Edit tour

Windows Analysis Report
good.exe

Overview

General Information

Sample name:	good.exe
Analysis ID:	1581361
MD5:	b0efb1607c79e9b10704200ab7b0e829
SHA1:	0833a6be6db50af933e9f13cc08baf4c68af1d77
SHA256:	9c02c287b340422b6a1c138e6d20a2ce77944fdf31953b5826a6ffb535d4867e
Tags:	exemalwaretrojanuser-Joker
Infos:

Detection

PureLog Stealer, zgRAT

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected PureLog Stealer

Yara detected UAC Bypass using CMSTP

Yara detected zgRAT

.NET source code contains method to dynamically call methods (often used by packers)

AI detected suspicious sample

Found many strings related to Crypto-Wallets (likely being stolen)

Machine Learning detection for sample

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Self deletion via cmd or bat file

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal browser information (history, passwords, etc)

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Queries information about the installed CPU (vendor, model number etc)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

good.exe (PID: 1584 cmdline: "C:\Users\user\Desktop\good.exe" MD5: B0EFB1607C79E9B10704200AB7B0E829)

cmd.exe (PID: 4992 cmdline: "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\user\Desktop\good.exe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5248 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

choice.exe (PID: 6436 cmdline: choice /C Y /N /D Y /T 3 MD5: 1A9804F0C374283B094E9E55DC5EE128)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
zgRAT	zgRAT is a Remote Access Trojan malware which sometimes drops other malware such as AgentTesla malware. zgRAT has an inforstealer use which targets browser information and cryptowallets.Usually spreads by USB or phishing emails with -zip/-lnk/.bat/.xlsx attachments and so on.	No Attribution	https://bazaar.abuse.ch/browse/signature/zgRAT/ https://kcm.trellix.com/corporate/index?page=content&id=KB96190&locale=en_US https://www.cloudsek.com/blog/threat-actors-abuse-ai-generated-youtube-videos-to-spread-stealer-malware https://www.difesaesicurezza.com/cyber/cybercrime-rfq-dalla-turchia-veicola-agenttesla-e-zgrat/ https://www.fortinet.com/blog/threat-research/smokeloader-using-old-vulnerabilities	https://malpedia.caad.fkie.fraunhofer.de/details/win.zgrat

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
good.exe	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
good.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
good.exe	MALWARE_Win_zgRAT	Detects zgRAT	ditekSHen	0x5624b:$s1: file:/// 0x56137:$s2: {11111-22222-10009-11112} 0x561db:$s3: {11111-22222-50001-00000} 0x51917:$s4: get_Module 0x51ff7:$s5: Reverse 0x4bebb:$s6: BlockCopy 0x5246f:$s7: ReadByte 0x5625d:$s8: 4C 00 6F 00 63 00 61 00 74 00 69 00 6F 00 6E 00 00 0B 46 00 69 00 6E 00 64 00 20 00 00 13 52 00 65 00 73 00 6F 00 75 00 72 00 63 00 65 00 41 00 00 11 56 00 69 00 72 00 74 00 75 00 61 00 6C 00 ...

Memory Dumps

Source	Rule	Description	Author
00000000.00000000.2096423020.00000227F6852000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000000.00000002.2201147807.0000022780001000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.2201147807.0000022780001000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
Process Memory Space: good.exe PID: 1584	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: good.exe PID: 1584	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
0.0.good.exe.227f6850000.0.unpack	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
0.0.good.exe.227f6850000.0.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.0.good.exe.227f6850000.0.unpack	MALWARE_Win_zgRAT	Detects zgRAT	ditekSHen	0x5624b:$s1: file:/// 0x56137:$s2: {11111-22222-10009-11112} 0x561db:$s3: {11111-22222-50001-00000} 0x51917:$s4: get_Module 0x51ff7:$s5: Reverse 0x4bebb:$s6: BlockCopy 0x5246f:$s7: ReadByte 0x5625d:$s8: 4C 00 6F 00 63 00 61 00 74 00 69 00 6F 00 6E 00 00 0B 46 00 69 00 6E 00 64 00 20 00 00 13 52 00 65 00 73 00 6F 00 75 00 72 00 63 00 65 00 41 00 00 11 56 00 69 00 72 00 74 00 75 00 61 00 6C 00 ...

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: good.exe

Avira: detected

Multi AV Scanner detection for submitted file

Source: good.exe	ReversingLabs: Detection: 63%
Source: good.exe	Virustotal: Detection: 68%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: good.exe

Joe Sandbox ML: detected

Exploits

Yara detected UAC Bypass using CMSTP

Source: Yara match	File source: 00000000.00000002.2201147807.0000022780001000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: good.exe PID: 1584, type: MEMORYSTR

Source: good.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: good.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\good.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\	Jump to behavior
Source: C:\Users\user\Desktop\good.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Cache\	Jump to behavior
Source: C:\Users\user\Desktop\good.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\	Jump to behavior
Source: C:\Users\user\Desktop\good.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\	Jump to behavior
Source: C:\Users\user\Desktop\good.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\	Jump to behavior
Source: C:\Users\user\Desktop\good.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\	Jump to behavior

Source: global traffic

TCP traffic: 192.168.2.6:49700 -> 147.45.44.151:5555

Source: global traffic

HTTP traffic detected: GET /json/ HTTP/1.1Content-Type: application/jsonHost: ip-api.comConnection: Keep-Alive

Source: Joe Sandbox View

IP Address: 208.95.112.1 208.95.112.1

Source: unknown

DNS query: name: ip-api.com

Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.151
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.151
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.151
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.151
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.151
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.151
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.151
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.151
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.151
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.151
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.151
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.151
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.151
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.151
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.151
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.151
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.151
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.151
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.151
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.151
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.151
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.151
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.151
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.151
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.151
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.151
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.151
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.151
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.151
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.151
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.151
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.151
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.151
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.151
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.151
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.151
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.151
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.151
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.151
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.151
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.151
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.151
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.151
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.151
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.151
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.151
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.151
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.151
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.151
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.151

Source: global traffic

HTTP traffic detected: GET /json/ HTTP/1.1Content-Type: application/jsonHost: ip-api.comConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: ip-api.com
Source: global traffic	DNS traffic detected: DNS query: holykap.cfd

Source: good.exe, 00000000.00000002.2201147807.0000022780A74000.00000004.00000800.00020000.00000000.sdmp, good.exe, 00000000.00000002.2201147807.0000022780470000.00000004.00000800.00020000.00000000.sdmp, good.exe, 00000000.00000002.2201147807.0000022780A8E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com
Source: good.exe, 00000000.00000002.2201147807.0000022780470000.00000004.00000800.00020000.00000000.sdmp, good.exe, 00000000.00000002.2201147807.0000022780A47000.00000004.00000800.00020000.00000000.sdmp, good.exe, 00000000.00000002.2201147807.0000022780001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com/json/
Source: good.exe, 00000000.00000002.2201147807.0000022780001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: good.exe, 00000000.00000002.2206337295.0000022790088000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: good.exe, 00000000.00000002.2206337295.0000022790088000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: good.exe, 00000000.00000002.2206337295.0000022790088000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: good.exe, 00000000.00000002.2206337295.0000022790088000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: good.exe, 00000000.00000002.2206337295.0000022790088000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: good.exe, 00000000.00000002.2206337295.0000022790088000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: good.exe, 00000000.00000002.2206337295.0000022790088000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: good.exe, 00000000.00000002.2201147807.0000022780641000.00000004.00000800.00020000.00000000.sdmp, good.exe, 00000000.00000002.2201147807.00000227806E3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://holykap.cfd
Source: good.exe, 00000000.00000002.2201147807.0000022780641000.00000004.00000800.00020000.00000000.sdmp, good.exe, 00000000.00000002.2201147807.00000227806E3000.00000004.00000800.00020000.00000000.sdmp, good.exe, 00000000.00000002.2201147807.0000022780001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://holykap.cfd/done.exe
Source: good.exe, 00000000.00000002.2206337295.0000022790088000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: good.exe, 00000000.00000002.2206337295.0000022790088000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico

System Summary

Malicious sample detected (through community Yara rule)

Source: good.exe, type: SAMPLE	Matched rule: Detects zgRAT Author: ditekSHen
Source: 0.0.good.exe.227f6850000.0.unpack, type: UNPACKEDPE	Matched rule: Detects zgRAT Author: ditekSHen

Source: C:\Users\user\Desktop\good.exe	Code function: 0_2_00007FFD348A28FA	0_2_00007FFD348A28FA
Source: C:\Users\user\Desktop\good.exe	Code function: 0_2_00007FFD34B0B0D0	0_2_00007FFD34B0B0D0
Source: C:\Users\user\Desktop\good.exe	Code function: 0_2_00007FFD34B048B1	0_2_00007FFD34B048B1
Source: C:\Users\user\Desktop\good.exe	Code function: 0_2_00007FFD34B17259	0_2_00007FFD34B17259
Source: C:\Users\user\Desktop\good.exe	Code function: 0_2_00007FFD34B11F08	0_2_00007FFD34B11F08
Source: C:\Users\user\Desktop\good.exe	Code function: 0_2_00007FFD34B166CD	0_2_00007FFD34B166CD
Source: C:\Users\user\Desktop\good.exe	Code function: 0_2_00007FFD34B08270	0_2_00007FFD34B08270
Source: C:\Users\user\Desktop\good.exe	Code function: 0_2_00007FFD34B11E90	0_2_00007FFD34B11E90
Source: C:\Users\user\Desktop\good.exe	Code function: 0_2_00007FFD34B007DD	0_2_00007FFD34B007DD
Source: C:\Users\user\Desktop\good.exe	Code function: 0_2_00007FFD34B19811	0_2_00007FFD34B19811
Source: C:\Users\user\Desktop\good.exe	Code function: 0_2_00007FFD34B05369	0_2_00007FFD34B05369
Source: C:\Users\user\Desktop\good.exe	Code function: 0_2_00007FFD34B0DBD0	0_2_00007FFD34B0DBD0
Source: C:\Users\user\Desktop\good.exe	Code function: 0_2_00007FFD34B0283C	0_2_00007FFD34B0283C

Source: good.exe, 00000000.00000000.2096423020.00000227F6852000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameSteal1.exe, vs good.exe
Source: good.exe, 00000000.00000002.2272842234.00000227F94EB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs good.exe
Source: good.exe	Binary or memory string: OriginalFilenameSteal1.exe, vs good.exe

Source: good.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: good.exe, type: SAMPLE	Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
Source: 0.0.good.exe.227f6850000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT

Source: good.exe, FMIJCCJDKMPOHDNPCEAGFDMNEAPEGCIPGDDK.cs	Cryptographic APIs: 'CreateDecryptor'
Source: good.exe, FMIJCCJDKMPOHDNPCEAGFDMNEAPEGCIPGDDK.cs	Cryptographic APIs: 'CreateDecryptor'

Source: classification engine

Classification label: mal100.troj.spyw.expl.evad.winEXE@6/1@2/2

Source: C:\Users\user\Desktop\good.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\good.exe.log

Jump to behavior

Source: C:\Users\user\Desktop\good.exe	Mutant created: NULL
Source: C:\Users\user\Desktop\good.exe	Mutant created: \Sessions\1\BaseNamedObjects\ppmOSIuxNVbQSxG
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5248:120:WilError_03

Source: C:\Users\user\Desktop\good.exe

File created: C:\Users\user\AppData\Local\Temp\a3yrqkms.0vs.exe

Jump to behavior

Source: good.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: good.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%

Source: C:\Users\user\Desktop\good.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\good.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\good.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: good.exe, 00000000.00000002.2201147807.000002278006C000.00000004.00000800.00020000.00000000.sdmp, good.exe, 00000000.00000002.2201147807.0000022780060000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: good.exe	ReversingLabs: Detection: 63%
Source: good.exe	Virustotal: Detection: 68%

Source: unknown	Process created: C:\Users\user\Desktop\good.exe "C:\Users\user\Desktop\good.exe"
Source: C:\Users\user\Desktop\good.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\user\Desktop\good.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\choice.exe choice /C Y /N /D Y /T 3
Source: C:\Users\user\Desktop\good.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\user\Desktop\good.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\choice.exe choice /C Y /N /D Y /T 3	Jump to behavior

Source: C:\Users\user\Desktop\good.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\good.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\good.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\good.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\good.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\good.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\good.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\good.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\good.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\good.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\good.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\good.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\good.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\good.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\good.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\good.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\good.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\good.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\good.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\good.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\good.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\good.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\good.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\good.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\good.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\good.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\good.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\good.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\good.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\good.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\good.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\good.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\good.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\good.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\good.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\good.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\good.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\good.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\good.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\good.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\good.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\good.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\good.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\good.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\good.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\good.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\good.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\good.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\choice.exe	Section loaded: version.dll	Jump to behavior

Source: C:\Users\user\Desktop\good.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: good.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: good.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation

.NET source code contains method to dynamically call methods (often used by packers)

Source: good.exe, FMIJCCJDKMPOHDNPCEAGFDMNEAPEGCIPGDDK.cs

.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})

Source: good.exe

Static PE information: 0xE702F9E4 [Sat Oct 25 00:12:20 2092 UTC]

Source: C:\Users\user\Desktop\good.exe	Code function: 0_2_00007FFD348A00BD pushad ; iretd	0_2_00007FFD348A00C1
Source: C:\Users\user\Desktop\good.exe	Code function: 0_2_00007FFD348AA7E7 push edi; ret	0_2_00007FFD348AA7ED
Source: C:\Users\user\Desktop\good.exe	Code function: 0_2_00007FFD348A9FEC push ebp; retf	0_2_00007FFD348A9FEF
Source: C:\Users\user\Desktop\good.exe	Code function: 0_2_00007FFD34B1A4D8 push eax; retn 34B9h	0_2_00007FFD34B25D39
Source: C:\Users\user\Desktop\good.exe	Code function: 0_2_00007FFD34B1BC78 push eax; ret	0_2_00007FFD34B1BC54
Source: C:\Users\user\Desktop\good.exe	Code function: 0_2_00007FFD34B1BC2D push eax; ret	0_2_00007FFD34B1BC54

Hooking and other Techniques for Hiding and Protection

Self deletion via cmd or bat file

Source: C:\Users\user\Desktop\good.exe	Process created: "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\user\Desktop\good.exe"
Source: C:\Users\user\Desktop\good.exe	Process created: "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\user\Desktop\good.exe"			Jump to behavior

Source: C:\Users\user\Desktop\good.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\good.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\good.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\good.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\good.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\good.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\good.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\good.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\good.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\good.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\good.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\good.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\good.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\good.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\good.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\good.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\good.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\good.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\good.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\good.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\good.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\good.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\good.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\good.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\good.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\good.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\good.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\good.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\good.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\good.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\good.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\good.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\good.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\good.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\good.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\good.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\good.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\good.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\good.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\good.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\good.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\good.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\good.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\good.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\good.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\good.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\good.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\good.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\good.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\good.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\good.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\good.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\good.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\good.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\good.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\good.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\good.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\good.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\good.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\good.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\good.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\good.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\good.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\good.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\good.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\good.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\good.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\good.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\good.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\good.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\good.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\good.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\good.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\good.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\good.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\good.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\good.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\good.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\good.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\good.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\good.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\good.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\good.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\good.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\good.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\good.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\good.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\good.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\good.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\good.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\good.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\good.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\good.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\good.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\Desktop\good.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\good.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: good.exe, 00000000.00000002.2201147807.0000022780001000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: SBIEDLL.DLL

Source: C:\Users\user\Desktop\good.exe	Memory allocated: 227F6BF0000 memory reserve \| memory write watch			Jump to behavior
Source: C:\Users\user\Desktop\good.exe	Memory allocated: 227F8690000 memory reserve \| memory write watch			Jump to behavior

Source: C:\Users\user\Desktop\good.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Users\user\Desktop\good.exe	Window / User API: threadDelayed 2675			Jump to behavior
Source: C:\Users\user\Desktop\good.exe	Window / User API: threadDelayed 6611			Jump to behavior

Source: C:\Users\user\Desktop\good.exe TID: 2732

Thread sleep time: -24903104499507879s >= -30000s

Jump to behavior

Source: C:\Users\user\Desktop\good.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * From Win32_ComputerSystem

Source: C:\Users\user\Desktop\good.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\good.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Users\user\Desktop\good.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\	Jump to behavior
Source: C:\Users\user\Desktop\good.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Cache\	Jump to behavior
Source: C:\Users\user\Desktop\good.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\	Jump to behavior
Source: C:\Users\user\Desktop\good.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\	Jump to behavior
Source: C:\Users\user\Desktop\good.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\	Jump to behavior
Source: C:\Users\user\Desktop\good.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\	Jump to behavior

Source: good.exe, 00000000.00000002.2206337295.000002279006B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696487552
Source: good.exe, 00000000.00000002.2206337295.000002279006B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696487552\|UE
Source: good.exe, 00000000.00000002.2206337295.000002279006B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696487552u
Source: good.exe, 00000000.00000002.2206337295.000002279006B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696487552f
Source: good.exe, 00000000.00000002.2206337295.000002279006B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696487552x
Source: good.exe, 00000000.00000002.2201147807.0000022780001000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: hyper-v
Source: good.exe, 00000000.00000002.2206337295.000002279006B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696487552}
Source: good.exe, 00000000.00000002.2206337295.000002279006B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696487552
Source: good.exe, 00000000.00000002.2206337295.000002279006B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552
Source: good.exe, 00000000.00000002.2206337295.000002279006B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696487552
Source: good.exe, 00000000.00000002.2206337295.000002279006B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696487552
Source: good.exe, 00000000.00000002.2206337295.000002279006B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696487552o
Source: good.exe, 00000000.00000002.2206337295.000002279006B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696487552
Source: good.exe, 00000000.00000002.2206337295.000002279006B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696487552d
Source: good.exe, 00000000.00000002.2206337295.000002279006B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696487552
Source: good.exe, 00000000.00000002.2206337295.000002279006B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696487552j
Source: good.exe, 00000000.00000002.2206337295.000002279006B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696487552]
Source: good.exe, 00000000.00000002.2206337295.000002279006B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696487552x
Source: good.exe, 00000000.00000002.2201147807.0000022780001000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmware
Source: good.exe, 00000000.00000002.2206337295.000002279006B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696487552
Source: good.exe, 00000000.00000002.2206337295.000002279006B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696487552h
Source: good.exe, 00000000.00000002.2206337295.000002279006B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696487552z
Source: good.exe, 00000000.00000002.2206337295.000002279006B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696487552~
Source: good.exe, 00000000.00000002.2206337295.000002279006B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696487552t
Source: good.exe, 00000000.00000002.2271868889.00000227F8FD2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll3
Source: good.exe, 00000000.00000002.2206337295.000002279006B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552^
Source: good.exe, 00000000.00000002.2206337295.000002279006B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696487552p
Source: good.exe, 00000000.00000002.2206337295.000002279006B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696487552n
Source: good.exe, 00000000.00000002.2206337295.000002279006B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696487552s
Source: good.exe, 00000000.00000002.2206337295.000002279006B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696487552
Source: good.exe, 00000000.00000002.2206337295.000002279006B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696487552t
Source: good.exe, 00000000.00000002.2206337295.000002279006B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696487552x
Source: good.exe, 00000000.00000002.2206337295.000002279006B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696487552}
Source: good.exe, 00000000.00000002.2206337295.000002279006B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696487552

Source: C:\Users\user\Desktop\good.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\good.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\good.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\good.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\user\Desktop\good.exe"			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\choice.exe choice /C Y /N /D Y /T 3			Jump to behavior

Source: C:\Users\user\Desktop\good.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\good.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\good.exe	Queries volume information: C:\Users\user\Desktop\good.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\good.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\good.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\good.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\good.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Compression\v4.0_4.0.0.0__b77a5c561934e089\System.IO.Compression.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\good.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\good.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\good.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: good.exe, 00000000.00000002.2271868889.00000227F8FD2000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\Desktop\good.exe

WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected PureLog Stealer

Source: Yara match	File source: good.exe, type: SAMPLE
Source: Yara match	File source: 0.0.good.exe.227f6850000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.2096423020.00000227F6852000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY

Yara detected zgRAT

Source: Yara match	File source: good.exe, type: SAMPLE
Source: Yara match	File source: 0.0.good.exe.227f6850000.0.unpack, type: UNPACKEDPE

Found many strings related to Crypto-Wallets (likely being stolen)

Source: good.exe, 00000000.00000002.2201147807.0000022780470000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Electrum
Source: good.exe, 00000000.00000002.2201147807.0000022780470000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 5\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb
Source: good.exe, 00000000.00000002.2201147807.0000022780470000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: \Exodus\exodus.wallet
Source: good.exe, 00000000.00000002.2201147807.0000022780470000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: \Ethereum\keystore
Source: good.exe, 00000000.00000002.2201147807.0000022780470000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Exodus
Source: good.exe, 00000000.00000002.2201147807.0000022780470000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Ethereum
Source: good.exe, 00000000.00000002.2201147807.0000022780470000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: \Coinomi\Coinomi\wallets
Source: good.exe, 00000000.00000002.2201147807.0000022780470000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: \Ethereum\keystore

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\good.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\good.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\good.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\good.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\good.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior

Source: Yara match	File source: 00000000.00000002.2201147807.0000022780001000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: good.exe PID: 1584, type: MEMORYSTR

Remote Access Functionality

Yara detected PureLog Stealer

Source: Yara match	File source: good.exe, type: SAMPLE
Source: Yara match	File source: 0.0.good.exe.227f6850000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.2096423020.00000227F6852000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY

Yara detected zgRAT

Source: Yara match	File source: good.exe, type: SAMPLE
Source: Yara match	File source: 0.0.good.exe.227f6850000.0.unpack, type: UNPACKEDPE

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	131 Windows Management Instrumentation	1 DLL Side-Loading	11 Process Injection	1 Masquerading	1 OS Credential Dumping	241 Security Software Discovery	Remote Services	11 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Disable or Modify Tools	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	2 Data from Local System	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	151 Virtualization/Sandbox Evasion	Security Account Manager	151 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 System Network Configuration Discovery	SSH	Keylogging	2 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Obfuscated Files or Information	Cached Domain Credentials	2 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Software Packing	DCSync	33 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Timestomp	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 DLL Side-Loading	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	1 File Deletion	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
good.exe	63%	ReversingLabs	ByteCode-MSIL.Trojan.Mardom
good.exe	68%	Virustotal		Browse
good.exe	100%	Avira	TR/Dropper.Gen
good.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label	Link
https://holykap.cfd	0%	Avira URL Cloud	safe
https://holykap.cfd/done.exe	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
ip-api.com	208.95.112.1	true	false		high
holykap.cfd	unknown	unknown	false		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://ip-api.com/json/	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://ac.ecosia.org/autocomplete?q=	good.exe, 00000000.00000002.2206337295.0000022790088000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/chrome_newtab	good.exe, 00000000.00000002.2206337295.0000022790088000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	good.exe, 00000000.00000002.2206337295.0000022790088000.00000004.00000800.00020000.00000000.sdmp	false		high
https://holykap.cfd/done.exe	good.exe, 00000000.00000002.2201147807.0000022780641000.00000004.00000800.00020000.00000000.sdmp, good.exe, 00000000.00000002.2201147807.00000227806E3000.00000004.00000800.00020000.00000000.sdmp, good.exe, 00000000.00000002.2201147807.0000022780001000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	good.exe, 00000000.00000002.2206337295.0000022790088000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	good.exe, 00000000.00000002.2206337295.0000022790088000.00000004.00000800.00020000.00000000.sdmp	false		high
https://holykap.cfd	good.exe, 00000000.00000002.2201147807.0000022780641000.00000004.00000800.00020000.00000000.sdmp, good.exe, 00000000.00000002.2201147807.00000227806E3000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ip-api.com	good.exe, 00000000.00000002.2201147807.0000022780A74000.00000004.00000800.00020000.00000000.sdmp, good.exe, 00000000.00000002.2201147807.0000022780470000.00000004.00000800.00020000.00000000.sdmp, good.exe, 00000000.00000002.2201147807.0000022780A8E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	good.exe, 00000000.00000002.2206337295.0000022790088000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	good.exe, 00000000.00000002.2206337295.0000022790088000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/	good.exe, 00000000.00000002.2206337295.0000022790088000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	good.exe, 00000000.00000002.2201147807.0000022780001000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	good.exe, 00000000.00000002.2206337295.0000022790088000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
208.95.112.1	ip-api.com	United States		53334	TUT-ASUS	false
147.45.44.151	unknown	Russian Federation		2895	FREE-NET-ASFREEnetEU	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1581361
Start date and time:	2024-12-27 14:03:05 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 15s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	good.exe
Detection:	MAL
Classification:	mal100.troj.spyw.expl.evad.winEXE@6/1@2/2
EGA Information:	Failed
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 13.107.246.63, 172.202.163.200
Excluded domains from analysis (whitelisted): ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target good.exe, PID 1584 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
08:03:54	API Interceptor	73x Sleep call for process: good.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
208.95.112.1	Client-built.exe	Get hash	malicious	Quasar	Browse	ip-api.com/json/
	DHL AWB-documents.lnk	Get hash	malicious	Divulge Stealer	Browse	ip-api.com/json/?fields=225545
	main.exe	Get hash	malicious	Python Stealer, Discord Token Stealer, PRYSMAX STEALER	Browse	ip-api.com/json/8.46.123.189?fields=192511
	main.exe	Get hash	malicious	Unknown	Browse	ip-api.com/json/8.46.123.189?fields=192511
	HX Design.exe	Get hash	malicious	Python Stealer, Blank Grabber	Browse	ip-api.com/json/?fields=225545
	dF66DKQP7u.exe	Get hash	malicious	XWorm	Browse	ip-api.com/line/?fields=hosting
	2QaN4hOyJs.exe	Get hash	malicious	XWorm	Browse	ip-api.com/line/?fields=hosting
	fvbhdyuJYi.exe	Get hash	malicious	XWorm	Browse	ip-api.com/line/?fields=hosting
	8DiSW8IPEF.exe	Get hash	malicious	XWorm	Browse	ip-api.com/line/?fields=hosting
	twE44mm07j.exe	Get hash	malicious	XWorm	Browse	ip-api.com/line/?fields=hosting
147.45.44.151	Wh2c6sgwRo.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ip-api.com	Client-built.exe	Get hash	malicious	Quasar	Browse	208.95.112.1
	DHL AWB-documents.lnk	Get hash	malicious	Divulge Stealer	Browse	208.95.112.1
	main.exe	Get hash	malicious	Python Stealer, Discord Token Stealer, PRYSMAX STEALER	Browse	208.95.112.1
	main.exe	Get hash	malicious	Unknown	Browse	208.95.112.1
	HX Design.exe	Get hash	malicious	Python Stealer, Blank Grabber	Browse	208.95.112.1
	dF66DKQP7u.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
	2QaN4hOyJs.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
	fvbhdyuJYi.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
	8DiSW8IPEF.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
	twE44mm07j.exe	Get hash	malicious	XWorm	Browse	208.95.112.1

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TUT-ASUS	http://au.kirmalk.com/watch.php?vid=7750fd3c8	Get hash	malicious	Unknown	Browse	162.252.214.4
	Client-built.exe	Get hash	malicious	Quasar	Browse	208.95.112.1
	DHL AWB-documents.lnk	Get hash	malicious	Divulge Stealer	Browse	208.95.112.1
	main.exe	Get hash	malicious	Python Stealer, Discord Token Stealer, PRYSMAX STEALER	Browse	208.95.112.1
	main.exe	Get hash	malicious	Unknown	Browse	208.95.112.1
	HX Design.exe	Get hash	malicious	Python Stealer, Blank Grabber	Browse	208.95.112.1
	file.exe	Get hash	malicious	LummaC, Amadey, AsyncRAT, LummaC Stealer, XWorm	Browse	208.95.112.1
	dF66DKQP7u.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
	2QaN4hOyJs.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
	fvbhdyuJYi.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
FREE-NET-ASFREEnetEU	n5Szx8qsFB.lnk	Get hash	malicious	Unknown	Browse	147.45.49.155
	7ZAg3nl9Fu.exe	Get hash	malicious	Unknown	Browse	147.45.44.166
	7ZAg3nl9Fu.exe	Get hash	malicious	Unknown	Browse	147.45.44.166
	HOrW5twCLd.exe	Get hash	malicious	XenoRAT	Browse	147.45.69.75
	cMTqzvmx9u.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RedLine	Browse	147.45.44.224
	qoqD1RxV0F.exe	Get hash	malicious	LummaC	Browse	147.45.44.131
	iviewers.dll	Get hash	malicious	LummaC	Browse	147.45.44.131
	Collapse.exe	Get hash	malicious	LummaC	Browse	147.45.47.81
	nTyPEbq9wQ.lnk	Get hash	malicious	Unknown	Browse	147.45.49.155
	7A2lfjTYNf.lnk	Get hash	malicious	Unknown	Browse	147.45.49.155

Process:	C:\Users\user\Desktop\good.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2045
Entropy (8bit):	5.3618187964722885
Encrypted:	false
SSDEEP:	48:MxHKQRJHiYHKGSI6oQHZHitHTHhAHKKkrHKoLHqHpHNp51qHGIs0HKD:iqECYqGSI6oQ5CtzHeqKkrqoLKJtp5w6
MD5:	E4A526604AB58CC5D8DD7B1DF0F4865A
SHA1:	DC2F6C1CE6CE8F6B3E39892724EC084E34D3964B
SHA-256:	8537FDE13C590680C5B06741BCEF76EC70389C8C9C71432900DEDE9BAFE3E665
SHA-512:	890547801EE6C92A6760B5EAFE45035A3FC3A6B6B7BFD33FCDEC646F006494B00B3452EE032E9BE7B6893A55BC539978EEABF888C7DBD4425BAF1FC8679F22C9
Malicious:	true
Reputation:	low
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..2,"System.Security, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..2,"System.Web.Extensions, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",0..2,"System.Web, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Configuration\915c1ee906bd8dfc15398a4bab4acb48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e0

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	5.93471630763831
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	good.exe
File size:	401'920 bytes
MD5:	b0efb1607c79e9b10704200ab7b0e829
SHA1:	0833a6be6db50af933e9f13cc08baf4c68af1d77
SHA256:	9c02c287b340422b6a1c138e6d20a2ce77944fdf31953b5826a6ffb535d4867e
SHA512:	2a1f202564d579921d786ab76c20b63f396e89375a5a88341a4828fa43df4442cd5c5ae018578b7f2d3a48c7d7a247e75bb65bdc1486256e5889bb576f62a302
SSDEEP:	6144:bR6qas733r8NIHxPgHSp5CGCNN4N+F/TuNFis6Nl3D95IDNpUs0tEg4Ntx:Azs7n5OGCNN4N+F/Taj6Vod0ig4B
TLSH:	06841A1BBA02CD51C2489736D5DF400893F5D581735BDA0E7DCE23E609433BBE94AAAB
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....................0.............>6... ...@....@.. ....................................`................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x46363e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0xE702F9E4 [Sat Oct 25 00:12:20 2092 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x635f0	0x4b	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x64000	0x590	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x66000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x61644	0x61800	a1df6b260cc8146421b87a313005d3e5	False	0.45899939903846154	data	5.94477978233479	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x64000	0x590	0x600	82c39eea34ce07077166e5c598e90129	False	0.4166666666666667	data	4.025634807679199	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x66000	0xc	0x200	4d5b6b8883a6d8cd281aeb5bfd586d20	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x640a0	0x304	data			0.4339378238341969
RT_MANIFEST	0x643a4	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 27, 2024 14:03:57.162843943 CET	49699	80	192.168.2.6	208.95.112.1
Dec 27, 2024 14:03:57.282510042 CET	80	49699	208.95.112.1	192.168.2.6
Dec 27, 2024 14:03:57.282701015 CET	49699	80	192.168.2.6	208.95.112.1
Dec 27, 2024 14:03:57.283734083 CET	49699	80	192.168.2.6	208.95.112.1
Dec 27, 2024 14:03:57.403289080 CET	80	49699	208.95.112.1	192.168.2.6
Dec 27, 2024 14:03:58.578804970 CET	80	49699	208.95.112.1	192.168.2.6
Dec 27, 2024 14:03:58.621751070 CET	49699	80	192.168.2.6	208.95.112.1
Dec 27, 2024 14:03:59.509192944 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:03:59.629105091 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:03:59.629272938 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:03:59.629791021 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:03:59.630434036 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:03:59.751399994 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:03:59.751465082 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:03:59.752130032 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:03:59.752190113 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:03:59.752249956 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:03:59.752279997 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:03:59.752327919 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:03:59.752342939 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:03:59.752346992 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:03:59.752371073 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:03:59.752393961 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:03:59.752420902 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:03:59.752429962 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:03:59.752449036 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:03:59.752469063 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:03:59.752505064 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:03:59.752564907 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:03:59.752593040 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:03:59.752612114 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:03:59.752639055 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:03:59.873208046 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:03:59.873317003 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:03:59.874234915 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:03:59.874264002 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:03:59.874280930 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:03:59.874347925 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:03:59.874392033 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:03:59.874420881 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:03:59.874439001 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:03:59.874454975 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:03:59.874469995 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:03:59.874505997 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:03:59.922157049 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:03:59.922337055 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:00.036524057 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.036640882 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:00.084486961 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.084542990 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:00.200428009 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.200525999 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:00.288393974 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.288450956 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:00.444463968 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.444633961 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:00.612430096 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.612874031 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:00.612934113 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:00.732579947 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.732604027 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.732685089 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.732728004 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.732785940 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:00.732826948 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.732856989 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.732872009 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:00.732901096 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:00.732908964 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.732954979 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:00.732990026 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.733037949 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:00.733053923 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.733062983 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.733097076 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:00.733165026 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.733172894 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.733222961 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:00.733299017 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.733349085 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:00.733385086 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.733432055 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:00.733494043 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.733546019 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:00.733565092 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.733618021 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:00.733664036 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.733712912 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:00.733721972 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.733771086 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:00.733804941 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.733855963 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:00.733913898 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.733947992 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.733954906 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:00.733994007 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:00.734009981 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.734055042 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:00.734107971 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.734153032 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:00.734210014 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.734252930 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:00.734261990 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.734302998 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:00.734414101 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.734441042 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.734452963 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:00.734477997 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:00.734519005 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.734568119 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:00.734616995 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.734657049 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:00.734735966 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.734766960 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.734781027 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:00.734808922 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:00.734874964 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.734915018 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:00.776443005 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.776618004 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:00.853543043 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.853620052 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.853652000 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:00.853667021 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:00.854135036 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.854176998 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:00.854789972 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.854851007 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:00.855384111 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.855429888 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:00.855839968 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.855890989 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:00.855920076 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.855959892 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:00.855974913 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.856018066 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:00.856451988 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.856507063 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:00.856576920 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.856622934 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:00.857053041 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.857093096 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:00.857121944 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.857166052 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:00.857561111 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.857609034 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:00.857633114 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.857641935 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.857686996 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:00.858215094 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.858239889 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.858262062 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:00.858272076 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:00.858282089 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.858304977 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.858326912 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:00.858340979 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.858351946 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:00.858401060 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:00.858628035 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.858669996 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:00.858702898 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.858711004 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.858725071 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.858762980 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:00.858777046 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:00.859165907 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.859174967 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.859217882 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.859227896 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:00.859247923 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.859266996 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:00.859285116 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.859302998 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:00.859324932 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:00.859745979 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.859754086 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.859805107 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:00.860440969 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.860457897 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.860491037 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:00.860505104 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:00.860595942 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.860605001 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.860655069 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:00.860690117 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.860735893 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:00.860757113 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.860765934 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.860801935 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.860809088 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:00.860851049 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:00.860923052 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.860932112 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.860937119 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.860984087 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:00.860985041 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.861037970 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:00.861078978 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.861087084 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.861133099 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:00.861171961 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.861180067 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.861227989 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:00.861229897 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.861274004 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:00.861274004 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.861283064 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.861331940 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:00.861457109 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.861464977 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.861512899 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:00.861586094 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.861594915 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.861633062 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:00.861674070 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.861711025 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.861717939 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:00.861757994 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:00.861849070 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.861857891 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.861911058 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:00.862015009 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.862060070 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.862062931 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:00.862102985 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:00.862139940 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.862149954 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.862194061 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:00.862226963 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.862243891 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.862277031 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:00.896158934 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.896430016 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:00.922677994 CET	49699	80	192.168.2.6	208.95.112.1
Dec 27, 2024 14:04:00.973256111 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.973349094 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.973360062 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.973366022 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.973380089 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:00.973442078 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:00.973644018 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.973691940 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:00.973779917 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.973829985 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:00.974304914 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.974356890 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:00.974431992 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.974473953 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:00.974893093 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.974940062 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:00.975080013 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.975125074 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:00.975368977 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.975436926 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.975450039 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:00.975481033 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:00.975491047 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.975514889 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.975537062 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:00.975555897 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:00.975577116 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.975621939 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:00.975692987 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.975773096 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:00.975987911 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.976030111 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:00.976042986 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.976085901 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:00.976221085 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.976229906 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.976273060 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:00.976593971 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.976646900 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:00.976723909 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.976736069 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.976768017 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:00.976783037 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:00.976824045 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.976866961 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:00.977200031 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.977243900 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:00.977286100 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.977324963 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.977339983 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:00.977368116 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:00.977458000 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.977509022 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:00.977541924 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.977551937 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.977591038 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:00.977761984 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.977806091 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:00.977909088 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.977946997 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.977951050 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:00.977984905 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.977992058 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:00.978024006 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:00.978024960 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.978070974 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:00.978130102 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.978138924 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.978178978 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:00.978239059 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.978261948 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.978280067 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:00.978296041 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:00.978384018 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.978394032 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.978432894 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:00.978461981 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.978501081 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:00.978527069 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.978573084 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:00.978590965 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.978600025 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.978638887 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:00.978725910 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.978734970 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.978739977 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.978780031 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:00.978784084 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.978822947 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.978827000 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:00.978866100 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:00.978878021 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.978919029 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:00.978933096 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.978941917 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.978984118 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:00.979049921 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.979072094 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.979094982 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:00.979161978 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.979170084 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.979197025 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:00.979212999 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:00.979268074 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.979276896 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.979331017 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:00.979372025 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.979381084 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.979384899 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.979433060 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:00.979995012 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.980010033 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.980037928 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:00.980051994 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:00.980110884 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.980154991 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:00.980190992 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.980225086 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.980232000 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:00.980264902 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:00.980365992 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.980377913 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.980420113 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:00.980475903 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.980500937 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.980520964 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:00.980545998 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:00.980562925 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.980571032 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.980607986 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:00.980631113 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.980652094 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.980673075 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:00.980695009 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:00.980734110 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.980741978 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.980787992 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:00.980793953 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.980815887 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.980834961 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:00.980860949 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:00.980865002 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.980887890 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.980905056 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:00.980921030 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:00.980987072 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.980995893 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.981038094 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:00.981045008 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.981096983 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:00.981121063 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.981162071 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:00.981163979 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.981210947 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:00.981245995 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.981254101 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.981275082 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.981297016 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:00.981332064 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:00.981410027 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.981419086 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.981426001 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.981435061 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.981457949 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:00.981475115 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:00.981506109 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.981514931 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.981519938 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.981551886 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.981565952 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:00.981599092 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:00.981633902 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.981643915 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.981683969 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:00.981761932 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.981770039 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.981810093 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.981811047 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:00.981818914 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.981859922 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:00.981889009 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.981920004 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.981934071 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:00.981960058 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:00.981991053 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.982003927 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.982049942 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:00.982052088 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.982060909 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.982103109 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:00.982218981 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.982228994 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.982237101 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.982248068 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.982254982 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.982275963 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:00.982295990 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:00.982321024 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:00.982346058 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.982358932 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.982362986 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.982409000 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.982413054 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:00.982417107 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.982425928 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.982433081 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.982464075 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:00.982537031 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.982544899 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.982553005 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.982558012 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.982573032 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.982582092 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.982598066 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:00.982618093 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:00.982634068 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:00.982680082 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.016845942 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.016957045 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.017869949 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.017920971 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.042618990 CET	80	49699	208.95.112.1	192.168.2.6
Dec 27, 2024 14:04:01.042697906 CET	49699	80	192.168.2.6	208.95.112.1
Dec 27, 2024 14:04:01.092904091 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.092969894 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.092988014 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.093008995 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.093033075 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.093060970 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.093086004 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.093117952 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.093130112 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.093151093 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.093157053 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.093175888 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.093195915 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.093228102 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.093250036 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.093291998 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.093329906 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.093338013 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.093380928 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.093425035 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.093432903 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.093476057 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.093802929 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.093818903 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.093868971 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.094048023 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.094057083 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.094105005 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.094605923 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.094654083 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.094665051 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.094706059 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.094841957 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.094851017 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.094897032 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.095227957 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.095276117 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.095304012 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.095310926 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.095349073 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.095351934 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.095396996 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.095411062 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.095418930 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.095459938 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.095462084 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.095501900 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.095578909 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.095588923 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.095622063 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.095635891 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.095650911 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.095659971 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.095675945 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.095712900 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.095865011 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.095904112 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.095940113 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.095948935 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.095992088 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.095994949 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.096038103 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.096160889 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.096170902 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.096211910 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.096245050 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.096254110 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.096296072 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.096616983 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.096625090 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.096667051 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.096674919 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.096700907 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.096710920 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.096745968 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.096767902 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.096776009 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.096817970 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.096820116 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.096848011 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.096868038 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.096893072 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.096916914 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.096963882 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.097033024 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.097043991 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.097080946 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.097110033 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.097117901 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.097158909 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.097166061 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.097207069 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.097290993 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.097300053 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.097307920 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.097332954 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.097352982 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.097410917 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.097419977 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.097453117 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.097462893 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.097461939 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.097498894 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.097512007 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.097570896 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.097579002 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.097620010 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.097665071 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.097709894 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.097714901 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.097748041 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.097760916 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.097785950 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.097834110 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.097842932 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.097881079 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.097918987 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.097968102 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.097969055 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.097992897 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.098009109 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.098026037 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.098074913 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.098109961 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.098119020 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.098123074 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.098157883 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.098232985 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.098242044 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.098282099 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.098287106 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.098290920 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.098330975 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.098351002 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.098371983 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.098396063 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.098514080 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.098522902 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.098565102 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.098566055 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.098614931 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.098628044 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.098635912 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.098684072 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.098710060 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.098718882 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.098757982 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.098761082 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.098782063 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.098802090 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.098826885 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.098895073 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.098936081 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.098937035 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.098946095 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.098951101 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.098980904 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.099004030 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.099123955 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.099132061 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.099189043 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.099193096 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.099231958 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.099261045 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.099270105 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.099303007 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.099317074 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.099344015 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.099348068 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.099394083 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.099402905 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.099442959 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.099447966 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.099498987 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.099524975 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.099534035 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.099541903 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.099571943 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.099601984 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.099648952 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.099649906 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.099674940 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.099695921 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.099715948 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.099724054 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.099770069 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.099797964 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.099802017 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.099844933 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.099870920 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.099916935 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.099987984 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.100008965 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.100027084 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.100044012 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.100075006 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.100119114 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.100214958 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.100260973 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.100286007 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.100332022 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.100461960 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.100470066 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.100511074 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.100521088 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.100529909 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.100572109 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.100584030 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.100591898 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.100634098 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.100712061 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.100752115 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.100758076 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.100796938 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.100831032 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.100840092 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.100883961 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.100929022 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.100960016 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.100974083 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.101007938 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.101022959 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.101063013 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.101066113 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.101114035 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.101144075 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.101151943 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.101190090 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.101222992 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.101233006 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.101262093 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.101279020 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.101279974 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.101327896 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.101334095 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.101377964 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.101393938 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.101408005 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.101434946 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.101449013 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.101478100 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.101486921 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.101535082 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.101567984 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.101577044 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.101625919 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.101634026 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.101651907 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.101682901 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.101735115 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.101743937 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.101783991 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.101811886 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.101830006 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.101855993 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.101875067 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.101888895 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.101941109 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.102051973 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.102062941 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.102071047 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.102104902 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.102109909 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.102139950 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.102149010 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.102186918 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.102195024 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.102220058 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.102235079 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.102266073 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.102292061 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.102299929 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.102341890 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.102375984 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.102418900 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.102425098 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.102467060 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.102478027 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.102494955 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.102521896 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.102550983 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.102560997 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.102598906 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.102641106 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.102679014 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.102683067 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.102720976 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.102807999 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.102842093 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.102853060 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.102886915 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.102994919 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.103034973 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.103038073 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.103080034 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.103107929 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.103125095 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.103149891 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.103166103 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.103245974 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.103266954 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.103287935 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.103303909 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.103390932 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.103399992 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.103444099 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.103518963 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.103528023 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.103569031 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.103611946 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.103646040 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.103656054 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.103683949 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.103720903 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.103759050 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.103777885 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.103827953 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.103866100 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.103889942 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.103909016 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.103926897 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.104034901 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.104043961 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.104084969 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.104160070 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.104202032 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.104209900 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.104249954 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.104281902 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.104310036 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.104321957 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.104356050 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.104473114 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.104481936 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.104522943 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.104557037 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.104604006 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.104620934 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.104665041 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.104722977 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.104732037 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.104765892 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.104878902 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.104887009 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.104932070 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.105019093 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.105027914 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.105065107 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.105071068 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.105074883 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.105115891 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.105158091 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.105169058 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.105210066 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.105238914 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.105247021 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.105262995 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.105271101 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.105289936 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.105304956 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.105324030 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.105339050 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.105365038 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.105381012 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.105448961 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.105464935 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.105484009 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.105496883 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.105597973 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.105606079 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.105644941 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.105659962 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.105669975 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.105706930 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.105736971 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.105746031 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.105775118 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.105788946 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.105808973 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.105814934 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.105830908 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.105873108 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.105891943 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.105901003 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.105942965 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.106009960 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.106018066 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.106056929 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.106081963 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.106112003 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.106123924 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.106142998 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.106151104 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.106152058 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.106192112 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.106211901 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.106236935 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.106251955 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.106287003 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.106355906 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.106364965 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.106401920 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.106429100 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.106450081 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.106471062 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.106503010 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.106555939 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.106564999 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.106594086 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.106606007 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.106606960 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.106643915 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.106679916 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.106688976 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.106733084 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.106745005 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.106758118 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.106786013 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.106808901 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.106829882 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.106837988 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.106846094 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.106859922 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.106883049 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.106908083 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.106949091 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.106957912 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.106998920 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.107028961 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.107037067 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.107057095 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.107074976 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.107091904 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.107098103 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.107141972 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.107145071 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.107161999 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.107183933 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.107202053 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.107208967 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.107249975 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.136483908 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.136548996 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.136571884 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.136612892 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.137332916 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.137373924 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.137492895 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.137536049 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.213536024 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.213546991 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.213589907 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.213609934 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.213614941 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.213654995 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.213660002 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.213694096 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.213696003 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.213711023 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.213737011 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.213749886 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.213774920 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.213783979 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.213821888 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.213849068 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.213857889 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.213902950 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.213916063 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.213958979 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.214987993 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.215023994 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.215038061 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.215066910 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.215071917 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.215080976 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.215117931 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.215178013 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.215187073 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.215228081 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.215229988 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.215241909 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.215262890 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.215270996 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.215284109 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.215296984 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.215316057 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.215344906 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.215872049 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.215922117 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.216092110 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.216100931 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.216139078 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.216142893 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.216151953 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.216197014 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.216222048 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.216231108 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.216273069 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.216275930 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.216293097 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.216321945 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.216335058 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.216398001 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.216445923 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.216532946 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.216579914 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.217149973 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.217190981 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.217200994 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.217240095 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.217257023 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.217293978 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.217298031 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.217324972 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.217333078 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.217336893 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.217406988 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.217431068 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.217439890 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.217482090 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.217550993 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.217560053 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.217578888 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.217602968 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.217622042 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.218915939 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.218933105 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.218957901 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.218960047 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.218970060 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.218976021 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.219000101 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.219010115 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.219132900 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.219135046 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.219135046 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.219161987 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.219193935 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.219337940 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.219347000 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.219389915 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.219407082 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.219415903 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.219445944 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.219460011 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.219480991 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.219518900 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.219527006 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.219569921 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.219685078 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.219693899 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.219732046 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.219767094 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.219786882 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.219810963 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.219822884 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.219862938 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.219904900 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.220491886 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.220500946 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.220545053 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.220557928 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.220566988 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.220575094 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.220585108 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.220611095 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.220628023 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.220628977 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.220638037 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.220647097 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.220673084 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.220683098 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.220726967 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.220777035 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.220786095 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.220861912 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.220870018 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.220890999 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.220900059 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.220900059 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.220913887 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.220925093 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.220941067 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.220966101 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.220973015 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.221009970 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.221091032 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.221100092 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.221141100 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.221158981 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.221168995 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.221209049 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.221313000 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.221357107 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.221538067 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.221545935 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.221587896 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.221600056 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.221616030 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.221637011 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.221657991 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.221662998 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.221667051 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.221709967 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.221739054 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.221750021 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.221788883 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.221821070 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.221828938 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.221853018 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.221862078 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.221872091 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.221880913 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.221894026 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.221920967 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.221929073 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.221939087 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.221986055 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.221999884 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.222007990 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.222040892 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.222048998 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.222049952 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.222074986 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.222084045 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.222095966 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.222130060 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.222178936 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.222196102 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.222222090 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.222235918 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.222794056 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.222804070 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.222814083 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.222821951 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.222845078 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.222853899 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.222856045 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.222872019 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.222886086 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.222899914 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.222902060 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.222934961 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.222946882 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.222956896 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.222991943 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.223052025 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.223061085 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.223100901 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.223206997 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.223215103 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.223223925 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.223232985 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.223241091 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.223248005 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.223248959 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.223252058 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.223264933 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.223273993 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.223284006 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.223299980 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.223325014 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.223326921 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.223335981 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.223380089 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.223433018 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.223443985 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.223475933 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.223498106 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.223500967 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.223522902 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.223550081 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.223896027 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.223916054 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.223941088 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.223949909 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.224143028 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.224145889 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.224195004 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.224244118 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.224252939 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.224268913 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.224283934 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.224303007 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.224334955 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.224373102 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.224381924 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.224421024 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.224525928 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.224534988 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.224556923 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.224565029 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.224575043 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.224575996 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.224592924 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.224607944 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.224625111 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.224646091 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.224687099 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.224695921 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.224735022 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.224751949 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.224761963 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.224800110 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.224827051 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.224875927 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.224884987 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.224929094 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.224972010 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.224977016 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.225024939 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.225024939 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.225068092 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.225090027 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.225099087 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.225128889 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.225142002 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.225158930 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.225202084 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.225219011 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.225228071 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.225272894 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.225301981 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.225311041 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.225342989 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.225347042 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.225351095 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.225399017 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.225474119 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.225483894 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.225505114 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.225528002 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.225541115 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.225553989 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.225603104 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.225625992 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.225635052 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.225671053 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.225672960 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.225701094 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.225711107 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.225745916 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.225778103 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.225783110 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.225816965 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.225830078 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.225845098 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.225853920 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.225900888 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.225933075 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.225945950 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.225980043 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.225991011 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.225992918 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.226016998 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.226035118 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.226058006 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.226083040 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.226104975 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.226130009 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.226224899 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.226236105 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.226274014 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.226301908 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.226304054 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.226351976 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.226360083 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.226408958 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.226538897 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.226547956 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.226556063 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.226583958 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.226586103 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.226593971 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.226629019 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.226638079 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.226658106 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.226676941 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.226690054 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.226774931 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.226783037 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.226819992 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.226824999 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.226828098 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.226861000 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.226867914 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.226871014 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.226919889 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.226922989 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.226933956 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.226965904 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.226982117 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.227018118 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.227051973 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.227058887 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.227083921 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.227092981 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.227122068 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.227133036 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.227191925 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.227195978 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.227205992 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.227260113 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.227293968 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.227302074 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.227363110 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.227390051 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.227399111 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.227407932 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.227452040 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.227492094 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.227534056 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.227541924 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.227623940 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.227632046 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.227657080 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.227672100 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.227673054 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.227709055 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.227722883 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.227754116 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.227819920 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.227828026 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.227838993 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.227895975 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.227927923 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.227938890 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.227946043 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.227967978 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.227976084 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.227987051 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.228019953 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.228023052 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.228065968 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.228075981 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.228084087 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.228115082 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.228127003 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.228147030 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.228166103 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.228250027 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.228265047 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.228275061 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.228312969 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.228389025 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.228398085 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.228444099 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.228527069 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.228543043 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.228568077 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.228579998 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.228594065 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.228602886 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.228640079 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.228678942 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.228688002 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.228724957 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.228727102 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.228740931 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.228770971 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.228786945 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.228872061 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.228879929 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.228883982 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.228925943 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.228926897 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.228965044 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.229047060 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.229054928 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.229065895 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.229074001 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.229096889 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.229111910 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.229157925 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.229171038 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.229218006 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.229239941 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.229259014 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.229285002 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.229298115 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.229345083 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.229357958 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.229367018 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.229387045 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.229406118 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.229476929 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.229485989 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.229530096 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.229557037 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.229567051 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.229573965 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.229602098 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.229603052 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.229613066 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.229621887 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.229640961 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.229644060 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.229666948 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.229667902 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.229684114 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.229711056 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.229743004 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.229770899 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.229784012 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.229799986 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.229818106 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.229844093 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.229865074 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.229904890 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.229919910 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.229928970 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.229967117 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.229990959 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.230006933 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.230036974 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.230056047 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.230097055 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.230104923 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.230145931 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.230160952 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.230201960 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.230211020 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.230252028 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.230308056 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.230317116 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.230334997 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.230356932 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.230376005 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.230444908 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.230454922 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.230490923 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.230504990 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.230545998 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.230576992 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.230587006 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.230627060 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.230638981 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.230648041 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.230686903 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.230783939 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.230784893 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.230829954 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.230869055 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.230878115 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.230894089 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.230895042 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.230916977 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.230927944 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.230937004 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.230948925 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.230974913 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.230994940 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.230995893 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.231003046 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.231040955 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.231106043 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.231115103 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.231154919 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.231172085 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.231180906 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.231223106 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.231340885 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.231350899 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.231359005 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.231367111 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.231383085 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.231390953 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.231391907 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.231405020 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.231426954 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.231436014 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.231448889 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.231460094 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.231492996 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.231493950 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.231502056 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.231539965 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.231564045 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.231589079 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.231609106 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.231621981 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.231673002 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.231682062 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.231720924 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.231738091 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.231746912 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.231786966 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.231827021 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.231834888 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.231878042 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.231923103 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.231931925 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.231971025 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.232075930 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.232085943 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.232124090 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.232137918 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.232152939 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.232203960 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.232209921 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.232219934 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.232268095 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.232323885 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.232332945 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.232357979 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.232361078 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.232372046 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.232389927 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.232415915 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.232446909 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.232469082 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.232487917 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.232501030 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.232619047 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.232635021 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.232667923 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.232711077 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.232719898 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.232754946 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.232846975 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.232887030 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.232903004 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.232912064 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.232919931 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.232952118 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.232953072 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.232989073 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.232996941 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.233032942 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.233033895 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.233043909 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.233081102 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.233124018 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.233133078 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.233175993 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.233190060 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.233237028 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.233246088 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.233280897 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.233283043 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.233290911 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.233320951 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.233330965 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.233390093 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.233409882 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.233434916 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.233448982 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.233449936 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.233483076 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.233495951 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.233613014 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.233659029 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.233663082 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.233689070 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.233697891 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.233702898 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.233736992 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.233747959 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.233757019 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.233782053 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.233791113 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.233797073 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.233833075 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.233871937 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.233889103 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.233912945 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.233927011 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.233973026 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.234010935 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.234018087 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.234059095 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.234097004 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.234105110 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.234148026 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.234220982 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.234236956 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.234261036 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.234266996 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.234282017 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.234304905 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.234307051 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.234344959 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.234447002 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.234457016 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.234472990 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.234502077 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.234610081 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.234611988 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.234664917 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.234703064 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.234711885 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.234715939 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.234750032 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.234755039 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.234759092 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.234767914 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.234776020 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.234802961 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.234853029 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.234865904 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.234889030 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.234896898 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.234906912 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.234925032 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.234944105 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.234949112 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.234970093 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.234988928 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.235085964 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.235094070 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.235117912 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.235131025 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.235146046 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.235176086 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.235188961 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.235228062 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.235260010 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.235299110 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.235301018 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.235337973 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.235434055 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.235476971 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.235476971 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.235528946 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.235549927 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.235558033 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.235562086 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.235569000 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.235579014 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.235615015 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.235634089 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.235657930 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.235666990 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.235711098 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.235779047 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.235788107 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.235795975 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.235825062 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.235845089 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.235882998 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.235892057 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.235896111 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.235903978 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.235944033 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.235976934 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.235987902 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.235995054 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.236002922 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.236017942 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.236033916 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.236043930 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.236043930 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.236073017 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.236089945 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.236148119 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.236157894 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.236201048 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.236234903 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.236243963 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.236274004 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.236289978 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.236310005 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.236320019 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.236356020 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.240982056 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.241113901 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.241168022 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.241193056 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.256109953 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.256161928 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.256166935 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.256192923 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.256217957 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.256228924 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.256242990 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.256285906 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.256879091 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.256923914 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.256958008 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.256999016 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.257110119 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.257118940 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.257158995 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.333235979 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.333245993 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.333301067 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.333337069 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.333345890 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.333372116 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.333379984 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.333389044 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.333408117 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.333422899 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.333432913 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.333475113 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.333479881 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.333530903 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.333535910 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.333580017 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.333599091 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.333621025 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.333630085 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.333642960 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.333677053 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.333715916 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.333724976 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.333775043 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.333818913 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.333827972 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.333867073 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.333873987 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.333885908 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.333893061 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.333903074 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.333933115 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.333950043 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.333977938 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.333986998 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.334038973 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.334474087 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.334522009 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.334561110 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.334569931 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.334604979 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.334616899 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.334646940 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.334686995 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.334700108 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.334734917 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.334752083 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.334769011 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.334778070 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.334819078 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.334863901 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.334903955 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.334914923 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.334956884 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.334979057 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.335017920 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.335024118 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.335072041 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.335074902 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.335117102 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.335118055 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.335165024 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.335203886 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.335212946 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.335247993 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.335308075 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.335350990 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.335362911 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.335372925 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.335403919 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.335407972 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.335413933 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.335445881 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.335447073 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.335453987 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.335495949 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.335509062 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.335535049 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.335563898 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.335607052 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.335653067 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.335675001 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.335719109 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.335724115 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.335774899 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.335827112 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.335835934 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.335901022 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.335938931 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.335984945 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.335989952 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.336035967 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.336071968 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.336081028 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.336122036 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.336199999 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.336213112 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.336257935 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.336265087 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.336275101 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.336296082 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.336314917 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.336335897 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.336343050 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.336386919 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.375684977 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.375844955 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.376432896 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.376473904 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.376506090 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.376550913 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.376584053 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.376632929 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.376667023 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.376708031 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.376743078 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.376792908 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.376830101 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.376883030 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.376919985 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.376972914 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.377008915 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.377058983 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.377101898 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.377154112 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.377193928 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.377255917 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.377298117 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.377355099 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.377397060 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.377463102 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.377499104 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.377551079 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.377573013 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.396121025 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.396193981 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.453015089 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.496587992 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.505784035 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.505896091 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.505904913 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.506027937 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.506088018 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.506158113 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.506236076 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.506299019 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.506408930 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.506419897 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.506608963 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.512303114 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.512311935 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.512324095 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.512506962 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.513066053 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.513135910 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.513156891 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.513196945 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.516830921 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.516891956 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.516891956 CET	49700	5555	192.168.2.6	147.45.44.151
Dec 27, 2024 14:04:01.633578062 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.633713007 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.633857965 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.633867025 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.634010077 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.634018898 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.634138107 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.634146929 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.634150982 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.634159088 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.634299040 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.634306908 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.634439945 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.634449005 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.634455919 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.634565115 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.634573936 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.638315916 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.638324976 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.638358116 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.638775110 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.638782978 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.638792992 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.737551928 CET	5555	49700	147.45.44.151	192.168.2.6
Dec 27, 2024 14:04:01.737637997 CET	49700	5555	192.168.2.6	147.45.44.151

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 27, 2024 14:03:57.019411087 CET	58313	53	192.168.2.6	1.1.1.1
Dec 27, 2024 14:03:57.156475067 CET	53	58313	1.1.1.1	192.168.2.6
Dec 27, 2024 14:03:59.638693094 CET	59723	53	192.168.2.6	1.1.1.1
Dec 27, 2024 14:03:59.888935089 CET	53	59723	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 27, 2024 14:03:57.019411087 CET	192.168.2.6	1.1.1.1	0x8837	Standard query (0)	ip-api.com	A (IP address)	IN (0x0001)	false
Dec 27, 2024 14:03:59.638693094 CET	192.168.2.6	1.1.1.1	0xef9e	Standard query (0)	holykap.cfd	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 27, 2024 14:03:57.156475067 CET	1.1.1.1	192.168.2.6	0x8837	No error (0)	ip-api.com		208.95.112.1	A (IP address)	IN (0x0001)	false
Dec 27, 2024 14:03:59.888935089 CET	1.1.1.1	192.168.2.6	0xef9e	Name error (3)	holykap.cfd	none	none	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

ip-api.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49699	208.95.112.1	80	1584	C:\Users\user\Desktop\good.exe

Timestamp	Bytes transferred	Direction	Data
Dec 27, 2024 14:03:57.283734083 CET	97	OUT	GET /json/ HTTP/1.1 Content-Type: application/json Host: ip-api.com Connection: Keep-Alive
Dec 27, 2024 14:03:58.578804970 CET	483	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 13:03:57 GMT Content-Type: application/json; charset=utf-8 Content-Length: 306 Access-Control-Allow-Origin: * X-Ttl: 60 X-Rl: 44 Data Raw: 7b 22 73 74 61 74 75 73 22 3a 22 73 75 63 63 65 73 73 22 2c 22 63 6f 75 6e 74 72 79 22 3a 22 55 6e 69 74 65 64 20 53 74 61 74 65 73 22 2c 22 63 6f 75 6e 74 72 79 43 6f 64 65 22 3a 22 55 53 22 2c 22 72 65 67 69 6f 6e 22 3a 22 4e 59 22 2c 22 72 65 67 69 6f 6e 4e 61 6d 65 22 3a 22 4e 65 77 20 59 6f 72 6b 22 2c 22 63 69 74 79 22 3a 22 4e 65 77 20 59 6f 72 6b 22 2c 22 7a 69 70 22 3a 22 31 30 31 32 33 22 2c 22 6c 61 74 22 3a 34 30 2e 37 31 32 38 2c 22 6c 6f 6e 22 3a 2d 37 34 2e 30 30 36 2c 22 74 69 6d 65 7a 6f 6e 65 22 3a 22 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 22 2c 22 69 73 70 22 3a 22 4c 65 76 65 6c 20 33 22 2c 22 6f 72 67 22 3a 22 43 65 6e 74 75 72 79 4c 69 6e 6b 20 43 6f 6d 6d 75 6e 69 63 61 74 69 6f 6e 73 2c 20 4c 4c 43 22 2c 22 61 73 22 3a 22 41 53 33 33 35 36 20 4c 65 76 65 6c 20 33 20 50 61 72 65 6e 74 2c 20 4c 4c 43 22 2c 22 71 75 65 72 79 22 3a 22 38 2e 34 36 2e 31 32 33 2e 31 38 39 22 7d Data Ascii: {"status":"success","country":"United States","countryCode":"US","region":"NY","regionName":"New York","city":"New York","zip":"10123","lat":40.7128,"lon":-74.006,"timezone":"America/New_York","isp":"Level 3","org":"CenturyLink Communications, LLC","as":"AS3356 Level 3 Parent, LLC","query":"8.46.123.189"}

Target ID:	0
Start time:	08:03:53
Start date:	27/12/2024
Path:	C:\Users\user\Desktop\good.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\good.exe"
Imagebase:	0x227f6850000
File size:	401'920 bytes
MD5 hash:	B0EFB1607C79E9B10704200AB7B0E829
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000000.00000000.2096423020.00000227F6852000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.2201147807.0000022780001000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000000.00000002.2201147807.0000022780001000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	08:04:03
Start date:	27/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\user\Desktop\good.exe"
Imagebase:	0x7ff663200000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	08:04:03
Start date:	27/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	08:04:03
Start date:	27/12/2024
Path:	C:\Windows\System32\choice.exe
Wow64 process (32bit):	false
Commandline:	choice /C Y /N /D Y /T 3
Imagebase:	0x7ff715620000
File size:	35'840 bytes
MD5 hash:	1A9804F0C374283B094E9E55DC5EE128
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Function 00007FFD34B0B0D0 Relevance: 6.1, Strings: 2, Instructions: 3621COMMON

Download Yara Rule

Strings

p'_H, xrefs: 00007FFD34B0CBC1
d'_H, xrefs: 00007FFD34B0C071

Memory Dump Source

Source File: 00000000.00000002.2278619221.00007FFD34B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34b00000_good.jbxd

Similarity

API ID:
String ID: d'_H$p'_H
API String ID: 0-100355858
Opcode ID: e3c6f033b7472b7d92a94d8f95b2f59c28fb607433729af7d61758471e130860
Instruction ID: 26c8880a3a201d374683b60ba3c12bee1026fefb2caf0c4f8d315397d70f44bf
Opcode Fuzzy Hash: e3c6f033b7472b7d92a94d8f95b2f59c28fb607433729af7d61758471e130860
Instruction Fuzzy Hash: 7A534F70A1CB858FD7B8DB1884A5AAA73E1FF99305F14457DD48EC7291CF38A842DB42

Function 00007FFD34B19811 Relevance: 1.0, Instructions: 973COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2278619221.00007FFD34B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34b00000_good.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d85a5e9791ccbcebf4593be4267e4dfbdd9011af2cd3020636cf189ad0d4956
Instruction ID: 345769c3063902656c0cbc4df5ebf3cd07c99c84f5fe2989e6fa7579f51c7c64
Opcode Fuzzy Hash: 8d85a5e9791ccbcebf4593be4267e4dfbdd9011af2cd3020636cf189ad0d4956
Instruction Fuzzy Hash: 70628F30A18A498FDB58EF18C4A1AB977E1FF99300F10457DD54AC7696DE39F842CB82

Function 00007FFD34B11F08 Relevance: .9, Instructions: 912COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2278619221.00007FFD34B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34b00000_good.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 77090b28e547d1ecf96b414ace4bc508186f3ea5d0883435472f535eadfd83ed
Instruction ID: 4691c7e150a9a0b904a40d97ef8e486d9d994096a7cea30a10bb1f814f2f3283
Opcode Fuzzy Hash: 77090b28e547d1ecf96b414ace4bc508186f3ea5d0883435472f535eadfd83ed
Instruction Fuzzy Hash: 29526031718A0A4FDBA8EE58D0A1A62B3E1FFA9314F54457DD54EC3686DE38F842C781

Function 00007FFD34B17259 Relevance: .8, Instructions: 844COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2278619221.00007FFD34B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34b00000_good.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0349a788fbc0488ed92b8534027c7377e6569f48326c7046835c9f97461c64a9
Instruction ID: 044f0d9b6898ccdd140065f7d383907313a217bf7b9cb76862c964618411a037
Opcode Fuzzy Hash: 0349a788fbc0488ed92b8534027c7377e6569f48326c7046835c9f97461c64a9
Instruction Fuzzy Hash: 6A429E61B1CA0A4FEBA8EE1C90A567573D2FF99304F1445BED44EC7286DE28EC42D781

Function 00007FFD34B05369 Relevance: .8, Instructions: 804COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2278619221.00007FFD34B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34b00000_good.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea63edb172a90ec1170d638b23da673a847ddd029da7ec2590f7a4d20a8497e3
Instruction ID: ed6044844fcda4af123fb7c92fb77d5d14c3e2d77224d73b259a7adbf019c58c
Opcode Fuzzy Hash: ea63edb172a90ec1170d638b23da673a847ddd029da7ec2590f7a4d20a8497e3
Instruction Fuzzy Hash: ED323630B1CA4A4FEB98EB2C98A96B437D1FF56311B1501BDD44AC75A3DE29EC42C742

Function 00007FFD34B11E90 Relevance: .7, Instructions: 738COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2278619221.00007FFD34B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34b00000_good.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0249cbf131900c4541481950635705c4a5a383f7d95d5b67aa3b9e91b60f6d36
Instruction ID: 93c8c5c62cb587fc77d83b2ab3f880c0092ec6976ade5af7d045ca05a57be118
Opcode Fuzzy Hash: 0249cbf131900c4541481950635705c4a5a383f7d95d5b67aa3b9e91b60f6d36
Instruction Fuzzy Hash: 72423B30A18A098FEBA8DF28C4A5BA5B3E1FF59300F1445B9D54ED7291DE39F881DB41

Function 00007FFD34B048B1 Relevance: .7, Instructions: 734COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2278619221.00007FFD34B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34b00000_good.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48ba1733382b065bac2aae65836e25d842bd886eb8cb6b81405a2287fee1c2c4
Instruction ID: d2e0ab08f88862cde7955b6e22bf927e261cde9538a54979a387c512f18d17bc
Opcode Fuzzy Hash: 48ba1733382b065bac2aae65836e25d842bd886eb8cb6b81405a2287fee1c2c4
Instruction Fuzzy Hash: 4822A23071CA154FDB68EB2C94A5A7577D2FF99301F1501BDE44EC72A6CE28EC429782

Function 00007FFD34B166CD Relevance: .7, Instructions: 708COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2278619221.00007FFD34B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34b00000_good.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46d556479d163c434b44f3a48db878342aa0f28b302b392f7a3adc6b6f8e6e14
Instruction ID: df9b02dff2f229cc3204ab8efc6d735e745d2cc6903b29facf4c18121acf7101
Opcode Fuzzy Hash: 46d556479d163c434b44f3a48db878342aa0f28b302b392f7a3adc6b6f8e6e14
Instruction Fuzzy Hash: 4532A270B18A4A8FDB98DF58C4A5BA9B7E1FF99300F1441B9D14DD7292CE38E881DB41

Function 00007FFD34B08270 Relevance: .7, Instructions: 678COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2278619221.00007FFD34B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34b00000_good.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f30be9c4869f76eab04264b3f634f23a02090a88329d5e0e60f578a523d8e4ee
Instruction ID: 8e251fd6c3f0eec6ce2426be87aa494cd02d1c2a00b6dc2a0ed6ea9be0ac896b
Opcode Fuzzy Hash: f30be9c4869f76eab04264b3f634f23a02090a88329d5e0e60f578a523d8e4ee
Instruction Fuzzy Hash: CE22D330B1CA464FEB68DA2984A167677D1FF96310F1445BED48EC3992DE38B842D782

Function 00007FFD34B0DBD0 Relevance: .7, Instructions: 674COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2278619221.00007FFD34B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34b00000_good.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50df45a8916c38cce753bdb8f5521a870c840a506439e7b6c2be920bfeaa02d4
Instruction ID: 2eade88d9949918e298590fea3d4051ae853990a967d416e6561d16a3cccd23e
Opcode Fuzzy Hash: 50df45a8916c38cce753bdb8f5521a870c840a506439e7b6c2be920bfeaa02d4
Instruction Fuzzy Hash: 0F12C821B1CA454BE75CEB2C94A66B573D2FF9A341F44457EE54EC32C2DE2CB8429282

Function 00007FFD34B007DD Relevance: .2, Instructions: 195COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2278619221.00007FFD34B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34b00000_good.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5af4686a2bbab894525ee8380e59d95456699d77111d629c2b215a17a9ba9c64
Instruction ID: 88f9221d08beb96c2c2d4baf58e18569ab547b73cbe08918907860ea5d7f8f3b
Opcode Fuzzy Hash: 5af4686a2bbab894525ee8380e59d95456699d77111d629c2b215a17a9ba9c64
Instruction Fuzzy Hash: CC516961B0DF860FE7A4CB2D64A4672B7D0FF5A22170446BFC58DC7592DF28A8428781

Function 00007FFD34B1D995 Relevance: 2.9, Strings: 2, Instructions: 406COMMON

Download Yara Rule

Strings

m, xrefs: 00007FFD34B1DDA2
^, xrefs: 00007FFD34B1DD9A

Memory Dump Source

Source File: 00000000.00000002.2278619221.00007FFD34B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34b00000_good.jbxd

Similarity

API ID:
String ID: ^$m
API String ID: 0-1535649515
Opcode ID: 49787ce4335a026790cd81ed70d01f90c1c3f456a1135087e55b9076285bfa7b
Instruction ID: 084d453f31b09f74a15daabebf9db02b7e1f319bda1157737cd56aeb74c6cfb6
Opcode Fuzzy Hash: 49787ce4335a026790cd81ed70d01f90c1c3f456a1135087e55b9076285bfa7b
Instruction Fuzzy Hash: 28D1E630B0D6994FD756DB2884A16A57BE1FF8A310F1405FED149C72D3CE29B986C742

Function 00007FFD348A3666 Relevance: 1.7, Strings: 1, Instructions: 446COMMON

Download Yara Rule

Strings

M_H, xrefs: 00007FFD348A4472

Memory Dump Source

Source File: 00000000.00000002.2274367338.00007FFD348A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd348a0000_good.jbxd

Similarity

API ID:
String ID: M_H
API String ID: 0-372873180
Opcode ID: 60dbb389abd7e57834c52065cc0c575bb09e4fedee2f7c657b90275939a65274
Instruction ID: 42bd4c71f4b620033c7a6bc59f063f4dbd998d871ccb7e5a322aa69a996e7d1b
Opcode Fuzzy Hash: 60dbb389abd7e57834c52065cc0c575bb09e4fedee2f7c657b90275939a65274
Instruction Fuzzy Hash: A1D11931B1A94E4FDBD8EBAC84A5AB977E1FF55300B1441B9D44EC7296CE28EC42C740

Function 00007FFD34B09448 Relevance: 1.7, Strings: 1, Instructions: 416COMMON

Download Yara Rule

Strings

S'_H, xrefs: 00007FFD34B0E8C3

Memory Dump Source

Source File: 00000000.00000002.2278619221.00007FFD34B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34b00000_good.jbxd

Similarity

API ID:
String ID: S'_H
API String ID: 0-2161813260
Opcode ID: 56923d350abdc91a398d4d7afe02641e2e576c429897b36899a7537d8d0219c2
Instruction ID: 4144382f34206807e944eb3c9be9fcaeb20818378e33f824c627ad7deb2a2c76
Opcode Fuzzy Hash: 56923d350abdc91a398d4d7afe02641e2e576c429897b36899a7537d8d0219c2
Instruction Fuzzy Hash: 8FD17231B0890A8FDBA4DB18D0E0A7573E2FF9A315B5841B9D50ECB296CF29EC42D741

Function 00007FFD34B1DDF1 Relevance: 1.4, Strings: 1, Instructions: 167COMMON

Download Yara Rule

Strings

1, xrefs: 00007FFD34B1DF03

Memory Dump Source

Source File: 00000000.00000002.2278619221.00007FFD34B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34b00000_good.jbxd

Similarity

API ID:
String ID: 1
API String ID: 0-2212294583
Opcode ID: 16325ad729fe7d5437a670ef1154355e21df6428ed66e104878532013a71fa73
Instruction ID: 4e04a96f7d7ab2e26b122a378079beef76820659e36e721a602c921ff8c352ae
Opcode Fuzzy Hash: 16325ad729fe7d5437a670ef1154355e21df6428ed66e104878532013a71fa73
Instruction Fuzzy Hash: DF516171A087498FDB99DF1884A57A5B7E4FF5A304F5405BEE08DD3292CF396942CB02

Function 00007FFD348A06E8 Relevance: 1.4, Strings: 1, Instructions: 122COMMON

Download Yara Rule

Strings

N_^ , xrefs: 00007FFD348A0772

Memory Dump Source

Source File: 00000000.00000002.2274367338.00007FFD348A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd348a0000_good.jbxd

Similarity

API ID:
String ID: N_^
API String ID: 0-574212493
Opcode ID: 074f8ad8250aad0ce92ee20dd9839cef1bf2541003e43b739f5448bb0cf82d02
Instruction ID: 5fb2167c506cf53e1345309be69de59eb3bab32bfa1e4bdf64a78a266b34428e
Opcode Fuzzy Hash: 074f8ad8250aad0ce92ee20dd9839cef1bf2541003e43b739f5448bb0cf82d02
Instruction Fuzzy Hash: 94419262A0E2815BD352ABBC6CB10E53F64AF43318B0C41BBD198DB093ED7C7445D796

Function 00007FFD348AC707 Relevance: 1.3, Strings: 1, Instructions: 36COMMON

Download Yara Rule

Strings

[, xrefs: 00007FFD348AFB8B

Memory Dump Source

Source File: 00000000.00000002.2274367338.00007FFD348A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd348a0000_good.jbxd

Similarity

API ID:
String ID: [
API String ID: 0-784033777
Opcode ID: c6cff6299dd11954f87b62cd036d0fe0d75e821b5f822806e62d091f85ed4335
Instruction ID: d17dae3ea649691b426717869148d8faccefff90f7dadc82a30fc34f5b62aa69
Opcode Fuzzy Hash: c6cff6299dd11954f87b62cd036d0fe0d75e821b5f822806e62d091f85ed4335
Instruction Fuzzy Hash: 74019370A099198FEBE0EB08C894BA972E1FF55301F1040B4D14DE7290CE78AD85DF50

Function 00007FFD348A06B0 Relevance: 1.3, Strings: 1, Instructions: 3COMMON

Download Yara Rule

Strings

N_^ , xrefs: 00007FFD348A0772

Memory Dump Source

Source File: 00000000.00000002.2274367338.00007FFD348A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd348a0000_good.jbxd

Similarity

API ID:
String ID: N_^
API String ID: 0-574212493
Opcode ID: 12bd6a01a26810c3eed6537109399688c63097b03527497e83985f6a6fc9e626
Instruction ID: ef55d9fe6a89a0278aa91ffa1d45166dadc8255f11ba99a6f791e3c81ca1a973
Opcode Fuzzy Hash: 12bd6a01a26810c3eed6537109399688c63097b03527497e83985f6a6fc9e626
Instruction Fuzzy Hash: 9E90022250402157D610E5ECE5F26D633645F0131870C5161D0485A147E97470404545

Function 00007FFD34B00A65 Relevance: .8, Instructions: 790COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2278619221.00007FFD34B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34b00000_good.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2213ab7767d80c789cba6984a5143cb56f1862a66b38e2e6eb767e44f581ec4
Instruction ID: 44f3e39069fc92bf2deb0312f6ce1dbd894f1974823774f2c712989c3dcf8b41
Opcode Fuzzy Hash: a2213ab7767d80c789cba6984a5143cb56f1862a66b38e2e6eb767e44f581ec4
Instruction Fuzzy Hash: 94421352A0EAC70FEBA9877814B51B47BD1EF97344B0840FED499CB1D3DE2CA8069342

Function 00007FFD348A311D Relevance: .8, Instructions: 755COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2274367338.00007FFD348A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd348a0000_good.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c10212e664fa5a3b6f5f7448f9cf35e40ca46fc4217cab85995e2dad7f622172
Instruction ID: f98364c00c5f34dee5dc02480f24f8aed7579af20c3209f37eb2c2f3321a693c
Opcode Fuzzy Hash: c10212e664fa5a3b6f5f7448f9cf35e40ca46fc4217cab85995e2dad7f622172
Instruction Fuzzy Hash: 38328130B199198FDF98EB5CC4A5AA977E2FF59300B1441B9D40ED7296DE38EC42CB90

Function 00007FFD34B01F3D Relevance: .6, Instructions: 604COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2278619221.00007FFD34B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34b00000_good.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21a6f58bd6e614e7397f633723f285eab08e49510bfb5fe0d432bf9ad5efac09
Instruction ID: e466895e2f3c06b3ac4e735dc75658a70b67cc859adf53c8119abd0d63301025
Opcode Fuzzy Hash: 21a6f58bd6e614e7397f633723f285eab08e49510bfb5fe0d432bf9ad5efac09
Instruction Fuzzy Hash: AE122631A0CB854FE769DB2884A1571B7E0FF52301B1445BED58EC7693EB29BC46C782

Function 00007FFD34B11F18 Relevance: .6, Instructions: 568COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2278619221.00007FFD34B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34b00000_good.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bcccaeb1692c18011f53b2de90730f269ffdf0b0bc7e71dc633eb74651ef3fae
Instruction ID: 8eeb858a263cd1a8756018a5b769243b69654cd3508b374f0fab3e79aa1631d2
Opcode Fuzzy Hash: bcccaeb1692c18011f53b2de90730f269ffdf0b0bc7e71dc633eb74651ef3fae
Instruction Fuzzy Hash: 84F1C13170CA4A8FDB98DA1CD4A4A71B7E1FF9A310B1445BEC54DC7296DA29EC82C741

Function 00007FFD34B08B54 Relevance: .6, Instructions: 560COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2278619221.00007FFD34B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34b00000_good.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08c5072b49e3dbcf34e1fb5f902a32558914e50762e6aeced27ba2be607fdd6e
Instruction ID: d3b86880dd91f48cd45556c0ae6074d4285501c9383880755e9c966ca9d7b28f
Opcode Fuzzy Hash: 08c5072b49e3dbcf34e1fb5f902a32558914e50762e6aeced27ba2be607fdd6e
Instruction Fuzzy Hash: 3AF10430B1CA4A4FE7A9EB2884A567573E1FF9A311F14457ED54EC3292DF28F8428781

Function 00007FFD34B27390 Relevance: .6, Instructions: 560COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2278619221.00007FFD34B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34b00000_good.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d43a9debc3cf34e65bb8f46cc0ad7b2b46cfa6d0a5bdea8e184a44cdcba6a5b1
Instruction ID: 043be34128bf0df48c97d4dbbe9f82bf69571d49e1c1d854df045f81e95cbdc2
Opcode Fuzzy Hash: d43a9debc3cf34e65bb8f46cc0ad7b2b46cfa6d0a5bdea8e184a44cdcba6a5b1
Instruction Fuzzy Hash: DC02EF61A0D7C20FE757972848BA6A47FB1EF57350B0901FBD09ACB1E3ED1DA8468352

Function 00007FFD34B001A9 Relevance: .5, Instructions: 525COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2278619221.00007FFD34B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34b00000_good.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4dfd1fd82048adfeb407adf49249953b59531a8fd6b82c05cea40582b3f2db9
Instruction ID: ace7ac743aa6083db21a501753c4eadf808dcfcfbb0bd0509de56bba26406578
Opcode Fuzzy Hash: e4dfd1fd82048adfeb407adf49249953b59531a8fd6b82c05cea40582b3f2db9
Instruction Fuzzy Hash: 0FF1A421B0DE8B0FE7E99B2C54F567936D2EF5A605B4800BAD94EC7187DE1CEC419382

Function 00007FFD34B06793 Relevance: .5, Instructions: 471COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2278619221.00007FFD34B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34b00000_good.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d18cf822a99240467abb75a33215186393ee99cf0f8ca85a2d6c7215642eb41
Instruction ID: 7a2e5aaa2800d5f453302160f1583f1412200ae12c43ef924e6f596cd1492631
Opcode Fuzzy Hash: 7d18cf822a99240467abb75a33215186393ee99cf0f8ca85a2d6c7215642eb41
Instruction Fuzzy Hash: 2DE11C2070C9454FDB6CDF1CE4A5BA937D1EF69301F1400AEE54ECB2A7CE28EC869646

Function 00007FFD34B1D401 Relevance: .4, Instructions: 427COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2278619221.00007FFD34B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34b00000_good.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b88bc2b3420035a908c84b401a1ed7bdc7b7a611d334441c864fb1855b6daa7f
Instruction ID: 79a2541aa090852bbf11886d27c385ab96a258852555f80f57b9a2fc1dfadf8e
Opcode Fuzzy Hash: b88bc2b3420035a908c84b401a1ed7bdc7b7a611d334441c864fb1855b6daa7f
Instruction Fuzzy Hash: AAE1D161A0DBC14FE717DB2888B55617FF1EF67300B1945EBD089CB1E3DA28A846C792

Function 00007FFD348A0575 Relevance: .4, Instructions: 418COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2274367338.00007FFD348A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd348a0000_good.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc7c5e795fb90992109c5d4d77b201c08102a49b2c69355341e3c19b23fd5a2c
Instruction ID: 4d6b56ce998fc15c6a3b8129d490ada80fb84f7da352afed64411679ad91a868
Opcode Fuzzy Hash: dc7c5e795fb90992109c5d4d77b201c08102a49b2c69355341e3c19b23fd5a2c
Instruction Fuzzy Hash: 08D14D32B0DA564FD755EBBCD8A56E977E0EF86321B0841BBC189CB193CD686407C781

Function 00007FFD34B09651 Relevance: .4, Instructions: 410COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2278619221.00007FFD34B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34b00000_good.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 60e2f0fcb32ba583f7fbc198fc4fc69ff62acf51b5cbd4f670661ac7452a56fc
Instruction ID: b9e5d5de96182cd74e1f66e3172711f76df0dd84783145fb8dc6d4c3dc64977d
Opcode Fuzzy Hash: 60e2f0fcb32ba583f7fbc198fc4fc69ff62acf51b5cbd4f670661ac7452a56fc
Instruction Fuzzy Hash: 0AC1E631B0CA4A4FE798EB2C94A567973D1FF9A311B44017ED54EC7293DF28B8429B81

Function 00007FFD34B19854 Relevance: .4, Instructions: 404COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2278619221.00007FFD34B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34b00000_good.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e49534a9d30c2ccaf1c1052882746a1eabd2b0b79974227834a0311bb6f7b81
Instruction ID: 0fa6aada48c3ae4a740a3950a278f23484d79ed3e9b9fde3d60927a852b0da66
Opcode Fuzzy Hash: 3e49534a9d30c2ccaf1c1052882746a1eabd2b0b79974227834a0311bb6f7b81
Instruction Fuzzy Hash: 96D16E70A18A498FDB98EF5CC4A59A977E1FF69300B1001BED44ED7292DE34F842CB81

Function 00007FFD34B0A915 Relevance: .4, Instructions: 392COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2278619221.00007FFD34B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34b00000_good.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07b197c902893707970bcf9f646dcb69b5f70afd5561a60690a0aacc1eaec269
Instruction ID: 546082b076f39ffee0f26dc81ac8cddd3aa7250bf68f3ceea18782f5f6ed0c93
Opcode Fuzzy Hash: 07b197c902893707970bcf9f646dcb69b5f70afd5561a60690a0aacc1eaec269
Instruction Fuzzy Hash: 1CB19821B1990A4BFAA9A75C14F52B523C2DFEB346F440479DA0DC72C7DE1DEC4B6242

Function 00007FFD348A32A3 Relevance: .4, Instructions: 392COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2274367338.00007FFD348A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd348a0000_good.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ecb37d87fd31e7a9be349f29d09421838179dc8395e2116e42346ab85d8210d3
Instruction ID: 6fb7e156a1dfa9435492947a8ab92ca6d6937d4236f2ace62b47bb8589900561
Opcode Fuzzy Hash: ecb37d87fd31e7a9be349f29d09421838179dc8395e2116e42346ab85d8210d3
Instruction Fuzzy Hash: 0CC19271F0E90A4FEBE9DBAC90E86B877E1FF65310F24057AC50AC7196CD6CA8429750

Function 00007FFD348A37CE Relevance: .4, Instructions: 373COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2274367338.00007FFD348A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd348a0000_good.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4890bd05c53589dbb9a1906630eead59e9ff29242999d47962e3633fd08864e
Instruction ID: f5b178c62a0d88f2ee1487d51eb47ec041a7f789cbbc55324a964c55462eb020
Opcode Fuzzy Hash: f4890bd05c53589dbb9a1906630eead59e9ff29242999d47962e3633fd08864e
Instruction Fuzzy Hash: 28C1E831B19A4A8FDBD8EB6CC4A5AA977E1FF55300B1441B9D44EDB296CE38EC42C740

Function 00007FFD34B0B0C0 Relevance: .4, Instructions: 372COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2278619221.00007FFD34B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34b00000_good.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb30235bb6ad0bf3b3c9e68ff5f28403501e2530ae37df84afc4807928805dd6
Instruction ID: c081e28a7ff457234574bc93def902e1581c38bcb5652da4593d6c41ded9846c
Opcode Fuzzy Hash: bb30235bb6ad0bf3b3c9e68ff5f28403501e2530ae37df84afc4807928805dd6
Instruction Fuzzy Hash: EEC12B70A1CB864FD7B4DB5884992BA77E1EF9A305F14067EC58DC3292DF38A8429743

Function 00007FFD34B031B7 Relevance: .4, Instructions: 372COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2278619221.00007FFD34B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34b00000_good.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed1f599c12c4f16527af991b8320cfa784ea7611e51e91e77144864ae53cd8ff
Instruction ID: 6f472074a275c11005458ca9afeb48121574e77d0ff351c091c8483deba73999
Opcode Fuzzy Hash: ed1f599c12c4f16527af991b8320cfa784ea7611e51e91e77144864ae53cd8ff
Instruction Fuzzy Hash: 73A12B31B0C60A4FEB59A76CA4E51B577D1FF86311F5400BAD50DCB196DE2EEC829342

Function 00007FFD348A3979 Relevance: .4, Instructions: 368COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2274367338.00007FFD348A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd348a0000_good.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 66dd90f9968dd1869ad78079c54ba28db6b111f6432d570c4676a36a0ab877ee
Instruction ID: 602c43773bdf783cbf70c7200f66fc487299509d4a52753d3fa2b318088b6cfa
Opcode Fuzzy Hash: 66dd90f9968dd1869ad78079c54ba28db6b111f6432d570c4676a36a0ab877ee
Instruction Fuzzy Hash: DDC1FB31B19A4A8FDB98EB68C4A5A7977E1FF56300B1401B9D44EC7296DE38EC43CB50

Function 00007FFD348A0968 Relevance: .4, Instructions: 365COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2274367338.00007FFD348A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd348a0000_good.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d94046bef9c6876da8ab49372dbc1e86ae8c5bae26fa5c05187e7a9015197e96
Instruction ID: d79a36d99b33f06943d5f397171947090c4e1aec824ff04c07d403cc7f22cfb3
Opcode Fuzzy Hash: d94046bef9c6876da8ab49372dbc1e86ae8c5bae26fa5c05187e7a9015197e96
Instruction Fuzzy Hash: B8C10B30B1DA9A4FD755EB7C84A66A97BF1EF5A300B1441BDD09DC72A3CE68A403C741

Function 00007FFD348A08AD Relevance: .4, Instructions: 358COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2274367338.00007FFD348A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd348a0000_good.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd0a9686ad0dd1ea5bf4ff7caea80475047553e6b839369b2b6e4004f4016f43
Instruction ID: f13e3d0fcae0ef8d00b60a05db841f3e4fb5b30b44c7a99eb77108e1268644f4
Opcode Fuzzy Hash: fd0a9686ad0dd1ea5bf4ff7caea80475047553e6b839369b2b6e4004f4016f43
Instruction Fuzzy Hash: 54B12831A0CA964FD751EBBC94A56EA7FF1EF56310B0841BAD08DCB193CE687446C781

Function 00007FFD34B07E11 Relevance: .4, Instructions: 355COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2278619221.00007FFD34B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34b00000_good.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c2e3c4d87c33f3a38166a4b297e94a9ffafc89163cc7be934b41ff4bad1c6a8
Instruction ID: a16f50c7ec9a3b8d50b0385095c01a6834819bccb26c7e66f91fc7105cc996de
Opcode Fuzzy Hash: 3c2e3c4d87c33f3a38166a4b297e94a9ffafc89163cc7be934b41ff4bad1c6a8
Instruction Fuzzy Hash: C5B1A830B18A488FDB58EF2CD495AA8B7E1FF5A305B1401B9D55DC72A2DF25EC42CB42

Function 00007FFD34B11EF0 Relevance: .3, Instructions: 346COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2278619221.00007FFD34B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34b00000_good.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a25f4592fbc4cba98bf7ce1488cd99c400e545a2a233e097aed1636ce8d82ff
Instruction ID: 84d8c29687e9c7c9ffbcaa48fba07122484b543129e13e0b439221596d203920
Opcode Fuzzy Hash: 6a25f4592fbc4cba98bf7ce1488cd99c400e545a2a233e097aed1636ce8d82ff
Instruction Fuzzy Hash: 80C16C30A18A4A8FFBA4DE18C0A0776B7D1FF55304F645479C54EC7682EA3EE882D791

Function 00007FFD34B1ACBD Relevance: .3, Instructions: 338COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2278619221.00007FFD34B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34b00000_good.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 977883fbbd67c59d5d11b101849c900f1035efe6225cf901b900ddf4bb0961f0
Instruction ID: f5075f101a0d08f515dbe35671f54cdcc5baac6e94382c6a5df6d5ef46c7c7be
Opcode Fuzzy Hash: 977883fbbd67c59d5d11b101849c900f1035efe6225cf901b900ddf4bb0961f0
Instruction Fuzzy Hash: C6A1A0307089498FEBD4EF2C94A8A6477D2FF9A301B0941FAE54DC72A6DD28EC45D741

Function 00007FFD34B04BAB Relevance: .3, Instructions: 306COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2278619221.00007FFD34B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34b00000_good.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7caf9f16aaa3b39bba98d265701f6eb1b517e4de662f3877c8e02f3b27e1dbd0
Instruction ID: 188ce53aecab512ba511164c2c58df62c6779d46f6d73e0a0f2d14f80d90724a
Opcode Fuzzy Hash: 7caf9f16aaa3b39bba98d265701f6eb1b517e4de662f3877c8e02f3b27e1dbd0
Instruction Fuzzy Hash: 8D9161307189098FDB6CEB1CD4A4B69B3D2FF59701F1546B9E44EC72A6CE24EC829781

Function 00007FFD34B11F10 Relevance: .3, Instructions: 303COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2278619221.00007FFD34B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34b00000_good.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 912460931b34bc1d44104803ad65ad19c7c51a7a17f90cee5c70da3c19e5cd5e
Instruction ID: 28d5d35624d7c4697893725395ad2cf2c4d56753abc343754230aa2d0c5ffffd
Opcode Fuzzy Hash: 912460931b34bc1d44104803ad65ad19c7c51a7a17f90cee5c70da3c19e5cd5e
Instruction Fuzzy Hash: A4917E30718A0A8FDB98EF1CD4D5A71B3E1FBA9314B244579D14EC7296DA29FC82C781

Function 00007FFD348A08D3 Relevance: .3, Instructions: 297COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2274367338.00007FFD348A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd348a0000_good.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 753865d2236df922c9906cdeb779e9208ed49a5374f6968aa2f3cd1b85503523
Instruction ID: fcd4c5ea0efd8ed49266039b4122ce91f6732bd3c12c03f8f06bbd78ac2e3a0a
Opcode Fuzzy Hash: 753865d2236df922c9906cdeb779e9208ed49a5374f6968aa2f3cd1b85503523
Instruction Fuzzy Hash: 99A13930B0CA564FD755EBBC94A56E97BF1EF56310B0841BAD09DCB293CE68A443C781

Function 00007FFD348A08FA Relevance: .3, Instructions: 293COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2274367338.00007FFD348A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd348a0000_good.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2acc1739413ce954d7d91efd7f7b4a137544f322e04e49360dddf93826a5cf4
Instruction ID: b9e8ab718c2646e709896c97149b2a40faaf7c4f9a72c8387e2fe9d14e47acbc
Opcode Fuzzy Hash: e2acc1739413ce954d7d91efd7f7b4a137544f322e04e49360dddf93826a5cf4
Instruction Fuzzy Hash: D3A13830B0CA564FD751EBBC94A56E97BF1EF5A310B0841BAD09DCB293CE68A443C781

Function 00007FFD34B0442C Relevance: .3, Instructions: 288COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2278619221.00007FFD34B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34b00000_good.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0110b4e9467e120faed32c31b7b63fc61f23d9d475befa88f35e0bf8fca69f24
Instruction ID: 4d36e19703270ed5c2534e2a60e47e553be99b101d7a61af84b2c668f5c1b592
Opcode Fuzzy Hash: 0110b4e9467e120faed32c31b7b63fc61f23d9d475befa88f35e0bf8fca69f24
Instruction Fuzzy Hash: 3F91D871B0D9494FEB94DB6C98B56783BD2FF9A305B1400B9D54DC72A2DE28EC02D742

Function 00007FFD34B03D56 Relevance: .3, Instructions: 281COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2278619221.00007FFD34B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34b00000_good.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f01a4fdff23b63cf0eef2dba841a262bfaa222cea751a9255323205318b2d150
Instruction ID: 64e85fdc381b39d8d3854239a0409a28a5b37fbec45ae2172209ebcfa0493b4f
Opcode Fuzzy Hash: f01a4fdff23b63cf0eef2dba841a262bfaa222cea751a9255323205318b2d150
Instruction Fuzzy Hash: 4F81E631B0894A4FEB95DB2C84E86B837E2FF9A305B0815B9D54DC7292CE29EC01D711

Function 00007FFD34B09E10 Relevance: .3, Instructions: 281COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2278619221.00007FFD34B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34b00000_good.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: edd35b085a5d7ad74bd4d9adad3082521107bc8719e952546194c9b43a0e609d
Instruction ID: 6dafe6c1c51652bcf1c9a5977c9fbdf82675ada15e2edc0c6d67c9b3cac206d2
Opcode Fuzzy Hash: edd35b085a5d7ad74bd4d9adad3082521107bc8719e952546194c9b43a0e609d
Instruction Fuzzy Hash: 0A919F31708A058FEBA8DB18D4E5A72B3D1FF6A311B04057DD54AC3691DB29FC86CB41

Function 00007FFD348A393E Relevance: .3, Instructions: 279COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2274367338.00007FFD348A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd348a0000_good.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 238499247f62986eba3b83fc92dd62feafe0551e334ac36528caf3ebc1101cc8
Instruction ID: a338a5f84eff755ef39ef3ce36b53bace144cc5cd115a84ab206ce913b2122a6
Opcode Fuzzy Hash: 238499247f62986eba3b83fc92dd62feafe0551e334ac36528caf3ebc1101cc8
Instruction Fuzzy Hash: 89918131B1990D8FDBD8EB58C4A5AA877E2FF59300B1441A9D40ED7296DE39EC42CB90

Function 00007FFD34B11BF1 Relevance: .3, Instructions: 270COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2278619221.00007FFD34B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34b00000_good.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70db4955f1bf903e1fecd3ac5829e56baef645ba9bffe33d22643655fe3c755a
Instruction ID: 03e438b63e61f9fb9922e2d026597e82510f2eaa2a6211abd9ccf1f71b824173
Opcode Fuzzy Hash: 70db4955f1bf903e1fecd3ac5829e56baef645ba9bffe33d22643655fe3c755a
Instruction Fuzzy Hash: E171C731B1CB088FDB48DF1CD8968B977E1EB9A725F04026EE54AD3252DE25B842C785

Function 00007FFD34B1A820 Relevance: .3, Instructions: 269COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2278619221.00007FFD34B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34b00000_good.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad9e6dd246df5521b3ef402d48e8bd136b52f2f787ec4e63972eea24111578c3
Instruction ID: eb4204a4d372eb75d7ad47dc0edbdb80a87a25defcfdbaeddee4f3443f68d521
Opcode Fuzzy Hash: ad9e6dd246df5521b3ef402d48e8bd136b52f2f787ec4e63972eea24111578c3
Instruction Fuzzy Hash: 5181F722A0E6915FD752B7BCA8F55E57BA0DF1632470C01BBD18CCB193ED28B84AC356

Function 00007FFD34B094A0 Relevance: .3, Instructions: 261COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2278619221.00007FFD34B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34b00000_good.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 42b769364fdc3bfa9759064a14b557201bee716acdead62d84a6b5f4010ccf6c
Instruction ID: cdb1fd7ac18bf051f55d548c011c20d587074c1ec6c0bedd44494fd6235d7a02
Opcode Fuzzy Hash: 42b769364fdc3bfa9759064a14b557201bee716acdead62d84a6b5f4010ccf6c
Instruction Fuzzy Hash: D471D030B18A058BEBA8DB1CD491A71B3D2FB9A311F14467DD54EC3292CE39F842C741

Function 00007FFD348A3A69 Relevance: .3, Instructions: 256COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2274367338.00007FFD348A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd348a0000_good.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 611f61edc2b589235d0ebd4d4f358e7219b06209283a618a2752c6728e4ca3ec
Instruction ID: 0d0779991285be5ceb119626f4682cdaf3347d9960079191abaf9176910648d4
Opcode Fuzzy Hash: 611f61edc2b589235d0ebd4d4f358e7219b06209283a618a2752c6728e4ca3ec
Instruction Fuzzy Hash: CB818231B1994D8FDF98EB58C4A5AA877E2FF59300B144179D40ED7296DE39EC42CB80

Function 00007FFD348A3A46 Relevance: .3, Instructions: 255COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2274367338.00007FFD348A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd348a0000_good.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db5bde3a25cfb1278778ccbcb7a82264f61c93ce3d1995e05116ce9625292fb5
Instruction ID: 29a4779a997e98b5ae9d130cdbd9593685ad63985aa03303bd45f3635375d52a
Opcode Fuzzy Hash: db5bde3a25cfb1278778ccbcb7a82264f61c93ce3d1995e05116ce9625292fb5
Instruction Fuzzy Hash: C0816F31B1990D8FDF98EB58C4A5AA8B3E2FF59300B144179D40ED7296DE39EC42DB90

Function 00007FFD34B17A49 Relevance: .2, Instructions: 248COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2278619221.00007FFD34B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34b00000_good.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f58049a81cad167d9e66104ba5998dd5189a44335535bad3c3570714370919a
Instruction ID: 33556dd0a77db7dc62715a768c66e5f14c5994241432b5af9303730ea4f04fcf
Opcode Fuzzy Hash: 2f58049a81cad167d9e66104ba5998dd5189a44335535bad3c3570714370919a
Instruction Fuzzy Hash: C471D421B0C94A4FE798DA2D94A477173D2FF99311F5841BAD04EC71C6DE2DE882D781

Function 00007FFD34B0147A Relevance: .2, Instructions: 237COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2278619221.00007FFD34B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34b00000_good.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51b21afed869da868a85c28f48455f0383094255363315f378abea3c5aea7ed2
Instruction ID: b3147f6b4783a6ed819822fe16493ada8f01609e624c56b9d3207714717811da
Opcode Fuzzy Hash: 51b21afed869da868a85c28f48455f0383094255363315f378abea3c5aea7ed2
Instruction Fuzzy Hash: C8511A21F0CE4A0BE76CD75C54A617977C1EF96361F18017ED94EC32D6DE29EC428682

Function 00007FFD34B0B2B8 Relevance: .2, Instructions: 236COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2278619221.00007FFD34B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34b00000_good.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a3f693169c5f1c35b8bc6eae5648beb31a359480663abb6ee481d9fc1aa23c1
Instruction ID: 04026647e93d8854b03b6da1b07797f42c27f0ccf266920f68b18ebd0e799333
Opcode Fuzzy Hash: 0a3f693169c5f1c35b8bc6eae5648beb31a359480663abb6ee481d9fc1aa23c1
Instruction Fuzzy Hash: E071A37061C7868FE778DB5894996BAB3E1FF99305F14067EC58DC3291DF38A8428782

Function 00007FFD34B1A610 Relevance: .2, Instructions: 231COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2278619221.00007FFD34B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34b00000_good.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19c0ae4286b805e4fc41001c003c7719618cf9ed9da51bd30e653f6d694db0b0
Instruction ID: 6b3b01506746669ee81face71b036c0130df609a3fdeacd20a545fc00db85a81
Opcode Fuzzy Hash: 19c0ae4286b805e4fc41001c003c7719618cf9ed9da51bd30e653f6d694db0b0
Instruction Fuzzy Hash: 4751C611B1C95A0FEB98B76C98B52B973C1EF9A350B1404BAD51EC72A3DD1CBC429382

Function 00007FFD34B11E50 Relevance: .2, Instructions: 228COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2278619221.00007FFD34B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34b00000_good.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e5b0cf8d522e3a7b8b01b288f3d4c86d01014c737b2bf4b133b1fd5a82b3190
Instruction ID: 5b950873c178467fdb92e060dbad0846e49a6a882f5047be9494ac346e570d74
Opcode Fuzzy Hash: 8e5b0cf8d522e3a7b8b01b288f3d4c86d01014c737b2bf4b133b1fd5a82b3190
Instruction Fuzzy Hash: 08512662B1DE850FD76CAB6C946A6B677D1EF95320F0805BFD09ED3192DD38B4068382

Function 00007FFD34B05620 Relevance: .2, Instructions: 221COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2278619221.00007FFD34B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34b00000_good.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7359992655830d1dab6e51988bf94d2d7b53a60beb33b3473c75f1ee3161b1b7
Instruction ID: f8f828e60b2c26321753b446879b88cd8121527cc98a9a06d539192cf9ba40ea
Opcode Fuzzy Hash: 7359992655830d1dab6e51988bf94d2d7b53a60beb33b3473c75f1ee3161b1b7
Instruction Fuzzy Hash: A861D261A18A0A8FEBA8EB2CC4A867073D1FF55341F1541B9D41DC76A6CF28FC81D741

Function 00007FFD34B03034 Relevance: .2, Instructions: 211COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2278619221.00007FFD34B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34b00000_good.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b2fa0c98c357aa6c21105bd6425eb50a85782cbcca7308cace71f9d13e50303
Instruction ID: 75d50250dc41bb3430b11ef0602ff620dfee415c3e3a1e867999e15bf80e3759
Opcode Fuzzy Hash: 6b2fa0c98c357aa6c21105bd6425eb50a85782cbcca7308cace71f9d13e50303
Instruction Fuzzy Hash: DE512421B0DA0A4FE7A8871C64A927677D1FF9A751B14027FD54EC3286EE29AC424382

Function 00007FFD34B0FEBB Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2278619221.00007FFD34B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34b00000_good.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51e2dbd72b6556176a083af1bf44d7b823a2f665fbffa7cdfc326d4ecc4b754b
Instruction ID: fe0a418f6ad47612c7c77f1ce6116e62c9485397f1aa4feef75a9eccb04de4a1
Opcode Fuzzy Hash: 51e2dbd72b6556176a083af1bf44d7b823a2f665fbffa7cdfc326d4ecc4b754b
Instruction Fuzzy Hash: B851C031B1DE0A4FEBA8AB2890A567573D2EF96345F14457DD54EC3282CF2CE842D382

Function 00007FFD34B14547 Relevance: .2, Instructions: 209COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2278619221.00007FFD34B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34b00000_good.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf070e02f0292250e33c1547428a1f76ea7c685ea72a063437f4c6027c366956
Instruction ID: adf8d6adcd68d91669d3c9556b7c9ce5f46294ef25dbc72c038fac7c3992f974
Opcode Fuzzy Hash: bf070e02f0292250e33c1547428a1f76ea7c685ea72a063437f4c6027c366956
Instruction Fuzzy Hash: CC719061A4D7C64FD7635B7488B42A47FF09F53224B0905FFC58ACA0E3EA1D688AD712

Function 00007FFD34B1A3FA Relevance: .2, Instructions: 204COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2278619221.00007FFD34B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34b00000_good.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0dcb3f20b4742f18e4b15bad68db35fdbcfd12499277983865b5eaa6b4dd1d66
Instruction ID: 7c15b9208a9aab9958b8689476d7aea8ddadda260b38d3e30bafe5d0f2a941b6
Opcode Fuzzy Hash: 0dcb3f20b4742f18e4b15bad68db35fdbcfd12499277983865b5eaa6b4dd1d66
Instruction Fuzzy Hash: 55512266608A561FD710FBFCA4B59E67BA0EF15324B481176E0ACCB453ED34F885CB81

Function 00007FFD348C8B88 Relevance: .2, Instructions: 203COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2274367338.00007FFD348A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd348a0000_good.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 988883780b893ba2922d881aacfced8665d32a849802bdf1d7c48b0f489a0cb1
Instruction ID: ca42e21f39cd6d0c387d47f1ca6da86a2018da36e28d26d38749c3a26e857a07
Opcode Fuzzy Hash: 988883780b893ba2922d881aacfced8665d32a849802bdf1d7c48b0f489a0cb1
Instruction Fuzzy Hash: E051F831B1DE490FD794DB2C94A56B5B7E1EF9A711B0441BFE54DC3292DE29EC028381

Function 00007FFD34B09AA4 Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2278619221.00007FFD34B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34b00000_good.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 63d2cfe419515e15d1cd53b5d8c65abfcf14df71779f983c94071bfe5ae7ff72
Instruction ID: 9034cf37fc9fc9aaf654366bff458bcdbb51e28fb3fde0f05c5b5d6b62604cb2
Opcode Fuzzy Hash: 63d2cfe419515e15d1cd53b5d8c65abfcf14df71779f983c94071bfe5ae7ff72
Instruction Fuzzy Hash: 8C51A071B18A494FDB98EF28C4A5A6673E1FF99315B14017ED44FC7292DE38E842CB41

Function 00007FFD34B1A568 Relevance: .2, Instructions: 197COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2278619221.00007FFD34B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34b00000_good.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff4440d5f5aa047bbab3cb5dcb4599b81d194b1a1e85e05956671f3b4a0377aa
Instruction ID: 50c5912a8549f38891f888d46291aff8f46d6a4f50754f612b499b80dd21334e
Opcode Fuzzy Hash: ff4440d5f5aa047bbab3cb5dcb4599b81d194b1a1e85e05956671f3b4a0377aa
Instruction Fuzzy Hash: 2B51563060CA865FE759EB6898959727BE1EFA7310B0441BED45DCB193DE2CA843C782

Function 00007FFD34B126D1 Relevance: .2, Instructions: 191COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2278619221.00007FFD34B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34b00000_good.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ec839edba9d30a602188fab0b6fea8310eaaf716c8a78e5bcd881d92d16004e
Instruction ID: 46cb1dc74e28daa0226f71ca2d9c48ced9822ef93dda5a3bbc4d8da2f1e86ccd
Opcode Fuzzy Hash: 7ec839edba9d30a602188fab0b6fea8310eaaf716c8a78e5bcd881d92d16004e
Instruction Fuzzy Hash: CD510561A1DB860FD7699B7884697B67BD1EF95310F0805BFD08ED3193DD38B8068382

Function 00007FFD34B0F612 Relevance: .2, Instructions: 188COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2278619221.00007FFD34B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34b00000_good.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a3d3056b336555588bdd8b49d79dcf107f0b6c046b3e37c080f4566c31d1adb
Instruction ID: a635f5e944d7ec7f4386cacec47e5931fc3ac201c02513441758b3da250db3ab
Opcode Fuzzy Hash: 7a3d3056b336555588bdd8b49d79dcf107f0b6c046b3e37c080f4566c31d1adb
Instruction Fuzzy Hash: 0551F321B0D98A0FEB98DB2894B567537D1EF9A301F0801BED54DCB2C7DE69AC42C742

Function 00007FFD34B1192D Relevance: .2, Instructions: 186COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2278619221.00007FFD34B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34b00000_good.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c3c4368526b6bf6f2b961465917e586fb0637a0f7bcf309dc3d10099117b93b
Instruction ID: b3188da6fed36c80eb1281663c11a3f59000cec614220b38d4462bbd4bc874a9
Opcode Fuzzy Hash: 5c3c4368526b6bf6f2b961465917e586fb0637a0f7bcf309dc3d10099117b93b
Instruction Fuzzy Hash: DA51B331B18A598FDB98DF68C0A16A977E1FF59310F1401AED04ED7296CE39E842CB41

Function 00007FFD34B10EA5 Relevance: .2, Instructions: 175COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2278619221.00007FFD34B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34b00000_good.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3fd8557cc6bb8050a4473b3482b61904e2155e22fad823bc4a9d3537756e589
Instruction ID: 7027c5f1722c9fcce91a3ba292948b4fe528c8248005978bbd013c45bbd12caf
Opcode Fuzzy Hash: d3fd8557cc6bb8050a4473b3482b61904e2155e22fad823bc4a9d3537756e589
Instruction Fuzzy Hash: BB41173170DA490FEB98DA1DA8AA67533D1EFAA221B0441BFD14DC7293DD1AEC42C342

Function 00007FFD34B1B292 Relevance: .2, Instructions: 174COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2278619221.00007FFD34B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34b00000_good.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d3f6c9fe983651b7d2ec3036bcad458ab60742efe5736ed62cc4bfa693c38cc
Instruction ID: a86ab92332daff5a6d5571efd1f71f80e682f8a6747a6697f98f97faa62a9527
Opcode Fuzzy Hash: 8d3f6c9fe983651b7d2ec3036bcad458ab60742efe5736ed62cc4bfa693c38cc
Instruction Fuzzy Hash: 7051D521B0DA994FE7A5EB6CA4B56B47BD1EF4A210B0801FAD59CCB1A7CD1CAC45C342

Function 00007FFD34B09438 Relevance: .2, Instructions: 169COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2278619221.00007FFD34B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34b00000_good.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6cdbe4982964262647e884cb132dc384444d84ebae33846099af40f9f4b4fb6
Instruction ID: 80b9c461a995a189308c7333f3b9bcbf812cf01a10cc0eb10d63f3c6b0010680
Opcode Fuzzy Hash: d6cdbe4982964262647e884cb132dc384444d84ebae33846099af40f9f4b4fb6
Instruction Fuzzy Hash: D741C831B18E0A4FEBA4DB1C94A05B6B3E2FF96355B040A7AD54AC3641DF28F8059781

Function 00007FFD348A0D39 Relevance: .2, Instructions: 169COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2274367338.00007FFD348A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd348a0000_good.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69af9f05e71d9b13e885cd7482d61bc067748c83c4ae6d71d233c64b9070ff11
Instruction ID: 472001a9c9294c46c08028878f4a3430b5b88ec8061629ca420b38a1a228b361
Opcode Fuzzy Hash: 69af9f05e71d9b13e885cd7482d61bc067748c83c4ae6d71d233c64b9070ff11
Instruction Fuzzy Hash: E551D97191DA994FE795DB6898697E97FF0EF5A310F0400F9C099DF2A2C9682416C701

Function 00007FFD34B08DBE Relevance: .2, Instructions: 165COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2278619221.00007FFD34B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34b00000_good.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ca4a62051008435d7ecbc70895eaf1dce91fe9d547271fe6502057ee9892aad
Instruction ID: ee47671de6c8c8b2c6b0c606bac59334109564611a3a8d71ccc44e91761cfb51
Opcode Fuzzy Hash: 3ca4a62051008435d7ecbc70895eaf1dce91fe9d547271fe6502057ee9892aad
Instruction Fuzzy Hash: CB417C20B1DB490FE3A6A72854A52BA7BD1EF56212F05457FE58DC32D3DE1C9C038392

Function 00007FFD34B123EA Relevance: .2, Instructions: 165COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2278619221.00007FFD34B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34b00000_good.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dfe63168a077a3c48c2f2bcb99b11e1402bfc5e85b275e565fd30716366dbb28
Instruction ID: 2a62334c7e1ea6a1b0ed5c5b7f972ca4342afd652c71feaaf09f2d762f9875c5
Opcode Fuzzy Hash: dfe63168a077a3c48c2f2bcb99b11e1402bfc5e85b275e565fd30716366dbb28
Instruction Fuzzy Hash: 5C41B631B1C6454BEB5C5F5C64A62B977D2EF9A710F44017EE98AD32C3DE2CAC029282

Function 00007FFD34B08CAD Relevance: .2, Instructions: 161COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2278619221.00007FFD34B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34b00000_good.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c47fcf5e07e7c5f4d06a0217db292230f56d989307576075697b1a95dab1a1d4
Instruction ID: ecba7409921e1c78676abf701925b4ef2762540e0c79e3c321ea41fb2ec36fc2
Opcode Fuzzy Hash: c47fcf5e07e7c5f4d06a0217db292230f56d989307576075697b1a95dab1a1d4
Instruction Fuzzy Hash: 65414A30B1DB454FE3699B3844952767BD1FF9A312F08457FE48EC3692CE2CA8428382

Function 00007FFD34B08C52 Relevance: .2, Instructions: 160COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2278619221.00007FFD34B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34b00000_good.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a5269b4ab01ceeaeea65f6944d367960bdc6a828fdc532cd967dad7dfc75618c
Instruction ID: f8524c76679b8d442aee9ebe052befa28541f99dbf9427acef778080c1441f4b
Opcode Fuzzy Hash: a5269b4ab01ceeaeea65f6944d367960bdc6a828fdc532cd967dad7dfc75618c
Instruction Fuzzy Hash: CC414930B0DB454FE3599B38589517A7BD1FF8A322F09457FE48DC3292DE2DA8428342

Function 00007FFD34B04FCD Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2278619221.00007FFD34B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34b00000_good.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1fa46e92cc4ae1bc235a611e99e581908ef8b912a9e2aa45ed8808efca645758
Instruction ID: a8c168b4680a63464ba0f081c72b2a59202faf00e234756f83344d50501b0ef4
Opcode Fuzzy Hash: 1fa46e92cc4ae1bc235a611e99e581908ef8b912a9e2aa45ed8808efca645758
Instruction Fuzzy Hash: 6D314A2170DD490FE7D8EB2C58A6ABA77D2EF8A36171801B9D44EC3257DD1CAC038380

Function 00007FFD34B11FA0 Relevance: .1, Instructions: 144COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2278619221.00007FFD34B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34b00000_good.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ffa4c759ea74f0d5a852a0132adfa4f02ef93b10bee8766755839561869107b3
Instruction ID: 87e8214000b96f98fbc7efd6df1bdf5d0127dcf31768aba45738e54114109fcf
Opcode Fuzzy Hash: ffa4c759ea74f0d5a852a0132adfa4f02ef93b10bee8766755839561869107b3
Instruction Fuzzy Hash: 4241BF31A08B864FEBA4DA28E0E4B66B7D2FF55304F484679D58EC36C1DA6CF885D341

Function 00007FFD34B05410 Relevance: .1, Instructions: 141COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2278619221.00007FFD34B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34b00000_good.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3fbdaa9998994bec04e1d252b1af80c6a2f009259a62fcc65cb4918059dbefe
Instruction ID: 4d461ae5a07f5af65678efed47b5378742642363f54f24b8629c42a8667f99eb
Opcode Fuzzy Hash: b3fbdaa9998994bec04e1d252b1af80c6a2f009259a62fcc65cb4918059dbefe
Instruction Fuzzy Hash: 6F31573071CE1A4FE798E72C98A6AB933C5EF56312B14017CD54EC3596EE59FC028282

Function 00007FFD34B0E435 Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2278619221.00007FFD34B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34b00000_good.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c18f0d958fdf3f9f54987a2ad534298a9bf6b69c3ab2aa79de935b4c5dd8a97
Instruction ID: d627b62470f178e91849eda82e60747ceef2b98cb8e823a01f1b352de2fe5a91
Opcode Fuzzy Hash: 8c18f0d958fdf3f9f54987a2ad534298a9bf6b69c3ab2aa79de935b4c5dd8a97
Instruction Fuzzy Hash: 6C41D331A18F464FEBA5DB1C84A1566B7E1FF96745B040A7ED48AC3582DF28F8058742

Function 00007FFD34B00262 Relevance: .1, Instructions: 139COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2278619221.00007FFD34B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34b00000_good.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5b4059122a3a8459f1ebce6651cdf73e883b6c56487e167bdbd9df4e2a227f4
Instruction ID: 9beb88bb50ee08dfec44f827d46900e3e0aaabb93323040b0535042929a3a2ab
Opcode Fuzzy Hash: e5b4059122a3a8459f1ebce6651cdf73e883b6c56487e167bdbd9df4e2a227f4
Instruction Fuzzy Hash: 64316E3170CA084FD798EA1CA466279B3D2EBD9721B5407AFD44AC3395DE25AC428786

Function 00007FFD34B06C1D Relevance: .1, Instructions: 139COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2278619221.00007FFD34B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34b00000_good.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db003e2086a12cb445b20a7b52ffd8cf2e667590c6c6b2d53f853c4e5f1dff95
Instruction ID: d9258cfc62fa7fae4b26caf3a156cd28f74c8b49e425b4f1b9f307d98a274428
Opcode Fuzzy Hash: db003e2086a12cb445b20a7b52ffd8cf2e667590c6c6b2d53f853c4e5f1dff95
Instruction Fuzzy Hash: C0310321B0DA4A0FF7A5A76C64E967437D1DF6B222B0400BBD94DC72A3DD1DAC429342

Function 00007FFD34B180F8 Relevance: .1, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2278619221.00007FFD34B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34b00000_good.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c4fbc14fedb15f730d776e2d41a6b387a84af224c27d1ea49d2e0b1616e48fb0
Instruction ID: 887c89d9582ce45584e66df312a987120674db5586510c4770cb849a66a4b7f5
Opcode Fuzzy Hash: c4fbc14fedb15f730d776e2d41a6b387a84af224c27d1ea49d2e0b1616e48fb0
Instruction Fuzzy Hash: 0B41E971A0DA854FD7658B2888A97B17BE1EF9B310F0941BED48DC7192DE38A815C782

Function 00007FFD34B04FF0 Relevance: .1, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2278619221.00007FFD34B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34b00000_good.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7e30798bbf47678d1b4ba108e771cbbd8845095d193fddc4101bf6e0b4b8065
Instruction ID: efa296891ec725d3260a826f0759e9e0c9e5efae05eb55982c67e488558e0adb
Opcode Fuzzy Hash: f7e30798bbf47678d1b4ba108e771cbbd8845095d193fddc4101bf6e0b4b8065
Instruction Fuzzy Hash: 2731096170DD490FE7D8EB2C54A6ABA77D2EFCA36171801B9D44EC3257DD18AC434380

Function 00007FFD34B0E335 Relevance: .1, Instructions: 123COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2278619221.00007FFD34B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34b00000_good.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 95aef6114f8b3251706c92cddce8c6f74bd3f01de1f73c37a122223f668121b3
Instruction ID: a2a39f854076635fcc27e207997fcf5690764e0efd9df24315a041469d3aca3e
Opcode Fuzzy Hash: 95aef6114f8b3251706c92cddce8c6f74bd3f01de1f73c37a122223f668121b3
Instruction Fuzzy Hash: 3331D761A1CA850FDB5DAA5C98665F93BD0EF65310F0810BFF44EC3183DD39B8468382

Function 00007FFD34B1D69A Relevance: .1, Instructions: 122COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2278619221.00007FFD34B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34b00000_good.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8311cae16c2aa998ac711ce54d46cfa2ec9099bfebcb69f80248edd33de4b5d
Instruction ID: 8d251d7bba2fc53cbbc213db1317fa671066a7a8f0dc85072ea7cab707afeb93
Opcode Fuzzy Hash: b8311cae16c2aa998ac711ce54d46cfa2ec9099bfebcb69f80248edd33de4b5d
Instruction Fuzzy Hash: A2315221B1CE074BE759EE5C80A1576B3D2EFA9340F14467DE45EC3686DE38F8429682

Function 00007FFD34B0F630 Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2278619221.00007FFD34B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34b00000_good.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9cfd562a7164b3fe990705f7f92597a7cf70af51bd401c14702aea6b66d0a507
Instruction ID: 4edc9d28bb33a36d956ec64241cdce97370e279cb18f2a35a6607e18d38f3ec7
Opcode Fuzzy Hash: 9cfd562a7164b3fe990705f7f92597a7cf70af51bd401c14702aea6b66d0a507
Instruction Fuzzy Hash: D031C321B0D90A0BFBA8DB5894B877627D1FF9A301F0841BED54DC72D6DE69AC41C782

Function 00007FFD34B0137D Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2278619221.00007FFD34B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34b00000_good.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3aa88fcbd16db74f68065cba389c379073b166287b98e81bbba918d70f554a41
Instruction ID: 4d604d166c2378176250b9a98279a6014e6d357743ccecbe02538953acf0167f
Opcode Fuzzy Hash: 3aa88fcbd16db74f68065cba389c379073b166287b98e81bbba918d70f554a41
Instruction Fuzzy Hash: 3B319C3060CA498FDB98EB2CC094BA477E1FF5A305F1405B9E84DC72A2CB69EC85C741

Function 00007FFD34B161C0 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2278619221.00007FFD34B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34b00000_good.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9af2dd4510488aba7414700f76fbbd39574dbdde4ea65405cb1da015f4c8706
Instruction ID: b486636c3f071c841836c629e9b3d09eb753f35b9b7e6ac0ca78bf43620c91d6
Opcode Fuzzy Hash: e9af2dd4510488aba7414700f76fbbd39574dbdde4ea65405cb1da015f4c8706
Instruction Fuzzy Hash: C321A222B1C9094FEB58EA5CA4A16B573C1EF95310F14427EE54EC32D7DD29FC829682

Function 00007FFD34B09CDA Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2278619221.00007FFD34B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34b00000_good.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 95cf21e6d6bd40e3c4e62093601cc9ce7691abcf4565f0e21d2d7fd72ab1ece9
Instruction ID: bc33b547a346b29d922d8c796b1d0704b3ebffeaeeda7f6756d5efa594e88745
Opcode Fuzzy Hash: 95cf21e6d6bd40e3c4e62093601cc9ce7691abcf4565f0e21d2d7fd72ab1ece9
Instruction Fuzzy Hash: E021F562A1DA810FE75D975858A65B67BE0EF96310F0440AFF08ED3193DE38B8068782

Function 00007FFD34B08D11 Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2278619221.00007FFD34B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34b00000_good.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4066987e2b7dae403d939caa99a2443a1b05017e9c02ec4e88839ebec143f0a
Instruction ID: d9dca0a67631c057d01d19be8ce5711e615fd178695c8add1d3d86b4f0ab61b2
Opcode Fuzzy Hash: f4066987e2b7dae403d939caa99a2443a1b05017e9c02ec4e88839ebec143f0a
Instruction Fuzzy Hash: 5931C151F0EA870BEBE9872C08B127576C2AFD6605B4816BED54AC3583CE1CED447282

Function 00007FFD34B1A528 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2278619221.00007FFD34B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34b00000_good.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e319e6ae00aecd4f40d270216e8a4e6623bffea2e07012a16e46a597d894ff5
Instruction ID: 2a44c11c1c83939bb8798cec0e4d7be2f8baf5ad5c5e37f8913678c695537e0a
Opcode Fuzzy Hash: 3e319e6ae00aecd4f40d270216e8a4e6623bffea2e07012a16e46a597d894ff5
Instruction Fuzzy Hash: 4D318070718E0E4FDBA4EB5DD4A5A62B3D0FF6A304B500579E55EC3A51DE28FC818B81

Function 00007FFD34B17E21 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2278619221.00007FFD34B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34b00000_good.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0195cc733e66a733e99623f361f27320e99589364b0fbca2308848632a2658f
Instruction ID: 9d8257d5fcf75a1d720b804f37cec649241307b1e3f422946de8bbe34b3da6bf
Opcode Fuzzy Hash: c0195cc733e66a733e99623f361f27320e99589364b0fbca2308848632a2658f
Instruction Fuzzy Hash: 59213A3170DB484FE748A72C949997A7BD0EF8B310B4005BEE54AC3263DD28AC429783

Function 00007FFD34B07BF6 Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2278619221.00007FFD34B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34b00000_good.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9eeb83295d06a1f8b302d30e64d4d2cdd7b531fc8a35f33053224274a7241842
Instruction ID: 4b17ff79f4bc1a8dc3c18fd27faac8d64849bada8d8fd9466306afbcd11a724f
Opcode Fuzzy Hash: 9eeb83295d06a1f8b302d30e64d4d2cdd7b531fc8a35f33053224274a7241842
Instruction Fuzzy Hash: FB213F72B1DA484FEB649B2CACB46B47BD1EF9B305B4400BAE149C73D3DE1998058306

Function 00007FFD34B0A0D3 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2278619221.00007FFD34B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34b00000_good.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4b4bdf09d5fde07e8f36d42ae2c9c60d79f9117295c362ffcfcd29acf6ac551
Instruction ID: 33d7d6603c1f0518a6e51eb21a32ad4d54205c33ca6db7a74b7f67f268943062
Opcode Fuzzy Hash: d4b4bdf09d5fde07e8f36d42ae2c9c60d79f9117295c362ffcfcd29acf6ac551
Instruction Fuzzy Hash: C5317031708A098FEB94EB18E4D5A61B3E1FF6A301B4405A9D44EC7692DB29FC86CB41

Function 00007FFD34B0EA98 Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2278619221.00007FFD34B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34b00000_good.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1484f91ab0f2397a12649987bd8725667f1d7c4974d2623f17fb1f8e3b5d5553
Instruction ID: b715732f7fc592bfe33f9f1505a5479c1c317ba2421d8eef5aa481418e36ee2d
Opcode Fuzzy Hash: 1484f91ab0f2397a12649987bd8725667f1d7c4974d2623f17fb1f8e3b5d5553
Instruction Fuzzy Hash: 6D31F23170CA494FEB65DB28D4E0A6073E1FF8A315B5405BAD54EC7296CB2EF882C702

Function 00007FFD34B0A7B0 Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2278619221.00007FFD34B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34b00000_good.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81bc4aff74ae16fbdfedfd005d0e8380dec6d1e5f74b79fe019f9f09109e6f2c
Instruction ID: bbc8ba66110beaf1be67314201a20b580f26d1ecc3f46a04965fd402506396bb
Opcode Fuzzy Hash: 81bc4aff74ae16fbdfedfd005d0e8380dec6d1e5f74b79fe019f9f09109e6f2c
Instruction Fuzzy Hash: F221F311B1890A4FEAB4975C24E527663C1EFAD312B0400BBE90CC3286DE1CEC4752C2

Function 00007FFD34B1BDC8 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2278619221.00007FFD34B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34b00000_good.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 664926337956478a166b9f46882daa1b42ecdd5bd543c575a9bd06f5b717430c
Instruction ID: ba1830794e15c26a97e207ff069d83f59f2aece9155f6273fdd38be82c6b5267
Opcode Fuzzy Hash: 664926337956478a166b9f46882daa1b42ecdd5bd543c575a9bd06f5b717430c
Instruction Fuzzy Hash: C021903170DA894FD79AEB7884A067077D2EFAA30471401BEC18ACB2A7CD2DA846D701

Function 00007FFD34B1B6A6 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2278619221.00007FFD34B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34b00000_good.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd66fe8605c227d886a3f19650c6f2aa6a3788c8f36aaea342c858dd3e51c879
Instruction ID: a9a3368af404963225da16324d95b4985229094c529795856971ffd93209bcf2
Opcode Fuzzy Hash: dd66fe8605c227d886a3f19650c6f2aa6a3788c8f36aaea342c858dd3e51c879
Instruction Fuzzy Hash: 3E21E432F0C8594BEB989E2C58B42B877D1EF96748F0400BAE54DD73D2DE2D6901D382

Function 00007FFD34B0A7AA Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2278619221.00007FFD34B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34b00000_good.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cecbc53fbc53fdaca71a735747c4dc65a5a94383ad1fd6d64d11d476b41cc0a1
Instruction ID: 452082a002c6c6d25c739ccb5a01d2e747eecad0a99a2afebec65d21d1241278
Opcode Fuzzy Hash: cecbc53fbc53fdaca71a735747c4dc65a5a94383ad1fd6d64d11d476b41cc0a1
Instruction Fuzzy Hash: EA21C011B18A0B4FEAB5975C24E127A63D1EFAE302B0440BAD94DC72C6EE1CEC4752C2

Function 00007FFD34B09D00 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2278619221.00007FFD34B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34b00000_good.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e907b6d2454207b28205b7cc52c8a043698b3b44cd7a10eb8e499a4fb4647c67
Instruction ID: f20a225502b9136f9d606c1a45e9c0551f59831a8edcedfa5f4741281c41328e
Opcode Fuzzy Hash: e907b6d2454207b28205b7cc52c8a043698b3b44cd7a10eb8e499a4fb4647c67
Instruction Fuzzy Hash: 8B212531B1CA410FE75CA69C94629BAB7D0EF99310F04506EF08ED3293DD34B8068786

Function 00007FFD34B08280 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2278619221.00007FFD34B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34b00000_good.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba7f1880965f57c915b195e257e416c39b3953dae7fba7e02b493b2bcf27069e
Instruction ID: e7feea8dabd72e0594936a4e6cbc5c3f27ab5075c58662baa19596b18a8b1c7d
Opcode Fuzzy Hash: ba7f1880965f57c915b195e257e416c39b3953dae7fba7e02b493b2bcf27069e
Instruction Fuzzy Hash: 6A210821B1DA0D0EE7A0BE3968983B6B3C4EB9A326F54067BE94DC2581DE5D58D0D342

Function 00007FFD34B0FCB5 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2278619221.00007FFD34B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34b00000_good.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38b094c27790b7d97b562e9f00020ad03a21edaf406cdfc3bfdf1995bd62542b
Instruction ID: 674b6a0c519ea0dd08e04d2efaa55e611c7c2fd6bc6d8b3e30b52f723e80c141
Opcode Fuzzy Hash: 38b094c27790b7d97b562e9f00020ad03a21edaf406cdfc3bfdf1995bd62542b
Instruction Fuzzy Hash: EC117231B0C70C4EEB58DA5DA4922B9B7D0EB89321F10413FE68AC3242DA25B8474686

Function 00007FFD34B14307 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2278619221.00007FFD34B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34b00000_good.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2d375bc913cded15c8ade7a0e7be44a939282189f49fd0d2d19f35cea29f448
Instruction ID: b7b67a554a1e5796835d39ffce56e9b6ad151c7f2f3322ecf54d894f0278bc99
Opcode Fuzzy Hash: a2d375bc913cded15c8ade7a0e7be44a939282189f49fd0d2d19f35cea29f448
Instruction Fuzzy Hash: 5A31A030A08B854FEBA4DB18D094B66B7E1FF5A304F444A7DC58EC3691CA68F881D701

Function 00007FFD34B11EA0 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2278619221.00007FFD34B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34b00000_good.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fcf25d448214253de816ecb1c214fb4f13cd128ea093533a4a5f6ce732ad840f
Instruction ID: 7a3d7945df59ee4edc0dc028c75c9956df1672e8e271b7219d6a6a1429431870
Opcode Fuzzy Hash: fcf25d448214253de816ecb1c214fb4f13cd128ea093533a4a5f6ce732ad840f
Instruction Fuzzy Hash: E911C33070C9194FEB5CDA18D8A97B672D1EB96311F64003ED54EC6192DA6AEC83D681

Function 00007FFD348A4555 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2274367338.00007FFD348A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd348a0000_good.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6da1cce4bba3ccfe48c45949fb72d5edaa59a1f95d7a10bbd348312c45a59d23
Instruction ID: e04c3f2da4804793a69d32717c424c99b066ef5b608b9f7d798e7810acaa3b70
Opcode Fuzzy Hash: 6da1cce4bba3ccfe48c45949fb72d5edaa59a1f95d7a10bbd348312c45a59d23
Instruction Fuzzy Hash: A821AC2190E3C25FE71797348C626957FA09F43364B1E02EBD490CB1E3DAAC6816D7B2

Function 00007FFD34B11104 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2278619221.00007FFD34B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34b00000_good.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 484ed84d019a20711642f0762a8c757cdb9d4155c8303dcb19ca7076f60aa7eb
Instruction ID: b5ad6063fd8f2b2e65f232512a3426c672bed88148992b2d6dc7f2c5a6917e2f
Opcode Fuzzy Hash: 484ed84d019a20711642f0762a8c757cdb9d4155c8303dcb19ca7076f60aa7eb
Instruction Fuzzy Hash: 91212631B0DA4A4FE754AA6894F06B677E2EF9A254F04407AD54DC3187CD3CE852C301

Function 00007FFD34B00729 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2278619221.00007FFD34B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34b00000_good.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ec0f110422d53f2bcc6a64a06b5be604422aed5faa9acec107fb982c7fe7660
Instruction ID: 3ded5d51e21d1e7d5b793dd63600b780c802c4b83c17d2f91c982c17a339d213
Opcode Fuzzy Hash: 0ec0f110422d53f2bcc6a64a06b5be604422aed5faa9acec107fb982c7fe7660
Instruction Fuzzy Hash: 2911E62270D98A4FE794D72CA4E8661B7E1FF9A311B1801BBD18CC7296DE1DAC81C741

Function 00007FFD34B08268 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2278619221.00007FFD34B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34b00000_good.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 488bf273ebb573aea1312cf970d2e0cea94bec897058f6f5c776abbe9e0fb5ec
Instruction ID: e453bd9842082fc80598e53f2f694c085a7526b0ef06a20eb5c3fb0ef646a732
Opcode Fuzzy Hash: 488bf273ebb573aea1312cf970d2e0cea94bec897058f6f5c776abbe9e0fb5ec
Instruction Fuzzy Hash: EC210531F09A4A4FEBA4AA6894E06B6B3E2EF9A354F144079D40EC3187DD3DF861D301

Function 00007FFD34B0A791 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2278619221.00007FFD34B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34b00000_good.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aafdf4463b63ac18a00987dc5f8c7f3a9efa5c6ca7f20f51d3d6a34424e4aa0d
Instruction ID: 06d001dd9eb07fd5f7c864f322820bcc0fedc5c33e655e43c2517803946f25f0
Opcode Fuzzy Hash: aafdf4463b63ac18a00987dc5f8c7f3a9efa5c6ca7f20f51d3d6a34424e4aa0d
Instruction Fuzzy Hash: 76110A20B095064FE665976C64E56B533D1DF9E30170400FAD948CB297DE0CAC4B5382

Function 00007FFD34B17EF5 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2278619221.00007FFD34B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34b00000_good.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 223d84b63d4a85dc620c56b23977b970a2d55cc888acbace519f181bf2b3c395
Instruction ID: 3e010e2ced16fa2e9235249b24957b59d70df0c8d04722933d5d645c90238c7c
Opcode Fuzzy Hash: 223d84b63d4a85dc620c56b23977b970a2d55cc888acbace519f181bf2b3c395
Instruction Fuzzy Hash: D3216024A1D6C34BEB665B2944F857A3BD1AF03315F6804F9D24DCB4D2EA1CE946E213

Function 00007FFD34B10302 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2278619221.00007FFD34B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34b00000_good.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 878d3c998394301474e290cbdc2515ed6f832bdfc0812a748159bdd3d26809d5
Instruction ID: edefb0d1e888643f4c70846145d9befc24b8c356f317ed998536fedc6f525228
Opcode Fuzzy Hash: 878d3c998394301474e290cbdc2515ed6f832bdfc0812a748159bdd3d26809d5
Instruction Fuzzy Hash: 2B21C03071CA454BDA58EB58D0A1AB973E2FF99300F54856DD45E836C6CE38B845DB42

Function 00007FFD348A404A Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2274367338.00007FFD348A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd348a0000_good.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 59153c1bcdbc91da408d635ee5b1f8405e46ef4808569062a709bd823b153a3f
Instruction ID: dd8892a4cac80fc73ee095e48be04e6f550d81e5e508fab518756d87cda8271a
Opcode Fuzzy Hash: 59153c1bcdbc91da408d635ee5b1f8405e46ef4808569062a709bd823b153a3f
Instruction Fuzzy Hash: 5211B421F0E9198BEFD8E74C84A567C3392EB99B40F104235D10DD32C6CD6CBC42A791

Function 00007FFD34B1C17F Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2278619221.00007FFD34B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34b00000_good.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3fa325125354139ae032bb81b07663b926537b5ddbb56eb5735e4e87ce5939f1
Instruction ID: 1c96965764c31437dd4323cda9cf9a1781cf4fc824658b41f01bd99806e0ea77
Opcode Fuzzy Hash: 3fa325125354139ae032bb81b07663b926537b5ddbb56eb5735e4e87ce5939f1
Instruction Fuzzy Hash: 0A114C42A1D7D60FE366A77858F61A97FB0EF07214B4900F7C688CB193ED0C585A9397

Function 00007FFD34B1037C Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2278619221.00007FFD34B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34b00000_good.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eea29bb908de72c16bf5f431382a2e31de16f1121040d924e105be02166e964a
Instruction ID: 928f9218b27fb214fe3e49693b399538df051631bb6b347e0e8b125c85e6f2cd
Opcode Fuzzy Hash: eea29bb908de72c16bf5f431382a2e31de16f1121040d924e105be02166e964a
Instruction Fuzzy Hash: B021FF30A1CA424BDB5CEB5890A17BA73E2FF99300F54856DD49E836C6CF38B445D742

Function 00007FFD348AC922 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2274367338.00007FFD348A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd348a0000_good.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1e643e5c329ef03809ec0b57f834636589d7760c88ff1ae4ca5f1cf966f9262
Instruction ID: fbd2618cea223d1e34cc26eb22162ac2368ed90d48b43cbda6f27c00b2755231
Opcode Fuzzy Hash: f1e643e5c329ef03809ec0b57f834636589d7760c88ff1ae4ca5f1cf966f9262
Instruction Fuzzy Hash: B0216230B0A6498FDB89EF68C4A1AA977A2EF55314B1405B8D44DCB2D2CE79E802CB50

Function 00007FFD348A07D3 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2274367338.00007FFD348A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd348a0000_good.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3768668137ec2ad2cd09d25467fc52472235c36efa8402ad27d5c756b9e46c42
Instruction ID: bdfdfa1c477ea5136efad21e534848852e36f3c45a5dc16964c5ede2469a1101
Opcode Fuzzy Hash: 3768668137ec2ad2cd09d25467fc52472235c36efa8402ad27d5c756b9e46c42
Instruction Fuzzy Hash: 6E215463A0E3811FE752ABBC98B20D53F609F43318B0D40F7D188CE093E96D6445A666

Function 00007FFD34B1BF2D Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2278619221.00007FFD34B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34b00000_good.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70a4c83aa747079a860a8a03e3a7159a9db1d99f41acb342039213889a9f421a
Instruction ID: de47d763b206de147eadcad9a4bc469976420ecf403fd27485af452751d86667
Opcode Fuzzy Hash: 70a4c83aa747079a860a8a03e3a7159a9db1d99f41acb342039213889a9f421a
Instruction Fuzzy Hash: C9110811A1D9960FD79A8B6824A01F57BE0EF4A250B1801F7D548CA187DD1CE942D7D2

Function 00007FFD34B0E607 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2278619221.00007FFD34B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34b00000_good.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0d0ead03968c617e1ac4440b042ff570feaccee8ce0f3092529956da11b31ec
Instruction ID: 66253345fec7e0447cdecca087454bad05b311fb495f324221f048dbb9b44bde
Opcode Fuzzy Hash: f0d0ead03968c617e1ac4440b042ff570feaccee8ce0f3092529956da11b31ec
Instruction Fuzzy Hash: 3411C632B08A194BEB64DB19A4915FBB3E1EFD5326F000A3BE64DC3590DB29E4458781

Function 00007FFD34B112E9 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2278619221.00007FFD34B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34b00000_good.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29c94eaa2fd646b25bf6135069281de6dc144f1062a3d5f8f8aa33958adb8105
Instruction ID: 09719a8c61c21497632c4b47902e8027f2caa00cbb3375e73787fa205f2f51b1
Opcode Fuzzy Hash: 29c94eaa2fd646b25bf6135069281de6dc144f1062a3d5f8f8aa33958adb8105
Instruction Fuzzy Hash: 3D11293270DB844FC755D72C9469125B7D1FF9A21071802EBD088C72A7C928EC46C7C2

Function 00007FFD34B00078 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2278619221.00007FFD34B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34b00000_good.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af3239ab2f71b4264ae85f91331bfa5ad8bfd35933e2de92023193fcc4cd7f64
Instruction ID: d45e768d865abf2a5c8ac7fd253dc83ab31c42775be9feac575fac8c9ac7174d
Opcode Fuzzy Hash: af3239ab2f71b4264ae85f91331bfa5ad8bfd35933e2de92023193fcc4cd7f64
Instruction Fuzzy Hash: E8113A70908A4E8FDF80EF68C895AED7BF0FF29305F10456AE50CE3251DB74A5808B81

Function 00007FFD34B15878 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2278619221.00007FFD34B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34b00000_good.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c05cde440e5b3535704548e65f0289123f80a4d3496fdc213c6fdfcf2d9bead
Instruction ID: 8c3b3c4055d47a2298b505fdea1718553406450ca5f80194c1066eaf54e35b05
Opcode Fuzzy Hash: 5c05cde440e5b3535704548e65f0289123f80a4d3496fdc213c6fdfcf2d9bead
Instruction Fuzzy Hash: DE114630618A098FDF98DF29C494E6273E1FF99318B2409ADD44EC7691CA3AF843D740

Function 00007FFD348A448F Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2274367338.00007FFD348A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd348a0000_good.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ed11dd8e3be54e20b7108302e6b481c80d407cb68dbffd244cd6689db42e095
Instruction ID: 2ad163e6172cd56f47623518ca4a017789bce01a52f022a5dcaa8ee20397f807
Opcode Fuzzy Hash: 6ed11dd8e3be54e20b7108302e6b481c80d407cb68dbffd244cd6689db42e095
Instruction Fuzzy Hash: E501A77254E21C1EF72CAA85FC476F97798EB83134F00112FD18E82452E56779538765

Function 00007FFD348A7B34 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2274367338.00007FFD348A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd348a0000_good.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 677a8a8039535cd97b8b625ad5fdab3a682632ec8ad280976b0fb67c225c6b75
Instruction ID: a977cbabc195502ec0d20129b144473d9b9f01340b9aed0a6e53e2cc2ef29ffa
Opcode Fuzzy Hash: 677a8a8039535cd97b8b625ad5fdab3a682632ec8ad280976b0fb67c225c6b75
Instruction Fuzzy Hash: CC118E25B0E90A4FEBD4EF08C4A06A42792FF96350F0404BAD95DD72E6EE6DEC429750

Function 00007FFD348A44D3 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2274367338.00007FFD348A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd348a0000_good.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a903c8d208cb3da939730a3c47271100c43535b8a501af036643ac9a16ba571a
Instruction ID: 7c0c2ce726088f24ad2defb7ff50e14de6b542a3efba87402173582314c9d62e
Opcode Fuzzy Hash: a903c8d208cb3da939730a3c47271100c43535b8a501af036643ac9a16ba571a
Instruction Fuzzy Hash: 1401446114E3C82EE71A6B25AC678F67F68DA83250B0512DFE4C9CA053E0856F26C372

Function 00007FFD34B079C2 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2278619221.00007FFD34B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34b00000_good.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b1680b2654ed634646453f40dffbd3257ce0e6e7d9e24631005752c35e27d50
Instruction ID: f42f0a62cd9d2fc3925a32601e71378bb935798932600dc3ab1579e28600f788
Opcode Fuzzy Hash: 6b1680b2654ed634646453f40dffbd3257ce0e6e7d9e24631005752c35e27d50
Instruction Fuzzy Hash: 4D019E3070C98E5FDB95E72C98A86247BE2EF9A31130D01E3D408CB2A3CA1CDC41C782

Function 00007FFD348A0815 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2274367338.00007FFD348A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd348a0000_good.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6449b8d86c456cd37d6ef1b302c5cb5be78737518c5c87328b1b28ff43135fd
Instruction ID: ffafcf810e2f91758278cdcb7c24d002e607586359ecba78bff6e265acd8fceb
Opcode Fuzzy Hash: d6449b8d86c456cd37d6ef1b302c5cb5be78737518c5c87328b1b28ff43135fd
Instruction Fuzzy Hash: 03110A62A0E3D11FD713ABB8A9B11D53F609F43318B0D41F7D198CA093E8AC68499356

Function 00007FFD348A1949 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2274367338.00007FFD348A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd348a0000_good.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 09457c084dd5c13f1bf4b83521060a4e57d04195bfdb8d1fe7aa31e41a8dee50
Instruction ID: 20f1e92058e372c93546d112cafcbf7902e65bae953ecb6ee511e322062070ff
Opcode Fuzzy Hash: 09457c084dd5c13f1bf4b83521060a4e57d04195bfdb8d1fe7aa31e41a8dee50
Instruction Fuzzy Hash: C9F02833B0D5290FE678DA5CAC955F67386F787330B0542BAD009D3295ED992D1393C0

Function 00007FFD34B1A630 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2278619221.00007FFD34B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34b00000_good.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 82cd61450375c179125a90278602026b68bc36f12918197375c7cde479ec8be2
Instruction ID: 1ec8bf8a1318837b8fa5747311bf9a3dd7ef663d4b191bd91d595a28413a2755
Opcode Fuzzy Hash: 82cd61450375c179125a90278602026b68bc36f12918197375c7cde479ec8be2
Instruction Fuzzy Hash: E901DF21B14C0A5FEBD8E76884A9AB563D1FF9A25075000B9E00EC3296CD2CBC82C380

Function 00007FFD348A3600 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2274367338.00007FFD348A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd348a0000_good.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e56ab5fae439ce50885912f07bb02cc913583bcfe72983f85cbce45ecbe9e4f
Instruction ID: e61d527a4b97748ec4f7b39d9cf39f71532fd74b84523f02d6e12df4736e496f
Opcode Fuzzy Hash: 6e56ab5fae439ce50885912f07bb02cc913583bcfe72983f85cbce45ecbe9e4f
Instruction Fuzzy Hash: 0A012862F1BA9A0BE75C9F2850E51F867D1EF6664070405BEC84ACB3C7DE59AC829290

Function 00007FFD34B007BA Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2278619221.00007FFD34B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34b00000_good.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f66f54d56346bb6eddf688f6b6b21ca3e5f83bb95cc789bbcbe73f0b6d557466
Instruction ID: 3e0526974e6610b9369c808bf3ba8a73630d9b11118328e22b5d2adf0c1be8cb
Opcode Fuzzy Hash: f66f54d56346bb6eddf688f6b6b21ca3e5f83bb95cc789bbcbe73f0b6d557466
Instruction Fuzzy Hash: C2014F32708D0A4FEA98DB1CD4D8B6163D1FB99351F58407AD54DC7252DE29EC828B41

Function 00007FFD348A4011 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2274367338.00007FFD348A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd348a0000_good.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0254e7a00d5cf743a091ed27f7dc5d9c73ad9b75644cf5a529bec91eab03d2c3
Instruction ID: 7eb51e4fde044d30f596a187861d872cbe957df9aa829bf1ebe9670ad26fec26
Opcode Fuzzy Hash: 0254e7a00d5cf743a091ed27f7dc5d9c73ad9b75644cf5a529bec91eab03d2c3
Instruction Fuzzy Hash: 91017121F1A9198BEBD8DB5C98A577D33A2FB99700F140274E40DD32D6CE6CBC42A790

Function 00007FFD348A3FD8 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2274367338.00007FFD348A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd348a0000_good.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 109f6899fea40b364fbeca61a8326b0f3c199177a6e03fb3e3ccbf03416d6a80
Instruction ID: 3e3f2e987fdad04b70be9db4117f7d2fb4aba237d5dfa12bf566524d588f723f
Opcode Fuzzy Hash: 109f6899fea40b364fbeca61a8326b0f3c199177a6e03fb3e3ccbf03416d6a80
Instruction Fuzzy Hash: 4E01B161F1A9198BEB98DB4C88A567C33A2EBA9700F100179D00DD72D6CE6CBC429790

Function 00007FFD34B11A65 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2278619221.00007FFD34B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34b00000_good.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02f9eef1135d34ec04f62dd6bf96c8412e9e8a5d962a7b65bf15568d7d4bee4f
Instruction ID: 9f130a4b1f347a58bacbb35f63b9d4d132c638ce30fa5faec4bf07af477923ef
Opcode Fuzzy Hash: 02f9eef1135d34ec04f62dd6bf96c8412e9e8a5d962a7b65bf15568d7d4bee4f
Instruction Fuzzy Hash: E401D671B1C7184FD328DF1CA4920B977E1FFC9220B10077FE04AD3245CA36A80286C6

Function 00007FFD34B11F80 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2278619221.00007FFD34B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34b00000_good.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3ba1671a79c90a525d91b816a3787087a073ab840769a4881aee9f1787dfe64
Instruction ID: 7fb3c6e8f56e195f4f52d4d7bdf0e2f2f237dd9b261ff3f1cc342e8d9e8eff73
Opcode Fuzzy Hash: e3ba1671a79c90a525d91b816a3787087a073ab840769a4881aee9f1787dfe64
Instruction Fuzzy Hash: 9A118620A1CBD599F7759A2890D4371FBD05F17308F0858BCC5CAC26C2DA9DB8D5E352

Function 00007FFD34B1C0C0 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2278619221.00007FFD34B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34b00000_good.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c946b82ffe4e105c35cac052abca77012bc8b985c5d5a6f6ec561be54a6acdb2
Instruction ID: 554f38a4bd994e76892f84c366515022544bfb730e750ac9d78e5dff67110d02
Opcode Fuzzy Hash: c946b82ffe4e105c35cac052abca77012bc8b985c5d5a6f6ec561be54a6acdb2
Instruction Fuzzy Hash: A6F0F612B4C91A0FEBE8996CB4EA1B432D1EF4A221B0510BBE50CCB195E84D8CD183C2

Function 00007FFD348A4086 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2274367338.00007FFD348A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd348a0000_good.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b613a57a1b43437520b083d3d4615bed1fe8dc287e32a79e600c5cc9afc2adb9
Instruction ID: ed6f95b1817ff9ba5e8472db30ab0e446474035d9bff7b79dbe7dcb0710dd9b6
Opcode Fuzzy Hash: b613a57a1b43437520b083d3d4615bed1fe8dc287e32a79e600c5cc9afc2adb9
Instruction Fuzzy Hash: C7017121B0A9194BEBD8D75888A57BD33A2EF99740F144178D10DD72C6CE7DAC429790

Function 00007FFD348A07B8 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2274367338.00007FFD348A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd348a0000_good.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae6cb6f79cb564a4f16621fbbf9d40c074f515b82749b37f214826aaa7f8c5d6
Instruction ID: 2b66b1c50b95399493cae6f2d81304b5fd2950ef768e63457d0a6c5aaec29fc4
Opcode Fuzzy Hash: ae6cb6f79cb564a4f16621fbbf9d40c074f515b82749b37f214826aaa7f8c5d6
Instruction Fuzzy Hash: 11117C62A0F3C11FE753AB7858B10E53F60AF43314B0D41F7D588CA093E9AC6848A3A6

Function 00007FFD34B1D930 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2278619221.00007FFD34B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34b00000_good.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22c76d7e5d85fbf89b0ef63114098951cacd02a5c305bda9d8adb0e414efae10
Instruction ID: 7fdea02f42cc7560e379837b9a3f5cb1abefe4d1b3a89bf591e976e7d43ee8cd
Opcode Fuzzy Hash: 22c76d7e5d85fbf89b0ef63114098951cacd02a5c305bda9d8adb0e414efae10
Instruction Fuzzy Hash: E9018B21B0EB854FDB8ADB6C58E41643BA1EFAB21431900FBD058CB2A3C91D9C86D312

Function 00007FFD348A40BC Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2274367338.00007FFD348A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd348a0000_good.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef9742cb17afbf0821408234fbce939c5c6af19e662789f03c4d2bd4165169d2
Instruction ID: 934dd1617aa9b8a51df84a96f20c75f7d1ec9ee1c092557e9eefe9d0500c0642
Opcode Fuzzy Hash: ef9742cb17afbf0821408234fbce939c5c6af19e662789f03c4d2bd4165169d2
Instruction Fuzzy Hash: 40017121F0A9198BEBD8D74888A576923A2EB99740F104138D10DD72C6CE6DAC429790

Function 00007FFD34B14481 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2278619221.00007FFD34B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34b00000_good.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9219711c49eb84f9bac40b068583f645e85fd7834e6d7c28384641b2da28dc8
Instruction ID: 6467b4a34c296e8726cd0d85c4ac1af7f61e67437eaa1c970dcc33034d055e1d
Opcode Fuzzy Hash: f9219711c49eb84f9bac40b068583f645e85fd7834e6d7c28384641b2da28dc8
Instruction Fuzzy Hash: 38F0F40094CBA20EF7B3527D15A42B67FD09F22214F4914EAC9D9C58C2D84CA8C6C382

Function 00007FFD34B079E0 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2278619221.00007FFD34B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34b00000_good.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 789fb2811c7a3da6b33821274764af5022c401db9a9490b3c88c16c8145701cc
Instruction ID: 88129bc76e4f8c071931b7339f4dbf300a0b662cc7606fc3d48dea397b61b31e
Opcode Fuzzy Hash: 789fb2811c7a3da6b33821274764af5022c401db9a9490b3c88c16c8145701cc
Instruction Fuzzy Hash: 03F0FE30714C0E8F9AD4F71CD4A8A2573E6EFA931135902B6E40DC7265DF64DC42C781

Function 00007FFD348A9D0B Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2274367338.00007FFD348A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd348a0000_good.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21d0b6c17b4a573519e0eaf01286af41b2c8a48acac59fc047ee5d36b6c53e24
Instruction ID: 3f72af051ea17fd00e88d28b01dfb9e9f848d81a87163241c3d3ce6c0bff9a25
Opcode Fuzzy Hash: 21d0b6c17b4a573519e0eaf01286af41b2c8a48acac59fc047ee5d36b6c53e24
Instruction Fuzzy Hash: C101AD31F0A51A8BFBE1AB04C4A47B86291FF16310F0541B5CA4CE72D1CEBCAC85DBA0

Function 00007FFD34B13EED Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2278619221.00007FFD34B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34b00000_good.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 28fe71db137e166a337d82155e95235b4696ff178af07d760b2c632067c01f5e
Instruction ID: ac958bb3ffbc5c46e0ea17d6fb989e93246abc21296e52c77d3cb6341b96a2b6
Opcode Fuzzy Hash: 28fe71db137e166a337d82155e95235b4696ff178af07d760b2c632067c01f5e
Instruction Fuzzy Hash: 5601A26060E6C65FEB13973888A99713FA08F2721070945FEC48DCB5A3E80D9886C322

Function 00007FFD34B1637A Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2278619221.00007FFD34B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34b00000_good.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55063b565aa45e60e4eb251583c958c137e42bb4e5c30e7522dd9da442e9d58d
Instruction ID: a40e70894d4ea70753908f2f429d0d153445a88bd7a062fe23b032868782bc84
Opcode Fuzzy Hash: 55063b565aa45e60e4eb251583c958c137e42bb4e5c30e7522dd9da442e9d58d
Instruction Fuzzy Hash: 1FF0AF3271C95A4FE748DA5CA8A16E0B3C1EF86314F08417AE04EC7696DE2AF843D681

Function 00007FFD348A410C Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2274367338.00007FFD348A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd348a0000_good.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b92b97b2bf88c49d933b06ef7afdd0f8d37d7fde00de2c6abb5157286b3777b3
Instruction ID: 908ebb83d8bf4e8887ff1501111009c2b85080a337fcd6db7b011becec917411
Opcode Fuzzy Hash: b92b97b2bf88c49d933b06ef7afdd0f8d37d7fde00de2c6abb5157286b3777b3
Instruction Fuzzy Hash: 3F018F21F0A9194FEFC8DB58C8A57A833A2FB99700F144078900DD72C6CE7CAC42D790

Function 00007FFD348A9B89 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2274367338.00007FFD348A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd348a0000_good.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d1d8b67e77db66ef17fc26cb330c5d2f622a244423574e470f47e66f26c27949
Instruction ID: 8fd35e914bb51c158af0b2b7ef7c181e38ba69550727136cc4c673c70876c763
Opcode Fuzzy Hash: d1d8b67e77db66ef17fc26cb330c5d2f622a244423574e470f47e66f26c27949
Instruction Fuzzy Hash: 5D010431A099298FDBD8EB18C4A4A6973E1FF59301F1500E8D14DD72A6CE78EC82CF40

Function 00007FFD34B09E08 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2278619221.00007FFD34B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34b00000_good.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ada4abfd65cbd00325dfaabcd80b9c964feae7824e9aa5b0f780aaf285de9f4d
Instruction ID: 88d05c3fd189648b2051f0afff9d71d0d338701981389502069bc3ec35eb17c9
Opcode Fuzzy Hash: ada4abfd65cbd00325dfaabcd80b9c964feae7824e9aa5b0f780aaf285de9f4d
Instruction Fuzzy Hash: E301F930A08A4A9BEF64EB2484E4A7673D4EF6B315F14097EC40AC35A1DB39EC89C751

Function 00007FFD34B1C121 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2278619221.00007FFD34B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34b00000_good.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: adc7e829ef58fca03375dc9b688dc1d643fb621bd037077447578afa341c8957
Instruction ID: b09d5a43e61ee116387a91492b841f403621c97436baa38b6577ceef01e79f76
Opcode Fuzzy Hash: adc7e829ef58fca03375dc9b688dc1d643fb621bd037077447578afa341c8957
Instruction Fuzzy Hash: 3AF08242F4C92A0BE7A4556C25E71E86BD1DB47620B4510B2D618C6286EC4D5C929283

Function 00007FFD34B0273D Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2278619221.00007FFD34B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34b00000_good.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c20c60d324774d7774660ce2dc3445f7805a9e7dd47a51f8943964948cf59c35
Instruction ID: 3fc3a642ae6c21cd116077324f7d6cd04de0b2fce98a0a217966f417e8a8e3e1
Opcode Fuzzy Hash: c20c60d324774d7774660ce2dc3445f7805a9e7dd47a51f8943964948cf59c35
Instruction Fuzzy Hash: 98F0B421B1890D4FE784EB5CA49527573C1EB8D22AF1440BAD54DC3282CE39ACC68381

Function 00007FFD34B11ED0 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2278619221.00007FFD34B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34b00000_good.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 95223c9ade6c3c6a36ef664550dff7ef92275260768cebc0a4497145d6c0fa07
Instruction ID: 315fc33f8427fe024943e72750e8a128499bd9b98c73b23629ee9a00b61ad356
Opcode Fuzzy Hash: 95223c9ade6c3c6a36ef664550dff7ef92275260768cebc0a4497145d6c0fa07
Instruction Fuzzy Hash: 4FF0492071890E8FEF84EF2CC8E1E2073E0EF2A304B6455A8D40DCB291EA1AEC46D701

Function 00007FFD348AC90E Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2274367338.00007FFD348A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd348a0000_good.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9197a6c6e3d8816dc317eea4cd31b7f6a3703edd3c70b218aa258c50fa3bbf5e
Instruction ID: d95655eae186856736d9f3856b8f7d65b738d3ede04b1ff5002e3ec07ef05d78
Opcode Fuzzy Hash: 9197a6c6e3d8816dc317eea4cd31b7f6a3703edd3c70b218aa258c50fa3bbf5e
Instruction Fuzzy Hash: 4B018B30B0950A8BE756EB58C4A0AB97392EF46300F144178D849D72E2DE6CEC02CB90

Function 00007FFD348A5E2C Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2274367338.00007FFD348A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd348a0000_good.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e880b12fd87f2a70fb6237d012d7926cc04f3e55dd22e0774ea0af0c52725424
Instruction ID: b8d21f3b046a69bd4eefdb4b2f964e1c61952f2581f360ac8d4ca14008680c3b
Opcode Fuzzy Hash: e880b12fd87f2a70fb6237d012d7926cc04f3e55dd22e0774ea0af0c52725424
Instruction Fuzzy Hash: 68F0F431A1E59A4FE3C5D72C90A06E537F2EF4A710B5881F5C0DAC719BC86CA8939294

Function 00007FFD34B13EA3 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2278619221.00007FFD34B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34b00000_good.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 85bd503a947d78089536006fc6d5e5fd2232963fde3b96d9a6244860d3393165
Instruction ID: a854afc6d8685c5e4322897ad97d2d1666cf38edd95066eabca85614064191ef
Opcode Fuzzy Hash: 85bd503a947d78089536006fc6d5e5fd2232963fde3b96d9a6244860d3393165
Instruction Fuzzy Hash: 9AF0FF10B1D68A1FFB60EA3848A98B53FD0DF26204B1811BDC94EC7582EE09D842D302

Function 00007FFD348A40EF Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2274367338.00007FFD348A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd348a0000_good.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13cf86318c7c8d1a6bb749aee22751531ea93f43fe1334de2ae08f0b07d8eb25
Instruction ID: c0df901a1b813cf77f1ea6f255e84bec3e739f3a227ae2b044e91e7e56d20208
Opcode Fuzzy Hash: 13cf86318c7c8d1a6bb749aee22751531ea93f43fe1334de2ae08f0b07d8eb25
Instruction Fuzzy Hash: 20F06D31B0A4098FEB98DB48C4A42A83363FFA6304F204078D10EC7186CE7A7C42DB50

Function 00007FFD348A118F Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2274367338.00007FFD348A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd348a0000_good.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 819ee67eb5725c90b966f9b2069ebacf2d41aebc724ba41e428620fae302f6b4
Instruction ID: 963d66f01d5d7ac0098c8b06256d383c2631e0c2663ee35959de344370c6da88
Opcode Fuzzy Hash: 819ee67eb5725c90b966f9b2069ebacf2d41aebc724ba41e428620fae302f6b4
Instruction Fuzzy Hash: 23F0F622F0E8424BF798572858BA2B427D2EF97350F185179D05EC72D3DD6C68039311

Function 00007FFD348A1C0A Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2274367338.00007FFD348A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd348a0000_good.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2c02252641abb5afd7e11faa07851bb3366b0f98394373c9a778abfe88ef406
Instruction ID: c921ae1f1fe53dbbbdbe090f9fab59213c823d0b17bccf557f2f558aaf52d964
Opcode Fuzzy Hash: d2c02252641abb5afd7e11faa07851bb3366b0f98394373c9a778abfe88ef406
Instruction Fuzzy Hash: E1F0FF30F0860A8FE780EBA488A55BE77E0FF56321B00093AC01AD3291EABC6581C780

Function 00007FFD348A3FB8 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2274367338.00007FFD348A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd348a0000_good.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b61eafb22ad435c6abc9cdb69c478fdf2bf177d8c78fe89e032b02ddd3fa046e
Instruction ID: c0df901a1b813cf77f1ea6f255e84bec3e739f3a227ae2b044e91e7e56d20208
Opcode Fuzzy Hash: b61eafb22ad435c6abc9cdb69c478fdf2bf177d8c78fe89e032b02ddd3fa046e
Instruction Fuzzy Hash: 20F06D31B0A4098FEB98DB48C4A42A83363FFA6304F204078D10EC7186CE7A7C42DB50

Function 00007FFD348AD0A9 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2274367338.00007FFD348A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd348a0000_good.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67e85dd49fd9143a0aa69374e6ddc92f3b4ca9e61d073508d504cc4e399e5dc3
Instruction ID: 5b5139068731ceff6a1447bc8f891a91d7ff71fba87a2eb71e11b220b6aa4d21
Opcode Fuzzy Hash: 67e85dd49fd9143a0aa69374e6ddc92f3b4ca9e61d073508d504cc4e399e5dc3
Instruction Fuzzy Hash: 54F0AF31F0942A8BEBA0FF04C4A47A87292FF56310F1141B5C94DE72D5CEBC6D419BA1

Function 00007FFD348A0840 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2274367338.00007FFD348A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd348a0000_good.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d970b6a2246fe0d1acfbcad0deb460bf353b57a93747d2c3d533c4e9b182acc5
Instruction ID: e4209ac77cf0de7b3442c837482120edd912cfe9cc369073ef21805a95b8901b
Opcode Fuzzy Hash: d970b6a2246fe0d1acfbcad0deb460bf353b57a93747d2c3d533c4e9b182acc5
Instruction Fuzzy Hash: 4CF0B65290F3C11FEB1367B859B11D53F605F43318B0D41EBD1D89A0A7E8AC6848A366

Function 00007FFD348A595F Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2274367338.00007FFD348A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd348a0000_good.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1349abf31a9c1d7c10d4c81e857e081ae76302db015f8c425939d680f0c7179e
Instruction ID: 79fb265a06f85b44668e9ec261bbe26fd228275ca1b9484a105bba2e8cb2982a
Opcode Fuzzy Hash: 1349abf31a9c1d7c10d4c81e857e081ae76302db015f8c425939d680f0c7179e
Instruction Fuzzy Hash: 5AF0627070951E9FE7909B54DC68ABEB7F0EF51311F0406BAC415D72A0DFB894418B50

Function 00007FFD348ACD01 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2274367338.00007FFD348A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd348a0000_good.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9120b856e2a34664ad4b713e27d012387c3fd6da881007348dd0efbef5de993
Instruction ID: b0f54415932ff490bd5ce1190ece9b4a1b0bd43c0aa2063785c86ca71d2696bf
Opcode Fuzzy Hash: a9120b856e2a34664ad4b713e27d012387c3fd6da881007348dd0efbef5de993
Instruction Fuzzy Hash: AFF0BE31F0981A8BEB90FF04C4A0BA87392FF56310F1141B5C94DE72D5CEACAD018BA0

Function 00007FFD348A5D2C Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2274367338.00007FFD348A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd348a0000_good.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e8fed746e89a54f2e423bce873f197608f97816c8493adedbbc02b1f9e7b889
Instruction ID: 3e1c8219b8e6f4d63d62adedc9c2c189cb3c3109d063d1ab9ba2181cc4516bf2
Opcode Fuzzy Hash: 1e8fed746e89a54f2e423bce873f197608f97816c8493adedbbc02b1f9e7b889
Instruction Fuzzy Hash: C4F08231A1E6554FE399972C90A05A533E1EB4A310B5542BDD09BC72D7C96D9882C254

Function 00007FFD348AC9B1 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2274367338.00007FFD348A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd348a0000_good.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 680c4781bec31023fb2cba5e2da85f79b69cf1b702cbe608595ed60b8b04d74e
Instruction ID: 8bd69a401913b9590c75034451819349cb2b869a8abb5c86ebbc40779997c56a
Opcode Fuzzy Hash: 680c4781bec31023fb2cba5e2da85f79b69cf1b702cbe608595ed60b8b04d74e
Instruction Fuzzy Hash: F0F05831A08429CFEB90EF08C498BA873E1FF1A310F0541B6D448E72A1DEA8AD00CB91

Function 00007FFD34B1B7C3 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2278619221.00007FFD34B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34b00000_good.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3cd408d4529026659952f7987eaf01d7ba7dabdc38ba97515ab04bd7152a287
Instruction ID: 6b61144e234e07c1341efb42d628db52bba10b4d549b8a99bbffbce32e966117
Opcode Fuzzy Hash: a3cd408d4529026659952f7987eaf01d7ba7dabdc38ba97515ab04bd7152a287
Instruction Fuzzy Hash: 24E0263194EA5C8BCB84BF69AC902D577E4FF4D308F00066EE55CC3281D73A9951C742

Function 00007FFD348A8119 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2274367338.00007FFD348A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd348a0000_good.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 59558aa8a0cfd1fd06c26673910b1c2a0bad284e06ce358a84f2d214c51730b6
Instruction ID: 3c81b15896efdd8bedde9b8ca7a2166f8d62c7f23d8a30ff54676b771d977e73
Opcode Fuzzy Hash: 59558aa8a0cfd1fd06c26673910b1c2a0bad284e06ce358a84f2d214c51730b6
Instruction Fuzzy Hash: 80F0A026F095074BE751AB10C8B1AA573A5EF42310F0981B2C999DB1E1DE6CAE019BE1

Function 00007FFD348AC025 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2274367338.00007FFD348A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd348a0000_good.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5b97c0e3f01c0b85c02492300d1ff70e3060b6596f04aa49996753978d41a74
Instruction ID: 21de61512f5c3f7fc0716b06b1aeb6d10ac2d6ba469cb3159f5066c448441d9c
Opcode Fuzzy Hash: f5b97c0e3f01c0b85c02492300d1ff70e3060b6596f04aa49996753978d41a74
Instruction Fuzzy Hash: 81F0A031F0D50A4FEBA5FF08C4A46E87292BF4A300F0001B9C94DD72E2DEACAD0197A1

Function 00007FFD34B08B9A Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2278619221.00007FFD34B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34b00000_good.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69d0053f7b1fe40e4f85143d9637a5eb1079b8d9c1a76ac929b8f7875ef48cd9
Instruction ID: a9fa64df2b7fcf8f33df99f7a44797cf57267f0a4b98a3235823a2a99ecac491
Opcode Fuzzy Hash: 69d0053f7b1fe40e4f85143d9637a5eb1079b8d9c1a76ac929b8f7875ef48cd9
Instruction Fuzzy Hash: 31D05B22B5DB0C0F5694691CB852079F3C0E786536740173FD58BC2145DE1B74825185

Function 00007FFD348A5A51 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2274367338.00007FFD348A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd348a0000_good.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a20044d8f8e2dc781d55cef8a5668bef97345a9cbc752a45e63f4ed3ef9b253
Instruction ID: 47ed2816cc2b6647257dba73197ce02ff6ed30c99d0952b738658e441411c71a
Opcode Fuzzy Hash: 2a20044d8f8e2dc781d55cef8a5668bef97345a9cbc752a45e63f4ed3ef9b253
Instruction Fuzzy Hash: E2E09B3170F9454FE7D2971884E11AA37A3EF97710B0443B6C05AC7191DD5C75479750

Function 00007FFD348A7049 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2274367338.00007FFD348A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd348a0000_good.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55f96a23f08a3f88c61834196e35406698fc1e77571b6caa2b136a564c627cf9
Instruction ID: 70081831b8317887858cccb8318f9468ebd9a0451e256ea4cdb290b0e4a43458
Opcode Fuzzy Hash: 55f96a23f08a3f88c61834196e35406698fc1e77571b6caa2b136a564c627cf9
Instruction Fuzzy Hash: C8F0A574A0982A8FDB90EB08C4A876972E1FF59311F0545B4D54DE7291CE78AC419B50

Function 00007FFD348A1568 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2274367338.00007FFD348A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd348a0000_good.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 89e1704fe1e2e7600fa7fa8e719ce85b50aa5557a416bab6b4d68c02534fd537
Instruction ID: a41e392a359ab6488e4e910f3aa128577c21a9d3d50cdd03832ef36c48f63c2a
Opcode Fuzzy Hash: 89e1704fe1e2e7600fa7fa8e719ce85b50aa5557a416bab6b4d68c02534fd537
Instruction Fuzzy Hash: 24E0C230B195044BD748EF3C886A079B3D1FB5A306F49C27AD04EC62A2DFAD64815741

Function 00007FFD348A9BCB Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2274367338.00007FFD348A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd348a0000_good.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c4dbf903c6e003b195a66d7bc6eeae0fe60a6ef2c25135e85e27051901f6969
Instruction ID: 92f1ee0a674cc63c0a77e46a7acbc2ee112ef7e5a74c796a01f6c08efcbfaa9a
Opcode Fuzzy Hash: 9c4dbf903c6e003b195a66d7bc6eeae0fe60a6ef2c25135e85e27051901f6969
Instruction Fuzzy Hash: 19E05234A048298FDBD4EB18C498B69B3E1FF59311F0541F5D54DE7266DE34AD819F80

Function 00007FFD348A78C2 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2274367338.00007FFD348A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd348a0000_good.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d926ca35bc4c8bea8b64390c1d1c96886c23e3ff1b81960e963b8f6420fa0a89
Instruction ID: 02f1cf190ff5ebc43beb3b8038ee2cb8eb3e2c3f0b1590cc386ed1e5fbf448d5
Opcode Fuzzy Hash: d926ca35bc4c8bea8b64390c1d1c96886c23e3ff1b81960e963b8f6420fa0a89
Instruction Fuzzy Hash: C3E05A30A0882D8FDFD0EB08C498BA973E2FF69301F1540A4954DE7255CE78ED418B90

Function 00007FFD348A887B Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2274367338.00007FFD348A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd348a0000_good.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98ba96997df39e270cf1297c43db63a63a0904efbfb350ddc815aca76a514c70
Instruction ID: 68ff0bfae554a2e072d48617f7ce8d3c21dee78a0e8de6bac9d9b7eed4ea6412
Opcode Fuzzy Hash: 98ba96997df39e270cf1297c43db63a63a0904efbfb350ddc815aca76a514c70
Instruction Fuzzy Hash: 54E0DF32F491068BF751AF00C4A47F47202AF42310F054576CD48E72E6CEAC690492F1

Function 00007FFD348A15B8 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2274367338.00007FFD348A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd348a0000_good.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc39c39dc1cb5b846d04709c51093b72ff642ede44694baebd1cc02bd75cf95e
Instruction ID: 7db74aff0f895777615f12e050f44c859d672b8c70d7d2d9b65e20ec15c59af5
Opcode Fuzzy Hash: bc39c39dc1cb5b846d04709c51093b72ff642ede44694baebd1cc02bd75cf95e
Instruction Fuzzy Hash: 16D05E30624A084FDB48EF39C85E535B3D1FB99206F99C1BA944EC6660CFA998815741

Function 00007FFD348A5867 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2274367338.00007FFD348A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd348a0000_good.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bca33fd812ed2a18998e092f88e3563a4502ac1fa11c36063c102fcb17ccd9ca
Instruction ID: 72a9f4dad989d259b51afa479ef16f085b57014e61ef949b9f50d29c84afdb11
Opcode Fuzzy Hash: bca33fd812ed2a18998e092f88e3563a4502ac1fa11c36063c102fcb17ccd9ca
Instruction Fuzzy Hash: 9EE04874A0611BCBEB84DF40C8A49BD73B1FB12310F140639C512E66D0DFFC55449B94

Function 00007FFD348AD070 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2274367338.00007FFD348A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd348a0000_good.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3c5d6d7b2f67b7975a453b23d9e889e9c7f926fa4f483a8df05e5dbe21bd407
Instruction ID: 1fa9ab35ff3398a490968a0ec3f2febec8bdd8ed78f1bfb10c05ad816098e10f
Opcode Fuzzy Hash: c3c5d6d7b2f67b7975a453b23d9e889e9c7f926fa4f483a8df05e5dbe21bd407
Instruction Fuzzy Hash: 94E08C20B0842A8FE681A71880A12A963E1FF8A300F5880F0C68DE3382CE2C6C039780

Function 00007FFD348A1550 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2274367338.00007FFD348A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd348a0000_good.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6489c298711ae9b51be2bb1637a4d183d1a6a6fd281b81d099ba69bf3c97eecc
Instruction ID: f2b800c17ea0ed62d2a12f7a838aa327d2ed53bc99b9357f19e0e4d0c7b1a3a0
Opcode Fuzzy Hash: 6489c298711ae9b51be2bb1637a4d183d1a6a6fd281b81d099ba69bf3c97eecc
Instruction Fuzzy Hash: 0BD012346154088FCA58AE3CC8A9465B3D0FB0A20579241A4901AC6570EA9AD8459740

Function 00007FFD348AC1ED Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2274367338.00007FFD348A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd348a0000_good.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e764bd4326e6cbb5c2d189e3be05b88a10bc4ad7bd79b03d61dfc8ff880a7775
Instruction ID: 0f0d3d06960f91fb969b1de69a76fa6c5acba8e437bed700478c04d3f8978725
Opcode Fuzzy Hash: e764bd4326e6cbb5c2d189e3be05b88a10bc4ad7bd79b03d61dfc8ff880a7775
Instruction Fuzzy Hash: EFD0EC20E19429CBEBE4AB04889877862E0BF45310F1440B4C18DE3194CE7C1D81EF90

Function 00007FFD348A7CB3 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2274367338.00007FFD348A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd348a0000_good.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84afce825784e9d601beb5dded27ccb9c1817819cba77afe3845dc643ecc0ef3
Instruction ID: 7cc216bbd807a4a67929506c3fb8cf74ce3d171733fbfa66d17cf19865cc9964
Opcode Fuzzy Hash: 84afce825784e9d601beb5dded27ccb9c1817819cba77afe3845dc643ecc0ef3
Instruction Fuzzy Hash: F4C09B24F0F515CAE6E9573440B527A50516F46704F5100B9D50DD63E7CD6D5C45E790

Function 00007FFD348A94A6 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2274367338.00007FFD348A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd348a0000_good.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c119e64ff5b0149aec3db74af443e3c71eb17fb86f9ecea9b7e5c3c5ff7bf362
Instruction ID: 7045d2a3c8686d82453cafe1fc648a3e1b119eb7ef1efc95ac220b9db20a65a9
Opcode Fuzzy Hash: c119e64ff5b0149aec3db74af443e3c71eb17fb86f9ecea9b7e5c3c5ff7bf362
Instruction Fuzzy Hash: DDC00260E1942D8EDBE4FF14C855B7863E1BF45300F1481F5854DE3555DE785D419F90

Function 00007FFD34B1A678 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2278619221.00007FFD34B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34b00000_good.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fce6e7167b627cb3b71d85caf62fa3316a9673036ea7fe4c05edfcb6db6e70cd
Instruction ID: 9986072e0ed2f6600306225a4ae78a6e2634d2588caecb98e2ef412ab9541f29
Opcode Fuzzy Hash: fce6e7167b627cb3b71d85caf62fa3316a9673036ea7fe4c05edfcb6db6e70cd
Instruction Fuzzy Hash: 91B0022190412257D6217AFDA26D5D567A45F0131470C9671D08C5F087A97870808645

Non-executed Functions

Function 00007FFD34B0283C Relevance: .8, Instructions: 758COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2278619221.00007FFD34B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34b00000_good.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d3d62c731095640e2d213d703039889ae3a8d2192605f230fbacb7d980f3e30
Instruction ID: 8a630788e6186c47f7995a08dab3063b95b774f24b2e2f058d8fccd714a99257
Opcode Fuzzy Hash: 4d3d62c731095640e2d213d703039889ae3a8d2192605f230fbacb7d980f3e30
Instruction Fuzzy Hash: 3D322631A1CB864FE36D8B2884A51717BE0EF57311F1402BED5CAC3193DA29BC46C782

Function 00007FFD348A28FA Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2274367338.00007FFD348A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd348a0000_good.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19391e45f36b794a6a7e56977f506f1a287e698e3b9675ee0b803924add48032
Instruction ID: 701a16cd324122cfd38fb5824ba466fee7c7e607b500d5f033155c31932c2f01
Opcode Fuzzy Hash: 19391e45f36b794a6a7e56977f506f1a287e698e3b9675ee0b803924add48032
Instruction Fuzzy Hash: EC519017B0893657D6207AFCB9A52FAA728DF813B6B086677D38DCE0435878748683D4

Function 00007FFD34B0855D Relevance: 6.3, Strings: 5, Instructions: 55COMMON

Download Yara Rule

Strings

'_^T, xrefs: 00007FFD34B0857A
'_^f, xrefs: 00007FFD34B085C2
'_^h, xrefs: 00007FFD34B085C9
'_^R, xrefs: 00007FFD34B08572
'_^Z, xrefs: 00007FFD34B08592

Memory Dump Source

Source File: 00000000.00000002.2278619221.00007FFD34B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34b00000_good.jbxd

Similarity

API ID:
String ID: '_^R$'_^T$'_^Z$'_^f$'_^h
API String ID: 0-3810465844
Opcode ID: de0a43f8eec0467678d49f1ba9fc0dc3b560ab9c6bc43ac25bb831fff72204e6
Instruction ID: 058db98031dc8dbd8e9f69c7d3092d8762920f7adcd38072074aaa9ac333ddef
Opcode Fuzzy Hash: de0a43f8eec0467678d49f1ba9fc0dc3b560ab9c6bc43ac25bb831fff72204e6
Instruction Fuzzy Hash: DC01F5EFA0991567D21066A9AC122C27350FFA4331B8D2172D558D7202EB347846CAC0

Function 00007FFD34B08560 Relevance: 6.3, Strings: 5, Instructions: 52COMMON

Download Yara Rule

Strings

'_^T, xrefs: 00007FFD34B0857A
'_^f, xrefs: 00007FFD34B085C2
'_^h, xrefs: 00007FFD34B085C9
'_^R, xrefs: 00007FFD34B08572
'_^Z, xrefs: 00007FFD34B08592

Memory Dump Source

Source File: 00000000.00000002.2278619221.00007FFD34B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34b00000_good.jbxd

Similarity

API ID:
String ID: '_^R$'_^T$'_^Z$'_^f$'_^h
API String ID: 0-3810465844
Opcode ID: 6da9decf991acd652224158ea3c691a52a175f732634bb9c6a89666702252391
Instruction ID: ba1a754efdef6001d0e2e4d31566dd75e5994230be30aec3b468dde47bb9af9c
Opcode Fuzzy Hash: 6da9decf991acd652224158ea3c691a52a175f732634bb9c6a89666702252391
Instruction Fuzzy Hash: 6401D4EFE0A91577D21066E9A8222D27360FFA4361B8D7172D558D7203EB347846CAC0

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report good.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Initial Sample

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Exploits

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\good.exe.log

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

Windows Analysis Report
good.exe

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre