Edit tour

Windows Analysis Report
drop1.exe

Overview

General Information

Sample name:	drop1.exe
Analysis ID:	1584549
MD5:	c401a019b5a9e44646577f8922e1014e
SHA1:	3406d945b0283bb6337a7490198b00cd1df278a2
SHA256:	31ebf7219722b8c908a914b2b08c5d03140af8b0cef6c96152e458dc82301c0a
Tags:	exeMeduzaMeduzaStealeruser-aachum
Infos:

Detection

CredGrabber, Meduza Stealer

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected CredGrabber

Yara detected Meduza Stealer

AI detected suspicious sample

Contains functionality to inject code into remote processes

Found many strings related to Crypto-Wallets (likely being stolen)

Injects a PE file into a foreign processes

Machine Learning detection for sample

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to create guard pages, often used to hinder reverse engineering and debugging

Contains functionality to dynamically determine API calls

Contains functionality to launch a program with higher privileges

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality to record screenshots

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Enables debug privileges

Found evasive API chain checking for process token information

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Queries time zone information

Suricata IDS alerts with low severity for network traffic

Terminates after testing mutex exists (may check infected machine status)

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

drop1.exe (PID: 5728 cmdline: "C:\Users\user\Desktop\drop1.exe" MD5: C401A019B5A9E44646577F8922E1014E)

conhost.exe (PID: 348 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

drop1.exe (PID: 1472 cmdline: "C:\Users\user\Desktop\drop1.exe" MD5: C401A019B5A9E44646577F8922E1014E)

cleanup

Malware Configuration

Threatname: Meduza Stealer

{"C2 url": "66.63.187.173", "grabber_max_size": 4194304, "anti_vm": true, "anti_dbg": true, "self_destruct": false, "extensions": ".txt; .doc; .xlsx", "build_name": "3", "links": "", "port": 15666}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000003.00000002.2243329095.0000000000CF8000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_MeduzaStealer	Yara detected Meduza Stealer	Joe Security
00000003.00000002.2242983706.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_MeduzaStealer	Yara detected Meduza Stealer	Joe Security
00000003.00000002.2242983706.0000000000400000.00000040.00000400.00020000.00000000.sdmp	infostealer_win_meduzastealer	Finds MeduzaStealer samples based on specific strings	Sekoia.io	0xff0dc:$str01: emoji 0x1018d8:$str02: %d-%m-%Y, %H:%M:%S 0x101940:$str03: [UTC 0x10194c:$str04: user_name 0x101970:$str05: computer_name 0x101994:$str06: timezone 0x1018c4:$str07: current_path() 0xff0a8:$str08: [json.exception. 0x11502e:$str09: GDI32.dll 0x1152a0:$str10: GdipGetImageEncoders 0x115318:$str10: GdipGetImageEncoders 0x114948:$str11: GetGeoInfoA
Process Memory Space: drop1.exe PID: 1472	JoeSecurity_MeduzaStealer	Yara detected Meduza Stealer	Joe Security
Process Memory Space: drop1.exe PID: 1472	JoeSecurity_CredGrabber	Yara detected CredGrabber	Joe Security
Process Memory Space: drop1.exe PID: 1472	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Click to see the 1 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.drop1.exe.196d220.1.raw.unpack	JoeSecurity_MeduzaStealer	Yara detected Meduza Stealer	Joe Security
0.2.drop1.exe.196d220.1.raw.unpack	infostealer_win_meduzastealer	Finds MeduzaStealer samples based on specific strings	Sekoia.io	0xfd6dc:$str01: emoji 0xffed8:$str02: %d-%m-%Y, %H:%M:%S 0xfff40:$str03: [UTC 0xfff4c:$str04: user_name 0xfff70:$str05: computer_name 0xfff94:$str06: timezone 0xffec4:$str07: current_path() 0xfd6a8:$str08: [json.exception. 0x11362e:$str09: GDI32.dll 0x1138a0:$str10: GdipGetImageEncoders 0x113918:$str10: GdipGetImageEncoders 0x112f48:$str11: GetGeoInfoA
3.2.drop1.exe.400000.1.unpack	JoeSecurity_MeduzaStealer	Yara detected Meduza Stealer	Joe Security
3.2.drop1.exe.400000.1.unpack	infostealer_win_meduzastealer	Finds MeduzaStealer samples based on specific strings	Sekoia.io	0xfd6dc:$str01: emoji 0xffed8:$str02: %d-%m-%Y, %H:%M:%S 0xfff40:$str03: [UTC 0xfff4c:$str04: user_name 0xfff70:$str05: computer_name 0xfff94:$str06: timezone 0xffec4:$str07: current_path() 0xfd6a8:$str08: [json.exception. 0x11362e:$str09: GDI32.dll 0x1138a0:$str10: GdipGetImageEncoders 0x113918:$str10: GdipGetImageEncoders 0x112f48:$str11: GetGeoInfoA
0.2.drop1.exe.196d220.1.unpack	JoeSecurity_MeduzaStealer	Yara detected Meduza Stealer	Joe Security
0.2.drop1.exe.196d220.1.unpack	infostealer_win_meduzastealer	Finds MeduzaStealer samples based on specific strings	Sekoia.io	0xfbcdc:$str01: emoji 0xfe4d8:$str02: %d-%m-%Y, %H:%M:%S 0xfe540:$str03: [UTC 0xfe54c:$str04: user_name 0xfe570:$str05: computer_name 0xfe594:$str06: timezone 0xfe4c4:$str07: current_path() 0xfbca8:$str08: [json.exception. 0x111c2e:$str09: GDI32.dll 0x111ea0:$str10: GdipGetImageEncoders 0x111f18:$str10: GdipGetImageEncoders 0x111548:$str11: GetGeoInfoA
3.2.drop1.exe.400000.1.raw.unpack	JoeSecurity_MeduzaStealer	Yara detected Meduza Stealer	Joe Security
3.2.drop1.exe.400000.1.raw.unpack	infostealer_win_meduzastealer	Finds MeduzaStealer samples based on specific strings	Sekoia.io	0xff0dc:$str01: emoji 0x1018d8:$str02: %d-%m-%Y, %H:%M:%S 0x101940:$str03: [UTC 0x10194c:$str04: user_name 0x101970:$str05: computer_name 0x101994:$str06: timezone 0x1018c4:$str07: current_path() 0xff0a8:$str08: [json.exception. 0x11502e:$str09: GDI32.dll 0x1152a0:$str10: GdipGetImageEncoders 0x115318:$str10: GdipGetImageEncoders 0x114948:$str11: GetGeoInfoA
Click to see the 3 entries

Suricata Signatures

ET MALWARE Win32/Unknown Grabber Base64 Data Exfiltration Attempt

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-05T20:18:59.648048+0100	2049441	1	A Network Trojan was detected	192.168.2.5	49704	66.63.187.173	15666	TCP

ET MALWARE [ANY.RUN] Meduza Stealer Exfiltration M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-05T20:18:59.648048+0100	2050806	1	A Network Trojan was detected	192.168.2.5	49704	66.63.187.173	15666	TCP
2025-01-05T20:18:59.653137+0100	2050806	1	A Network Trojan was detected	192.168.2.5	49704	66.63.187.173	15666	TCP

ET MALWARE [ANY.RUN] Possible Meduza Stealer Exfiltration (TCP)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-05T20:18:59.648048+0100	2050807	1	A Network Trojan was detected	192.168.2.5	49704	66.63.187.173	15666	TCP
2025-01-05T20:18:59.653137+0100	2050807	1	A Network Trojan was detected	192.168.2.5	49704	66.63.187.173	15666	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 3.2.drop1.exe.400000.1.unpack

Malware Configuration Extractor: Meduza Stealer {"C2 url": "66.63.187.173", "grabber_max_size": 4194304, "anti_vm": true, "anti_dbg": true, "self_destruct": false, "extensions": ".txt; .doc; .xlsx", "build_name": "3", "links": "", "port": 15666}

Multi AV Scanner detection for submitted file

Source: drop1.exe

ReversingLabs: Detection: 91%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 98.9% probability

Machine Learning detection for sample

Source: drop1.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\drop1.exe	Code function: 3_2_0047A610 CryptUnprotectData,LocalFree,	3_2_0047A610
Source: C:\Users\user\Desktop\drop1.exe	Code function: 3_2_0043D4A0 BCryptDestroyKey,	3_2_0043D4A0
Source: C:\Users\user\Desktop\drop1.exe	Code function: 3_2_0047A950 CryptProtectData,LocalFree,	3_2_0047A950
Source: C:\Users\user\Desktop\drop1.exe	Code function: 3_2_0047AAE0 BCryptDecrypt,BCryptDecrypt,	3_2_0047AAE0
Source: C:\Users\user\Desktop\drop1.exe	Code function: 3_2_00440B60 CryptUnprotectData,LocalFree,	3_2_00440B60
Source: C:\Users\user\Desktop\drop1.exe	Code function: 3_2_0047AE10 BCryptCloseAlgorithmProvider,	3_2_0047AE10
Source: C:\Users\user\Desktop\drop1.exe	Code function: 3_2_0047AE80 BCryptOpenAlgorithmProvider,BCryptSetProperty,BCryptGenerateSymmetricKey,	3_2_0047AE80

Source: drop1.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 172.67.74.152:443 -> 192.168.2.5:49705 version: TLS 1.2

Source: drop1.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_ISOLATION, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\drop1.exe	Code function: 0_2_0015BE9A FindFirstFileExW,	0_2_0015BE9A
Source: C:\Users\user\Desktop\drop1.exe	Code function: 0_2_0015BF4B FindFirstFileExW,FindNextFileW,FindClose,FindClose,	0_2_0015BF4B
Source: C:\Users\user\Desktop\drop1.exe	Code function: 3_2_0015BE9A FindFirstFileExW,	3_2_0015BE9A
Source: C:\Users\user\Desktop\drop1.exe	Code function: 3_2_0015BF4B FindFirstFileExW,FindNextFileW,FindClose,FindClose,	3_2_0015BF4B
Source: C:\Users\user\Desktop\drop1.exe	Code function: 3_2_004402D0 FindFirstFileW,FindNextFileW,	3_2_004402D0
Source: C:\Users\user\Desktop\drop1.exe	Code function: 3_2_004B84C0 FindClose,FindFirstFileExW,GetLastError,	3_2_004B84C0
Source: C:\Users\user\Desktop\drop1.exe	Code function: 3_2_004B8545 GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,___std_fs_open_handle@16,GetFileInformationByHandleEx,GetLastError,GetFileInformationByHandleEx,GetFileInformationByHandleEx,	3_2_004B8545
Source: C:\Users\user\Desktop\drop1.exe	Code function: 3_2_004B84E0 FindFirstFileExW,	3_2_004B84E0
Source: C:\Users\user\Desktop\drop1.exe	Code function: 3_2_004BAB85 FindFirstFileExW,	3_2_004BAB85

Source: C:\Users\user\Desktop\drop1.exe

Code function: 3_2_00487550 GetLogicalDriveStringsW,

3_2_00487550

Source: C:\Users\user\Desktop\drop1.exe	File opened: D:\sources\migration\	Jump to behavior
Source: C:\Users\user\Desktop\drop1.exe	File opened: D:\sources\replacementmanifests\	Jump to behavior
Source: C:\Users\user\Desktop\drop1.exe	File opened: D:\sources\migration\wtr\	Jump to behavior
Source: C:\Users\user\Desktop\drop1.exe	File opened: D:\sources\replacementmanifests\microsoft-activedirectory-webservices\	Jump to behavior
Source: C:\Users\user\Desktop\drop1.exe	File opened: D:\sources\replacementmanifests\microsoft-client-license-platform-service-migration\	Jump to behavior
Source: C:\Users\user\Desktop\drop1.exe	File opened: D:\sources\replacementmanifests\hwvid-migration-2\	Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2049441 - Severity 1 - ET MALWARE Win32/Unknown Grabber Base64 Data Exfiltration Attempt : 192.168.2.5:49704 -> 66.63.187.173:15666
Source: Network traffic	Suricata IDS: 2050806 - Severity 1 - ET MALWARE [ANY.RUN] Meduza Stealer Exfiltration M2 : 192.168.2.5:49704 -> 66.63.187.173:15666

Source: global traffic

TCP traffic: 192.168.2.5:49704 -> 66.63.187.173:15666

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1Accept: text/html; text/plain; */*Host: api.ipify.orgCache-Control: no-cache

Source: Joe Sandbox View	IP Address: 172.67.74.152 172.67.74.152
Source: Joe Sandbox View	IP Address: 172.67.74.152 172.67.74.152

Source: Joe Sandbox View

ASN Name: ASN-QUADRANET-GLOBALUS ASN-QUADRANET-GLOBALUS

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org

Source: Network traffic

Suricata IDS: 2050807 - Severity 1 - ET MALWARE [ANY.RUN] Possible Meduza Stealer Exfiltration (TCP) : 192.168.2.5:49704 -> 66.63.187.173:15666

Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173

Source: C:\Users\user\Desktop\drop1.exe

Code function: 3_2_00485350 recv,recv,recv,recv,recv,recv,closesocket,WSACleanup,

3_2_00485350

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1Accept: text/html; text/plain; */*Host: api.ipify.orgCache-Control: no-cache

Source: global traffic

DNS traffic detected: DNS query: api.ipify.org

Source: drop1.exe, 00000003.00000003.2242546192.000000000106B000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000003.00000003.2242629094.000000000106C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ns.adp/1.0/
Source: drop1.exe, 00000003.00000002.2243667314.000000000106E000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000003.00000003.2242546192.000000000106B000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000003.00000003.2242629094.000000000106C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ns.exif/1
Source: drop1.exe, 00000003.00000003.2023626908.0000000000D6F000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000003.00000003.2023350123.000000000442D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: drop1.exe, 00000003.00000002.2243329095.0000000000CF8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/
Source: drop1.exe, 00000003.00000003.2044728897.0000000000DA9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.
Source: drop1.exe, 00000003.00000003.2044824868.0000000000DA7000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000003.00000003.2044824868.0000000000D6F000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000003.00000003.2044482311.0000000000DEA000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000003.00000003.2044900517.0000000000DEB000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000003.00000003.2044728897.0000000000DA9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta
Source: drop1.exe, 00000003.00000003.2023626908.0000000000D6F000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000003.00000003.2023350123.000000000442D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: drop1.exe, 00000003.00000003.2023626908.0000000000D6F000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000003.00000003.2023350123.000000000442D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: drop1.exe, 00000003.00000003.2023626908.0000000000D6F000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000003.00000003.2023350123.000000000442D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: drop1.exe, 00000003.00000003.2044824868.0000000000DA7000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000003.00000003.2044824868.0000000000D6F000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000003.00000003.2044482311.0000000000DEA000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000003.00000003.2044900517.0000000000DEB000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000003.00000003.2044728897.0000000000DA9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: drop1.exe, 00000003.00000003.2044728897.0000000000DA9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg
Source: drop1.exe, 00000003.00000003.2023626908.0000000000D6F000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000003.00000003.2023350123.000000000442D000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000003.00000003.2023350123.0000000004414000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000003.00000003.2024111798.0000000004414000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: drop1.exe, 00000003.00000003.2023626908.0000000000D6F000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000003.00000003.2023350123.000000000442D000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000003.00000003.2023350123.0000000004414000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000003.00000003.2024111798.0000000004414000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: drop1.exe, 00000003.00000003.2023626908.0000000000D6F000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000003.00000003.2023350123.000000000442D000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000003.00000003.2023350123.0000000004414000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000003.00000003.2024111798.0000000004414000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: drop1.exe, 00000003.00000003.2044728897.0000000000DA9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: drop1.exe, 00000003.00000003.2041225998.0000000003D01000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.moz
Source: drop1.exe, 00000003.00000003.2040285656.0000000003D00000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000003.00000003.2039051909.0000000003766000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000003.00000003.2038497430.00000000036B3000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000003.00000003.2038497430.00000000036BB000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000003.00000003.2038497430.00000000036E1000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000003.00000003.2043762244.00000000044D5000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000003.00000003.2038497430.00000000036D9000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000003.00000003.2038497430.000000000376E000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000003.00000003.2043762244.000000000442B000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000003.00000003.2038497430.0000000003711000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000003.00000003.2043762244.0000000004423000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000003.00000003.2038497430.0000000003719000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org
Source: drop1.exe, 00000003.00000003.2038497430.0000000003721000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: drop1.exe, 00000003.00000003.2038497430.0000000003721000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL
Source: drop1.exe, 00000003.00000003.2044824868.0000000000DA7000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000003.00000003.2044824868.0000000000D6F000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000003.00000003.2044482311.0000000000DEA000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000003.00000003.2044900517.0000000000DEB000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000003.00000003.2044728897.0000000000DA9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477
Source: drop1.exe, 00000003.00000003.2044824868.0000000000DA7000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000003.00000003.2044824868.0000000000D6F000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000003.00000003.2044482311.0000000000DEA000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000003.00000003.2044900517.0000000000DEB000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000003.00000003.2044728897.0000000000DA9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref
Source: drop1.exe, 00000003.00000003.2023626908.0000000000D6F000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000003.00000003.2023350123.000000000442D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: drop1.exe, 00000003.00000003.2023626908.0000000000D6F000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000003.00000003.2023350123.000000000442D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: drop1.exe, 00000003.00000003.2040285656.0000000003D00000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000003.00000003.2039051909.0000000003766000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000003.00000003.2038497430.00000000036B3000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000003.00000003.2038497430.00000000036BB000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000003.00000003.2038497430.00000000036E1000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000003.00000003.2043762244.00000000044D5000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000003.00000003.2038497430.00000000036D9000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000003.00000003.2038497430.000000000376E000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000003.00000003.2043762244.000000000442B000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000003.00000003.2038497430.0000000003711000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000003.00000003.2043762244.0000000004423000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000003.00000003.2038497430.0000000003719000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org
Source: drop1.exe, 00000003.00000003.2038497430.0000000003721000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.CDjelnmQJyZc
Source: drop1.exe, 00000003.00000003.2038497430.0000000003721000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.b3lOZaxJcpF6
Source: drop1.exe, 00000003.00000003.2038497430.00000000036C3000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000003.00000003.2041225998.0000000003D01000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000003.00000003.2038497430.00000000036E9000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000003.00000003.2039051909.0000000003776000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000003.00000003.2038497430.0000000003721000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: drop1.exe, 00000003.00000003.2038497430.0000000003721000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: drop1.exe, 00000003.00000003.2038497430.00000000036C3000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000003.00000003.2041225998.0000000003D01000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000003.00000003.2038497430.00000000036E9000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000003.00000003.2039051909.0000000003776000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000003.00000003.2038497430.0000000003721000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/media/img/mozorg/mozilla-256.4720741d4108.jpg
Source: drop1.exe, 00000003.00000003.2038497430.00000000036C3000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000003.00000003.2041225998.0000000003D01000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000003.00000003.2038497430.00000000036E9000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000003.00000003.2039051909.0000000003776000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000003.00000003.2038497430.0000000003721000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705

Source: unknown

HTTPS traffic detected: 172.67.74.152:443 -> 192.168.2.5:49705 version: TLS 1.2

Source: C:\Users\user\Desktop\drop1.exe

Code function: 3_2_00485F00 GetSystemMetrics,KiUserCallbackDispatcher,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetDC,GetDeviceCaps,GetDeviceCaps,GetDeviceCaps,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,SHCreateMemStream,SelectObject,DeleteDC,ReleaseDC,DeleteObject,IStream_Size,IStream_Reset,IStream_Read,SelectObject,DeleteDC,ReleaseDC,DeleteObject,

3_2_00485F00

System Summary

Malicious sample detected (through community Yara rule)

Source: 0.2.drop1.exe.196d220.1.raw.unpack, type: UNPACKEDPE	Matched rule: Finds MeduzaStealer samples based on specific strings Author: Sekoia.io
Source: 3.2.drop1.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: Finds MeduzaStealer samples based on specific strings Author: Sekoia.io
Source: 0.2.drop1.exe.196d220.1.unpack, type: UNPACKEDPE	Matched rule: Finds MeduzaStealer samples based on specific strings Author: Sekoia.io
Source: 3.2.drop1.exe.400000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Finds MeduzaStealer samples based on specific strings Author: Sekoia.io
Source: 00000003.00000002.2242983706.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Finds MeduzaStealer samples based on specific strings Author: Sekoia.io

Source: C:\Users\user\Desktop\drop1.exe	Code function: 3_2_0048A0A0 GetModuleHandleA,GetProcAddress,OpenProcess,NtQuerySystemInformation,NtQuerySystemInformation,NtQuerySystemInformation,GetCurrentProcess,NtQueryObject,GetFinalPathNameByHandleA,CloseHandle,CloseHandle,		3_2_0048A0A0
Source: C:\Users\user\Desktop\drop1.exe	Code function: 3_2_0048A710 RtlAcquirePebLock,NtAllocateVirtualMemory,NtAllocateVirtualMemory,lstrcpyW,lstrcatW,NtAllocateVirtualMemory,lstrcpyW,RtlInitUnicodeString,RtlInitUnicodeString,RtlInitUnicodeString,LdrEnumerateLoadedModules,RtlReleasePebLock,		3_2_0048A710

Source: C:\Users\user\Desktop\drop1.exe	Code function: 0_2_00151000	0_2_00151000
Source: C:\Users\user\Desktop\drop1.exe	Code function: 0_2_00155235	0_2_00155235
Source: C:\Users\user\Desktop\drop1.exe	Code function: 0_2_00161542	0_2_00161542
Source: C:\Users\user\Desktop\drop1.exe	Code function: 3_2_00151000	3_2_00151000
Source: C:\Users\user\Desktop\drop1.exe	Code function: 3_2_00155235	3_2_00155235
Source: C:\Users\user\Desktop\drop1.exe	Code function: 3_2_00161542	3_2_00161542
Source: C:\Users\user\Desktop\drop1.exe	Code function: 3_2_004422D0	3_2_004422D0
Source: C:\Users\user\Desktop\drop1.exe	Code function: 3_2_0043A2B0	3_2_0043A2B0
Source: C:\Users\user\Desktop\drop1.exe	Code function: 3_2_00446400	3_2_00446400
Source: C:\Users\user\Desktop\drop1.exe	Code function: 3_2_00488400	3_2_00488400
Source: C:\Users\user\Desktop\drop1.exe	Code function: 3_2_0043E4F0	3_2_0043E4F0
Source: C:\Users\user\Desktop\drop1.exe	Code function: 3_2_004395D0	3_2_004395D0
Source: C:\Users\user\Desktop\drop1.exe	Code function: 3_2_00487780	3_2_00487780
Source: C:\Users\user\Desktop\drop1.exe	Code function: 3_2_00485840	3_2_00485840
Source: C:\Users\user\Desktop\drop1.exe	Code function: 3_2_0043C970	3_2_0043C970
Source: C:\Users\user\Desktop\drop1.exe	Code function: 3_2_004479C0	3_2_004479C0
Source: C:\Users\user\Desktop\drop1.exe	Code function: 3_2_00459A06	3_2_00459A06
Source: C:\Users\user\Desktop\drop1.exe	Code function: 3_2_0046EB70	3_2_0046EB70
Source: C:\Users\user\Desktop\drop1.exe	Code function: 3_2_0046BCE0	3_2_0046BCE0
Source: C:\Users\user\Desktop\drop1.exe	Code function: 3_2_00439D60	3_2_00439D60
Source: C:\Users\user\Desktop\drop1.exe	Code function: 3_2_00470EF0	3_2_00470EF0
Source: C:\Users\user\Desktop\drop1.exe	Code function: 3_2_0043BF70	3_2_0043BF70
Source: C:\Users\user\Desktop\drop1.exe	Code function: 3_2_00462080	3_2_00462080
Source: C:\Users\user\Desktop\drop1.exe	Code function: 3_2_004320A0	3_2_004320A0
Source: C:\Users\user\Desktop\drop1.exe	Code function: 3_2_004A70A7	3_2_004A70A7
Source: C:\Users\user\Desktop\drop1.exe	Code function: 3_2_0042D150	3_2_0042D150
Source: C:\Users\user\Desktop\drop1.exe	Code function: 3_2_00479130	3_2_00479130
Source: C:\Users\user\Desktop\drop1.exe	Code function: 3_2_00474190	3_2_00474190
Source: C:\Users\user\Desktop\drop1.exe	Code function: 3_2_00461250	3_2_00461250
Source: C:\Users\user\Desktop\drop1.exe	Code function: 3_2_00408270	3_2_00408270
Source: C:\Users\user\Desktop\drop1.exe	Code function: 3_2_004B6380	3_2_004B6380
Source: C:\Users\user\Desktop\drop1.exe	Code function: 3_2_00407470	3_2_00407470
Source: C:\Users\user\Desktop\drop1.exe	Code function: 3_2_00462410	3_2_00462410
Source: C:\Users\user\Desktop\drop1.exe	Code function: 3_2_004A5426	3_2_004A5426
Source: C:\Users\user\Desktop\drop1.exe	Code function: 3_2_0045C4C0	3_2_0045C4C0
Source: C:\Users\user\Desktop\drop1.exe	Code function: 3_2_0043D4A0	3_2_0043D4A0
Source: C:\Users\user\Desktop\drop1.exe	Code function: 3_2_0047E580	3_2_0047E580
Source: C:\Users\user\Desktop\drop1.exe	Code function: 3_2_0046B620	3_2_0046B620
Source: C:\Users\user\Desktop\drop1.exe	Code function: 3_2_00468750	3_2_00468750
Source: C:\Users\user\Desktop\drop1.exe	Code function: 3_2_00419770	3_2_00419770
Source: C:\Users\user\Desktop\drop1.exe	Code function: 3_2_0045C700	3_2_0045C700
Source: C:\Users\user\Desktop\drop1.exe	Code function: 3_2_004917CA	3_2_004917CA
Source: C:\Users\user\Desktop\drop1.exe	Code function: 3_2_0045D7A0	3_2_0045D7A0
Source: C:\Users\user\Desktop\drop1.exe	Code function: 3_2_004627A0	3_2_004627A0
Source: C:\Users\user\Desktop\drop1.exe	Code function: 3_2_0049687E	3_2_0049687E
Source: C:\Users\user\Desktop\drop1.exe	Code function: 3_2_004B6870	3_2_004B6870
Source: C:\Users\user\Desktop\drop1.exe	Code function: 3_2_0043A800	3_2_0043A800
Source: C:\Users\user\Desktop\drop1.exe	Code function: 3_2_00493800	3_2_00493800
Source: C:\Users\user\Desktop\drop1.exe	Code function: 3_2_0049F8A2	3_2_0049F8A2
Source: C:\Users\user\Desktop\drop1.exe	Code function: 3_2_00461940	3_2_00461940
Source: C:\Users\user\Desktop\drop1.exe	Code function: 3_2_00445950	3_2_00445950
Source: C:\Users\user\Desktop\drop1.exe	Code function: 3_2_00478990	3_2_00478990
Source: C:\Users\user\Desktop\drop1.exe	Code function: 3_2_004ACA4B	3_2_004ACA4B
Source: C:\Users\user\Desktop\drop1.exe	Code function: 3_2_00406AE0	3_2_00406AE0
Source: C:\Users\user\Desktop\drop1.exe	Code function: 3_2_004B3AE0	3_2_004B3AE0
Source: C:\Users\user\Desktop\drop1.exe	Code function: 3_2_00430AF0	3_2_00430AF0
Source: C:\Users\user\Desktop\drop1.exe	Code function: 3_2_0048AA80	3_2_0048AA80
Source: C:\Users\user\Desktop\drop1.exe	Code function: 3_2_00414AA0	3_2_00414AA0
Source: C:\Users\user\Desktop\drop1.exe	Code function: 3_2_0045EAA0	3_2_0045EAA0
Source: C:\Users\user\Desktop\drop1.exe	Code function: 3_2_00476AB6	3_2_00476AB6
Source: C:\Users\user\Desktop\drop1.exe	Code function: 3_2_00462B50	3_2_00462B50
Source: C:\Users\user\Desktop\drop1.exe	Code function: 3_2_00482C4B	3_2_00482C4B
Source: C:\Users\user\Desktop\drop1.exe	Code function: 3_2_004BCC40	3_2_004BCC40
Source: C:\Users\user\Desktop\drop1.exe	Code function: 3_2_004B6C40	3_2_004B6C40
Source: C:\Users\user\Desktop\drop1.exe	Code function: 3_2_00461CC0	3_2_00461CC0
Source: C:\Users\user\Desktop\drop1.exe	Code function: 3_2_00478D40	3_2_00478D40
Source: C:\Users\user\Desktop\drop1.exe	Code function: 3_2_004B6D30	3_2_004B6D30
Source: C:\Users\user\Desktop\drop1.exe	Code function: 3_2_004B1D30	3_2_004B1D30
Source: C:\Users\user\Desktop\drop1.exe	Code function: 3_2_00440DE0	3_2_00440DE0
Source: C:\Users\user\Desktop\drop1.exe	Code function: 3_2_0043AE50	3_2_0043AE50
Source: C:\Users\user\Desktop\drop1.exe	Code function: 3_2_0042EEA0	3_2_0042EEA0
Source: C:\Users\user\Desktop\drop1.exe	Code function: 3_2_00406F40	3_2_00406F40
Source: C:\Users\user\Desktop\drop1.exe	Code function: 3_2_00444F50	3_2_00444F50
Source: C:\Users\user\Desktop\drop1.exe	Code function: 3_2_00443F00	3_2_00443F00
Source: C:\Users\user\Desktop\drop1.exe	Code function: 3_2_00456F00	3_2_00456F00
Source: C:\Users\user\Desktop\drop1.exe	Code function: 3_2_00412FA0	3_2_00412FA0

Source: C:\Users\user\Desktop\drop1.exe	Code function: String function: 004AC500 appears 58 times
Source: C:\Users\user\Desktop\drop1.exe	Code function: String function: 001551F0 appears 64 times
Source: C:\Users\user\Desktop\drop1.exe	Code function: String function: 004517F0 appears 53 times
Source: C:\Users\user\Desktop\drop1.exe	Code function: String function: 0015970F appears 36 times

Source: drop1.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: 0.2.drop1.exe.196d220.1.raw.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_meduzastealer author = Sekoia.io, description = Finds MeduzaStealer samples based on specific strings, creation_date = 2023-06-20, classification = TLP:CLEAR, version = 1.0, id = 1276f485-aa5d-491b-89d8-77f98dc496e1
Source: 3.2.drop1.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_meduzastealer author = Sekoia.io, description = Finds MeduzaStealer samples based on specific strings, creation_date = 2023-06-20, classification = TLP:CLEAR, version = 1.0, id = 1276f485-aa5d-491b-89d8-77f98dc496e1
Source: 0.2.drop1.exe.196d220.1.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_meduzastealer author = Sekoia.io, description = Finds MeduzaStealer samples based on specific strings, creation_date = 2023-06-20, classification = TLP:CLEAR, version = 1.0, id = 1276f485-aa5d-491b-89d8-77f98dc496e1
Source: 3.2.drop1.exe.400000.1.raw.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_meduzastealer author = Sekoia.io, description = Finds MeduzaStealer samples based on specific strings, creation_date = 2023-06-20, classification = TLP:CLEAR, version = 1.0, id = 1276f485-aa5d-491b-89d8-77f98dc496e1
Source: 00000003.00000002.2242983706.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: infostealer_win_meduzastealer author = Sekoia.io, description = Finds MeduzaStealer samples based on specific strings, creation_date = 2023-06-20, classification = TLP:CLEAR, version = 1.0, id = 1276f485-aa5d-491b-89d8-77f98dc496e1

Source: drop1.exe

Static PE information: Section: .bss ZLIB complexity 1.0003138195647467

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@4/0@1/2

Source: C:\Users\user\Desktop\drop1.exe

Code function: 3_2_0048CB50 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,CloseHandle,

3_2_0048CB50

Source: C:\Users\user\Desktop\drop1.exe

Code function: 3_2_004473D0 CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,

3_2_004473D0

Source: C:\Users\user\Desktop\drop1.exe

Code function: 3_2_00477EE0 CoInitializeEx,CoInitializeSecurity,CoCreateInstance,CoSetProxyBlanket,SysAllocStringByteLen,SysFreeString,SysAllocStringByteLen,SysFreeString,SysStringByteLen,SysStringByteLen,SysFreeString,SysFreeString,

3_2_00477EE0

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:348:120:WilError_03
Source: C:\Users\user\Desktop\drop1.exe	Mutant created: \Sessions\1\BaseNamedObjects\Mmm-A33C734061CA11EE8C18806E6F6E6963C78A5D27

Source: drop1.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\drop1.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: drop1.exe

ReversingLabs: Detection: 91%

Source: C:\Users\user\Desktop\drop1.exe

File read: C:\Users\user\Desktop\drop1.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\drop1.exe "C:\Users\user\Desktop\drop1.exe"
Source: C:\Users\user\Desktop\drop1.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\drop1.exe	Process created: C:\Users\user\Desktop\drop1.exe "C:\Users\user\Desktop\drop1.exe"
Source: C:\Users\user\Desktop\drop1.exe	Process created: C:\Users\user\Desktop\drop1.exe "C:\Users\user\Desktop\drop1.exe"	Jump to behavior

Source: C:\Users\user\Desktop\drop1.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\drop1.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\drop1.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\drop1.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\drop1.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\drop1.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\drop1.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\drop1.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\drop1.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\drop1.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\drop1.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\drop1.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\drop1.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\drop1.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\drop1.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\drop1.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\drop1.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\drop1.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\drop1.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\drop1.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\drop1.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\drop1.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\drop1.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\drop1.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\drop1.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\drop1.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\drop1.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\drop1.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\drop1.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\drop1.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\drop1.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\drop1.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\drop1.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\drop1.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\drop1.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\drop1.exe	Section loaded: wintypes.dll	Jump to behavior

Source: C:\Users\user\Desktop\drop1.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\drop1.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: drop1.exe

Static file information: File size 1293312 > 1048576

Source: drop1.exe

Static PE information: Raw size of .bss is bigger than: 0x100000 < 0x120a00

Source: drop1.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_ISOLATION, TERMINAL_SERVER_AWARE

Source: drop1.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: drop1.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: drop1.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: drop1.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: drop1.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\drop1.exe

Code function: 3_2_00446400 LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,

3_2_00446400

Source: drop1.exe

Static PE information: section name: .OO

Source: C:\Users\user\Desktop\drop1.exe	Code function: 0_2_001546A3 push ecx; ret	0_2_001546B6
Source: C:\Users\user\Desktop\drop1.exe	Code function: 3_2_001546A3 push ecx; ret	3_2_001546B6
Source: C:\Users\user\Desktop\drop1.exe	Code function: 3_2_004ACE0C push ecx; ret	3_2_004ACE1F

Source: C:\Users\user\Desktop\drop1.exe

Code function: 3_2_0047E240 GetCurrentProcess,OpenProcessToken,GetTokenInformation,CloseHandle,ExitProcess,OpenMutexA,ExitProcess,CreateMutexA,ExitProcess,ReleaseMutex,CloseHandle,

3_2_0047E240

Source: C:\Users\user\Desktop\drop1.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\drop1.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\drop1.exe

Check user administrative privileges: GetTokenInformation,DecisionNodes

graph_3-58188

Source: C:\Users\user\Desktop\drop1.exe	Code function: 0_2_0015BE9A FindFirstFileExW,	0_2_0015BE9A
Source: C:\Users\user\Desktop\drop1.exe	Code function: 0_2_0015BF4B FindFirstFileExW,FindNextFileW,FindClose,FindClose,	0_2_0015BF4B
Source: C:\Users\user\Desktop\drop1.exe	Code function: 3_2_0015BE9A FindFirstFileExW,	3_2_0015BE9A
Source: C:\Users\user\Desktop\drop1.exe	Code function: 3_2_0015BF4B FindFirstFileExW,FindNextFileW,FindClose,FindClose,	3_2_0015BF4B
Source: C:\Users\user\Desktop\drop1.exe	Code function: 3_2_004402D0 FindFirstFileW,FindNextFileW,	3_2_004402D0
Source: C:\Users\user\Desktop\drop1.exe	Code function: 3_2_004B84C0 FindClose,FindFirstFileExW,GetLastError,	3_2_004B84C0
Source: C:\Users\user\Desktop\drop1.exe	Code function: 3_2_004B8545 GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,___std_fs_open_handle@16,GetFileInformationByHandleEx,GetLastError,GetFileInformationByHandleEx,GetFileInformationByHandleEx,	3_2_004B8545
Source: C:\Users\user\Desktop\drop1.exe	Code function: 3_2_004B84E0 FindFirstFileExW,	3_2_004B84E0
Source: C:\Users\user\Desktop\drop1.exe	Code function: 3_2_004BAB85 FindFirstFileExW,	3_2_004BAB85

Source: C:\Users\user\Desktop\drop1.exe

Code function: 3_2_00487550 GetLogicalDriveStringsW,

3_2_00487550

Source: C:\Users\user\Desktop\drop1.exe

Code function: 3_2_00498574 VirtualQuery,GetSystemInfo,VirtualAlloc,VirtualProtect,

3_2_00498574

Source: C:\Users\user\Desktop\drop1.exe	File opened: D:\sources\migration\	Jump to behavior
Source: C:\Users\user\Desktop\drop1.exe	File opened: D:\sources\replacementmanifests\	Jump to behavior
Source: C:\Users\user\Desktop\drop1.exe	File opened: D:\sources\migration\wtr\	Jump to behavior
Source: C:\Users\user\Desktop\drop1.exe	File opened: D:\sources\replacementmanifests\microsoft-activedirectory-webservices\	Jump to behavior
Source: C:\Users\user\Desktop\drop1.exe	File opened: D:\sources\replacementmanifests\microsoft-client-license-platform-service-migration\	Jump to behavior
Source: C:\Users\user\Desktop\drop1.exe	File opened: D:\sources\replacementmanifests\hwvid-migration-2\	Jump to behavior

Source: drop1.exe, 00000003.00000003.2034994573.00000000044A5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: drop1.exe, 00000003.00000003.2034994573.00000000044A5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696428655f
Source: drop1.exe, 00000003.00000003.2034994573.00000000044A5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: drop1.exe, 00000003.00000003.2034994573.00000000044A5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: drop1.exe, 00000003.00000003.2034994573.00000000044A5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696428655
Source: drop1.exe, 00000003.00000003.2034994573.00000000044A5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: drop1.exe, 00000003.00000002.2243329095.0000000000CF8000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000003.00000003.2021635573.0000000000D59000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000003.00000002.2243329095.0000000000D45000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: drop1.exe, 00000003.00000003.2034994573.00000000044A5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: drop1.exe, 00000003.00000003.2034994573.00000000044A5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: drop1.exe, 00000003.00000003.2034994573.00000000044A5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: drop1.exe, 00000003.00000003.2021635573.0000000000D59000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000003.00000002.2243329095.0000000000D45000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWl
Source: drop1.exe, 00000003.00000003.2034994573.00000000044A5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: drop1.exe, 00000003.00000003.2034994573.00000000044A5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: drop1.exe, 00000003.00000003.2034994573.00000000044A5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: drop1.exe, 00000003.00000003.2034994573.00000000044A5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: drop1.exe, 00000003.00000003.2034994573.00000000044A5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: drop1.exe, 00000003.00000003.2034994573.00000000044A5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: drop1.exe, 00000003.00000003.2034994573.00000000044A5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: drop1.exe, 00000003.00000003.2034994573.00000000044A5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: drop1.exe, 00000003.00000003.2034994573.00000000044A5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: drop1.exe, 00000003.00000003.2034994573.00000000044A5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: drop1.exe, 00000003.00000003.2034994573.00000000044A5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696428655
Source: drop1.exe, 00000003.00000003.2034994573.00000000044A5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: drop1.exe, 00000003.00000003.2034994573.00000000044A5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: drop1.exe, 00000003.00000003.2034994573.00000000044A5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: drop1.exe, 00000003.00000003.2034994573.00000000044A5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: drop1.exe, 00000003.00000003.2034994573.00000000044A5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: drop1.exe, 00000003.00000003.2034994573.00000000044A5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: drop1.exe, 00000003.00000003.2034994573.00000000044A5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: drop1.exe, 00000003.00000003.2034994573.00000000044A5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: drop1.exe, 00000003.00000003.2034994573.00000000044A5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: drop1.exe, 00000003.00000003.2034994573.00000000044A5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: drop1.exe, 00000003.00000003.2034994573.00000000044A5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655

Source: C:\Users\user\Desktop\drop1.exe

API call chain: ExitProcess graph end node

graph_3-58208

Source: C:\Users\user\Desktop\drop1.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\drop1.exe

Code function: 3_2_0048A710 RtlAcquirePebLock,NtAllocateVirtualMemory,NtAllocateVirtualMemory,lstrcpyW,lstrcatW,NtAllocateVirtualMemory,lstrcpyW,RtlInitUnicodeString,RtlInitUnicodeString,RtlInitUnicodeString,LdrEnumerateLoadedModules,RtlReleasePebLock,

3_2_0048A710

Source: C:\Users\user\Desktop\drop1.exe

Code function: 0_2_00155027 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00155027

Source: C:\Users\user\Desktop\drop1.exe

Code function: 3_2_00498574 VirtualProtect ?,-00000001,00000104,?,?,?,0000001C

3_2_00498574

Source: C:\Users\user\Desktop\drop1.exe

Code function: 3_2_00446400 LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,

3_2_00446400

Source: C:\Users\user\Desktop\drop1.exe	Code function: 0_2_0016A1A9 mov edi, dword ptr fs:[00000030h]	0_2_0016A1A9
Source: C:\Users\user\Desktop\drop1.exe	Code function: 0_2_00151770 mov edi, dword ptr fs:[00000030h]	0_2_00151770
Source: C:\Users\user\Desktop\drop1.exe	Code function: 3_2_00151770 mov edi, dword ptr fs:[00000030h]	3_2_00151770

Source: C:\Users\user\Desktop\drop1.exe

Code function: 0_2_00159726 GetProcessHeap,

0_2_00159726

Source: C:\Users\user\Desktop\drop1.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\drop1.exe	Code function: 0_2_0015501B SetUnhandledExceptionFilter,	0_2_0015501B
Source: C:\Users\user\Desktop\drop1.exe	Code function: 0_2_00155027 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00155027
Source: C:\Users\user\Desktop\drop1.exe	Code function: 0_2_001578CC IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_001578CC
Source: C:\Users\user\Desktop\drop1.exe	Code function: 0_2_001545B7 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_001545B7
Source: C:\Users\user\Desktop\drop1.exe	Code function: 3_2_0015501B SetUnhandledExceptionFilter,	3_2_0015501B
Source: C:\Users\user\Desktop\drop1.exe	Code function: 3_2_00155027 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_00155027
Source: C:\Users\user\Desktop\drop1.exe	Code function: 3_2_001578CC IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_001578CC
Source: C:\Users\user\Desktop\drop1.exe	Code function: 3_2_001545B7 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	3_2_001545B7
Source: C:\Users\user\Desktop\drop1.exe	Code function: 3_2_004AC6BF IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_004AC6BF
Source: C:\Users\user\Desktop\drop1.exe	Code function: 3_2_004AC80A SetUnhandledExceptionFilter,	3_2_004AC80A
Source: C:\Users\user\Desktop\drop1.exe	Code function: 3_2_00497B2D IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_00497B2D
Source: C:\Users\user\Desktop\drop1.exe	Code function: 3_2_004ABFD4 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	3_2_004ABFD4

HIPS / PFW / Operating System Protection Evasion

Contains functionality to inject code into remote processes

Source: C:\Users\user\Desktop\drop1.exe

Code function: 0_2_0016A1A9 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CreateProcessW,CreateProcessW,VirtualAlloc,VirtualAlloc,GetThreadContext,Wow64GetThreadContext,ReadProcessMemory,ReadProcessMemory,VirtualAllocEx,VirtualAllocEx,GetProcAddress,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,SetThreadContext,Wow64SetThreadContext,ResumeThread,ResumeThread,

0_2_0016A1A9

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\drop1.exe

Memory written: C:\Users\user\Desktop\drop1.exe base: 400000 value starts with: 4D5A

Jump to behavior

Source: C:\Users\user\Desktop\drop1.exe

Code function: 3_2_0047D2F0 ShellExecuteW,OpenProcessToken,GetCurrentProcess,GetTokenInformation,std::ios_base::_Ios_base_dtor,

3_2_0047D2F0

Source: C:\Users\user\Desktop\drop1.exe

Process created: C:\Users\user\Desktop\drop1.exe "C:\Users\user\Desktop\drop1.exe"

Jump to behavior

Source: C:\Users\user\Desktop\drop1.exe

Code function: 3_2_00486C50 cpuid

3_2_00486C50

Source: C:\Users\user\Desktop\drop1.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	3_2_004A6109
Source: C:\Users\user\Desktop\drop1.exe	Code function: GetLocaleInfoEx,FormatMessageA,	3_2_004B824D
Source: C:\Users\user\Desktop\drop1.exe	Code function: GetLocaleInfoW,	3_2_004A620F
Source: C:\Users\user\Desktop\drop1.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	3_2_004A62E5
Source: C:\Users\user\Desktop\drop1.exe	Code function: EnumSystemLocalesW,	3_2_0049C70E
Source: C:\Users\user\Desktop\drop1.exe	Code function: GetACP,IsValidCodePage,GetLocaleInfoW,	3_2_004A5970
Source: C:\Users\user\Desktop\drop1.exe	Code function: EnumSystemLocalesW,	3_2_004A5C67
Source: C:\Users\user\Desktop\drop1.exe	Code function: EnumSystemLocalesW,	3_2_004A5C1C
Source: C:\Users\user\Desktop\drop1.exe	Code function: GetLocaleInfoW,	3_2_0049CCB0
Source: C:\Users\user\Desktop\drop1.exe	Code function: EnumSystemLocalesW,	3_2_004A5D02
Source: C:\Users\user\Desktop\drop1.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	3_2_004A5D8D
Source: C:\Users\user\Desktop\drop1.exe	Code function: GetLocaleInfoW,	3_2_004A5FE0

Source: C:\Users\user\Desktop\drop1.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\drop1.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior

Source: C:\Users\user\Desktop\drop1.exe

Key value queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\TimeZoneInformation TimeZoneKeyName

Jump to behavior

Source: C:\Users\user\Desktop\drop1.exe

Code function: 0_2_001548D3 GetSystemTimePreciseAsFileTime,GetSystemTimePreciseAsFileTime,GetSystemTimeAsFileTime,

0_2_001548D3

Source: C:\Users\user\Desktop\drop1.exe

Code function: 3_2_004863F0 GetUserNameW,

3_2_004863F0

Source: C:\Users\user\Desktop\drop1.exe

Code function: 3_2_004A1074 GetTimeZoneInformation,

3_2_004A1074

Stealing of Sensitive Information

Yara detected CredGrabber

Source: Yara match

File source: Process Memory Space: drop1.exe PID: 1472, type: MEMORYSTR

Yara detected Meduza Stealer

Source: Yara match	File source: 0.2.drop1.exe.196d220.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.drop1.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.drop1.exe.196d220.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.drop1.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.2243329095.0000000000CF8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2242983706.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: drop1.exe PID: 1472, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: drop1.exe, 00000003.00000002.2243329095.0000000000CF8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Electrum-LTC\config
Source: drop1.exe, 00000003.00000002.2243329095.0000000000CF8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ElectronCash\config
Source: drop1.exe, 00000003.00000003.2047669762.0000000000D6F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldbgs42
Source: drop1.exe, 00000003.00000002.2243329095.0000000000CF8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Exodus\exodus.wallet
Source: drop1.exe, 00000003.00000002.2243329095.0000000000D45000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Binance\walletsXw
Source: drop1.exe, 00000003.00000002.2243329095.0000000000CF8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Ethereum\keystore
Source: drop1.exe, 00000003.00000002.2243329095.0000000000CF8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Ethereum\keystore

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\drop1.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\drop1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\CURRENT	Jump to behavior
Source: C:\Users\user\Desktop\drop1.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\drop1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\MANIFEST-000001	Jump to behavior
Source: C:\Users\user\Desktop\drop1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\drop1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Users\user\Desktop\drop1.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\drop1.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\drop1.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\drop1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\drop1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\drop1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOG	Jump to behavior
Source: C:\Users\user\Desktop\drop1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\drop1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\drop1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOCK	Jump to behavior
Source: C:\Users\user\Desktop\drop1.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\drop1.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\drop1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\000003.log	Jump to behavior
Source: C:\Users\user\Desktop\drop1.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\drop1.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: Yara match

File source: Process Memory Space: drop1.exe PID: 1472, type: MEMORYSTR

Remote Access Functionality

Yara detected CredGrabber

Source: Yara match

File source: Process Memory Space: drop1.exe PID: 1472, type: MEMORYSTR

Yara detected Meduza Stealer

Source: Yara match	File source: 0.2.drop1.exe.196d220.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.drop1.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.drop1.exe.196d220.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.drop1.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.2243329095.0000000000CF8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2242983706.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: drop1.exe PID: 1472, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Native API	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	1 Disable or Modify Tools	1 OS Credential Dumping	12 System Time Discovery	Remote Services	1 Archive Collected Data	2 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	2 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 Access Token Manipulation	2 Obfuscated Files or Information	Security Account Manager	3 File and Directory Discovery	SMB/Windows Admin Shares	1 Screen Capture	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	211 Process Injection	1 Software Packing	NTDS	34 System Information Discovery	Distributed Component Object Model	1 Email Collection	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Query Registry	SSH	Keylogging	3 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Access Token Manipulation	Cached Domain Credentials	21 Security Software Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	211 Process Injection	DCSync	2 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	1 System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	1 System Network Configuration Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
drop1.exe	91%	ReversingLabs	Win32.Trojan.LummaStealer
drop1.exe	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
https://support.moz	0%	Avira URL Cloud	safe
http://ns.adp/1.0/	0%	Avira URL Cloud	safe
http://ns.exif/1	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
api.ipify.org	172.67.74.152	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://api.ipify.org/	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://ac.ecosia.org/autocomplete?q=	drop1.exe, 00000003.00000003.2023626908.0000000000D6F000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000003.00000003.2023350123.000000000442D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://duckduckgo.com/chrome_newtab	drop1.exe, 00000003.00000003.2023626908.0000000000D6F000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000003.00000003.2023350123.000000000442D000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000003.00000003.2023350123.0000000004414000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000003.00000003.2024111798.0000000004414000.00000004.00000020.00020000.00000000.sdmp	false		high
http://ns.exif/1	drop1.exe, 00000003.00000002.2243667314.000000000106E000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000003.00000003.2242546192.000000000106B000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000003.00000003.2242629094.000000000106C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/ac/?q=	drop1.exe, 00000003.00000003.2023626908.0000000000D6F000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000003.00000003.2023350123.000000000442D000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000003.00000003.2023350123.0000000004414000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000003.00000003.2024111798.0000000004414000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.moz	drop1.exe, 00000003.00000003.2041225998.0000000003D01000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg	drop1.exe, 00000003.00000003.2044728897.0000000000DA9000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	drop1.exe, 00000003.00000003.2023626908.0000000000D6F000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000003.00000003.2023350123.000000000442D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	drop1.exe, 00000003.00000003.2044824868.0000000000DA7000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000003.00000003.2044824868.0000000000D6F000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000003.00000003.2044482311.0000000000DEA000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000003.00000003.2044900517.0000000000DEB000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000003.00000003.2044728897.0000000000DA9000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	drop1.exe, 00000003.00000003.2023626908.0000000000D6F000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000003.00000003.2023350123.000000000442D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	drop1.exe, 00000003.00000003.2044728897.0000000000DA9000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL	drop1.exe, 00000003.00000003.2038497430.0000000003721000.00000004.00000020.00020000.00000000.sdmp	false		high
http://ns.adp/1.0/	drop1.exe, 00000003.00000003.2242546192.000000000106B000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000003.00000003.2242629094.000000000106C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref	drop1.exe, 00000003.00000003.2044824868.0000000000DA7000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000003.00000003.2044824868.0000000000D6F000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000003.00000003.2044482311.0000000000DEA000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000003.00000003.2044900517.0000000000DEB000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000003.00000003.2044728897.0000000000DA9000.00000004.00000020.00020000.00000000.sdmp	false		high
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.	drop1.exe, 00000003.00000003.2044728897.0000000000DA9000.00000004.00000020.00020000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	drop1.exe, 00000003.00000003.2023626908.0000000000D6F000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000003.00000003.2023350123.000000000442D000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000003.00000003.2023350123.0000000004414000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000003.00000003.2024111798.0000000004414000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477	drop1.exe, 00000003.00000003.2044824868.0000000000DA7000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000003.00000003.2044824868.0000000000D6F000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000003.00000003.2044482311.0000000000DEA000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000003.00000003.2044900517.0000000000DEB000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000003.00000003.2044728897.0000000000DA9000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	drop1.exe, 00000003.00000003.2023626908.0000000000D6F000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000003.00000003.2023350123.000000000442D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.mozilla.org	drop1.exe, 00000003.00000003.2040285656.0000000003D00000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000003.00000003.2039051909.0000000003766000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000003.00000003.2038497430.00000000036B3000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000003.00000003.2038497430.00000000036BB000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000003.00000003.2038497430.00000000036E1000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000003.00000003.2043762244.00000000044D5000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000003.00000003.2038497430.00000000036D9000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000003.00000003.2038497430.000000000376E000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000003.00000003.2043762244.000000000442B000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000003.00000003.2038497430.0000000003711000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000003.00000003.2043762244.0000000004423000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000003.00000003.2038497430.0000000003719000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/	drop1.exe, 00000003.00000003.2023626908.0000000000D6F000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000003.00000003.2023350123.000000000442D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta	drop1.exe, 00000003.00000003.2044824868.0000000000DA7000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000003.00000003.2044824868.0000000000D6F000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000003.00000003.2044482311.0000000000DEA000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000003.00000003.2044900517.0000000000DEB000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000003.00000003.2044728897.0000000000DA9000.00000004.00000020.00020000.00000000.sdmp	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	drop1.exe, 00000003.00000003.2023626908.0000000000D6F000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000003.00000003.2023350123.000000000442D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	drop1.exe, 00000003.00000003.2038497430.0000000003721000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
66.63.187.173	unknown	United States		8100	ASN-QUADRANET-GLOBALUS	true
172.67.74.152	api.ipify.org	United States		13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1584549
Start date and time:	2025-01-05 20:18:05 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 28s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	6
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	drop1.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@4/0@1/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 99% Number of executed functions: 87 Number of non-executed functions: 134
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 4.175.87.197, 13.107.246.45
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: drop1.exe

Simulations

Behavior and APIs

⊘No simulations

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
66.63.187.173	drop1.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse
66.63.187.173	file.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse
172.67.74.152	jgbC220X2U.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/?format=text
	malware.exe	Get hash	malicious	Targeted Ransomware, TrojanRansom	Browse	api.ipify.org/
	Simple1.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	Simple2.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	systemConfigChecker.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	systemConfigChecker.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	2b7cu0KwZl.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	Zc9eO57fgF.elf	Get hash	malicious	Unknown	Browse	api.ipify.org/
	67065b4c84713_Javiles.exe	Get hash	malicious	RDPWrap Tool	Browse	api.ipify.org/
	Yc9hcFC1ux.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
api.ipify.org	drop1.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	104.26.13.205
	Yoranis Setup.exe	Get hash	malicious	Unknown	Browse	104.26.12.205
	Yoranis Setup.exe	Get hash	malicious	Unknown	Browse	104.26.13.205
	file.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	104.26.12.205
	http://www.cipassoitalia.it/	Get hash	malicious	CAPTCHA Scam ClickFix	Browse	172.67.74.152
	https://telegra.ph/Clarkson-122025-01-02	Get hash	malicious	Unknown	Browse	104.26.12.205
	vEtDFkAZjO.exe	Get hash	malicious	RL STEALER, StormKitty	Browse	104.26.12.205
	Statement of Account - USD 16,720.00.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	RtU8kXPnKr.exe	Get hash	malicious	Quasar	Browse	104.26.12.205
	Loader.exe	Get hash	malicious	Meduza Stealer	Browse	104.26.13.205

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ASN-QUADRANET-GLOBALUS	drop1.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	66.63.187.173
	file.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	66.63.187.173
	Fantazy.spc.elf	Get hash	malicious	Unknown	Browse	104.223.10.34
	1.elf	Get hash	malicious	Unknown	Browse	72.11.146.74
	Aqua.arm7.elf	Get hash	malicious	Mirai	Browse	193.111.248.108
	Aqua.mips.elf	Get hash	malicious	Unknown	Browse	193.111.248.108
	Aqua.mpsl.elf	Get hash	malicious	Unknown	Browse	193.111.248.108
	DEMONS.ppc.elf	Get hash	malicious	Unknown	Browse	162.220.9.64
	Hilix.ppc.elf	Get hash	malicious	Mirai	Browse	45.199.228.221
CLOUDFLARENETUS	DansMinistrie.exe	Get hash	malicious	LummaC	Browse	104.21.112.1
	CrosshairX.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	installer_1.05_36.7.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.208.58
	Installer_x64.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	Installer.exe	Get hash	malicious	LummaC, PureLog Stealer	Browse	104.21.32.1
	Insomia.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	Aura.exe	Get hash	malicious	LummaC, PureLog Stealer	Browse	104.21.80.1
	loader.exe	Get hash	malicious	LummaC, PureLog Stealer	Browse	188.114.97.3
	LinxOptimizer.exe	Get hash	malicious	Unknown	Browse	172.67.75.163
	Script.exe	Get hash	malicious	LummaC, PureLog Stealer	Browse	104.21.80.1

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
37f463bf4616ecd445d4a1937da06e19	ZT0KQ1PC.exe	Get hash	malicious	PureLog Stealer, Vidar	Browse	172.67.74.152
	LinxOptimizer.exe	Get hash	malicious	Unknown	Browse	172.67.74.152
	setup.msi	Get hash	malicious	Unknown	Browse	172.67.74.152
	drop1.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	172.67.74.152
	2b687482300.6345827638.08.exe	Get hash	malicious	Unknown	Browse	172.67.74.152
	2b687482300.6345827638.08.exe	Get hash	malicious	Unknown	Browse	172.67.74.152
	K27Yg4V48M.exe	Get hash	malicious	LummaC	Browse	172.67.74.152
	IH5XqCdf06.exe	Get hash	malicious	LummaC	Browse	172.67.74.152
	Tax_Refund_Claim_2024_Australian_Taxation_Office.js	Get hash	malicious	Remcos	Browse	172.67.74.152
	c2.hta	Get hash	malicious	Remcos	Browse	172.67.74.152

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	PE32 executable (console) Intel 80386, for MS Windows
Entropy (8bit):	7.959249656314459
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	drop1.exe
File size:	1'293'312 bytes
MD5:	c401a019b5a9e44646577f8922e1014e
SHA1:	3406d945b0283bb6337a7490198b00cd1df278a2
SHA256:	31ebf7219722b8c908a914b2b08c5d03140af8b0cef6c96152e458dc82301c0a
SHA512:	f1306e3e015f005af3675f53ff17015b4cdc4484d13690a04842fa8ab9e7037c68e2e53c90176d7fff36c8a2faf50864d09fb89609466d5d89d7f11783f9250f
SSDEEP:	24576:Bdl/7xIgevnHodySw5KP4lXkV8sWGzv6VD0iNKlsTEc8hF71X:/l/a5vnIdyd5Q4lXkBmLNfkP7F
TLSH:	5855235131C0C4B1CBA3583645B0BB56593DF9314FB0A9FF278D59A15E22AD08A3CAFB
File Content Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...bI\g..........".................\L............@.......................................@.................................D~..(..

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x404c5c
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_ISOLATION, TERMINAL_SERVER_AWARE
Time Stamp:	0x675C4962 [Fri Dec 13 14:49:06 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2716f32d1d63b3fc977d6064633b778d

Entrypoint Preview

Instruction
call 00007F4DD0B3A00Ah
jmp 00007F4DD0B39C29h
push ebp
mov ebp, esp
push dword ptr [ebp+08h]
call 00007F4DD0B39DBFh
neg eax
pop ecx
sbb eax, eax
neg eax
dec eax
pop ebp
ret
push ebp
mov ebp, esp
cmp dword ptr [0041B4F0h], FFFFFFFFh
push dword ptr [ebp+08h]
jne 00007F4DD0B39DB9h
call 00007F4DD0B3C3D1h
jmp 00007F4DD0B39DBDh
push 0041B4F0h
call 00007F4DD0B3C354h
pop ecx
pop ecx
xor ecx, ecx
test eax, eax
cmove ecx, dword ptr [ebp+08h]
mov eax, ecx
pop ebp
ret
push 00000008h
push 00418D38h
call 00007F4DD0B3A2F0h
and dword ptr [ebp-04h], 00000000h
mov eax, 00005A4Dh
cmp word ptr [00400000h], ax
jne 00007F4DD0B39E0Fh
mov eax, dword ptr [0040003Ch]
cmp dword ptr [eax+00400000h], 00004550h
jne 00007F4DD0B39DFEh
mov ecx, 0000010Bh
cmp word ptr [eax+00400018h], cx
jne 00007F4DD0B39DF0h
mov eax, dword ptr [ebp+08h]
mov ecx, 00400000h
sub eax, ecx
push eax
push ecx
call 00007F4DD0B39F32h
pop ecx
pop ecx
test eax, eax
je 00007F4DD0B39DD9h
cmp dword ptr [eax+24h], 00000000h
jl 00007F4DD0B39DD3h
mov dword ptr [ebp-04h], FFFFFFFEh
mov al, 01h
jmp 00007F4DD0B39DD1h
mov eax, dword ptr [ebp-14h]
mov eax, dword ptr [eax]
xor ecx, ecx
cmp dword ptr [eax], C0000005h
sete cl
mov eax, ecx
ret
mov esp, dword ptr [ebp-18h]

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x17e44	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x1d000	0xe8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x1e000	0x12fc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x12808	0xc0	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x17fac	0x140	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x10c15	0x10e00	05d7420100633613bdbd5a889171c5f7	False	0.5704427083333333	data	6.50620173764596	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x12000	0x7294	0x7400	4965eb04eb8b1b66b8d84a097bc01bc3	False	0.3977976831896552	data	4.65662016842751	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x1a000	0x1c10	0x1200	6a2a147d595c2e66ddd7fdd872225955	False	0.4281684027777778	data	4.604642940636322	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.OO	0x1c000	0x4	0x200	bf619eac0cdf3f68d496ea9344137e8b	False	0.02734375	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x1d000	0xe8	0x200	0713d2c4e51a805f2ce8d9843bcbad43	False	0.306640625	data	2.337865625306241	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x1e000	0x12fc	0x1400	c56221e7af6185e7585b1796050bcf12	False	0.778515625	data	6.424268394395036	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.bss	0x20000	0x120a00	0x120a00	0981e8d8e7a06f97fc8527d01b1e5825	False	1.0003138195647467	data	7.999822246026082	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x1d060	0x87	XML 1.0 document, ASCII text	English	United States	0.8222222222222222

Imports

DLL

Import

KERNEL32.dll

AcquireSRWLockExclusive, CloseHandle, CompareStringW, CreateFileW, CreateThread, DecodePointer, DeleteCriticalSection, EncodePointer, EnterCriticalSection, ExitProcess, ExitThread, FindClose, FindFirstFileExW, FindNextFileW, FlushFileBuffers, FreeEnvironmentStringsW, FreeLibrary, FreeLibraryAndExitThread, GetACP, GetCPInfo, GetCommandLineA, GetCommandLineW, GetConsoleMode, GetConsoleOutputCP, GetCurrentProcess, GetCurrentProcessId, GetCurrentThreadId, GetEnvironmentStringsW, GetExitCodeThread, GetFileSize, GetFileType, GetLastError, GetModuleFileNameA, GetModuleFileNameW, GetModuleHandleA, GetModuleHandleExW, GetModuleHandleW, GetOEMCP, GetProcAddress, GetProcessHeap, GetStartupInfoW, GetStdHandle, GetStringTypeW, GetSystemTimeAsFileTime, HeapAlloc, HeapFree, HeapReAlloc, HeapSize, InitializeCriticalSectionAndSpinCount, InitializeSListHead, IsDebuggerPresent, IsProcessorFeaturePresent, IsValidCodePage, LCMapStringW, LeaveCriticalSection, LoadLibraryExW, MultiByteToWideChar, QueryPerformanceCounter, RaiseException, ReadFile, ReleaseSRWLockExclusive, RtlUnwind, SetEnvironmentVariableW, SetFilePointerEx, SetLastError, SetStdHandle, SetUnhandledExceptionFilter, TerminateProcess, TlsAlloc, TlsFree, TlsGetValue, TlsSetValue, TryAcquireSRWLockExclusive, UnhandledExceptionFilter, WaitForSingleObjectEx, WakeAllConditionVariable, WideCharToMultiByte, WriteConsoleW, WriteFile

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-05T20:18:59.648048+0100	2049441	ET MALWARE Win32/Unknown Grabber Base64 Data Exfiltration Attempt	1	192.168.2.5	49704	66.63.187.173	15666	TCP
2025-01-05T20:18:59.648048+0100	2050806	ET MALWARE [ANY.RUN] Meduza Stealer Exfiltration M2	1	192.168.2.5	49704	66.63.187.173	15666	TCP
2025-01-05T20:18:59.648048+0100	2050807	ET MALWARE [ANY.RUN] Possible Meduza Stealer Exfiltration (TCP)	1	192.168.2.5	49704	66.63.187.173	15666	TCP
2025-01-05T20:18:59.653137+0100	2050806	ET MALWARE [ANY.RUN] Meduza Stealer Exfiltration M2	1	192.168.2.5	49704	66.63.187.173	15666	TCP
2025-01-05T20:18:59.653137+0100	2050807	ET MALWARE [ANY.RUN] Possible Meduza Stealer Exfiltration (TCP)	1	192.168.2.5	49704	66.63.187.173	15666	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 5, 2025 20:18:54.419646025 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:54.424539089 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:54.424632072 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:54.493781090 CET	49705	443	192.168.2.5	172.67.74.152
Jan 5, 2025 20:18:54.493808985 CET	443	49705	172.67.74.152	192.168.2.5
Jan 5, 2025 20:18:54.493880987 CET	49705	443	192.168.2.5	172.67.74.152
Jan 5, 2025 20:18:54.501682997 CET	49705	443	192.168.2.5	172.67.74.152
Jan 5, 2025 20:18:54.501697063 CET	443	49705	172.67.74.152	192.168.2.5
Jan 5, 2025 20:18:54.969953060 CET	443	49705	172.67.74.152	192.168.2.5
Jan 5, 2025 20:18:54.970098019 CET	49705	443	192.168.2.5	172.67.74.152
Jan 5, 2025 20:18:55.021651983 CET	49705	443	192.168.2.5	172.67.74.152
Jan 5, 2025 20:18:55.021665096 CET	443	49705	172.67.74.152	192.168.2.5
Jan 5, 2025 20:18:55.021887064 CET	443	49705	172.67.74.152	192.168.2.5
Jan 5, 2025 20:18:55.024079084 CET	49705	443	192.168.2.5	172.67.74.152
Jan 5, 2025 20:18:55.025599003 CET	49705	443	192.168.2.5	172.67.74.152
Jan 5, 2025 20:18:55.067329884 CET	443	49705	172.67.74.152	192.168.2.5
Jan 5, 2025 20:18:55.138686895 CET	443	49705	172.67.74.152	192.168.2.5
Jan 5, 2025 20:18:55.138731003 CET	443	49705	172.67.74.152	192.168.2.5
Jan 5, 2025 20:18:55.138742924 CET	49705	443	192.168.2.5	172.67.74.152
Jan 5, 2025 20:18:55.138782024 CET	49705	443	192.168.2.5	172.67.74.152
Jan 5, 2025 20:18:55.139940023 CET	49705	443	192.168.2.5	172.67.74.152
Jan 5, 2025 20:18:55.139954090 CET	443	49705	172.67.74.152	192.168.2.5
Jan 5, 2025 20:18:59.648047924 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.653055906 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.653074026 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.653111935 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.653129101 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.653136969 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.653139114 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.653186083 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.653198957 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.653209925 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.653240919 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.653254986 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.653274059 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.653285980 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.653294086 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.653301954 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.653333902 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.653346062 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.658035040 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.658046007 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.658061981 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.658071041 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.658078909 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.658086061 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.658118010 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.658118963 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.658133984 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.658153057 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.658157110 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.658175945 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.658205032 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.658210993 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.658231020 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.658250093 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.658253908 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.658266068 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.658308983 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.658333063 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.658385038 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.663181067 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.663196087 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.663208961 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.663216114 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.663229942 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.663238049 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.663244009 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.663264990 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.663278103 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.663280964 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.663294077 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.663316965 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.663333893 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.663361073 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.663383007 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.663423061 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.663506031 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.663515091 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.663562059 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.671906948 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.671952009 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.672000885 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.672009945 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.672018051 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.672025919 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.672035933 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.672074080 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.672120094 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.672127962 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.672131062 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.672137976 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.672146082 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.672173977 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.672173977 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.672189951 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.672238111 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.672247887 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.672254086 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.672261000 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.672278881 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.672297001 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.672311068 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.672378063 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.672388077 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.672395945 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.672404051 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.672429085 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.672446966 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.672523975 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.672532082 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.672538996 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.672545910 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.672553062 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.672580957 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.672599077 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.672668934 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.672704935 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.680649996 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.680694103 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.680720091 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.680732012 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.680740118 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.680747986 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.680762053 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.680769920 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.680782080 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.680793047 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.680816889 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.680969000 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.680979013 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.680986881 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.680994987 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.681020975 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.681044102 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.681087017 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.681094885 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.681104898 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.681123972 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.681133032 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.681133032 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.681145906 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.681171894 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.681216955 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.681226015 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.681233883 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.681241989 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.681255102 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.681278944 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.681289911 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.681344032 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.681354046 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.681361914 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.681370020 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.681377888 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.681385040 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.681416035 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.681478977 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.681489944 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.681497097 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.681504011 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.681512117 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.681519985 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.681531906 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.681569099 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.689407110 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.689456940 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.689519882 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.689528942 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.689536095 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.689574957 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.689645052 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.689655066 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.689662933 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.689676046 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.689682007 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.689701080 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.689740896 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.689758062 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.689766884 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.689769983 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.689775944 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.689783096 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.689811945 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.689884901 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.689893961 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.689901114 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.689939022 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.690048933 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.690057039 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.690063953 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.690099955 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.690181017 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.690190077 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.690192938 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.690200090 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.690229893 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.690249920 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.690309048 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.690318108 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.690325022 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.690331936 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.690339088 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.690351009 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.690363884 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.690378904 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.690427065 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.690435886 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.690442085 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.690448999 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.690455914 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.690468073 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.690476894 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.690496922 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.690576077 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.690584898 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.690622091 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.698390007 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.698435068 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.699438095 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.699482918 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.699589014 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.699632883 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.700368881 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.700380087 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.700388908 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.700417042 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.700419903 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.700433969 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.700442076 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.700445890 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.700450897 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.700457096 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.700459957 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.700468063 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.700474977 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.700481892 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.700484037 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.700490952 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.700499058 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.700501919 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.700505972 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.700514078 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.700521946 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.700529099 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.700532913 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.700536013 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.700537920 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.700545073 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.700553894 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.700558901 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.700563908 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.700573921 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.700577021 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.700581074 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.700589895 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.700597048 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.700607061 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.700620890 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.700623035 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.700629950 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.700639009 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.700648069 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.700654984 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.700661898 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.700669050 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.700670958 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.700676918 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.700685024 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.700685978 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.700692892 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.700700045 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.700700045 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.700707912 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.700721025 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.700737000 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.700745106 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.703289032 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.703334093 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.704308987 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.704355955 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.704405069 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.704452038 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.705521107 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.705549002 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.705566883 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.705574036 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.705588102 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.705591917 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.705598116 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.705605030 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.705616951 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.705636978 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.705638885 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.705651045 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.705653906 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.705670118 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.705689907 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.705697060 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.705705881 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.705722094 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.705745935 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.705745935 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.705754995 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.705799103 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.705807924 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.705816031 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.705822945 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.705856085 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.705871105 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.705879927 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.705912113 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.705919027 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.705920935 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.705955982 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.705969095 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.705976963 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.706013918 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.706021070 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.706047058 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.706056118 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.706065893 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.706099033 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.706110954 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.706119061 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.706123114 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.706151009 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.706159115 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.706166983 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.706193924 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.706202030 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.706222057 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.706244946 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.706253052 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.706260920 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.706290007 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.706298113 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.706302881 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.706335068 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.706336021 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.706346035 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.706383944 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.706389904 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.706398010 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.706420898 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.706429005 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.706443071 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.706463099 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.706470013 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.706507921 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.708106995 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.708148956 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.708287001 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.708328962 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.709163904 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.709216118 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.709294081 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.709336042 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.710427999 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.710445881 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.710469961 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.710483074 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.710546017 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.710556984 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.710597992 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.710659027 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.710668087 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.710702896 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.710747957 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.710762978 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.710783958 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.710794926 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.710817099 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.710829973 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.710856915 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.710865021 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.710897923 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.710907936 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.710928917 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.710937023 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.710947990 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.710977077 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.710982084 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.710993052 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.711016893 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.711025953 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.711025953 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.711070061 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.711090088 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.711098909 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.711137056 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.711138964 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.711148024 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.711184978 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.711219072 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.711226940 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.711261988 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.711272001 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.711307049 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.711347103 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.711355925 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.711363077 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.711396933 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.711396933 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.711405039 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.711409092 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.711445093 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.711453915 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.711462021 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.711498976 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.711498976 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.711508036 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.711536884 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.711539984 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.711549997 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.711553097 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.711587906 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.711597919 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.711606026 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.711637974 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.711639881 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.711646080 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.711675882 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.711677074 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.711684942 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.711702108 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.711710930 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.711723089 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.711730003 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.711731911 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.711740017 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.711767912 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.711782932 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.713011026 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.713057041 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.713123083 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.713162899 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.715735912 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.715786934 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.716911077 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.716957092 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.720421076 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.720432997 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.720453024 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.720459938 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.720468044 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.720468044 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.720484018 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.720489025 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.720493078 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.720499992 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.720501900 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.720510960 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.720518112 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.720525026 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.720529079 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.720532894 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.720541000 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.720549107 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.720551968 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.720560074 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.720563889 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.720566034 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.720578909 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.720587015 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.720594883 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.720602036 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.720606089 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.720606089 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.720609903 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.720618963 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.720626116 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.720633030 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.720633030 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.720633984 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.720642090 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.720662117 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.720674038 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.720676899 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.720684052 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.720694065 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.720701933 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.720705032 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.720709085 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.720716000 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.720721006 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.720722914 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.720731020 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.720737934 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.720745087 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.720752954 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.720756054 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.720760107 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.720771074 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.720772982 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.720778942 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.720786095 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.720793962 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.720798969 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.720798969 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.720802069 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.720809937 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.720814943 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.720818996 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.720822096 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.720828056 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.720834970 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.720838070 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.720843077 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.720848083 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.720851898 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.720863104 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.720885992 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.720897913 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.721780062 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.721832037 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.721905947 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.721915007 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.721950054 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.724596024 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.724648952 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.725591898 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.725626945 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.729480982 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.729490995 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.729527950 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.729547024 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.729556084 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.729563951 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.729572058 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.729578018 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.729597092 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.729630947 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.729662895 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.729708910 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.729765892 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.729774952 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.729778051 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.729788065 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.729794979 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.729801893 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.729804993 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.729818106 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.729836941 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.729840994 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.729850054 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.729856968 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.729856968 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.729866028 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.729872942 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.729886055 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.729914904 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.729985952 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.729994059 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.730026007 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.730079889 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.730087996 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.730093956 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.730102062 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.730108976 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.730115891 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.730123043 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.730129957 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.730132103 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.730156898 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.730170965 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.730171919 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.730180979 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.730190039 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.730196953 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.730201006 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.730207920 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.730210066 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.730216026 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.730223894 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.730227947 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.730254889 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.730254889 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.730297089 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.730304956 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.730340958 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.730392933 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.730401993 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.730407953 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.730412006 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.730418921 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.730426073 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.730428934 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.730436087 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.730446100 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.730447054 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.730447054 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.730458975 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.730484009 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.730484009 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.730496883 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.730611086 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.730622053 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.730628967 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.730635881 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.730659008 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.730670929 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.730761051 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.730770111 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.730808020 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.733412027 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.733458042 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.734406948 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.734446049 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.738205910 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.738221884 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.738249063 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.738261938 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.738313913 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.738322973 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.738331079 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.738339901 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.738358974 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.738379002 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.738437891 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.738446951 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.738455057 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.738481045 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.738509893 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.741863966 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.742024899 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.742089987 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.743072987 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.743120909 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.743201971 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.743211985 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.743218899 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.743256092 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.743261099 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.743273020 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.743285894 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.743309975 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.743326902 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.743335962 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.743336916 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.743361950 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.743375063 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.746903896 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.746937990 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.746949911 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.746982098 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.746995926 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.747016907 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.747044086 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.747049093 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.747056007 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.747062922 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.747076988 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.747085094 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.747090101 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.747097969 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.747119904 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.747123957 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.747132063 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.747133970 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.747148991 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.747157097 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.747163057 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.747186899 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.747189045 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.747198105 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.747209072 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.747227907 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.747231960 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.747236967 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.747261047 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.747262001 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.747270107 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.747271061 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.747292995 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.747293949 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.747299910 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.747303963 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.747344971 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.747344971 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.747364998 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.747387886 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.747410059 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.787465096 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.787621975 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.787682056 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.787694931 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.835479021 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.835658073 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.835747957 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.835767984 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.841483116 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.841500998 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.841507912 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.841511011 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.841519117 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.841528893 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.841532946 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.841543913 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.841552019 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.841557980 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.841562033 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.841564894 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.841583967 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.841594934 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.841603994 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.841604948 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.841610909 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.841625929 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.841633081 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.841639996 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.841648102 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.841648102 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.841651917 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.841660976 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.841669083 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.841674089 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.841682911 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.841691971 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.841695070 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.841700077 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.841711044 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.841711044 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.841726065 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.841733932 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.841742992 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.841747999 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.841752052 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.841763020 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.841769934 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.841778040 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.841784000 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.841792107 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.841794014 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.841799021 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.841806889 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.841809034 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.841814041 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.841830969 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.841833115 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.841840029 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.841847897 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.841847897 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.841856003 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.841862917 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.841871977 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.841876984 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.841886997 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.841897964 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.841906071 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.841909885 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.841916084 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.841929913 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.841936111 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.841938019 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.841958046 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.841960907 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.841968060 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.841975927 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.841979980 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.841990948 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.841995001 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.842000008 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.842012882 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.842015028 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.842022896 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.842025042 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.842037916 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.842047930 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.842060089 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.842060089 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.842075109 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.842081070 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.842082024 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.842089891 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.842091084 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.842104912 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.842116117 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.842118025 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.842125893 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.842128992 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.842145920 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.842154026 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.842155933 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.842170954 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.842190027 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.842197895 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.842206955 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.842210054 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.842353106 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.847018003 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.847031116 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.847039938 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.847062111 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.847075939 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.847076893 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.847093105 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.847098112 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.847114086 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.847114086 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.847129107 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.847153902 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.847161055 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.847162008 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.847178936 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.847199917 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.847199917 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.847213030 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.847238064 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.847251892 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.847260952 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.847261906 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.847270012 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.847279072 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.847292900 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.847306967 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.847325087 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.847357988 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.847367048 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.847374916 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.847383022 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.847398996 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.847415924 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.847419024 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.847429037 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.847457886 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.847465992 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.847476006 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.847511053 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.847565889 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.847592115 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.847599983 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.847608089 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.847620010 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.847625017 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.847635984 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.847635984 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.847652912 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.847660065 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.847662926 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.847676992 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.847682953 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.847683907 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.847697973 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.847704887 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.847712040 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.847718000 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.847728014 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.847731113 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.847747087 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.847749949 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.847760916 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.847778082 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.847784042 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.847793102 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.847820044 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.847824097 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.847836018 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.847857952 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.847866058 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.847867012 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.847881079 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.847907066 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.847954988 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.847965002 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.847971916 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.847982883 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.848004103 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.848015070 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.848016024 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.848028898 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.848032951 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.848042011 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.848050117 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.848053932 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.848067045 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.848067999 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.848073006 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.848078966 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.848102093 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.848108053 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.848117113 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.848119974 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.848140001 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.848146915 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.848148108 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.848171949 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.848185062 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.848189116 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.848193884 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.848208904 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.848226070 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.848227978 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.848237991 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.848251104 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.848265886 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.848274946 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.848305941 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.848305941 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.848315001 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.848341942 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.848361015 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.848370075 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.848403931 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.848442078 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.848452091 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.848460913 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.848476887 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.848480940 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.848491907 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.848499060 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.848500013 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.848515034 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.848536015 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.851963997 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.852010965 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.852025986 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.852067947 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.852068901 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.852104902 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.852107048 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.852116108 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.852149963 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.852150917 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.852163076 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.852207899 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.852266073 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.852277040 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.852305889 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.852307081 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.852317095 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.852334976 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.852349997 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.852353096 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.852360964 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.852391958 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.852401018 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.852401018 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.852440119 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.852472067 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.852509022 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.852513075 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.852546930 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.852585077 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.852607965 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.852623940 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.852631092 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.852643013 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.852648973 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.852662086 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.852664948 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.852673054 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.852684975 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.852705956 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.852710962 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.852716923 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.852750063 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.852751970 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.852760077 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.852787971 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.852806091 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.852897882 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.852907896 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.852920055 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.852940083 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.852943897 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.852962971 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.852966070 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.852972984 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.852991104 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.853004932 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.853013992 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.853025913 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.853055954 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.853085041 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.853096008 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.853096008 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.853113890 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.853135109 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.853156090 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.853168964 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.853180885 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.853207111 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.853209019 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.853219032 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.853220940 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.853250027 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.853251934 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.853264093 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.853288889 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.853291035 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.853298903 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.853317976 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.853339911 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.853372097 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.853382111 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.853399038 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.853408098 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.853408098 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.853426933 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.853437901 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.853455067 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.853468895 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.853472948 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.853511095 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.853518963 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.853528976 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.853555918 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.853569984 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.853575945 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.853595018 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.853600979 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.853617907 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.853630066 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.853631020 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.853662968 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.893752098 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.893946886 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.894032955 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.894061089 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.898864031 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.898916960 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.898924112 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.898926020 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.898933887 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.898956060 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.898967028 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.898976088 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.898983002 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.899004936 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.899005890 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.899014950 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.899044037 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.899046898 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.899056911 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.899079084 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.899077892 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.899094105 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.899102926 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.899102926 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.899118900 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.899131060 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.899143934 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.899171114 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.899171114 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.899195910 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.899209976 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.899210930 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.899226904 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.899234056 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.899243116 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.899250984 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.899252892 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.899269104 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.899285078 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.899338961 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.899348021 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.899374008 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.899382114 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.899383068 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.899403095 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.899405003 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.899413109 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.899422884 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.899450064 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.899481058 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.899490118 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.899513960 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.899525881 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.899528980 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.899548054 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.899561882 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.899561882 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.899569988 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.899585009 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.899597883 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.899612904 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.899621010 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.899629116 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.899661064 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.899705887 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.899715900 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.899723053 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.899729967 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.899748087 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.899774075 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.943511009 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.943702936 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.943803072 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.943844080 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.966713905 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.966865063 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.966944933 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.966974974 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.971769094 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.971792936 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.971801996 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.971808910 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.971817017 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.971834898 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.971837044 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.971846104 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.971865892 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.971869946 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.971877098 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.971878052 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.971888065 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.971904039 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.971920013 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.971935034 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.971946955 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.971976995 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.971986055 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.971988916 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.971999884 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.972023010 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.972029924 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.972043037 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.972047091 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.972069979 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.972084999 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.972086906 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.972094059 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.972112894 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.972125053 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.972148895 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.972167969 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.972177029 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.972183943 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.972191095 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.972218037 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.972232103 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.972297907 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.972306967 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.972316027 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.972332954 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.972341061 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.972347021 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.972348928 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.972361088 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.972368002 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.972377062 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.972390890 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.972392082 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.972403049 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.972419024 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.972423077 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.972430944 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.972433090 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.972441912 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.972454071 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.972455025 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.972466946 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.972480059 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.972491026 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.972498894 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.972506046 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.972513914 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.972515106 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.972531080 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.972537994 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.972542048 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.972553968 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.972560883 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.972562075 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:18:59.972579956 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:18:59.972593069 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.015467882 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.015672922 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.015757084 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.015789986 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.029225111 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.029376984 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.029452085 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.029481888 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.034307957 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.034320116 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.034328938 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.034337044 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.034365892 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.034382105 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.034404993 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.034414053 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.034418106 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.034420967 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.034439087 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.034456015 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.034461021 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.034471035 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.034471989 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.034487963 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.034490108 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.034507036 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.034513950 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.034523964 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.034533978 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.034549952 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.034563065 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.034573078 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.034578085 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.034586906 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.034590006 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.034606934 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.034615040 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.034622908 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.034624100 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.034631968 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.034657001 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.034662008 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.034667015 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.034692049 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.034701109 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.034701109 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.034729004 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.034730911 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.034740925 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.034761906 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.034765959 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.034770012 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.034775019 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.034800053 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.034807920 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.034812927 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.034852982 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.034874916 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.034883976 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.034913063 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.034920931 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.034921885 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.034956932 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.034960032 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.034984112 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.035005093 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.035012960 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.035020113 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.035034895 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.035037041 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.035043955 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.035051107 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.035083055 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.035089970 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.035092115 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.035113096 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.035120964 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.035129070 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.035157919 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.035175085 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.035183907 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.035191059 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.035212994 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.035221100 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.035222054 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.035233974 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.035254955 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.035264015 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.035267115 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.035284042 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.035300016 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.035300970 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.035326004 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.035345078 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.035357952 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.035367012 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.035406113 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.035410881 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.035422087 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.035458088 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.035461903 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.035492897 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.035502911 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.035517931 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.035535097 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.035542011 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.035553932 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.035559893 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.035593033 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.035649061 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.035664082 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.035675049 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.035693884 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.035693884 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.035705090 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.035710096 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.035720110 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.035726070 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.035742998 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.035751104 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.035788059 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.039406061 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.039455891 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.039531946 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.039555073 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.039567947 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.039576054 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.039597988 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.039607048 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.039644957 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.039690018 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.039705038 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.039736986 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.039753914 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.039786100 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.039833069 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.039875031 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.039917946 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.039964914 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.039980888 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.039989948 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.040021896 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.040044069 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.040074110 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.040121078 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.040203094 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.040251017 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.040292978 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.040309906 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.040363073 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.040411949 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.040424109 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.040446043 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.040452957 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.040467978 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.040471077 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.040497065 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.040510893 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.040545940 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.040555000 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.040570021 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.040577888 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.040596008 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.040605068 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.040621042 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.040647030 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.040651083 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.040673018 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.040707111 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.040723085 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.040730953 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.040777922 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.040842056 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.040851116 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.040854931 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.040896893 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.040910006 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.040911913 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.040934086 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.040942907 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.040951014 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.040956974 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.040965080 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.040982008 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.040986061 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.041011095 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.041011095 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.041028023 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.041054010 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.041079044 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.041088104 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.041093111 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.041152954 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.044296026 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.044317961 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.044344902 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.044370890 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.044392109 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.044421911 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.044451952 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.044476986 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.044507027 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.044550896 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.044559956 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.044569969 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.044605017 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.044692039 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.044744015 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.044809103 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.044852972 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.044884920 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.044895887 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.044910908 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.044934988 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.044939995 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.044954062 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.044980049 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.045054913 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.045101881 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.045252085 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.045269012 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.045296907 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.045397043 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.091478109 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.091609001 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.091661930 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.091698885 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.098767996 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.098927975 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.098988056 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.099021912 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.103921890 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.103967905 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.104034901 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.104078054 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.104096889 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.104135036 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.104219913 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.104228973 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.104268074 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.104370117 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.104410887 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.104475021 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.104521990 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.104584932 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.104624987 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.104693890 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.104731083 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.104734898 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.104770899 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.104785919 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.104806900 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.104826927 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.104842901 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.104897022 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.104904890 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.104932070 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.104942083 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.104979038 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.104979038 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.105024099 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.105040073 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.105050087 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.105076075 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.105083942 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.105098963 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.105123043 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.105145931 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.105159044 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.105168104 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.105195045 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.105201960 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.105211020 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.105216980 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.105252981 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.105294943 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.105309010 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.105317116 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.105335951 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.105345011 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.105350018 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.105361938 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.105392933 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.105392933 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.105402946 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.105416059 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.105432034 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.105444908 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.105458021 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.105462074 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.105470896 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.105499983 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.105510950 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.105532885 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.105570078 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.105575085 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.105622053 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.105634928 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.105643034 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.105647087 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.105663061 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.105670929 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.105679035 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.105695963 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.105721951 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.105730057 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.105732918 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.105777979 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.105798006 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.105807066 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.105844021 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.105912924 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.105921984 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.105925083 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.105931997 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.105968952 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.105988979 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.108822107 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.108875990 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.108930111 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.108943939 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.108979940 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.109064102 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.109111071 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.109199047 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.109239101 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.109244108 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.109282970 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.109318018 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.109368086 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.109486103 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.109493971 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.109538078 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.109599113 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.109643936 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.109680891 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.109689951 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.109724998 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.109730005 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.109771013 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.109842062 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.109849930 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.109886885 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.109895945 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.109932899 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.109961987 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.110001087 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.110054016 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.110099077 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.110112906 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.110148907 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.110158920 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.110193014 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.110203028 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.110245943 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.110275030 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.110316992 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.110362053 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.110369921 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.110409975 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.110414982 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.110456944 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.110518932 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.110563993 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.110614061 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.110663891 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.110773087 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.110817909 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.110891104 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.110899925 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.110907078 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.110934973 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.110949993 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.110970020 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.110980034 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.111008883 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.111016035 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.111027956 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.111059904 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.111097097 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.111143112 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.111252069 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.111264944 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.111273050 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.111280918 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.111287117 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.111301899 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.111318111 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.111324072 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.111332893 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.111336946 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.111350060 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.111373901 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.111390114 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.111404896 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.111413956 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.111448050 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.111450911 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.111455917 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.111498117 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.111540079 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.111552000 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.111588001 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.113698959 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.113739967 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.113779068 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.113822937 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.113868952 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.113914967 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.113974094 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.114020109 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.114020109 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.114072084 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.114154100 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.114197969 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.114197969 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.114242077 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.114247084 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.114272118 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.114286900 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.114319086 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.114357948 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.114402056 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.114430904 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.114475965 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.114505053 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.114551067 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.114569902 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.114578009 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.114623070 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.114736080 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.114744902 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.114785910 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.114872932 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.114881039 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.114921093 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.114959955 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.114976883 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.115004063 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.115005970 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.115015030 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.115030050 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.115057945 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.115068913 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.115130901 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.115175962 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.115192890 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.115226984 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.115240097 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.115252972 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.115272045 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.115293980 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.115322113 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.115364075 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.115466118 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.115511894 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.115581989 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.115664005 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.115701914 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.115746021 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.115758896 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.115803957 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.115844965 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.115853071 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.115864992 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.115873098 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.115890026 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.115910053 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.115978956 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.116017103 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.116024017 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.116067886 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.116096973 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.116118908 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.116142988 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.116158962 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.116183996 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.116229057 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.116377115 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.116416931 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.116434097 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.116470098 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.116475105 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.116509914 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.116522074 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.116524935 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.116561890 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.116600990 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.116610050 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.116647005 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.116653919 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.116656065 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.116689920 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.116693974 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.116698027 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.116744041 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.118522882 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.118571043 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.118616104 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.118659973 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.118693113 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.118736029 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.118824005 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.118850946 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.118870020 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.118892908 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.118948936 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.118999004 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.119043112 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.119086981 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.119091034 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.119096041 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.119139910 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.119190931 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.119235992 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.119349957 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.119394064 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.119416952 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.119436979 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.119462013 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.119468927 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.119472980 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.119497061 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.119517088 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.119540930 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.119580984 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.119590044 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.119633913 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.119719982 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.119764090 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.119817972 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.119846106 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.119862080 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.119890928 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.119890928 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.119934082 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.119940996 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.119950056 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.119982958 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.119993925 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.120024920 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.120035887 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.120074987 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.120079994 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.120114088 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.120142937 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.120151043 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.120191097 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.120264053 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.120311975 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.120471954 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.120520115 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.120558023 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.120600939 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.120654106 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.120697975 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.120769978 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.120778084 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.120799065 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.120805979 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.120822906 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.120843887 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.120861053 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.120907068 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.120912075 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.120939970 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.120948076 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.120959044 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.120989084 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.120990992 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.121041059 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.121136904 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.121189117 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.121205091 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.121248960 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.121279955 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.121323109 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.121402025 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.121439934 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.121447086 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.121484041 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.121505976 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.121526003 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.121546984 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.121565104 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.121582031 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.121630907 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.121665001 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.121680975 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.121695042 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.121701956 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.121709108 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.121726990 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.121733904 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.121740103 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.121752977 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.121761084 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.121781111 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.121799946 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.123455048 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.123503923 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.123511076 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.123519897 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.123560905 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.123651981 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.123701096 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.123740911 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.123788118 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.123855114 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.123895884 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.123898983 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.123934984 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.123949051 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.123975992 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.123992920 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.124015093 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.124047041 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.124095917 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.124212980 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.124260902 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.124294996 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.124341011 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.124353886 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.124397039 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.124419928 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.124464035 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.124511003 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.124519110 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.124536037 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.124558926 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.124584913 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.124619961 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.124628067 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.124672890 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.124696970 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.124705076 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.124738932 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.124741077 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.124779940 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.124788046 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.124835968 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.124870062 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.124877930 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.124914885 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.124916077 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.124963999 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.124964952 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.125000954 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.125004053 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.125035048 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.125046015 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.125081062 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.125263929 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.125314951 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.125405073 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.125451088 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.125485897 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.125494003 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.125533104 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.125628948 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.125669003 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.125675917 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.125677109 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.125719070 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.125776052 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.125819921 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.125844955 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.125853062 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.125883102 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.125894070 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.125930071 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.125931978 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.125942945 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.125972986 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.125978947 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.126015902 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.126223087 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.126266956 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.126403093 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.126447916 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.126487970 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.126517057 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.126529932 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.126560926 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.126619101 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.126626968 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.126657963 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.126668930 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.126709938 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.126756907 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.126765966 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.126769066 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.126801968 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.126811028 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.126847982 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.126859903 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.126868963 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.126899958 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.126908064 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.126914024 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.126950026 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.128412008 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.128462076 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.128480911 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.128489017 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.128524065 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.128563881 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.128611088 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.128643990 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.128684044 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.128721952 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.128740072 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.128768921 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.128873110 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.128922939 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.128932953 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.128978968 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.129003048 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.129018068 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.129053116 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.129067898 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.129137993 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.129188061 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.129251003 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.129297018 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.129412889 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.129453897 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.129458904 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.129462957 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.129511118 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.129534006 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.129576921 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.129631042 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.129664898 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.129678965 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.129714012 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.129793882 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.129832029 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.129839897 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.129877090 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.129878998 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.129894972 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.129904032 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.129926920 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.129940033 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.129949093 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.129993916 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.130000114 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.130003929 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.130044937 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.130074024 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.130081892 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.130119085 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.130122900 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.130135059 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.130168915 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.130184889 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.130217075 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.130264044 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.130294085 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.130340099 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.130347013 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.130393028 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.130532026 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.130541086 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.130580902 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.130614042 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.130667925 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.130671978 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.130717039 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.130723000 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.130732059 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.130764008 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.130774975 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.130809069 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.130824089 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.130861044 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.130870104 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.130887032 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.130897045 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.130907059 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.130938053 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.131110907 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.131160975 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.131417990 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.131431103 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.131438017 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.131470919 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.131491899 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.131576061 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.131584883 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.131591082 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.131612062 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.131627083 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.131644964 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.131654024 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.131731033 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.131777048 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.131809950 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.131850004 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.131858110 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.131890059 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.131895065 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.131917953 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.131936073 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.131947994 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.131957054 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.131966114 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.131985903 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.132008076 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.133218050 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.133265018 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.133330107 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.133352041 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.133358955 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.133374929 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.133393049 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.133420944 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.133469105 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.133553982 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.133605003 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.133608103 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.133645058 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.133647919 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.133692026 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.133698940 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.133747101 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.133843899 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.133886099 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.133889914 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.133894920 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.133939028 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.133939981 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.133985996 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.134171963 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.134222031 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.134249926 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.134295940 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.134305954 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.134356022 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.134452105 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.134501934 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.134582043 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.134593010 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.134632111 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.134722948 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.134732962 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.134774923 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.134804964 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.134836912 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.134845018 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.134850025 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.134886980 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.134912014 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.134957075 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.134990931 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.135020018 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.135042906 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.135071993 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.135071993 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.135123014 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.135132074 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.135158062 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.135164976 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.135186911 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.135204077 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.135229111 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.135236979 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.135251999 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.135286093 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.135431051 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.135473013 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.135489941 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.135541916 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.135545969 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.135610104 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.135612011 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.135659933 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.135663033 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.135672092 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.135698080 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.135708094 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.135746956 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.135787964 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.135803938 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.135812998 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.135850906 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.135852098 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.135859966 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.135880947 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.135906935 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.135926008 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.135967970 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.136023045 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.136271954 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.136317968 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.136344910 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.136385918 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.136390924 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.136429071 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.136430979 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.136473894 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.136476040 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.136485100 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.136514902 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.136528969 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.136557102 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.136565924 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.136611938 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.136709929 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.136756897 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.136773109 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.136781931 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.136817932 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.136900902 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.136918068 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.136951923 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.136954069 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.136982918 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.136996984 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.138025999 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.138081074 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.138205051 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.138241053 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.138252974 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.138286114 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.138293028 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.138323069 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.138338089 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.138366938 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.138415098 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.138423920 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.138463974 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.138540030 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.138586998 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.138608932 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.138617992 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.138659954 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.138721943 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.138767004 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.138772964 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.138777018 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.138813972 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.138817072 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.138858080 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.138994932 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.139045000 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.139107943 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.139153957 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.139157057 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.139204025 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.139353991 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.139365911 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.139401913 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.139415979 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.139441967 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.139461994 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.139492989 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.139583111 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.139592886 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.139633894 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.139640093 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.139662981 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.139687061 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.139697075 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.139702082 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.139707088 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.139753103 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.139799118 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.139846087 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.139863014 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.139870882 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.139914036 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.139950037 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.139995098 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.140033007 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.140058041 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.140079021 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.140096903 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.140105009 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.140149117 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.140153885 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.140186071 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.140201092 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.140233040 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.140256882 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.140266895 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.140311956 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.140419960 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.140429974 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.140450001 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.140458107 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.140477896 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.140510082 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.140515089 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.140543938 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.140563965 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.140590906 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.140609980 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.140649080 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.140655994 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.140691996 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.140693903 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.140739918 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.140798092 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.140844107 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.140846014 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.140866995 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.140891075 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.140913963 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.141055107 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.141102076 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.141113997 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.141160011 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.141207933 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.141251087 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.141256094 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.141259909 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.141299009 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.141336918 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.141357899 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.141385078 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.141397953 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.141407013 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.141407013 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.141450882 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.141540051 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.141583920 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.141608000 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.141649008 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.141655922 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.141696930 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.141807079 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.141815901 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.141834021 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.141858101 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.141877890 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.142868996 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.142920017 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.143120050 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.143130064 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.143174887 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.143218040 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.143228054 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.143269062 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.143275023 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.143285990 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.143332005 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.143346071 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.143390894 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.143454075 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.143462896 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.143491030 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.143507004 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.143544912 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.143610954 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.143657923 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.143685102 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.143699884 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.143709898 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.143728971 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.143744946 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.143809080 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.143853903 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.143971920 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.144017935 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.144047022 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.144098043 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.144172907 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.144218922 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.144232035 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.144264936 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.144273043 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.144279957 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.144320011 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.144434929 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.144481897 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.144493103 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.144539118 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.144562960 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.144572020 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.144623995 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.144637108 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.144671917 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.144681931 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.144684076 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.144726992 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.144767046 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.144777060 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.144802094 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.144819975 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.144839048 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.144855022 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.144870996 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.144882917 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.144922972 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.144957066 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.145005941 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.145030022 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.145076990 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.145081997 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.145097971 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.145106077 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.145137072 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.145154953 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.145294905 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.145339966 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.145343065 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.145375013 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.145385981 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.145400047 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.145409107 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.145430088 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.145440102 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.145447969 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.145487070 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.145499945 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.145510912 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.145541906 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.145550013 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.145550966 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.145596027 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.145658970 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.145697117 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.145710945 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.145725965 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.145745039 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.145772934 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.145864964 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.145908117 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.145911932 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.145953894 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.146063089 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.146097898 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.146106958 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.146147966 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.146161079 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.146197081 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.146205902 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.146205902 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.146236897 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.146246910 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.146282911 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.146307945 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.146348000 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.146353960 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.146393061 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.146444082 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.146471024 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.146492958 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.146507978 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.146584034 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.146620989 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.146631002 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.146670103 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.146826029 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.146873951 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.147757053 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.147805929 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.148058891 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.148083925 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.148108006 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.148121119 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.148156881 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.148206949 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.148246050 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.148288012 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.148297071 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.148324013 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.148345947 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.148372889 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.148385048 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.148394108 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.148423910 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.148442984 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.148471117 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.148504972 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.148550987 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.148580074 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.148629904 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.148649931 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.148658037 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.148683071 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.148689985 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.148699045 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.148737907 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.148762941 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.148808956 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.148849010 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.148900032 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.148915052 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.148961067 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.148989916 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.149036884 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.149121046 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.149168015 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.149175882 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.149185896 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.149228096 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.149291992 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.149342060 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.149347067 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.149399042 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.149456978 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.149502993 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.149503946 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.149549961 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.149586916 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.149595976 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.149637938 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.149683952 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.149729967 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.149761915 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.149805069 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.149810076 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.149851084 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.149852037 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.149902105 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.149913073 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.149956942 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.149995089 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.150013924 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.150043011 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.150054932 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.150063038 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.150082111 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.150110960 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.150113106 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.150135040 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.150163889 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.150165081 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.150211096 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.150237083 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.150245905 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.150290012 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.150311947 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.150355101 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.150432110 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.150440931 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.150456905 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.150480032 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.150496960 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.150528908 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.150574923 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.150588989 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.150598049 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.150639057 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.150643110 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.150682926 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.150685072 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.150732040 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.150748014 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.150758028 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.150788069 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.150799036 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.150831938 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.150902987 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.150943041 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.150949955 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.150988102 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.151021004 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.151058912 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.151067019 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.151108980 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.151109934 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.151154995 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.151199102 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.151207924 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.151226997 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.151247978 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.151268005 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.151324034 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.151340008 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.151375055 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.151388884 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.151388884 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.151432991 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.151432991 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.151484966 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.151518106 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.151552916 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.151563883 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.151595116 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.151598930 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.151640892 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.151858091 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.151904106 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.152802944 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.152856112 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.152903080 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.152949095 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.152992010 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.153039932 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.153055906 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.153106928 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.153243065 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.153251886 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.153295040 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.153321028 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.153362989 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.153364897 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.153393984 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.153409958 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.153419971 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.153440952 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.153462887 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.153549910 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.153559923 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.153603077 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.153661013 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.153707027 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.153744936 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.153757095 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.153770924 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.153785944 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.153794050 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.153796911 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.153820038 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.153846979 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.153852940 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.153875113 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.153903008 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.153937101 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.154012918 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.154042006 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.154062033 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.154072046 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.154079914 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.154118061 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.154134035 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.154153109 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.154180050 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.154196024 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.154272079 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.154316902 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.154462099 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.154470921 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.154505014 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.154510975 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.154541016 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.154553890 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.154597998 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.154634953 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.154644966 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.154652119 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.154694080 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.154738903 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.154776096 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.154786110 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.154817104 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.154911041 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.154954910 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.154964924 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.155014038 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.155060053 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.155106068 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.155196905 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.155206919 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.155215025 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.155246973 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.155267000 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.155284882 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.155330896 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.155353069 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.155361891 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.155390024 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.155402899 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.155447960 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.155484915 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.155494928 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.155518055 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.155536890 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.155560970 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.155565023 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.155606031 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.155673981 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.155720949 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.155724049 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.155741930 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.155751944 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.155778885 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.155798912 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.155800104 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.155838966 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.155846119 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.155848026 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.155890942 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.155909061 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.155919075 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.155947924 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.155961037 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.155999899 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.156060934 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.156106949 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.156111956 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.156157970 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.156181097 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.156208992 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.156232119 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.156260967 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.156263113 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.156303883 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.156311035 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.156349897 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.156352997 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.156398058 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.156404018 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.156450987 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.156451941 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.156472921 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.156481981 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.156497002 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.156532049 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.156550884 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.156596899 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.156814098 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.156862020 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.157759905 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.157779932 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.157807112 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.157819986 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.157856941 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.157902956 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.157953978 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.157999992 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.158037901 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.158077955 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.158085108 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.158127069 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.158162117 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.158200026 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.158210039 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.158243895 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.158277988 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.158325911 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.158338070 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.158382893 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.158469915 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.158510923 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.158515930 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.158548117 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.158559084 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.158585072 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.158593893 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.158631086 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.158735037 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.158757925 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.158786058 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.158799887 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.158817053 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.158864021 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.158910990 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.158957005 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.159006119 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.159015894 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.159054041 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.159066916 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.159111977 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.159193993 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.159238100 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.159305096 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.159331083 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.159359932 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.159375906 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.159404039 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.159411907 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.159460068 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.159467936 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.159473896 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.159507990 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.159516096 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.159554005 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.159564018 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.159593105 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.159610033 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.159636974 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.159676075 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.159684896 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.159688950 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.159702063 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.159740925 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.159791946 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.159813881 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.159821987 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.159837961 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.159859896 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.159897089 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.159905910 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.159957886 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.160039902 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.160058975 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.160082102 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.160099030 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.160171032 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.160218954 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.160274982 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.160314083 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.160322905 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.160358906 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.160403967 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.160444975 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.160450935 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.160486937 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.160490036 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.160538912 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.160582066 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.160590887 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.160629988 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.160686970 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.160725117 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.160732985 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.160772085 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.160797119 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.160837889 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.160845041 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.160881042 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.160883904 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.160898924 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.160924911 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.160943031 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.160953045 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.160974979 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.161005020 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.161017895 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.161024094 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.161071062 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.161094904 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.161142111 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.161156893 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.161175966 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.161202908 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.161216974 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.161235094 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.161278009 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.161282063 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.161320925 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.161322117 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.161370039 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.161390066 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.161403894 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.161416054 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.161433935 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.161436081 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.161453962 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.161467075 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.161473036 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.161501884 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.161514044 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.161525965 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.161535025 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.161545038 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.161572933 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.161638021 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.161645889 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.161691904 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.162625074 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.162666082 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.162673950 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.162674904 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.162725925 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.162748098 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.162796974 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.162895918 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.162904024 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.162945986 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.163007975 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.163048983 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.163054943 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.163098097 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.163197041 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.163206100 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.163213968 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.163247108 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.163264990 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.163311005 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.163343906 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.163361073 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.163389921 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.163479090 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.163487911 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.163535118 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.163569927 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.163616896 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.163633108 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.163650990 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.163685083 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.163701057 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.163778067 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.163803101 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.163822889 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.163841963 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.163904905 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.163913965 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.163955927 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.164005995 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.164057016 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.164149046 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.164186001 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.164199114 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.164230108 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.164231062 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.164277077 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.164285898 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.164294958 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.164335966 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.164371967 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.164381027 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.164426088 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.164518118 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.164570093 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.164582968 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.164618015 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.164627075 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.164632082 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.164660931 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.164665937 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.164700985 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.164715052 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.164716959 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.164736032 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.164748907 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.164767981 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.164777040 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.164819956 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.164819956 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.164832115 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.164861917 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.164870024 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.164891958 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.164910078 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.164942980 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.164974928 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.165019035 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.165107965 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.165153980 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.165153980 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.165196896 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.165287971 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.165338039 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.165350914 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.165373087 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.165401936 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.165417910 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.165446997 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.165463924 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.165473938 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.165493965 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.165509939 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.165533066 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.165580034 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.165680885 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.165697098 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.165728092 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.165743113 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.165766001 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.165787935 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.165796041 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.165816069 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.165826082 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.165832996 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.165836096 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.165879965 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.165954113 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.166001081 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.166018009 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.166043997 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.166064978 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.166078091 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.166105986 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.166115046 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.166167021 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.166192055 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.166222095 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.166239977 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.166266918 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.166261911 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.166312933 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.166352034 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.166368961 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.166378975 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.166398048 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.166412115 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.166420937 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.166461945 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.166461945 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.166472912 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.166507006 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.166548967 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.166590929 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.166618109 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.166625977 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.166668892 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.167535067 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.167543888 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.167576075 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.167598009 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.167619944 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.167653084 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.167701960 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.167721033 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.167768002 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.167773962 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.167819977 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.167974949 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.167984009 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.168025017 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.168085098 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.168100119 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.168128967 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.168129921 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.168148041 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.168175936 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.168198109 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.168206930 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.168251038 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.168344975 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.168354988 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.168397903 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.168477058 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.168486118 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.168495893 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.168525934 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.168540955 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.168575048 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.168582916 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.168626070 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.168730974 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.168775082 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.168797016 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.168839931 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.168843985 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.168885946 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.168952942 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.168991089 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.168998003 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.169037104 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.169111967 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.169162035 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.169163942 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.169209957 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.169213057 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.169230938 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.169241905 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.169260025 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.169286966 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.169313908 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.169361115 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.169401884 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.169447899 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.169512033 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.169534922 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.169557095 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.169575930 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.169620037 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.169653893 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.169665098 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.169708014 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.169711113 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.169754028 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.169763088 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.169775963 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.169784069 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.169792891 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.169800997 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.169825077 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.169836044 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.169866085 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.169873953 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.169883013 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.169903994 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.169915915 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.169954062 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.170037985 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.170047998 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.170088053 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.170124054 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.170164108 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.170222044 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.170268059 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.170305967 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.170315027 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.170351982 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.170356035 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.170391083 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.170397997 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.170433998 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.170448065 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.170484066 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.170597076 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.170605898 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.170646906 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.170684099 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.170694113 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.170710087 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.170725107 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.170737982 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.170752048 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.170762062 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.170775890 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.170792103 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.170814991 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.170833111 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.170855999 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.170886993 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.170905113 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.170929909 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.170988083 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.171003103 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.171010971 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.171041012 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.171061993 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.171088934 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.171097994 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.171139002 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.171185017 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.171195030 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.171202898 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.171247959 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.171252012 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.171257019 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.171299934 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.171338081 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.171361923 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.171392918 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.171407938 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.171422005 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.171469927 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.171581030 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.171624899 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.171633005 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.171679020 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.172388077 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.172398090 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.172441006 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.172449112 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.172485113 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.172494888 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.172529936 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.172693968 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.172703028 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.172746897 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.172782898 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.172812939 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.172832012 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.172857046 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.172930002 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.172946930 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.172977924 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.172991037 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.172991037 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.173031092 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.173032999 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.173057079 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.173080921 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.173099041 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.173157930 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.173204899 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.173213005 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.173264980 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.173348904 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.173372030 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.173398972 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.173403978 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.173413038 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.173413992 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.173449039 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.173455000 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.173494101 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.173512936 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.173564911 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.173590899 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.173613071 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.173639059 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.173650980 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.173652887 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.173707962 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.173866034 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.173912048 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.173957109 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.173989058 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.174004078 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.174031973 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.174037933 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.174088955 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.174129009 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.174144030 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.174177885 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.174185038 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.174228907 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.174232960 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.174238920 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.174283028 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.174371004 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.174381018 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.174421072 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.174505949 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.174551964 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.174591064 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.174638033 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.174678087 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.174722910 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.174731970 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.174761057 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.174782038 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.174803972 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.174858093 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.174874067 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.174881935 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.174911022 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.174926996 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.174952030 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.174962044 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.175005913 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.175005913 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.175017118 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.175036907 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.175069094 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.175081968 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.175116062 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.175162077 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.175169945 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.175215006 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.175245047 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.175285101 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.175291061 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.175332069 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.175343990 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.175390959 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.175407887 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.175417900 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.175455093 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.175601959 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.175649881 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.175702095 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.175712109 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.175720930 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.175753117 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.175766945 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.175785065 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.175821066 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.175833941 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.175863028 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.175863981 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.175908089 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.175954103 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.175983906 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.175998926 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.176033974 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.176068068 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.176115990 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.176192999 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.176208019 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.176237106 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.176246881 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.176281929 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.176322937 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.176354885 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.176362991 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.176373005 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.176400900 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.176408052 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.176439047 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.176460981 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.176484108 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.176520109 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.176528931 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.176568985 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.176631927 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.176676035 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.176676989 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.176685095 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.176704884 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.176726103 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.176753044 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.176754951 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.176800966 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.177206993 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.177263021 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.177330971 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.177340031 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.177385092 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.177433014 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.177479029 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.177570105 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.177614927 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.177687883 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.177700043 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.177716970 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.177736044 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.177736044 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.177767038 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.177773952 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.177803040 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.177813053 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.177859068 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.177894115 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.177906036 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.177937984 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.177942038 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.177973986 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.177989006 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.178006887 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.178020000 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.178060055 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.178121090 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.178168058 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.178220987 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.178267956 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.178272963 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.178297997 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.178313971 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.178342104 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.178411961 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.178461075 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.178474903 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.178520918 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.178538084 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.178548098 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.178555012 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.178586006 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.178591967 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.178639889 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.178786039 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.178831100 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.178875923 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.178924084 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.178960085 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.178993940 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.179007053 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.179044962 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.179049015 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.179095030 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.179100037 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.179130077 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.179138899 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.179147005 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.179188013 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.179195881 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.179234982 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.179248095 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.179280996 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.179289103 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.179297924 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.179342031 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.179450989 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.179497957 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.179533958 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.179574013 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.179580927 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.179620028 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.179667950 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.179712057 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.179764032 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.179819107 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.223436117 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.223608971 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.223675966 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.223720074 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.223799944 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.223845959 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.271492004 CET	15666	49704	66.63.187.173	192.168.2.5
Jan 5, 2025 20:19:00.271692991 CET	49704	15666	192.168.2.5	66.63.187.173
Jan 5, 2025 20:19:00.271759987 CET	49704	15666	192.168.2.5	66.63.187.173

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 5, 2025 20:18:54.480884075 CET	192.168.2.5	1.1.1.1	0x370e	Standard query (0)	api.ipify.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Jan 5, 2025 20:18:54.487793922 CET	1.1.1.1	192.168.2.5	0x370e	No error (0)	api.ipify.org	172.67.74.152	A (IP address)	IN (0x0001)	false
Jan 5, 2025 20:18:54.487793922 CET	1.1.1.1	192.168.2.5	0x370e	No error (0)	api.ipify.org	104.26.13.205	A (IP address)	IN (0x0001)	false
Jan 5, 2025 20:18:54.487793922 CET	1.1.1.1	192.168.2.5	0x370e	No error (0)	api.ipify.org	104.26.12.205	A (IP address)	IN (0x0001)	false

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49705	172.67.74.152	443	1472	C:\Users\user\Desktop\drop1.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-05 19:18:55 UTC	100	OUT	GET / HTTP/1.1 Accept: text/html; text/plain; / Host: api.ipify.org Cache-Control: no-cache
2025-01-05 19:18:55 UTC	424	IN	HTTP/1.1 200 OK Date: Sun, 05 Jan 2025 19:18:55 GMT Content-Type: text/plain Content-Length: 12 Connection: close Vary: Origin CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8fd5d122396a42f2-EWR server-timing: cfL4;desc="?proto=TCP&rtt=1712&min_rtt=1704&rtt_var=655&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2819&recv_bytes=738&delivery_rate=1649717&cwnd=222&unsent_bytes=0&cid=953dd1a640d1a207&ts=179&x=0"
2025-01-05 19:18:55 UTC	12	IN	Data Raw: 38 2e 34 36 2e 31 32 33 2e 31 38 39 Data Ascii: 8.46.123.189

Target ID:	0
Start time:	14:18:52
Start date:	05/01/2025
Path:	C:\Users\user\Desktop\drop1.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\drop1.exe"
Imagebase:	0x150000
File size:	1'293'312 bytes
MD5 hash:	C401A019B5A9E44646577F8922E1014E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	14:18:52
Start date:	05/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	14:18:53
Start date:	05/01/2025
Path:	C:\Users\user\Desktop\drop1.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\drop1.exe"
Imagebase:	0x150000
File size:	1'293'312 bytes
MD5 hash:	C401A019B5A9E44646577F8922E1014E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_MeduzaStealer, Description: Yara detected Meduza Stealer, Source: 00000003.00000002.2243329095.0000000000CF8000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_MeduzaStealer, Description: Yara detected Meduza Stealer, Source: 00000003.00000002.2242983706.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: infostealer_win_meduzastealer, Description: Finds MeduzaStealer samples based on specific strings, Source: 00000003.00000002.2242983706.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Sekoia.io
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	7.9%
Dynamic/Decrypted Code Coverage:	0.6%
Signature Coverage:	1.9%
Total number of Nodes:	1336
Total number of Limit Nodes:	11

Executed Functions

Function 0016A1A9 Relevance: 42.3, APIs: 10, Strings: 14, Instructions: 295
threadinjectionmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessW.KERNELBASE(?,00000000,00000000,00000000,00000000,00000004,00000000,00000000,0016A11B,0016A10B), ref: 0016A33F
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 0016A352
Wow64GetThreadContext.KERNEL32(000000FC,00000000), ref: 0016A370
ReadProcessMemory.KERNELBASE(00000100,?,0016A15F,00000004,00000000), ref: 0016A394
VirtualAllocEx.KERNELBASE(00000100,?,?,00003000,00000040), ref: 0016A3BF
WriteProcessMemory.KERNELBASE(00000100,00000000,?,?,00000000,?), ref: 0016A417
WriteProcessMemory.KERNELBASE(00000100,00400000,?,?,00000000,?,00000028), ref: 0016A462
WriteProcessMemory.KERNELBASE(00000100,?,?,00000004,00000000), ref: 0016A4A0
Wow64SetThreadContext.KERNEL32(000000FC,013D0000), ref: 0016A4DC
ResumeThread.KERNELBASE(000000FC), ref: 0016A4EB

Strings

GetThreadContext, xrefs: 0016A281
aryA, xrefs: 0016A1ED
ress, xrefs: 0016A231
TerminateProcess, xrefs: 0016A3CE
Load, xrefs: 0016A1E5
CreateProcessW, xrefs: 0016A25B
WriteProcessMemory, xrefs: 0016A2BA
ReadProcessMemory, xrefs: 0016A294
SetThreadContext, xrefs: 0016A2CD
VirtualAllocEx, xrefs: 0016A2A7
ResumeThread, xrefs: 0016A2E3
GetP, xrefs: 0016A229
VirtualAlloc, xrefs: 0016A26E
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe, xrefs: 0016A33E

Memory Dump Source

Source File: 00000000.00000002.2011685207.000000000016A000.00000040.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000000.00000002.2011642770.0000000000150000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011655984.0000000000151000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011671915.0000000000162000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011715778.000000000016B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011746244.000000000016D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011805247.0000000000170000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150000_drop1.jbxd

Similarity

API ID: Process$Memory$ThreadWrite$AllocContextVirtualWow64$CreateReadResume
String ID: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe$CreateProcessW$GetP$GetThreadContext$Load$ReadProcessMemory$ResumeThread$SetThreadContext$TerminateProcess$VirtualAlloc$VirtualAllocEx$WriteProcessMemory$aryA$ress
API String ID: 2687962208-3857624555
Opcode ID: 4d4c1a7e65f8d0d38951af6025ef960edc15c7aa7ffa2998c2434409f37e51df
Instruction ID: 5b63dbf06dbd9185936153c867414a58519ee099e1af87d2d57e8b9fb563929a
Opcode Fuzzy Hash: 4d4c1a7e65f8d0d38951af6025ef960edc15c7aa7ffa2998c2434409f37e51df
Instruction Fuzzy Hash: FFB1F97664064AAFDB60CF68CC80BDA73A5FF88714F158124EA0CAB341D774FA51CB94

Function 0015D525 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 197
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__alloca_probe_16.LIBCMT ref: 0015D5AA
__alloca_probe_16.LIBCMT ref: 0015D673
__freea.LIBCMT ref: 0015D6DA

Part of subcall function 0015B3B5: RtlAllocateHeap.NTDLL(00000000,?,00000000,?,00153C34,?,?,00152442,00001000,?,001523AA), ref: 0015B3E7

__freea.LIBCMT ref: 0015D6ED
__freea.LIBCMT ref: 0015D6FA

Strings

o]\^, xrefs: 0015D52C

Memory Dump Source

Source File: 00000000.00000002.2011655984.0000000000151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000000.00000002.2011642770.0000000000150000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011671915.0000000000162000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011685207.000000000016A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011715778.000000000016B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011746244.000000000016D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011805247.0000000000170000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150000_drop1.jbxd

Similarity

API ID: __freea$__alloca_probe_16$AllocateHeap
String ID: o]\^
API String ID: 1423051803-3166235393
Opcode ID: 16e5a71ddf46e9a842967b07dab544345ceda89b9cfb0306044750497682d3f9
Instruction ID: 7af75b38530b62b3acfcce6219ac3fc428279bf55bdd3c92306fe759e24bd10b
Opcode Fuzzy Hash: 16e5a71ddf46e9a842967b07dab544345ceda89b9cfb0306044750497682d3f9
Instruction Fuzzy Hash: 1051BF72600246EFEB359F64EC81DAB3AA9EB54716B1A0029FC38DE141EB71CC19C761

Function 001594CE Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(00000000,?,00000000,00000800,00000000,?,?,5E5C5D6F,?,001595DD,?,?,00000000), ref: 0015958F

Strings

api-ms-, xrefs: 00159525
ext-ms-, xrefs: 00159539

Memory Dump Source

Source File: 00000000.00000002.2011655984.0000000000151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000000.00000002.2011642770.0000000000150000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011671915.0000000000162000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011685207.000000000016A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011715778.000000000016B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011746244.000000000016D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011805247.0000000000170000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150000_drop1.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: 7affb6c59a394bdbbf6f5f3616ab0a2aa38e90e5278069716d4f614a12a0c980
Instruction ID: acd7f4008ea39d60b9136434c343c7033cda25d9e0e72691c37dd796aa33edfe
Opcode Fuzzy Hash: 7affb6c59a394bdbbf6f5f3616ab0a2aa38e90e5278069716d4f614a12a0c980
Instruction Fuzzy Hash: DF213D71A11211E7CB228724EC40A5A37689B557A2F150112FD26EF2D0FB70EE59C6D1

Function 00151930 Relevance: 9.2, APIs: 6, Instructions: 196
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE ref: 001519D0
GetFileSize.KERNEL32 ref: 00151A01
CloseHandle.KERNEL32 ref: 00151A1E

Memory Dump Source

Source File: 00000000.00000002.2011655984.0000000000151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000000.00000002.2011642770.0000000000150000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011671915.0000000000162000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011685207.000000000016A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011715778.000000000016B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011746244.000000000016D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011805247.0000000000170000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150000_drop1.jbxd

Similarity

API ID: File$CloseCreateHandleSize
String ID:
API String ID: 1378416451-0
Opcode ID: f7e7d1c7febc28ae0117fa80e1e9ec53522b4cfb9b5be72e2d9f7f13c097d2e4
Instruction ID: 22b242a1e22839720b0eaf758c1ac9a999af9b4dfa29b11b4b7790ffa4b11c61
Opcode Fuzzy Hash: f7e7d1c7febc28ae0117fa80e1e9ec53522b4cfb9b5be72e2d9f7f13c097d2e4
Instruction Fuzzy Hash: 0281F1B4D09248EFCB05DFA8D584BAEBBF0BF09305F104929E865AB381D7749948CF56

Function 001517E0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 77
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeConsole.KERNELBASE ref: 00151849
VirtualProtect.KERNELBASE ref: 001518F7

Strings

o]\^, xrefs: 001517EC
@, xrefs: 001518EB

Memory Dump Source

Source File: 00000000.00000002.2011655984.0000000000151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000000.00000002.2011642770.0000000000150000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011671915.0000000000162000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011685207.000000000016A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011715778.000000000016B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011746244.000000000016D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011805247.0000000000170000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150000_drop1.jbxd

Similarity

API ID: ConsoleFreeProtectVirtual
String ID: @$o]\^
API String ID: 621788221-388437526
Opcode ID: bfeffa24c65ec418c67f9feb1749f4b4ea723f9be89ae00844834e58ffd366df
Instruction ID: def4d87e15a59e94998dea7a5079ce6971965a1656b6356f3f6db67979aab156
Opcode Fuzzy Hash: bfeffa24c65ec418c67f9feb1749f4b4ea723f9be89ae00844834e58ffd366df
Instruction Fuzzy Hash: D031A2B0904208EFDB04DFA9D98979EBBF0BF48319F518429E858AB350D7749988CF95

Function 0015A0BA Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 177
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0015A2BF: GetOEMCP.KERNEL32(00000000,?,?,00000000,?), ref: 0015A2EA

IsValidCodePage.KERNEL32(-00000030,00000000,?,?,?,?,?,?,?,?,0015A4CA,?,00000000,?,00000000,?), ref: 0015A11B
GetCPInfo.KERNEL32(00000000,?,?,?,?,?,?,?,?,0015A4CA,?,00000000,?,00000000,?), ref: 0015A157

Strings

o]\^, xrefs: 0015A0C2

Memory Dump Source

Source File: 00000000.00000002.2011655984.0000000000151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000000.00000002.2011642770.0000000000150000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011671915.0000000000162000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011685207.000000000016A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011715778.000000000016B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011746244.000000000016D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011805247.0000000000170000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150000_drop1.jbxd

Similarity

API ID: CodeInfoPageValid
String ID: o]\^
API String ID: 546120528-3166235393
Opcode ID: 177b144db294362f7009cbe35344f7cd89d9d9319f7458ea037b0e23e343e13a
Instruction ID: ecab91cafea9dbb5558f2c7b6abe9132cb00faaef375f898ab6744d22dfd736f
Opcode Fuzzy Hash: 177b144db294362f7009cbe35344f7cd89d9d9319f7458ea037b0e23e343e13a
Instruction Fuzzy Hash: B8516930980744CFDB21CF75C8826AABBF5FF51301F58426ED8A68F241D7759949CB52

Function 00153C1A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 94
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 001544C7
___raise_securityfailure.LIBCMT ref: 001545AF

Part of subcall function 0015556E: RaiseException.KERNEL32(E06D7363,00000001,00000003,001544BB,?,?,?,?,001544BB,00001000,0016875C,00001000), ref: 001555CF

Strings

o]\^, xrefs: 00154590

Memory Dump Source

Source File: 00000000.00000002.2011655984.0000000000151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000000.00000002.2011642770.0000000000150000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011671915.0000000000162000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011685207.000000000016A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011715778.000000000016B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011746244.000000000016D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011805247.0000000000170000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150000_drop1.jbxd

Similarity

API ID: ExceptionFeaturePresentProcessorRaise___raise_securityfailure
String ID: o]\^
API String ID: 3749517692-3166235393
Opcode ID: 65181ebc723c8622509563488e4b038c08c851bd228eb458aaa477a7fca3cae3
Instruction ID: eed3bc63a6e2304f1f7503e33e15f55cf7f1453e1e5174ece64d72008b57509b
Opcode Fuzzy Hash: 65181ebc723c8622509563488e4b038c08c851bd228eb458aaa477a7fca3cae3
Instruction Fuzzy Hash: 7C313D75508209EBD704EF55FDA665977E8BB08314F10452EE924DBAA0EBF0A9C4CB84

Function 001567F4 Relevance: 4.6, APIs: 3, Instructions: 51
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateThread.KERNELBASE(001534C0,?,Function_0000690C,00000000,?,001534C0), ref: 0015683D
GetLastError.KERNEL32(?,00000000,00000000,?,00153379), ref: 00156849
__dosmaperr.LIBCMT ref: 00156850

Memory Dump Source

Source File: 00000000.00000002.2011655984.0000000000151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000000.00000002.2011642770.0000000000150000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011671915.0000000000162000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011685207.000000000016A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011715778.000000000016B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011746244.000000000016D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011805247.0000000000170000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150000_drop1.jbxd

Similarity

API ID: CreateErrorLastThread__dosmaperr
String ID:
API String ID: 2744730728-0
Opcode ID: 41719979759048b2b9f3000f1a78727d34b278a1e603e4ca4fbe12dd6bdf65b6
Instruction ID: 0efdb691b782424f0cb87dd59a380c9601ce726a5cfb8f89b4c306191563e4d4
Opcode Fuzzy Hash: 41719979759048b2b9f3000f1a78727d34b278a1e603e4ca4fbe12dd6bdf65b6
Instruction Fuzzy Hash: A5018C72900219EFDF059FA0DC06AAE7BA9EF10366F404158FC219B190DB71CD58DBE1

Function 0015A649 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 142
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCPInfo.KERNEL32(00000083,?,00000005,0015A4CA,?), ref: 0015A67B

Strings

o]\^, xrefs: 0015A654

Memory Dump Source

Source File: 00000000.00000002.2011655984.0000000000151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000000.00000002.2011642770.0000000000150000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011671915.0000000000162000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011685207.000000000016A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011715778.000000000016B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011746244.000000000016D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011805247.0000000000170000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150000_drop1.jbxd

Similarity

API ID: Info
String ID: o]\^
API String ID: 1807457897-3166235393
Opcode ID: c1312fda3f59b1f986b2bc739247e0ae9bc0f9594c0d1b0374bf943ae4bbe185
Instruction ID: 9ed6d649b0f1c643a4cad99a6c39c2dcaa95d7f7ff166ec7a690e6c6aa5d8e41
Opcode Fuzzy Hash: c1312fda3f59b1f986b2bc739247e0ae9bc0f9594c0d1b0374bf943ae4bbe185
Instruction Fuzzy Hash: 675149B1504158DEDB118E28CD94BE9BB7CEF19300F5402E9E8A9CB182D3369E8DDF61

Function 00159599 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 56
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

o]\^, xrefs: 001595AD, 00159600

Memory Dump Source

Source File: 00000000.00000002.2011655984.0000000000151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000000.00000002.2011642770.0000000000150000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011671915.0000000000162000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011685207.000000000016A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011715778.000000000016B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011746244.000000000016D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011805247.0000000000170000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150000_drop1.jbxd

Similarity

API ID:
String ID: o]\^
API String ID: 0-3166235393
Opcode ID: e69a63c7a56d0eba899ec3847bf09e35db446328f3274c37b19b0d2abe443c9f
Instruction ID: ce1d0e59ee22a3f4ce22739b5b697f64681f5c6cd1f0ab73c395887445076a49
Opcode Fuzzy Hash: e69a63c7a56d0eba899ec3847bf09e35db446328f3274c37b19b0d2abe443c9f
Instruction Fuzzy Hash: E8012433254214EF8B068F68ED80A1A33B5FBC132136A4125FD20DF494EB30D898DB86

Function 001517A0 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 18
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNEL32 ref: 001517D5

Strings

o]\^, xrefs: 001517AA

Memory Dump Source

Source File: 00000000.00000002.2011655984.0000000000151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000000.00000002.2011642770.0000000000150000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011671915.0000000000162000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011685207.000000000016A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011715778.000000000016B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011746244.000000000016D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011805247.0000000000170000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150000_drop1.jbxd

Similarity

API ID: ExitProcess
String ID: o]\^
API String ID: 621844428-3166235393
Opcode ID: 47a5ccd2e83dc1b6d6e71a8a9265b3687145e62ab61cd491d56411f8a0b1b80e
Instruction ID: 1eb30a9fea9d17cbb17ccba27612c615abfe222ef51e9efd38821541354aa5e5
Opcode Fuzzy Hash: 47a5ccd2e83dc1b6d6e71a8a9265b3687145e62ab61cd491d56411f8a0b1b80e
Instruction Fuzzy Hash: 59E012316152089BD740EF79CC0479A7BE5EF49311F858438E989EB384DA74E8808B92

Function 00159EAC Relevance: 3.1, APIs: 2, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStdHandle.KERNEL32(000000F6,?,?,?,?,?,?,?,00000000,00159D9B,001690B8,0000000C), ref: 00159EF8
GetFileType.KERNELBASE(00000000,?,?,?,?,?,?,?,00000000,00159D9B,001690B8,0000000C), ref: 00159F0A

Memory Dump Source

Source File: 00000000.00000002.2011655984.0000000000151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000000.00000002.2011642770.0000000000150000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011671915.0000000000162000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011685207.000000000016A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011715778.000000000016B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011746244.000000000016D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011805247.0000000000170000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150000_drop1.jbxd

Similarity

API ID: FileHandleType
String ID:
API String ID: 3000768030-0
Opcode ID: fa888fec50ac2246e6f23594f2c5a1900545230399c888a10fb0febd1e46f114
Instruction ID: 7430517b5ed5acb52df5f6077061c6215b8724843a7178c868bbd126055286f5
Opcode Fuzzy Hash: fa888fec50ac2246e6f23594f2c5a1900545230399c888a10fb0febd1e46f114
Instruction Fuzzy Hash: CD11E431508701C6CB348E3E8C886227E95A756332B380B4FE9B6CA5F1C734D98DC242

Function 0015690C Relevance: 3.0, APIs: 2, Instructions: 38
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32(00168D78,0000000C), ref: 0015691F
ExitThread.KERNEL32 ref: 00156926

Memory Dump Source

Source File: 00000000.00000002.2011655984.0000000000151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000000.00000002.2011642770.0000000000150000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011671915.0000000000162000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011685207.000000000016A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011715778.000000000016B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011746244.000000000016D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011805247.0000000000170000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150000_drop1.jbxd

Similarity

API ID: ErrorExitLastThread
String ID:
API String ID: 1611280651-0
Opcode ID: 5bdbd206853a4d9bf04c9c13bc506e5f664c21b3ce2e39ae75c7f84a9798e331
Instruction ID: 3559a07c05284808ae2c415f89b697f770732c5240606c37d972aa188a400e96
Opcode Fuzzy Hash: 5bdbd206853a4d9bf04c9c13bc506e5f664c21b3ce2e39ae75c7f84a9798e331
Instruction Fuzzy Hash: 0EF0C271944604DFDB00AFB0CC4AE6E3B74FF64316F104589F8229F692CB749948CBA1

Function 00159357 Relevance: 3.0, APIs: 2, Instructions: 34
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LCMapStringEx.KERNELBASE(?,0015D615,?,?,-00000008,?,00000000,00000000,00000000,00000000,00000000), ref: 0015938B
LCMapStringW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,?,-00000008,-00000008,?,0015D615,?,?,-00000008,?,00000000), ref: 001593A9

Memory Dump Source

Source File: 00000000.00000002.2011655984.0000000000151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000000.00000002.2011642770.0000000000150000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011671915.0000000000162000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011685207.000000000016A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011715778.000000000016B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011746244.000000000016D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011805247.0000000000170000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150000_drop1.jbxd

Similarity

API ID: String
String ID:
API String ID: 2568140703-0
Opcode ID: de4b397f64ec7e383e817938836225d4f4a4e04f84a4f0fa94fdc4fd14aa0dcf
Instruction ID: 270a316de49f3e96f8e37714720ec0863c1f58c9a6a517ba536ef741ae39fd47
Opcode Fuzzy Hash: de4b397f64ec7e383e817938836225d4f4a4e04f84a4f0fa94fdc4fd14aa0dcf
Instruction Fuzzy Hash: 0BF0643240011AFBCF126FA0DC059EE3E26BF483A1B098110FE2869060CB76C875AB91

Function 0015A83B Relevance: 3.0, APIs: 2, Instructions: 22
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlFreeHeap.NTDLL(00000000,00000000,?,0015B3A9,?,00000000,?,?,0015B2C5,?,00000007,?,?,0015B8DE,?,?), ref: 0015A851
GetLastError.KERNEL32(?,?,0015B3A9,?,00000000,?,?,0015B2C5,?,00000007,?,?,0015B8DE,?,?), ref: 0015A85C

Memory Dump Source

Source File: 00000000.00000002.2011655984.0000000000151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000000.00000002.2011642770.0000000000150000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011671915.0000000000162000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011685207.000000000016A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011715778.000000000016B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011746244.000000000016D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011805247.0000000000170000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150000_drop1.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: c99264fbc235702625019b688d78b06dcec9228bce9a2b99bbb1464357620670
Instruction ID: 0d86beef64d0e271c7b766fdb34acecfec84b7ad8513613b74c780a8757bd678
Opcode Fuzzy Hash: c99264fbc235702625019b688d78b06dcec9228bce9a2b99bbb1464357620670
Instruction Fuzzy Hash: F0E08C32184214EBCB112FA0EC09B993E58EF40357F504A21FA189A460CBB1C9E8CB8A

Function 001532D0 Relevance: 1.6, APIs: 1, Instructions: 75COMMON

Download Yara Rule

APIs

std::_Throw_Cpp_error.LIBCPMT ref: 001533B3

Memory Dump Source

Source File: 00000000.00000002.2011655984.0000000000151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000000.00000002.2011642770.0000000000150000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011671915.0000000000162000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011685207.000000000016A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011715778.000000000016B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011746244.000000000016D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011805247.0000000000170000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150000_drop1.jbxd

Similarity

API ID: Cpp_errorThrow_std::_
String ID:
API String ID: 2134207285-0
Opcode ID: 35374993114714533e5973764b1d507e3dc515ae0b28c54cfb6489bca27aeb99
Instruction ID: 010a7a6b1c7e1361c1b3df898a3dc8299fce8459242c9c249252e877df4e8e05
Opcode Fuzzy Hash: 35374993114714533e5973764b1d507e3dc515ae0b28c54cfb6489bca27aeb99
Instruction Fuzzy Hash: C231E5B4901208CFCB04DFA8C545BAEBBF0FF48355F11816AE825AB351D7749A08CFA1

Function 0015B3B5 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,?,00000000,?,00153C34,?,?,00152442,00001000,?,001523AA), ref: 0015B3E7

Memory Dump Source

Source File: 00000000.00000002.2011655984.0000000000151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000000.00000002.2011642770.0000000000150000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011671915.0000000000162000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011685207.000000000016A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011715778.000000000016B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011746244.000000000016D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011805247.0000000000170000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150000_drop1.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 53db97f450b493f2d4f022038b06792f0f44b6247b6ec62e74fdffc0c3e7896d
Instruction ID: ea95c656e0d13371df47091fa8c3e70d611d52b993cd0185f5ca51862f11230b
Opcode Fuzzy Hash: 53db97f450b493f2d4f022038b06792f0f44b6247b6ec62e74fdffc0c3e7896d
Instruction Fuzzy Hash: 04E0302120D525D7DB6126669C42B6A7A58FF413A2B160520EDB5AE5D0DBA48C4881E1

Non-executed Functions

Function 0015BF4B Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 205COMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNEL32(?,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0015C03B

Strings

o]\^, xrefs: 0015BF56

Memory Dump Source

Source File: 00000000.00000002.2011655984.0000000000151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000000.00000002.2011642770.0000000000150000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011671915.0000000000162000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011685207.000000000016A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011715778.000000000016B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011746244.000000000016D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011805247.0000000000170000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150000_drop1.jbxd

Similarity

API ID: FileFindFirst
String ID: o]\^
API String ID: 1974802433-3166235393
Opcode ID: a0ea231ebe075ab1a3ef42b65ee37447b501e886b7a67872c3507382ad30a5b5
Instruction ID: bf14f25413f7bdb3324f76bc584791f3a26fa323736a95623c797c69d9ce13b9
Opcode Fuzzy Hash: a0ea231ebe075ab1a3ef42b65ee37447b501e886b7a67872c3507382ad30a5b5
Instruction Fuzzy Hash: 9671E8B1949228DFDF209F24CCC9AAEB7B5AF05302F5441DAE829AB151DB314EC98F50

Function 001578CC Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,00000000), ref: 001579C4
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,00000000), ref: 001579CE
UnhandledExceptionFilter.KERNEL32(-00000327,?,?,?,?,?,00000000), ref: 001579DB

Strings

o]\^, xrefs: 001578D7

Memory Dump Source

Source File: 00000000.00000002.2011655984.0000000000151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000000.00000002.2011642770.0000000000150000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011671915.0000000000162000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011685207.000000000016A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011715778.000000000016B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011746244.000000000016D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011805247.0000000000170000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150000_drop1.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID: o]\^
API String ID: 3906539128-3166235393
Opcode ID: 1f3cf3049b91913eadb2b3b82b050aacc231651d805e110f271baad2ebc1202f
Instruction ID: 63dd6302aae221352505c1aadb5aa5743709e2338ae57699b37c67d58d755a42
Opcode Fuzzy Hash: 1f3cf3049b91913eadb2b3b82b050aacc231651d805e110f271baad2ebc1202f
Instruction Fuzzy Hash: 2C31D574901219DBCB61DF68DD8978DB7B4BF18315F5042DAE82CAB290EB709F858F44

Function 00155027 Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,?), ref: 00155033
IsDebuggerPresent.KERNEL32 ref: 001550FF
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00155118
UnhandledExceptionFilter.KERNEL32(?), ref: 00155122

Memory Dump Source

Source File: 00000000.00000002.2011655984.0000000000151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000000.00000002.2011642770.0000000000150000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011671915.0000000000162000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011685207.000000000016A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011715778.000000000016B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011746244.000000000016D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011805247.0000000000170000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150000_drop1.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: c093fe921d97236abf75fc67740ec2ecc7c4f34089457a990f2150179879fa83
Instruction ID: 2c8978603b72dc2f3cb8dce3ee40f17f097023ba6b33add60f8e3e32b7094b6b
Opcode Fuzzy Hash: c093fe921d97236abf75fc67740ec2ecc7c4f34089457a990f2150179879fa83
Instruction Fuzzy Hash: CB31F975D05219DBDB20DFA4DD497CDBBB8BF08305F1041EAE50DAB250EB719A888F45

Function 001548D3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 27timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimePreciseAsFileTime.KERNEL32(?,00154844,?,?,?,?,00154868,000000FF,?,?,?,00154780,00000000), ref: 0015490B
GetSystemTimeAsFileTime.KERNEL32(?,5E5C5D6F,?,?,00161B3D,000000FF,?,00154844,?,?,?,?,00154868,000000FF,?), ref: 0015490F

Strings

o]\^, xrefs: 001548E5

Memory Dump Source

Source File: 00000000.00000002.2011655984.0000000000151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000000.00000002.2011642770.0000000000150000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011671915.0000000000162000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011685207.000000000016A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011715778.000000000016B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011746244.000000000016D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011805247.0000000000170000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150000_drop1.jbxd

Similarity

API ID: Time$FileSystem$Precise
String ID: o]\^
API String ID: 743729956-3166235393
Opcode ID: 18f930e468d547e9a6dc01f3e9ac808bba51dd376ee7932a815311e37c51a6c7
Instruction ID: 7feefaeea1bb1c8180e66c411523342ea4953bdc85eecaa94581d56688ac26e5
Opcode Fuzzy Hash: 18f930e468d547e9a6dc01f3e9ac808bba51dd376ee7932a815311e37c51a6c7
Instruction Fuzzy Hash: 6AF09B72958558EFCB019F44DC41B5AB7B8FB08B24F05462AEC23D7B90DBB46984CB90

Function 0015BE9A Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 199fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0015AF77: HeapAlloc.KERNEL32(00000008,?,?,?,001597D4,00000001,00000364,?,00000002,000000FF,?,00156931,00168D78,0000000C), ref: 0015AFB8

FindFirstFileExW.KERNEL32(?,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0015C03B
FindNextFileW.KERNEL32(00000000,?), ref: 0015C12F
FindClose.KERNEL32(00000000), ref: 0015C16E
FindClose.KERNEL32(00000000), ref: 0015C1A1

Strings

o]\^, xrefs: 0015BF56

Memory Dump Source

Source File: 00000000.00000002.2011655984.0000000000151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000000.00000002.2011642770.0000000000150000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011671915.0000000000162000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011685207.000000000016A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011715778.000000000016B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011746244.000000000016D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011805247.0000000000170000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150000_drop1.jbxd

Similarity

API ID: Find$CloseFile$AllocFirstHeapNext
String ID: o]\^
API String ID: 2701053895-3166235393
Opcode ID: 8d5e56f34788c39c12434e773cb578d949f4013585fa3f1e29d0fa7f6373605d
Instruction ID: 798e87efd19a8f4c819988506536c7b6b5283b0911e352570772907c324b3fe2
Opcode Fuzzy Hash: 8d5e56f34788c39c12434e773cb578d949f4013585fa3f1e29d0fa7f6373605d
Instruction Fuzzy Hash: 2C512775908118EFDB249F289CC59BEB7A9DF45346F14419AFC399F241EB308D4A8B60

Function 00161542 Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,0016149D,?,?,00000008,?,?,0016106F,00000000), ref: 0016176F

Memory Dump Source

Source File: 00000000.00000002.2011655984.0000000000151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000000.00000002.2011642770.0000000000150000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011671915.0000000000162000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011685207.000000000016A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011715778.000000000016B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011746244.000000000016D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011805247.0000000000170000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150000_drop1.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 8bfa6e3f1734911af714fbb89ada78526a487181e32cb35ac2694eece4faa65c
Instruction ID: f1d3e609236aaee7067341237eea14350fbfdcbdbd23bae3603026b76c5d1bfc
Opcode Fuzzy Hash: 8bfa6e3f1734911af714fbb89ada78526a487181e32cb35ac2694eece4faa65c
Instruction Fuzzy Hash: 49B15E36510609EFD719CF28C886B647BE0FF45365F2D8658E89ACF2A1C375E9A1CB40

Function 00155235 Relevance: 1.7, APIs: 1, Instructions: 242COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 0015524B

Memory Dump Source

Source File: 00000000.00000002.2011655984.0000000000151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000000.00000002.2011642770.0000000000150000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011671915.0000000000162000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011685207.000000000016A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011715778.000000000016B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011746244.000000000016D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011805247.0000000000170000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150000_drop1.jbxd

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: eed4330f427ed3c1dc1800befdb3547e8c46aa51bf86cd68df966e5bd6e28eae
Instruction ID: 7d1563dc806a2c75bf23fda358666da4cd2713c184280f903b787279ce73d92a
Opcode Fuzzy Hash: eed4330f427ed3c1dc1800befdb3547e8c46aa51bf86cd68df966e5bd6e28eae
Instruction Fuzzy Hash: 10A1AF71911605CFDB19CF58EC962A9BBF1FF44325F18812AD829EB760D3B49884CF51

Function 0015501B Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_0000513C,00154ACD), ref: 00155020

Memory Dump Source

Source File: 00000000.00000002.2011655984.0000000000151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000000.00000002.2011642770.0000000000150000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011671915.0000000000162000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011685207.000000000016A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011715778.000000000016B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011746244.000000000016D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011805247.0000000000170000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150000_drop1.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 2045080bb7e3f6c5fe7cddbfa61847ebaec128e67d7a827016c63eef7d56ed99
Instruction ID: 206c130ca75cac128d0437cbcedab370dcee1f7ef1353cf487bdb81ff94d00c5
Opcode Fuzzy Hash: 2045080bb7e3f6c5fe7cddbfa61847ebaec128e67d7a827016c63eef7d56ed99
Instruction Fuzzy Hash:

Function 00151000 Relevance: 1.4, Strings: 1, Instructions: 109COMMON

Download Yara Rule

Strings

o]\^, xrefs: 0015100C

Memory Dump Source

Source File: 00000000.00000002.2011655984.0000000000151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000000.00000002.2011642770.0000000000150000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011671915.0000000000162000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011685207.000000000016A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011715778.000000000016B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011746244.000000000016D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011805247.0000000000170000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150000_drop1.jbxd

Similarity

API ID:
String ID: o]\^
API String ID: 0-3166235393
Opcode ID: b31aa5766cd2ac8492d7820cb0dd16da5f72d5c9f5b3fef4559b65d71bfcd311
Instruction ID: 5a6228f2f5178760357f7f17b3888e090f39ced688987cfe8bee8605c6aa892a
Opcode Fuzzy Hash: b31aa5766cd2ac8492d7820cb0dd16da5f72d5c9f5b3fef4559b65d71bfcd311
Instruction Fuzzy Hash: 0E519AB0D0020DEFCB44DFA8C591AEEBBF4AB09351F24445AE825FB350D730AA45CB65

Function 00159726 Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00159726

Memory Dump Source

Source File: 00000000.00000002.2011655984.0000000000151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000000.00000002.2011642770.0000000000150000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011671915.0000000000162000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011685207.000000000016A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011715778.000000000016B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011746244.000000000016D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011805247.0000000000170000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150000_drop1.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 1f20e64b6973a36220a350def02388b6141f446362461056f5857fe0ce2b0dbf
Instruction ID: bf7dafe7367ff5f5b27af3338591bad6dd693e703b5e86d4a309b698cfd2c608
Opcode Fuzzy Hash: 1f20e64b6973a36220a350def02388b6141f446362461056f5857fe0ce2b0dbf
Instruction Fuzzy Hash: 12A01270143100CB43004F345E4420837985B442803050814E004C0520DB7440C46A00

Function 00151770 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2011655984.0000000000151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000000.00000002.2011642770.0000000000150000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011671915.0000000000162000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011685207.000000000016A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011715778.000000000016B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011746244.000000000016D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011805247.0000000000170000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150000_drop1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cad9205f6bd199fce5879b9ba951cc8ad459025a51b17c9d4c88020f3c18893c
Instruction ID: 98eafffb1301a121bbe929b7b333a97daa8768aa38300c84abd73215c6f6866f
Opcode Fuzzy Hash: cad9205f6bd199fce5879b9ba951cc8ad459025a51b17c9d4c88020f3c18893c
Instruction Fuzzy Hash: FBD0923A645A58EFC210CF49E840D41F7B8FB8D670B168166EA4893B20C371FC11CAE0

Function 0015F878 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 248COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCPInfo.KERNEL32(01580560,01580560,00000000,7FFFFFFF,?,0015F863,01580560,01580560,00000000,01580560,?,?,?,?,01580560,00000000), ref: 0015F91E
__alloca_probe_16.LIBCMT ref: 0015F9D9
__alloca_probe_16.LIBCMT ref: 0015FA68
__freea.LIBCMT ref: 0015FAB3
__freea.LIBCMT ref: 0015FAB9
__freea.LIBCMT ref: 0015FAEF
__freea.LIBCMT ref: 0015FAF5
__freea.LIBCMT ref: 0015FB05

Strings

o]\^, xrefs: 0015F880

Memory Dump Source

Source File: 00000000.00000002.2011655984.0000000000151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000000.00000002.2011642770.0000000000150000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011671915.0000000000162000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011685207.000000000016A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011715778.000000000016B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011746244.000000000016D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011805247.0000000000170000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150000_drop1.jbxd

Similarity

API ID: __freea$__alloca_probe_16$Info
String ID: o]\^
API String ID: 127012223-3166235393
Opcode ID: e016de4fcb9aa732c2c2614ce2cb263dc3ed8bc039ca751f36dcbc7f8d003e34
Instruction ID: a647d088bb42f3b931acc8a0c3a0ecd21a67c34ef3d9d756550cf09658b59eb5
Opcode Fuzzy Hash: e016de4fcb9aa732c2c2614ce2cb263dc3ed8bc039ca751f36dcbc7f8d003e34
Instruction Fuzzy Hash: B771D372904206EBDF209E64CC92FAE77A99F45316F29002DFD35AF281E7359C4A8791

Function 00155C80 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 122COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00155CB7
___except_validate_context_record.LIBVCRUNTIME ref: 00155CBF
_ValidateLocalCookies.LIBCMT ref: 00155D48
__IsNonwritableInCurrentImage.LIBCMT ref: 00155D73
_ValidateLocalCookies.LIBCMT ref: 00155DC8

Strings

o]\^, xrefs: 00155D32, 00155DAF
csm, xrefs: 00155D5D

Memory Dump Source

Source File: 00000000.00000002.2011655984.0000000000151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000000.00000002.2011642770.0000000000150000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011671915.0000000000162000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011685207.000000000016A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011715778.000000000016B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011746244.000000000016D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011805247.0000000000170000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150000_drop1.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm$o]\^
API String ID: 1170836740-2445782091
Opcode ID: 11d728f961d2228de6224caa0d7e390a794cbde9e0e42c374779170c1a64b99a
Instruction ID: c52cfdc71f1310df33c4aa1bf189bc8501025859cac4ead94dcfb8e4be1826be
Opcode Fuzzy Hash: 11d728f961d2228de6224caa0d7e390a794cbde9e0e42c374779170c1a64b99a
Instruction Fuzzy Hash: 6741E535A00618EBCF10DFA8CC98A9EBBF6EF44325F148055EC246F392D771A959CB91

Function 001546F6 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 116threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 0015470A
AcquireSRWLockExclusive.KERNEL32(?,?,00000000,00161B20,000000FF,?,00153552), ref: 00154729
AcquireSRWLockExclusive.KERNEL32(?,?,?,?,00000000,00161B20,000000FF,?,00153552), ref: 00154757
TryAcquireSRWLockExclusive.KERNEL32(?,?,?,?,00000000,00161B20,000000FF,?,00153552), ref: 001547B2
TryAcquireSRWLockExclusive.KERNEL32(?,?,?,?,00000000,00161B20,000000FF,?,00153552), ref: 001547C9

Strings

o]\^, xrefs: 001546FC

Memory Dump Source

Source File: 00000000.00000002.2011655984.0000000000151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000000.00000002.2011642770.0000000000150000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011671915.0000000000162000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011685207.000000000016A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011715778.000000000016B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011746244.000000000016D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011805247.0000000000170000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150000_drop1.jbxd

Similarity

API ID: AcquireExclusiveLock$CurrentThread
String ID: o]\^
API String ID: 66001078-3166235393
Opcode ID: 96a97554352cd825522b774b913abc54294437293fbcf39f1403d2fac46e0359
Instruction ID: 970a6d57be234db18dedadf8c6886de895a46e81c70568fe3baf5834551fe974
Opcode Fuzzy Hash: 96a97554352cd825522b774b913abc54294437293fbcf39f1403d2fac46e0359
Instruction Fuzzy Hash: 7A414D35900646DFCB24DFA5C8819AAB3F5FF0A31AB10492AD876DBA40D730F9C8CB50

Function 00156A60 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,5E5C5D6F,?,?,00000000,00161B77,000000FF,?,00156B21,00000002,?,00156BBD,00157DE9), ref: 00156A95
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00156AA7
FreeLibrary.KERNEL32(00000000,?,?,00000000,00161B77,000000FF,?,00156B21,00000002,?,00156BBD,00157DE9), ref: 00156AC9

Strings

o]\^, xrefs: 00156A75
mscoree.dll, xrefs: 00156A8E
CorExitProcess, xrefs: 00156A9F

Memory Dump Source

Source File: 00000000.00000002.2011655984.0000000000151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000000.00000002.2011642770.0000000000150000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011671915.0000000000162000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011685207.000000000016A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011715778.000000000016B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011746244.000000000016D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011805247.0000000000170000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150000_drop1.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll$o]\^
API String ID: 4061214504-1772416451
Opcode ID: 08d8cffead9dd2b7b754acad2ebe4fbe1db868d62e4142b3893f73fe679b3afb
Instruction ID: 01634860fd176a5e4cffee62445cb874c9b275ef2a15f170a091ccf048df1644
Opcode Fuzzy Hash: 08d8cffead9dd2b7b754acad2ebe4fbe1db868d62e4142b3893f73fe679b3afb
Instruction Fuzzy Hash: A701AD31944619FFDB118F44CC09FAEBBB8FB04B55F484625FC22A36E0DBB49848CA80

Function 0015489F Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 15libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll), ref: 001548A5
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 001548B3
GetProcAddress.KERNEL32(00000000,GetTempPath2W), ref: 001548C4

Strings

GetSystemTimePreciseAsFileTime, xrefs: 001548AD
GetTempPath2W, xrefs: 001548B9
kernel32.dll, xrefs: 001548A0

Memory Dump Source

Source File: 00000000.00000002.2011655984.0000000000151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000000.00000002.2011642770.0000000000150000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011671915.0000000000162000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011685207.000000000016A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011715778.000000000016B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011746244.000000000016D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011805247.0000000000170000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150000_drop1.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: GetSystemTimePreciseAsFileTime$GetTempPath2W$kernel32.dll
API String ID: 667068680-1047828073
Opcode ID: c054290cf9f879d82b62dcf5daa1332ea5d29f3d350cc431fc2c0270bf83b218
Instruction ID: 8bc92b233fca3da3cd9febb653260e86c75851f549ae4c472f1427250c59023c
Opcode Fuzzy Hash: c054290cf9f879d82b62dcf5daa1332ea5d29f3d350cc431fc2c0270bf83b218
Instruction Fuzzy Hash: A1D0A732687A20EFC3109F787C0D84B3FA5EB043413010611F401D2651DFF404D4CBA0

Function 0015DCA8 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 333fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(5E5C5D6F,00000000,00000000,?), ref: 0015DD0B

Part of subcall function 0015C8A1: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,0015D6D0,?,00000000,-00000008), ref: 0015C902

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 0015DF5D
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 0015DFA3
GetLastError.KERNEL32 ref: 0015E046

Strings

o]\^, xrefs: 0015DCBE

Memory Dump Source

Source File: 00000000.00000002.2011655984.0000000000151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000000.00000002.2011642770.0000000000150000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011671915.0000000000162000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011685207.000000000016A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011715778.000000000016B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011746244.000000000016D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011805247.0000000000170000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150000_drop1.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID: o]\^
API String ID: 2112829910-3166235393
Opcode ID: de7e207231e0be478a6cc8369e10e8280a1f444ff4e50be7177b4e31e669add0
Instruction ID: 6b2e71619e016b156cb4e55558663dd5c09fdfdaf76330941888eeefdcf6ee2c
Opcode Fuzzy Hash: de7e207231e0be478a6cc8369e10e8280a1f444ff4e50be7177b4e31e669add0
Instruction Fuzzy Hash: 84D17D75E04248DFCB19CFA8D8809ADBBF5FF08315F18456AE826EB251D770A94ACB50

Function 00157F49 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00157F40,00155A6B,00155180), ref: 00157F57
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00157F65
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00157F7E
SetLastError.KERNEL32(00000000,00157F40,00155A6B,00155180), ref: 00157FD0

Memory Dump Source

Source File: 00000000.00000002.2011655984.0000000000151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000000.00000002.2011642770.0000000000150000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011671915.0000000000162000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011685207.000000000016A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011715778.000000000016B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011746244.000000000016D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011805247.0000000000170000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150000_drop1.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: fe3292abdbc2a064e8262e172abd83a72e31fe336157c13fe73ac0d8315d5590
Instruction ID: cac63bb495994d82ad5034a0257f0075d9d8a00615ba86fc3bbe57a0a3e3d361
Opcode Fuzzy Hash: fe3292abdbc2a064e8262e172abd83a72e31fe336157c13fe73ac0d8315d5590
Instruction Fuzzy Hash: 1D01B17210C612EEA62567B5BC8682637A8DF5577B721022AFC305D4F1EF924C4E9650

Function 001587D9 Relevance: 9.1, APIs: 2, Strings: 3, Instructions: 301COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 001588F8
CallUnexpected.LIBVCRUNTIME ref: 00158B71

Strings

csm, xrefs: 0015892F
csm, xrefs: 00158883
csm, xrefs: 00158816

Memory Dump Source

Source File: 00000000.00000002.2011655984.0000000000151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000000.00000002.2011642770.0000000000150000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011671915.0000000000162000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011685207.000000000016A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011715778.000000000016B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011746244.000000000016D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011805247.0000000000170000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150000_drop1.jbxd

Similarity

API ID: CallUnexpectedtype_info::operator==
String ID: csm$csm$csm
API String ID: 2673424686-393685449
Opcode ID: a390cf1146019a269dba97e9d567752f07ce33b65321469457141ad7b6de027f
Instruction ID: f7172af49ba3286e5c35d3b05d417f5cc6273c67cbaa8130cec910eab93b4e2a
Opcode Fuzzy Hash: a390cf1146019a269dba97e9d567752f07ce33b65321469457141ad7b6de027f
Instruction Fuzzy Hash: F0B17971800209EFCF18EFA4C8819AEB7B5FF54316B14415AEC217F252DB31DA5ACB91

Function 0015C2C4 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79COMMON

Download Yara Rule

Strings

C:\Users\user\Desktop\drop1.exe, xrefs: 0015C2E0

Memory Dump Source

Source File: 00000000.00000002.2011655984.0000000000151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000000.00000002.2011642770.0000000000150000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011671915.0000000000162000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011685207.000000000016A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011715778.000000000016B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011746244.000000000016D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011805247.0000000000170000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150000_drop1.jbxd

Similarity

API ID:
String ID: C:\Users\user\Desktop\drop1.exe
API String ID: 0-1358265949
Opcode ID: dcc2d88ac760f6055402bca616f3fc6c42575d4ad6332f9432584d75190d11a6
Instruction ID: f820cfdf30ff0ffd4eb732678d15b3736b6d3b8079be05e677f7bd60c18f824e
Opcode Fuzzy Hash: dcc2d88ac760f6055402bca616f3fc6c42575d4ad6332f9432584d75190d11a6
Instruction Fuzzy Hash: 1E217971600309EFDB60AFB5CC8186B77A9BF1436A7108A15FD399A650DB31EC488BE1

Function 00151E00 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 53threadCOMMON

Download Yara Rule

APIs

std::_Throw_Cpp_error.LIBCPMT ref: 00151E2D
GetCurrentThreadId.KERNEL32 ref: 00151E3B
std::_Throw_Cpp_error.LIBCPMT ref: 00151E54
std::_Throw_Cpp_error.LIBCPMT ref: 00151E93

Strings

o]\^, xrefs: 00151E06

Memory Dump Source

Source File: 00000000.00000002.2011655984.0000000000151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000000.00000002.2011642770.0000000000150000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011671915.0000000000162000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011685207.000000000016A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011715778.000000000016B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011746244.000000000016D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011805247.0000000000170000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150000_drop1.jbxd

Similarity

API ID: Cpp_errorThrow_std::_$CurrentThread
String ID: o]\^
API String ID: 2261580123-3166235393
Opcode ID: 0a95372b50a959d26268eb43e90bc4524b5754f4dd07103aba3af408184bf890
Instruction ID: c7c620c443b262f92ee134b4b1a42cfbfac8b0889db92cfb77f46c901462de2c
Opcode Fuzzy Hash: 0a95372b50a959d26268eb43e90bc4524b5754f4dd07103aba3af408184bf890
Instruction Fuzzy Hash: 9D21C3B0D04209DFCB05EFA8C5827ADBBF1EF58301F01845DE869AB351D7349945CB51

Function 0015B45D Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 98COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 0015B4CF
GetStringTypeW.KERNEL32(?,-00000008,00000000,00000001,?,?,?,?,?,?,?,?,?,?,?,00000083), ref: 0015B527
__freea.LIBCMT ref: 0015B534

Part of subcall function 0015B3B5: RtlAllocateHeap.NTDLL(00000000,?,00000000,?,00153C34,?,?,00152442,00001000,?,001523AA), ref: 0015B3E7

Strings

o]\^, xrefs: 0015B465

Memory Dump Source

Source File: 00000000.00000002.2011655984.0000000000151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000000.00000002.2011642770.0000000000150000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011671915.0000000000162000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011685207.000000000016A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011715778.000000000016B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011746244.000000000016D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011805247.0000000000170000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150000_drop1.jbxd

Similarity

API ID: AllocateHeapStringType__alloca_probe_16__freea
String ID: o]\^
API String ID: 2035984020-3166235393
Opcode ID: 09a855bb9808086d84e23918da26d4fe3a016140a560854f966093f108987a7b
Instruction ID: aa118b2f75b81d6c885eb7d12c602e26cfc831f669558f74c8c66fe039500770
Opcode Fuzzy Hash: 09a855bb9808086d84e23918da26d4fe3a016140a560854f966093f108987a7b
Instruction Fuzzy Hash: BF31EF7290520AEBCF249F65DC85EAF7BA4EF04312F050128FD24AB251E730C959CBA0

Function 0015C1E8 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 45COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,00000105), ref: 0015C20D
GetLastError.KERNEL32 ref: 0015C217
__dosmaperr.LIBCMT ref: 0015C21E

Strings

o]\^, xrefs: 0015C1F3

Memory Dump Source

Source File: 00000000.00000002.2011655984.0000000000151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000000.00000002.2011642770.0000000000150000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011671915.0000000000162000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011685207.000000000016A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011715778.000000000016B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011746244.000000000016D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011805247.0000000000170000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150000_drop1.jbxd

Similarity

API ID: ErrorFileLastModuleName__dosmaperr
String ID: o]\^
API String ID: 4076908705-3166235393
Opcode ID: fa59a4fd0d1772cf345b591796997dc2659041d45b8c57bc00962fd79e90b6c2
Instruction ID: e55ddff36fb60166e7b5f3614a53d988053a6e9bd1d2fea7863309ee5b2bda08
Opcode Fuzzy Hash: fa59a4fd0d1772cf345b591796997dc2659041d45b8c57bc00962fd79e90b6c2
Instruction Fuzzy Hash: 3B111B7194421CEFCB14DFA4DC89BDEB7B8AF18305F104599E519EB241DB709A888F94

Function 0015D200 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,0015D29C,00000000,?,0016B728,?,?,?,0015D1D3,00000004,InitializeCriticalSectionEx,00163740,00163748), ref: 0015D20D
GetLastError.KERNEL32(?,0015D29C,00000000,?,0016B728,?,?,?,0015D1D3,00000004,InitializeCriticalSectionEx,00163740,00163748,00000000,?,00158E2C), ref: 0015D217
LoadLibraryExW.KERNEL32(00000000,00000000,00000000), ref: 0015D23F

Strings

api-ms-, xrefs: 0015D224

Memory Dump Source

Source File: 00000000.00000002.2011655984.0000000000151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000000.00000002.2011642770.0000000000150000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011671915.0000000000162000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011685207.000000000016A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011715778.000000000016B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011746244.000000000016D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011805247.0000000000170000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150000_drop1.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: dc9c63275c9cc81072b38e553692661cad6a234b85cae9f0b01937466068bd97
Instruction ID: 0740963549d63a84086d67044fd1b057db9f0b9ed016614e024f0cccf654ce5b
Opcode Fuzzy Hash: dc9c63275c9cc81072b38e553692661cad6a234b85cae9f0b01937466068bd97
Instruction Fuzzy Hash: D3E01A70684208F6EF211B60EC06B683B649B50B52F144420FD1CEC4E1DBB1E9989684

Function 00158500 Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 001585C7
___AdjustPointer.LIBCMT ref: 001585EA
___AdjustPointer.LIBCMT ref: 00158686

Memory Dump Source

Source File: 00000000.00000002.2011655984.0000000000151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000000.00000002.2011642770.0000000000150000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011671915.0000000000162000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011685207.000000000016A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011715778.000000000016B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011746244.000000000016D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011805247.0000000000170000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150000_drop1.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 53f11087109a5052f6ae147a0246b928f50c61d9c8ffbbee61b49133fd353405
Instruction ID: d8eb11bf36a50ee99364f4ac6ca9f7ee7fe6f53640dc94bfb7a38abc3045cafe
Opcode Fuzzy Hash: 53f11087109a5052f6ae147a0246b928f50c61d9c8ffbbee61b49133fd353405
Instruction Fuzzy Hash: 7051B172A01606DFDB298F54D851BBA77A5EF14312F14452DEC226F291EF31EC48DB90

Function 0015BD28 Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 0015C8A1: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,0015D6D0,?,00000000,-00000008), ref: 0015C902

GetLastError.KERNEL32(?,?,?,00000000,00000000,?,0015C0CE,?,?,?,00000000), ref: 0015BD8C
__dosmaperr.LIBCMT ref: 0015BD93
GetLastError.KERNEL32(00000000,0015C0CE,?,?,00000000,?,?,?,00000000,00000000,?,0015C0CE,?,?,?,00000000), ref: 0015BDCD
__dosmaperr.LIBCMT ref: 0015BDD4

Memory Dump Source

Source File: 00000000.00000002.2011655984.0000000000151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000000.00000002.2011642770.0000000000150000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011671915.0000000000162000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011685207.000000000016A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011715778.000000000016B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011746244.000000000016D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011805247.0000000000170000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150000_drop1.jbxd

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: 768dce0a0226fb928dabc562debb6f9c58838720252145585697f8109234f09a
Instruction ID: 9347f97cb91ecc8e2d2ee2db85261ec645f27f5f25303bc3bd947c7335166cf6
Opcode Fuzzy Hash: 768dce0a0226fb928dabc562debb6f9c58838720252145585697f8109234f09a
Instruction Fuzzy Hash: 61217171608206EFDB20AFA588D196AB7B9EF5436A7108518FC399F150D774EC488B91

Function 0015C99D Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 0015C9A5

Part of subcall function 0015C8A1: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,0015D6D0,?,00000000,-00000008), ref: 0015C902

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 0015C9DD
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 0015C9FD

Memory Dump Source

Source File: 00000000.00000002.2011655984.0000000000151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000000.00000002.2011642770.0000000000150000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011671915.0000000000162000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011685207.000000000016A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011715778.000000000016B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011746244.000000000016D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011805247.0000000000170000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150000_drop1.jbxd

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide
String ID:
API String ID: 158306478-0
Opcode ID: 3b393c431af804323b168bbcdb940bb0afa7689bdf38004d0c4e6f9dfdb279b2
Instruction ID: 61fb07344a6766c9f179a02fa4b707177df91b9cfc7cbaf258909519d9eb56a4
Opcode Fuzzy Hash: 3b393c431af804323b168bbcdb940bb0afa7689bdf38004d0c4e6f9dfdb279b2
Instruction Fuzzy Hash: 7A11E1E1905319FE6611ABB19C89CAF2D6CDEA47AB3500425FC21EA140FBA08D4982F1

Function 0015FD00 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,?,00000000,00000000,00000000,?,0015F4A1,00000000,00000001,00000000,?,?,0015E09A,?,00000000,00000000), ref: 0015FD17
GetLastError.KERNEL32(?,0015F4A1,00000000,00000001,00000000,?,?,0015E09A,?,00000000,00000000,?,?,?,0015D9E0,00000000), ref: 0015FD23

Part of subcall function 0015FD74: CloseHandle.KERNEL32(FFFFFFFE,0015FD33,?,0015F4A1,00000000,00000001,00000000,?,?,0015E09A,?,00000000,00000000,?,?), ref: 0015FD84

___initconout.LIBCMT ref: 0015FD33

Part of subcall function 0015FD55: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,0015FCF1,0015F48E,?,?,0015E09A,?,00000000,00000000,?), ref: 0015FD68

WriteConsoleW.KERNEL32(00000000,?,00000000,00000000,?,0015F4A1,00000000,00000001,00000000,?,?,0015E09A,?,00000000,00000000,?), ref: 0015FD48

Memory Dump Source

Source File: 00000000.00000002.2011655984.0000000000151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000000.00000002.2011642770.0000000000150000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011671915.0000000000162000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011685207.000000000016A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011715778.000000000016B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011746244.000000000016D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011805247.0000000000170000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150000_drop1.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 5567f1d2d1a8a3bc1b502ed934ac26cfb4ab25ef10b84a11c24360233e18c84b
Instruction ID: c8c94e792dd0bf8339a0d14af09ad6adc9404ad4d47833385aa0d533ac4c98cf
Opcode Fuzzy Hash: 5567f1d2d1a8a3bc1b502ed934ac26cfb4ab25ef10b84a11c24360233e18c84b
Instruction Fuzzy Hash: 37F0C036540116FBCF221FD5DC0CA9A3F36FF093A2B444524FE199A530DBB288A5AB91

Function 00154F01 Relevance: 6.0, APIs: 4, Instructions: 25timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(?), ref: 00154F13
GetCurrentThreadId.KERNEL32 ref: 00154F22
GetCurrentProcessId.KERNEL32 ref: 00154F2B
QueryPerformanceCounter.KERNEL32(?), ref: 00154F38

Memory Dump Source

Source File: 00000000.00000002.2011655984.0000000000151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000000.00000002.2011642770.0000000000150000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011671915.0000000000162000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011685207.000000000016A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011715778.000000000016B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011746244.000000000016D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011805247.0000000000170000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150000_drop1.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 7b954de386896378882926df1ed635ae4a85ae26c6936cf0850de0c5f5163c1b
Instruction ID: 3f68e3fad3b23c1d2f4848b9fae4bb3875d810951dc8425136ebcd35a99a0fda
Opcode Fuzzy Hash: 7b954de386896378882926df1ed635ae4a85ae26c6936cf0850de0c5f5163c1b
Instruction Fuzzy Hash: 4DF06274D1020DEBCB00DBF4DA49A9EBBF4FF1C205B914A95E412E7510EB70AB889B51

Function 00158BFD Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 125COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,00000000,00000000,?,?,?,?,?,?,00158AFE,?,?,00000000,00000000,00000000,?), ref: 00158C22

Strings

MOC, xrefs: 00158C34
RCC, xrefs: 00158C3C

Memory Dump Source

Source File: 00000000.00000002.2011655984.0000000000151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000000.00000002.2011642770.0000000000150000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011671915.0000000000162000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011685207.000000000016A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011715778.000000000016B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011746244.000000000016D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011805247.0000000000170000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150000_drop1.jbxd

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: 5f7981c4fa009a6a7a456f0bba9998c476e7e2e7dc7ee1180df25607619372b3
Instruction ID: 6fe9471d616c4e11f3ecdf86c0b1150bcf293f23e1d70f62b4fc71075624e3e3
Opcode Fuzzy Hash: 5f7981c4fa009a6a7a456f0bba9998c476e7e2e7dc7ee1180df25607619372b3
Instruction Fuzzy Hash: E6417671900209EFCF15DF98C881AEEBBB5BF18305F184159FD25BA291D735AA54CB60

Function 0015E29B Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 104fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

WriteFile.KERNEL32(?,?,00000000,?,00000000,0015DA55,00000000,0015AE95,?,00000000,?,00000000,00000000,00000000,?,?), ref: 0015E384
GetLastError.KERNEL32(0015DA55,00000000,0015AE95,?,00000000,?,00000000,00000000,00000000,?,?,00000000,?,?,0015AC51,?), ref: 0015E3B4

Strings

o]\^, xrefs: 0015E2AA

Memory Dump Source

Source File: 00000000.00000002.2011655984.0000000000151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000000.00000002.2011642770.0000000000150000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011671915.0000000000162000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011685207.000000000016A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011715778.000000000016B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011746244.000000000016D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011805247.0000000000170000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150000_drop1.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: o]\^
API String ID: 442123175-3166235393
Opcode ID: 7237bb3f3961c07c2bc859a5e3a13726d47f502221e6cf5510e545824eec499c
Instruction ID: 5cb5cabd2c3c7c3d99e1d5443d108718da2a41ccdd816d2d1aeed979155fd2a1
Opcode Fuzzy Hash: 7237bb3f3961c07c2bc859a5e3a13726d47f502221e6cf5510e545824eec499c
Instruction Fuzzy Hash: F6318371B00219EFDB28CF69DC91AEAB7F9BB44311F1444A9E915DB290D770EE848B60

Function 00158469 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 001586E0

Strings

csm, xrefs: 00158702
csm, xrefs: 00158773

Memory Dump Source

Source File: 00000000.00000002.2011655984.0000000000151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000000.00000002.2011642770.0000000000150000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011671915.0000000000162000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011685207.000000000016A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011715778.000000000016B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011746244.000000000016D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011805247.0000000000170000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150000_drop1.jbxd

Similarity

API ID: ___except_validate_context_record
String ID: csm$csm
API String ID: 3493665558-3733052814
Opcode ID: 9e6b565f10564cbc0613981958a1e449d96bfa85ca6e174167199685a1563d02
Instruction ID: f5d700c8c68a8129b56df9c1a780eb9cfd2526b1aee7ef211b0c1cf052c6799d
Opcode Fuzzy Hash: 9e6b565f10564cbc0613981958a1e449d96bfa85ca6e174167199685a1563d02
Instruction Fuzzy Hash: B131B036400219DBCF269F50CC449AA7BA6FF0C317B38455AFD646D221DB32CCA9DB91

Function 0015E1B2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 82fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

WriteFile.KERNEL32(?,?,?,?,00000000,00000000,00000000,?,?,0015DA3E,00000000,0015AE95,?,00000000,?,00000000), ref: 0015E25C
GetLastError.KERNEL32(?,0015DA3E,00000000,0015AE95,?,00000000,?,00000000,00000000,00000000,?,?,00000000,?,?,0015AC51), ref: 0015E282

Strings

o]\^, xrefs: 0015E1C1

Memory Dump Source

Source File: 00000000.00000002.2011655984.0000000000151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000000.00000002.2011642770.0000000000150000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011671915.0000000000162000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011685207.000000000016A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011715778.000000000016B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011746244.000000000016D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011805247.0000000000170000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150000_drop1.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: o]\^
API String ID: 442123175-3166235393
Opcode ID: 1e5253bb5f8ed0ba813c0172b5948714b772f70331498fee0b251b9d81136c3b
Instruction ID: ff3bc77c0fb3c831fff1eb1e15642df910083a212c074d8e4a816a072fe2e59b
Opcode Fuzzy Hash: 1e5253bb5f8ed0ba813c0172b5948714b772f70331498fee0b251b9d81136c3b
Instruction Fuzzy Hash: 72219171E00218DBCB28CF19DC809AAB3F9EF48315F1444AAED19DB250D7309E85CF90

Function 0015E0D7 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 80fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

WriteFile.KERNEL32(?,?,?,?,00000000,00000000,00000000,?,?,0015DA69,00000000,0015AE95,?,00000000,?,00000000), ref: 0015E173
GetLastError.KERNEL32(?,0015DA69,00000000,0015AE95,?,00000000,?,00000000,00000000,00000000,?,?,00000000,?,?,0015AC51), ref: 0015E199

Strings

o]\^, xrefs: 0015E0E6

Memory Dump Source

Source File: 00000000.00000002.2011655984.0000000000151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000000.00000002.2011642770.0000000000150000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011671915.0000000000162000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011685207.000000000016A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011715778.000000000016B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011746244.000000000016D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011805247.0000000000170000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150000_drop1.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: o]\^
API String ID: 442123175-3166235393
Opcode ID: e227e23a095440df3f68802e697218ac18ba66ce20672f52d9fdc41ba94ff530
Instruction ID: b343edaec57606f52c3d5333c698c998f9543c5544f89994a653983c6aa3f80b
Opcode Fuzzy Hash: e227e23a095440df3f68802e697218ac18ba66ce20672f52d9fdc41ba94ff530
Instruction Fuzzy Hash: 91218075A00218DBCB19CF29DDD09E9B7F9EB4C306F1444AAED16DB211D7309E8A8F60

Function 00153C8E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 001544C7
___raise_securityfailure.LIBCMT ref: 001545AF

Strings

o]\^, xrefs: 00154590

Memory Dump Source

Source File: 00000000.00000002.2011655984.0000000000151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000000.00000002.2011642770.0000000000150000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011671915.0000000000162000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011685207.000000000016A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011715778.000000000016B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011746244.000000000016D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2011805247.0000000000170000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150000_drop1.jbxd

Similarity

API ID: FeaturePresentProcessor___raise_securityfailure
String ID: o]\^
API String ID: 3761405300-3166235393
Opcode ID: 1745e7e1a9880204a2a4f2beae0bef462cca9df768711bb21a531daea7c018a4
Instruction ID: 04a738d5a184fac84fa8f6dc8320cb8ff270a1ae0d7927797f7273a59040e9f1
Opcode Fuzzy Hash: 1745e7e1a9880204a2a4f2beae0bef462cca9df768711bb21a531daea7c018a4
Instruction Fuzzy Hash: 1C21D8B5549208EAD700DF58FDA6A593BE4BB08304F10812EE908CABB0E7F4A9C48F45

Analysis Process: drop1.exePID: 1472, Parent PID: 5728COMMON

Execution Graph

Execution Coverage:	10.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	1.5%
Total number of Nodes:	1808
Total number of Limit Nodes:	86

Executed Functions

Function 00485F00 Relevance: 31.7, APIs: 21, Instructions: 205
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserCallbackDispatcher.NTDLL(0000004C), ref: 00485F72
GetSystemMetrics.USER32(0000004D), ref: 00485F7C
GetSystemMetrics.USER32(0000004E), ref: 00485F86
GetSystemMetrics.USER32(0000004F), ref: 00485F90
GetDC.USER32(00000000), ref: 00485F9A
GetDeviceCaps.GDI32(00000000,00000008), ref: 00485FAF
GetDeviceCaps.GDI32(?,0000000A), ref: 00485FBB
CreateCompatibleDC.GDI32(?), ref: 00485FC5
CreateCompatibleBitmap.GDI32(?,00000000,00000000), ref: 00485FDA
SelectObject.GDI32(?,00000000), ref: 00485FEE
BitBlt.GDI32(?,00000000,00000000,?,?,?,?,?,40CC0020), ref: 0048601D
SHCreateMemStream.SHLWAPI(00000000,00000000), ref: 0048604F
DeleteDC.GDI32(?), ref: 0048606E
ReleaseDC.USER32(00000000,?), ref: 00486077
DeleteObject.GDI32(?), ref: 00486083
IStream_Size.SHLWAPI(?,?,?), ref: 004860F5
IStream_Reset.SHLWAPI(?), ref: 00486104
IStream_Read.SHLWAPI(?,00000000,?,?), ref: 0048611E
DeleteDC.GDI32(?), ref: 00486175
ReleaseDC.USER32(00000000,?), ref: 00486183
DeleteObject.GDI32(?), ref: 0048618F

Memory Dump Source

Source File: 00000003.00000002.2242983706.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: Delete$CreateMetricsObjectStream_System$CapsCompatibleDeviceRelease$BitmapCallbackDispatcherReadResetSelectSizeStreamUser
String ID:
API String ID: 2798906502-0
Opcode ID: 99dc10b740a5f021b41c68854b237c0d4245f8800150c2945631f9edaba6f951
Instruction ID: 1540f068b23de5c11a4fec01122546931e44dbb37a8a944e45ab45a1281bc334
Opcode Fuzzy Hash: 99dc10b740a5f021b41c68854b237c0d4245f8800150c2945631f9edaba6f951
Instruction Fuzzy Hash: F4812971C01218AFDB11EB64DC49BEDBBB8EF09314F1041AAE509B7291DB742E84CF99

Function 00488400 Relevance: 27.7, APIs: 5, Strings: 10, Instructions: 1461
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00486990: EnumDisplayDevicesW.USER32(00000000,00000000,00000348,00000001), ref: 00486A68
Part of subcall function 00486990: EnumDisplayDevicesW.USER32(00000000,00000001,00000348,00000001), ref: 00486ABD

Part of subcall function 004868B0: RegGetValueA.KERNEL32(80000002,SOFTWARE\Microsoft\Windows NT\CurrentVersion,ProductName,00000002,00000000,?,?), ref: 00486916

Part of subcall function 004863F0: GetUserNameW.ADVAPI32(?,?), ref: 00486464

Part of subcall function 004864E0: GetComputerNameW.KERNEL32(?,?), ref: 00486554

Part of subcall function 004517F0: Concurrency::cancel_current_task.LIBCPMT ref: 004518C2

Part of subcall function 0044BAD0: Concurrency::cancel_current_task.LIBCPMT ref: 0044BBB3

GlobalMemoryStatusEx.KERNEL32(?,00000003), ref: 00488A6C
GetDesktopWindow.USER32 ref: 0048936A
GetWindowRect.USER32(00000000), ref: 00489371
_strftime.LIBCMT ref: 0048956B
GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,system,00000006), ref: 0048979A

Strings

ram, xrefs: 00488B55
>wfw, xrefs: 0048920B
user_name, xrefs: 004885A6
timezone, xrefs: 004899BF
time, xrefs: 004895E2
gpu, xrefs: 00488712
computer_name, xrefs: 00488CBE
%d-%m-%Y, %H:%M:%S, xrefs: 00489560
cpu, xrefs: 0048887B
system, xrefs: 004884CA, 00488633, 0048879C, 00488905, 00488A9E, 00488BDF, 00488D48, 00488F88, 004891A9, 00489507, 00489681, 00489933, 00489A78, 00489C87

Memory Dump Source

Source File: 00000003.00000002.2242983706.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: Name$Concurrency::cancel_current_taskDevicesDisplayEnumWindow$ComputerDesktopFileGlobalMemoryModuleRectStatusUserValue_strftime
String ID: %d-%m-%Y, %H:%M:%S$>wfw$computer_name$cpu$gpu$ram$system$time$timezone$user_name
API String ID: 3994675093-2215247992
Opcode ID: 780eb4c071b8c58362fb5c4d0a213da67d6cb8a55b1d61346fd39ba53df65c40
Instruction ID: 1ab1bce1cb2369babe93dc2c843a9f66333b387f055d73d8335e63cf3a34051b
Opcode Fuzzy Hash: 780eb4c071b8c58362fb5c4d0a213da67d6cb8a55b1d61346fd39ba53df65c40
Instruction Fuzzy Hash: FC037970C052A99BDB26DF28C8547DDBBB1AF19308F2482DEE44867242DB751F85CF92

Function 0047E240 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 199
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(00000008,00000000,8762CD73), ref: 0047E2A3
OpenProcessToken.ADVAPI32(00000000), ref: 0047E2AA
GetTokenInformation.KERNELBASE(00000000,00000014(TokenIntegrityLevel),?,00000004,00000004), ref: 0047E2CE
CloseHandle.KERNEL32(00000000), ref: 0047E2F3
ExitProcess.KERNEL32 ref: 0047E32D
OpenMutexA.KERNEL32(001F0001,00000000,?), ref: 0047E411
ExitProcess.KERNEL32 ref: 0047E420
CreateMutexA.KERNEL32(00000000,00000000,?), ref: 0047E436
ExitProcess.KERNEL32 ref: 0047E457
ReleaseMutex.KERNEL32(00000000), ref: 0047E525
CloseHandle.KERNEL32(00000000), ref: 0047E52C

Strings

SeImpersonatePrivilege, xrefs: 0047E341
SeDebugPrivilege, xrefs: 0047E337

Memory Dump Source

Source File: 00000003.00000002.2242983706.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: Process$ExitMutex$CloseHandleOpenToken$CreateCurrentInformationRelease
String ID: SeDebugPrivilege$SeImpersonatePrivilege
API String ID: 1905835197-3768118664
Opcode ID: 1304b057001cb0e859eaf618cd2e17930212c1f0f1b5904f04536edf5095bcb9
Instruction ID: e600725b129d9e3f70f3f4d3925b8df88ff981f4a24a656009bcaac003b6a44b
Opcode Fuzzy Hash: 1304b057001cb0e859eaf618cd2e17930212c1f0f1b5904f04536edf5095bcb9
Instruction Fuzzy Hash: 80817F70D01258EFDB00EFE6D9457DDBBB4EF08308F10815EE51AA7281DB785A05DB69

Function 00446400 Relevance: 20.1, APIs: 8, Strings: 3, Instructions: 833
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(?,8762CD73), ref: 004464FE
GetProcAddress.KERNEL32(00000000,?), ref: 0044664C
GetProcAddress.KERNEL32(?,?), ref: 0044678C
GetProcAddress.KERNEL32(?,?), ref: 00446831
GetProcAddress.KERNEL32(?,?), ref: 004468D6
GetProcAddress.KERNEL32(?,?), ref: 0044697B
GetProcAddress.KERNEL32(?,?), ref: 00446A27
FreeLibrary.KERNEL32(00000000), ref: 004473A1

Strings

vault, xrefs: 00447225
!F, xrefs: 00446482
system, xrefs: 004471E6

Memory Dump Source

Source File: 00000003.00000002.2242983706.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: AddressProc$Library$FreeLoad
String ID: system$vault$!F
API String ID: 2449869053-2452413646
Opcode ID: e0fea6c89a0f53085211ecf823e563bfcd2fd38e707c4234fd3e69986002ee46
Instruction ID: b3fd50756066dde9c2bcdca3b11f87412f5b17b86e41c1a20d378922be8368ac
Opcode Fuzzy Hash: e0fea6c89a0f53085211ecf823e563bfcd2fd38e707c4234fd3e69986002ee46
Instruction Fuzzy Hash: 2CA2DFB4D0426D8BDB25CFA8C884BEEBBB1BF59304F1081DAD948B7251DB385A85CF54

Function 00485840 Relevance: 16.1, APIs: 8, Strings: 1, Instructions: 364
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetOpenA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00485AB8
InternetOpenUrlA.WININET(00000000,?,?,00000000,84880100,00000000), ref: 00485B23
HttpQueryInfoW.WININET(00000000,00000013,?,?,00000000), ref: 00485B7C
HttpQueryInfoW.WININET(00000000,00000005,?,00000040,00000000), ref: 00485C0D
InternetQueryDataAvailable.WININET(00000000,?,00000000,00000000), ref: 00485C4F
InternetReadFile.WININET(00000000,00000000,?,0B911A77), ref: 00485CE0
InternetCloseHandle.WININET(00000000), ref: 00485DEE

Strings

dk{u, xrefs: 004858C5

Memory Dump Source

Source File: 00000003.00000002.2242983706.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: Internet$Query$HttpInfoOpen$AvailableCloseDataFileHandleRead
String ID: dk{u
API String ID: 1359475806-1025949191
Opcode ID: 27b0cd3a0b6fc00430f0ab845b11a26261cda9ec311c293bfde6673f79c1c1f5
Instruction ID: 61ea4010c365d261526b7633df9a1f3866779007c1279ae13805143fd257e1b9
Opcode Fuzzy Hash: 27b0cd3a0b6fc00430f0ab845b11a26261cda9ec311c293bfde6673f79c1c1f5
Instruction Fuzzy Hash: 320203B0D057599BDB20CFA4C944BDDBBB5BF19304F20819AE848BB241EB746A84CF95

Function 004B8545 Relevance: 15.2, APIs: 10, Instructions: 200
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesExW.KERNEL32(000000FF,00000000,?,00000001,?,?), ref: 004B85DD
GetLastError.KERNEL32 ref: 004B85E7
FindFirstFileW.KERNEL32(000000FF,?), ref: 004B85FE
GetLastError.KERNEL32 ref: 004B8609
FindClose.KERNEL32(00000000), ref: 004B8615
___std_fs_open_handle@16.LIBCPMT ref: 004B86CE

Memory Dump Source

Source File: 00000003.00000002.2242983706.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: ErrorFileFindLast$AttributesCloseFirst___std_fs_open_handle@16
String ID:
API String ID: 2340820627-0
Opcode ID: 26e86fa6e15967cd6674ed6e37e588395ab66286ab2511015f361a3ca517eeda
Instruction ID: b482ff722bd6c6e5562e69f300935f677b27db246a655513dfd80cbad8c50a56
Opcode Fuzzy Hash: 26e86fa6e15967cd6674ed6e37e588395ab66286ab2511015f361a3ca517eeda
Instruction Fuzzy Hash: 6271A174A01619AFCB60CF28DC84BEAB7B8BF15314F24466AE854E3380DF389D41CB65

Function 0048CB50 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 92
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(00000028,8762CD73,8762CD73,00000000,00000000), ref: 0048CBC1
OpenProcessToken.ADVAPI32(00000000), ref: 0048CBC8
LookupPrivilegeValueW.ADVAPI32(00000000,SeDebugPrivilege,?), ref: 0048CBDF
AdjustTokenPrivileges.KERNELBASE(?,00000000,?,00000010,00000000,00000000), ref: 0048CC10
CloseHandle.KERNEL32(00000000), ref: 0048CC2E

Strings

SeDebugPrivilege, xrefs: 0048CBD9

Memory Dump Source

Source File: 00000003.00000002.2242983706.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: ProcessToken$AdjustCloseCurrentHandleLookupOpenPrivilegePrivilegesValue
String ID: SeDebugPrivilege
API String ID: 3038321057-2896544425
Opcode ID: 0de4daaceb39ec4f5814627b6f1dd40d7c5fb6c13739ccbd22e93afb17c114b7
Instruction ID: c2b5bf8999928723eaabf61e86e1a0babf1022b92d12b441156265fc3f808218
Opcode Fuzzy Hash: 0de4daaceb39ec4f5814627b6f1dd40d7c5fb6c13739ccbd22e93afb17c114b7
Instruction Fuzzy Hash: 4631A471D01208AFDB10DFA5DD85BEEBBB8EB09710F14422BE911B7280DB745A44CBB5

Function 004473D0 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 301processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,8762CD73), ref: 0044741C
Process32FirstW.KERNEL32(00000000,?), ref: 00447468
Process32NextW.KERNEL32(?,0000022C), ref: 004475CD
CloseHandle.KERNEL32(?), ref: 004478D2

Strings

[PID: , xrefs: 004474B1

Memory Dump Source

Source File: 00000003.00000002.2242983706.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID: [PID:
API String ID: 420147892-2210602247
Opcode ID: cefa39f860a061b5cdc928b49f93e6ea5fa11b751c85222641e7e19468bf29e5
Instruction ID: 3632983ffbfa210010dfb9a713b5006bf5dbac80d679a8e5b8b4f374b17b9b69
Opcode Fuzzy Hash: cefa39f860a061b5cdc928b49f93e6ea5fa11b751c85222641e7e19468bf29e5
Instruction Fuzzy Hash: 0AE14770D112689BDB2ADF24CC807AEBBB9BF59304F1481D9E84867251DB346F89CF45

Function 004402D0 Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 333fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(00000000,?,?), ref: 004403C0
FindNextFileW.KERNELBASE(00000000,?), ref: 004406F2

Strings

content, xrefs: 0044063C
filename, xrefs: 004405E4

Memory Dump Source

Source File: 00000003.00000002.2242983706.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: FileFind$FirstNext
String ID: content$filename
API String ID: 1690352074-474635906
Opcode ID: 3df7f202a6b99253f354de22ded639a46978a58fefe962044121c03344fab8ef
Instruction ID: 3fd07a7a2c97014430c74f1e6d5836f1a3ad12268408335d8deab24a75892f91
Opcode Fuzzy Hash: 3df7f202a6b99253f354de22ded639a46978a58fefe962044121c03344fab8ef
Instruction Fuzzy Hash: 2BD1D430D01249DBEB15EB64CD457EEBBB4AF21308F1440AEE505A7292DB785F48CB96

Function 00485350 Relevance: 6.3, APIs: 4, Instructions: 316networkCOMMON

Download Yara Rule

APIs

recv.WS2_32(?,00002000,00000000), ref: 004854A4
recv.WS2_32(?,00000001,00000000), ref: 004857E2
closesocket.WS2_32(00000254), ref: 004857EE
WSACleanup.WS2_32 ref: 004857F4

Memory Dump Source

Source File: 00000003.00000002.2242983706.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: recv$Cleanupclosesocket
String ID:
API String ID: 146070474-0
Opcode ID: 9e36abc3380925dd93690334c8facdcdb208839f31d4ee637cc8ac082e786f44
Instruction ID: ea48c0c3f42896101b1dfecbe024c21eb3956ad5c3a4809403442742827d540a
Opcode Fuzzy Hash: 9e36abc3380925dd93690334c8facdcdb208839f31d4ee637cc8ac082e786f44
Instruction Fuzzy Hash: 4CE19C70D01298DEDB14EB64CC49BDEBBB2BF14308F1041DAE449AB292DB745E88DF95

Function 00487780 Relevance: 5.8, APIs: 1, Strings: 2, Instructions: 515timeCOMMON

Download Yara Rule

APIs

GetTimeZoneInformation.KERNEL32(?,8762CD73,00000000,000000BF), ref: 00487C87

Strings

[UTC, xrefs: 00487C45
@Zb=, xrefs: 00487A4F

Memory Dump Source

Source File: 00000003.00000002.2242983706.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: InformationTimeZone
String ID: @Zb=$[UTC
API String ID: 565725191-730387550
Opcode ID: cf8fb0669151e3915c1c56c918cda204041e77f9a4f9e4b93b5b3df9b86f4cc7
Instruction ID: 6d71337f0f8cf227c7c56c381cd8fae4285dcd83216f0cb77706b7edbf0b928b
Opcode Fuzzy Hash: cf8fb0669151e3915c1c56c918cda204041e77f9a4f9e4b93b5b3df9b86f4cc7
Instruction Fuzzy Hash: E0520270D052688BDB25CF28CC947DDBBB1BF59304F1082DAD949AB281DB756B85CF84

Function 004A1074 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 156timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0049C0BD: RtlFreeHeap.NTDLL(00000000,00000000,?,004A4A11,?,00000000,?,?,004A4CB2,?,00000007,?,?,004A3378,?,?), ref: 0049C0D3
Part of subcall function 0049C0BD: GetLastError.KERNEL32(?,?,004A4A11,?,00000000,?,?,004A4CB2,?,00000007,?,?,004A3378,?,?), ref: 0049C0DE

GetTimeZoneInformation.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,004A1227,00000000,00000000,00000000), ref: 004A10E6

Strings

Eastern Summer Time, xrefs: 004A1193
Eastern Standard Time, xrefs: 004A117F

Memory Dump Source

Source File: 00000003.00000002.2242983706.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: ErrorFreeHeapInformationLastTimeZone
String ID: Eastern Standard Time$Eastern Summer Time
API String ID: 3335090040-239921721
Opcode ID: cbda99af75327c4c820746f38f84b7f1daa917d9e057987815aac769d108124b
Instruction ID: 53762b2ebd1cb462dfa51e434dc7c6f7f2cc61e8d19f93444a713380c049c16d
Opcode Fuzzy Hash: cbda99af75327c4c820746f38f84b7f1daa917d9e057987815aac769d108124b
Instruction Fuzzy Hash: 73410871C00224ABDB10AF76DC45A9F7BB8EF6A754F10415BF510EB2A1E7349D04DB98

Function 004B84C0 Relevance: 4.5, APIs: 3, Instructions: 35COMMONLIBRARYCODE

Download Yara Rule

APIs

FindClose.KERNEL32(000000FF,?,004B84EE,00000001,?,?,00437D69,?,004BDC4D,00000001,?,?,?,8762CD73,00000001), ref: 004B84CC
FindFirstFileExW.KERNEL32(000000FF,00000001,8762CD73,00000000,00000000,00000000,00000001,00000001,?,?,004B84EE,00000001,?,?,00437D69,?), ref: 004B84FB
GetLastError.KERNEL32(?,004B84EE,00000001,?,?,00437D69,?,004BDC4D,00000001,?,?,?,8762CD73,00000001), ref: 004B850D

Memory Dump Source

Source File: 00000003.00000002.2242983706.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: Find$CloseErrorFileFirstLast
String ID:
API String ID: 4020440971-0
Opcode ID: 6891505d0e316c560b8af891ce29886cce9dd01a211028f8c8b4780eaf2fe176
Instruction ID: a5a0d7868366c0cca89b591e166bcddb9b03d08ebbd2c2fb18ba3c3c76c3338f
Opcode Fuzzy Hash: 6891505d0e316c560b8af891ce29886cce9dd01a211028f8c8b4780eaf2fe176
Instruction Fuzzy Hash: 0AF03071001109BFDB216FA4EC08AAA7B9DEB14360B10862ABD28C55A0EA359961DB79

Function 004479C0 Relevance: 4.1, APIs: 1, Strings: 1, Instructions: 647COMMON

Download Yara Rule

APIs

Part of subcall function 00487290: RegOpenKeyExA.KERNEL32(80000001,0047F265,00000000,00020019,00000000,8762CD73,?,0051C288), ref: 0048735B
Part of subcall function 00487290: RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000000,00000000,00000000,00000000,00000000), ref: 00487397

Part of subcall function 004870B0: RegOpenKeyExA.KERNEL32(80000001,0051C570,00000000,00020019,00000000,8762CD73,0051C570,0051C2A0), ref: 00487182
Part of subcall function 004870B0: RegQueryValueExA.KERNEL32(00000000,?,00000000,000F003F,?,00000400), ref: 004871B6

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 004487A3

Part of subcall function 004870B0: RegCloseKey.ADVAPI32(00000000), ref: 00487260

Strings

0hC, xrefs: 00448799

Memory Dump Source

Source File: 00000003.00000002.2242983706.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: Open$CloseEnumIos_base_dtorQueryValuestd::ios_base::_
String ID: 0hC
API String ID: 3553622603-2581318919
Opcode ID: ade7bf363ed15e6875cf1af1c8a60079e7d2754fd8a921585c80e4634e37238f
Instruction ID: d381e0b8d15ce89c3a027b92e8a5ae116750b180a2e65f5cba22683de7249f8f
Opcode Fuzzy Hash: ade7bf363ed15e6875cf1af1c8a60079e7d2754fd8a921585c80e4634e37238f
Instruction Fuzzy Hash: EA82CEB4E152688FEB25CF18C8957DDBBB0BF5A304F5082DAD98DA7241DB305A85CF81

Function 0047A610 Relevance: 3.1, APIs: 2, Instructions: 119encryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000001,?), ref: 0047A678
LocalFree.KERNEL32(?,00000000), ref: 0047A70F

Memory Dump Source

Source File: 00000003.00000002.2242983706.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: CryptDataFreeLocalUnprotect
String ID:
API String ID: 1561624719-0
Opcode ID: 23f8f3dfd76d3946956684746ccb5c99c2b1de592e134c678ee3552ffd4f36d7
Instruction ID: 0fc5e8941a16b16f9458543aa06cdc6e77fe0ca1878954e15eaf8ff6be4b297f
Opcode Fuzzy Hash: 23f8f3dfd76d3946956684746ccb5c99c2b1de592e134c678ee3552ffd4f36d7
Instruction Fuzzy Hash: 86518B70C00249EBEB00DFA5D845BDEFBB4FF54708F14821AE81477281D7B96A98CBA5

Function 00487550 Relevance: 1.6, APIs: 1, Instructions: 133COMMON

Download Yara Rule

APIs

GetLogicalDriveStringsW.KERNEL32(00000104,?,8762CD73), ref: 00487605

Memory Dump Source

Source File: 00000003.00000002.2242983706.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: DriveLogicalStrings
String ID:
API String ID: 2022863570-0
Opcode ID: af7986355f76353f56621d05ed0878166b8efb0a331a21fa16df84ccda1fe4cc
Instruction ID: 0be71067b94349f3b163f10fc7865c9901b3f86c171c2f757c76e38bbf7f7ec5
Opcode Fuzzy Hash: af7986355f76353f56621d05ed0878166b8efb0a331a21fa16df84ccda1fe4cc
Instruction Fuzzy Hash: 3351BD70C05318DBDB20DF64D85979EB7B0EF18304F1082DED409A7291EBB86A88CB95

Function 004863F0 Relevance: 1.6, APIs: 1, Instructions: 61COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,?), ref: 00486464

Memory Dump Source

Source File: 00000003.00000002.2242983706.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: f4ed9f5e37941df1e9ba9867385f1ec3f0cb7986d12087e88cefc21d8231c34a
Instruction ID: 991b9e5c4f1dd7985d860474454b41f109cd49006b683c09ab2e27c6457cb47f
Opcode Fuzzy Hash: f4ed9f5e37941df1e9ba9867385f1ec3f0cb7986d12087e88cefc21d8231c34a
Instruction Fuzzy Hash: AF217FB0D043189BD721DF15C844B9ABBF4FB08714F0046AEE84997380DBB9A6849BE5

Function 00486C50 Relevance: 1.4, Strings: 1, Instructions: 198COMMON

Download Yara Rule

Strings

cores, xrefs: 00486E4E

Memory Dump Source

Source File: 00000003.00000002.2242983706.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drop1.jbxd

Yara matches

Similarity

API ID:
String ID: cores
API String ID: 0-2370456839
Opcode ID: 7caecc748150b05fedb2737b290fa2d10d67063e027dfbdfaad7aac65fe8cbf0
Instruction ID: e3a9e89045bf121aadbf864e887aeb25ba0c58f762de233e8adf5c73134b1a6d
Opcode Fuzzy Hash: 7caecc748150b05fedb2737b290fa2d10d67063e027dfbdfaad7aac65fe8cbf0
Instruction Fuzzy Hash: 2B916871D003599BDB00CFA8C9547EEFBB4FF59304F14825AE404BB292EBB56A84CB91

Function 00480C80 Relevance: 19.8, APIs: 13, Instructions: 258
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004808F0: InitializeCriticalSectionEx.KERNEL32(0051C7AC,00000000,00000000), ref: 0048096F
Part of subcall function 004808F0: GetLastError.KERNEL32 ref: 00480979

EnterCriticalSection.KERNEL32(00000004,8762CD73,?,?), ref: 00480CD8
GdiplusStartup.GDIPLUS(00000000,00000001,?), ref: 00480D08
LeaveCriticalSection.KERNEL32(00000004), ref: 00480D13
LeaveCriticalSection.KERNEL32(00000004,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00480D42
GdipGetImageEncodersSize.GDIPLUS(?,?), ref: 00480D50
__alloca_probe_16.LIBCMT ref: 00480D7E
GdipGetImageEncoders.GDIPLUS(?,?,00000000), ref: 00480DCE
GdipCreateBitmapFromScan0.GDIPLUS(?,?,?,0026200A,?,?), ref: 00480EB3
GdipSaveImageToStream.GDIPLUS(00000000,?,?,00000000), ref: 00480ED0
GdipDisposeImage.GDIPLUS(00000000), ref: 00480F33
GdipDisposeImage.GDIPLUS(00000000), ref: 00480F4C

Memory Dump Source

Source File: 00000003.00000002.2242983706.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: Gdip$Image$CriticalSection$DisposeEncodersLeave$BitmapCreateEnterErrorFromGdiplusInitializeLastSaveScan0SizeStartupStream__alloca_probe_16
String ID:
API String ID: 1308617310-0
Opcode ID: db8e19989c3c8e354b887b54b5669c89f7a5afa25811b29cf81357a5f4059125
Instruction ID: f4feccb951fe1b922ecb3dfaf5b8302156747445c0b76c240fb24b0f4f51c94e
Opcode Fuzzy Hash: db8e19989c3c8e354b887b54b5669c89f7a5afa25811b29cf81357a5f4059125
Instruction Fuzzy Hash: D1A165B1D10208DFDB50DFA4C984BAEBBF4FF49314F24452AE905A7340D778A949CBA9

Function 00481B10 Relevance: 17.8, APIs: 7, Strings: 3, Instructions: 293
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00485E30: GetUserGeoID.KERNEL32(00000010), ref: 00485E6C
Part of subcall function 00485E30: GetGeoInfoA.KERNEL32(00000000,00000004,00000000,00000000,00000000), ref: 00485E7E
Part of subcall function 00485E30: GetGeoInfoA.KERNEL32(0000000F,00000004,?,00000000,00000000), ref: 00485ED6

WSAStartup.WS2_32(00000202,00516D04), ref: 00481C85
socket.WS2_32(00000002,00000001,00000000), ref: 00481C98
htons.WS2_32(00000002), ref: 00481CBF
inet_pton.WS2_32(00000002,00000000,00516E98), ref: 00481DA2
connect.WS2_32(00516E94,00000010), ref: 00481DB5
closesocket.WS2_32 ref: 00481DD5
WSACleanup.WS2_32 ref: 00481DDB

Strings

geo, xrefs: 00481C1D
NG, xrefs: 00481B1D
system, xrefs: 00481B74

Memory Dump Source

Source File: 00000003.00000002.2242983706.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: Info$CleanupStartupUserclosesocketconnecthtonsinet_ptonsocket
String ID: NG$geo$system
API String ID: 213021568-968879199
Opcode ID: 3e51a562f8bb916ff5cdbc648a8933530491576e42c442edfc0125d67360bed5
Instruction ID: a79096e42c26a1a604384fcb43a931ed9af1c00745f33276f8ffcea807cfd111
Opcode Fuzzy Hash: 3e51a562f8bb916ff5cdbc648a8933530491576e42c442edfc0125d67360bed5
Instruction Fuzzy Hash: 1DC1AE70D01248DBDB00EFA8C8457DEBBB5FF15308F14421BE854AB391EBB86A85CB95

Function 004BC57A Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 273
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004BC233: CreateFileW.KERNEL32(?,00000000,?,004BC623,?,?,00000000,?,004BC623,?,0000000C), ref: 004BC250

GetLastError.KERNEL32 ref: 004BC68E
__dosmaperr.LIBCMT ref: 004BC695
GetFileType.KERNEL32(00000000), ref: 004BC6A1
GetLastError.KERNEL32 ref: 004BC6AB
__dosmaperr.LIBCMT ref: 004BC6B4
CloseHandle.KERNEL32(00000000), ref: 004BC6D4
CloseHandle.KERNEL32(004BB653), ref: 004BC821
GetLastError.KERNEL32 ref: 004BC853
__dosmaperr.LIBCMT ref: 004BC85A

Strings

H, xrefs: 004BC7DF

Memory Dump Source

Source File: 00000003.00000002.2242983706.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
String ID: H
API String ID: 4237864984-2852464175
Opcode ID: 1092716943437c36cfa02252dfbb3b8d28f6a4b1d2fea1c18a37bf8b19ebdc4d
Instruction ID: e4caf95108e2d56c13f9780512823c5111e6df0be3dd416bceb2684eca6e9c1f
Opcode Fuzzy Hash: 1092716943437c36cfa02252dfbb3b8d28f6a4b1d2fea1c18a37bf8b19ebdc4d
Instruction Fuzzy Hash: 65A13632A041549FCF19AF68DCD1BEE3BA1AB46314F14015FF8119F391CB798906CBA9

Function 00450EF0 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 130
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00450F2D
std::_Lockit::_Lockit.LIBCPMT ref: 00450F4F
std::_Lockit::~_Lockit.LIBCPMT ref: 00450F77
std::_Facet_Register.LIBCPMT ref: 00451071
std::_Lockit::~_Lockit.LIBCPMT ref: 0045109B

Strings

PbC, xrefs: 00451032
p]C, xrefs: 00451011
`aC, xrefs: 0045101E

Memory Dump Source

Source File: 00000003.00000002.2242983706.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_Register
String ID: PbC$`aC$p]C
API String ID: 459529453-2418293346
Opcode ID: 47ef1fd8d8b019aabc3f0f5610737af1e43986cebb35cd2acfb9168d2d0dbd79
Instruction ID: e392c769357d74c7cb0e8da2cb70d10442ea48cde3856dc7faeb71697ce32a0a
Opcode Fuzzy Hash: 47ef1fd8d8b019aabc3f0f5610737af1e43986cebb35cd2acfb9168d2d0dbd79
Instruction Fuzzy Hash: 9A519E71900249DFDF20CF99C5417AEBBB0FB14318F24845ED805AB382D7B9AE49CB95

Function 00481110 Relevance: 11.0, APIs: 4, Strings: 2, Instructions: 526
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 004812EC
GetFileSize.KERNEL32(00000000,00000000,?,?,00000000,000000B8), ref: 004812FC
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00481388
ReadFile.KERNEL32(00000000,00000000,00516C10,00000000,00000000), ref: 004813A4

Strings

exists, xrefs: 0048181F
0hC, xrefs: 004812E2

Memory Dump Source

Source File: 00000003.00000002.2242983706.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: File$Ios_base_dtorPointerReadSizestd::ios_base::_
String ID: 0hC$exists
API String ID: 418202444-4085241440
Opcode ID: 849f238cd3a392783c80e55f8389a1395318525961415ca9d71f5ff49262db28
Instruction ID: 03b619e30c80654d4b10cf1501dd509fce63877f60a48615618d7203a258c35b
Opcode Fuzzy Hash: 849f238cd3a392783c80e55f8389a1395318525961415ca9d71f5ff49262db28
Instruction Fuzzy Hash: 3E425D70D01248DFDB10DFA9C9447DDBBF4BF19308F10819AE849A7291DB746A89CF95

Function 00453280 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 340
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 00453446
___std_exception_destroy.LIBVCRUNTIME ref: 00453463

Part of subcall function 004AFA0C: RaiseException.KERNEL32(E06D7363,00000001,00000003,0043FE44,?,?,?,004B9080,0043FE44,00513AB0,?,0043FE44,?,?,0000000C,8762CD73), ref: 004AFA6C

___std_exception_destroy.LIBVCRUNTIME ref: 004536B0
___std_exception_destroy.LIBVCRUNTIME ref: 004536CD

Strings

value, xrefs: 00453386, 004535E5
MC, xrefs: 0045343C, 00453458, 004536A6, 004536C2

Memory Dump Source

Source File: 00000003.00000002.2242983706.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: ___std_exception_destroy$ExceptionRaise
String ID: MC$value
API String ID: 299339551-3840657116
Opcode ID: 105946c5cbd8b82caa2ff389fd77db40c33b1abb7ad3302a948b5beaa238df8e
Instruction ID: 0b049260404a019bd3923239173dd3b15bf9369a861e2bc94eedd162a5d5976f
Opcode Fuzzy Hash: 105946c5cbd8b82caa2ff389fd77db40c33b1abb7ad3302a948b5beaa238df8e
Instruction Fuzzy Hash: 1EF16B70C05298DEEB20DB65C954BDEFBB4AF19304F1481DED84963282E7746B88CF96

Function 0049EF0E Relevance: 9.3, APIs: 6, Instructions: 292
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000003.00000002.2242983706.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drop1.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39d1791a85c6a05d2366e13811c19a5ff8bd139f1b7508f647d7bcfc961fa37e
Instruction ID: af9c87e70908a1ee06dfbc346dd9d7a470d4d3b04964572cafa80a59c2292356
Opcode Fuzzy Hash: 39d1791a85c6a05d2366e13811c19a5ff8bd139f1b7508f647d7bcfc961fa37e
Instruction Fuzzy Hash: ACB13274A04249EFEF11CF99C841BAE7FB1AF46304F14417AE5009B392C7B99D4ACB99

Function 0049865A Relevance: 9.3, APIs: 6, Instructions: 265COMMON

Download Yara Rule

APIs

__allrem.LIBCMT ref: 004987E2
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 004987FE
__allrem.LIBCMT ref: 00498815
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00498833
__allrem.LIBCMT ref: 0049884A
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00498868

Memory Dump Source

Source File: 00000003.00000002.2242983706.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@
String ID:
API String ID: 1992179935-0
Opcode ID: 0bad0c18fe0cf381acad9996688c966a33eada49a23c210a765f4fa7ac2e53a6
Instruction ID: bac2f8d64b4771d1480d5067db4f3a3676e567bfb19d99c183f063f20f68270c
Opcode Fuzzy Hash: 0bad0c18fe0cf381acad9996688c966a33eada49a23c210a765f4fa7ac2e53a6
Instruction Fuzzy Hash: A68107B26007069BDB20EA6DCC41B5B7BE9AF52364F24453FF111DB791EB78D9008B98

Function 004823F0 Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 280COMMON

Download Yara Rule

Strings

exists, xrefs: 0048291E
0, xrefs: 004827FE
0hC, xrefs: 00482852

Memory Dump Source

Source File: 00000003.00000002.2242983706.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: Ios_base_dtorstd::ios_base::_
String ID: 0$0hC$exists
API String ID: 323602529-1229763112
Opcode ID: f10948b3ed40f3b076f8b225239c75273635f3694046d4e0320974136430c3f1
Instruction ID: 8ad686ceee80f5ac92384c61aa111afe13dce58c6585d204e44adfbc4e8d440e
Opcode Fuzzy Hash: f10948b3ed40f3b076f8b225239c75273635f3694046d4e0320974136430c3f1
Instruction Fuzzy Hash: 81D18070D0528CDAEB10DBA8CA45BDCBBF4AF19308F2440DDE4456B282DBB95F48DB56

Function 004865D0 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 230registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0047FD70: ___std_fs_get_current_path@8.LIBCPMT ref: 0047FE92

GetVolumeInformationW.KERNEL32(?,?,00000100,?,?,?,?,00000100,00000000,?,8762CD73,?,?), ref: 00486757
RegGetValueA.KERNEL32(80000002,SOFTWARE\Microsoft\Windows NT\CurrentVersion,ProductName,00000002,00000000,?,?), ref: 00486916

Strings

ProductName, xrefs: 00486900
SOFTWARE\Microsoft\Windows NT\CurrentVersion, xrefs: 00486905

Memory Dump Source

Source File: 00000003.00000002.2242983706.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: InformationValueVolume___std_fs_get_current_path@8
String ID: ProductName$SOFTWARE\Microsoft\Windows NT\CurrentVersion
API String ID: 2814272438-1787575317
Opcode ID: b1404d09f7114e8511fbbac145fb6ec7f4eb5f2e1f33eee02c53c21e1c4c82cd
Instruction ID: 5513a57b40c567382305f19abecc614c7fb65df7785b10e0462d816fc7d7abf5
Opcode Fuzzy Hash: b1404d09f7114e8511fbbac145fb6ec7f4eb5f2e1f33eee02c53c21e1c4c82cd
Instruction Fuzzy Hash: DFA18BB1C012199BDB21DF55CD59BE9B7B4FF14304F1042EAE419A7281EB786B88CF94

Function 004A0DE2 Relevance: 5.7, APIs: 1, Strings: 2, Instructions: 408timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetTimeZoneInformation.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,004A1227,00000000,00000000,00000000), ref: 004A10E6

Strings

Eastern Summer Time, xrefs: 004A1193
Eastern Standard Time, xrefs: 004A117F

Memory Dump Source

Source File: 00000003.00000002.2242983706.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: InformationTimeZone
String ID: Eastern Standard Time$Eastern Summer Time
API String ID: 565725191-239921721
Opcode ID: a0c3fa71ac075b893766dc5b0ab0f3ca29078ed841b914ae773539177a8584d6
Instruction ID: d63cae11faca7fbaaedfd5ec0c01f193a5a5e64d1a9f5e85edff99bc4745f09f
Opcode Fuzzy Hash: a0c3fa71ac075b893766dc5b0ab0f3ca29078ed841b914ae773539177a8584d6
Instruction Fuzzy Hash: D5C15872D00211ABDB20AB65CC02ABF7BB9EF76754F10405BF901EB291E7788E41D798

Function 00481F10 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 282COMMON

Download Yara Rule

APIs

Part of subcall function 0045D680: ___std_fs_convert_narrow_to_wide@20.LIBCPMT ref: 0045D726
Part of subcall function 0045D680: ___std_fs_convert_narrow_to_wide@20.LIBCPMT ref: 0045D750

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00482387

Part of subcall function 0043E440: std::ios_base::_Ios_base_dtor.LIBCPMT ref: 0043E4CF

Strings

exists, xrefs: 004823DA
0hC, xrefs: 0048237C

Memory Dump Source

Source File: 00000003.00000002.2242983706.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: Ios_base_dtor___std_fs_convert_narrow_to_wide@20std::ios_base::_
String ID: 0hC$exists
API String ID: 1525435645-4085241440
Opcode ID: 8ca7fd5849306998ec001e4bdecb4b4743a0745ed80b2030e0a7e1d66a3192b0
Instruction ID: 349907f898d0770bf1c6c6bee16b757a414fbaa0545e2b95a55e182eb82389be
Opcode Fuzzy Hash: 8ca7fd5849306998ec001e4bdecb4b4743a0745ed80b2030e0a7e1d66a3192b0
Instruction Fuzzy Hash: 1ED19F70D0528CDAEB10DBA8CA45BDCBBF0AF19308F2480DDD4456B282D7B95F58DB56

Function 00438180 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 85COMMON

Download Yara Rule

APIs

___std_fs_directory_iterator_advance@8.LIBCPMT ref: 004381BC

Part of subcall function 004B849F: FindNextFileW.KERNELBASE(?,00000001,?,00437D97,?,00000001,?,004BDC4D,00000001,?,?,?,8762CD73,00000001), ref: 004B84A8

Strings

directory_iterator::operator++, xrefs: 00438294
., xrefs: 004381CE

Memory Dump Source

Source File: 00000003.00000002.2242983706.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: FileFindNext___std_fs_directory_iterator_advance@8
String ID: .$directory_iterator::operator++
API String ID: 3878998205-1036657373
Opcode ID: 42ea8ddbda2b7e0b12b5802c67e6a5f09428df7f782a6b2438fae6bd72fb2b67
Instruction ID: 735a56af49808cf236c7d8626bd4983a1e4e1118483563b87a501f55d85a1d57
Opcode Fuzzy Hash: 42ea8ddbda2b7e0b12b5802c67e6a5f09428df7f782a6b2438fae6bd72fb2b67
Instruction Fuzzy Hash: C7318D70A047188BCF30DF59C8887ABF7B4EB49310F14429EE45997391DB395E85CA84

Function 00435DA0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 60COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00435DCB
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00435E2E

Part of subcall function 004B9356: _Yarn.LIBCPMT ref: 004B9375
Part of subcall function 004B9356: _Yarn.LIBCPMT ref: 004B9399

Strings

bad locale name, xrefs: 00435E51

Memory Dump Source

Source File: 00000003.00000002.2242983706.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: Yarnstd::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 1908188788-1405518554
Opcode ID: 4f591d35f3d0401d16c29d601d846a696ee7aa1707a5175f538b14ce155db12b
Instruction ID: 3ec4c6a4a97d0462a05707b65000259191fcf5f6abdba4908dc577763c239046
Opcode Fuzzy Hash: 4f591d35f3d0401d16c29d601d846a696ee7aa1707a5175f538b14ce155db12b
Instruction Fuzzy Hash: 3B210570805784DFD320CF69C90478BBFF4AF15714F14868ED48597781D3B9AA04CBA5

Function 004868B0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 59registryCOMMON

Download Yara Rule

APIs

RegGetValueA.KERNEL32(80000002,SOFTWARE\Microsoft\Windows NT\CurrentVersion,ProductName,00000002,00000000,?,?), ref: 00486916

Strings

ProductName, xrefs: 00486900
SOFTWARE\Microsoft\Windows NT\CurrentVersion, xrefs: 00486905

Memory Dump Source

Source File: 00000003.00000002.2242983706.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: Value
String ID: ProductName$SOFTWARE\Microsoft\Windows NT\CurrentVersion
API String ID: 3702945584-1787575317
Opcode ID: b1b14b774ef6c570b057e3b558ffe0deac3071ed0933685e6c950abb9736e9bf
Instruction ID: c2d08890748770af0873008191db5a05c2fa34d27609d4939fc155a72502f57e
Opcode Fuzzy Hash: b1b14b774ef6c570b057e3b558ffe0deac3071ed0933685e6c950abb9736e9bf
Instruction Fuzzy Hash: 95218EB09003599BDB20DF54C805BEABBF8FF04704F10465EE845A7681DBB86A44CB95

Function 00487290 Relevance: 4.7, APIs: 3, Instructions: 178registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNEL32(80000001,0047F265,00000000,00020019,00000000,8762CD73,?,0051C288), ref: 0048735B
RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000000,00000000,00000000,00000000,00000000), ref: 00487397
RegCloseKey.ADVAPI32(00000000), ref: 0048751D

Memory Dump Source

Source File: 00000003.00000002.2242983706.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: CloseEnumOpen
String ID:
API String ID: 1332880857-0
Opcode ID: 583436978cce415da765378ea93a3ed95bf41f57cd7b16fc1002d349e714ed29
Instruction ID: e90b3dd054a924dd9803ab5f17a38fc1c4cefb0d6438d00707aa441ccba3a8d8
Opcode Fuzzy Hash: 583436978cce415da765378ea93a3ed95bf41f57cd7b16fc1002d349e714ed29
Instruction Fuzzy Hash: E3717FF0D012189FDB20DF24CD94B9DB7B4EB54304F1082DAEA19A7281D774AE88CF99

Function 004870B0 Relevance: 4.6, APIs: 3, Instructions: 115registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNEL32(80000001,0051C570,00000000,00020019,00000000,8762CD73,0051C570,0051C2A0), ref: 00487182
RegQueryValueExA.KERNEL32(00000000,?,00000000,000F003F,?,00000400), ref: 004871B6
RegCloseKey.ADVAPI32(00000000), ref: 00487260

Memory Dump Source

Source File: 00000003.00000002.2242983706.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: CloseOpenQueryValue
String ID:
API String ID: 3677997916-0
Opcode ID: 57d060fa11377f52f079fc837384727404e649e1529402bdcb096a3e64267e6d
Instruction ID: b9c4edd99e38da91ddb4c738108b0054469e00b62f6e0a688ac56e9026d709b2
Opcode Fuzzy Hash: 57d060fa11377f52f079fc837384727404e649e1529402bdcb096a3e64267e6d
Instruction Fuzzy Hash: 905130B0D042189BDB20DF15CD54B9AB7F8FF45708F5042DEE609A7281DB74AA88CF99

Function 004855F0 Relevance: 4.6, APIs: 3, Instructions: 99networkCOMMON

Download Yara Rule

APIs

recv.WS2_32(?,00000001,00000000), ref: 004857E2
closesocket.WS2_32(00000254), ref: 004857EE
WSACleanup.WS2_32 ref: 004857F4

Memory Dump Source

Source File: 00000003.00000002.2242983706.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: Cleanupclosesocketrecv
String ID:
API String ID: 3447645871-0
Opcode ID: a55422f294b4942afa1ff90dfbe741e21dd202ebe771de9cafeea328bec9a277
Instruction ID: c065b03366e761df0b34e2ad76ec595a4b6e3bb6db0e63c2aea2bbb819f94b56
Opcode Fuzzy Hash: a55422f294b4942afa1ff90dfbe741e21dd202ebe771de9cafeea328bec9a277
Instruction Fuzzy Hash: 6C415830D11398CEEB14EB65CC59BDEBB71AF10308F1081DAE449672A2DB741E88DFA5

Function 00485E30 Relevance: 4.6, APIs: 3, Instructions: 65COMMON

Download Yara Rule

APIs

GetUserGeoID.KERNEL32(00000010), ref: 00485E6C
GetGeoInfoA.KERNEL32(00000000,00000004,00000000,00000000,00000000), ref: 00485E7E
GetGeoInfoA.KERNEL32(0000000F,00000004,?,00000000,00000000), ref: 00485ED6

Memory Dump Source

Source File: 00000003.00000002.2242983706.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: Info$User
String ID:
API String ID: 2017065092-0
Opcode ID: 76db3dc4c87bbc6f384a5473c1c7e0f0467f6834ab8a05054a61e1c1351183cd
Instruction ID: dee3d2b381a88aa75edb4726eebd2668ef991be1adfc48943d59dd3409b8a73b
Opcode Fuzzy Hash: 76db3dc4c87bbc6f384a5473c1c7e0f0467f6834ab8a05054a61e1c1351183cd
Instruction Fuzzy Hash: 60219D70A40305ABE730DF65DD09B5BBBF8EB44B14F104A1EF545AB6C0D7B9AA048BE4

Function 004A2897 Relevance: 4.5, APIs: 3, Instructions: 15COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,004A2891,00000016,0049036B,?,?,8762CD73,0049036B,?), ref: 004A28A8
TerminateProcess.KERNEL32(00000000,?,004A2891,00000016,0049036B,?,?,8762CD73,0049036B,?), ref: 004A28AF
ExitProcess.KERNEL32 ref: 004A28C1

Memory Dump Source

Source File: 00000003.00000002.2242983706.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: c52b8aea0878e361db6f998eabd52a91712daacfbdb63a7d2bb12d779e64a9bf
Instruction ID: 5f52cdf8944b70cf92df4f225d6e01553ce615c3954620652ef0a1f31c52b3c3
Opcode Fuzzy Hash: c52b8aea0878e361db6f998eabd52a91712daacfbdb63a7d2bb12d779e64a9bf
Instruction Fuzzy Hash: ACD09E71001108BBDF423F65ED0DB8E3F2AEF55745F044026B9095A131DB799995EB98

Function 0047EE90 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 177COMMON

Download Yara Rule

APIs

Part of subcall function 0047F1C0: RegOpenKeyExA.KERNEL32(80000001,0051C570,00000000,00020019,00000000,8762CD73), ref: 0047F211
Part of subcall function 0047F1C0: RegCloseKey.ADVAPI32(00000000), ref: 0047F221

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 0047F194

Strings

0hC, xrefs: 0047F18D

Memory Dump Source

Source File: 00000003.00000002.2242983706.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: CloseIos_base_dtorOpenstd::ios_base::_
String ID: 0hC
API String ID: 1131316584-2581318919
Opcode ID: 7cba46937cda891c258594ace6fbaf3fef31f328805038bc20a4f0a0119cf12a
Instruction ID: cfb713b882ce29762410958d43b6c09695d359a02ab63b143eff75d03a191730
Opcode Fuzzy Hash: 7cba46937cda891c258594ace6fbaf3fef31f328805038bc20a4f0a0119cf12a
Instruction Fuzzy Hash: 59911674C00298CBDB20DF68C845BDDBBB0AB19314F1086EAD45977282DB746E88CF95

Function 00486F20 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 103COMMON

Download Yara Rule

APIs

GetCurrentHwProfileW.ADVAPI32(?), ref: 00486F86

Strings

Unknown, xrefs: 0048705A

Memory Dump Source

Source File: 00000003.00000002.2242983706.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: CurrentProfile
String ID: Unknown
API String ID: 2104809126-1654365787
Opcode ID: d6032fd6981b0caf5e4c49708838f9cebd9397818ef9a0e4cf965eded2abff42
Instruction ID: 4cfd0b05124d6ad0cc2ed0fe670d1554fe3cca3eb32f1e14fa8b394e0e179909
Opcode Fuzzy Hash: d6032fd6981b0caf5e4c49708838f9cebd9397818ef9a0e4cf965eded2abff42
Instruction Fuzzy Hash: 74418B71D00258CBDB20DF69C8407DEFBF4EF49704F1082AAD899A7281D774AA88CF91

Function 004ABC08 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 85COMMONLIBRARYCODE

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00434FF1

Strings

MC, xrefs: 00434FDC

Memory Dump Source

Source File: 00000003.00000002.2242983706.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: MC
API String ID: 2659868963-1829682832
Opcode ID: a7a485d9c83800eb579eb1fbe217d44add95b41717c89af58e444174cff24a24
Instruction ID: 040724f085c67d798f1d490f9b73413860191a50a7d7deb79defe6124e27c29a
Opcode Fuzzy Hash: a7a485d9c83800eb579eb1fbe217d44add95b41717c89af58e444174cff24a24
Instruction Fuzzy Hash: 3611EB71800308ABCB10DF58DC01B9AB7ACEB15724F10466FF81597780EB79A940CBD8

Function 00447920 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 42COMMON

Download Yara Rule

APIs

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 0044799C

Strings

0hC, xrefs: 00447996

Memory Dump Source

Source File: 00000003.00000002.2242983706.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: Ios_base_dtorstd::ios_base::_
String ID: 0hC
API String ID: 323602529-2581318919
Opcode ID: 5129ab555f51bed53336c49a6076550c51d3d5e874f0d443237048deba2c8ea9
Instruction ID: 8ca8b340eaa0dfe9bad33bee777e0704730a4b63aab2394a13b70ad755bbc225
Opcode Fuzzy Hash: 5129ab555f51bed53336c49a6076550c51d3d5e874f0d443237048deba2c8ea9
Instruction Fuzzy Hash: CD11ADB0840609DFDB10DF59C840A9DFBF8FB05328F208A6EE85197390EB74AA05CB80

Function 00460310 Relevance: 3.3, APIs: 2, Instructions: 312COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 004604B4

Memory Dump Source

Source File: 00000003.00000002.2242983706.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 8b13a2037e7e0b03ddde8346a73a64acbab074baffae8b20c15079bbed3282a0
Instruction ID: 66707b960993136107624c9d81ef05c918eca4bbb2b21c6d520a63eb0cd0cd41
Opcode Fuzzy Hash: 8b13a2037e7e0b03ddde8346a73a64acbab074baffae8b20c15079bbed3282a0
Instruction Fuzzy Hash: 04A191B1E002159FDB14DF68C981AAFBBB4EB49314F24422FE815E7385E738AD05CB95

Function 00437CB0 Relevance: 3.1, APIs: 2, Instructions: 124COMMON

Download Yara Rule

APIs

___std_fs_directory_iterator_open@12.LIBCPMT ref: 00437D64
___std_fs_directory_iterator_advance@8.LIBCPMT ref: 00437D92

Memory Dump Source

Source File: 00000003.00000002.2242983706.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: ___std_fs_directory_iterator_advance@8___std_fs_directory_iterator_open@12
String ID:
API String ID: 3016148460-0
Opcode ID: 73963d7e42f46bada0bb91468d8e6c86860c6526e71e689b58131c2916953d37
Instruction ID: c774fac7b26238caf8a18ea1cc9dfb162d547f418ec2e445b27f5ef4f4107e88
Opcode Fuzzy Hash: 73963d7e42f46bada0bb91468d8e6c86860c6526e71e689b58131c2916953d37
Instruction Fuzzy Hash: E841A0B1D04218DBCB34DF64C480AEEB7B4EF19324F00516BE851AB381EB789D44CB94

Function 00480F90 Relevance: 3.1, APIs: 2, Instructions: 108COMMON

Download Yara Rule

APIs

SHGetKnownFolderPath.SHELL32(004E05C0,00000000,00000000,?,8762CD73,?,?), ref: 0048101E
CoTaskMemFree.OLE32(?), ref: 004810DC

Memory Dump Source

Source File: 00000003.00000002.2242983706.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: FolderFreeKnownPathTask
String ID:
API String ID: 969438705-0
Opcode ID: 72aa8b02f906d3fbe3ba85b36074818c76339de4eced8fbcc3b8c7e13541c268
Instruction ID: 3e538bd659216d3e4857fbb8bc962106784e19cd0647cea7878622876b38b54a
Opcode Fuzzy Hash: 72aa8b02f906d3fbe3ba85b36074818c76339de4eced8fbcc3b8c7e13541c268
Instruction Fuzzy Hash: 4241ACB0D01748DBDB10CFA5C9457AEFBF4EF58314F20421EE811A7280EBB86A44CB94

Function 0047F1C0 Relevance: 3.1, APIs: 2, Instructions: 82registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNEL32(80000001,0051C570,00000000,00020019,00000000,8762CD73), ref: 0047F211
RegCloseKey.ADVAPI32(00000000), ref: 0047F221

Memory Dump Source

Source File: 00000003.00000002.2242983706.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: CloseOpen
String ID:
API String ID: 47109696-0
Opcode ID: 53310d44514645ec7d69775a39ecbdcf721de23dfed265a4b960d742e8fdaebb
Instruction ID: 54b3090d3cf4edc9b1beeea5084ab922e7ff7cf66e968ba670c482e571a875e7
Opcode Fuzzy Hash: 53310d44514645ec7d69775a39ecbdcf721de23dfed265a4b960d742e8fdaebb
Instruction Fuzzy Hash: 1021F675E002199BDB10EF95DC81BEFB7B4EB48714F14827EE819B7382EB399D048694

Function 0049AD6F Relevance: 3.1, APIs: 2, Instructions: 65COMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F6), ref: 0049ADBB
GetFileType.KERNEL32(00000000), ref: 0049ADCD

Memory Dump Source

Source File: 00000003.00000002.2242983706.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: FileHandleType
String ID:
API String ID: 3000768030-0
Opcode ID: 4f32fbaeb40bbd2ddea1473ad080d3a809991d13d49bec4850263f289b53d757
Instruction ID: 9b806bec79c801feb13e2bd810877b0a9fec2b0519df56a68c4b4061daa9a1e0
Opcode Fuzzy Hash: 4f32fbaeb40bbd2ddea1473ad080d3a809991d13d49bec4850263f289b53d757
Instruction Fuzzy Hash: B611B7311047514ACF304A3E8C886677E96AB56331B39073FD4B687AF1C338D9A691CB

Function 0049F3BE Relevance: 3.1, APIs: 2, Instructions: 52COMMONLIBRARYCODE

Download Yara Rule

APIs

SetFilePointerEx.KERNEL32(00000000,00000000,00000000,00000000,00000002,00000000,00000000,00000000,00000000,?,0049F4F8,00000000,00000000,00000000,00000002,00000000), ref: 0049F3FA
GetLastError.KERNEL32(00000000,?,0049F4F8,00000000,00000000,00000000,00000002,00000000,?,0049BE05,00000000,00000000,00000000,00000002,00000000,00000000), ref: 0049F407

Memory Dump Source

Source File: 00000003.00000002.2242983706.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 80260035985e1c693c2aa0c1ce2b926f9b01d7339fcba6fc68b9113c9f56a2d4
Instruction ID: e391caa542caa0dd86735aa216be2178a54a5bfb1c46ce41420e93566301b438
Opcode Fuzzy Hash: 80260035985e1c693c2aa0c1ce2b926f9b01d7339fcba6fc68b9113c9f56a2d4
Instruction Fuzzy Hash: 57012232614215AFCF058F69DC49D9E3F2AEF95324F24422AF811DB290E775EE41CB94

Function 0047E47D Relevance: 3.1, APIs: 2, Instructions: 51synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 004473D0: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,8762CD73), ref: 0044741C
Part of subcall function 004473D0: Process32FirstW.KERNEL32(00000000,?), ref: 00447468

Part of subcall function 00445950: CredEnumerateA.ADVAPI32(00000000,00000000,?,?,8762CD73,00000000,?), ref: 004459B2

Part of subcall function 00485350: recv.WS2_32(?,00002000,00000000), ref: 004854A4

ReleaseMutex.KERNEL32(00000000), ref: 0047E525
CloseHandle.KERNEL32(00000000), ref: 0047E52C

Memory Dump Source

Source File: 00000003.00000002.2242983706.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: CloseCreateCredEnumerateFirstHandleMutexProcess32ReleaseSnapshotToolhelp32recv
String ID:
API String ID: 420082584-0
Opcode ID: 43ab8f6d0282bbd386fa8db408f8dbade1bdb5759a0961783a362487319a2d08
Instruction ID: 21d12501465ffecb104f3396b5f4d487cf58cbb0265569f00e2db2d4d6eee1e0
Opcode Fuzzy Hash: 43ab8f6d0282bbd386fa8db408f8dbade1bdb5759a0961783a362487319a2d08
Instruction Fuzzy Hash: D9114C71806548EAEB00FBF7950639DB7A0AF0431CF10C59FE90623182DF7D1A0596AF

Function 0047E4C8 Relevance: 3.0, APIs: 2, Instructions: 40synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 00485350: recv.WS2_32(?,00002000,00000000), ref: 004854A4

ReleaseMutex.KERNEL32(00000000), ref: 0047E525
CloseHandle.KERNEL32(00000000), ref: 0047E52C

Memory Dump Source

Source File: 00000003.00000002.2242983706.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: CloseHandleMutexReleaserecv
String ID:
API String ID: 2659716615-0
Opcode ID: 0316209b74f7a510048f6aca9fcb45fc03c3e98c7b54836586b8f6f774e638a0
Instruction ID: d8074609c4b6b56a118d8c4864159468ec2ce210cc92c7876c64f9fcb1cee0d4
Opcode Fuzzy Hash: 0316209b74f7a510048f6aca9fcb45fc03c3e98c7b54836586b8f6f774e638a0
Instruction Fuzzy Hash: CD017171806518DAE710FBE2D50679DB7A0AF0931CF50869FE90623282DF791A0187AE

Function 0049C0BD Relevance: 3.0, APIs: 2, Instructions: 22memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(00000000,00000000,?,004A4A11,?,00000000,?,?,004A4CB2,?,00000007,?,?,004A3378,?,?), ref: 0049C0D3
GetLastError.KERNEL32(?,?,004A4A11,?,00000000,?,?,004A4CB2,?,00000007,?,?,004A3378,?,?), ref: 0049C0DE

Memory Dump Source

Source File: 00000003.00000002.2242983706.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 2c7be629525b77807a060ce78cd6937da288636f168411113672e5418cb75576
Instruction ID: 589170845ab709ad3b3b60fb6adb52998bb4654d1de7eee66c817f55301082a8
Opcode Fuzzy Hash: 2c7be629525b77807a060ce78cd6937da288636f168411113672e5418cb75576
Instruction Fuzzy Hash: 9BE08631500614A7CF222BA1EC0D7893F58DB40355F104036F60897160DF398940CB88

Function 0048FAB0 Relevance: 1.7, APIs: 1, Instructions: 205COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 0048FCEA

Memory Dump Source

Source File: 00000003.00000002.2242983706.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 54dc556bc546888474d3f19e34a31102f3849cfd2e1ddc240e0765d6926b334a
Instruction ID: 258a51d4530bdfdbcfb978a880514f411ab203130510da66870d02f2c2448e76
Opcode Fuzzy Hash: 54dc556bc546888474d3f19e34a31102f3849cfd2e1ddc240e0765d6926b334a
Instruction Fuzzy Hash: DB71F671A002088FCB24EF28C490B6E77A5BF15314F244A7FE865CB791D739EA49CB95

Function 0044AF90 Relevance: 1.7, APIs: 1, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2242983706.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drop1.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9135f7d9b5d1880a46c4ac02def5f1366672d51aadf79d8842421bd6ac20231f
Instruction ID: 5047db877c7d9ae38b531aa0dda64427d2377832e7d6361d0852b000475400c5
Opcode Fuzzy Hash: 9135f7d9b5d1880a46c4ac02def5f1366672d51aadf79d8842421bd6ac20231f
Instruction Fuzzy Hash: F45180B5A0060ADFDB18CF28D480999FBB4FF4A320B5082AAE819C7B51D735ED55CBD4

Function 0049E314 Relevance: 1.7, APIs: 1, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2242983706.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drop1.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4d1b25cda05e585bd14aeef0c776674eabbc591f49ad1024f01acac1088cae4
Instruction ID: 7d9f16a24b0820fe6bfe4efb506255557b861a5981f24711c09fdeca13a2084c
Opcode Fuzzy Hash: f4d1b25cda05e585bd14aeef0c776674eabbc591f49ad1024f01acac1088cae4
Instruction Fuzzy Hash: 8751C470A00104EFDF14CF5ACC85AAE7FA5AF99324F28816AE8095B352D379DE41CB95

Function 00458550 Relevance: 1.6, APIs: 1, Instructions: 150COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 004586AF

Memory Dump Source

Source File: 00000003.00000002.2242983706.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 9d0e38e8a100f06b44e5b2c958822f107f66b3500270d3682d1b991c4f050d55
Instruction ID: 39eac46aceff4f274d7df031c3ad8bb7d561d247c585fc64f7f09dd83a036c2e
Opcode Fuzzy Hash: 9d0e38e8a100f06b44e5b2c958822f107f66b3500270d3682d1b991c4f050d55
Instruction Fuzzy Hash: E941A4B1E001159FDB04DFA8C841AAEBBB5EF48315F10422EE815F7386DB34AE09CB95

Function 004520F0 Relevance: 1.6, APIs: 1, Instructions: 138COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 0045223D

Memory Dump Source

Source File: 00000003.00000002.2242983706.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 8aafa409fbbe6252fd8d16ac1cef4b76429e1a26ed72850fe408f5c857c7a805
Instruction ID: 543f2dd5f5f38f41d79c3b3e326d175c20dbca08f8aec97f7e4552ad9d8ce088
Opcode Fuzzy Hash: 8aafa409fbbe6252fd8d16ac1cef4b76429e1a26ed72850fe408f5c857c7a805
Instruction Fuzzy Hash: E1411272E001149BCB05EF68CD806AFB7A5EF56311F1402AFFC15EB302D6789E158B99

Function 00451F90 Relevance: 1.6, APIs: 1, Instructions: 137COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 004520DE

Memory Dump Source

Source File: 00000003.00000002.2242983706.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: a14de396b08b32659630435c90f611bc18073001c29953638865ceda2285425b
Instruction ID: 53fc907bca80d66a09b4c03435f3e8acb878ccb904669eb33cf36a05cbe64725
Opcode Fuzzy Hash: a14de396b08b32659630435c90f611bc18073001c29953638865ceda2285425b
Instruction Fuzzy Hash: E7414272D001049BCB15AF68CD806AEBBA5AF4A305F1002ABED15EB342D7749E158BD9

Function 0048F890 Relevance: 1.6, APIs: 1, Instructions: 135COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 0048F9FA

Memory Dump Source

Source File: 00000003.00000002.2242983706.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: d2fccf6f5b3df297b65b13170b90e5c1872a490292f016b70dee3939b6e05f49
Instruction ID: 91311e753e2fbbf9cdae31aef67f458025fa5287f257254b7d49e4ed808e7769
Opcode Fuzzy Hash: d2fccf6f5b3df297b65b13170b90e5c1872a490292f016b70dee3939b6e05f49
Instruction Fuzzy Hash: 4F41B3B2E005049FDB14EF68C985A6EBBA9EB49320F24473EE815D7385DB349D04CB95

Function 00451E50 Relevance: 1.6, APIs: 1, Instructions: 125COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00451F7F

Memory Dump Source

Source File: 00000003.00000002.2242983706.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: bceca21abfd596b49baddf9976fd8ae7e3bbe9a292c563c34926c129456dd860
Instruction ID: dbfd0375bb16cbcb281b8a1501cab73851c3df864c0bb83deedb38d5f1c134ec
Opcode Fuzzy Hash: bceca21abfd596b49baddf9976fd8ae7e3bbe9a292c563c34926c129456dd860
Instruction Fuzzy Hash: 72312572A001049BCB14DF688881B9FBBA5AB59315B24426FEC15CB303DB34DE5987D9

Function 004516D0 Relevance: 1.6, APIs: 1, Instructions: 118COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 004517DF

Memory Dump Source

Source File: 00000003.00000002.2242983706.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 4beab17cec18f8408a3d260484db6fe46066ad92ba7b493454d35fe0c2aa28c2
Instruction ID: 65e916faade23ef3c336758c75d3ad3b55c144e32e026a5ec30b5c92d10e86c8
Opcode Fuzzy Hash: 4beab17cec18f8408a3d260484db6fe46066ad92ba7b493454d35fe0c2aa28c2
Instruction Fuzzy Hash: BB316772E001105BCB18EE6D9880A6FB7E9EB88312B24427FEC15D7352DA38DD0987D9

Function 0044D7D0 Relevance: 1.6, APIs: 1, Instructions: 116COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 0044D8F9

Memory Dump Source

Source File: 00000003.00000002.2242983706.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 4a7e0aa971e9c18d460f3d63606fed0fdd4bc56cc13da704aad23d70c2080c39
Instruction ID: 6687ec20b77dec97c90771c2cbe71989815263d1b8fcacfb2e06f2ee49a1853a
Opcode Fuzzy Hash: 4a7e0aa971e9c18d460f3d63606fed0fdd4bc56cc13da704aad23d70c2080c39
Instruction Fuzzy Hash: C3310A71E002045BE714AE6DD880A7EB7A4EF55324F24477FF865C7382D67899408759

Function 0044BAD0 Relevance: 1.6, APIs: 1, Instructions: 87COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 0044BBB3

Part of subcall function 00434F80: ___std_exception_copy.LIBVCRUNTIME ref: 00434FF1

Memory Dump Source

Source File: 00000003.00000002.2242983706.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task___std_exception_copy
String ID:
API String ID: 1979911387-0
Opcode ID: 14553861a0e6d344c6703ce135879dfe8084568f0dbccc5b703b736294f01183
Instruction ID: f8cf7cd3dcf405c094d14d4edd2427269fc308b55f739c6c677f8adad7f52d2f
Opcode Fuzzy Hash: 14553861a0e6d344c6703ce135879dfe8084568f0dbccc5b703b736294f01183
Instruction Fuzzy Hash: 902126B1E006059BE7149F25D48166AB7A4EF15324F20036FE8258BB91E739FE90C7D6

Function 004BB697 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

__wsopen_s.LIBCMT ref: 004BB6D1

Memory Dump Source

Source File: 00000003.00000002.2242983706.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: __wsopen_s
String ID:
API String ID: 3347428461-0
Opcode ID: c0068bc3e55a3d1622d6bbbbb6d136ac2493d2630b2467d4896e3e7752e83962
Instruction ID: 7232828ef0ab4ea1277fc9c55e8108ad49929c9e06a984f5114aae078e858d40
Opcode Fuzzy Hash: c0068bc3e55a3d1622d6bbbbb6d136ac2493d2630b2467d4896e3e7752e83962
Instruction Fuzzy Hash: B9113671A0010AAFCB05DF58E9819CF7BF4EF88304F00405AF808AB311D770D9118BA4

Function 00482930 Relevance: 1.5, APIs: 1, Instructions: 43networkCOMMON

Download Yara Rule

APIs

send.WS2_32(?,?,00000000), ref: 00482968

Memory Dump Source

Source File: 00000003.00000002.2242983706.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: send
String ID:
API String ID: 2809346765-0
Opcode ID: 2e230c4dbecb0c91bd7935fcc59657d459b7808623847299c78205d0fd7c7ba6
Instruction ID: 15365ef676efcd120e403479619ae1d38f6ec3fc5171ce29fb9a7f72e5811cf6
Opcode Fuzzy Hash: 2e230c4dbecb0c91bd7935fcc59657d459b7808623847299c78205d0fd7c7ba6
Instruction Fuzzy Hash: 93F0B472302115AB83109A5DAD4096BF7DEDBCA7B0B2003A7FC2CC33E0E9618C0153D4

Function 0049C6A4 Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,0043FE48,00000001,?,00499445,00000001,00000364,00000001,00000006,000000FF,?,004AD408,0043FE4A,0043FE44,?), ref: 0049C6E5

Memory Dump Source

Source File: 00000003.00000002.2242983706.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 934b5854b3b2fba1ba84eb25d33e8f66ddb7b9c5617b0a1ffb822db2bfc3c07a
Instruction ID: bf89d2d5fe5833ab0f4bff440cdb33f04d1e0b68cec02520bce29c64fa949510
Opcode Fuzzy Hash: 934b5854b3b2fba1ba84eb25d33e8f66ddb7b9c5617b0a1ffb822db2bfc3c07a
Instruction Fuzzy Hash: 82F0BE322852256BAF215B229D85B5B3F589B417E0F195037FC08EA290CE78EC008AEC

Function 004406AD Relevance: 1.5, APIs: 1, Instructions: 36fileCOMMON

Download Yara Rule

APIs

FindNextFileW.KERNELBASE(00000000,?), ref: 004406F2

Memory Dump Source

Source File: 00000003.00000002.2242983706.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: FileFindNext
String ID:
API String ID: 2029273394-0
Opcode ID: df8edaa59d5e1f82e8cad7747c6b34272b3092e2e70faf3eef711e3f2ee9bc11
Instruction ID: a1ffe5c8ce5f1f1a4397a2b9345f76ae3c812c30bf0ac5870f9d4861cf5b4c4e
Opcode Fuzzy Hash: df8edaa59d5e1f82e8cad7747c6b34272b3092e2e70faf3eef711e3f2ee9bc11
Instruction Fuzzy Hash: 95015631A0625DDFEB20DFA4D988BAEBBB4EF14314F2040DAD909A7282C7346E04DF55

Function 0049D15A Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,00000001,0043FE44,?,004AD408,0043FE4A,0043FE44,?,?,?,00434C2F,0043FE48,0043FE48), ref: 0049D18C

Memory Dump Source

Source File: 00000003.00000002.2242983706.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 7ee9b205990c537f360d36ea94f63206e53d45b0dbf15067b0b63116574bd50f
Instruction ID: de2ad87b2feeaf860c8dfd974d012cc9eb33a1afe18dd843800594eb24cb3dbb
Opcode Fuzzy Hash: 7ee9b205990c537f360d36ea94f63206e53d45b0dbf15067b0b63116574bd50f
Instruction Fuzzy Hash: 08E0E533A0132166EF212BA6AD02B5B3E48CB513A0F190137EC18962C4CB28DC0082ED

Function 004A8D62 Relevance: 1.5, APIs: 1, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 004A8D69

Memory Dump Source

Source File: 00000003.00000002.2242983706.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: H_prolog3
String ID:
API String ID: 431132790-0
Opcode ID: 3aba680758f6379cc1f0e69a772bc6cab6bd8c88bcc4b04971677c60b68784ff
Instruction ID: f589969de9c028132caa70972cc51c37c6bf7195d426b38a2c2fae52dece88af
Opcode Fuzzy Hash: 3aba680758f6379cc1f0e69a772bc6cab6bd8c88bcc4b04971677c60b68784ff
Instruction Fuzzy Hash: 71E09A76C4020D9ADB40DFD5C486BEFB7BCAB14304F50406BA205E6181EB7857448BE5

Function 004BC233 Relevance: 1.5, APIs: 1, Instructions: 15fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,00000000,?,004BC623,?,?,00000000,?,004BC623,?,0000000C), ref: 004BC250

Memory Dump Source

Source File: 00000003.00000002.2242983706.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: dd275b77e4c8549b8163696f0af87788398892aa77d507c51891a1137c56f0af
Instruction ID: c65ff2ef24fd0563ec255788cd93a1d7270b85fbbbb51eec7110af243f851585
Opcode Fuzzy Hash: dd275b77e4c8549b8163696f0af87788398892aa77d507c51891a1137c56f0af
Instruction Fuzzy Hash: 05D06C3200010DBBDF028F84EC06FDA3BAAFB48714F018010BA1866020C732E821ABA4

Function 004B9AE2 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

GetNativeSystemInfo.KERNEL32(?,?,?,00486DD6,?,?,?,8762CD73,?,?), ref: 004B9AEC

Memory Dump Source

Source File: 00000003.00000002.2242983706.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: InfoNativeSystem
String ID:
API String ID: 1721193555-0
Opcode ID: 19af6f8f66515c3ad7801cfde8998948d5a7d817498514074e40bdf49eb42b08
Instruction ID: f88b8e15ca571a688dc5d535dfb7cb0f1e1a76fd2fb5174ce8f8aecae7ce3306
Opcode Fuzzy Hash: 19af6f8f66515c3ad7801cfde8998948d5a7d817498514074e40bdf49eb42b08
Instruction Fuzzy Hash: 0EC09B7490610E97CF00E7E5D94D88E77FCA608204F4004A1D551E3140E770FD45C795

Non-executed Functions

Function 0048A0A0 Relevance: 23.1, APIs: 10, Strings: 3, Instructions: 325nativelibraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(ntdll.dll,NtDuplicateObject,8762CD73,?,?), ref: 0048A0F7
GetProcAddress.KERNEL32(00000000), ref: 0048A0FE
OpenProcess.KERNEL32(00000040,00000000,00000000), ref: 0048A12A
NtQuerySystemInformation.NTDLL(00000010,00000000,00000014,00000000), ref: 0048A153
NtQuerySystemInformation.NTDLL(00000010,00000000,00000000,00000000), ref: 0048A178
GetCurrentProcess.KERNEL32 ref: 0048A1FD
NtQueryObject.NTDLL ref: 0048A22B
GetFinalPathNameByHandleA.KERNEL32(00000000,00000000,00000104,00000000,00000104,?,00000104,00000000), ref: 0048A315
CloseHandle.KERNEL32(00000000), ref: 0048A3E6
CloseHandle.KERNEL32(00000000), ref: 0048A441

Strings

NtDuplicateObject, xrefs: 0048A0E6
File, xrefs: 0048A25B
ntdll.dll, xrefs: 0048A0EB

Memory Dump Source

Source File: 00000003.00000002.2242983706.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: Handle$Query$CloseInformationProcessSystem$AddressCurrentFinalModuleNameObjectOpenPathProc
String ID: File$NtDuplicateObject$ntdll.dll
API String ID: 2729825427-3955674919
Opcode ID: 8320b73641bfe2fd6a36d39389df1be313783445bc61d84dd6fe8aca722285e2
Instruction ID: 0800680efb81c18e2f896ca5fb1c4f1751909ec1a20682d0b449f1ef79601e33
Opcode Fuzzy Hash: 8320b73641bfe2fd6a36d39389df1be313783445bc61d84dd6fe8aca722285e2
Instruction Fuzzy Hash: C3C1DE71D00218AFEF10EFA4DC45BAEBBB5FF44704F14452AE801A7281E7B9AD45CB96

Function 0048A710 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 215stringmemorynativeCOMMON

Download Yara Rule

APIs

RtlAcquirePebLock.NTDLL(8762CD73,00000000,00000000), ref: 0048A766
NtAllocateVirtualMemory.NTDLL ref: 0048A78F
lstrcpyW.KERNEL32(?), ref: 0048A7C6
lstrcatW.KERNEL32(?), ref: 0048A8CD
NtAllocateVirtualMemory.NTDLL ref: 0048A904
lstrcpyW.KERNEL32(?), ref: 0048AA0F
RtlInitUnicodeString.NTDLL(-00000037), ref: 0048AA28
RtlInitUnicodeString.NTDLL(-0000003F), ref: 0048AA37
LdrEnumerateLoadedModules.NTDLL ref: 0048AA44
RtlReleasePebLock.NTDLL ref: 0048AA4A

Part of subcall function 00480F90: SHGetKnownFolderPath.SHELL32(004E05C0,00000000,00000000,?,8762CD73,?,?), ref: 0048101E
Part of subcall function 00480F90: CoTaskMemFree.OLE32(?), ref: 004810DC

Strings

0Qv, xrefs: 0048AA1E

Memory Dump Source

Source File: 00000003.00000002.2242983706.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: AllocateInitLockMemoryStringUnicodeVirtuallstrcpy$AcquireEnumerateFolderFreeKnownLoadedModulesPathReleaseTasklstrcat
String ID: 0Qv
API String ID: 573923072-416853194
Opcode ID: 9f0bc586ea1a7da28060736a8c13b163a192ecd6657979f9a74a2ad2d362be03
Instruction ID: 1d72f842e61e5ce7feef92d17fc1071c4f69874d6174494518bfda03acdacd70
Opcode Fuzzy Hash: 9f0bc586ea1a7da28060736a8c13b163a192ecd6657979f9a74a2ad2d362be03
Instruction Fuzzy Hash: D6B190B4D05268EFDB14CFA9D885A9DBBB5FF08314F10822AE825A7361DB346946CF44

Function 00477EE0 Relevance: 18.3, APIs: 12, Instructions: 289COMMON

Download Yara Rule

APIs

CoInitializeEx.OLE32(00000000,00000000,8762CD73,?,?), ref: 00477F5C

Memory Dump Source

Source File: 00000003.00000002.2242983706.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: eec43777c261d8a2dab22aea29dbdf31e886a527831d6dfb0425ac795999018e
Instruction ID: d5989f67fd172e1006781f95ff6e7d6cbd1369fc69074948a5cb2319df95c689
Opcode Fuzzy Hash: eec43777c261d8a2dab22aea29dbdf31e886a527831d6dfb0425ac795999018e
Instruction Fuzzy Hash: 12D1F170D04288DBDB11CFA8D848BEDBBB0FF15314F14824AE508BB291DB796AC9DB55

Function 0047D2F0 Relevance: 17.9, APIs: 1, Strings: 9, Instructions: 410COMMON

Download Yara Rule

APIs

Part of subcall function 004517F0: Concurrency::cancel_current_task.LIBCPMT ref: 004518C2

Part of subcall function 0044DCC0: std::ios_base::_Addstd.LIBCPMT ref: 0044DDEF

Part of subcall function 00436640: std::ios_base::_Ios_base_dtor.LIBCPMT ref: 004366E9

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 0047D95A

Strings

abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789+=-&^%$#@!(){}[},.;', xrefs: 0047D443
.exe, xrefs: 0047D349, 0047D423
.G, xrefs: 0047D646, 0047D6BC, 0047D8DD
open, xrefs: 0047D7E5
.vbs, xrefs: 0047D3A5
runas, xrefs: 0047D7EA, 0047D82A, 0047D82B
0hC, xrefs: 0047D950
.cmd, xrefs: 0047D385
.ps1, xrefs: 0047D365

Memory Dump Source

Source File: 00000003.00000002.2242983706.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: std::ios_base::_$Ios_base_dtor$AddstdConcurrency::cancel_current_task
String ID: .cmd$.exe$.ps1$.vbs$.G$0hC$abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789+=-&^%$#@!(){}[},.;'$open$runas
API String ID: 2154145882-3307477358
Opcode ID: 6595408e174a39f32e18d343271d234c9a7f1da95b1be23f008c122fddbd1b18
Instruction ID: f5ba6b163c3a98fee3f853caf05b9595179ad2eb3f8f0c36a39513699dfd7300
Opcode Fuzzy Hash: 6595408e174a39f32e18d343271d234c9a7f1da95b1be23f008c122fddbd1b18
Instruction Fuzzy Hash: 6A122770D00268DFDB20DF64CD85BDEBBB4AF19304F1481EAE849A7282DB755A84CF95

Function 0047AE80 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 41COMMON

Download Yara Rule

APIs

BCryptOpenAlgorithmProvider.BCRYPT(?,AES,00000000,00000000,00000001,?,0047AF9D,?,?,8762CD73), ref: 0047AE91
BCryptSetProperty.BCRYPT(?,ChainingMode,ChainingModeGCM,00000020,00000000), ref: 0047AEAB
BCryptGenerateSymmetricKey.BCRYPT(?,?,00000000,00000000,?,?,00000000), ref: 0047AECF

Strings

AES, xrefs: 0047AE88
ChainingMode, xrefs: 0047AEA4
ChainingModeGCM, xrefs: 0047AE9F

Memory Dump Source

Source File: 00000003.00000002.2242983706.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: Crypt$AlgorithmGenerateOpenPropertyProviderSymmetric
String ID: AES$ChainingMode$ChainingModeGCM
API String ID: 1692524283-1213888626
Opcode ID: b81ac72cefcce56172d4d4bf7609f9087b605a60a83836cd33b6e41b4b4cf51e
Instruction ID: 8d127e15825cd86a398cba4dadb085fb92217d3de15f733cf2195ed64ba2db48
Opcode Fuzzy Hash: b81ac72cefcce56172d4d4bf7609f9087b605a60a83836cd33b6e41b4b4cf51e
Instruction Fuzzy Hash: 1CF03031381710BBE7309E65AC4AFDB7BA8FB44F10F10492AFA41DA1D0D7A0F8559B5A

Function 0046B620 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 331COMMON

Download Yara Rule

APIs

___std_fs_directory_iterator_advance@8.LIBCPMT ref: 0046B7DA
___std_fs_directory_iterator_advance@8.LIBCPMT ref: 0046B81E
___std_fs_directory_iterator_advance@8.LIBCPMT ref: 0046B924
___std_fs_directory_iterator_advance@8.LIBCPMT ref: 0046B970

Strings

., xrefs: 0046B942

Memory Dump Source

Source File: 00000003.00000002.2242983706.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: ___std_fs_directory_iterator_advance@8
String ID: .
API String ID: 2610647541-248832578
Opcode ID: 2e775b534ccb48514fa1d19158a196e6f147d360d3fd40777325cb8899fa8bdc
Instruction ID: 99e23c5b304899c8ab8714ce46d423df57297e0934c6bc539a0dfe6d7ec6f1b4
Opcode Fuzzy Hash: 2e775b534ccb48514fa1d19158a196e6f147d360d3fd40777325cb8899fa8bdc
Instruction Fuzzy Hash: 77C1BF75A016269FCB20DF18C8847AAB3B5FF44314F14829AD915D7390EB39AD85CFC6

Function 004A6109 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,004A641B,00000002,00000000,?,?,?,004A641B,?,00000000), ref: 004A61A2
GetLocaleInfoW.KERNEL32(?,20001004,004A641B,00000002,00000000,?,?,?,004A641B,?,00000000), ref: 004A61CB
GetACP.KERNEL32(?,?,004A641B,?,00000000), ref: 004A61E0

Strings

OCP, xrefs: 004A615D
ACP, xrefs: 004A6127

Memory Dump Source

Source File: 00000003.00000002.2242983706.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: 83dfd683b9c94d176d38183288480b868ca78ec3c44069a2c66a1e4373e54840
Instruction ID: 02a1f9ff6d074017cf30d732e6d651dacf3b6180dce544ba7b26bbdffeda2481
Opcode Fuzzy Hash: 83dfd683b9c94d176d38183288480b868ca78ec3c44069a2c66a1e4373e54840
Instruction Fuzzy Hash: 14217731B00101A6DB348F54C901A9BBBA7EB76B54B5F8466E909D7302EB36DE41C358

Function 004A62E5 Relevance: 7.7, APIs: 5, Instructions: 182COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 004992A7: GetLastError.KERNEL32(00000000,?,004A2D01), ref: 004992AB
Part of subcall function 004992A7: SetLastError.KERNEL32(00000000,00000000,00000001,00000006,000000FF), ref: 0049934D

GetUserDefaultLCID.KERNEL32(?,?,?,00000055,?), ref: 004A63ED
IsValidCodePage.KERNEL32(00000000), ref: 004A642B
IsValidLocale.KERNEL32(?,00000001), ref: 004A643E
GetLocaleInfoW.KERNEL32(?,00001001,-00000050,00000040,?,000000D0,00000055,00000000,?,?,00000055,00000000), ref: 004A6486
GetLocaleInfoW.KERNEL32(?,00001002,00000030,00000040), ref: 004A64A1

Memory Dump Source

Source File: 00000003.00000002.2242983706.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: Locale$ErrorInfoLastValid$CodeDefaultPageUser
String ID:
API String ID: 415426439-0
Opcode ID: 478fc60fa90a9ec9e197162e05efa7e840982a7b058c794a341e424fb9183a7c
Instruction ID: c25bf07a23f3a9ec008bfe0b344d9b34e57977eb2ee5f51d57588e3c0d66081e
Opcode Fuzzy Hash: 478fc60fa90a9ec9e197162e05efa7e840982a7b058c794a341e424fb9183a7c
Instruction Fuzzy Hash: B351C031A00205ABDF10DFA5CC41AAF77B8BF2A700F09446BF905EB2C0D778D9058B68

Function 004A5970 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 254COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 004992A7: GetLastError.KERNEL32(00000000,?,004A2D01), ref: 004992AB
Part of subcall function 004992A7: SetLastError.KERNEL32(00000000,00000000,00000001,00000006,000000FF), ref: 0049934D

GetACP.KERNEL32(?,?,?,?,?,?,00499D39,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 004A5A2F
IsValidCodePage.KERNEL32(00000000,?,?,?,?,?,?,00499D39,?,?,?,00000055,?,-00000050,?,?), ref: 004A5A66
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,-00000050,00000000,000000D0), ref: 004A5BC9

Strings

utf8, xrefs: 004A5B38

Memory Dump Source

Source File: 00000003.00000002.2242983706.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: ErrorLast$CodeInfoLocalePageValid
String ID: utf8
API String ID: 607553120-905460609
Opcode ID: 04b3e337810216b61eac7fea49992564720a065615442711857ddc30d61a34d4
Instruction ID: 57bf36a595626d2e68748195e450517760c1dbe6c14d68ec56d01c4c71c4df41
Opcode Fuzzy Hash: 04b3e337810216b61eac7fea49992564720a065615442711857ddc30d61a34d4
Instruction Fuzzy Hash: F771FA71600B01ABDB24AB75CD82BAB73ACEF66714F14052FF505D7281E778E940866D

Function 00497B2D Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,00000001), ref: 00497C25
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,00000001), ref: 00497C2F
UnhandledExceptionFilter.KERNEL32(-00000327,?,?,?,?,?,00000001), ref: 00497C3C

Strings

/LC, xrefs: 00497B2F

Memory Dump Source

Source File: 00000003.00000002.2242983706.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID: /LC
API String ID: 3906539128-2135541996
Opcode ID: ba9b98a76fbca1403476e1f0242b14846ec85a4183b9da3279bb0f6910b30b28
Instruction ID: bfbf58602b6ed5b9f74246d621f9e13e9ead8f3e4535d75d7aa199c35e3273ea
Opcode Fuzzy Hash: ba9b98a76fbca1403476e1f0242b14846ec85a4183b9da3279bb0f6910b30b28
Instruction Fuzzy Hash: 3231D274901229ABCB21DF65DC8878DBBB8BF18710F5041EAE40CA7250E7349F858F48

Function 00493800 Relevance: 6.5, APIs: 4, Instructions: 455COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2242983706.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drop1.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ea11f6e400efd71b53824ee55fa65b6dac5785e4ad25e6ab9d2c54b6af7400f
Instruction ID: d1eb0eda3f30262f0aa428ac7e9151949e9d9ef7bd25f7153de96db8ebdefec9
Opcode Fuzzy Hash: 4ea11f6e400efd71b53824ee55fa65b6dac5785e4ad25e6ab9d2c54b6af7400f
Instruction Fuzzy Hash: DB023C71E002199BDF14CFA9C9806AEFBF1FF89315F24826AE519E7341D735AE018B94

Function 0015BF4B Relevance: 6.2, APIs: 4, Instructions: 205COMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNEL32(?,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0015C03B

Memory Dump Source

Source File: 00000003.00000002.2242784215.0000000000151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000003.00000002.2242762091.0000000000150000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2242815596.0000000000162000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2242836543.000000000016A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2242864527.000000000016D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2242886972.0000000000170000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_drop1.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: c9ea7e229103684f77dbb7de760379f4e8c4a6b50bbd98fce2b1661110f0f93f
Instruction ID: bf14f25413f7bdb3324f76bc584791f3a26fa323736a95623c797c69d9ce13b9
Opcode Fuzzy Hash: c9ea7e229103684f77dbb7de760379f4e8c4a6b50bbd98fce2b1661110f0f93f
Instruction Fuzzy Hash: 9671E8B1949228DFDF209F24CCC9AAEB7B5AF05302F5441DAE829AB151DB314EC98F50

Function 00498574 Relevance: 6.1, APIs: 4, Instructions: 82memoryCOMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32(?,?,0000001C), ref: 0049859D
GetSystemInfo.KERNEL32(?,?,?,0000001C), ref: 004985B1
VirtualAlloc.KERNEL32(?,-00000001,00001000,00000004,?,?,?,0000001C), ref: 00498602
VirtualProtect.KERNEL32(?,-00000001,00000104,?,?,?,0000001C), ref: 00498617

Memory Dump Source

Source File: 00000003.00000002.2242983706.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: Virtual$AllocInfoProtectQuerySystem
String ID:
API String ID: 3562403962-0
Opcode ID: 4e29c64980591c23c9d6474b97963c5f1eeeaad4aec7d0b9861b07a888b65890
Instruction ID: 57c86550534b148c15952eeeaf39776b02a492ab104de77fe61266457f658886
Opcode Fuzzy Hash: 4e29c64980591c23c9d6474b97963c5f1eeeaad4aec7d0b9861b07a888b65890
Instruction Fuzzy Hash: 91217C72E00119ABCF20DFA9DD85AEFBBB8EF45754F05017AE905E7140EA349D04C794

Function 00155027 Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,?), ref: 00155033
IsDebuggerPresent.KERNEL32 ref: 001550FF
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00155118
UnhandledExceptionFilter.KERNEL32(?), ref: 00155122

Memory Dump Source

Source File: 00000003.00000002.2242784215.0000000000151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000003.00000002.2242762091.0000000000150000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2242815596.0000000000162000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2242836543.000000000016A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2242864527.000000000016D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2242886972.0000000000170000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_drop1.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: fef6b53d4497aa0fbefe66b9c0912c73e97abee99b4ee75f326d4d8a7ea5da99
Instruction ID: 2c8978603b72dc2f3cb8dce3ee40f17f097023ba6b33add60f8e3e32b7094b6b
Opcode Fuzzy Hash: fef6b53d4497aa0fbefe66b9c0912c73e97abee99b4ee75f326d4d8a7ea5da99
Instruction Fuzzy Hash: CB31F975D05219DBDB20DFA4DD497CDBBB8BF08305F1041EAE50DAB250EB719A888F45

Function 004AC6BF Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,?), ref: 004AC6CB
IsDebuggerPresent.KERNEL32 ref: 004AC797
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 004AC7B0
UnhandledExceptionFilter.KERNEL32(?), ref: 004AC7BA

Memory Dump Source

Source File: 00000003.00000002.2242983706.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 1a5f2cb74b25642d18f707c0b6da8939d9b46288bf323feffe580c9d32bdbba1
Instruction ID: 70dc3419eb2b6db1900c7bd06373213fcab329736da06f39ceabfcfe7a7444e5
Opcode Fuzzy Hash: 1a5f2cb74b25642d18f707c0b6da8939d9b46288bf323feffe580c9d32bdbba1
Instruction Fuzzy Hash: E1314A75C012189BDF21DF61DC897CEBBB8BF18700F1041AAE40DAB250E7759A84CF48

Function 0043D4A0 Relevance: 6.0, APIs: 1, Strings: 2, Instructions: 725COMMON

Download Yara Rule

Strings

content, xrefs: 0043E150
filename, xrefs: 0043E0E3

Memory Dump Source

Source File: 00000003.00000002.2242983706.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drop1.jbxd

Yara matches

Similarity

API ID:
String ID: content$filename
API String ID: 0-474635906
Opcode ID: b66f7423e610c841824d5b72251d930196416b83facb86d1c8f8609f3cb58a8b
Instruction ID: d087ffba84baf14db51f89a037efaf3a0efd4671473d6540ebf1f333b1c0f3d3
Opcode Fuzzy Hash: b66f7423e610c841824d5b72251d930196416b83facb86d1c8f8609f3cb58a8b
Instruction Fuzzy Hash: 5392EEB0C052AC9BDB66DF68D9857DDBBB4AF18308F1441DAE80CA7252EB741B84CF45

Function 004B824D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 32windowCOMMON

Download Yara Rule

APIs

GetLocaleInfoEx.KERNEL32(!x-sys-default-locale,20000001,00000000,00000002,?,?,00435B2A,?,?), ref: 004B8261
FormatMessageA.KERNEL32(00001300,00000000,00000000,00000000,?,00000000,00000000,?,?,00435B2A,?,?), ref: 004B8288

Strings

!x-sys-default-locale, xrefs: 004B825C

Memory Dump Source

Source File: 00000003.00000002.2242983706.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: FormatInfoLocaleMessage
String ID: !x-sys-default-locale
API String ID: 4235545615-2729719199
Opcode ID: 84205eb8d4b061531bed3096fe064d3d6fd842fcad4d2f7a7c64ada32d2dc388
Instruction ID: 4f66f40a8a4f046c7b0032d4e1a4b833dd41128cf422eed9181fa496fdef01a0
Opcode Fuzzy Hash: 84205eb8d4b061531bed3096fe064d3d6fd842fcad4d2f7a7c64ada32d2dc388
Instruction Fuzzy Hash: 1AF030B5511108FFEF089BD5DC0EEEB77ACEB09394F10416AB501D6150E6B0AE00D778

Function 004A5D8D Relevance: 4.7, APIs: 3, Instructions: 205COMMON

Download Yara Rule

APIs

Part of subcall function 004992A7: GetLastError.KERNEL32(00000000,?,004A2D01), ref: 004992AB
Part of subcall function 004992A7: SetLastError.KERNEL32(00000000,00000000,00000001,00000006,000000FF), ref: 0049934D

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 004A5DE1
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 004A5E2B
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 004A5EF1

Memory Dump Source

Source File: 00000003.00000002.2242983706.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: InfoLocale$ErrorLast
String ID:
API String ID: 661929714-0
Opcode ID: 4e5522a14392cd0b3bbc4aa0c2beba558a9818cfc0a7be593c71ffc28e535be1
Instruction ID: 962ae09c726557bba2a742099c161f9beda31160a96e42ffbc7faebc0f235ca1
Opcode Fuzzy Hash: 4e5522a14392cd0b3bbc4aa0c2beba558a9818cfc0a7be593c71ffc28e535be1
Instruction Fuzzy Hash: D86190715416079FDB28DF28CE82BABB7A8EF25305F1440BBE905C6285E738DE41CB58

Function 0047AAE0 Relevance: 3.2, APIs: 2, Instructions: 249COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2242983706.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drop1.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a5cc1d22bd71ddba461825bf1e5a719f52907f0f441b03632678b65b188f3f2
Instruction ID: 33f7787d24f7b6ada88b2ec4e837cc4b10ca5ac34968b166931d9a07c874724e
Opcode Fuzzy Hash: 7a5cc1d22bd71ddba461825bf1e5a719f52907f0f441b03632678b65b188f3f2
Instruction Fuzzy Hash: 21B1A170D04249DFDB10CFA4C884BEEBBB5FF89304F20825AD505AB381D778A984CB96

Function 00440B60 Relevance: 3.1, APIs: 2, Instructions: 137encryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,?,00000000,00000000,00000001,?), ref: 00440BFA
LocalFree.KERNEL32(?,00000000), ref: 00440C8E

Memory Dump Source

Source File: 00000003.00000002.2242983706.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: CryptDataFreeLocalUnprotect
String ID:
API String ID: 1561624719-0
Opcode ID: 691253dd090d0692abb79b75d9c07df8674f2c8687ba40f9476d8420fea36caa
Instruction ID: f58a043fe36a424058588bce6ee5e9d112fd586f94ce921f9f6943f9dc7e0036
Opcode Fuzzy Hash: 691253dd090d0692abb79b75d9c07df8674f2c8687ba40f9476d8420fea36caa
Instruction Fuzzy Hash: 68517E70D00249DBEB00CFA9C8457DEFBB4FF14308F14821AE8547B281D7B96A48CBA5

Function 0047A950 Relevance: 3.1, APIs: 2, Instructions: 119encryptionCOMMON

Download Yara Rule

APIs

CryptProtectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000001,?), ref: 0047A9B8
LocalFree.KERNEL32(?,00000000), ref: 0047AA4F

Memory Dump Source

Source File: 00000003.00000002.2242983706.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: CryptDataFreeLocalProtect
String ID:
API String ID: 2714945720-0
Opcode ID: 1650d13529f5b5e644ab9d1fc943a2e59ee628ce821009b7a4047a2a1a045cf0
Instruction ID: 6fc12887242d51354b1d4be44c56afc8010d77d5c64fcd5971483ececb25fb38
Opcode Fuzzy Hash: 1650d13529f5b5e644ab9d1fc943a2e59ee628ce821009b7a4047a2a1a045cf0
Instruction Fuzzy Hash: 7351BF70D00249EBEB00CFA5D945BDEFBB4FF54308F10821AE81077281D7B96A58CBA5

Function 004A5FE0 Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 004992A7: GetLastError.KERNEL32(00000000,?,004A2D01), ref: 004992AB
Part of subcall function 004992A7: SetLastError.KERNEL32(00000000,00000000,00000001,00000006,000000FF), ref: 0049934D

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 004A6034

Memory Dump Source

Source File: 00000003.00000002.2242983706.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 56b126747d64a408f8cb97836ba55e90b6bea24853320db90e581c5e767a0a51
Instruction ID: 4410453ce78f061189afbc458556258a4ff070a6a13362461f6e96f76a4d0aba
Opcode Fuzzy Hash: 56b126747d64a408f8cb97836ba55e90b6bea24853320db90e581c5e767a0a51
Instruction Fuzzy Hash: A121B232655206ABDF28DF25DC41A7B77ACEF61314B1500BFFA01C6281EB38ED408A58

Function 004A5C67 Relevance: 1.6, APIs: 1, Instructions: 63COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 004992A7: GetLastError.KERNEL32(00000000,?,004A2D01), ref: 004992AB
Part of subcall function 004992A7: SetLastError.KERNEL32(00000000,00000000,00000001,00000006,000000FF), ref: 0049934D

EnumSystemLocalesW.KERNEL32(004A5D8D,00000001,00000000,?,-00000050,?,004A63C1,00000000,?,?,?,00000055,?), ref: 004A5CD9

Memory Dump Source

Source File: 00000003.00000002.2242983706.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: e42620a4cb20c2da49a4224be13f12341b998f391a46648d9ba836fd2d73139f
Instruction ID: 1406c895032231e24aa0afc96b0d01b76351fdf719fc880d52765eb770635e76
Opcode Fuzzy Hash: e42620a4cb20c2da49a4224be13f12341b998f391a46648d9ba836fd2d73139f
Instruction Fuzzy Hash: 1711E537600B015FDB18AF79C9916BABB92FF91368B18842EE94787B40E375A942C744

Function 004A620F Relevance: 1.5, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

Part of subcall function 004992A7: GetLastError.KERNEL32(00000000,?,004A2D01), ref: 004992AB
Part of subcall function 004992A7: SetLastError.KERNEL32(00000000,00000000,00000001,00000006,000000FF), ref: 0049934D

GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,004A5FA9,00000000,00000000,?), ref: 004A623B

Memory Dump Source

Source File: 00000003.00000002.2242983706.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: afed30a40adaf0fe2c2ae6d6b95a375c8a19700a8aa4b2d509547a2ce32d92aa
Instruction ID: 9487850153f17b5aff8b54b84101990ee62d9d6b8c11e223cf6e38bc87e8a6da
Opcode Fuzzy Hash: afed30a40adaf0fe2c2ae6d6b95a375c8a19700a8aa4b2d509547a2ce32d92aa
Instruction Fuzzy Hash: 3C01DB33A10112ABDF286A658D06BBB7768DB51754F1A446FEC06A3680DA38ED41C698

Function 004A5D02 Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 004992A7: GetLastError.KERNEL32(00000000,?,004A2D01), ref: 004992AB
Part of subcall function 004992A7: SetLastError.KERNEL32(00000000,00000000,00000001,00000006,000000FF), ref: 0049934D

EnumSystemLocalesW.KERNEL32(004A5FE0,00000001,00000005,?,-00000050,?,004A6389,-00000050,?,?,?,00000055,?,-00000050,?,?), ref: 004A5D4C

Memory Dump Source

Source File: 00000003.00000002.2242983706.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: eaaeaeafc5fac60a840ad3651ae3e1ab29e3739c136bdf2006a19ad432905435
Instruction ID: c98a1cf7b30e52ba405588815af828edc546cc3ef2e56581ce593e44f0a9addd
Opcode Fuzzy Hash: eaaeaeafc5fac60a840ad3651ae3e1ab29e3739c136bdf2006a19ad432905435
Instruction Fuzzy Hash: 2AF022362007041FCB246F799885A6A7BA5EB81368F14842EF9054B690C2759C02C658

Function 0049C70E Relevance: 1.5, APIs: 1, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0049B2E1: EnterCriticalSection.KERNEL32(-0051B45F,?,004A6D40,00000000,005137C8,0000000C,004A6D08,0043FE48,?,0049C6D7,0043FE48,?,00499445,00000001,00000364,00000001), ref: 0049B2F0

EnumSystemLocalesW.KERNEL32(0049C701,00000001,00513580,0000000C,0049CB55,00000000), ref: 0049C746

Memory Dump Source

Source File: 00000003.00000002.2242983706.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: CriticalEnterEnumLocalesSectionSystem
String ID:
API String ID: 1272433827-0
Opcode ID: 69dda01542ccd3eab63414d956f3fcf1c5f44d3c23f22103bfe59f95768ac423
Instruction ID: a78643f9f3df08ccc8addbe33751412e33acbb4152fc9e9c363d2dc9b4240f3c
Opcode Fuzzy Hash: 69dda01542ccd3eab63414d956f3fcf1c5f44d3c23f22103bfe59f95768ac423
Instruction Fuzzy Hash: A0F04972A40205EFEB00DFA9E882B9C7BF0FB55725F10816BF415EB2A0D77959049F44

Function 0047AE10 Relevance: 1.5, APIs: 1, Instructions: 33COMMON

Download Yara Rule

APIs

BCryptCloseAlgorithmProvider.BCRYPT(?,00000000,8762CD73,?,?,?,004CB69D,000000FF), ref: 0047AE4A

Memory Dump Source

Source File: 00000003.00000002.2242983706.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: AlgorithmCloseCryptProvider
String ID:
API String ID: 3378198380-0
Opcode ID: ba7b4d00b8746e9ab6913010367bb35a0b16d4da032a75110d36ee2580577608
Instruction ID: 7a92f9e53ad6301b38de286dc83f6de03fbb372fed7888f050c821ed69dc0e63
Opcode Fuzzy Hash: ba7b4d00b8746e9ab6913010367bb35a0b16d4da032a75110d36ee2580577608
Instruction Fuzzy Hash: B1F06D71A44618ABD720CF58DC05B9AB7F8EB04B20F10476FE821A37C0D779A9008B94

Function 004A5C1C Relevance: 1.5, APIs: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 004992A7: GetLastError.KERNEL32(00000000,?,004A2D01), ref: 004992AB
Part of subcall function 004992A7: SetLastError.KERNEL32(00000000,00000000,00000001,00000006,000000FF), ref: 0049934D

EnumSystemLocalesW.KERNEL32(004A5B75,00000001,00000005,?,?,004A63E3,-00000050,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 004A5C53

Memory Dump Source

Source File: 00000003.00000002.2242983706.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: f5bcbf328ab98889824a8f4a2aca38cb232a0aaea5e92dc81316268b5f07e0b0
Instruction ID: 8029f739405c8b6d15305cd3561d0adeac93de3ed34cfe121213407b3ae16d1c
Opcode Fuzzy Hash: f5bcbf328ab98889824a8f4a2aca38cb232a0aaea5e92dc81316268b5f07e0b0
Instruction Fuzzy Hash: B1F05C3630030557CB049F35D84576A7F54EFD2724F06005EEA058B690C6769842C754

Function 0049CCB0 Relevance: 1.5, APIs: 1, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,?,00000000,?,-00000050,?,?,?,0049A8AF,?,20001004,00000000,00000002,?,?,00499EA1), ref: 0049CCE4

Memory Dump Source

Source File: 00000003.00000002.2242983706.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: f7abdc218717ea54d8d13a8a84f23afce84eed1fa1e88fe8fac7f9052fbf838e
Instruction ID: eb41334156ced680ef33706ab3692b9e9ee117c5b5a07fe61c85a323d836a744
Opcode Fuzzy Hash: f7abdc218717ea54d8d13a8a84f23afce84eed1fa1e88fe8fac7f9052fbf838e
Instruction Fuzzy Hash: BDE04F35501228BBCF122F61DC04EAE7F16EF84761F004036FC0A66261CB368D21AAD9

Function 00477B00 Relevance: 31.7, APIs: 21, Instructions: 230processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,8762CD73,?,?), ref: 00477B54
Process32FirstW.KERNEL32(00000000,?), ref: 00477BB9
Process32NextW.KERNEL32(00000000,0000022C), ref: 00477BE0
OpenProcess.KERNEL32(00000400,00000000,?), ref: 00477BFD
OpenProcessToken.ADVAPI32(00000000,0000000E,?), ref: 00477C2A
GetTokenInformation.ADVAPI32(?,00000001(TokenIntegrityLevel),00000000,00000000,00000000), ref: 00477C4D
GetLastError.KERNEL32 ref: 00477C5B
GetTokenInformation.ADVAPI32(?,00000001(TokenIntegrityLevel),00000000,00000000,00000000), ref: 00477C9C
CloseHandle.KERNEL32(00000000), ref: 00477CA7
CloseHandle.KERNEL32(?), ref: 00477CAF
CloseHandle.KERNEL32(?), ref: 00477E29
Process32NextW.KERNEL32(?,0000022C), ref: 00477E39
CloseHandle.KERNEL32(?), ref: 00477E62
CloseHandle.KERNEL32(00000000), ref: 00477E65
CloseHandle.KERNEL32(00000000), ref: 00477E84

Memory Dump Source

Source File: 00000003.00000002.2242983706.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: CloseHandle$Process32Token$InformationNextOpenProcess$CreateErrorFirstLastSnapshotToolhelp32
String ID:
API String ID: 1236848392-0
Opcode ID: 8196f859269c8a2d89c48d56fc566d1cdbd904d5535603d3da99df98a23cf43e
Instruction ID: 454ab3ae29a80d327a78c61064fadb2005c2365cc5293efb4604dbbba27fe465
Opcode Fuzzy Hash: 8196f859269c8a2d89c48d56fc566d1cdbd904d5535603d3da99df98a23cf43e
Instruction Fuzzy Hash: F6A15B709052189FDF219F24DC89BAEBBB8EF44700F5441EAE90CA2250EB359E84DF59

Function 0044E020 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 147COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0044E070
std::_Lockit::_Lockit.LIBCPMT ref: 0044E092
std::_Lockit::~_Lockit.LIBCPMT ref: 0044E0BA
std::_Facet_Register.LIBCPMT ref: 0044E1D0
std::_Lockit::~_Lockit.LIBCPMT ref: 0044E1FA

Strings

p]C, xrefs: 0044E15D
cC, xrefs: 0044E17E
`aC, xrefs: 0044E16A

Memory Dump Source

Source File: 00000003.00000002.2242983706.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_Register
String ID: cC$`aC$p]C
API String ID: 459529453-2177106863
Opcode ID: 3b4551e079cc5b39d29d7e7bdd64fe49162edcc9952f3099eaf8dfb465f0d5d9
Instruction ID: 1ff138599dd9b712ad814e44402e9ca08be03e0a2a2e3ebe43d51928b08ed38c
Opcode Fuzzy Hash: 3b4551e079cc5b39d29d7e7bdd64fe49162edcc9952f3099eaf8dfb465f0d5d9
Instruction Fuzzy Hash: 99518BB0D00259DBEB10CF99C8457AEBBB4FB18314F24815ED811AB381DB79AA44CBA5

Function 004AAEF3 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 147COMMONLIBRARYCODE

Download Yara Rule

APIs

DecodePointer.KERNEL32(?,?,?,?,?,?,?,?,?,004AA85F), ref: 004AAF0C

Strings

asin, xrefs: 004AB039
acos, xrefs: 004AB042
pow, xrefs: 004AAFAA, 004AB054, 004AB0A1
sqrt, xrefs: 004AB04B
log10, xrefs: 004AAF4E, 004AAF5D
exp, xrefs: 004AAF8B, 004AAFF0
log, xrefs: 004AAF69, 004AAF78

Memory Dump Source

Source File: 00000003.00000002.2242983706.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: DecodePointer
String ID: acos$asin$exp$log$log10$pow$sqrt
API String ID: 3527080286-3064271455
Opcode ID: 74ba9069d7c1eb0fdfb04e1fac74ca4f81e2e7f03cc06b4bb9d653b05ebe1574
Instruction ID: 58aec3622616389bffb488f30e5ac45d5b57ecd31d6a71103e59991c775c814d
Opcode Fuzzy Hash: 74ba9069d7c1eb0fdfb04e1fac74ca4f81e2e7f03cc06b4bb9d653b05ebe1574
Instruction Fuzzy Hash: BE516C7090860ACFCF148F58D9481AFBFB0FB66300F558187E4A1A6355C7BD8966CB9A

Function 00452250 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 135COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0045228D
std::_Lockit::_Lockit.LIBCPMT ref: 004522AF
std::_Lockit::~_Lockit.LIBCPMT ref: 004522D7
__Getcoll.LIBCPMT ref: 0045239F
std::_Facet_Register.LIBCPMT ref: 004523EB
std::_Lockit::~_Lockit.LIBCPMT ref: 00452415

Strings

p]C, xrefs: 00452378
`aC, xrefs: 00452385

Memory Dump Source

Source File: 00000003.00000002.2242983706.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_GetcollRegister
String ID: `aC$p]C
API String ID: 1184649410-1363152631
Opcode ID: ee0d8e80db7bf3ce5345385ae9befd7b19c844c70984252df4be432834496699
Instruction ID: 568a7e1164ae6cef3cf0599e82aad122ccc02b6897634e5ab4797aad8f19cd87
Opcode Fuzzy Hash: ee0d8e80db7bf3ce5345385ae9befd7b19c844c70984252df4be432834496699
Instruction Fuzzy Hash: 49518B70800208DFDB01DF95C9457DEBBB4FF55318F24815ED805AB282DBB9AE49CBA9

Function 004AFE4C Relevance: 12.6, APIs: 3, Strings: 4, Instructions: 303COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 004AFF6B
___TypeMatch.LIBVCRUNTIME ref: 004B0079
CallUnexpected.LIBVCRUNTIME ref: 004B01E6

Strings

csm, xrefs: 004AFFA2
<fM, xrefs: 004AFF62
csm, xrefs: 004AFE89
csm, xrefs: 004AFEF6

Memory Dump Source

Source File: 00000003.00000002.2242983706.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: CallMatchTypeUnexpectedtype_info::operator==
String ID: <fM$csm$csm$csm
API String ID: 1206542248-3599101812
Opcode ID: aaac5c7749a7aa866996bcb2d51d73d9b1fe5293335fd4c63eebf0a3ecf9d180
Instruction ID: 5ce913a956d0af8773c3ee17d9b542f15401108c10c26080aa375b564815456b
Opcode Fuzzy Hash: aaac5c7749a7aa866996bcb2d51d73d9b1fe5293335fd4c63eebf0a3ecf9d180
Instruction Fuzzy Hash: DBB19B71800209EFCF18DFA5C8809EFB7B5FF25315B10816BE8056B212D779DA15CBA9

Function 0047CF70 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 162COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 0047D113
Concurrency::cancel_current_task.LIBCPMT ref: 0047D118
Concurrency::cancel_current_task.LIBCPMT ref: 0047D11D

Strings

true, xrefs: 0047D0B8
p]C, xrefs: 0047D008
false, xrefs: 0047D092
`aC, xrefs: 0047D015

Memory Dump Source

Source File: 00000003.00000002.2242983706.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID: `aC$false$p]C$true
API String ID: 118556049-4224333681
Opcode ID: fc25f6a8858bdc90a7f78ad0cc94d282a8ef03db695885ce467b4123cd5932c9
Instruction ID: 10a02a47a4876ff195f080d04569540bf2a908c30d6efafbe52ebceab6b25fd0
Opcode Fuzzy Hash: fc25f6a8858bdc90a7f78ad0cc94d282a8ef03db695885ce467b4123cd5932c9
Instruction Fuzzy Hash: 73510871910745DBDB20DF65C801B9EBBF4EF04718F20862FE815A7781E7BAAA04CB95

Function 0047C6C0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 128COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0047C6FD
std::_Lockit::_Lockit.LIBCPMT ref: 0047C71F
std::_Lockit::~_Lockit.LIBCPMT ref: 0047C747
std::_Facet_Register.LIBCPMT ref: 0047C834
std::_Lockit::~_Lockit.LIBCPMT ref: 0047C85E

Strings

p]C, xrefs: 0047C7E1
`aC, xrefs: 0047C7EE

Memory Dump Source

Source File: 00000003.00000002.2242983706.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_Register
String ID: `aC$p]C
API String ID: 459529453-1363152631
Opcode ID: 026aa07ec564b50549d32f646a8dd61011c7ae9d801dbb7833802f677d234be8
Instruction ID: 399bbb442a0c6c40ac274560e971594f6ebfe9651e6100c107b7a0aaef0602e2
Opcode Fuzzy Hash: 026aa07ec564b50549d32f646a8dd61011c7ae9d801dbb7833802f677d234be8
Instruction Fuzzy Hash: 2C517A71900249DFDB15CF99C580BEEBBB4EB15318F24805ED409AB381DB79AE09CF95

Function 0047D190 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 99networkfileCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET(File Downloader,00000001,00000000,00000000,00000000), ref: 0047D22D
InternetOpenUrlA.WININET(00000000,?,00000000,00000000,80000000,00000000), ref: 0047D256
InternetReadFile.WININET(00000000,?,00001000,00000000), ref: 0047D27C
InternetReadFile.WININET(00000000,?,00001000,00000000), ref: 0047D2B2
InternetCloseHandle.WININET(00000000), ref: 0047D2B9
InternetCloseHandle.WININET(?), ref: 0047D2C5

Strings

File Downloader, xrefs: 0047D214

Memory Dump Source

Source File: 00000003.00000002.2242983706.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: Internet$CloseFileHandleOpenRead
String ID: File Downloader
API String ID: 4038090926-3631955488
Opcode ID: 811208fdf33a36e9be3e42b468326af56e319a1deb0617af28b90d4cff8a8570
Instruction ID: 638e9360adee8abd238f5bb9f06079602c51a7af3a4d5d450420b7b82b1eb562
Opcode Fuzzy Hash: 811208fdf33a36e9be3e42b468326af56e319a1deb0617af28b90d4cff8a8570
Instruction Fuzzy Hash: 5B318370A01655ABD730CF55CC45BEAB7B8EF44700F1041AAF549E7290DBB8AE84DFA8

Function 0015F878 Relevance: 12.2, APIs: 8, Instructions: 248COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCPInfo.KERNEL32(?,?,?,7FFFFFFF,?,0015F863,?,?,?,?,?,?,?,?,?,?), ref: 0015F91E
__alloca_probe_16.LIBCMT ref: 0015F9D9
__alloca_probe_16.LIBCMT ref: 0015FA68
__freea.LIBCMT ref: 0015FAB3
__freea.LIBCMT ref: 0015FAB9
__freea.LIBCMT ref: 0015FAEF
__freea.LIBCMT ref: 0015FAF5
__freea.LIBCMT ref: 0015FB05

Memory Dump Source

Source File: 00000003.00000002.2242784215.0000000000151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000003.00000002.2242762091.0000000000150000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2242815596.0000000000162000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2242836543.000000000016A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2242864527.000000000016D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2242886972.0000000000170000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_drop1.jbxd

Similarity

API ID: __freea$__alloca_probe_16$Info
String ID:
API String ID: 127012223-0
Opcode ID: 63ece9fc45d746690a6ba1273d6e9bd7336da885c49c0640a4feac5ff5a9fe03
Instruction ID: a647d088bb42f3b931acc8a0c3a0ecd21a67c34ef3d9d756550cf09658b59eb5
Opcode Fuzzy Hash: 63ece9fc45d746690a6ba1273d6e9bd7336da885c49c0640a4feac5ff5a9fe03
Instruction Fuzzy Hash: B771D372904206EBDF209E64CC92FAE77A99F45316F29002DFD35AF281E7359C4A8791

Function 004B9D99 Relevance: 12.2, APIs: 8, Instructions: 225COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCPInfo.KERNEL32(?,?,?,?,?), ref: 004B9E24
MultiByteToWideChar.KERNEL32(?,00000009,?,?,00000000,00000000), ref: 004B9EB0
__alloca_probe_16.LIBCMT ref: 004B9EDA
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 004B9F1B
MultiByteToWideChar.KERNEL32(?,00000009,?,?,00000000,00000000), ref: 004B9F37
__alloca_probe_16.LIBCMT ref: 004B9F5D
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 004B9F9A
CompareStringEx.KERNEL32(?,?,00000000,?,00000000,?,00000000,00000000,00000000), ref: 004B9FB7

Memory Dump Source

Source File: 00000003.00000002.2242983706.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWide$__alloca_probe_16$CompareInfoString
String ID:
API String ID: 3603178046-0
Opcode ID: 3ce074e6bcc7f87e0e4de1f7dc2ca851322fbe0f14b3b5897e042b4e817243f3
Instruction ID: 05f54580d30f9e3720c8b3961695daa3f0f937b9c5610d8c2bd80885558d9d7b
Opcode Fuzzy Hash: 3ce074e6bcc7f87e0e4de1f7dc2ca851322fbe0f14b3b5897e042b4e817243f3
Instruction Fuzzy Hash: 7871AE3290021AABDF219F65CC85BFF7BB9AF05724F18405BEA04E6291D7398C40C7B9

Function 004B9AF7 Relevance: 12.2, APIs: 8, Instructions: 175COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,00000001,?,00000000,00000000,?,?,?,00000001), ref: 004B9B40
__alloca_probe_16.LIBCMT ref: 004B9B6C
MultiByteToWideChar.KERNEL32(00000001,00000001,00000000,?,00000000,00000000), ref: 004B9BAB
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 004B9BC8
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 004B9C07
__alloca_probe_16.LIBCMT ref: 004B9C24
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 004B9C66
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,?,00000000,00000000), ref: 004B9C89

Memory Dump Source

Source File: 00000003.00000002.2242983706.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: ByteCharMultiStringWide$__alloca_probe_16
String ID:
API String ID: 2040435927-0
Opcode ID: 127654da753590042b08ac6595405d01716cfec311436dda6d72091204f46cc9
Instruction ID: 0cb7a2a667138b596a59e049b57baa22d652deda395932da07ab0cb8239329c9
Opcode Fuzzy Hash: 127654da753590042b08ac6595405d01716cfec311436dda6d72091204f46cc9
Instruction Fuzzy Hash: A151BF7250020AABEF219F65CC44FEB7FB9EF50740F24412AFA05A6260D7399C11CB68

Function 00489F30 Relevance: 12.1, APIs: 8, Instructions: 134COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?), ref: 00489F4B
GetProcessId.KERNEL32(00000000), ref: 00489F52
RmStartSession.RSTRTMGR(?,00000041,?), ref: 00489F76
RmRegisterResources.RSTRTMGR(?,00000001,?,00000000,00000000,00000000,00000000), ref: 00489F91
RmGetList.RSTRTMGR(?,?,?,00000003,?), ref: 00489FD4
RmGetList.RSTRTMGR(?,?,?,00000000,?), ref: 0048A020
RmEndSession.RSTRTMGR(?), ref: 0048A04A
RmEndSession.RSTRTMGR(?), ref: 0048A07A

Memory Dump Source

Source File: 00000003.00000002.2242983706.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: Session$ListProcess$CurrentRegisterResourcesStart
String ID:
API String ID: 3299295986-0
Opcode ID: c8fc720c6df2cefa911e5ab8bfb66f499295b1f9aa4f52cb019436ebaefd8700
Instruction ID: 0c548674b0cea8079c7009f79d794e669f8d4684f59b10cf2f6688a8c9d6d6ed
Opcode Fuzzy Hash: c8fc720c6df2cefa911e5ab8bfb66f499295b1f9aa4f52cb019436ebaefd8700
Instruction Fuzzy Hash: A7417971E011589BEF10AFE4DC44AEEBBBCEB45300F14412BE902EB254EB7A9C058B95

Function 00473B90 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 333COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 00473D56
___std_exception_destroy.LIBVCRUNTIME ref: 00473D73

Part of subcall function 004AFA0C: RaiseException.KERNEL32(E06D7363,00000001,00000003,0043FE44,?,?,?,004B9080,0043FE44,00513AB0,?,0043FE44,?,?,0000000C,8762CD73), ref: 004AFA6C

___std_exception_destroy.LIBVCRUNTIME ref: 00473FC0
___std_exception_destroy.LIBVCRUNTIME ref: 00473FDD

Strings

value, xrefs: 00473C96, 00473EF5
MC, xrefs: 00473D4C, 00473D68, 00473FB6, 00473FD2

Memory Dump Source

Source File: 00000003.00000002.2242983706.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: ___std_exception_destroy$ExceptionRaise
String ID: MC$value
API String ID: 299339551-3840657116
Opcode ID: fad894e6791b73173a90b46eb5f7d570fcfb30b2d17f717ef1dd9171332bf87e
Instruction ID: 838f8dd16b3ea7f4eeb45613560c02c2ef3b01355b1a5592379bf0a45a67ceab
Opcode Fuzzy Hash: fad894e6791b73173a90b46eb5f7d570fcfb30b2d17f717ef1dd9171332bf87e
Instruction Fuzzy Hash: 31F15A70C05298DEEB20DB65C954BDEFBB4AF19304F1482DAD44963282E7746B88CF96

Function 00155C80 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 122COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00155CB7
___except_validate_context_record.LIBVCRUNTIME ref: 00155CBF
_ValidateLocalCookies.LIBCMT ref: 00155D48
__IsNonwritableInCurrentImage.LIBCMT ref: 00155D73
_ValidateLocalCookies.LIBCMT ref: 00155DC8

Strings

csm, xrefs: 00155D5D

Memory Dump Source

Source File: 00000003.00000002.2242784215.0000000000151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000003.00000002.2242762091.0000000000150000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2242815596.0000000000162000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2242836543.000000000016A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2242864527.000000000016D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2242886972.0000000000170000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_drop1.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 11d728f961d2228de6224caa0d7e390a794cbde9e0e42c374779170c1a64b99a
Instruction ID: c52cfdc71f1310df33c4aa1bf189bc8501025859cac4ead94dcfb8e4be1826be
Opcode Fuzzy Hash: 11d728f961d2228de6224caa0d7e390a794cbde9e0e42c374779170c1a64b99a
Instruction Fuzzy Hash: 6741E535A00618EBCF10DFA8CC98A9EBBF6EF44325F148055EC246F392D771A959CB91

Function 004AD600 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 122COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 004AD637
___except_validate_context_record.LIBVCRUNTIME ref: 004AD63F
_ValidateLocalCookies.LIBCMT ref: 004AD6C8
__IsNonwritableInCurrentImage.LIBCMT ref: 004AD6F3
_ValidateLocalCookies.LIBCMT ref: 004AD748

Strings

csm, xrefs: 004AD6DD

Memory Dump Source

Source File: 00000003.00000002.2242983706.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 255d3a1bd88e468a9ea08ee1f7f85cdc8f29e10e22a0162dea8eb7e65443c785
Instruction ID: fca86a332ffc7d642b39a5fdc798139505592cae81a3a9a41e25a428a24f43dc
Opcode Fuzzy Hash: 255d3a1bd88e468a9ea08ee1f7f85cdc8f29e10e22a0162dea8eb7e65443c785
Instruction Fuzzy Hash: 2741D834E002089BCF10DF69C880A9E7BB5BF66318F14815BE81A5B752D739EA01CF95

Function 001594CE Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,00000000,00000800,00000000,?,?,BB40E64E,?,001595DD,00152442,?,00000000,?), ref: 0015958F

Strings

api-ms-, xrefs: 00159525
ext-ms-, xrefs: 00159539

Memory Dump Source

Source File: 00000003.00000002.2242784215.0000000000151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000003.00000002.2242762091.0000000000150000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2242815596.0000000000162000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2242836543.000000000016A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2242864527.000000000016D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2242886972.0000000000170000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_drop1.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: 7affb6c59a394bdbbf6f5f3616ab0a2aa38e90e5278069716d4f614a12a0c980
Instruction ID: acd7f4008ea39d60b9136434c343c7033cda25d9e0e72691c37dd796aa33edfe
Opcode Fuzzy Hash: 7affb6c59a394bdbbf6f5f3616ab0a2aa38e90e5278069716d4f614a12a0c980
Instruction Fuzzy Hash: DF213D71A11211E7CB228724EC40A5A37689B557A2F150112FD26EF2D0FB70EE59C6D1

Function 0049C8FA Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,0049CA09,0043FE48,00434C2F,00000000,00000001,0043FE4A,?,0049CC33,00000022,FlsSetValue,004D294C,FlsSetValue,00000001), ref: 0049C9BB

Strings

ext-ms-, xrefs: 0049C965
api-ms-, xrefs: 0049C951

Memory Dump Source

Source File: 00000003.00000002.2242983706.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: 7c1f6f25a6eeb0dcc1b48f853c441653626ec7c6eb0710202be6e4b6adacda37
Instruction ID: 9ca0f964f7470424b5d3057a4191f763ac6aa624da693043a33dcdca32e519f2
Opcode Fuzzy Hash: 7c1f6f25a6eeb0dcc1b48f853c441653626ec7c6eb0710202be6e4b6adacda37
Instruction Fuzzy Hash: A621E7B2A01211ABDF219B25ECC0B5F3B69AB527A4F250237E905A7390D738ED01C6DD

Function 00436640 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 72COMMON

Download Yara Rule

APIs

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 004366E9

Part of subcall function 004AFA0C: RaiseException.KERNEL32(E06D7363,00000001,00000003,0043FE44,?,?,?,004B9080,0043FE44,00513AB0,?,0043FE44,?,?,0000000C,8762CD73), ref: 004AFA6C

Strings

ios_base::eofbit set, xrefs: 00436686
(>Q, xrefs: 004366D9
ios_base::badbit set, xrefs: 00436677, 004366A2
ios_base::failbit set, xrefs: 00436681
0hC, xrefs: 004366E3

Memory Dump Source

Source File: 00000003.00000002.2242983706.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: ExceptionIos_base_dtorRaisestd::ios_base::_
String ID: (>Q$0hC$ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 1903096808-798308736
Opcode ID: 0ed2678322210cc8cc3a07b91dadb1e30d188d3d66194e55af3b44069607d8cc
Instruction ID: 0e9c3b5a5aba75944b05d252eccadd5948fd44e578ec9c0118fa22ff265feac2
Opcode Fuzzy Hash: 0ed2678322210cc8cc3a07b91dadb1e30d188d3d66194e55af3b44069607d8cc
Instruction Fuzzy Hash: 4E1122B29046487BD710DB59DC02FAA7398EB09754F04862FFD58872C1EB3DA90487AA

Function 0015489F Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 15libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll), ref: 001548A5
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 001548B3
GetProcAddress.KERNEL32(00000000,GetTempPath2W), ref: 001548C4

Strings

GetTempPath2W, xrefs: 001548B9
GetSystemTimePreciseAsFileTime, xrefs: 001548AD
kernel32.dll, xrefs: 001548A0

Memory Dump Source

Source File: 00000003.00000002.2242784215.0000000000151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000003.00000002.2242762091.0000000000150000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2242815596.0000000000162000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2242836543.000000000016A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2242864527.000000000016D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2242886972.0000000000170000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_drop1.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: GetSystemTimePreciseAsFileTime$GetTempPath2W$kernel32.dll
API String ID: 667068680-1047828073
Opcode ID: c054290cf9f879d82b62dcf5daa1332ea5d29f3d350cc431fc2c0270bf83b218
Instruction ID: 8bc92b233fca3da3cd9febb653260e86c75851f549ae4c472f1427250c59023c
Opcode Fuzzy Hash: c054290cf9f879d82b62dcf5daa1332ea5d29f3d350cc431fc2c0270bf83b218
Instruction Fuzzy Hash: A1D0A732687A20EFC3109F787C0D84B3FA5EB043413010611F401D2651DFF404D4CBA0

Function 0049D57F Relevance: 9.3, APIs: 6, Instructions: 329COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2242983706.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drop1.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a850e4bd8366f6602f7f439948ddd996ec0ba155590deffeea4e3919eff859f
Instruction ID: c45b587b2b6024bbc8d631f61cfde13028adc071dc65d72902c8bf59655bd6a7
Opcode Fuzzy Hash: 8a850e4bd8366f6602f7f439948ddd996ec0ba155590deffeea4e3919eff859f
Instruction Fuzzy Hash: 64B13572D00255AFDF11DF64CC81BAA7FA5EF55310F1441BBE454AB382D2789D01C7A9

Function 004A2113 Relevance: 9.1, APIs: 3, Strings: 2, Instructions: 370COMMONLIBRARYCODE

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 004A21FD
__freea.LIBCMT ref: 004A228D
__freea.LIBCMT ref: 004A22A9

Strings

am/pm, xrefs: 004A230B
a/p, xrefs: 004A236F

Memory Dump Source

Source File: 00000003.00000002.2242983706.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: __freea$__alloca_probe_16
String ID: a/p$am/pm
API String ID: 3509577899-3206640213
Opcode ID: 2f1fc7fa59a782c27ac2a0a21d9667bbb23879f6a72bde815bccda8bcba835b0
Instruction ID: 1d0f90a389a6ddb01c6eee3cfed114d4cdbff39c5c4e16d1e763b1923b69fac5
Opcode Fuzzy Hash: 2f1fc7fa59a782c27ac2a0a21d9667bbb23879f6a72bde815bccda8bcba835b0
Instruction Fuzzy Hash: 32C1BF35904212AADB298F6CCA947BB77B0FF2B300F14405BE905AB750D3BD9D42EB59

Function 0047CCA0 Relevance: 9.1, APIs: 6, Instructions: 108COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0047CCD6
std::_Lockit::_Lockit.LIBCPMT ref: 0047CCF9
std::_Lockit::~_Lockit.LIBCPMT ref: 0047CD21
std::_Facet_Register.LIBCPMT ref: 0047CD9A
std::_Lockit::~_Lockit.LIBCPMT ref: 0047CDC4
Concurrency::cancel_current_task.LIBCPMT ref: 0047CDE7

Memory Dump Source

Source File: 00000003.00000002.2242983706.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: 28da64327ea27554a00a06c9e40525b24cdd21d51c36f3309ffdeb549bf855e5
Instruction ID: 5e0d328f53af4ec2248f8036dfe48c657d56e4526373956cc4eb9e978e4c29ea
Opcode Fuzzy Hash: 28da64327ea27554a00a06c9e40525b24cdd21d51c36f3309ffdeb549bf855e5
Instruction Fuzzy Hash: FE419A71800219CFCB21CF98C980BEFBBB4EB15714F14856ED80A67381D738AE04CBA5

Function 00157F49 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00157F40,00155A6B,00155180), ref: 00157F57
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00157F65
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00157F7E
SetLastError.KERNEL32(00000000,00157F40,00155A6B,00155180), ref: 00157FD0

Memory Dump Source

Source File: 00000003.00000002.2242784215.0000000000151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000003.00000002.2242762091.0000000000150000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2242815596.0000000000162000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2242836543.000000000016A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2242864527.000000000016D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2242886972.0000000000170000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_drop1.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 3d4ac19216367687ec5530f4b2f6058929f61a36dedb694f37e3512466729db5
Instruction ID: cac63bb495994d82ad5034a0257f0075d9d8a00615ba86fc3bbe57a0a3e3d361
Opcode Fuzzy Hash: 3d4ac19216367687ec5530f4b2f6058929f61a36dedb694f37e3512466729db5
Instruction Fuzzy Hash: 1D01B17210C612EEA62567B5BC8682637A8DF5577B721022AFC305D4F1EF924C4E9650

Function 004AFADE Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,004AFAD5,004AF923,004AC85A), ref: 004AFAEC
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 004AFAFA
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 004AFB13
SetLastError.KERNEL32(00000000,004AFAD5,004AF923,004AC85A), ref: 004AFB65

Memory Dump Source

Source File: 00000003.00000002.2242983706.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 0a9cead03a1cbea0f2d00e28f649f33043dad87cbbba68afa2d7a2a72df1b0e0
Instruction ID: 5c97271c99781371f32c50c56a2d0a191a69233ae1c55058bab721689d3f3b0d
Opcode Fuzzy Hash: 0a9cead03a1cbea0f2d00e28f649f33043dad87cbbba68afa2d7a2a72df1b0e0
Instruction Fuzzy Hash: 9001F9321093119E9A2417F5AC559972A65EB23379B24463FF514951E0FB1A5C0CA16C

Function 00480AC0 Relevance: 9.1, APIs: 6, Instructions: 56COMMON

Download Yara Rule

APIs

DeleteObject.GDI32(?), ref: 00480B31
EnterCriticalSection.KERNEL32(00000004,8762CD73,?,?,?,?,004C21C0,000000FF,?,00480A9B), ref: 00480B42
EnterCriticalSection.KERNEL32(00000004,?,?,?,?,004C21C0,000000FF,?,00480A9B), ref: 00480B4F
GdiplusShutdown.GDIPLUS(00000000,?,?,?,?,004C21C0,000000FF,?,00480A9B), ref: 00480B5C
LeaveCriticalSection.KERNEL32(00000004,?,?,?,?,004C21C0,000000FF,?,00480A9B), ref: 00480B69
LeaveCriticalSection.KERNEL32(00000004,?,?,?,?,004C21C0,000000FF,?,00480A9B), ref: 00480B70

Memory Dump Source

Source File: 00000003.00000002.2242983706.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave$DeleteGdiplusObjectShutdown
String ID:
API String ID: 4268643673-0
Opcode ID: ab380d08308f5f7294dc0c8834127c13781bff22419dd726a23e31aeb0b35f9a
Instruction ID: a49544f5ea7446c9cfb95f09875386710a40740b290a3353e41ff902735902d1
Opcode Fuzzy Hash: ab380d08308f5f7294dc0c8834127c13781bff22419dd726a23e31aeb0b35f9a
Instruction Fuzzy Hash: 8B117FB15002009FD3209F58D848B1A7BF8FF05728F20475EE4258B2D1C77AD806CB94

Function 001587D9 Relevance: 9.1, APIs: 2, Strings: 3, Instructions: 301COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 001588F8
CallUnexpected.LIBVCRUNTIME ref: 00158B71

Strings

csm, xrefs: 00158883
csm, xrefs: 00158816
csm, xrefs: 0015892F

Memory Dump Source

Source File: 00000003.00000002.2242784215.0000000000151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000003.00000002.2242762091.0000000000150000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2242815596.0000000000162000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2242836543.000000000016A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2242864527.000000000016D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2242886972.0000000000170000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_drop1.jbxd

Similarity

API ID: CallUnexpectedtype_info::operator==
String ID: csm$csm$csm
API String ID: 2673424686-393685449
Opcode ID: 55c7ccc12e4f8d3a8c569a6d029a210d590a54ae719e9fec6d9e4a32adfe35fd
Instruction ID: f7172af49ba3286e5c35d3b05d417f5cc6273c67cbaa8130cec910eab93b4e2a
Opcode Fuzzy Hash: 55c7ccc12e4f8d3a8c569a6d029a210d590a54ae719e9fec6d9e4a32adfe35fd
Instruction Fuzzy Hash: F0B17971800209EFCF18EFA4C8819AEB7B5FF54316B14415AEC217F252DB31DA5ACB91

Function 0048A490 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 195COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32(8762CD73), ref: 0048A4E4
FreeEnvironmentStringsW.KERNEL32(?), ref: 0048A685
RtlInitUnicodeString.NTDLL(?), ref: 0048A6D9
RtlInitUnicodeString.NTDLL(?,00000000), ref: 0048A6E4

Strings

0Qv, xrefs: 0048A6D9, 0048A6E4

Memory Dump Source

Source File: 00000003.00000002.2242983706.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: EnvironmentInitStringStringsUnicode$Free
String ID: 0Qv
API String ID: 2488768755-416853194
Opcode ID: 0d066fd5a037e956643cd3d92a9a96980abf0cb91633621b3d58d647d7d5a7ef
Instruction ID: 1a99e4392def1b605416f46e3147960cb17592dd8275db88d5f878599104deaf
Opcode Fuzzy Hash: 0d066fd5a037e956643cd3d92a9a96980abf0cb91633621b3d58d647d7d5a7ef
Instruction Fuzzy Hash: 6471AAB1C10219EBDB00DF98C884B9EFBF8FF18304F14461BE815A3250E7B8A995CB95

Function 00156A60 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,BB40E64E,?,?,00000000,00161B77,000000FF,?,00156B21,?,?,00156BBD,00000000), ref: 00156A95
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00156AA7
FreeLibrary.KERNEL32(00000000,?,00000000,00161B77,000000FF,?,00156B21,?,?,00156BBD,00000000), ref: 00156AC9

Strings

mscoree.dll, xrefs: 00156A8E
CorExitProcess, xrefs: 00156A9F

Memory Dump Source

Source File: 00000003.00000002.2242784215.0000000000151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000003.00000002.2242762091.0000000000150000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2242815596.0000000000162000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2242836543.000000000016A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2242864527.000000000016D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2242886972.0000000000170000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_drop1.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 08d8cffead9dd2b7b754acad2ebe4fbe1db868d62e4142b3893f73fe679b3afb
Instruction ID: 01634860fd176a5e4cffee62445cb874c9b275ef2a15f170a091ccf048df1644
Opcode Fuzzy Hash: 08d8cffead9dd2b7b754acad2ebe4fbe1db868d62e4142b3893f73fe679b3afb
Instruction Fuzzy Hash: A701AD31944619FFDB118F44CC09FAEBBB8FB04B55F484625FC22A36E0DBB49848CA80

Function 004A2923 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,8762CD73,00000001,?,00000000,004CEBA0,000000FF,?,004A28BD,?,?,004A2891,00000016), ref: 004A2958
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 004A296A
FreeLibrary.KERNEL32(00000000,?,00000000,004CEBA0,000000FF,?,004A28BD,?,?,004A2891,00000016), ref: 004A298C

Strings

CorExitProcess, xrefs: 004A2962
mscoree.dll, xrefs: 004A2951

Memory Dump Source

Source File: 00000003.00000002.2242983706.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: bb5db20903b210e56e17606efd33f47167f5dac7559f5cad6f576f47fa7b3a02
Instruction ID: 4a39d6f0df0723e62e133a2fe4a12dc63d6bfdc81165c834358a2709fa0273f6
Opcode Fuzzy Hash: bb5db20903b210e56e17606efd33f47167f5dac7559f5cad6f576f47fa7b3a02
Instruction Fuzzy Hash: DA01A271A10625AFCB118F54DC05FAFBBBCFB04B10F044627E812A2790DBB89900DA98

Function 004B82A1 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 32libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,8762CD73,?,?,004CEC14,000000FF,?,004B87C4,00000105,?,00000000,?,?,?,0047FCE3), ref: 004B82C9
GetProcAddress.KERNEL32(00000000,GetTempPath2W), ref: 004B82D5
GetTempPathW.KERNEL32(?,?,004CEC14,000000FF,?,004B87C4,00000105,?,00000000,?,?,?,0047FCE3,?,00000105,?), ref: 004B82F5

Strings

GetTempPath2W, xrefs: 004B82CF
kernel32.dll, xrefs: 004B82C4

Memory Dump Source

Source File: 00000003.00000002.2242983706.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: AddressHandleModulePathProcTemp
String ID: GetTempPath2W$kernel32.dll
API String ID: 775647363-1846531799
Opcode ID: f1cf7476179f5a48e5f157bd4a6fca76b08ed530dfc52bf4d8c2badd71eabe8a
Instruction ID: 490c9918516094a75be01d3e1b1e27de5ce3fa518d230e70400d3a931493a6c9
Opcode Fuzzy Hash: f1cf7476179f5a48e5f157bd4a6fca76b08ed530dfc52bf4d8c2badd71eabe8a
Instruction Fuzzy Hash: C2F03A36A44654EFCB159F54EC05F9A7BA8FB09B60F008127EC16937A0DB79A800CB98

Function 0015D525 Relevance: 7.7, APIs: 5, Instructions: 197COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 0015D5AA
__alloca_probe_16.LIBCMT ref: 0015D673
__freea.LIBCMT ref: 0015D6DA

Part of subcall function 0015B3B5: HeapAlloc.KERNEL32(00000000,?,00000000,?,00153C34,?,?,00152442,00001000,?,001523AA), ref: 0015B3E7

__freea.LIBCMT ref: 0015D6ED
__freea.LIBCMT ref: 0015D6FA

Memory Dump Source

Source File: 00000003.00000002.2242784215.0000000000151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000003.00000002.2242762091.0000000000150000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2242815596.0000000000162000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2242836543.000000000016A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2242864527.000000000016D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2242886972.0000000000170000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_drop1.jbxd

Similarity

API ID: __freea$__alloca_probe_16$AllocHeap
String ID:
API String ID: 1096550386-0
Opcode ID: 098934ae3815b837f132febfede49b7916f70a859365aa9658ac7bb42ed1c2dc
Instruction ID: 7af75b38530b62b3acfcce6219ac3fc428279bf55bdd3c92306fe759e24bd10b
Opcode Fuzzy Hash: 098934ae3815b837f132febfede49b7916f70a859365aa9658ac7bb42ed1c2dc
Instruction Fuzzy Hash: 1051BF72600246EFEB359F64EC81DAB3AA9EB54716B1A0029FC38DE141EB71CC19C761

Function 0049AEB4 Relevance: 7.7, APIs: 5, Instructions: 197COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 0049AF39
__alloca_probe_16.LIBCMT ref: 0049B002
__freea.LIBCMT ref: 0049B069

Part of subcall function 0049D15A: RtlAllocateHeap.NTDLL(00000000,00000001,0043FE44,?,004AD408,0043FE4A,0043FE44,?,?,?,00434C2F,0043FE48,0043FE48), ref: 0049D18C

__freea.LIBCMT ref: 0049B07C
__freea.LIBCMT ref: 0049B089

Memory Dump Source

Source File: 00000003.00000002.2242983706.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: __freea$__alloca_probe_16$AllocateHeap
String ID:
API String ID: 1423051803-0
Opcode ID: eacd31da778fb37b7442589558929131525861ec069ee9dc50b1fd4580814607
Instruction ID: c461f83b43c969d084823d86eb7d78e4c690f12dee5ba4d22df99f96e1ee22eb
Opcode Fuzzy Hash: eacd31da778fb37b7442589558929131525861ec069ee9dc50b1fd4580814607
Instruction Fuzzy Hash: 4C510072600206AFEF209F65AD81EBB7EA9EF84314F15013EFC54D6241EB39DC5086E8

Function 00151930 Relevance: 7.7, APIs: 5, Instructions: 196COMMON

Download Yara Rule

APIs

GetFileSize.KERNEL32 ref: 00151A01
CloseHandle.KERNEL32 ref: 00151A1E

Memory Dump Source

Source File: 00000003.00000002.2242784215.0000000000151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000003.00000002.2242762091.0000000000150000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2242815596.0000000000162000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2242836543.000000000016A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2242864527.000000000016D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2242886972.0000000000170000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_drop1.jbxd

Similarity

API ID: CloseFileHandleSize
String ID:
API String ID: 3849164406-0
Opcode ID: f7e7d1c7febc28ae0117fa80e1e9ec53522b4cfb9b5be72e2d9f7f13c097d2e4
Instruction ID: 22b242a1e22839720b0eaf758c1ac9a999af9b4dfa29b11b4b7790ffa4b11c61
Opcode Fuzzy Hash: f7e7d1c7febc28ae0117fa80e1e9ec53522b4cfb9b5be72e2d9f7f13c097d2e4
Instruction Fuzzy Hash: 0281F1B4D09248EFCB05DFA8D584BAEBBF0BF09305F104929E865AB381D7749948CF56

Function 001546F6 Relevance: 7.6, APIs: 5, Instructions: 116threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 0015470A
AcquireSRWLockExclusive.KERNEL32(?,?,00000000,00161B20,000000FF,?,00153552), ref: 00154729
AcquireSRWLockExclusive.KERNEL32(?,?,?,?,00000000,00161B20,000000FF,?,00153552), ref: 00154757
TryAcquireSRWLockExclusive.KERNEL32(?,?,?,?,00000000,00161B20,000000FF,?,00153552), ref: 001547B2
TryAcquireSRWLockExclusive.KERNEL32(?,?,?,?,00000000,00161B20,000000FF,?,00153552), ref: 001547C9

Memory Dump Source

Source File: 00000003.00000002.2242784215.0000000000151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000003.00000002.2242762091.0000000000150000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2242815596.0000000000162000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2242836543.000000000016A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2242864527.000000000016D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2242886972.0000000000170000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_drop1.jbxd

Similarity

API ID: AcquireExclusiveLock$CurrentThread
String ID:
API String ID: 66001078-0
Opcode ID: c69b0716a9abcc696bdbaf773f5ea7414bfaa7e800b94b8449efee08bfdbf9a4
Instruction ID: 970a6d57be234db18dedadf8c6886de895a46e81c70568fe3baf5834551fe974
Opcode Fuzzy Hash: c69b0716a9abcc696bdbaf773f5ea7414bfaa7e800b94b8449efee08bfdbf9a4
Instruction Fuzzy Hash: 7A414D35900646DFCB24DFA5C8819AAB3F5FF0A31AB10492AD876DBA40D730F9C8CB50

Function 004B9258 Relevance: 7.5, APIs: 5, Instructions: 44COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 004B925F
std::_Lockit::_Lockit.LIBCPMT ref: 004B926A
std::_Lockit::~_Lockit.LIBCPMT ref: 004B92D8

Part of subcall function 004B93BB: std::locale::_Locimp::_Locimp.LIBCPMT ref: 004B93D3

std::locale::_Setgloballocale.LIBCPMT ref: 004B9285
_Yarn.LIBCPMT ref: 004B929B

Memory Dump Source

Source File: 00000003.00000002.2242983706.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: Lockitstd::_std::locale::_$H_prolog3LocimpLocimp::_Lockit::_Lockit::~_SetgloballocaleYarn
String ID:
API String ID: 1088826258-0
Opcode ID: 9529708b05f48a18c841b776fc683316fa11b0247fd455af3d56381143c4ee67
Instruction ID: d57bef6452a6d9f87b7c1f6c81a415e25ff1084f0ba862d3ffc406506ccaed08
Opcode Fuzzy Hash: 9529708b05f48a18c841b776fc683316fa11b0247fd455af3d56381143c4ee67
Instruction Fuzzy Hash: 2101BC75A002149BDB09EF21E881ABE3BA5BF95714B18400EE90157381CF78AE42DBE9

Function 0015D200 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,0015D29C,00000000,?,0016B728,?,?,?,0015D1D3,00000004,InitializeCriticalSectionEx,00163740,00163748), ref: 0015D20D
GetLastError.KERNEL32(?,0015D29C,00000000,?,0016B728,?,?,?,0015D1D3,00000004,InitializeCriticalSectionEx,00163740,00163748,00000000,?,00158E2C), ref: 0015D217
LoadLibraryExW.KERNEL32(00000000,00000000,00000000), ref: 0015D23F

Strings

api-ms-, xrefs: 0015D224

Memory Dump Source

Source File: 00000003.00000002.2242784215.0000000000151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000003.00000002.2242762091.0000000000150000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2242815596.0000000000162000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2242836543.000000000016A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2242864527.000000000016D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2242886972.0000000000170000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_drop1.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: dc9c63275c9cc81072b38e553692661cad6a234b85cae9f0b01937466068bd97
Instruction ID: 0740963549d63a84086d67044fd1b057db9f0b9ed016614e024f0cccf654ce5b
Opcode Fuzzy Hash: dc9c63275c9cc81072b38e553692661cad6a234b85cae9f0b01937466068bd97
Instruction Fuzzy Hash: D3E01A70684208F6EF211B60EC06B683B649B50B52F144420FD1CEC4E1DBB1E9989684

Function 004B0B2E Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,004B0ADF,00000000,?,0051BBA8,?,?,?,004B0C82,00000004,InitializeCriticalSectionEx,004D70E4,004D70EC), ref: 004B0B3B
GetLastError.KERNEL32(?,004B0ADF,00000000,?,0051BBA8,?,?,?,004B0C82,00000004,InitializeCriticalSectionEx,004D70E4,004D70EC,00000000,?,004B0A39), ref: 004B0B45
LoadLibraryExW.KERNEL32(00000000,00000000,00000000), ref: 004B0B6D

Strings

api-ms-, xrefs: 004B0B52

Memory Dump Source

Source File: 00000003.00000002.2242983706.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: e73f2d59ed71ffe050e3980c02a90d09a2b8a6f7f1eeff266cde429a2dd4b4c8
Instruction ID: d85af749d3a2776d246a861fdd0c76bc3b777c55ee5f54f02c25fa514b149693
Opcode Fuzzy Hash: e73f2d59ed71ffe050e3980c02a90d09a2b8a6f7f1eeff266cde429a2dd4b4c8
Instruction Fuzzy Hash: 25E04F30284305B7EF221BA1EC0AF5E3B55AB11B49F144032F90CA91E1EBA6A910859C

Function 0047F2C0 Relevance: 6.5, APIs: 4, Instructions: 457registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,0051C570,00000000,00020019,00000000,?,?,?,8762CD73,?,0051C2A0), ref: 0047F4D0
RegQueryValueExA.ADVAPI32(00000000,0051C2A0,00000000,000F003F,?,00000400,?,?,?,8762CD73,?,0051C2A0), ref: 0047F506
RegCloseKey.ADVAPI32(00000000,?,?,?,8762CD73,?,0051C2A0), ref: 0047F5A4
SysFreeString.OLEAUT32 ref: 0047FA14

Part of subcall function 0047A610: CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000001,?), ref: 0047A678
Part of subcall function 0047A610: LocalFree.KERNEL32(?,00000000), ref: 0047A70F

Part of subcall function 004870B0: RegOpenKeyExA.KERNEL32(80000001,0051C570,00000000,00020019,00000000,8762CD73,0051C570,0051C2A0), ref: 00487182
Part of subcall function 004870B0: RegQueryValueExA.KERNEL32(00000000,?,00000000,000F003F,?,00000400), ref: 004871B6

Memory Dump Source

Source File: 00000003.00000002.2242983706.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: FreeOpenQueryValue$CloseCryptDataLocalStringUnprotect
String ID:
API String ID: 2380017125-0
Opcode ID: a521d0abf644b9380dcd8d70f5715900671aedad0facd1908bb1e921974b8b3c
Instruction ID: 56cbdaf4eb2024de0fd4bd59dbcd72090a4e5b75bdf23aa4f75e7a392944198d
Opcode Fuzzy Hash: a521d0abf644b9380dcd8d70f5715900671aedad0facd1908bb1e921974b8b3c
Instruction Fuzzy Hash: 24122BF0E002689BDB24DF24CC5479DB7B5AF44318F1086EAD64DA7282DB346E88CF59

Function 0015DCA8 Relevance: 6.3, APIs: 4, Instructions: 333fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(BB40E64E,00000000,00000000,?), ref: 0015DD0B

Part of subcall function 0015C8A1: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,0015D6D0,?,00000000,-00000008), ref: 0015C902

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 0015DF5D
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 0015DFA3
GetLastError.KERNEL32 ref: 0015E046

Memory Dump Source

Source File: 00000003.00000002.2242784215.0000000000151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000003.00000002.2242762091.0000000000150000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2242815596.0000000000162000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2242836543.000000000016A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2242864527.000000000016D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2242886972.0000000000170000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_drop1.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: d62c6526541fd29d35b03c21f051e52b99409ac6ff56e52bc3a704813ed405ae
Instruction ID: 6b2e71619e016b156cb4e55558663dd5c09fdfdaf76330941888eeefdcf6ee2c
Opcode Fuzzy Hash: d62c6526541fd29d35b03c21f051e52b99409ac6ff56e52bc3a704813ed405ae
Instruction Fuzzy Hash: 84D17D75E04248DFCB19CFA8D8809ADBBF5FF08315F18456AE826EB251D770A94ACB50

Function 0049B476 Relevance: 6.3, APIs: 4, Instructions: 333fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(8762CD73,00000000,00000000,00000000), ref: 0049B4D9

Part of subcall function 004A1489: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,0049B05F,?,00000000,-00000008), ref: 004A14EA

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 0049B72B
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 0049B771
GetLastError.KERNEL32 ref: 0049B814

Memory Dump Source

Source File: 00000003.00000002.2242983706.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: aef57a059a08420b8d5dfae5096d35553b8056bffb0ce8bb8e63412c3f54050f
Instruction ID: 17746d06032e39ca1db24970b21defb679d9c3d722e4804f7fdb3bafa319cb4d
Opcode Fuzzy Hash: aef57a059a08420b8d5dfae5096d35553b8056bffb0ce8bb8e63412c3f54050f
Instruction Fuzzy Hash: 15D17A75D002489FCF05CFE9E980AEDBBB5EF49314F18816AE425EB351D734A906CB94

Function 00478300 Relevance: 6.3, APIs: 4, Instructions: 321COMMON

Download Yara Rule

APIs

Part of subcall function 00477B00: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,8762CD73,?,?), ref: 00477B54
Part of subcall function 00477B00: Process32FirstW.KERNEL32(00000000,?), ref: 00477BB9
Part of subcall function 00477B00: CloseHandle.KERNEL32(00000000), ref: 00477E84

ImpersonateLoggedOnUser.ADVAPI32(00000000,8762CD73,?,00000000), ref: 00478391

Memory Dump Source

Source File: 00000003.00000002.2242983706.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: CloseCreateFirstHandleImpersonateLoggedProcess32SnapshotToolhelp32User
String ID:
API String ID: 1507787261-0
Opcode ID: ebec02cd2df44e7bd4fb65aecaaffec3bb885a70c3ad5895e8640ffefb46c4a4
Instruction ID: e502c6a69380433c55fd31efa36561dbf437e01bd72b95285a5588c942f2c0dc
Opcode Fuzzy Hash: ebec02cd2df44e7bd4fb65aecaaffec3bb885a70c3ad5895e8640ffefb46c4a4
Instruction Fuzzy Hash: F5F17070C0428DDEEB15DBA4C8587DDBBB0AF15308F24819ED04977292DB785F88DBA6

Function 00158500 Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 001585C7
___AdjustPointer.LIBCMT ref: 001585EA
___AdjustPointer.LIBCMT ref: 00158686

Memory Dump Source

Source File: 00000003.00000002.2242784215.0000000000151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000003.00000002.2242762091.0000000000150000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2242815596.0000000000162000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2242836543.000000000016A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2242864527.000000000016D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2242886972.0000000000170000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_drop1.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 25659cb0bbdcfa813449b34b279a706b99228d64b41cb146f722e3ce88d594e1
Instruction ID: d8eb11bf36a50ee99364f4ac6ca9f7ee7fe6f53640dc94bfb7a38abc3045cafe
Opcode Fuzzy Hash: 25659cb0bbdcfa813449b34b279a706b99228d64b41cb146f722e3ce88d594e1
Instruction Fuzzy Hash: 7051B172A01606DFDB298F54D851BBA77A5EF14312F14452DEC226F291EF31EC48DB90

Function 004AFBF5 Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 004AFCBC
___AdjustPointer.LIBCMT ref: 004AFCDF
___AdjustPointer.LIBCMT ref: 004AFD7B

Memory Dump Source

Source File: 00000003.00000002.2242983706.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: e71c71c21820e5819a4508bd04d803321a7ecaf8570da358721e6539f5a36dac
Instruction ID: 33b3d652e50ecda4e79a0ecf225597f03c3ffd3297545ef1ce997a4b46d38663
Opcode Fuzzy Hash: e71c71c21820e5819a4508bd04d803321a7ecaf8570da358721e6539f5a36dac
Instruction Fuzzy Hash: AF51D0B150020A9FEB269FD1D881BAA77A4FF62718F10003EEC434B291D739E849C798

Function 004A077A Relevance: 6.1, APIs: 4, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2242983706.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drop1.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00fa7b59af023eaaf071b224feea6c80f4edf5776798c8ca34953c892f2afd27
Instruction ID: 6bad779769d7c9384c33fcc5b288381071ef860472916b423066c301ca7f7ee1
Opcode Fuzzy Hash: 00fa7b59af023eaaf071b224feea6c80f4edf5776798c8ca34953c892f2afd27
Instruction Fuzzy Hash: D141E675A00704AFDB24AF39CC41B6BBBA9EB99714F20452FF101DB781D77DA9418B88

Function 0015BD28 Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 0015C8A1: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,0015D6D0,?,00000000,-00000008), ref: 0015C902

GetLastError.KERNEL32(?,?,?,00000000,00000000,?,0015C0CE,?,?,?,00000000), ref: 0015BD8C
__dosmaperr.LIBCMT ref: 0015BD93
GetLastError.KERNEL32(00000000,0015C0CE,?,?,00000000,?,?,?,00000000,00000000,?,0015C0CE,?,?,?,00000000), ref: 0015BDCD
__dosmaperr.LIBCMT ref: 0015BDD4

Memory Dump Source

Source File: 00000003.00000002.2242784215.0000000000151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000003.00000002.2242762091.0000000000150000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2242815596.0000000000162000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2242836543.000000000016A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2242864527.000000000016D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2242886972.0000000000170000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_drop1.jbxd

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: bfe3732a88d39b964d2e50d5b10e1958c2e26e8dc2a177a0edbae697ebb76b32
Instruction ID: 9347f97cb91ecc8e2d2ee2db85261ec645f27f5f25303bc3bd947c7335166cf6
Opcode Fuzzy Hash: bfe3732a88d39b964d2e50d5b10e1958c2e26e8dc2a177a0edbae697ebb76b32
Instruction Fuzzy Hash: 61217171608206EFDB20AFA588D196AB7B9EF5436A7108518FC399F150D774EC488B91

Function 004BA942 Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 004A1489: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,0049B05F,?,00000000,-00000008), ref: 004A14EA

GetLastError.KERNEL32 ref: 004BA9A6
__dosmaperr.LIBCMT ref: 004BA9AD
GetLastError.KERNEL32(?,?,?,?), ref: 004BA9E7
__dosmaperr.LIBCMT ref: 004BA9EE

Memory Dump Source

Source File: 00000003.00000002.2242983706.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: 51edd5c4e5c25a430a3840a704f497c195c233776ddb3170bc40658ab91a4e1f
Instruction ID: cdbbd9429668cd5750c88df838a7d8834fbfbf28e86e5927cf8d45539b4e27df
Opcode Fuzzy Hash: 51edd5c4e5c25a430a3840a704f497c195c233776ddb3170bc40658ab91a4e1f
Instruction Fuzzy Hash: 7A21C871600605AF8F21AF66CC809ABBBADFF44368711492FF91597210D739EC60D7BA

Function 0015C2C4 Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2242784215.0000000000151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000003.00000002.2242762091.0000000000150000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2242815596.0000000000162000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2242836543.000000000016A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2242864527.000000000016D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2242886972.0000000000170000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_drop1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4a714f7af5547b012412c788b16acb2f7c16eb85b02c8a53f2800bc21013f20
Instruction ID: f820cfdf30ff0ffd4eb732678d15b3736b6d3b8079be05e677f7bd60c18f824e
Opcode Fuzzy Hash: f4a714f7af5547b012412c788b16acb2f7c16eb85b02c8a53f2800bc21013f20
Instruction Fuzzy Hash: 1E217971600309EFDB60AFB5CC8186B77A9BF1436A7108A15FD399A650DB31EC488BE1

Function 004989A8 Relevance: 6.1, APIs: 4, Instructions: 79COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2242983706.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drop1.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29faf50d70bb4521c0c7912d0192e47e6614307814943c5259d0fead7ff358f5
Instruction ID: 5e5224636d54f024fd63f309ffc809bb58d9736df3a284f1f4315f29edb86acb
Opcode Fuzzy Hash: 29faf50d70bb4521c0c7912d0192e47e6614307814943c5259d0fead7ff358f5
Instruction Fuzzy Hash: F321A171600205AFCF21EF6ADC4496B7FA9AF42368720453FF91597251EF38ED008799

Function 0015C99D Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 0015C9A5

Part of subcall function 0015C8A1: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,0015D6D0,?,00000000,-00000008), ref: 0015C902

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 0015C9DD
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 0015C9FD

Memory Dump Source

Source File: 00000003.00000002.2242784215.0000000000151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000003.00000002.2242762091.0000000000150000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2242815596.0000000000162000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2242836543.000000000016A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2242864527.000000000016D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2242886972.0000000000170000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_drop1.jbxd

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide
String ID:
API String ID: 158306478-0
Opcode ID: 1efe61e1fbbedae1667bbe0bcceda6923943395b50af7852b365439595a01192
Instruction ID: 61fb07344a6766c9f179a02fa4b707177df91b9cfc7cbaf258909519d9eb56a4
Opcode Fuzzy Hash: 1efe61e1fbbedae1667bbe0bcceda6923943395b50af7852b365439595a01192
Instruction Fuzzy Hash: 7A11E1E1905319FE6611ABB19C89CAF2D6CDEA47AB3500425FC21EA140FBA08D4982F1

Function 004AB379 Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 004AB381

Part of subcall function 004A1489: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,0049B05F,?,00000000,-00000008), ref: 004A14EA

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 004AB3B9
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 004AB3D9

Memory Dump Source

Source File: 00000003.00000002.2242983706.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide
String ID:
API String ID: 158306478-0
Opcode ID: 1d91f606ac6a83883d4ef3ff80323bf4a1fd7361cb21549a9305e1241be95ec6
Instruction ID: 352b9fd8ff6adfd48aa864b65f723ba5a946c2f7c3dd1541d1c3166fed4ac287
Opcode Fuzzy Hash: 1d91f606ac6a83883d4ef3ff80323bf4a1fd7361cb21549a9305e1241be95ec6
Instruction Fuzzy Hash: B21156B19015157E7A1167B65C8AD6F6A5CDE5A398B10403BF801D1203EB7D9D0245BA

Function 00151E00 Relevance: 6.1, APIs: 4, Instructions: 53threadCOMMON

Download Yara Rule

APIs

std::_Throw_Cpp_error.LIBCPMT ref: 00151E2D
GetCurrentThreadId.KERNEL32 ref: 00151E3B
std::_Throw_Cpp_error.LIBCPMT ref: 00151E54
std::_Throw_Cpp_error.LIBCPMT ref: 00151E93

Memory Dump Source

Source File: 00000003.00000002.2242784215.0000000000151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000003.00000002.2242762091.0000000000150000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2242815596.0000000000162000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2242836543.000000000016A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2242864527.000000000016D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2242886972.0000000000170000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_drop1.jbxd

Similarity

API ID: Cpp_errorThrow_std::_$CurrentThread
String ID:
API String ID: 2261580123-0
Opcode ID: 0b15fa192cc870b26e2b6e4515164a11c1b2b8411ed7af192a24b85af959c03b
Instruction ID: c7c620c443b262f92ee134b4b1a42cfbfac8b0889db92cfb77f46c901462de2c
Opcode Fuzzy Hash: 0b15fa192cc870b26e2b6e4515164a11c1b2b8411ed7af192a24b85af959c03b
Instruction Fuzzy Hash: 9D21C3B0D04209DFCB05EFA8C5827ADBBF1EF58301F01845DE869AB351D7349945CB51

Function 004B8430 Relevance: 6.0, APIs: 4, Instructions: 44COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(00000001,00000400,8762CD73,00000000,00000000,00000000,00000000,00000000,00000001,?,?,0044E5F3,?,?,00000000,00000000), ref: 004B844D
GetLastError.KERNEL32(?,?,0044E5F3,?,?,00000000,00000000,00000000,8762CD73,00000001), ref: 004B8459
WideCharToMultiByte.KERNEL32(00000001,00000000,8762CD73,00000000,00000000,00000000,00000000,00000000,?,?,0044E5F3,?,?,00000000,00000000,00000000), ref: 004B847F
GetLastError.KERNEL32(?,?,0044E5F3,?,?,00000000,00000000,00000000,8762CD73,00000001), ref: 004B848B

Memory Dump Source

Source File: 00000003.00000002.2242983706.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: ByteCharErrorLastMultiWide
String ID:
API String ID: 203985260-0
Opcode ID: b17853a5fac4461212df69502fdb333749a3d57a63655a8d7d2491092ae6608b
Instruction ID: 6b90caf3a67b14ffb57c64759c70b961d31bb881305e702148557666a2de5e43
Opcode Fuzzy Hash: b17853a5fac4461212df69502fdb333749a3d57a63655a8d7d2491092ae6608b
Instruction Fuzzy Hash: FB01BF36601156BFCF224F95DC08E9F3F7AEBD9791F118029FA0556220DA31C922EBA5

Function 0015FD00 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,?,00000000,00000000,00000000,?,0015F4A1,00000000,00000001,00000000,?,?,0015E09A,?,00000000,00000000), ref: 0015FD17
GetLastError.KERNEL32(?,0015F4A1,00000000,00000001,00000000,?,?,0015E09A,?,00000000,00000000,?,?,?,0015D9E0,00000000), ref: 0015FD23

Part of subcall function 0015FD74: CloseHandle.KERNEL32(FFFFFFFE,0015FD33,?,0015F4A1,00000000,00000001,00000000,?,?,0015E09A,?,00000000,00000000,?,?), ref: 0015FD84

___initconout.LIBCMT ref: 0015FD33

Part of subcall function 0015FD55: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,0015FCF1,0015F48E,?,?,0015E09A,?,00000000,00000000,?), ref: 0015FD68

WriteConsoleW.KERNEL32(00000000,?,00000000,00000000,?,0015F4A1,00000000,00000001,00000000,?,?,0015E09A,?,00000000,00000000,?), ref: 0015FD48

Memory Dump Source

Source File: 00000003.00000002.2242784215.0000000000151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000003.00000002.2242762091.0000000000150000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2242815596.0000000000162000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2242836543.000000000016A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2242864527.000000000016D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2242886972.0000000000170000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_drop1.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 5567f1d2d1a8a3bc1b502ed934ac26cfb4ab25ef10b84a11c24360233e18c84b
Instruction ID: c8c94e792dd0bf8339a0d14af09ad6adc9404ad4d47833385aa0d533ac4c98cf
Opcode Fuzzy Hash: 5567f1d2d1a8a3bc1b502ed934ac26cfb4ab25ef10b84a11c24360233e18c84b
Instruction Fuzzy Hash: 37F0C036540116FBCF221FD5DC0CA9A3F36FF093A2B444524FE199A530DBB288A5AB91

Function 004A95E5 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,00000000,?,00000000,00000000,?,004A671A,00000000,00000001,0000000C,00000000,?,0049B868,00000000,00000000,00000000), ref: 004A95FC
GetLastError.KERNEL32(?,004A671A,00000000,00000001,0000000C,00000000,?,0049B868,00000000,00000000,00000000,00000000,00000000,?,0049BE42,?), ref: 004A9608

Part of subcall function 004A95CE: CloseHandle.KERNEL32(FFFFFFFE,004A9618,?,004A671A,00000000,00000001,0000000C,00000000,?,0049B868,00000000,00000000,00000000,00000000,00000000), ref: 004A95DE

___initconout.LIBCMT ref: 004A9618

Part of subcall function 004A9590: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,004A95BF,004A6707,00000000,?,0049B868,00000000,00000000,00000000,00000000), ref: 004A95A3

WriteConsoleW.KERNEL32(00000000,00000000,?,00000000,?,004A671A,00000000,00000001,0000000C,00000000,?,0049B868,00000000,00000000,00000000,00000000), ref: 004A962D

Memory Dump Source

Source File: 00000003.00000002.2242983706.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 798d55b3f7968c96ef430ebc1f18d2e2465c9867b2c7648d7be43d295ef59026
Instruction ID: 8abc0c58445a332f8c6052495b9482a66327941653e6e46fd38a52645a0d97bb
Opcode Fuzzy Hash: 798d55b3f7968c96ef430ebc1f18d2e2465c9867b2c7648d7be43d295ef59026
Instruction Fuzzy Hash: DCF01237441215BBCF521F91DC09ACE3F66EF19364F024426FA2C86120C6368D60DB94

Function 00154F01 Relevance: 6.0, APIs: 4, Instructions: 25timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(?), ref: 00154F13
GetCurrentThreadId.KERNEL32 ref: 00154F22
GetCurrentProcessId.KERNEL32 ref: 00154F2B
QueryPerformanceCounter.KERNEL32(?), ref: 00154F38

Memory Dump Source

Source File: 00000003.00000002.2242784215.0000000000151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000003.00000002.2242762091.0000000000150000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2242815596.0000000000162000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2242836543.000000000016A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2242864527.000000000016D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2242886972.0000000000170000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_drop1.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 7b954de386896378882926df1ed635ae4a85ae26c6936cf0850de0c5f5163c1b
Instruction ID: 3f68e3fad3b23c1d2f4848b9fae4bb3875d810951dc8425136ebcd35a99a0fda
Opcode Fuzzy Hash: 7b954de386896378882926df1ed635ae4a85ae26c6936cf0850de0c5f5163c1b
Instruction Fuzzy Hash: 4DF06274D1020DEBCB00DBF4DA49A9EBBF4FF1C205B914A95E412E7510EB70AB889B51

Function 00158BFD Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 125COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,00000000,00000000,?,?,?,?,?,?,00158AFE,?,?,00000000,00000000,00000000,?), ref: 00158C22

Strings

RCC, xrefs: 00158C3C
MOC, xrefs: 00158C34

Memory Dump Source

Source File: 00000003.00000002.2242784215.0000000000151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000003.00000002.2242762091.0000000000150000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2242815596.0000000000162000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2242836543.000000000016A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2242864527.000000000016D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2242886972.0000000000170000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_drop1.jbxd

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: 1a0038502e43e8d1bc4986922101282cd4f66244e819d8280300a4aa5d8a5084
Instruction ID: 6fe9471d616c4e11f3ecdf86c0b1150bcf293f23e1d70f62b4fc71075624e3e3
Opcode Fuzzy Hash: 1a0038502e43e8d1bc4986922101282cd4f66244e819d8280300a4aa5d8a5084
Instruction Fuzzy Hash: E6417671900209EFCF15DF98C881AEEBBB5BF18305F184159FD25BA291D735AA54CB60

Function 00453E10 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 125COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00453EF4

Strings

p]C, xrefs: 00453F59
`aC, xrefs: 00453F48

Memory Dump Source

Source File: 00000003.00000002.2242983706.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID: `aC$p]C
API String ID: 118556049-1363152631
Opcode ID: 15b0531adf7878dcd052dc043384283fbe7e7e749bd6b518c848f3481f58b70e
Instruction ID: 7ffd0bf130dfa3baccabcf7c02000b8885a72f27ff8372dee48aba471c76e642
Opcode Fuzzy Hash: 15b0531adf7878dcd052dc043384283fbe7e7e749bd6b518c848f3481f58b70e
Instruction Fuzzy Hash: 2B4114B1D002089BCB24DF58C841BAFBBF4EF45354F10426FEC2597382E7799A148B95

Function 004B01F1 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?), ref: 004B0216

Strings

RCC, xrefs: 004B0230
MOC, xrefs: 004B0228

Memory Dump Source

Source File: 00000003.00000002.2242983706.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: f6a5424a3b0add0d67cdb7a4433499b834c2692f3a3c89efa9c8eec31821c917
Instruction ID: 70788f387beb527cb8114cdc5e5f216b8ccff70d73c61da87df7ae4bd57bd2ae
Opcode Fuzzy Hash: f6a5424a3b0add0d67cdb7a4433499b834c2692f3a3c89efa9c8eec31821c917
Instruction Fuzzy Hash: EE415871900209AFCF16CF98CD85AEEBBB5FF48305F18809AFA0567211D3399950DB68

Function 00158469 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 001586E0

Strings

csm, xrefs: 00158773
csm, xrefs: 00158702

Memory Dump Source

Source File: 00000003.00000002.2242784215.0000000000151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000003.00000002.2242762091.0000000000150000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2242815596.0000000000162000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2242836543.000000000016A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2242864527.000000000016D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2242886972.0000000000170000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_drop1.jbxd

Similarity

API ID: ___except_validate_context_record
String ID: csm$csm
API String ID: 3493665558-3733052814
Opcode ID: 9e6b565f10564cbc0613981958a1e449d96bfa85ca6e174167199685a1563d02
Instruction ID: f5d700c8c68a8129b56df9c1a780eb9cfd2526b1aee7ef211b0c1cf052c6799d
Opcode Fuzzy Hash: 9e6b565f10564cbc0613981958a1e449d96bfa85ca6e174167199685a1563d02
Instruction Fuzzy Hash: B131B036400219DBCF269F50CC449AA7BA6FF0C317B38455AFD646D221DB32CCA9DB91

Function 0047DD40 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 57COMMON

Download Yara Rule

APIs

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 0047DDD1

Strings

.G, xrefs: 0047DD75
0hC, xrefs: 0047DDCB

Memory Dump Source

Source File: 00000003.00000002.2242983706.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: Ios_base_dtorstd::ios_base::_
String ID: .G$0hC
API String ID: 323602529-633007509
Opcode ID: fa7f0577eed2ee249957cc315ff075d2cc7a9cf360a169e300ae923cf5853acc
Instruction ID: def2e33cd38b5e824c816681f9ae39c6530dfa40910c99229239c839cc9e5e1b
Opcode Fuzzy Hash: fa7f0577eed2ee249957cc315ff075d2cc7a9cf360a169e300ae923cf5853acc
Instruction Fuzzy Hash: 9B21AE74940245DFD720CF1AC844B99FBF8FF05324F148A6EE85597391D775A904CB84

Function 0044BEB0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 0044BEF3
___std_exception_copy.LIBVCRUNTIME ref: 0044BF26

Strings

MC, xrefs: 0044BEE4, 0044BF17

Memory Dump Source

Source File: 00000003.00000002.2242983706.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: MC
API String ID: 2659868963-1829682832
Opcode ID: ab36d56284830d128f6cf4340ca16e134d89125db0bb4639ace7817866229729
Instruction ID: 159077f32092c3bc03b4ae882dbf743a881f4ebbd8d79b989d6de070d85d5faa
Opcode Fuzzy Hash: ab36d56284830d128f6cf4340ca16e134d89125db0bb4639ace7817866229729
Instruction Fuzzy Hash: 4E112EB5900649EFCB11CF59C980B86FBE8FF19320F10C66BE815A7640E7B4A944CBA4

Function 004827A6 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 53COMMON

Download Yara Rule

APIs

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 0048285D

Strings

0, xrefs: 004827FE
0hC, xrefs: 00482852

Memory Dump Source

Source File: 00000003.00000002.2242983706.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: Ios_base_dtorstd::ios_base::_
String ID: 0$0hC
API String ID: 323602529-784950247
Opcode ID: 622b40fb6d894d5aa1115991de8c2c5b589d84d9705eb3b065fc2cec7fc6fad0
Instruction ID: dd26a1c23eadb7639fef0861fdc2b6c05f84c76fd28c7669f454e47aafc92c53
Opcode Fuzzy Hash: 622b40fb6d894d5aa1115991de8c2c5b589d84d9705eb3b065fc2cec7fc6fad0
Instruction Fuzzy Hash: FC21F074905298CFCB10CF98C6887DCBBF0AB09308F2480EAD949A7381D775AE58CF55

Function 0047D9C0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 47COMMON

Download Yara Rule

APIs

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 0047DA4F

Strings

.G, xrefs: 0047D9F2
0hC, xrefs: 0047DA49

Memory Dump Source

Source File: 00000003.00000002.2242983706.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: Ios_base_dtorstd::ios_base::_
String ID: .G$0hC
API String ID: 323602529-633007509
Opcode ID: d1051db2cb1cfc94d531bfa9645f70c65f72b0c573f779327227424f90c0fd69
Instruction ID: 8e7f9f1aa37db0bf33048e17fc0a06a73726813013154025c8e8923a4ade326e
Opcode Fuzzy Hash: d1051db2cb1cfc94d531bfa9645f70c65f72b0c573f779327227424f90c0fd69
Instruction Fuzzy Hash: 121149B4940744CFDB21CF49C984A99BBF8FB09324F108A5EE89697391D775AA44CF80

Function 00438A00 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 00438A46
___std_exception_destroy.LIBVCRUNTIME ref: 00438A5C

Strings

MC, xrefs: 00438A3C, 00438A56

Memory Dump Source

Source File: 00000003.00000002.2242983706.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: ___std_exception_destroy
String ID: MC
API String ID: 4194217158-1829682832
Opcode ID: 36b679e11db0edd653e0a2647b8e85e069932705a2a35767823b219f623ddd02
Instruction ID: 2156576f1eef92af9ffbb3102a1cf8c86cd110feba5e05fe60ab6789c6c907d6
Opcode Fuzzy Hash: 36b679e11db0edd653e0a2647b8e85e069932705a2a35767823b219f623ddd02
Instruction Fuzzy Hash: 5A01B5B1C44318EBC710DF58DD01B8ABBE8EB1A714F10466FE811E3780E779A60487A5

Function 00438CC0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 00438D06
___std_exception_destroy.LIBVCRUNTIME ref: 00438D1C

Strings

MC, xrefs: 00438CFC, 00438D16

Memory Dump Source

Source File: 00000003.00000002.2242983706.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: ___std_exception_destroy
String ID: MC
API String ID: 4194217158-1829682832
Opcode ID: d7eaf932c4118910232a5250f95a2e385d092f5df7cd9ec96b40b31c7f1f2a93
Instruction ID: 34d925613d03c46ca24c24dcd021453886a1a957fa2bd66f6c30760aa6902abf
Opcode Fuzzy Hash: d7eaf932c4118910232a5250f95a2e385d092f5df7cd9ec96b40b31c7f1f2a93
Instruction Fuzzy Hash: 050192B1C443189BC711DF58DD05B89BBE8EB1A714F14466FE811A3780E7B9A60487A5

Function 00438DD0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 00438E16
___std_exception_destroy.LIBVCRUNTIME ref: 00438E2C

Strings

MC, xrefs: 00438E0C, 00438E26

Memory Dump Source

Source File: 00000003.00000002.2242983706.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: ___std_exception_destroy
String ID: MC
API String ID: 4194217158-1829682832
Opcode ID: dd0c4f4c0c82000e457c7f44c182c4aade15206cd65931e5a6e762cfa9f818e5
Instruction ID: 81858840e3503bfd15470ad0d796ddf3043ff6da9bec83e018f38d9446b02dde
Opcode Fuzzy Hash: dd0c4f4c0c82000e457c7f44c182c4aade15206cd65931e5a6e762cfa9f818e5
Instruction Fuzzy Hash: 4A01D2B1C442089FC710DF58DD01B8ABBE8EB1A714F10426FE811E3780E7B9A60487A5

Function 00438A90 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 00438AD6
___std_exception_destroy.LIBVCRUNTIME ref: 00438AEC

Strings

MC, xrefs: 00438ACC, 00438AE6

Memory Dump Source

Source File: 00000003.00000002.2242983706.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: ___std_exception_destroy
String ID: MC
API String ID: 4194217158-1829682832
Opcode ID: 54ef2c628f25b7a2a23f3ae652ac74171c9fd81bd4396ab0a0f6fcd8ada00686
Instruction ID: 14708e90e5e2dd6187806a9d8007313cf644032e1f72ff90a2cf062a52645627
Opcode Fuzzy Hash: 54ef2c628f25b7a2a23f3ae652ac74171c9fd81bd4396ab0a0f6fcd8ada00686
Instruction Fuzzy Hash: AD0131B1C54658DFC710DF98D901B8ABBF8EB09724F10466BE815E3780E779A6048BA5

Function 00438D50 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 00438D96
___std_exception_destroy.LIBVCRUNTIME ref: 00438DAC

Strings

MC, xrefs: 00438D8C, 00438DA6

Memory Dump Source

Source File: 00000003.00000002.2242983706.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: ___std_exception_destroy
String ID: MC
API String ID: 4194217158-1829682832
Opcode ID: 2a7c72095c6804fc0da1c178a4919001dd8fbeb9815b62e3a8e22e5ece97145b
Instruction ID: 57808b7f7ef1f41f2f9046275374ae6f4c4975ec05ee0e2f2319a2ec8c3047b8
Opcode Fuzzy Hash: 2a7c72095c6804fc0da1c178a4919001dd8fbeb9815b62e3a8e22e5ece97145b
Instruction Fuzzy Hash: BB0136B1C44658DFC710DF98D901B89BBF8EB09714F10466FE815E3780E77566048B65

Function 0048A6B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 33COMMON

Download Yara Rule

APIs

RtlInitUnicodeString.NTDLL(?), ref: 0048A6D9
RtlInitUnicodeString.NTDLL(?,00000000), ref: 0048A6E4

Strings

0Qv, xrefs: 0048A6D9, 0048A6E4

Memory Dump Source

Source File: 00000003.00000002.2242983706.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: InitStringUnicode
String ID: 0Qv
API String ID: 4228678080-416853194
Opcode ID: 7daf87f8c1ea5e59ace241312ec7f61dd946e809b9173c130261c4fe55fa0827
Instruction ID: 9965e4e76de23dc0ee0a0bab637c9cbc157b952fc1d2a329a02330ce3ace71f2
Opcode Fuzzy Hash: 7daf87f8c1ea5e59ace241312ec7f61dd946e809b9173c130261c4fe55fa0827
Instruction Fuzzy Hash: 7CF03036140649DFC701CF99E888D96B7ECBB6C3107548453E945C7620C232F8A9CB61

Function 004BA04D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 004805F0: InitializeCriticalSectionEx.KERNEL32(?,00000000,00000000,8762CD73,00000000,004BCF70,000000FF,?,?,00513FC8), ref: 00480617
Part of subcall function 004805F0: GetLastError.KERNEL32(?,00000000,00000000,8762CD73,00000000,004BCF70,000000FF,?,?,00513FC8), ref: 00480621

IsDebuggerPresent.KERNEL32(?,?,?,00434B5D), ref: 004BA080
OutputDebugStringW.KERNEL32(ERROR : Unable to initialize critical section in CAtlBaseModule,?,?,?,00434B5D), ref: 004BA08F

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 004BA08A

Memory Dump Source

Source File: 00000003.00000002.2242983706.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: CriticalDebugDebuggerErrorInitializeLastOutputPresentSectionString
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 3511171328-631824599
Opcode ID: c51739a2d2ef137336e9adc3b97a1d747fb81e18f3053d9a6155fde0035c1d30
Instruction ID: d36ccacf6001ae6edc25a42526d65594664b7a1234a3e60676ee06f56b9b42c5
Opcode Fuzzy Hash: c51739a2d2ef137336e9adc3b97a1d747fb81e18f3053d9a6155fde0035c1d30
Instruction Fuzzy Hash: 64E065701007018FD330AF3AD40C3467BE0AB14304F00882FD945C7750E7B9D4088B66

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report drop1.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Meduza Stealer

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

Windows Analysis Report
drop1.exe

Function 0016A1A9 Relevance: 42.3, APIs: 10, Strings: 14, Instructions: 295
threadinjectionmemoryCOMMON

Function 0015D525 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 197
COMMON

Function 001594CE Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74
COMMONLIBRARYCODE

Function 00151930 Relevance: 9.2, APIs: 6, Instructions: 196
fileCOMMON

Function 001517E0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 77
memoryCOMMON

Function 0015A0BA Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 177
COMMON

Function 00153C1A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 94
COMMONLIBRARYCODE

Function 001567F4 Relevance: 4.6, APIs: 3, Instructions: 51
threadCOMMON

Function 0015A649 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 142
COMMON

Function 00159599 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 56
COMMONLIBRARYCODE

Function 001517A0 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 18
COMMON

Function 00159EAC Relevance: 3.1, APIs: 2, Instructions: 65
COMMON

Function 0015690C Relevance: 3.0, APIs: 2, Instructions: 38
threadCOMMON

Function 00159357 Relevance: 3.0, APIs: 2, Instructions: 34
COMMON

Function 0015A83B Relevance: 3.0, APIs: 2, Instructions: 22
memoryCOMMONLIBRARYCODE

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre