Edit tour

Windows Analysis Report
test.exe

Overview

General Information

Sample name:	test.exe
Analysis ID:	1585541
MD5:	21945c46e3b1ee896e07ae397a884856
SHA1:	25cb35e7eb23af78a7cbda2293a5d7b57ffbf9c6
SHA256:	d4c46c13f408317efc18f9ee4d7e8b6f61197f06cb12fedaadbdc873d9bb58c1
Tags:	exejalapenomalwareuser-Joker
Infos:

Detection

PureLog Stealer, zgRAT

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected PureLog Stealer

Yara detected UAC Bypass using CMSTP

Yara detected zgRAT

.NET source code contains method to dynamically call methods (often used by packers)

AI detected suspicious sample

Machine Learning detection for sample

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Self deletion via cmd or bat file

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal browser information (history, passwords, etc)

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Queries information about the installed CPU (vendor, model number etc)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

test.exe (PID: 7440 cmdline: "C:\Users\user\Desktop\test.exe" MD5: 21945C46E3B1EE896E07AE397A884856)

cmd.exe (PID: 7584 cmdline: "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\user\Desktop\test.exe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7592 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

choice.exe (PID: 7636 cmdline: choice /C Y /N /D Y /T 3 MD5: 1A9804F0C374283B094E9E55DC5EE128)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
zgRAT	zgRAT is a Remote Access Trojan malware which sometimes drops other malware such as AgentTesla malware. zgRAT has an inforstealer use which targets browser information and cryptowallets.Usually spreads by USB or phishing emails with -zip/-lnk/.bat/.xlsx attachments and so on.	No Attribution	https://bazaar.abuse.ch/browse/signature/zgRAT/ https://kcm.trellix.com/corporate/index?page=content&id=KB96190&locale=en_US https://www.cloudsek.com/blog/threat-actors-abuse-ai-generated-youtube-videos-to-spread-stealer-malware https://www.difesaesicurezza.com/cyber/cybercrime-rfq-dalla-turchia-veicola-agenttesla-e-zgrat/ https://www.fortinet.com/blog/threat-research/smokeloader-using-old-vulnerabilities	https://malpedia.caad.fkie.fraunhofer.de/details/win.zgrat

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
test.exe	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
test.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
test.exe	MALWARE_Win_zgRAT	Detects zgRAT	ditekSHen	0x52ce7:$s1: file:/// 0x52bd3:$s2: {11111-22222-10009-11112} 0x52c77:$s3: {11111-22222-50001-00000} 0x4e54c:$s4: get_Module 0x4ec2c:$s5: Reverse 0x48c63:$s6: BlockCopy 0x4f0a4:$s7: ReadByte 0x52cf9:$s8: 4C 00 6F 00 63 00 61 00 74 00 69 00 6F 00 6E 00 00 0B 46 00 69 00 6E 00 64 00 20 00 00 13 52 00 65 00 73 00 6F 00 75 00 72 00 63 00 65 00 41 00 00 11 56 00 69 00 72 00 74 00 75 00 61 00 6C 00 ...

Memory Dumps

Source	Rule	Description	Author
00000000.00000000.1648296354.00000265716F2000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000000.00000002.1682508482.0000026500001000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
Process Memory Space: test.exe PID: 7440	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
0.0.test.exe.265716f0000.0.unpack	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
0.0.test.exe.265716f0000.0.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.0.test.exe.265716f0000.0.unpack	MALWARE_Win_zgRAT	Detects zgRAT	ditekSHen	0x52ce7:$s1: file:/// 0x52bd3:$s2: {11111-22222-10009-11112} 0x52c77:$s3: {11111-22222-50001-00000} 0x4e54c:$s4: get_Module 0x4ec2c:$s5: Reverse 0x48c63:$s6: BlockCopy 0x4f0a4:$s7: ReadByte 0x52cf9:$s8: 4C 00 6F 00 63 00 61 00 74 00 69 00 6F 00 6E 00 00 0B 46 00 69 00 6E 00 64 00 20 00 00 13 52 00 65 00 73 00 6F 00 75 00 72 00 63 00 65 00 41 00 00 11 56 00 69 00 72 00 74 00 75 00 61 00 6C 00 ...

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: test.exe

Avira: detected

Multi AV Scanner detection for submitted file

Source: test.exe

ReversingLabs: Detection: 50%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: test.exe

Joe Sandbox ML: detected

Exploits

Yara detected UAC Bypass using CMSTP

Source: Yara match	File source: 00000000.00000002.1682508482.0000026500001000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: test.exe PID: 7440, type: MEMORYSTR

Source: test.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: test.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: global traffic

TCP traffic: 192.168.2.4:49731 -> 65.21.119.48:6561

Source: global traffic

HTTP traffic detected: GET /json/ HTTP/1.1Content-Type: application/jsonHost: ip-api.comConnection: Keep-Alive

Source: Joe Sandbox View

IP Address: 208.95.112.1 208.95.112.1

Source: unknown

DNS query: name: ip-api.com

Source: unknown	TCP traffic detected without corresponding DNS query: 65.21.119.48
Source: unknown	TCP traffic detected without corresponding DNS query: 65.21.119.48
Source: unknown	TCP traffic detected without corresponding DNS query: 65.21.119.48
Source: unknown	TCP traffic detected without corresponding DNS query: 65.21.119.48
Source: unknown	TCP traffic detected without corresponding DNS query: 65.21.119.48
Source: unknown	TCP traffic detected without corresponding DNS query: 65.21.119.48
Source: unknown	TCP traffic detected without corresponding DNS query: 65.21.119.48
Source: unknown	TCP traffic detected without corresponding DNS query: 65.21.119.48
Source: unknown	TCP traffic detected without corresponding DNS query: 65.21.119.48
Source: unknown	TCP traffic detected without corresponding DNS query: 65.21.119.48
Source: unknown	TCP traffic detected without corresponding DNS query: 65.21.119.48
Source: unknown	TCP traffic detected without corresponding DNS query: 65.21.119.48
Source: unknown	TCP traffic detected without corresponding DNS query: 65.21.119.48
Source: unknown	TCP traffic detected without corresponding DNS query: 65.21.119.48
Source: unknown	TCP traffic detected without corresponding DNS query: 65.21.119.48
Source: unknown	TCP traffic detected without corresponding DNS query: 65.21.119.48
Source: unknown	TCP traffic detected without corresponding DNS query: 65.21.119.48
Source: unknown	TCP traffic detected without corresponding DNS query: 65.21.119.48
Source: unknown	TCP traffic detected without corresponding DNS query: 65.21.119.48
Source: unknown	TCP traffic detected without corresponding DNS query: 65.21.119.48
Source: unknown	TCP traffic detected without corresponding DNS query: 65.21.119.48
Source: unknown	TCP traffic detected without corresponding DNS query: 65.21.119.48
Source: unknown	TCP traffic detected without corresponding DNS query: 65.21.119.48
Source: unknown	TCP traffic detected without corresponding DNS query: 65.21.119.48
Source: unknown	TCP traffic detected without corresponding DNS query: 65.21.119.48
Source: unknown	TCP traffic detected without corresponding DNS query: 65.21.119.48
Source: unknown	TCP traffic detected without corresponding DNS query: 65.21.119.48
Source: unknown	TCP traffic detected without corresponding DNS query: 65.21.119.48
Source: unknown	TCP traffic detected without corresponding DNS query: 65.21.119.48
Source: unknown	TCP traffic detected without corresponding DNS query: 65.21.119.48
Source: unknown	TCP traffic detected without corresponding DNS query: 65.21.119.48
Source: unknown	TCP traffic detected without corresponding DNS query: 65.21.119.48
Source: unknown	TCP traffic detected without corresponding DNS query: 65.21.119.48
Source: unknown	TCP traffic detected without corresponding DNS query: 65.21.119.48
Source: unknown	TCP traffic detected without corresponding DNS query: 65.21.119.48
Source: unknown	TCP traffic detected without corresponding DNS query: 65.21.119.48
Source: unknown	TCP traffic detected without corresponding DNS query: 65.21.119.48
Source: unknown	TCP traffic detected without corresponding DNS query: 65.21.119.48
Source: unknown	TCP traffic detected without corresponding DNS query: 65.21.119.48
Source: unknown	TCP traffic detected without corresponding DNS query: 65.21.119.48
Source: unknown	TCP traffic detected without corresponding DNS query: 65.21.119.48
Source: unknown	TCP traffic detected without corresponding DNS query: 65.21.119.48
Source: unknown	TCP traffic detected without corresponding DNS query: 65.21.119.48
Source: unknown	TCP traffic detected without corresponding DNS query: 65.21.119.48
Source: unknown	TCP traffic detected without corresponding DNS query: 65.21.119.48
Source: unknown	TCP traffic detected without corresponding DNS query: 65.21.119.48
Source: unknown	TCP traffic detected without corresponding DNS query: 65.21.119.48
Source: unknown	TCP traffic detected without corresponding DNS query: 65.21.119.48
Source: unknown	TCP traffic detected without corresponding DNS query: 65.21.119.48
Source: unknown	TCP traffic detected without corresponding DNS query: 65.21.119.48

Source: global traffic

HTTP traffic detected: GET /json/ HTTP/1.1Content-Type: application/jsonHost: ip-api.comConnection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: ip-api.com

Source: test.exe, 00000000.00000002.1682508482.0000026500077000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com
Source: test.exe, 00000000.00000002.1682508482.0000026500077000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com/json/
Source: test.exe, 00000000.00000002.1682508482.0000026500001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com/json/LGETMapplication/jsonNcountryOcountryCodePcityQqueryRregionNameStimezoneTzip
Source: test.exe, 00000000.00000002.1682508482.0000026500001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: test.exe, 00000000.00000002.1687481525.00000265100AB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: test.exe, 00000000.00000002.1687481525.00000265100AB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: test.exe, 00000000.00000002.1687481525.00000265100AB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: test.exe, 00000000.00000002.1687481525.00000265100AB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: test.exe, 00000000.00000002.1687481525.00000265100AB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: test.exe, 00000000.00000002.1687481525.00000265100AB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: test.exe, 00000000.00000002.1687481525.00000265100AB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: test.exe, 00000000.00000002.1687481525.00000265100AB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: test.exe, 00000000.00000002.1687481525.00000265100AB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico

System Summary

Malicious sample detected (through community Yara rule)

Source: test.exe, type: SAMPLE	Matched rule: Detects zgRAT Author: ditekSHen
Source: 0.0.test.exe.265716f0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects zgRAT Author: ditekSHen

Source: C:\Users\user\Desktop\test.exe	Code function: 0_2_00007FFD9B8808D4	0_2_00007FFD9B8808D4
Source: C:\Users\user\Desktop\test.exe	Code function: 0_2_00007FFD9B881995	0_2_00007FFD9B881995
Source: C:\Users\user\Desktop\test.exe	Code function: 0_2_00007FFD9B8848A0	0_2_00007FFD9B8848A0
Source: C:\Users\user\Desktop\test.exe	Code function: 0_2_00007FFD9B8825FA	0_2_00007FFD9B8825FA
Source: C:\Users\user\Desktop\test.exe	Code function: 0_2_00007FFD9BAF7C50	0_2_00007FFD9BAF7C50
Source: C:\Users\user\Desktop\test.exe	Code function: 0_2_00007FFD9BB01420	0_2_00007FFD9BB01420
Source: C:\Users\user\Desktop\test.exe	Code function: 0_2_00007FFD9BB09B68	0_2_00007FFD9BB09B68
Source: C:\Users\user\Desktop\test.exe	Code function: 0_2_00007FFD9BB01318	0_2_00007FFD9BB01318
Source: C:\Users\user\Desktop\test.exe	Code function: 0_2_00007FFD9BB08F2D	0_2_00007FFD9BB08F2D
Source: C:\Users\user\Desktop\test.exe	Code function: 0_2_00007FFD9BB06689	0_2_00007FFD9BB06689
Source: C:\Users\user\Desktop\test.exe	Code function: 0_2_00007FFD9BAF3E5D	0_2_00007FFD9BAF3E5D
Source: C:\Users\user\Desktop\test.exe	Code function: 0_2_00007FFD9BAFA6D0	0_2_00007FFD9BAFA6D0
Source: C:\Users\user\Desktop\test.exe	Code function: 0_2_00007FFD9BB012A0	0_2_00007FFD9BB012A0
Source: C:\Users\user\Desktop\test.exe	Code function: 0_2_00007FFD9BAF4969	0_2_00007FFD9BAF4969
Source: C:\Users\user\Desktop\test.exe	Code function: 0_2_00007FFD9BAFD0E1	0_2_00007FFD9BAFD0E1

Source: test.exe, 00000000.00000000.1648340926.0000026571750000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameSteal1WC.exe, vs test.exe
Source: test.exe	Binary or memory string: OriginalFilenameSteal1WC.exe, vs test.exe

Source: test.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: test.exe, type: SAMPLE	Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
Source: 0.0.test.exe.265716f0000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT

Source: test.exe, FMIJCCJDKMPOHDNPCEAGFDMNEAPEGCIPGDDK.cs	Cryptographic APIs: 'CreateDecryptor'
Source: test.exe, FMIJCCJDKMPOHDNPCEAGFDMNEAPEGCIPGDDK.cs	Cryptographic APIs: 'CreateDecryptor'

Source: classification engine

Classification label: mal100.troj.spyw.expl.evad.winEXE@6/1@1/2

Source: C:\Users\user\Desktop\test.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\test.exe.log

Jump to behavior

Source: C:\Users\user\Desktop\test.exe	Mutant created: NULL
Source: C:\Users\user\Desktop\test.exe	Mutant created: \Sessions\1\BaseNamedObjects\CTZCRdDXHUNthwh
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7592:120:WilError_03

Source: test.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: test.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%

Source: C:\Users\user\Desktop\test.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\test.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\test.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: test.exe, 00000000.00000002.1682508482.000002650005F000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: test.exe

ReversingLabs: Detection: 50%

Source: unknown	Process created: C:\Users\user\Desktop\test.exe "C:\Users\user\Desktop\test.exe"
Source: C:\Users\user\Desktop\test.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\user\Desktop\test.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\choice.exe choice /C Y /N /D Y /T 3
Source: C:\Users\user\Desktop\test.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\user\Desktop\test.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\choice.exe choice /C Y /N /D Y /T 3	Jump to behavior

Source: C:\Users\user\Desktop\test.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\choice.exe	Section loaded: version.dll	Jump to behavior

Source: C:\Users\user\Desktop\test.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32

Jump to behavior

Source: test.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: test.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation

.NET source code contains method to dynamically call methods (often used by packers)

Source: test.exe, FMIJCCJDKMPOHDNPCEAGFDMNEAPEGCIPGDDK.cs

.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})

Source: test.exe

Static PE information: 0xA1C0FDFB [Thu Dec 30 11:41:47 2055 UTC]

Source: C:\Users\user\Desktop\test.exe	Code function: 0_2_00007FFD9B8850DD push esi; ret	0_2_00007FFD9B8850DF
Source: C:\Users\user\Desktop\test.exe	Code function: 0_2_00007FFD9BB07049 push es; retf	0_2_00007FFD9BB07177
Source: C:\Users\user\Desktop\test.exe	Code function: 0_2_00007FFD9BB07BC3 push edi; ret	0_2_00007FFD9BB07BD6
Source: C:\Users\user\Desktop\test.exe	Code function: 0_2_00007FFD9BB0B22D push eax; ret	0_2_00007FFD9BB0B254
Source: C:\Users\user\Desktop\test.exe	Code function: 0_2_00007FFD9BB0EDB5 push ebp; retf	0_2_00007FFD9BB0EDB8
Source: C:\Users\user\Desktop\test.exe	Code function: 0_2_00007FFD9BAF7967 push ebx; retf	0_2_00007FFD9BAF796A
Source: C:\Users\user\Desktop\test.exe	Code function: 0_2_00007FFD9BB07125 push es; retf	0_2_00007FFD9BB07177

Hooking and other Techniques for Hiding and Protection

Self deletion via cmd or bat file

Source: C:\Users\user\Desktop\test.exe	Process created: "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\user\Desktop\test.exe"
Source: C:\Users\user\Desktop\test.exe	Process created: "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\user\Desktop\test.exe"			Jump to behavior

Source: C:\Users\user\Desktop\test.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\Desktop\test.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\test.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: test.exe, 00000000.00000002.1682508482.0000026500001000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SBIEDLL.DLL@
Source: test.exe, 00000000.00000002.1682508482.0000026500001000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SBIEDLL.DLL

Source: C:\Users\user\Desktop\test.exe	Memory allocated: 26571C20000 memory reserve \| memory write watch			Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Memory allocated: 265735D0000 memory reserve \| memory write watch			Jump to behavior

Source: C:\Users\user\Desktop\test.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Users\user\Desktop\test.exe	Window / User API: threadDelayed 1401			Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Window / User API: threadDelayed 3787			Jump to behavior

Source: C:\Users\user\Desktop\test.exe TID: 7496	Thread sleep time: -14757395258967632s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\test.exe TID: 7520	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\test.exe TID: 7460	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\test.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * From Win32_ComputerSystem

Source: C:\Users\user\Desktop\test.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\test.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: test.exe, 00000000.00000002.1682508482.0000026500001000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmware
Source: test.exe, 00000000.00000002.1682508482.0000026500001000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: hyper-v
Source: test.exe, 00000000.00000002.1722766889.0000026573DFB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\test.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\test.exe

Process queried: DebugPort

Jump to behavior

Source: C:\Users\user\Desktop\test.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\test.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\test.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\user\Desktop\test.exe"			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\choice.exe choice /C Y /N /D Y /T 3			Jump to behavior

Source: C:\Users\user\Desktop\test.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\Desktop\test.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Compression\v4.0_4.0.0.0__b77a5c561934e089\System.IO.Compression.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\test.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Users\user\Desktop\test.exe

WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected PureLog Stealer

Source: Yara match	File source: test.exe, type: SAMPLE
Source: Yara match	File source: 0.0.test.exe.265716f0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1648296354.00000265716F2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY

Yara detected zgRAT

Source: Yara match	File source: test.exe, type: SAMPLE
Source: Yara match	File source: 0.0.test.exe.265716f0000.0.unpack, type: UNPACKEDPE

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\test.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior

Remote Access Functionality

Yara detected PureLog Stealer

Source: Yara match	File source: test.exe, type: SAMPLE
Source: Yara match	File source: 0.0.test.exe.265716f0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1648296354.00000265716F2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY

Yara detected zgRAT

Source: Yara match	File source: test.exe, type: SAMPLE
Source: Yara match	File source: 0.0.test.exe.265716f0000.0.unpack, type: UNPACKEDPE

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	131 Windows Management Instrumentation	1 DLL Side-Loading	11 Process Injection	1 Masquerading	1 OS Credential Dumping	241 Security Software Discovery	Remote Services	11 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Disable or Modify Tools	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	1 Data from Local System	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	161 Virtualization/Sandbox Evasion	Security Account Manager	161 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 System Network Configuration Discovery	SSH	Keylogging	2 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Obfuscated Files or Information	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Software Packing	DCSync	33 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Timestomp	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 DLL Side-Loading	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	1 File Deletion	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
test.exe	50%	ReversingLabs	Win32.Trojan.Jalapeno
test.exe	100%	Avira	TR/Dropper.Gen
test.exe	100%	Joe Sandbox ML

Name	IP	Active	Malicious	Antivirus Detection	Reputation
ip-api.com	208.95.112.1	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://ip-api.com/json/	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://ac.ecosia.org/autocomplete?q=	test.exe, 00000000.00000002.1687481525.00000265100AB000.00000004.00000800.00020000.00000000.sdmp	false	high
https://duckduckgo.com/chrome_newtab	test.exe, 00000000.00000002.1687481525.00000265100AB000.00000004.00000800.00020000.00000000.sdmp	false	high
https://duckduckgo.com/ac/?q=	test.exe, 00000000.00000002.1687481525.00000265100AB000.00000004.00000800.00020000.00000000.sdmp	false	high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	test.exe, 00000000.00000002.1687481525.00000265100AB000.00000004.00000800.00020000.00000000.sdmp	false	high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	test.exe, 00000000.00000002.1687481525.00000265100AB000.00000004.00000800.00020000.00000000.sdmp	false	high
http://ip-api.com	test.exe, 00000000.00000002.1682508482.0000026500077000.00000004.00000800.00020000.00000000.sdmp	false	high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	test.exe, 00000000.00000002.1687481525.00000265100AB000.00000004.00000800.00020000.00000000.sdmp	false	high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	test.exe, 00000000.00000002.1687481525.00000265100AB000.00000004.00000800.00020000.00000000.sdmp	false	high
https://www.ecosia.org/newtab/	test.exe, 00000000.00000002.1687481525.00000265100AB000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	test.exe, 00000000.00000002.1682508482.0000026500001000.00000004.00000800.00020000.00000000.sdmp	false	high
http://ip-api.com/json/LGETMapplication/jsonNcountryOcountryCodePcityQqueryRregionNameStimezoneTzip	test.exe, 00000000.00000002.1682508482.0000026500001000.00000004.00000800.00020000.00000000.sdmp	false	high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	test.exe, 00000000.00000002.1687481525.00000265100AB000.00000004.00000800.00020000.00000000.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
208.95.112.1	ip-api.com	United States		53334	TUT-ASUS	false
65.21.119.48	unknown	United States		199592	CP-ASDE	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1585541
Start date and time:	2025-01-07 20:01:05 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 9s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	4
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	test.exe
Detection:	MAL
Classification:	mal100.troj.spyw.expl.evad.winEXE@6/1@1/2
EGA Information:	Failed
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Execution Graph export aborted for target test.exe, PID 7440 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
VT rate limit hit for: test.exe

Simulations

Behavior and APIs

Time	Type	Description
14:01:54	API Interceptor	21x Sleep call for process: test.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
208.95.112.1	HaLCYOFjMN.exe	Get hash	malicious	DCRat, PureLog Stealer, RedLine, XWorm, zgRAT	Browse	ip-api.com/line/?fields=hosting
	1.exe	Get hash	malicious	Unknown	Browse	ip-api.com/json/?fields=hosting,query
	1.exe	Get hash	malicious	Unknown	Browse	ip-api.com/json/?fields=hosting,query
	YPzNsfg4nR.exe	Get hash	malicious	XWorm	Browse	ip-api.com/line/?fields=hosting
	SAL987656700.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	Resource.exe	Get hash	malicious	Blank Grabber	Browse	ip-api.com/json/?fields=225545
	P3A946MOFP.exe	Get hash	malicious	XWorm	Browse	ip-api.com/line/?fields=hosting
	BootstrapperV1.16.exe	Get hash	malicious	XWorm	Browse	ip-api.com/line/?fields=hosting
	SharkHack.exe	Get hash	malicious	XWorm	Browse	ip-api.com/line/?fields=hosting
	paint.exe	Get hash	malicious	Blank Grabber	Browse	ip-api.com/json/?fields=225545
65.21.119.48	mu3JuAyrj5.exe	Get hash	malicious	PureLog Stealer, zgRAT	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ip-api.com	HaLCYOFjMN.exe	Get hash	malicious	DCRat, PureLog Stealer, RedLine, XWorm, zgRAT	Browse	208.95.112.1
	1.exe	Get hash	malicious	Unknown	Browse	208.95.112.1
	1.exe	Get hash	malicious	Unknown	Browse	208.95.112.1
	YPzNsfg4nR.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
	SAL987656700.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	Resource.exe	Get hash	malicious	Blank Grabber	Browse	208.95.112.1
	P3A946MOFP.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
	BootstrapperV1.16.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
	SharkHack.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
	paint.exe	Get hash	malicious	Blank Grabber	Browse	208.95.112.1

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CP-ASDE	loligang.arm.elf	Get hash	malicious	Mirai	Browse	65.21.173.88
	botx.sh4.elf	Get hash	malicious	Mirai	Browse	65.20.129.65
	daHTg2LQmU.lnk	Get hash	malicious	Unknown	Browse	65.20.104.212
	Sw7141dkgT.lnk	Get hash	malicious	Unknown	Browse	65.20.104.217
	hax.spc.elf	Get hash	malicious	Mirai	Browse	65.20.206.188
	mu3JuAyrj5.exe	Get hash	malicious	PureLog Stealer, zgRAT	Browse	65.21.119.48
	850.exe	Get hash	malicious	AsyncRAT	Browse	65.21.198.54
	tDLozbx48F.exe	Get hash	malicious	Gurcu Stealer	Browse	65.21.49.163
	botx.spc.elf	Get hash	malicious	Mirai	Browse	65.21.172.4
	Finish_Agreement_DocuSign.pdf	Get hash	malicious	Unknown	Browse	65.21.29.43
TUT-ASUS	HaLCYOFjMN.exe	Get hash	malicious	DCRat, PureLog Stealer, RedLine, XWorm, zgRAT	Browse	208.95.112.1
	1.exe	Get hash	malicious	Unknown	Browse	208.95.112.1
	1.exe	Get hash	malicious	Unknown	Browse	208.95.112.1
	YPzNsfg4nR.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
	SAL987656700.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	Resource.exe	Get hash	malicious	Blank Grabber	Browse	208.95.112.1
	P3A946MOFP.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
	BootstrapperV1.16.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
	SharkHack.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
	paint.exe	Get hash	malicious	Blank Grabber	Browse	208.95.112.1

Process:	C:\Users\user\Desktop\test.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2045
Entropy (8bit):	5.3618187964722885
Encrypted:	false
SSDEEP:	48:MxHKQ71qHGIs0HKjJHiYHKGSI6oQHZHitHTHhAHKKkrHKoLHqHpHNpv:iq+wmj0qVCYqGSI6oQ5CtzHeqKkrqoLA
MD5:	2880333ECF0A1010436F3B458AE3D931
SHA1:	77BD788B221FEDAAC26D7822C9C129CAD7E8D9D9
SHA-256:	1473EDC44F2DA62769AFFE97BD0E7882B48F9A4EA8325286DE80E2F27306592F
SHA-512:	A2E1CBFE3D2CB2EF87217AEEB8504AF0D9247BC83FFC1B1BE3DBFCE32968CE1BDFE4637B50C7B4F744F52EABE8738F2D33207A70F61E75ADDB5B84724EEE6467
Malicious:	true
Reputation:	low
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Drawing\567ff6b0de7f9dcd8111001e94ab7cf6\System.Drawing.ni.dll",0..3,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\2a7fffeef3976b2a6f273db66b1f0107\System.Windows.Forms.ni.dll",0..2,"System.Security, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..2,"System.Web.Extensions, Version=4.0.0.0, Culture=

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	5.869732326513745
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	test.exe
File size:	380'416 bytes
MD5:	21945c46e3b1ee896e07ae397a884856
SHA1:	25cb35e7eb23af78a7cbda2293a5d7b57ffbf9c6
SHA256:	d4c46c13f408317efc18f9ee4d7e8b6f61197f06cb12fedaadbdc873d9bb58c1
SHA512:	ef14c8987f0334a5bfb2e9e20aff9f395812d51049d4d8b42aacc97b453e3dac28fff37be16db81a5cb4dc8ad82fc11c8621ebdb523ec9e274c5ea1422d8daab
SSDEEP:	6144:FwekV8twzTf3Z1/BhFKWvm+3Nq9RDf7k/eCS:mewnptbRD3Nac/4
TLSH:	F384E70BFE568E51C1885736C5EF400453F8E6813757E60E39CE23E909533BBA94A6BB
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....................0.................. ........@.. .......................@............`................................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x45e32e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0xA1C0FDFB [Thu Dec 30 11:41:47 2055 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x5e2e0	0x4b	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x60000	0x598	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x62000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x5c334	0x5c400	9c6d3dd034c881827cf8800e6cf40434	False	0.4517038236788618	data	5.879926977678287	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x60000	0x598	0x600	a9ce836158326703e94f602667bd4d3b	False	0.41796875	data	4.039075596408711	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x62000	0xc	0x200	0444eb95753855b09cb9bc10266c0ac2	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x600a0	0x30c	data			0.4346153846153846
RT_MANIFEST	0x603ac	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 7, 2025 20:01:55.562669992 CET	49730	80	192.168.2.4	208.95.112.1
Jan 7, 2025 20:01:55.567622900 CET	80	49730	208.95.112.1	192.168.2.4
Jan 7, 2025 20:01:55.567692041 CET	49730	80	192.168.2.4	208.95.112.1
Jan 7, 2025 20:01:55.568315983 CET	49730	80	192.168.2.4	208.95.112.1
Jan 7, 2025 20:01:55.573098898 CET	80	49730	208.95.112.1	192.168.2.4
Jan 7, 2025 20:01:56.081140041 CET	80	49730	208.95.112.1	192.168.2.4
Jan 7, 2025 20:01:56.127672911 CET	49730	80	192.168.2.4	208.95.112.1
Jan 7, 2025 20:01:57.372452974 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.377382994 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.377485991 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.378010035 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.378556967 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.382766962 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.382846117 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.383443117 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.383451939 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.383460999 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.383469105 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.383480072 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.383514881 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.383537054 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.383548021 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.383574963 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.383584023 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.383589983 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.383613110 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.383636951 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.387476921 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.387543917 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.387677908 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.387727022 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.388366938 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.388421059 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.388430119 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.388473988 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.392384052 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.392394066 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.392401934 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.392452002 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.431395054 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.431556940 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.483345032 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.483408928 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.503120899 CET	49730	80	192.168.2.4	208.95.112.1
Jan 7, 2025 20:01:57.531327963 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.531383991 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.583394051 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.583445072 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.631397963 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.631452084 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.679384947 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.679435968 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.727369070 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.727417946 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.775410891 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.775465965 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.823476076 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.823538065 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.874475956 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.874660969 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.879547119 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.879559994 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.879590034 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.879595041 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.879611015 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.879612923 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.879642963 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.879643917 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.879654884 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.879683971 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.879695892 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.879741907 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.879754066 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.879789114 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.879806042 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.879844904 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.879857063 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.879869938 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.879879951 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.879895926 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.879913092 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.879928112 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.879993916 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.880049944 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.880052090 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.880105019 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.880224943 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.880331039 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.880356073 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.880403042 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.880403996 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.880414963 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.880465984 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.880481958 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.880506039 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.880553961 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.880599022 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.880620003 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.880644083 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.880656958 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.880693913 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.880729914 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.880764008 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.880774975 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.880809069 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.880829096 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.880929947 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.880940914 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.881000042 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.884434938 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.884458065 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.884491920 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.884497881 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.884533882 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.884569883 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.884581089 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.884617090 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.884650946 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.884665012 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.884684086 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.884697914 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.884712934 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.884727955 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.884744883 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.884757042 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.884785891 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.884788990 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.884797096 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.884804010 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.884810925 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.884829998 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.884843111 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.884850979 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.884862900 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.884864092 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.884875059 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.884891987 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.884896040 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.884906054 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.884932041 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.884989023 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.885000944 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.885011911 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.885023117 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.885032892 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.885061026 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.885101080 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.885139942 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.885179043 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.885191917 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.885216951 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.885231018 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.885278940 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.885289907 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.885330915 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.885343075 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.885365009 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.885391951 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.885406017 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.885411024 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.885422945 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.885443926 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.885454893 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.885454893 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.885468960 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.885478973 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.885503054 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.885514021 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.885525942 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.885536909 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.885549068 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.885559082 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.885562897 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.885581017 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.885593891 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.885605097 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.885612011 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.885636091 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.885642052 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.885648012 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.885675907 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.885746002 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.885793924 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.885797024 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.885808945 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.885828972 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.885845900 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.885849953 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.885890961 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.885900021 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.885901928 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.885932922 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.885936022 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.885946035 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.885957956 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.885967970 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.885974884 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.885979891 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.885998011 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.886004925 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.886018038 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.886025906 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.886039972 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.886042118 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.886051893 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.886059046 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.886065960 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.886074066 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.886079073 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.886096954 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.886100054 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.886123896 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.886153936 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.886204958 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.886215925 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.886226892 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.886239052 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.886246920 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.886260033 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.886275053 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.886280060 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.886291981 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.886307955 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.886312962 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.886324883 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.886332989 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.886337996 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.886348963 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.886363983 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.886385918 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.889256001 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.889267921 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.889281034 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.889308929 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.889329910 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.889369965 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.889380932 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.889410019 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.889415026 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.889427900 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.889447927 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.889453888 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.889483929 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.889576912 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.889588118 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.889616013 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.889640093 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.889693975 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.889705896 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.889724970 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.889735937 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.889748096 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.889764071 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.889775038 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.889780045 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.889805079 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.889816999 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.889822960 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.889837980 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.889851093 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.889853001 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.889863014 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.889873028 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.889883995 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.889894962 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.889904022 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.889918089 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.889925003 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.889930010 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.889951944 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.889952898 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.889962912 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.889978886 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.889991045 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.890005112 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.890014887 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.890016079 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.890042067 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.890054941 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.890058994 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.890065908 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.890106916 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.890165091 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.890177011 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.890187979 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.890198946 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.890207052 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.890212059 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.890218973 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.890221119 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.890223980 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.890244007 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.890254021 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.890254974 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.890266895 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.890279055 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.890290022 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.890311003 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.890311003 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.890322924 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.890335083 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.890336990 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.890356064 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.890367031 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.890367985 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.890379906 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.890387058 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.890412092 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.890423059 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.890423059 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.890434980 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.890444994 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.890448093 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.890486002 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.890501022 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.890511990 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.890522957 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.890535116 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.890543938 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.890554905 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.890564919 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.890567064 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.890575886 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.890611887 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.890646935 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.890657902 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.890683889 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.890738010 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.890769005 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.890779972 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.890798092 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.890810013 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.890830994 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.890835047 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.890842915 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.890847921 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.890852928 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.890872002 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.890886068 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.890894890 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.890906096 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.890916109 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.890927076 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.890933037 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.890947104 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.890958071 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.890961885 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.890969038 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.890980959 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.890981913 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.891000032 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.891030073 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.891056061 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.891067028 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.891077995 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.891088963 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.891098976 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.891108036 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.891122103 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.891134977 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.891146898 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.891146898 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.891159058 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.891159058 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.891170979 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.891189098 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.891191959 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.891204119 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.891215086 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.891221046 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.891227007 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.891242027 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.891251087 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.891256094 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.891271114 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.891277075 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.891282082 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.891304016 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.891305923 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.891331911 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.891335011 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.891360998 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.891360998 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.891374111 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.891380072 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.891393900 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.891406059 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.891412020 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.891422033 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.891437054 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.891441107 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.891453981 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.891463995 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.891468048 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.891480923 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.891482115 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.891494989 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.891503096 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.891520023 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.891525030 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.891526937 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.891540051 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.891541958 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.891552925 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.891563892 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.891566992 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.891587973 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.891592026 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.891604900 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.891607046 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.891632080 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.891634941 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.891643047 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.891657114 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.891670942 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.891683102 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.891685963 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.891726971 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.891746044 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.891757965 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.891769886 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.891779900 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.891784906 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.891792059 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.891803026 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.891815901 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.891819000 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.891829014 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.891839981 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.891844034 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.891855955 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.891865969 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.891880989 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.891889095 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.891901016 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.891913891 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.891915083 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.891926050 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.891937017 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.891954899 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.891967058 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.891969919 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.891978979 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.891992092 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.892013073 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.892029047 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.892038107 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.892049074 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.892076015 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.892088890 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.892113924 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.892128944 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.892144918 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.892153978 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.892164946 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.892196894 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.894093990 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.894121885 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.894145966 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.894162893 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.894187927 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.894191027 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.894217014 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.894227982 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.894246101 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.894253969 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.894268036 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.894288063 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.894289970 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.894325018 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.894332886 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.894337893 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.894367933 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.894388914 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.894401073 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.894416094 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.894434929 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.894444942 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.894445896 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.894457102 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.894458055 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.894469976 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.894484997 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.894491911 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.894498110 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.894504070 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.894525051 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.894558907 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.894685030 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.894728899 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.894782066 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.894793034 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.894803047 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.894834995 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.894855976 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.894866943 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.894867897 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.894879103 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.894889116 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.894915104 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.894922018 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.894926071 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.894939899 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.894948006 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.894984961 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.894999027 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.895169973 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.895212889 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.895243883 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.895287991 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.895387888 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.895397902 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.895426989 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.895435095 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.895438910 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.895457029 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.895474911 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.895503998 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.895514965 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.895534992 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.895538092 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.895545959 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.895555019 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.895575047 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.895585060 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.895627975 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.895641088 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.895651102 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.895662069 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.895669937 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.895683050 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.895689964 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.895715952 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.895728111 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.895734072 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.895740032 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.895746946 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.895752907 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.895767927 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.895776033 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.895788908 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.895801067 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.895827055 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.895838976 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.895860910 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.895868063 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.895879030 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.895881891 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.895896912 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.895920992 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.895926952 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.895940065 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.895967960 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.895981073 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.896025896 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.896037102 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.896048069 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.896059990 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.896061897 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.896080971 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.896100044 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.896166086 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.896178007 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.896188021 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.896209955 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.896219015 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.896230936 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.896241903 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.896248102 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.896253109 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.896259069 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.896282911 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.896311045 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.896326065 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.896369934 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.896408081 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.896408081 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.896451950 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.896457911 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.896465063 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.896476030 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.896496058 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.896498919 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.896513939 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.896543026 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.896794081 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.896805048 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.896816015 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.896826982 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.896833897 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.896850109 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.896873951 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.896920919 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.896931887 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.896965981 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.896971941 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.896976948 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.897006989 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.897025108 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.897047997 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.897061110 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.897067070 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.897073984 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.897089005 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.897113085 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.897114992 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.897126913 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.897139072 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.897149086 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.897170067 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.897177935 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.897181988 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.897193909 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.897208929 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.897209883 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.897222042 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.897241116 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.897252083 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.897263050 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.897267103 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.897275925 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.897288084 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.897308111 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.897317886 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.897319078 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.897332907 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.897332907 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.897361994 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.897362947 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.897375107 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.897397041 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.897403955 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.897414923 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.897459984 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.897460938 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.897471905 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.897494078 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.897504091 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.897519112 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.897533894 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.897545099 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.897547960 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.897573948 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.897578001 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.897584915 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.897591114 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.897617102 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.897625923 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.897628069 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.897665977 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.897711039 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.897722006 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.897738934 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.897748947 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.897749901 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.897761106 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.897772074 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.897773027 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.897793055 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.897814989 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.897826910 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.897830009 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.897856951 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.897869110 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.897871971 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.897880077 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.897916079 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.897967100 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.897979021 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.897989988 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.898001909 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.898017883 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.898020029 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.898032904 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.898040056 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.898046017 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.898053885 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.898057938 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.898080111 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.898087025 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.898092031 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.898108959 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.898113012 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.898123026 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.898125887 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.898152113 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.898152113 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.898168087 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.898168087 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.898195982 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.898196936 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.898209095 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.898220062 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.898231030 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.898235083 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.898241997 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.898255110 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.898258924 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.898269892 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.898283005 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.898293972 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.898296118 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.898304939 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.898319960 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.898325920 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.898336887 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.898349047 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.898360014 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.898376942 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.898379087 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.898394108 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.898431063 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.898513079 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.898524046 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.898535013 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.898545980 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.898557901 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.898564100 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.898576021 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.898580074 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.898591042 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.898602009 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.898607969 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.898618937 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.898618937 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.898633003 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.898655891 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.898670912 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.898674965 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.898689032 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.898700953 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.898711920 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.898715019 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.898729086 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.898755074 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.898756981 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.898793936 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.898796082 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.898808956 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.898821115 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.898833990 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.898835897 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.898848057 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.898870945 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.898870945 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.898881912 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.898900032 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.898911953 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.898912907 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.898935080 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.898953915 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.898978949 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.898989916 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.899020910 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.899029970 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.899080992 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.899091959 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.899121046 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.899131060 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.899235010 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.899247885 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.899257898 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.899270058 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.899275064 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.899281979 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.899297953 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.899306059 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.899324894 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.899327040 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.899341106 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.899347067 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.899363041 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.899372101 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.899374962 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.899383068 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.899398088 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.899406910 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.899409056 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.899424076 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.899430037 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.899435997 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.899442911 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.899456024 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.899456024 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.899475098 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.899477005 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.899485111 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.899494886 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.899530888 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.899576902 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.899588108 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.899606943 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.899632931 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.899648905 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.899656057 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.899689913 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.899693012 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.899705887 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.899739027 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.899759054 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.899769068 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.899779081 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.899796009 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.899801016 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.899810076 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.899811983 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.899822950 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.899830103 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.899863005 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.899863958 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.899876118 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.899903059 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.899916887 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.899916887 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.899928093 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.899954081 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.899957895 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.899959087 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.899971962 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.899993896 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.900005102 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.900006056 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.900026083 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.900037050 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.900049925 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.900058031 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.900063992 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.900074005 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.900080919 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.900109053 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.900110960 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.900126934 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.900156021 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.900161028 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.900167942 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.900201082 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.900202036 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.900213957 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.900224924 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.900239944 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.900245905 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.900250912 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.900259018 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.900265932 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.900280952 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.900284052 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.900291920 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.900295019 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.900331974 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.900343895 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.900353909 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.900365114 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.900374889 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.900386095 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.900394917 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.900398970 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.900409937 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.900420904 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.900433064 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.900444031 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.900454044 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.900475025 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.900490046 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.900501966 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.900511980 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.900527000 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.900537968 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.900595903 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.900607109 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.900636911 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.900650978 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.900738001 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.900748968 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.900759935 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.900770903 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.900775909 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.900783062 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.900793076 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.900794983 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.900814056 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.900816917 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.900827885 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.900830984 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.900841951 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.900852919 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.900855064 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.900866032 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.900883913 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.900887012 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.900899887 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.900906086 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.900912046 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.900918961 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.900933027 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.900944948 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.900953054 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.900955915 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.900968075 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.900968075 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.900999069 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.901001930 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.901015043 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.901021004 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.901036978 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.901047945 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.901052952 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.901060104 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.901066065 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.901082993 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.901093960 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.901094913 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.901106119 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.901108980 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.901130915 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.901134014 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.901140928 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.901153088 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.901153088 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.901165009 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.901189089 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.901190996 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.901195049 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.901199102 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.901206017 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.901212931 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.901235104 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.901245117 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.901246071 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.901273966 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.901303053 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.901307106 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.901314020 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.901343107 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.901350975 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.901386976 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.901386976 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.901420116 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.901424885 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.901437044 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.901468039 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.901479006 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.901499987 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.901510954 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.901535034 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.901537895 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.901551008 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.901560068 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.901588917 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.901590109 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.901598930 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.901602983 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.901618958 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.901640892 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.901665926 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.901676893 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.901705027 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.901714087 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.901715040 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.901755095 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.901782990 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.901794910 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.901828051 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.901837111 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.901850939 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.901890993 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.901902914 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.901913881 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.901925087 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.901937962 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.901940107 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.901947975 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.901952982 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.901969910 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.901978970 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.901983976 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.901992083 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.902025938 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.902046919 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.902059078 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.902070045 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.902080059 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.902090073 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.902098894 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.902111053 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.902122974 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.902129889 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.902137041 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.902143002 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.902160883 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.902162075 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.902173042 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.902194977 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.902205944 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.902209044 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.902220011 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.902231932 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.902231932 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.902259111 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.902261972 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.902275085 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.902276039 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.902304888 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.902304888 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.902317047 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.902337074 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.902338982 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.902348042 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.902360916 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.902373075 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.902380943 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.902393103 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.902394056 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.902415037 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.902417898 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.902427912 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.902430058 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.902462959 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.902489901 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.902497053 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.902503014 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.902514935 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.902525902 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.902539015 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.902546883 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.902553082 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.902558088 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.902570963 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.902581930 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.902581930 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.902606964 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.902612925 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.902612925 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.902617931 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.902623892 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.902631998 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.902659893 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.902671099 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.902682066 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.902684927 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.902693987 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.902703047 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.902730942 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.902740002 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.902745008 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.902751923 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.902764082 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.902785063 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.902800083 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.902801991 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.902806997 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.902818918 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.902828932 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.902829885 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.902868032 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.902874947 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.902884007 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.902888060 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.902900934 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.902911901 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.902918100 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.902925968 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.902935982 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.902936935 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.902947903 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.902960062 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.902964115 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.902978897 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.902987957 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.903000116 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.903007030 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.903016090 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.903028011 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.903038025 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.903057098 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.903074980 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.903088093 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.903090000 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.903100014 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.903110981 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.903124094 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.903136969 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.903142929 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.903155088 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.903161049 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.903182983 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.903187037 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.903193951 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.903208971 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.903224945 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.903228998 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.903240919 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.903253078 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.903261900 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.903273106 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.903284073 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.903284073 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.903311014 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.903318882 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.903330088 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.903350115 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.903366089 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.903397083 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.903408051 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.903419971 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.903430939 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.903441906 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.903453112 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.903465033 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.903465986 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.903476000 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.903480053 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.903489113 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.903511047 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.903512001 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.903522968 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.903539896 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.903544903 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.903558016 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.903572083 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.903582096 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.903589964 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.903594017 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.903605938 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.903625965 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.903640032 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.903656960 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.903672934 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.903691053 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.903779030 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.903789997 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.903809071 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.903816938 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.903820038 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.903834105 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.903845072 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.903856039 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.903860092 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.903868914 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.903875113 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.903887033 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.903898001 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.903904915 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.903911114 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.903930902 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.903938055 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.903943062 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.903951883 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.903983116 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.903995037 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.904025078 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.904036999 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.904047966 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.904057980 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.904063940 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.904073954 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.904098034 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.904123068 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.904140949 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.904151917 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.904166937 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.904172897 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.904177904 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.904190063 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.904201031 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.904202938 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.904213905 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.904215097 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.904237986 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.904242992 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.904252052 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.904258013 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.904272079 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.904288054 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.904294968 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.904308081 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.904318094 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.904324055 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.904345989 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.904352903 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.904360056 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.904373884 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.904380083 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.904386044 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.904408932 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.904416084 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.904421091 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.904428959 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.904441118 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.904443026 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.904454947 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.904468060 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.904484987 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.904495955 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.904496908 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.904530048 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.904536009 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.904542923 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.904578924 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.904584885 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.904597044 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.904608011 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.904618979 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.904623985 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.904635906 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.904639959 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.904653072 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.904664040 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.904674053 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.904679060 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.904696941 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.904697895 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.904709101 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.904721975 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.904737949 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.904750109 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.904751062 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.904762983 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.904762983 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.904774904 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.904793024 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.904793978 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.904805899 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.904808998 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.904834032 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.904839039 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.904850960 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.904851913 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.904889107 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.904892921 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.904903889 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.904930115 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.904931068 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.904942989 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.904947996 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.904973030 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.904975891 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.904985905 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.904998064 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.905019045 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.905025005 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.905046940 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.905056953 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.905057907 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.905077934 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.905097961 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.905108929 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.905174971 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.905185938 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.905196905 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.905208111 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.905217886 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.905232906 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.905240059 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.905252934 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.905257940 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.905273914 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.905283928 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.905287027 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.905297995 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.905309916 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.905317068 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.905330896 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.905342102 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.905349970 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.905364990 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.905375957 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.905390024 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.905405998 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.905407906 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.905409098 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.905431032 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.905464888 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.905476093 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.905488014 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.905523062 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.905530930 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.905540943 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.905541897 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.905563116 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.905564070 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.905572891 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.905580044 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.905600071 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.905606985 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.905613899 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.905620098 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.905626059 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.905642986 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.905663013 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.905693054 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.905704021 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.905714989 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.905725956 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.905735970 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.905740023 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.905757904 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.905769110 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.905776978 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.905782938 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.905795097 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.905797005 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.905806065 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.905813932 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.905826092 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.905843973 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.905867100 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.905896902 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.905908108 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.905930996 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.905935049 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.905947924 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.905947924 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.905972958 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.905994892 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.906009912 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.906022072 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.906042099 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.906052113 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.906059027 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.906085014 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.906104088 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.906148911 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.906161070 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.906188011 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.906198978 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.906198978 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.906234980 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.906239033 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.906248093 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.906277895 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.906301975 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.906337976 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.906348944 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.906379938 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.906388998 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.906404018 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.906414986 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.906445980 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.906460047 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.906487942 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.906498909 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.906527996 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.906537056 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.906538963 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.906579018 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.906665087 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.906676054 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.906696081 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.906704903 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.906707048 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.906727076 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.906733990 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.906749010 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.906764030 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.906789064 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.906805038 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.906816006 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.906837940 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.906861067 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.906877995 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.906888962 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.906915903 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.906918049 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.906927109 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.906934977 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.906940937 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.906960011 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.906981945 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.906996012 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.907004118 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.907030106 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.907046080 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.907069921 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.907174110 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.907185078 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.907219887 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.907246113 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.907267094 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.907298088 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.907363892 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.907375097 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.907396078 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.907406092 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.907413006 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.907419920 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.907429934 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.907430887 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.907453060 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.907464027 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.907464027 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.907484055 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.907516003 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.907571077 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.907582045 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.907612085 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.907675982 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.907686949 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.907713890 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.907726049 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.907740116 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.907751083 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.907763958 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.907776117 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.907778978 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.907797098 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.907808065 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.907812119 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.907836914 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.907849073 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.907851934 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.907861948 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.907881975 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.907892942 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.907892942 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.907906055 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.907921076 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.907937050 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.907942057 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.907953978 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.907957077 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.907974958 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.907980919 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.907993078 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.908000946 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.908015013 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.908027887 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.908039093 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.908039093 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.908061028 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.908066988 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.908068895 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.908080101 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.908085108 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.908092976 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.908104897 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.908114910 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.908123970 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.908128977 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.908142090 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.908144951 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.908164024 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.908174992 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.908174992 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.908185959 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.908186913 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.908216953 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.908243895 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.916920900 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.916932106 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.916948080 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.917311907 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.917536974 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.917574883 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.917654037 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.917684078 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.917815924 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.917870045 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.917921066 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.918020964 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.918081999 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.918118954 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.918205976 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.918380976 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.918423891 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.918438911 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.918486118 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.918529987 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.918565989 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.918631077 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.918699026 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.918742895 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.918756008 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.918797970 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.918839931 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.918889046 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.918941021 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.919003010 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.919054985 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.919101000 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.919111013 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.919146061 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.919146061 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.919162035 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.919303894 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.922710896 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.922760963 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.923032999 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.923077106 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.923448086 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.923492908 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.925123930 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.925137043 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.925164938 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.925187111 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.925192118 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.925206900 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.925231934 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.925245047 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.925374985 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.925411940 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.925736904 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.925787926 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.926964045 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.926978111 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.927002907 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.927005053 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.927021980 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.927036047 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.927227974 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.927267075 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.928313971 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.928330898 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.928348064 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.928360939 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.928375959 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.928394079 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.928698063 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.928739071 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.929270029 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.929316998 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.929482937 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.929527998 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.929836035 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.929872990 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.930211067 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.930246115 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.930572033 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.930609941 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.930929899 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.930969954 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.931014061 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.931032896 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.931049109 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.931055069 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.931060076 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.931071997 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.931072950 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.931086063 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.931090117 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.931113005 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.931122065 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.931139946 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.931155920 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.931171894 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.931180000 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.931196928 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.931205988 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.931236982 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.931246042 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:57.931282043 CET	49731	6561	192.168.2.4	65.21.119.48
Jan 7, 2025 20:01:57.965286970 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:58.407190084 CET	6561	49731	65.21.119.48	192.168.2.4
Jan 7, 2025 20:01:58.407260895 CET	49731	6561	192.168.2.4	65.21.119.48

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 7, 2025 20:01:55.546257019 CET	53605	53	192.168.2.4	1.1.1.1
Jan 7, 2025 20:01:55.556646109 CET	53	53605	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 7, 2025 20:01:55.546257019 CET	192.168.2.4	1.1.1.1	0x5f4f	Standard query (0)	ip-api.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 7, 2025 20:01:55.556646109 CET	1.1.1.1	192.168.2.4	0x5f4f	No error (0)	ip-api.com		208.95.112.1	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

ip-api.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	208.95.112.1	80	7440	C:\Users\user\Desktop\test.exe

Timestamp	Bytes transferred	Direction	Data
Jan 7, 2025 20:01:55.568315983 CET	97	OUT	GET /json/ HTTP/1.1 Content-Type: application/json Host: ip-api.com Connection: Keep-Alive
Jan 7, 2025 20:01:56.081140041 CET	483	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 19:01:55 GMT Content-Type: application/json; charset=utf-8 Content-Length: 306 Access-Control-Allow-Origin: * X-Ttl: 60 X-Rl: 44 Data Raw: 7b 22 73 74 61 74 75 73 22 3a 22 73 75 63 63 65 73 73 22 2c 22 63 6f 75 6e 74 72 79 22 3a 22 55 6e 69 74 65 64 20 53 74 61 74 65 73 22 2c 22 63 6f 75 6e 74 72 79 43 6f 64 65 22 3a 22 55 53 22 2c 22 72 65 67 69 6f 6e 22 3a 22 4e 59 22 2c 22 72 65 67 69 6f 6e 4e 61 6d 65 22 3a 22 4e 65 77 20 59 6f 72 6b 22 2c 22 63 69 74 79 22 3a 22 4e 65 77 20 59 6f 72 6b 22 2c 22 7a 69 70 22 3a 22 31 30 31 32 33 22 2c 22 6c 61 74 22 3a 34 30 2e 37 31 32 38 2c 22 6c 6f 6e 22 3a 2d 37 34 2e 30 30 36 2c 22 74 69 6d 65 7a 6f 6e 65 22 3a 22 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 22 2c 22 69 73 70 22 3a 22 4c 65 76 65 6c 20 33 22 2c 22 6f 72 67 22 3a 22 43 65 6e 74 75 72 79 4c 69 6e 6b 20 43 6f 6d 6d 75 6e 69 63 61 74 69 6f 6e 73 2c 20 4c 4c 43 22 2c 22 61 73 22 3a 22 41 53 33 33 35 36 20 4c 65 76 65 6c 20 33 20 50 61 72 65 6e 74 2c 20 4c 4c 43 22 2c 22 71 75 65 72 79 22 3a 22 38 2e 34 36 2e 31 32 33 2e 31 38 39 22 7d Data Ascii: {"status":"success","country":"United States","countryCode":"US","region":"NY","regionName":"New York","city":"New York","zip":"10123","lat":40.7128,"lon":-74.006,"timezone":"America/New_York","isp":"Level 3","org":"CenturyLink Communications, LLC","as":"AS3356 Level 3 Parent, LLC","query":"8.46.123.189"}

Target ID:	0
Start time:	14:01:53
Start date:	07/01/2025
Path:	C:\Users\user\Desktop\test.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\test.exe"
Imagebase:	0x265716f0000
File size:	380'416 bytes
MD5 hash:	21945C46E3B1EE896E07AE397A884856
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000000.00000000.1648296354.00000265716F2000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000000.00000002.1682508482.0000026500001000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	14:01:56
Start date:	07/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\user\Desktop\test.exe"
Imagebase:	0x7ff607ca0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	14:01:56
Start date:	07/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	14:01:57
Start date:	07/01/2025
Path:	C:\Windows\System32\choice.exe
Wow64 process (32bit):	false
Commandline:	choice /C Y /N /D Y /T 3
Imagebase:	0x7ff650580000
File size:	35'840 bytes
MD5 hash:	1A9804F0C374283B094E9E55DC5EE128
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Function 00007FFD9BAFA6D0 Relevance: 6.2, Strings: 2, Instructions: 3653COMMON

Download Yara Rule

Strings

z'_H, xrefs: 00007FFD9BAFC1C1
n'_H, xrefs: 00007FFD9BAFB671

Memory Dump Source

Source File: 00000000.00000002.1731623497.00007FFD9BAF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9baf0000_test.jbxd

Similarity

API ID:
String ID: n'_H$z'_H
API String ID: 0-4285015528
Opcode ID: 3bfd8b3c9ade047a987dac9a1216c185dd0f32a8b8932ebf56c0861450bce4bd
Instruction ID: f4cba81ac55e9f7d4313b48398e4fab5772f19135e2a7896faed7df518d66f9d
Opcode Fuzzy Hash: 3bfd8b3c9ade047a987dac9a1216c185dd0f32a8b8932ebf56c0861450bce4bd
Instruction Fuzzy Hash: DF536E70B1DB498FD7B9DB18C495AAAB7E1EF98300F11457ED08DC32A1DE74A942CB42

Function 00007FFD9BAF4969 Relevance: 2.1, Instructions: 2057COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731623497.00007FFD9BAF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9baf0000_test.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0669290934fe9a31e3ac6cf83f236591eafd8f231d9252e2f0e94b29c4f0801e
Instruction ID: df1e352220baa74d1d60cfebd9b5d2d348a2e72200c0b60a2dc959aaa316eee4
Opcode Fuzzy Hash: 0669290934fe9a31e3ac6cf83f236591eafd8f231d9252e2f0e94b29c4f0801e
Instruction Fuzzy Hash: 8AD2F631B1EA4A4FEBA8DB6C88655B47BD1EF54300B1601BED44EC72B2DE65FD428780

Function 00007FFD9B8808D4 Relevance: 1.6, Strings: 1, Instructions: 377COMMON

Download Yara Rule

Strings

73O, xrefs: 00007FFD9B880BC3

Memory Dump Source

Source File: 00000000.00000002.1728841751.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b880000_test.jbxd

Similarity

API ID:
String ID: 73O
API String ID: 0-410241874
Opcode ID: d8995c886f0d12b0411fba31924d399c0a352dfb52fd34c11c6c4da4a1d29bd1
Instruction ID: 97604ab9761e4ce38f84f0d87164c513bcb92f19e908ed8b8a637e95da196b90
Opcode Fuzzy Hash: d8995c886f0d12b0411fba31924d399c0a352dfb52fd34c11c6c4da4a1d29bd1
Instruction Fuzzy Hash: 53D1EA61A0EAC94FEB55D77C98657A87FE1EF9A310F4401FAD089CB1E7DA282446C341

Function 00007FFD9BB06689 Relevance: 1.1, Instructions: 1070COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731623497.00007FFD9BAF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9baf0000_test.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e86b60300b40d54b2dcd39fec1edac5f64ca76a5ad86946123e51317d268fdda
Instruction ID: 07374c50d40b1a469efc1376924953e56ed1c9615849b17c1a714d78fb265fee
Opcode Fuzzy Hash: e86b60300b40d54b2dcd39fec1edac5f64ca76a5ad86946123e51317d268fdda
Instruction Fuzzy Hash: 6E62EF31B0DA4A4FEBA8EB58846167573D2FF98304B1541BDD48EC72EAEE24ED428741

Function 00007FFD9BB08F2D Relevance: .9, Instructions: 920COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731623497.00007FFD9BAF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9baf0000_test.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a979eea96821dec6d4b5f6beab69edc4410c01c8c852a6630c558fc81efc4b0d
Instruction ID: bb8b703720b9c97def7761de867b695c0d7d8984272cffebe61c670a64eb97f0
Opcode Fuzzy Hash: a979eea96821dec6d4b5f6beab69edc4410c01c8c852a6630c558fc81efc4b0d
Instruction Fuzzy Hash: A2629030A1DA098FDB69DB58C4A5AB9B7E1FF94304F1101BDD09EC76E6DE24E842C781

Function 00007FFD9BB01318 Relevance: .9, Instructions: 913COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731623497.00007FFD9BAF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9baf0000_test.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 493c5830ace6176ef590774123067662e5dbfda947bc739238271f7167920a36
Instruction ID: cad2bdb51b8bafe0ef9b0b6245a127d38c6f38afda88e6d5ac87a73e765450ce
Opcode Fuzzy Hash: 493c5830ace6176ef590774123067662e5dbfda947bc739238271f7167920a36
Instruction Fuzzy Hash: 9A526F31718A0A4FDBACEA58D4A1A76B3E1FFA4304B1545BDD08EC35DADE34F9428781

Function 00007FFD9BAF7C50 Relevance: .8, Instructions: 833COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731623497.00007FFD9BAF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9baf0000_test.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f278b5701d3c8b69d09285441349203b6cb5aabd52e7c7885dd4095f0764c2c
Instruction ID: 284738a292ba6d3d2250a1a3c1d17c238a8da88e6f642a10324a5654a036ba55
Opcode Fuzzy Hash: 7f278b5701d3c8b69d09285441349203b6cb5aabd52e7c7885dd4095f0764c2c
Instruction Fuzzy Hash: 77426070B19A0D8FDBA8DF58C8A4AB977E1FF98304F1541B9D04EC72A5DE34A981CB41

Function 00007FFD9BAF3E5D Relevance: .8, Instructions: 816COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731623497.00007FFD9BAF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9baf0000_test.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b9c9db1483877ebba77710ad6cc443c1f437d6a982ba0b39efec3eaabff6bd5
Instruction ID: 6e3db9803883f9194936de6bcfa37953b84d48bb3a6445230c322caeb5939767
Opcode Fuzzy Hash: 7b9c9db1483877ebba77710ad6cc443c1f437d6a982ba0b39efec3eaabff6bd5
Instruction Fuzzy Hash: 1032B230B1DA494FE768EB6C9465AB577D2FF98300F1502BEE44DC72A6DE24EC428781

Function 00007FFD9BAFD0E1 Relevance: .8, Instructions: 778COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731623497.00007FFD9BAF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9baf0000_test.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 003d05c4d54d26dd735d723312ee7218ac20d919826db75762772d3193a263d5
Instruction ID: ffdb0c46d49a89e48c43319fbf3d27d77f8360c592a9264dce951893874cef6f
Opcode Fuzzy Hash: 003d05c4d54d26dd735d723312ee7218ac20d919826db75762772d3193a263d5
Instruction Fuzzy Hash: 70322931B1DB494FE769AB6C94652F57BD1FF99300F0501BED08EC72E2DE68A9028381

Function 00007FFD9BB012A0 Relevance: .7, Instructions: 739COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731623497.00007FFD9BAF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9baf0000_test.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d754d9b6c3efa4af950696f7c530b2e17b5b464309e6ae1d58598264bc257ee2
Instruction ID: 7c185d3483a19ef12d3bf493d0809863993512a721c772fbbd8673525f7274e5
Opcode Fuzzy Hash: d754d9b6c3efa4af950696f7c530b2e17b5b464309e6ae1d58598264bc257ee2
Instruction Fuzzy Hash: 75423F30A19A0D8FDBA8DB58C4A5B79B3E1FF54304F1041B9D48EC76A5DE34E986CB41

Function 00007FFD9BB01420 Relevance: .5, Instructions: 488COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731623497.00007FFD9BAF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9baf0000_test.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed5e10cb0ac1d9eb4235cc645cfdfebbbd3f66f6ea0c38f88f91b914a77c00fd
Instruction ID: 3e3ea30b65081a6671a7b8177ea3244312eb8c3b9ede34bbafb0a200011a0b8c
Opcode Fuzzy Hash: ed5e10cb0ac1d9eb4235cc645cfdfebbbd3f66f6ea0c38f88f91b914a77c00fd
Instruction Fuzzy Hash: 08E14D72B0EB844FDB298A5CE8955797BD1FF86364B0901BFF0C9871FBD915A9028381

Function 00007FFD9BB09B68 Relevance: .3, Instructions: 300COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731623497.00007FFD9BAF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9baf0000_test.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd2b2f3ab4a18daec210204bf75ca7e43e83712cf127b2ce529e1e450765abe4
Instruction ID: ccd5a5d4ca2c42a6d1e878f9710f32af0a48ad0cd9eb94be6af3c908a51b4f8b
Opcode Fuzzy Hash: dd2b2f3ab4a18daec210204bf75ca7e43e83712cf127b2ce529e1e450765abe4
Instruction Fuzzy Hash: 96918631A0DA4A4FD759DF6898655B17BE1FF9A310B0541BED04DC72E3EE28A842C781

Function 00007FFD9B880558 Relevance: 6.6, Strings: 5, Instructions: 366COMMON

Download Yara Rule

Strings

>O_^, xrefs: 00007FFD9B880601
O_^~, xrefs: 00007FFD9B880762
O_^V, xrefs: 00007FFD9B8806C2
O_^n, xrefs: 00007FFD9B880722
O_^X, xrefs: 00007FFD9B8806C9

Memory Dump Source

Source File: 00000000.00000002.1728841751.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b880000_test.jbxd

Similarity

API ID:
String ID: >O_^$O_^V$O_^X$O_^n$O_^~
API String ID: 0-3989213369
Opcode ID: db6181152d95d05663bff29261c8464117e8c994e9ac0fb2914ca442e5e4cf9f
Instruction ID: 0d2e022e67d61226c99dcee59e58f2318d8580b0d080cce2cbd09e528bcf6764
Opcode Fuzzy Hash: db6181152d95d05663bff29261c8464117e8c994e9ac0fb2914ca442e5e4cf9f
Instruction Fuzzy Hash: 7FA147A3B0A5664BE71677BCB86A5ED3B80DFC4329B0805B7D19DCB0D7EC1824874291

Function 00007FFD9BAF8154 Relevance: 3.1, Strings: 2, Instructions: 629COMMON

Download Yara Rule

Strings

'_^, xrefs: 00007FFD9BAF886A
'_^, xrefs: 00007FFD9BAF88C2

Memory Dump Source

Source File: 00000000.00000002.1731623497.00007FFD9BAF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9baf0000_test.jbxd

Similarity

API ID:
String ID: '_^$'_^
API String ID: 0-1311721088
Opcode ID: 6412d8b99dc09e1c94a14445baecb623d8d4d845ad7cb4da15f5ac1f66d947f2
Instruction ID: 918e4b0385083b3b980dd9e6f636fd05913bd3aac4316baab22d23a905995e60
Opcode Fuzzy Hash: 6412d8b99dc09e1c94a14445baecb623d8d4d845ad7cb4da15f5ac1f66d947f2
Instruction Fuzzy Hash: 69023831B1EB4A8FD769DB2884656B57BE1FF59310B0501BED08EC31E3DE24B8468781

Function 00007FFD9BB0CF30 Relevance: 3.0, Strings: 2, Instructions: 450COMMON

Download Yara Rule

Strings

^, xrefs: 00007FFD9BB0D39A
m, xrefs: 00007FFD9BB0D3A2

Memory Dump Source

Source File: 00000000.00000002.1731623497.00007FFD9BAF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9baf0000_test.jbxd

Similarity

API ID:
String ID: ^$m
API String ID: 0-1535649515
Opcode ID: e269dd53526d4440e5567d98932b1137875daa9d0158434ac242eb054a72ccec
Instruction ID: 7d4dbd51ef5c01694c4c6fe9fe020a4765943cf52f201e2c3ff7bcfcb89e8e8a
Opcode Fuzzy Hash: e269dd53526d4440e5567d98932b1137875daa9d0158434ac242eb054a72ccec
Instruction Fuzzy Hash: 79E14770B0DB894FD756EB688464AB47BE1FF4A314F0501FAE089C72E7DE28A946C741

Function 00007FFD9BAF8BFA Relevance: 2.9, Strings: 2, Instructions: 430COMMON

Download Yara Rule

Strings

'_^, xrefs: 00007FFD9BAF8BFA
'_^, xrefs: 00007FFD9BAF8C2A

Memory Dump Source

Source File: 00000000.00000002.1731623497.00007FFD9BAF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9baf0000_test.jbxd

Similarity

API ID:
String ID: '_^$'_^
API String ID: 0-1311721088
Opcode ID: 99722ea78afc53e6b08060e198fe26a2326a48284c5d3c3cdaee29b95af34252
Instruction ID: 08523d0510cadbc84968fe2944f44b1b4d3055cc98f738828e23eee04c9b637c
Opcode Fuzzy Hash: 99722ea78afc53e6b08060e198fe26a2326a48284c5d3c3cdaee29b95af34252
Instruction Fuzzy Hash: 65C10A71B0DA098FEB68EB6C94655F577D2FF98320B45017AD04EC72E3DE28B9028740

Function 00007FFD9BAF8A68 Relevance: 1.8, Strings: 1, Instructions: 515COMMON

Download Yara Rule

Strings

]'_H, xrefs: 00007FFD9BAFDEC3

Memory Dump Source

Source File: 00000000.00000002.1731623497.00007FFD9BAF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9baf0000_test.jbxd

Similarity

API ID:
String ID: ]'_H
API String ID: 0-1610993727
Opcode ID: bb33119801c8d5243846e6ad04c10cfd5226f6b262494cf0e19cf6dd0214179f
Instruction ID: ebf8d0a94456bb5b95f5ba204829d42b5edd808d1f061a5313114459fa180e2a
Opcode Fuzzy Hash: bb33119801c8d5243846e6ad04c10cfd5226f6b262494cf0e19cf6dd0214179f
Instruction Fuzzy Hash: 1DF1E831B09A0E4FDBA9DB58D4A0AB177D2FFA9314B1541BAC04DC72A6CE69FD42C740

Function 00007FFD9BB09ED3 Relevance: 1.7, Strings: 1, Instructions: 456COMMON

Download Yara Rule

Strings

", xrefs: 00007FFD9BB0A1A0

Memory Dump Source

Source File: 00000000.00000002.1731623497.00007FFD9BAF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9baf0000_test.jbxd

Similarity

API ID:
String ID: "
API String ID: 0-123907689
Opcode ID: a0cbc8ba7be460462a33f2c96366858df20f7c21fa69928783aab2a85e57c948
Instruction ID: 59dd2e6ea3e7b9ab7f33a8f5cf27f967a6cc3820b03dd1ff444efc012844af94
Opcode Fuzzy Hash: a0cbc8ba7be460462a33f2c96366858df20f7c21fa69928783aab2a85e57c948
Instruction Fuzzy Hash: DED1477270DA894FD759EB2C88659B577E0FFA931470500BED08AC71E7EE25AC068741

Function 00007FFD9BB018B2 Relevance: 1.6, Strings: 1, Instructions: 301COMMON

Download Yara Rule

Strings

(, xrefs: 00007FFD9BB01924

Memory Dump Source

Source File: 00000000.00000002.1731623497.00007FFD9BAF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9baf0000_test.jbxd

Similarity

API ID:
String ID: (
API String ID: 0-3887548279
Opcode ID: 5c46a1776aac935c4f3bc47afd73488a857ea301ad8c8203959ad1ecd43802b2
Instruction ID: ca1b10d64de669aa810000a0dc32ebcb21474741e246b7be9995ed5e5582ef74
Opcode Fuzzy Hash: 5c46a1776aac935c4f3bc47afd73488a857ea301ad8c8203959ad1ecd43802b2
Instruction Fuzzy Hash: EA810621B0EA4E0BEB6C9A9854653B977D1FF96314F0501BEF48DC32E7DE68A9428341

Function 00007FFD9BB0D3F1 Relevance: 1.4, Strings: 1, Instructions: 165COMMON

Download Yara Rule

Strings

1, xrefs: 00007FFD9BB0D503

Memory Dump Source

Source File: 00000000.00000002.1731623497.00007FFD9BAF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9baf0000_test.jbxd

Similarity

API ID:
String ID: 1
API String ID: 0-2212294583
Opcode ID: 76567a45f8664df7e61ef52621eede509e730803d28db757c6e562d4cd9e5a62
Instruction ID: a1b171c5c50b70f8ba129c762e8aeb5475b5144c1f0043a81cd99c1ddd8ca196
Opcode Fuzzy Hash: 76567a45f8664df7e61ef52621eede509e730803d28db757c6e562d4cd9e5a62
Instruction Fuzzy Hash: 79516FB0A096498FD759DF5894656B9B7E4FF58308F1001FAE48DC32E6DB396A42CB02

Function 00007FFD9B8805D3 Relevance: 1.4, Strings: 1, Instructions: 154COMMON

Download Yara Rule

Strings

>O_^, xrefs: 00007FFD9B880601

Memory Dump Source

Source File: 00000000.00000002.1728841751.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b880000_test.jbxd

Similarity

API ID:
String ID: >O_^
API String ID: 0-4219905819
Opcode ID: 6ad7affc23c08f9033e863f709ff66417f3d0493c93f56a484f4e4c73e27eeef
Instruction ID: 9ffad7605fee2799356b84ea3f040eeef54c5e17bae27b8368fd826440b64889
Opcode Fuzzy Hash: 6ad7affc23c08f9033e863f709ff66417f3d0493c93f56a484f4e4c73e27eeef
Instruction Fuzzy Hash: 8041D392A0E6D64FD716B7B828796F97FD0DF9A264B0804FBD0C9CB1A7DD1824478341

Function 00007FFD9B88084D Relevance: 1.3, Strings: 1, Instructions: 69COMMON

Download Yara Rule

Strings

<O_^, xrefs: 00007FFD9B880801

Memory Dump Source

Source File: 00000000.00000002.1728841751.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b880000_test.jbxd

Similarity

API ID:
String ID: <O_^
API String ID: 0-1368354704
Opcode ID: a72c27cbebe4e8ef372ab6993c2d97b5b37b3ff5b25f390410c69e47a5f1179c
Instruction ID: 14bfdeaff98d6025d5db6d300f9fe8908498703027e731ed305f1645ba98a90c
Opcode Fuzzy Hash: a72c27cbebe4e8ef372ab6993c2d97b5b37b3ff5b25f390410c69e47a5f1179c
Instruction Fuzzy Hash: 881104A3A1E3A68BE766B7BCBCB64D53B90DF0162CB0D01F7D0AC8A0A3FC1865455241

Function 00007FFD9BAF89FA Relevance: 1.3, Strings: 1, Instructions: 3COMMON

Download Yara Rule

Strings

'_^, xrefs: 00007FFD9BAF89FA

Memory Dump Source

Source File: 00000000.00000002.1731623497.00007FFD9BAF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9baf0000_test.jbxd

Similarity

API ID:
String ID: '_^
API String ID: 0-1941156895
Opcode ID: e9e588547a23b3acc8091679100f16b4e651f990f6ee0fbcc3161652165e22d0
Instruction ID: 724715637de0d8770c0da9993e9ebd500d665979655e8d9f0362b6b0c6b69850
Opcode Fuzzy Hash: e9e588547a23b3acc8091679100f16b4e651f990f6ee0fbcc3161652165e22d0
Instruction Fuzzy Hash:

Function 00007FFD9BAF0029 Relevance: .8, Instructions: 816COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731623497.00007FFD9BAF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9baf0000_test.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6ff241ef5eb61a49ce2d295f28f229a1d5b1aeb78e9563eb6f0895fda6f075c
Instruction ID: bccbd939ec0e724088526c1da0393c28181d351bfdfb58d53ab927019a771d6e
Opcode Fuzzy Hash: f6ff241ef5eb61a49ce2d295f28f229a1d5b1aeb78e9563eb6f0895fda6f075c
Instruction Fuzzy Hash: 57424B62B0EFCA0FEBBA9B6814751B47FD1EF56640B0900FED499C70E7ED58A9058305

Function 00007FFD9B883BDB Relevance: .8, Instructions: 775COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1728841751.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b880000_test.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3e945cf324c52133f00a4a9b8c166fd983b53e8179cd4703cea755f576d7243
Instruction ID: 57a85048673184c7963852b5bd63ba1ea39b7a5a5a523d92ea88141c6735a271
Opcode Fuzzy Hash: b3e945cf324c52133f00a4a9b8c166fd983b53e8179cd4703cea755f576d7243
Instruction Fuzzy Hash: 3D421F31B19D0D8FDB98EB5CD494AA877E2FF98304B1541B9D01DCB2A6DA35ED42CB80

Function 00007FFD9BB01328 Relevance: .7, Instructions: 690COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731623497.00007FFD9BAF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9baf0000_test.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 725f77531e37282727c05592127e834c01ea4bccadbf8afefde2361e4c15897e
Instruction ID: 7bfd37ac7655164bc30c3567c4a5350abe0e39ccd50131e27f0e7eddc11ef386
Opcode Fuzzy Hash: 725f77531e37282727c05592127e834c01ea4bccadbf8afefde2361e4c15897e
Instruction Fuzzy Hash: 7D12E13170DA0A8FDB98DE5CD4A0A75B3D2FB99314B1541BAD08DC76EADE25EC42C780

Function 00007FFD9BAF153D Relevance: .6, Instructions: 618COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731623497.00007FFD9BAF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9baf0000_test.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a2bce4c50cbac265851e34c2698c51a5e64b78325b31554ba5e2e302c95aae3
Instruction ID: 542727787993e085f620c4fbc3c192182e5d71fa74b3db2a83042f5b54a0dc30
Opcode Fuzzy Hash: 3a2bce4c50cbac265851e34c2698c51a5e64b78325b31554ba5e2e302c95aae3
Instruction Fuzzy Hash: 49126730B0DB894FD769DB68C4A15B5BBE0FF65300B1545BED08EC76A3EA64B842C781

Function 00007FFD9BB16990 Relevance: .6, Instructions: 566COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731623497.00007FFD9BAF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9baf0000_test.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 645f2a1335e04569f5ca775fbc949fa6ce52ef7c1fa26df4e8cbb27b0e413557
Instruction ID: 2671f9584064e6f9692b5a5d9a2ac6782c4c907573e57913ce2d4f1ff5ed54c0
Opcode Fuzzy Hash: 645f2a1335e04569f5ca775fbc949fa6ce52ef7c1fa26df4e8cbb27b0e413557
Instruction Fuzzy Hash: 82121361A0E7C60FE7669B6848366647FA1EF66300B0A41FBD08ACB1F3ED196D41C352

Function 00007FFD9B8833CA Relevance: .5, Instructions: 472COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1728841751.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b880000_test.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 619c43c1a7501e81efa5238d0c91ddb203e0c40d37f12af3d801cfc5e5db2c7b
Instruction ID: 111e1d4dca28266999031e341b08c179dd6706d8b5dc57970c42c803c9eb140e
Opcode Fuzzy Hash: 619c43c1a7501e81efa5238d0c91ddb203e0c40d37f12af3d801cfc5e5db2c7b
Instruction Fuzzy Hash: 09E12961F0ED4E4FEBB4E7ACD4A567877E1EF58350F1101BAE019C72A6DD34A9428740

Function 00007FFD9BAF5D93 Relevance: .5, Instructions: 470COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731623497.00007FFD9BAF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9baf0000_test.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca22f7a28c9d9b93d0d97326c707dc23bb6dd4402c3512ef361338fdd7487dea
Instruction ID: 922f2c6af0ad31a5105f91e26a0041fc9bed77052bbf8dd5360f32dd2f01ac4b
Opcode Fuzzy Hash: ca22f7a28c9d9b93d0d97326c707dc23bb6dd4402c3512ef361338fdd7487dea
Instruction Fuzzy Hash: 1FE13C3070DA898FEB7C9B1CE865BA837D1EF59300F1540AEE45ECB2A7CE249D468745

Function 00007FFD9BB04420 Relevance: .5, Instructions: 465COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731623497.00007FFD9BAF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9baf0000_test.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94044b90d156fab09062d8c81e55f94a2f5ba98b7b9ccd308cc6b90979cbba36
Instruction ID: ce2d7891b64a40d216f3f0296bd2ec6b40031e670c53e7ea0931b73202fb886f
Opcode Fuzzy Hash: 94044b90d156fab09062d8c81e55f94a2f5ba98b7b9ccd308cc6b90979cbba36
Instruction Fuzzy Hash: 93F11461A0EBC54FD71BDB6888655647FF1EF67304B1A41EBC089CB1E7DE28A806C352

Function 00007FFD9BAF2634 Relevance: .5, Instructions: 465COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731623497.00007FFD9BAF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9baf0000_test.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1ca3139b5a9ce191476dd0d8a2464372401630151ca31357b74d1bfe4870f2e
Instruction ID: 2481ca247ae67a9c7f53432fae22e744a1f76e2716575ca6ec18cec41b79c538
Opcode Fuzzy Hash: b1ca3139b5a9ce191476dd0d8a2464372401630151ca31357b74d1bfe4870f2e
Instruction Fuzzy Hash: 12D14820B0DB0E0FEBB8A7AC94A41B57BD1EF95310F5501BEE44DC71A6DD69AD428381

Function 00007FFD9B883CB6 Relevance: .5, Instructions: 460COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1728841751.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b880000_test.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db106d878b52656f616fb3e2a82f6a25a3be18c3096cbaf9a68491ab624e8c4d
Instruction ID: 6b5f855af943fd5f793be03b87a5c914fb06544aee8544f847053ccf420794d3
Opcode Fuzzy Hash: db106d878b52656f616fb3e2a82f6a25a3be18c3096cbaf9a68491ab624e8c4d
Instruction Fuzzy Hash: 78E10E31B1990D8FDBA8EB5CD494AA877E1FF58305F1541B9D01ECB2A6DA35EC42CB40

Function 00007FFD9BB01BA2 Relevance: .4, Instructions: 404COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731623497.00007FFD9BAF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9baf0000_test.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 63b91f6965a000022a505bdfee6019db59a1429c6ff01e28ffa7f56f9bda09c7
Instruction ID: 1db695bd57595a32f5cb7a3232c83c5e3b1fc6efa81ba3ede43a25518c5bce67
Opcode Fuzzy Hash: 63b91f6965a000022a505bdfee6019db59a1429c6ff01e28ffa7f56f9bda09c7
Instruction Fuzzy Hash: 20C13961B1DE894FD76CA7689465ABAB7D1FF65310B0405FEE08AC71EBED24B8028341

Function 00007FFD9BB0A2BD Relevance: .4, Instructions: 404COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731623497.00007FFD9BAF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9baf0000_test.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9578519ac48a3325346c23c07df5eac4f64a5eb5e639fc1edf8efc1b1a552084
Instruction ID: aa7b8b5edce2f733ab3eaac4d951def424b16dff5a1dca326efb619b9c802080
Opcode Fuzzy Hash: 9578519ac48a3325346c23c07df5eac4f64a5eb5e639fc1edf8efc1b1a552084
Instruction Fuzzy Hash: 7FC10571B0998D4FDBA4EB6C9468B787BE1FF9935470905FAD08DC72BADD18AC058340

Function 00007FFD9BAF9F15 Relevance: .4, Instructions: 395COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731623497.00007FFD9BAF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9baf0000_test.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e661daef7cffd49a6850b5b896ce0166d1c8b43135816dbedbec2063b7b99434
Instruction ID: adc8ca9e8d0d529e1d9d9ebbd7b8a6913d36ba0b0212a844d9419f973d651842
Opcode Fuzzy Hash: e661daef7cffd49a6850b5b896ce0166d1c8b43135816dbedbec2063b7b99434
Instruction Fuzzy Hash: D7B1D861B1EB0E0BEBB5A7A854652F527D2DF99341F1600BAC84DC72F3DD5EAE068340

Function 00007FFD9BAF7B85 Relevance: .4, Instructions: 390COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731623497.00007FFD9BAF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9baf0000_test.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6cc12aaf0e2f6fc3f4e26f0e7be2ffab1fa7866dfe6169288670882448590727
Instruction ID: ba7126290de0f7df30ceb8836b22fd7eb2c0695df97ce25eef04f4a37e467777
Opcode Fuzzy Hash: 6cc12aaf0e2f6fc3f4e26f0e7be2ffab1fa7866dfe6169288670882448590727
Instruction Fuzzy Hash: 8BB10531B09A0E4FDB68EB9CD8A59F977E1FF94324F05427AD08DC7196DE24B8468780

Function 00007FFD9B88415D Relevance: .4, Instructions: 375COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1728841751.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b880000_test.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2082f6051cf749fc7dd2beebbf6f8ae6de9fbba91f61c39d24cd3778e0d4dde8
Instruction ID: 3fbc23fcbc4dc70472c2f93326bb593a0a8990b56049ba9a2c62c3dc6ad0e56c
Opcode Fuzzy Hash: 2082f6051cf749fc7dd2beebbf6f8ae6de9fbba91f61c39d24cd3778e0d4dde8
Instruction Fuzzy Hash: C3C11E31B1990D8FDBA8EB5CD464A6877E2FF98314B1901B9D01DCB2A6DE35ED42CB40

Function 00007FFD9BAF39B9 Relevance: .4, Instructions: 369COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731623497.00007FFD9BAF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9baf0000_test.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f10ae93d93784814e23596e44d7100efa42a21f5a2977ef3dc5a6b040f339f54
Instruction ID: 2cc6613c7f07777364aeab6ea5962a226faba5de2343a41f0a0361403c73933c
Opcode Fuzzy Hash: f10ae93d93784814e23596e44d7100efa42a21f5a2977ef3dc5a6b040f339f54
Instruction Fuzzy Hash: 95B1C671B0EB4E4FEBA4DBAC88B56A87BD1FF59740B1500B9D44DC72A2DD65AC06C700

Function 00007FFD9BB01300 Relevance: .3, Instructions: 349COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731623497.00007FFD9BAF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9baf0000_test.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 60a8cfaf2ca3fdd261612d9353a7042b435c78d7fe9a583dd0de29b0b3910296
Instruction ID: 9cfdd9509e3c90955fd145a1d7dda77978176c560358d2cd394e3a29dab90ca4
Opcode Fuzzy Hash: 60a8cfaf2ca3fdd261612d9353a7042b435c78d7fe9a583dd0de29b0b3910296
Instruction Fuzzy Hash: 5CC19130B19A0E8FEBA8DA58C0A4775B3D1FF58308F154579C08E876D9DA3AE985C740

Function 00007FFD9B8840E8 Relevance: .3, Instructions: 335COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1728841751.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b880000_test.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 295d38b812c0a2326ae774b474b3397b354c560149b1be883bfd561b0dc69bc2
Instruction ID: 05e77a41b545d8465601a88768bd8125cb649c4d84619be873daf5c2178243e4
Opcode Fuzzy Hash: 295d38b812c0a2326ae774b474b3397b354c560149b1be883bfd561b0dc69bc2
Instruction Fuzzy Hash: 76B10D31B1990D8FDBA8EB5CD468A6873E1FF98314F1A01B9D01DCB2A5DA35EC42CB40

Function 00007FFD9B884121 Relevance: .3, Instructions: 335COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1728841751.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b880000_test.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ecb0aacf3e32c8a5833d5c9a43699c21110245e51afd5a0b06f20b81a5b2786e
Instruction ID: f4ae51bb54c287138f67847c406078ea7a2c2e765d2b8afe04e982295d312400
Opcode Fuzzy Hash: ecb0aacf3e32c8a5833d5c9a43699c21110245e51afd5a0b06f20b81a5b2786e
Instruction Fuzzy Hash: E6B10D31B1990D8FDBA8EB5CD458A6873E1FF98314F1901B9D01DCB2A5DA35EC42CB40

Function 00007FFD9B884196 Relevance: .3, Instructions: 333COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1728841751.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b880000_test.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b50337058ac7bd2c4dcf9c4d901a2878978e5af826b6baf8be1811220fc43bc1
Instruction ID: 3dfc3d0a827bfbbded735e12ded99021e291888f17e69a3b54bb725cbd139aed
Opcode Fuzzy Hash: b50337058ac7bd2c4dcf9c4d901a2878978e5af826b6baf8be1811220fc43bc1
Instruction Fuzzy Hash: 50B1FC31B1990D8FDBA8EB5CD468A6877E2FF98314F1901B9D01DCB2A5DA35ED42CB40

Function 00007FFD9B8841CC Relevance: .3, Instructions: 333COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1728841751.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b880000_test.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9721c1e858d6ae05101940bc8cd71272c6bbae21b4acb78e798546cfb28eee13
Instruction ID: 4310a1e945f8a4cfa2a07a1883d554767b1795bef8054d10ef1a565899031810
Opcode Fuzzy Hash: 9721c1e858d6ae05101940bc8cd71272c6bbae21b4acb78e798546cfb28eee13
Instruction Fuzzy Hash: E5B10C31B1990D8FDBA8EB5CD464A6877E1FF98314F1901B9D01DCB2A5DA35ED42CB40

Function 00007FFD9BAF7B78 Relevance: .3, Instructions: 330COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731623497.00007FFD9BAF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9baf0000_test.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e090f03355c522247978584e6339e4dea9774d8c03e58f99351bf0114f8fe37
Instruction ID: c1dc1755982e42c539f777c68411be8f1b5eb3b0b24c41a6eb01165c2eb2db55
Opcode Fuzzy Hash: 1e090f03355c522247978584e6339e4dea9774d8c03e58f99351bf0114f8fe37
Instruction Fuzzy Hash: 6CA1D330B0DA0D4FDB68DB98C8A59B977E1FF95314F05427AD089C71A6DE24B9428781

Function 00007FFD9B88421C Relevance: .3, Instructions: 329COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1728841751.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b880000_test.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8efa0ba64ca4ca78b74fdac8a55c1aa7e1f2453c485b34a415feeb50d5a92a5d
Instruction ID: f6916556de5be0bc4bb717ed37691233250428be6c9bfbae2a88cf35a380244e
Opcode Fuzzy Hash: 8efa0ba64ca4ca78b74fdac8a55c1aa7e1f2453c485b34a415feeb50d5a92a5d
Instruction Fuzzy Hash: 77A1FC31B1990D8FDBA8EB5CD454B6873E1FF98314B1941B9D01DCB2A5DA35ED42CB40

Function 00007FFD9B8841FF Relevance: .3, Instructions: 322COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1728841751.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b880000_test.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4f1ad3881821930589db0858569e404b92adae22a955bf7871c13c3baf95e8c
Instruction ID: 287025c98cdac91291ba399a69d2179de8076db56b137062bba03819c13c2147
Opcode Fuzzy Hash: e4f1ad3881821930589db0858569e404b92adae22a955bf7871c13c3baf95e8c
Instruction Fuzzy Hash: 5DA10C31B1990D8FDBA8EB5CD458A6877E1FF98314F1A41B9D01ECB2A5DA35EC42CB40

Function 00007FFD9B8840C8 Relevance: .3, Instructions: 322COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1728841751.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b880000_test.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a21d9b444ed1b563f26d5f76fffdee4f8e8abeb3b0261b953478afdbfc62758
Instruction ID: 287025c98cdac91291ba399a69d2179de8076db56b137062bba03819c13c2147
Opcode Fuzzy Hash: 9a21d9b444ed1b563f26d5f76fffdee4f8e8abeb3b0261b953478afdbfc62758
Instruction Fuzzy Hash: 5DA10C31B1990D8FDBA8EB5CD458A6877E1FF98314F1A41B9D01ECB2A5DA35EC42CB40

Function 00007FFD9BB01320 Relevance: .3, Instructions: 306COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731623497.00007FFD9BAF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9baf0000_test.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e004dd85424ed16491947ae608c1271947bc98a78e2686a7caf1eafd211d3dc
Instruction ID: 3a1f7187f9c851cf8236b3bfecca11507c48935ff32bd6936669ae165151e0b7
Opcode Fuzzy Hash: 1e004dd85424ed16491947ae608c1271947bc98a78e2686a7caf1eafd211d3dc
Instruction Fuzzy Hash: 0D919030719A0D4FDB68EA58D494E7573E1FB98314B21456DD08EC76EADA26FC82C780

Function 00007FFD9BAF41AB Relevance: .3, Instructions: 306COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731623497.00007FFD9BAF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9baf0000_test.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c0517ffa98361d8c99c08e42ad9d67675c377adc3a440f172f4222857146e79
Instruction ID: 925352aadc80bf15f8833ee5a33861f5a9f67e039e7e36be6e37a6c4a55d37f5
Opcode Fuzzy Hash: 6c0517ffa98361d8c99c08e42ad9d67675c377adc3a440f172f4222857146e79
Instruction Fuzzy Hash: 5B912130B189094FEB6CEB1CD465BA9B7D2FF58300F1541AEE45ED72A6DE24EC428781

Function 00007FFD9BB05C55 Relevance: .3, Instructions: 297COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731623497.00007FFD9BAF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9baf0000_test.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5cca331ec0832a2bf074f0c9ce0c2e0eb65613e71c5a45b6941b8404a871bf76
Instruction ID: 10318c0ab84be63517d431d33829980fc7fee0f2be0682673452c9a27bab4776
Opcode Fuzzy Hash: 5cca331ec0832a2bf074f0c9ce0c2e0eb65613e71c5a45b6941b8404a871bf76
Instruction Fuzzy Hash: C3910530B0DA4D4FDB68DF58C894AB577E1FF99314F05427AD089C36A6DA24F9418781

Function 00007FFD9BAF0065 Relevance: .3, Instructions: 283COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731623497.00007FFD9BAF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9baf0000_test.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46ad4bdcc09abbe77e810b573de877773cd00ed408689c3f891999631c12dad2
Instruction ID: 15432332f89f3b79a4c7dc84554dace91860d6f8467304bb45f4cf0154e3df06
Opcode Fuzzy Hash: 46ad4bdcc09abbe77e810b573de877773cd00ed408689c3f891999631c12dad2
Instruction Fuzzy Hash: 8D812672B0EF890FEBB99B6848755B57BD1EF65740B0501BED08AC31A3ED64B801C749

Function 00007FFD9BAF3356 Relevance: .3, Instructions: 273COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731623497.00007FFD9BAF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9baf0000_test.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 700c57454f2d116df61ddc8462f3355e660494d808837f3515b4e7da397676e9
Instruction ID: e5ffd579e669f6483ffce3ad2cfb803831de5eb91aea39d8d922ff6b02bda24e
Opcode Fuzzy Hash: 700c57454f2d116df61ddc8462f3355e660494d808837f3515b4e7da397676e9
Instruction Fuzzy Hash: 7781B571B1DA4D4FEBA5DB6C88B46F83BD2FF99305B0600B9D44DC72A2DE65A842C700

Function 00007FFD9BAF39D0 Relevance: .3, Instructions: 271COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731623497.00007FFD9BAF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9baf0000_test.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0eaf351cb9e0244887a2e1491041812e4d4879c8af507cccf8d3766201132f8e
Instruction ID: b23173d22afaaf69eceb787f99363255f51ecb13fa0903931818f180446a3079
Opcode Fuzzy Hash: 0eaf351cb9e0244887a2e1491041812e4d4879c8af507cccf8d3766201132f8e
Instruction Fuzzy Hash: 2881C771B0DB4E4FEFA4DBAC88B45A87BD2FF99744B1500A9D44DC72A2DE65AC02C700

Function 00007FFD9BAF8AC0 Relevance: .3, Instructions: 261COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731623497.00007FFD9BAF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9baf0000_test.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67c1acd2d25b572498168baf7905907be6753b9dafde8a0ff05fa02389eec787
Instruction ID: fffbaf713aefaa53e8aef64cb8d61b44483984564040829b23df8a7449d6bc5f
Opcode Fuzzy Hash: 67c1acd2d25b572498168baf7905907be6753b9dafde8a0ff05fa02389eec787
Instruction Fuzzy Hash: 8371B030B19B098BEBB8EB58D455AB1B7D2FB98310F15457ED08AC32A5CE75F942C780

Function 00007FFD9BB01CD1 Relevance: .3, Instructions: 258COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731623497.00007FFD9BAF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9baf0000_test.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 802db868520963fd7a285d69fc5a6cb8ab7067dc63334b71caeefa292e6319a8
Instruction ID: 8f0478acf734bb1a35445dcf667d9ff7488225413b4a1c5a37e480ee5663a095
Opcode Fuzzy Hash: 802db868520963fd7a285d69fc5a6cb8ab7067dc63334b71caeefa292e6319a8
Instruction Fuzzy Hash: 9A7129A1A1EBC50FD76DA67854156BABBD1EF65210F0404FFE0DAC71D7ED2464038352

Function 00007FFD9BAFEB90 Relevance: .3, Instructions: 256COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731623497.00007FFD9BAF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9baf0000_test.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4d4715fddc9853cd744f33cceeb9cb5b310558416e956f89ae376dc3f8a11c6
Instruction ID: fbc1bd08d7ad9ba638251e81580e0d5af43003b48b5b33a9eb4c1aa6e8299a05
Opcode Fuzzy Hash: f4d4715fddc9853cd744f33cceeb9cb5b310558416e956f89ae376dc3f8a11c6
Instruction Fuzzy Hash: 65713961B0EA8D0FEBA99B6C58746B03BD1EF9D340B0901BAD04DC72E7DD64AD428340

Function 00007FFD9BB01260 Relevance: .2, Instructions: 250COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731623497.00007FFD9BAF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9baf0000_test.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6da8f04f100d15763cde5c94d31e2af6e9e913f50e396a2028acb80aa8c5a885
Instruction ID: 4402d94be8ef2075f6a96088711ba308ac5a51db469cdff45f49f4b9c20d0d31
Opcode Fuzzy Hash: 6da8f04f100d15763cde5c94d31e2af6e9e913f50e396a2028acb80aa8c5a885
Instruction Fuzzy Hash: 437139A1A1EF850FD76CA6785419ABAB7D1EFA5260F0404FFE0DAC71DBED2464028342

Function 00007FFD9BB004A5 Relevance: .2, Instructions: 245COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731623497.00007FFD9BAF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9baf0000_test.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a13a9eda4d28fd68b33d7d59adca1ba6c21f71c58056cb07c37dc1788488a108
Instruction ID: 55def066a7309a3ddbcf68f0e3c6b62d897a8635cc98db85a5c7145cedf52e34
Opcode Fuzzy Hash: a13a9eda4d28fd68b33d7d59adca1ba6c21f71c58056cb07c37dc1788488a108
Instruction Fuzzy Hash: 06514C32B0E64D0FD7B8965C98A56B537D2FF9A614B4A01BBD08DC72F6DD19AC428340

Function 00007FFD9BAF0A7A Relevance: .2, Instructions: 240COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731623497.00007FFD9BAF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9baf0000_test.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c03976e393ce2fae028f7c405bce34ced956ed0817c768dc62d0730ec85165b
Instruction ID: 96aed32ef3122b821d6ff90640b49cb2453eaf82f29e143b9a3311528b1aa5f0
Opcode Fuzzy Hash: 7c03976e393ce2fae028f7c405bce34ced956ed0817c768dc62d0730ec85165b
Instruction Fuzzy Hash: 0D512921B0DB0E0BE778AB5C94251B577C2EF99750F0502BFD84DC32E6ED65ED428285

Function 00007FFD9BAFA8B7 Relevance: .2, Instructions: 238COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731623497.00007FFD9BAF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9baf0000_test.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: efd5d92d1569bb4a22456b969a5758b9d542565f8ebe3b381f8efb4a55bc4164
Instruction ID: e83c0364b697d67fbaa2f8476f5fbd9ec38beee8796dd3f444e87aacd7d58bec
Opcode Fuzzy Hash: efd5d92d1569bb4a22456b969a5758b9d542565f8ebe3b381f8efb4a55bc4164
Instruction Fuzzy Hash: 7371B37071D78E8BE774DB58D4996FAB7E1EF94301F11467EC48DC32A2DE34A8428682

Function 00007FFD9BB07049 Relevance: .2, Instructions: 221COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731623497.00007FFD9BAF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9baf0000_test.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0739048dafadc90526b96013c1320ed28ff7f45273893dd1235867727101ed55
Instruction ID: b8e210dd203b7d09c9dc929960ae5fe584ad1b3e08d6e9042f965181b9d414bc
Opcode Fuzzy Hash: 0739048dafadc90526b96013c1320ed28ff7f45273893dd1235867727101ed55
Instruction Fuzzy Hash: 8E612632B09D0E4FEBA8DA5E9464771B3D2FF94314F1541B9D08DC36E9DE29E8428740

Function 00007FFD9BAF4C20 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731623497.00007FFD9BAF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9baf0000_test.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e70c3ed6a5906f7eeaa95f980ffa47ef3d02a122998e7cb31e69345ea81074c
Instruction ID: c548d3f20c8f1a9c7b1725447ba1c995c13d7117a64cff6913f012fbf21ecf70
Opcode Fuzzy Hash: 9e70c3ed6a5906f7eeaa95f980ffa47ef3d02a122998e7cb31e69345ea81074c
Instruction Fuzzy Hash: 4D618D21B1AA0A4FEBB5AB6C84686B07BD1FF54740F1A41B9D459C72B6CFA4FC81C740

Function 00007FFD9BAFF4BA Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731623497.00007FFD9BAF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9baf0000_test.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 648b9bf8505aa5171c7e82829f5e392fe91d0a236e9b4a6b3e4f94b4047edcf8
Instruction ID: f5a9a0dc40cc67ef471cf174ae440d270eda5b2bb54d1783b13bd6447513314e
Opcode Fuzzy Hash: 648b9bf8505aa5171c7e82829f5e392fe91d0a236e9b4a6b3e4f94b4047edcf8
Instruction Fuzzy Hash: D251C53170EB0E4BEBB8EB5890656B577D1FF98354F150579D40EC32A2DE6AED428380

Function 00007FFD9BB0A892 Relevance: .2, Instructions: 212COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731623497.00007FFD9BAF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9baf0000_test.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f45f27fc797d702cb8c13a0261c1fbb6cd7a1e4145f55d6c10071b2333c0dea1
Instruction ID: 07cdf933239e51ada4a5dc677fcae3166cd6aa1a44b4d03ba7724979e0d552aa
Opcode Fuzzy Hash: f45f27fc797d702cb8c13a0261c1fbb6cd7a1e4145f55d6c10071b2333c0dea1
Instruction Fuzzy Hash: 9A510521B0EA8D0FD7A6EBAC98647B97FE0FF45214B0A05FBD08DCB1E7D91898058341

Function 00007FFD9BB03B47 Relevance: .2, Instructions: 209COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731623497.00007FFD9BAF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9baf0000_test.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6c947a8487991162bb078b88601c5158098cc61c1e643354a5418bcaa5795d8
Instruction ID: 651941ca134b217ef1f7311eca4e4f4a411d2a36f00ea037f938771a5d034490
Opcode Fuzzy Hash: d6c947a8487991162bb078b88601c5158098cc61c1e643354a5418bcaa5795d8
Instruction Fuzzy Hash: D1718161A4E7CA4FD7635B7448682647FF0AF53224B0A01FFC4C9CA0E7EA5D5946C322

Function 00007FFD9BAF90A4 Relevance: .2, Instructions: 205COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731623497.00007FFD9BAF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9baf0000_test.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c32b9c5ff67f05fa3ac97b30ddc1ce42fe71d5d67eaa313ad798955c8ac9f17
Instruction ID: 86c37da887f3a0ec1043f7e0c136cda235bf2db75de604f6c85e3bae396c4126
Opcode Fuzzy Hash: 7c32b9c5ff67f05fa3ac97b30ddc1ce42fe71d5d67eaa313ad798955c8ac9f17
Instruction Fuzzy Hash: 1251A571B18A4D4FDBA8EF68C4A5A7577E1FF98300B1101BED44EC32A6DE34E8458741

Function 00007FFD9BAFA6C0 Relevance: .2, Instructions: 200COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731623497.00007FFD9BAF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9baf0000_test.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f0653b89eb686936dec08ab4450bfaf893abbd9f80ecac7cc1c6b4052e45db9
Instruction ID: 2fcd7dc6cff0c557e99dcfecae4b1e2724cf9c9824e4e9613eca412ec0f81ade
Opcode Fuzzy Hash: 5f0653b89eb686936dec08ab4450bfaf893abbd9f80ecac7cc1c6b4052e45db9
Instruction Fuzzy Hash: 8B513471B1EBCE0FE7759B6884692F97FE1EF99240F0501BED489C31A3DD6868028742

Function 00007FFD9B8831FA Relevance: .2, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1728841751.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b880000_test.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c4055e3514dc68dfb3e554ed39ae56360b6da8ea6b02d630b84f1d4ff03cd3fb
Instruction ID: 2a0b87712fb15477b2ccc2b90e47344e7ac8190cdacf2b7d0f9e493cf12cd649
Opcode Fuzzy Hash: c4055e3514dc68dfb3e554ed39ae56360b6da8ea6b02d630b84f1d4ff03cd3fb
Instruction Fuzzy Hash: CF515D71A0EACD5FE756EB7848656E93FE0EF5A350F0900FED089CB1A3DA285806C740

Function 00007FFD9BAF6FC2 Relevance: .2, Instructions: 194COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731623497.00007FFD9BAF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9baf0000_test.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1c18f47324e48c7fd386b768497a8eb358ab304bf1702bfafa8a8e8a5d19838
Instruction ID: 39466d4978cdae828ee3fb51fd39d14d970b645b77d3ce30bd890a12a7789bc3
Opcode Fuzzy Hash: e1c18f47324e48c7fd386b768497a8eb358ab304bf1702bfafa8a8e8a5d19838
Instruction Fuzzy Hash: F651E33170DA4E4FDBA5EB6CC464AA57BE2EF99310B0901F6D04DCB2A6DE24EC06C750

Function 00007FFD9BB00F2D Relevance: .2, Instructions: 183COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731623497.00007FFD9BAF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9baf0000_test.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2301be8ba4dc3511a108c726427d5d7a7e8f7e594b1a8c016c894313a0100d6e
Instruction ID: 385a8604b9080b8431480b2b58fa88de5e5e3925415d66b1a04bd6344be4f0ef
Opcode Fuzzy Hash: 2301be8ba4dc3511a108c726427d5d7a7e8f7e594b1a8c016c894313a0100d6e
Instruction Fuzzy Hash: FA51D471B09A4C8FDB68DF28C465AA9B7E1FF59314B5101EDD08AC72A6DE35EC42CB40

Function 00007FFD9BAF9265 Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731623497.00007FFD9BAF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9baf0000_test.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3bbc2af4c5dc4f368df9c28ef7026be063fd7c13dfcb42052ac17248d6076289
Instruction ID: 8251459a622369bfd7d593ed6040cdd690840ba75bf1f4c4b613da3b1624e4d1
Opcode Fuzzy Hash: 3bbc2af4c5dc4f368df9c28ef7026be063fd7c13dfcb42052ac17248d6076289
Instruction Fuzzy Hash: E0415A62B0EB890FD75C976958659F5BBD0EFA5350F0401BFE08EC31E3DC68A8068342

Function 00007FFD9BAF9410 Relevance: .2, Instructions: 166COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731623497.00007FFD9BAF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9baf0000_test.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11e97b3664e5efe6c8fe63e9f63ba804b23e4ffb5e1d82aa70b61ca0cfa56f73
Instruction ID: e2180e3ba87eec8bc01298e2c6f65f7a4f89a63a9b7fcaf975b6feaa97a560b4
Opcode Fuzzy Hash: 11e97b3664e5efe6c8fe63e9f63ba804b23e4ffb5e1d82aa70b61ca0cfa56f73
Instruction Fuzzy Hash: F641F831B09F0A4BEF74AB5A94586F677D1EF58361F41017AC44EC35A1DD69F9428340

Function 00007FFD9BB09C10 Relevance: .2, Instructions: 166COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731623497.00007FFD9BAF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9baf0000_test.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7340e9ec8423d38379934906896cc559c6dd5d8229e0ab6890a1621f566bb01
Instruction ID: 0daa39054d2ecb7282b3a68f367e4411ca8d569a92110343d0dd5132b2171343
Opcode Fuzzy Hash: b7340e9ec8423d38379934906896cc559c6dd5d8229e0ab6890a1621f566bb01
Instruction Fuzzy Hash: 1241F921F1991E0FEAB8EBAC94756B962C2FF983557111079D40FC32E6DD18BD428381

Function 00007FFD9BAF83BC Relevance: .2, Instructions: 164COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731623497.00007FFD9BAF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9baf0000_test.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86923b755a4d2af0f176473663ad37897edcd6a1a1242b05fa6cfb3f35e4cf0f
Instruction ID: 51664595932c19a9965ea4b6aa0fa6e77692fb10d1d49475f22f8b865a664d81
Opcode Fuzzy Hash: 86923b755a4d2af0f176473663ad37897edcd6a1a1242b05fa6cfb3f35e4cf0f
Instruction Fuzzy Hash: 7B412930F1EB9A4FE369A76848652B97AC1EF89221F4501BFE48EC31E7DD1868428351

Function 00007FFD9BAF82AD Relevance: .2, Instructions: 161COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731623497.00007FFD9BAF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9baf0000_test.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c376ca2c17d970cd0d7154033dde2ddbe42f72925454a6251d44046493515c17
Instruction ID: 8cadd66835d0a6cacd54c1004736c0339b4b23e41db42584475aae1fc55a4534
Opcode Fuzzy Hash: c376ca2c17d970cd0d7154033dde2ddbe42f72925454a6251d44046493515c17
Instruction Fuzzy Hash: C8414D30B1DB498FE3699B2848652757FD0FF89321F05057FE48DC32E2DE28A8428382

Function 00007FFD9BAF8252 Relevance: .2, Instructions: 160COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731623497.00007FFD9BAF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9baf0000_test.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5fe2a176fb868931893a40056aa845d97b29f08c3d60573c49fcd399aa5fd54e
Instruction ID: c93b944634cc9f7d95119c467210de183a99e2fbdb72f801ce2feb9bed0ac87e
Opcode Fuzzy Hash: 5fe2a176fb868931893a40056aa845d97b29f08c3d60573c49fcd399aa5fd54e
Instruction Fuzzy Hash: AA414A31F0EB498FE3699B2858651B97FD1FF89231F46057FE48DC31A6D928A8428342

Function 00007FFD9BB013B0 Relevance: .1, Instructions: 144COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731623497.00007FFD9BAF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9baf0000_test.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c385ef00c1be24132fdd9e13c30d0644b1129bb730e4bf1a405de0590465d3df
Instruction ID: ad6b5fe306dc3b64025a7c8a79f31eac75bb12babcef06b02e32d19e5b914325
Opcode Fuzzy Hash: c385ef00c1be24132fdd9e13c30d0644b1129bb730e4bf1a405de0590465d3df
Instruction Fuzzy Hash: 7D41D131B09B494FEBB0DA68C098B76B7D2FF58308F094679D0CAC36E5D668B981C740

Function 00007FFD9BAF8390 Relevance: .1, Instructions: 141COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731623497.00007FFD9BAF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9baf0000_test.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99f74251822f18185c7ba3c8549703c1d2f84ea7e81c177260c04017e168c3ed
Instruction ID: 9723bc4f9161efab4532654678918744f25a4d60dc310a36a1ee0ce2eff43f7a
Opcode Fuzzy Hash: 99f74251822f18185c7ba3c8549703c1d2f84ea7e81c177260c04017e168c3ed
Instruction Fuzzy Hash: 59313C30F1EB4E8FE36A976848651B97ED0EF46221F56017FE48DC31E6DD5868428351

Function 00007FFD9BAF4A10 Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731623497.00007FFD9BAF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9baf0000_test.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc3aad9862968e3451b14131754323a965ea20392d5d690c4d137188a5b261b3
Instruction ID: cc39065bea4b00bf190b035f2268359996bbbae0b7f4352f7b7ef646e10502d8
Opcode Fuzzy Hash: dc3aad9862968e3451b14131754323a965ea20392d5d690c4d137188a5b261b3
Instruction Fuzzy Hash: 9D31473070EB0E4FE778A7AE9825AB53BC4EF59310B1501BDD44AC31B6ED94FC028285

Function 00007FFD9BAF95C9 Relevance: .1, Instructions: 139COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731623497.00007FFD9BAF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9baf0000_test.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29131a69f3e0336c3a7f322d698ce6664d3044250d5ba1616e4907600b426c01
Instruction ID: b077d7399ebc84809f1358a4b5877540827c443fd942a3bb34110e44f20efff1
Opcode Fuzzy Hash: 29131a69f3e0336c3a7f322d698ce6664d3044250d5ba1616e4907600b426c01
Instruction Fuzzy Hash: D9414F30719B088FDBA4EF1DD495AA2B3E1FF58311B44466DD08AC76A2CA79F985CB40

Function 00007FFD9BAFDA35 Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731623497.00007FFD9BAF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9baf0000_test.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8aa369dee5e620b9dc486ceddc8e8e33bc89eefacfa05d9bb45856ea4cc923e
Instruction ID: 74c3a8ee5de267f14039c126e8f6bd8572a611f9e64b1c51cff1198b7bec7e78
Opcode Fuzzy Hash: c8aa369dee5e620b9dc486ceddc8e8e33bc89eefacfa05d9bb45856ea4cc923e
Instruction Fuzzy Hash: D641FA71B19F4A4FEBB1DB2884619A1BBE1FFA5354B050579D4CAC31A2DB64F9028740

Function 00007FFD9BAF621D Relevance: .1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731623497.00007FFD9BAF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9baf0000_test.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c1453e4d133dd275d66053c9270567b98d56c28c008a266691440bf5660d2f2
Instruction ID: 64c523a1b03094ca07daa947bc9d3edab81fae6099b7a3005d9dec6f05cc30a9
Opcode Fuzzy Hash: 3c1453e4d133dd275d66053c9270567b98d56c28c008a266691440bf5660d2f2
Instruction Fuzzy Hash: 9C311621B0EB4D0FEBA5ABAC94A46B43BD1DFA9351B0501BBD44CC72A3DC559D42C340

Function 00007FFD9BAF6FE0 Relevance: .1, Instructions: 135COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731623497.00007FFD9BAF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9baf0000_test.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 191dfe5b8da63ee4b4ce5024e5bb32affc11831859564687d676baf0279c3f58
Instruction ID: 7c970aaecd0c69587e556fb076008cc89af9e018d925896bbc468df62f54398d
Opcode Fuzzy Hash: 191dfe5b8da63ee4b4ce5024e5bb32affc11831859564687d676baf0279c3f58
Instruction Fuzzy Hash: F031C631709A4D8FCBA4EB1CD498EA577E1EF99310B0901F6E40DCB2A6DE24EC02C791

Function 00007FFD9BAF8A58 Relevance: .1, Instructions: 129COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731623497.00007FFD9BAF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9baf0000_test.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f143c245cc3fb9f29f883c090cee90140789e7e84b4591dd399f3f107d8451f4
Instruction ID: 363d846b8270a746ff3d243728d9a4bc0130bab32b9e110857ec76934513786e
Opcode Fuzzy Hash: f143c245cc3fb9f29f883c090cee90140789e7e84b4591dd399f3f107d8451f4
Instruction Fuzzy Hash: 04311832B19F0A4BEBB1EB5C84619B2B7E1FFA9354F010579D48AC31A1DF65F9028780

Function 00007FFD9BB076F8 Relevance: .1, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731623497.00007FFD9BAF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9baf0000_test.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1e6de946b3ed9506f359f9dbb36bce2f84987dceb080a2bf98f67f5a6f53af6
Instruction ID: 614fccfa984e6941b4a7950b39e7213768d0b7d9852dc7c2df5b213a4ad83c2c
Opcode Fuzzy Hash: e1e6de946b3ed9506f359f9dbb36bce2f84987dceb080a2bf98f67f5a6f53af6
Instruction Fuzzy Hash: 1741F97160EB894FD7B9CB198858AB5B7E1FF99301F09817ED08DC31A2DE246805C791

Function 00007FFD9BAF6EC9 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731623497.00007FFD9BAF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9baf0000_test.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9bdcb3596618e2bdb8c153fbd502380f84393f7e13e7280bfd03e3dcadca3bf
Instruction ID: e20071949fcebe47472fc1247780bb758df6c263450b9b897342b4ab17791d4e
Opcode Fuzzy Hash: a9bdcb3596618e2bdb8c153fbd502380f84393f7e13e7280bfd03e3dcadca3bf
Instruction Fuzzy Hash: 7C31F62270EA4E0FD7A0EB6DD8606E0BBE1EF5531070941F6D48DC71A6DA55ED46C380

Function 00007FFD9BB0CC9A Relevance: .1, Instructions: 122COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731623497.00007FFD9BAF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9baf0000_test.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96a70428abc2a970578a02c3c955f7526df2f249990a40191d46115ec74fbd99
Instruction ID: 4780da940cbe6a507456437d3feaeffdeea8f622acc97f7d0ece7ade18101237
Opcode Fuzzy Hash: 96a70428abc2a970578a02c3c955f7526df2f249990a40191d46115ec74fbd99
Instruction Fuzzy Hash: 2A316060B1DA0A4BEB6DEB5C9065579B3D2FBA8304F11467DE05EC32DADE34E8428681

Function 00007FFD9BAF097D Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731623497.00007FFD9BAF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9baf0000_test.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c30707ae9ce2bbcc6db6d0785ee6dc356c8f0c08fca36d1aa13ec815cf78215
Instruction ID: 23d97c2d91a47884f3d434c1de4983062202f8e27e9eadcf38c4653d22db93e8
Opcode Fuzzy Hash: 0c30707ae9ce2bbcc6db6d0785ee6dc356c8f0c08fca36d1aa13ec815cf78215
Instruction Fuzzy Hash: B7318C30709B4D8FDBA4EF68C094BA57BE1FF59300F4106BAE849C72A2DB64E985C740

Function 00007FFD9BAFD935 Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731623497.00007FFD9BAF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9baf0000_test.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cae8743d6ecf5d45c31b3f0f086a2f08c6dab64c601548c7f9301a7d175c6c5e
Instruction ID: 3508867a32f3cb51c1681cda1a67897bfb36338bb7b1121e283913bd61223ee1
Opcode Fuzzy Hash: cae8743d6ecf5d45c31b3f0f086a2f08c6dab64c601548c7f9301a7d175c6c5e
Instruction Fuzzy Hash: E631F371B1CA890FDB1DAA1C98559F97BE0EB65350F0000AFF49A832D7ED65A8478382

Function 00007FFD9BAFEC30 Relevance: .1, Instructions: 119COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731623497.00007FFD9BAF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9baf0000_test.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: deccddb8bf8346c79c02e9fe7e1bf5b3f90f836c82cb938a0c7d4f25144dc235
Instruction ID: 3eb6a9058d65d828e494911840e6ce44c8eee5681afd3b83e4fbe6367be8eb36
Opcode Fuzzy Hash: deccddb8bf8346c79c02e9fe7e1bf5b3f90f836c82cb938a0c7d4f25144dc235
Instruction Fuzzy Hash: F331C661B0EA4E0BFBA89B5854646B52BC2FF9C701F0540BAE44DC72D7DE65AD428380

Function 00007FFD9BB07178 Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731623497.00007FFD9BAF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9baf0000_test.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8646c67e2c1a32a59ff42de95c9d18055ff9e0850f2a28d6a1cf8bd0b4f2618
Instruction ID: 3000b39692e8849491afea8789ab91d2f86d2831da856b86f5d9e72c4c2cf369
Opcode Fuzzy Hash: b8646c67e2c1a32a59ff42de95c9d18055ff9e0850f2a28d6a1cf8bd0b4f2618
Instruction Fuzzy Hash: 3831C723F0F95B4AF6B442AE58743B4E7D0FF56224F4A01B7E8D9C60E5DD1DA9824241

Function 00007FFD9BAF10BD Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731623497.00007FFD9BAF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9baf0000_test.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f257ae792571f14405f23b6b1ecf1eebd0a2d889606d99e77ed30616d39f4b07
Instruction ID: 1a88d8a06294fbe7bf3035c8be0ed6b71f37905e4174a4050b5f9259b56b0aa3
Opcode Fuzzy Hash: f257ae792571f14405f23b6b1ecf1eebd0a2d889606d99e77ed30616d39f4b07
Instruction Fuzzy Hash: DB31393170AA0E0FD7A0EB6DC864AE57BE1FF9931070941F6D44DC75A6EA55EC82C380

Function 00007FFD9BB09B28 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731623497.00007FFD9BAF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9baf0000_test.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1e347728346201998c10e361bf1c45d1a98ad65eebbb76d223519aee9f4a2d3
Instruction ID: 4b8991d24f90c465a1a39b26aa4a54c5c75d556a87894583079e563fbf4145dd
Opcode Fuzzy Hash: a1e347728346201998c10e361bf1c45d1a98ad65eebbb76d223519aee9f4a2d3
Instruction Fuzzy Hash: 2131AD70719E0E9FDBA4EF9DD095A66B3D0FB68314B1145B9E04EC32A1EA21FC41CB80

Function 00007FFD9BAF71FD Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731623497.00007FFD9BAF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9baf0000_test.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bdc5618ca4b91f551fe710c14e787e0202232d410e09f52c174202d1949c292b
Instruction ID: ee120a5787382dbf196d841bd7f37355629dc47fc7d3aaca5098933851434ff5
Opcode Fuzzy Hash: bdc5618ca4b91f551fe710c14e787e0202232d410e09f52c174202d1949c292b
Instruction Fuzzy Hash: 6621A562B1EA484FEBA89B5C68B56F83BD2EF99714B4501BAF04DC32A3DD555C018300

Function 00007FFD9BB07421 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731623497.00007FFD9BAF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9baf0000_test.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c8e4a8b0ccb16f10997b7d85c31e73fff72bc478c66bdc3073685228ba92375
Instruction ID: 3ca4f8bf08c59720886ed104b26957fab9470b118e7958ab8ef83a0217a6b7ef
Opcode Fuzzy Hash: 1c8e4a8b0ccb16f10997b7d85c31e73fff72bc478c66bdc3073685228ba92375
Instruction Fuzzy Hash: AB213A3170EB8C0FE754A76D985957ABBD1EF99350B0102BFE48DC72B2DD24A9418782

Function 00007FFD9BAF96D3 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731623497.00007FFD9BAF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9baf0000_test.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf0a471e75e031be36cb05d49772511082b12cfdd9d53a5523cc2fbd1666a921
Instruction ID: 83230fbde231e48857afffcb6377cc05c4d99910b9cb8ca4c71055632a84494e
Opcode Fuzzy Hash: cf0a471e75e031be36cb05d49772511082b12cfdd9d53a5523cc2fbd1666a921
Instruction Fuzzy Hash: 60318130709B098FEFA4EF19D495AA1B3E1FF58304B4505A9D44EC76A2CA29FC82CB40

Function 00007FFD9BAF9D99 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731623497.00007FFD9BAF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9baf0000_test.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7864d3614e021665f541b72f1fa6c874d5ca7a8583da821109342ac69979f182
Instruction ID: b0e938ea223d4b06c1d85de6a1b26c73e5a0cc22b1b8070d13ff8d9d82e5044a
Opcode Fuzzy Hash: 7864d3614e021665f541b72f1fa6c874d5ca7a8583da821109342ac69979f182
Instruction Fuzzy Hash: 7221C510B1AB0A0FFBB5979D54A92B56BC3DF98711B1501BBE04CC32A6DD55DD068380

Function 00007FFD9BAF9DB0 Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731623497.00007FFD9BAF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9baf0000_test.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0bde37623fffd4af3c6f3c84b8f166861cb41b6f655a3df486f53a8f08b811e4
Instruction ID: 0bbec7201be847027da431caaf13de1ca35128780da1b5c705b48a7a5dca8c5c
Opcode Fuzzy Hash: 0bde37623fffd4af3c6f3c84b8f166861cb41b6f655a3df486f53a8f08b811e4
Instruction Fuzzy Hash: A5210521B1AA0E0BFAB5979DA4AD7B567C3DFD8752B1501BBE40CC32A5DC59DC4282C0

Function 00007FFD9BB0ACA6 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731623497.00007FFD9BAF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9baf0000_test.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 77486d35c2df297ef4350d9cb8a2eb532d22d288beb79a15b4a9649ed4dd6e3e
Instruction ID: 5e8913bc0014fd55bf9449bcab8fe12fabcd413a7aab10ab78ed14c49e1a3e60
Opcode Fuzzy Hash: 77486d35c2df297ef4350d9cb8a2eb532d22d288beb79a15b4a9649ed4dd6e3e
Instruction Fuzzy Hash: B621F732B0E85D0FEBA9966858703B837D1FF94789F0609BAE49DC32FADE1569018240

Function 00007FFD9BAF9300 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731623497.00007FFD9BAF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9baf0000_test.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb434f43dcbd9be17b293b2816140d373712fb161c05041f3d0e2eb835efff9d
Instruction ID: c4ef1075f8217f4b247bdd2209e8300b8ddbf57817067713e57e6f701eb42bac
Opcode Fuzzy Hash: cb434f43dcbd9be17b293b2816140d373712fb161c05041f3d0e2eb835efff9d
Instruction Fuzzy Hash: 74210631B1CA450FD75CA61DA8659BAB7D1EBE8354F40006EF09EC31D7ED74B8068342

Function 00007FFD9B88AC40 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1728841751.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b880000_test.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b59b3982a651ef9a781c5ad416816f948271be14057d644f29fe53427e653a09
Instruction ID: 0fec736c6f60761522289b778932ef90351fc673ca0a2de6aaf7f70195f0b40d
Opcode Fuzzy Hash: b59b3982a651ef9a781c5ad416816f948271be14057d644f29fe53427e653a09
Instruction Fuzzy Hash: 5131C371B09E4D8FEBA4DB48C8A4AB973A1EF9C310F4501BAD45DD72A2DE34AD418B40

Function 00007FFD9BAF7880 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731623497.00007FFD9BAF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9baf0000_test.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 082924b8e4e66dd312b11802b7bb7441ad43b0e935e377194d8297b0d16f7733
Instruction ID: 790bba2621e65031550c6003a655bebaf71738c8bc8e72b54ae9847588b5c915
Opcode Fuzzy Hash: 082924b8e4e66dd312b11802b7bb7441ad43b0e935e377194d8297b0d16f7733
Instruction Fuzzy Hash: D7210B21B1FB4D0EF7B0A7A868583F6B7C4EB99325F05067BD84DC21A1EE9E59C18341

Function 00007FFD9BAFF2B5 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731623497.00007FFD9BAF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9baf0000_test.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0001d4ef3b4d6f66cad871ea41bc5717ffe8e39e620f91876ab4a81481ea1b64
Instruction ID: 3c0da1ae5c1f9df2d8ad05e045c62efddacee60085e692db88b6f26c21f86868
Opcode Fuzzy Hash: 0001d4ef3b4d6f66cad871ea41bc5717ffe8e39e620f91876ab4a81481ea1b64
Instruction Fuzzy Hash: A8117F31B0D70C4EEB58DA5DA4922F9B7D0EB89324F50113FE58AC3252DA22B9534685

Function 00007FFD9B884665 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1728841751.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b880000_test.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b6be48e97a8c524d6768ec330309bf20bf44deab099c03afe087485a5c38acf
Instruction ID: 812487c8557c401ca1c9f921e1010dc265b04a75474e40e9461dbbc78e07904c
Opcode Fuzzy Hash: 7b6be48e97a8c524d6768ec330309bf20bf44deab099c03afe087485a5c38acf
Instruction Fuzzy Hash: C3318D2190E7C25FE72797748822AA17FA09F47350B1E02EBD0D4CB1F3D96C691AC362

Function 00007FFD9BB03907 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731623497.00007FFD9BAF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9baf0000_test.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03415a5b44708a54f4e73228877ea82fe32db5d43a1273dd94eab7555926aa40
Instruction ID: 7029f2147482efb7008e7a904ec47c6a7b9dd3bd2d0f95604d4128742c860951
Opcode Fuzzy Hash: 03415a5b44708a54f4e73228877ea82fe32db5d43a1273dd94eab7555926aa40
Instruction Fuzzy Hash: 17316B30A09B498FEBB0DB18C059B76B7E2FF59304F054669C0CAC36E6DA68F981C740

Function 00007FFD9BB012B0 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731623497.00007FFD9BAF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9baf0000_test.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f526d30f10187da364e0f49fa82b2b9acedf599ad905bef625c83b7eedadf5f6
Instruction ID: fc5b6b3ea9708ccd0bd806328ca01f88984200c582dca76bb8152323a0d087ef
Opcode Fuzzy Hash: f526d30f10187da364e0f49fa82b2b9acedf599ad905bef625c83b7eedadf5f6
Instruction Fuzzy Hash: 8311F63070D51D4FEB6CDA08C8A977672D1FB91325F20007ED08EC65E9DA25ED838690

Function 00007FFD9BAFE098 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731623497.00007FFD9BAF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9baf0000_test.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a499654e6eead4b2f4dba53123b5952233ee3b7ec80dc6fbe4fa8152ff46901
Instruction ID: bdfd7cd60de29bdc00c1057074e7dc5badcf057ffbdd38e2c59f786dfb633131
Opcode Fuzzy Hash: 1a499654e6eead4b2f4dba53123b5952233ee3b7ec80dc6fbe4fa8152ff46901
Instruction Fuzzy Hash: 6921A43170E74D4FEB65DB68D4605B47BA2EF99310B1A01BAD04DCB2A6CA6AAD42C740

Function 00007FFD9BAFF8FB Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731623497.00007FFD9BAF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9baf0000_test.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d10b002e7353de6589824d4cb678ee79816678d52a0c32bf1c5ea00f4de80ad2
Instruction ID: 095de8e525158c0efae05c5a8e9844c15f38ec807d817590db9d4fcd1960fbe8
Opcode Fuzzy Hash: d10b002e7353de6589824d4cb678ee79816678d52a0c32bf1c5ea00f4de80ad2
Instruction Fuzzy Hash: 4B21733071DA0A8BDB6CEB14D061AB973D2FF99300F5085ADD49E832DBCE35B9068B01

Function 00007FFD9BAF0F31 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731623497.00007FFD9BAF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9baf0000_test.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67ca3463fc00b9e51d4fcd88665e77989bf8459e6b7e042bfbb943460bfaf505
Instruction ID: 8347a5af41a26f6a6dc74048d34254e325365b191266a47fc7a754f3dfdcdb37
Opcode Fuzzy Hash: 67ca3463fc00b9e51d4fcd88665e77989bf8459e6b7e042bfbb943460bfaf505
Instruction Fuzzy Hash: 7D113B61B1DE8B4FD76DDB2844608B07BA1FFA4210B4881BAC04DC3196EE3CA9468381

Function 00007FFD9BAFF97C Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731623497.00007FFD9BAF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9baf0000_test.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f8d91bf6b2d05e3d9acc308e94d1592efcf927bc75192f08dd8224cf7d0623c
Instruction ID: 977ef38dfeeec48e23379852f33834db8de2040606058d214fc5a99f1f38bfe6
Opcode Fuzzy Hash: 8f8d91bf6b2d05e3d9acc308e94d1592efcf927bc75192f08dd8224cf7d0623c
Instruction Fuzzy Hash: 1421513071DB0A4BDB6CEB149461BBA73D1FF99340F4185ADD49E832DACE34A5068B06

Function 00007FFD9BAF93D1 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731623497.00007FFD9BAF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9baf0000_test.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c37cdd2588eb5d8f79d2d339c0a46aa49b50850d81e0733ba202eab9dbabbd69
Instruction ID: 24a5a43d9d220add67afad62abf91a4cd5bd3d63b891647cadb32843d767c371
Opcode Fuzzy Hash: c37cdd2588eb5d8f79d2d339c0a46aa49b50850d81e0733ba202eab9dbabbd69
Instruction Fuzzy Hash: 2311D630A0E78A5FDB66A76584A89F27FE4AF56214B0901FAC049CB1B3D958E545C311

Function 00007FFD9BAF0DF5 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731623497.00007FFD9BAF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9baf0000_test.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b541841501ed5aca4d7b7c4e531724bd3d3dd22f2d2fe8d2d0d182dfa8f61569
Instruction ID: 75fc225509af99a91498e1b642b482e9841d0c51ceac392fba7cba9cfee8c35a
Opcode Fuzzy Hash: b541841501ed5aca4d7b7c4e531724bd3d3dd22f2d2fe8d2d0d182dfa8f61569
Instruction Fuzzy Hash: 8211592170E7890FD3659B7CA8552A07FD2EF99310F0901BED08CC72E3DC5998828391

Function 00007FFD9B888301 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1728841751.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b880000_test.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 28648aada9dca21feab87e2a1b1efe5c83465d3968faa991abb1ed21056332a7
Instruction ID: 4673a32ade1d2cc7de4f4411b5a154728828d7afcbb2e875892c0c556aac91f0
Opcode Fuzzy Hash: 28648aada9dca21feab87e2a1b1efe5c83465d3968faa991abb1ed21056332a7
Instruction Fuzzy Hash: 62116071B1990E8FEBA4EF48D4A0AA573A5FF58340B1605B6D46EC72B2DE34ED018740

Function 00007FFD9BB008E9 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731623497.00007FFD9BAF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9baf0000_test.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f59b19fcb67d308d9af398dc7a260e8404455c4ee34707ccb1b8fda7d6fc136
Instruction ID: 85360c92e29fb378813f169f1b71ee2974a0462c3c41e189dfba802ac77c26f2
Opcode Fuzzy Hash: 4f59b19fcb67d308d9af398dc7a260e8404455c4ee34707ccb1b8fda7d6fc136
Instruction Fuzzy Hash: 5311553271EB888FD7A4DB3C88695627BE1FB9D21070506EBD049C72B7DE24AC05C781

Function 00007FFD9BB04E78 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731623497.00007FFD9BAF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9baf0000_test.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21994c804000d9e10f2eaff8424c4fde600ea323a87b40f78f12e8ea7b955dc4
Instruction ID: 4d28871880dc7ec6aa5831975d8790f6ef90f6cb4b852e2a047174883c3292ce
Opcode Fuzzy Hash: 21994c804000d9e10f2eaff8424c4fde600ea323a87b40f78f12e8ea7b955dc4
Instruction Fuzzy Hash: 1F112E30619A0D8FDFA8EA68C490E72B3E1FB69318B21056DD44AC76D5DA36F942CB40

Function 00007FFD9BAFDC07 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731623497.00007FFD9BAF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9baf0000_test.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b75286d94a956061efbe9778987d53dafe50c5bccae414fd073a841630c4704
Instruction ID: e0f74dbecbd121531305a04c9b3d401604c775947a79d1a3a1ebb0f7b23bb839
Opcode Fuzzy Hash: 4b75286d94a956061efbe9778987d53dafe50c5bccae414fd073a841630c4704
Instruction Fuzzy Hash: 86110632B08B194BDB75DB5990515F7BBE1EFD4322F00063BD58EC21A0DBB5E5468780

Function 00007FFD9B88459F Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1728841751.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b880000_test.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 89ce2cfc2665c593577e96e7156b2d942595feda71c2871429ac69ec96600520
Instruction ID: 63fab92d7b6b5ce21697e55ecfe7c317d1c62bc9c092ba1dfcc6eaed1df460b3
Opcode Fuzzy Hash: 89ce2cfc2665c593577e96e7156b2d942595feda71c2871429ac69ec96600520
Instruction Fuzzy Hash: 8B01D47254E60C1EF72CAA85FC076F97394EB86130F00112FD08E82452E56779638355

Function 00007FFD9B8845E3 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1728841751.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b880000_test.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b35e02ce2a04f60e06d6c67d5b31e0cc7caaedec71f0cfe8d98741559c48c00
Instruction ID: aa0b2e201dac4290e8ced0f50ca981ad9e92ccfa5cac1b630f1955c88fddaca5
Opcode Fuzzy Hash: 6b35e02ce2a04f60e06d6c67d5b31e0cc7caaedec71f0cfe8d98741559c48c00
Instruction Fuzzy Hash: AE01216114E3C82FE61A6765AC278F67F68D987260B05029FE4C9CA063E0556F268362

Function 00007FFD9B88AD3F Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1728841751.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b880000_test.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c07c82699c61039d9cd93bca0a13f91665eba369ccf2e21d40ea5ff812a0edb1
Instruction ID: 780a67df5d5ca91c829eb3245c74f43729f27480ae4f5a11a7a25bcea3e0d415
Opcode Fuzzy Hash: c07c82699c61039d9cd93bca0a13f91665eba369ccf2e21d40ea5ff812a0edb1
Instruction Fuzzy Hash: 7711A962B0DD4E5FEBB4EB4894606A56397EB9C350B164276D46DC72E6DD38FD0103C0

Function 00007FFD9BAF0E69 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731623497.00007FFD9BAF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9baf0000_test.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 95b8b35ed8c85ce9657bb998d1e5756395232210ea7a3cb9ca7f9ca65306b0f6
Instruction ID: d8f7d6a6bdc370c027f89fa891889be7b2622b28018610a4e26793c98873cf04
Opcode Fuzzy Hash: 95b8b35ed8c85ce9657bb998d1e5756395232210ea7a3cb9ca7f9ca65306b0f6
Instruction Fuzzy Hash: A5012D3070EA494FD3A5EBAC84A46B17BD2FFAE20070501BAD04DC72A2DD29EC42C340

Function 00007FFD9B887632 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1728841751.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b880000_test.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7c13b22fe08c08f136de13fbc25541a062f364adc09c5148421aeb078698e6a
Instruction ID: 195e7c3df9b6de6ccd0b4b3b0281f95dcc23076d82e43b88763837d1099e85f8
Opcode Fuzzy Hash: f7c13b22fe08c08f136de13fbc25541a062f364adc09c5148421aeb078698e6a
Instruction Fuzzy Hash: 2B11E670A18A498FCB88EF58C861AA977B2FB9C305F1500ACD45ED7296CA35EC52CF40

Function 00007FFD9BB04400 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731623497.00007FFD9BAF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9baf0000_test.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c35ecd8c92e907007d7515e77667e546abefec0afd8fa30c64b7d392eb33c78
Instruction ID: 682bccc3d76df9e364d0b987f2e3ca7a83cc4864af9c96699d2f8c7b7443bfe9
Opcode Fuzzy Hash: 9c35ecd8c92e907007d7515e77667e546abefec0afd8fa30c64b7d392eb33c78
Instruction Fuzzy Hash: 9AF0A411B0E95E0FEBB495ACB4B42B576C1EF5822574600BAE48DC61E9E859DDC14380

Function 00007FFD9BB01390 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731623497.00007FFD9BAF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9baf0000_test.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84a303c529b1378f5f52e0c3c37c583d1aeb8fca5a8c5a51813ced40abb30111
Instruction ID: fef1d21b0443b93d6d8b7d81542392cd94f381704ea848b4e35569a5d30c2c71
Opcode Fuzzy Hash: 84a303c529b1378f5f52e0c3c37c583d1aeb8fca5a8c5a51813ced40abb30111
Instruction Fuzzy Hash: 6B11A920A1DF9D8DFB7592E89058371A7D07F1A30CF0948BCD4CA526E6CA9DBAC5C741

Function 00007FFD9BAF1D30 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731623497.00007FFD9BAF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9baf0000_test.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d62c59371c4e9a8640f44e832ba79513cf0095c033e136d65adf7673ee37f15
Instruction ID: 2d91423a0fb0d94284b6d4b9b6cf42857e1e3bad7d7c01c6709f3959e21c5fb4
Opcode Fuzzy Hash: 4d62c59371c4e9a8640f44e832ba79513cf0095c033e136d65adf7673ee37f15
Instruction Fuzzy Hash: DFF0A432B19A1D4FEBA4D75CA4952B077D3E7AC255B14407BC40DC32A6DDB6AC838384

Function 00007FFD9BB01065 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731623497.00007FFD9BAF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9baf0000_test.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b98fb780bf3a3d6c5b0d0f41f0691e38f060315a172376062a4ac1f3c41e0f1d
Instruction ID: 321eab1a9f75cb0ed0a60993b39707eca2ce539541428a34cc64f6bda66701c9
Opcode Fuzzy Hash: b98fb780bf3a3d6c5b0d0f41f0691e38f060315a172376062a4ac1f3c41e0f1d
Instruction Fuzzy Hash: 8701D671B1CB188FD3289F1CA4420B973E1FB89220B10567FE08AC3295DA36A8028682

Function 00007FFD9B887301 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1728841751.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b880000_test.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 09f08d9ca9be1004308b2ff8bb17feb06e3238f2119cf1b6d354edce6b417cdc
Instruction ID: e7c1222b79b0a62a7cbefa4a263b83ad3a421250acb85264fc308338e990354c
Opcode Fuzzy Hash: 09f08d9ca9be1004308b2ff8bb17feb06e3238f2119cf1b6d354edce6b417cdc
Instruction Fuzzy Hash: 3B012D32F0D91E8BFB24E780E471AF86355EB49324F560175C45EA71E2DD29BB418681

Function 00007FFD9BB03A81 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731623497.00007FFD9BAF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9baf0000_test.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ab2ab793121fabb77b327f80b56e5c0afcae379ebd858da7b343d60c792d5f4
Instruction ID: 736b57b37ab1028ab626c522a3e6c9b651c1688accb32a4a14a3d063bc774b1a
Opcode Fuzzy Hash: 6ab2ab793121fabb77b327f80b56e5c0afcae379ebd858da7b343d60c792d5f4
Instruction Fuzzy Hash: 72F0D101A4DBEA0DE7B252A924682B96ED0AB16210F4E04EAC8C9C94E6D84DEDC9C341

Function 00007FFD9BB0597A Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731623497.00007FFD9BAF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9baf0000_test.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8bca063b36c2b7b485fc9b35ad7e1edddb7e2810baae4cbc9842ff540aab2930
Instruction ID: b04547b851375b4acb36b84914d8e851a9ad65cb051355941e5896326dd18c1f
Opcode Fuzzy Hash: 8bca063b36c2b7b485fc9b35ad7e1edddb7e2810baae4cbc9842ff540aab2930
Instruction Fuzzy Hash: F5F0A43271CD1A4AE75C9A1CA8616B4B3D1FB81324F4441BAD09E835DADD26E8438285

Function 00007FFD9B88A639 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1728841751.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b880000_test.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6448d10522bcd7b114111dfb4770ac662ba9ccb52c9ea25135015e3d4d84da8
Instruction ID: 669ec409e1f9f2f5ec1de1fb522520ff799de99b4872539b52ea6812b2ce4d9f
Opcode Fuzzy Hash: d6448d10522bcd7b114111dfb4770ac662ba9ccb52c9ea25135015e3d4d84da8
Instruction Fuzzy Hash: 3911C971E0995DCFEFA0EB48C464FA873A1FB59314F0241B5941DD72A5CE78AE818B41

Function 00007FFD9B88B589 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1728841751.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b880000_test.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9923b913bd97d91976e337945fc618de7d248cdad8325fcdd0b52d23a6e5324
Instruction ID: f50605a972e67476729f3b028b3cd37176fe3e93f63f29f73608a79d44c49f69
Opcode Fuzzy Hash: a9923b913bd97d91976e337945fc618de7d248cdad8325fcdd0b52d23a6e5324
Instruction Fuzzy Hash: B2011E21E09D1E8BFBA0E744D465BB82295EF59310F5341B5C46ED72E6CE38BF418781

Function 00007FFD9B888DC9 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1728841751.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b880000_test.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b61d531966842590c43a02e7e582f07fb8cdc83469b47b1677f15c937aaa746e
Instruction ID: 0f9460c24e698324b57b67cfe6c5eb0a024d8dccfea38b3e8df7b530738f700d
Opcode Fuzzy Hash: b61d531966842590c43a02e7e582f07fb8cdc83469b47b1677f15c937aaa746e
Instruction Fuzzy Hash: DD016232F0980A8FE751EB58D4656AC73E5EF19320F5601B6D41DC72A5DE28AD424B80

Function 00007FFD9BB08D29 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731623497.00007FFD9BAF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9baf0000_test.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 514b4f2b63df7a18c43276ead28a02dc75610985486455bc8d139176919bcadd
Instruction ID: 0cb7d2cdfddc167f1c53db8258f35230242a4b0061ba048fd778a809a0900d06
Opcode Fuzzy Hash: 514b4f2b63df7a18c43276ead28a02dc75610985486455bc8d139176919bcadd
Instruction Fuzzy Hash: 1701F73190F7494FD77657A858612B07BA0FF15304F0E02FED488861F2D629AE85C750

Function 00007FFD9BB012E0 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731623497.00007FFD9BAF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9baf0000_test.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb45848036ed8053ea87b0452c811a7462a1c098e660453ecad89b82ee4e63ad
Instruction ID: 07569dd840ae540b69163e1224ad278d98a124f1b856c8dd2ec956a0082c2cfd
Opcode Fuzzy Hash: bb45848036ed8053ea87b0452c811a7462a1c098e660453ecad89b82ee4e63ad
Instruction Fuzzy Hash: 30F03C2071A90E8FDEA4EA6CC46493473D0FB1830876545A8E44DC71F5EA16FC46C700

Function 00007FFD9B8853E5 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1728841751.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b880000_test.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ed65c72d392efffb9fe4ed417a889f8cbea682c944a5afa0b6d36870783c5cb
Instruction ID: 51f1952e8d0b19e51ed48b793ef685bc913e7294d43af033cfa312af92da8d06
Opcode Fuzzy Hash: 5ed65c72d392efffb9fe4ed417a889f8cbea682c944a5afa0b6d36870783c5cb
Instruction Fuzzy Hash: BAF0D1B1B0A94E4BEB689B88D8645FEB7F1FF55311F44053ED016C22A4DA7465468780

Function 00007FFD9B88184B Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1728841751.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b880000_test.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30d6f58c94bc84e3e659d075dc4b4c8e3a8ba96e6ad2b8c0ec40784d9f1e1c31
Instruction ID: ae1755750bf4a01360edd5728d72139ec2335675ba029478ea245a3c84d161ee
Opcode Fuzzy Hash: 30d6f58c94bc84e3e659d075dc4b4c8e3a8ba96e6ad2b8c0ec40784d9f1e1c31
Instruction Fuzzy Hash: CFF08170F0964F8FDB60EBA8D8955BE77E0FF5D351F000A76C029C61A1EE3866418780

Function 00007FFD9B88CCF4 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1728841751.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b880000_test.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 28f863fe3cd7e83b36a8b09a2f493ebe3087a0e0a0930f7ac2398f29e8aebc6d
Instruction ID: a72992780310b74f3174c0edfe066116eb23fbaa8081ddf753f6ed14f9ad084a
Opcode Fuzzy Hash: 28f863fe3cd7e83b36a8b09a2f493ebe3087a0e0a0930f7ac2398f29e8aebc6d
Instruction Fuzzy Hash: 37016230B09D4E4FEFA5FB68846466866A2FF5D300F1100F9941ED72A6DE34ED818700

Function 00007FFD9B8866F1 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1728841751.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b880000_test.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 77d2d941c2c6cfdb39b57ba6476561d6d5e5b532f70af92438a0607e596c1fe0
Instruction ID: 2238b5d8c505eeec5090bfc4684d4a16ff17f333cbe2432bce56ab78e4738260
Opcode Fuzzy Hash: 77d2d941c2c6cfdb39b57ba6476561d6d5e5b532f70af92438a0607e596c1fe0
Instruction Fuzzy Hash: 5001A831A0991D8FEBA4EF08C894AA873B5FF59300F5141E5941DD72A1DE34EE918F80

Function 00007FFD9B88131F Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1728841751.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b880000_test.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a5f6339c103b84f6c505b7a3c7991236f278b10104ef72a17c5899423fbe859
Instruction ID: 5a4119753e76f2040fddacd1601974a8633bf012059d8283d81eb87a0044d268
Opcode Fuzzy Hash: 5a5f6339c103b84f6c505b7a3c7991236f278b10104ef72a17c5899423fbe859
Instruction Fuzzy Hash: 30F0A422B0E84A4BF768A798483566823D2EF9D710F194279D06EC75E2DD2DA9428301

Function 00007FFD9B88CC9A Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1728841751.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b880000_test.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46cab6e5a1a58369fbb7c50d3503f72387ee610c22714cccfac8622c8bc367fd
Instruction ID: 32e16b539503e4392b737930811b475a64651b41bc27c6910584b165210d283d
Opcode Fuzzy Hash: 46cab6e5a1a58369fbb7c50d3503f72387ee610c22714cccfac8622c8bc367fd
Instruction Fuzzy Hash: F0F08620B09D4E4FEFB5FB6884746746692FF5D341F5100B9941ED71E6DD34AE818700

Function 00007FFD9B88A207 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1728841751.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b880000_test.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cada614b5e205cf918d3e79a11e87596e1f51f614afb5f989f162d9439fe43ac
Instruction ID: 2b947af68093e7e2a83d58d11c12777a373e55f7174e0f100a55727d23c2a0d3
Opcode Fuzzy Hash: cada614b5e205cf918d3e79a11e87596e1f51f614afb5f989f162d9439fe43ac
Instruction Fuzzy Hash: 66F01231F0991E8FEB60EB54C4647B83391EB59310F5241B5846DD72E5CE38BE418B81

Function 00007FFD9B884595 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1728841751.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b880000_test.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 28434c97492e3bcdccd27590b729bc120509836e32554b7aec7af26d912ce514
Instruction ID: 40dcbe3ceed5289f7d96f2313ae4247d1f697c6d78c30445039b2a3fa3c0bc43
Opcode Fuzzy Hash: 28434c97492e3bcdccd27590b729bc120509836e32554b7aec7af26d912ce514
Instruction Fuzzy Hash: E6E02B3364E50D1BF628B696FC025F93394EB89270F00003FD05C86452EA2726538341

Function 00007FFD9BB0350A Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731623497.00007FFD9BAF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9baf0000_test.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 625589ae95a8423834fb9716e55aa384bd12548765f4911af0d27d95870116c9
Instruction ID: 2a614ffea64e9a6aa775560701add276e7c9acbde38e9f93f28c6c5871bbd283
Opcode Fuzzy Hash: 625589ae95a8423834fb9716e55aa384bd12548765f4911af0d27d95870116c9
Instruction Fuzzy Hash: B4F0826071E98E5FEF64E6B9C42C9356B80EF2920971905BDD48ED71F2ED06E9468700

Function 00007FFD9BAF8AD3 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731623497.00007FFD9BAF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9baf0000_test.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e466fe67cdd0685c604f4d0c7c6b8c2c7d8abc651d38f7c5087964a9dadd98d0
Instruction ID: d760aad69c6e97208d9fd3430bd64a9f8372d5d50e32ee482b176c7cf199e4d4
Opcode Fuzzy Hash: e466fe67cdd0685c604f4d0c7c6b8c2c7d8abc651d38f7c5087964a9dadd98d0
Instruction Fuzzy Hash: 8EE06831B0E71E0AE674639F20201F91BA2DFDD320B4605B7E40DC22A5CC99AD438385

Function 00007FFD9B889A51 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1728841751.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b880000_test.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a2d00f8153f67f0443fe4733b8a654fa1a3a299589e923dd41c4e13704129be
Instruction ID: fa692af7e1c685cededa57ebbf2a6bb74417c0d01656e48040e54e285055fcd5
Opcode Fuzzy Hash: 0a2d00f8153f67f0443fe4733b8a654fa1a3a299589e923dd41c4e13704129be
Instruction Fuzzy Hash: 2EF03031F0991E8FEF64FB54C464AA83391EB5D310F1241B5946DD72E5DE38BE428B80

Function 00007FFD9BB0B721 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731623497.00007FFD9BAF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9baf0000_test.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e789257bb2a3212246fbbb4eb0aacaceff79300e4bfefd078f5d9ab2060c668
Instruction ID: 85f4cb17d49bbd1bbf68d6be487d951ab2cd1eae8aad6f8fecf5ae4e872b200c
Opcode Fuzzy Hash: 3e789257bb2a3212246fbbb4eb0aacaceff79300e4bfefd078f5d9ab2060c668
Instruction Fuzzy Hash: 72E02602E0EA180FD7B1525815F51B87B90EB5820074600EAD15CC62FBF8089D464381

Function 00007FFD9B889BED Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1728841751.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b880000_test.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c61666798f3c789a385d4c03d58dd8b364705a2bd361f263cf05f051d9df93e
Instruction ID: e6faaef47d0b588f28cec135ea3e4845790a86f716aa960aa01f3a4f6addd7ba
Opcode Fuzzy Hash: 5c61666798f3c789a385d4c03d58dd8b364705a2bd361f263cf05f051d9df93e
Instruction Fuzzy Hash: BCF06D31F0990E8BEB70EB80D4306B82295AF4A310F4601B0D86DD72E2DE3DAF418680

Function 00007FFD9B88A425 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1728841751.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b880000_test.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04ffa85c5303f03f4edc670511cf0432f4945668fc3d8fbb7a8f29e3bf399e17
Instruction ID: 579a5db74bc5a15cf0cb48c157b27480c471bf3b3c6c6ef70f51e9f2ede65179
Opcode Fuzzy Hash: 04ffa85c5303f03f4edc670511cf0432f4945668fc3d8fbb7a8f29e3bf399e17
Instruction Fuzzy Hash: 06F05E21F0D95B8FEB64EB98C471AA423A5EB4A310F4206B5846DC72E2DD7CEA014680

Function 00007FFD9B88D77F Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1728841751.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b880000_test.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5cfa22da2f8ce582ea045d5b6fbce1f15f684f06781bd4eea342fd9c554a9783
Instruction ID: 9f36c3d5978b0560253096ecd142e076460794cae7d29f5c91e427abd1e29cdf
Opcode Fuzzy Hash: 5cfa22da2f8ce582ea045d5b6fbce1f15f684f06781bd4eea342fd9c554a9783
Instruction Fuzzy Hash: 92F0B421A0A95D8FE7A5E754843A6A863A5EF5D310F1201BAC85E971E2CD386E42C740

Function 00007FFD9B88BC81 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1728841751.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b880000_test.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40e14cdf93155aae16c782a0f92db282ac2fa4ec7f2ed0f040eb012a73f001c7
Instruction ID: f52fb40eef683f88314b12b66c7de3a3c916a8b0adc45dde29ede2221b06bb65
Opcode Fuzzy Hash: 40e14cdf93155aae16c782a0f92db282ac2fa4ec7f2ed0f040eb012a73f001c7
Instruction Fuzzy Hash: B8F03031E0D85E8FFB60E744D465BA822A4EF09310F5641B5C41ED71E0DD7CBA814A81

Function 00007FFD9BB0ADC5 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731623497.00007FFD9BAF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9baf0000_test.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e711cea015f130ced8666e51a75caad5ae128d347d0833c5652f5031a4f566d7
Instruction ID: 524c9bb728cf87176baeac7165c1ce387b0a5284da0ec76e4798a84fb3cebfd8
Opcode Fuzzy Hash: e711cea015f130ced8666e51a75caad5ae128d347d0833c5652f5031a4f566d7
Instruction Fuzzy Hash: F6E0203195E91C4FCB54EB995C102E537E5FF48308F010A59E05CC31D5D7755A51C781

Function 00007FFD9B88A9E6 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1728841751.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b880000_test.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 944a6e06bc551a6e9a3b4ca21bbd88564e691a33b4b5410c24cedfb65e9b70b0
Instruction ID: 4372bf05cf0af96eb7eeb2728dccac3e0cd0d64bc210fff36ad9b54df3522a2f
Opcode Fuzzy Hash: 944a6e06bc551a6e9a3b4ca21bbd88564e691a33b4b5410c24cedfb65e9b70b0
Instruction Fuzzy Hash: ECF08231F09A0D8FEB64EB94C4606A43391EB4D310F4241B9D46DC72E2DE38AA41C780

Function 00007FFD9BB0D188 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731623497.00007FFD9BAF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9baf0000_test.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3986a8ad28567b20dcc5fd80f419338881b925ea32710693fa1d2469cd28225a
Instruction ID: 729204e3e95d42968378ac94fe0cfa206b1a0daa020b36ae51f4a4b990bd88f3
Opcode Fuzzy Hash: 3986a8ad28567b20dcc5fd80f419338881b925ea32710693fa1d2469cd28225a
Instruction Fuzzy Hash: 58F0555590D6C90FEB26A7B8003A8B07FD0EF11210B0908FDE8E98B1FBD80C78408382

Function 00007FFD9B888BAB Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1728841751.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b880000_test.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 519a099c15ac1140b6ddb595249ac2a0e62d342ddc3809e5be0f791725760347
Instruction ID: b6eb1153ffa239bb1fb62207978148f853fdb046ccba625eeeab118ab3c0c39c
Opcode Fuzzy Hash: 519a099c15ac1140b6ddb595249ac2a0e62d342ddc3809e5be0f791725760347
Instruction Fuzzy Hash: 96F06230A0995DCFDBA0EB18C494BA923E2EF59310F1600B4941ED7295CE38AE818B41

Function 00007FFD9BAF819A Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731623497.00007FFD9BAF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9baf0000_test.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ac725346217976abafd4fb23af966c76e4a730e0a203a121e05dd4262c266c9
Instruction ID: 5f2e0eabe030e389587ed78e250e79fd250fb625f3a71ed54b8c99619e44d4fc
Opcode Fuzzy Hash: 8ac725346217976abafd4fb23af966c76e4a730e0a203a121e05dd4262c266c9
Instruction Fuzzy Hash: DFD0952375EB1C0FA1A4695C78120B8F3C0F785131700073FC88BC2115DD16754241C5

Function 00007FFD9B886DF7 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1728841751.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b880000_test.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4582b781876e5b3f50eb360b522ef20167aa2e1df07e7838827b68028bb8db04
Instruction ID: 109d67ead51f183d3f42dacf96a316c3022cd41ad9ea4044a309666784567f2e
Opcode Fuzzy Hash: 4582b781876e5b3f50eb360b522ef20167aa2e1df07e7838827b68028bb8db04
Instruction Fuzzy Hash: 75F05A70A0981DCFEFE4EB18C894FA873E2FBA8304F0141E5901DE7265CA34AE818F40

Function 00007FFD9B886DDF Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1728841751.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b880000_test.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f3d1152eccd5e57890f6f8ce89f299147f4efdee072ab1c42c528415602e11c
Instruction ID: 7137eac164a86403d6655df1550f845896a44e0ac47694468982020ca0899b06
Opcode Fuzzy Hash: 5f3d1152eccd5e57890f6f8ce89f299147f4efdee072ab1c42c528415602e11c
Instruction Fuzzy Hash: 6EF0B770E0991D8FDBA4EB54C4647A972A1FF58300F1101F9901EE7291CF39AE81CF40

Function 00007FFD9B88A03B Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1728841751.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b880000_test.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0741b1b3de99e4733abca4c2d7a30760624e6ad9dbef7a62a89fd967a211dd99
Instruction ID: 4d3922902f4972dc860de747692aa713451c781e99dced773f61adb62d3e23bb
Opcode Fuzzy Hash: 0741b1b3de99e4733abca4c2d7a30760624e6ad9dbef7a62a89fd967a211dd99
Instruction Fuzzy Hash: FDF03031F0D85E4FEB64EB44D461AA833A5EB09310F0642B5C41DD32E5DD3CFA414A81

Function 00007FFD9B8855D2 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1728841751.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b880000_test.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c190f063c35f83013e126358fdabd312d184688297c851d08d45efbac3c10705
Instruction ID: e577ac7bdd8037ce4ddc492eb8ca7a2c9f6ebddeacb0841972c8a80ee5f1601c
Opcode Fuzzy Hash: c190f063c35f83013e126358fdabd312d184688297c851d08d45efbac3c10705
Instruction Fuzzy Hash: 6FE06532A0E9894BE766D75484601AA37939F99211B1506B6C05AC71A5DD68A6068740

Function 00007FFD9B88122A Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1728841751.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b880000_test.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 072709828d62ed9c6cd670ed67d863310aaea1616af89461b5e130e370f0178e
Instruction ID: 05ca8f750f843d474c668fcfdc30cafbda69c28dcfb919bcf7da5506518844e8
Opcode Fuzzy Hash: 072709828d62ed9c6cd670ed67d863310aaea1616af89461b5e130e370f0178e
Instruction Fuzzy Hash: 6AF08238E0851F8FE761EB90CC246BE36A0BB5E311F010935C026E62A0DFB963008790

Function 00007FFD9BAF74E0 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731623497.00007FFD9BAF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9baf0000_test.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b9ff12c3c8e33d6ad639960de8275794b8fed0d57b48d82624b20466805c2c3
Instruction ID: d86c944d9b1c2d3436a06e8a92f16d6b13d73106db9045c206e2b41dccead8c2
Opcode Fuzzy Hash: 3b9ff12c3c8e33d6ad639960de8275794b8fed0d57b48d82624b20466805c2c3
Instruction Fuzzy Hash: 6FD0C251F0D51D02F6B447D460602FD3392EF44300F21003CD09D922E2CE686D478680

Function 00007FFD9B88C297 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1728841751.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b880000_test.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd9409668cb4c9c675d5446a749ef6bcddbdee922b645eb659a00d4d2be1ad97
Instruction ID: fdec5af5c08e913036d4a35d5cd3358fce0b6de23276c4b8fd01993d09171930
Opcode Fuzzy Hash: dd9409668cb4c9c675d5446a749ef6bcddbdee922b645eb659a00d4d2be1ad97
Instruction Fuzzy Hash: 70E04871F0965E8FEB50EF44C461AF837959B1A310F0741B1D86DD72E2DE2CEA5186C0

Function 00007FFD9B880E50 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1728841751.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b880000_test.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 534dbc114fa4b7d5f1cc84a5ce05295167d68e0a08cc92dd9f24ffa70a44afb6
Instruction ID: 5f6b52e3046ba76e9cdb78a4b7da73b286b5f03af3b40d93786f0385b6a9aa1e
Opcode Fuzzy Hash: 534dbc114fa4b7d5f1cc84a5ce05295167d68e0a08cc92dd9f24ffa70a44afb6
Instruction Fuzzy Hash: 79D05E346259084BCB18EF39CC4E535B7D1FB9D206F9AC1BA944ED6670CF6598818741

Function 00007FFD9B886D9E Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1728841751.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b880000_test.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e0922813ff7d781823b9085da8305533ff1111b5a742c8334cb004cd399fb5e
Instruction ID: 04ee8dde1c1d0e9eaeb0d0156058d7d46c52ecd52b3d081364a3b828e376e4bb
Opcode Fuzzy Hash: 6e0922813ff7d781823b9085da8305533ff1111b5a742c8334cb004cd399fb5e
Instruction Fuzzy Hash: 8BE07D7090A91D8FDBA4EF64C461A6873A2FF58305F1101F9D45DE7295CF35AE91CB00

Function 00007FFD9B886772 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1728841751.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b880000_test.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ff4692ae93268305bf7245fe8991c3e1ef0f1cf96b47dff018dbeef5030f214
Instruction ID: 1e6a3b9e219a31ade4e02d19be2988f2b94c1203866cabb5ea69eeed95a2e390
Opcode Fuzzy Hash: 0ff4692ae93268305bf7245fe8991c3e1ef0f1cf96b47dff018dbeef5030f214
Instruction Fuzzy Hash: 78E07570E1491D8FDBA4EB08C8A46A872A2FF9C300F0101B9941DE3296CF356E51CB40

Function 00007FFD9B885979 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1728841751.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b880000_test.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8877379e53a051eaadfd5e91d9cd61fa3855e39ea6fc1a9e049b5c2e96da0a0e
Instruction ID: 7987781e4d84ecf040539e04e08f154c4dba0289bfc9ec0e6edb1d1567b1d508
Opcode Fuzzy Hash: 8877379e53a051eaadfd5e91d9cd61fa3855e39ea6fc1a9e049b5c2e96da0a0e
Instruction Fuzzy Hash: 7BE08C21A0E88E8FD2A5EB5888602F927B2AF4D300B5980B4D09D8B1A6CC386913C340

Function 00007FFD9B885391 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1728841751.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b880000_test.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4d5a49066e19f5e24f550a98899b7395da1d4cb85cee727067b1fcb62f57c00
Instruction ID: 4d170b98c32eeac29f6540711d18c2b4b83eb1f8822dce1a43c623d0364e83df
Opcode Fuzzy Hash: b4d5a49066e19f5e24f550a98899b7395da1d4cb85cee727067b1fcb62f57c00
Instruction Fuzzy Hash: 5FE04F34E0561A8BE720DB94C8549EDB3B0FB05311F048A25D42196294DB78A7448BC0

Function 00007FFD9B886B23 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1728841751.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b880000_test.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72b6df3e98773306c904e1603e08ac8134866ba79312b890617a2563726fee0b
Instruction ID: 1ad325b0b8952dbb34a44f1d1a049cfbe4f7f7e7f1ef81c354942b670c9ffa15
Opcode Fuzzy Hash: 72b6df3e98773306c904e1603e08ac8134866ba79312b890617a2563726fee0b
Instruction Fuzzy Hash: 0AD0C933E0E81D8AEB60A7C4B4625F8B351EF49374F450073D92FA71A2DA296A164280

Function 00007FFD9B889632 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1728841751.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b880000_test.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c3a44ce93419d05abece99bdd9be0d281b82038d90cc58196be33cc934ec2b3
Instruction ID: b96314c58b761a64a761113fb160ff6878970e333a0acd3e2af80587566dccdc
Opcode Fuzzy Hash: 1c3a44ce93419d05abece99bdd9be0d281b82038d90cc58196be33cc934ec2b3
Instruction Fuzzy Hash: F7D09E20B09C5D4BDB94FB5884256692292AF9C300F114074985ED7296CE34AE418780

Function 00007FFD9B887478 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1728841751.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b880000_test.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5ece93cf87cefdac067fde5fba9f3d5ce239c5f5732efe146da54ea7c0eab0e
Instruction ID: 133ce7017f820dcfdc63210395d0b9b429ed89132938cf8035619de6d7e788a9
Opcode Fuzzy Hash: f5ece93cf87cefdac067fde5fba9f3d5ce239c5f5732efe146da54ea7c0eab0e
Instruction Fuzzy Hash: 21D04270E1D92D8BE7B0E754D8657A962A6BF08700F5646F5C06EA31A5CA783E808F80

Function 00007FFD9B885921 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1728841751.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b880000_test.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d48b081bf1018c336a0902b2f70943ea1fc477e8d83cc662ead59f12b1ed6b65
Instruction ID: d5dec052ad6ff22fdc8e073583587aa69a956157583239db38d376e57267d11c
Opcode Fuzzy Hash: d48b081bf1018c336a0902b2f70943ea1fc477e8d83cc662ead59f12b1ed6b65
Instruction Fuzzy Hash: 60C00271A09A09CBD668AB5880606A922A1AF5C305B61047CE46E872A6CA39A912D640

Function 00007FFD9B884A19 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1728841751.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b880000_test.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d8f0030dd637fbb9e7222b149d901b7dd924bfaa5623b39cc8f54e49bbba588
Instruction ID: 31a6a388ac50e799ab1e3021cdd34f9a7c0b038c4cc3c5cf619b4593143807bd
Opcode Fuzzy Hash: 2d8f0030dd637fbb9e7222b149d901b7dd924bfaa5623b39cc8f54e49bbba588
Instruction Fuzzy Hash: FFC08C1160D5880FE3A5C36094216282AA28F8A240F2A80BAC449CB1B3D83C6E048302

Function 00007FFD9BB09C78 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731623497.00007FFD9BAF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9baf0000_test.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e51062e9f840ac4a53cc7b6fbdc06b93d4bbd8f72864ac341cca4278becee759
Instruction ID: 242a829ac6259d8d84d00483cbaf490c712b034a8014e51018958c091713d279
Opcode Fuzzy Hash: e51062e9f840ac4a53cc7b6fbdc06b93d4bbd8f72864ac341cca4278becee759
Instruction Fuzzy Hash: 5DB0026190413286D71A7AB9B65D9D467909F0121870886B2D09D4F0CBA96860819645

Function 00007FFD9B889996 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1728841751.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b880000_test.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d79673389de0b7bd501bd69e9a14562aa6d9ef191498ed72ea5e88b98b910e7
Instruction ID: 2e6bf77796a0f3e23c50481e0167b5001f0a911187bfb9f9d2e7ba470fbb1bb5
Opcode Fuzzy Hash: 5d79673389de0b7bd501bd69e9a14562aa6d9ef191498ed72ea5e88b98b910e7
Instruction Fuzzy Hash: 80B09264F0994B8BE320AA80C021BAD21025F4D300F920030D82E532D2CD78794142A1

Non-executed Functions

Function 00007FFD9B881995 Relevance: 2.9, Strings: 2, Instructions: 393COMMON

Download Yara Rule

Strings

(O_^, xrefs: 00007FFD9B881C01
)O_^, xrefs: 00007FFD9B881B01

Memory Dump Source

Source File: 00000000.00000002.1728841751.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b880000_test.jbxd

Similarity

API ID:
String ID: (O_^$)O_^
API String ID: 0-4022962792
Opcode ID: 5e9ec4ce7159bb762f5bffe02ad1eec2955b48ce386915ede6b3502bf214b2ac
Instruction ID: 6fa864c73403f27f617bd197b55bab2243248b834f0df4734bdb4dbfce6c0b9c
Opcode Fuzzy Hash: 5e9ec4ce7159bb762f5bffe02ad1eec2955b48ce386915ede6b3502bf214b2ac
Instruction Fuzzy Hash: DCB1F72BB0C6B68AD306777EB8695D87B50DFC533A70845B7C2D8CE483A914648F83E4

Function 00007FFD9B8825FA Relevance: .2, Instructions: 249COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1728841751.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b880000_test.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d15651e913cb17192b7053c5db36a20969e8c64c36e2aa9f66a9cd9031d50ac
Instruction ID: ce55f5c9b76de197d5a8e897849c13767cbc061f254147ba6c944ad552cfb4e2
Opcode Fuzzy Hash: 6d15651e913cb17192b7053c5db36a20969e8c64c36e2aa9f66a9cd9031d50ac
Instruction Fuzzy Hash: 8551D597B0897545930A76BDB959AFD3700DFC033AB044AB7D3AECE0875C1868CB52E5

Function 00007FFD9B8848A0 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1728841751.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b880000_test.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 529bd23547fead130dda019809e34bc8c116b34c84504bfb284f927c54395042
Instruction ID: 65e8b33b8a37ee3f82473157a44a6556c66df42f074dbad72f903900c823ace7
Opcode Fuzzy Hash: 529bd23547fead130dda019809e34bc8c116b34c84504bfb284f927c54395042
Instruction Fuzzy Hash: 0C11E26150D7894FD3299BB04C6A8B2BFA5DF53210B1A42EED096874A3E95858079392

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report test.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Initial Sample

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Exploits

Compliance

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\test.exe.log

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

Windows Analysis Report
test.exe

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre