Edit tour

Windows Analysis Report
240506-b7lv1sfmcw_pw_infected.zip

Overview

General Information

Sample name:	240506-b7lv1sfmcw_pw_infected.zip
Analysis ID:	1437957
MD5:	eee9a11acff6ca42d6822287bd877855
SHA1:	cfeb4cc3712467d1249ed60756c81241c3d8e42b
SHA256:	cf3b0c8d16a32ef00df66903044dbd4e293d580e4b86de0db6c77b3096fd905f
Infos:

Detection

Xmrig

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for dropped file

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Snort IDS alert for network traffic

Yara detected Xmrig cryptocurrency miner

Changes security center settings (notifications, updates, antivirus, firewall)

Contains functionality to infect the boot sector

Creates files inside the volume driver (system volume information)

Creates files with lurking names (e.g. Crack.exe)

Drops PE files to the user root directory

Drops password protected ZIP file

Found API chain indicative of debugger detection

Found pyInstaller with non standard icon

Found strings related to Crypto-Mining

Machine Learning detection for dropped file

Modifies the windows firewall

Sigma detected: Potentially Suspicious Malware Callback Communication

Uses known network protocols on non-standard ports

Uses netsh to modify the Windows network and firewall settings

Writes many files with high entropy

AV process strings found (often used to terminate AV products)

Abnormal high CPU Usage

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Connects to several IPs in different countries

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to communicate with device drivers

Contains functionality to delete services

Contains functionality to dynamically determine API calls

Contains functionality to enumerate running services

Contains functionality to query CPU information (cpuid)

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality to simulate keystroke presses

Contains functionality to simulate mouse events

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates or modifies windows services

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the user directory

Drops PE files to the windows directory (C:\Windows)

Drops files with a non-matching file extension (content does not match file extension)

Enables debug privileges

Enables security privileges

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

OS version to string mapping found (often used in BOTs)

PE file contains sections with non-standard names

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Suspicious Copy From or To System Directory

Sigma detected: Suspicious Outbound SMTP Connections

Sigma detected: Use Short Name Path in Command Line

Uses FTP

Uses code obfuscation techniques (call, push, ret)

Uses taskkill to terminate processes

Yara signature match

Classification

Process Tree

System is w10x64_ra

rundll32.exe (PID: 5928 cmdline: C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding MD5: EF3179D498793BF4234F708D3BE28633)

svchost.exe (PID: 6004 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 6420 cmdline: C:\Windows\System32\svchost.exe -k NetworkService -p MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

SgrmBroker.exe (PID: 6456 cmdline: C:\Windows\system32\SgrmBroker.exe MD5: 3BA1A18A0DC30A0545E7765CB97D8E63)

svchost.exe (PID: 6500 cmdline: C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

7zG.exe (PID: 6544 cmdline: "C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\" -ad -an -ai#7zMap21038:114:7zEvent22422 MD5: 50F289DF0C19484E970849AAC4E6F977)

svchost.exe (PID: 6640 cmdline: C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 6728 cmdline: C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s wscsvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

MpCmdRun.exe (PID: 7160 cmdline: "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable MD5: B3676839B2EE96983F9ED735CD044159)

conhost.exe (PID: 2088 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

svchost.exe (PID: 6812 cmdline: C:\Windows\system32\svchost.exe -k UnistackSvcGroup MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

7zG.exe (PID: 7060 cmdline: "C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\" -an -ai#7zMap6425:244:7zEvent24752 MD5: 50F289DF0C19484E970849AAC4E6F977)

5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe (PID: 7156 cmdline: "C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe" MD5: A9D4007C9419A6E8D55805B8F8F52DE0)

5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe (PID: 4896 cmdline: "C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe" MD5: A9D4007C9419A6E8D55805B8F8F52DE0)

5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe (PID: 5948 cmdline: "C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe" MD5: A9D4007C9419A6E8D55805B8F8F52DE0)

5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe (PID: 6216 cmdline: "C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe" MD5: A9D4007C9419A6E8D55805B8F8F52DE0)

cmd.exe (PID: 2652 cmdline: C:\Windows\system32\cmd.exe /c copy /y C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe C:\Users\user\HelpPane.exe MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 3688 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 5152 cmdline: C:\Windows\system32\cmd.exe /c C:\Users\user\HelpPane.exe --startup auto install MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 6400 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

HelpPane.exe (PID: 6476 cmdline: C:\Users\user\HelpPane.exe --startup auto install MD5: A9D4007C9419A6E8D55805B8F8F52DE0)

HelpPane.exe (PID: 1288 cmdline: C:\Users\user\HelpPane.exe --startup auto install MD5: A9D4007C9419A6E8D55805B8F8F52DE0)

cmd.exe (PID: 6256 cmdline: C:\Windows\system32\cmd.exe /c C:\Users\user\HelpPane.exe start MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 6232 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

HelpPane.exe (PID: 1360 cmdline: C:\Users\user\HelpPane.exe start MD5: A9D4007C9419A6E8D55805B8F8F52DE0)

HelpPane.exe (PID: 2792 cmdline: C:\Users\user\HelpPane.exe start MD5: A9D4007C9419A6E8D55805B8F8F52DE0)

HelpPane.exe (PID: 2920 cmdline: "C:\Users\user\HelpPane.exe" MD5: A9D4007C9419A6E8D55805B8F8F52DE0)

HelpPane.exe (PID: 6996 cmdline: "C:\Users\user\HelpPane.exe" MD5: A9D4007C9419A6E8D55805B8F8F52DE0)

cmd.exe (PID: 5408 cmdline: C:\Windows\system32\cmd.exe /c taskkill /pid 2284 /f MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 1788 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 6976 cmdline: taskkill /pid 2284 /f MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

cmd.exe (PID: 364 cmdline: C:\Windows\system32\cmd.exe /c copy /y C:\Windows\TEMP\_MEI29~1\xmrig.exe C:\Windows\TEMP\xmrig.exe MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 5208 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 2184 cmdline: C:\Windows\system32\cmd.exe /c copy /y C:\Windows\TEMP\_MEI29~1\config.json C:\Windows\TEMP\config.json MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 1272 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

xmrig.exe (PID: 3528 cmdline: C:\Windows\TEMP\xmrig.exe MD5: 13BDD9CD9F7E51746172996262B5A873)

conhost.exe (PID: 5968 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

netsh.exe (PID: 3668 cmdline: netsh firewall add allowedprogram C:\Users\user\HelpPane.exe "MyApp" ENABLE MD5: 4E89A1A088BE715D6C946E55AB07C7DF)

conhost.exe (PID: 1752 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

spoolsv.exe (PID: 2272 cmdline: C:\Windows\System32\spoolsv.exe MD5: 0D4B1E3E4488E9BDC035F23E1F4FE22F)

svchost.exe (PID: 6944 cmdline: C:\Windows\system32\svchost.exe -k SDRSVC MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
xmrig	According to PCrisk, XMRIG is a completely legitimate open-source application that utilizes system CPUs to mine Monero cryptocurrency. Unfortunately, criminals generate revenue by infiltrating this app into systems without users' consent. This deceptive marketing method is called "bundling".In most cases, "bundling" is used to infiltrate several potentially unwanted programs (PUAs) at once. So, there is a high probability that XMRIG Virus came with a number of adware-type applications that deliver intrusive ads and gather sensitive information.	No Attribution	https://gridinsoft.com/xmrig https://www.crowdstrike.com/blog/new-kiss-a-dog-cryptojacking-campaign-targets-docker-and-kubernetes/	https://malpedia.caad.fkie.fraunhofer.de/details/win.xmrig

Yara Signatures

Dropped Files

Source	Rule	Description	Author
C:\Users\user\AppData\Local\Temp\_MEI13602\config.json	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
C:\Windows\Temp\config.json	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
C:\Users\user\AppData\Local\Temp\_MEI64762\config.json	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
C:\Users\user\AppData\Local\Temp\_MEI59482\config.json	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
C:\Users\user\AppData\Local\Temp\_MEI71562\config.json	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
C:\Windows\Temp\_MEI29202\xmrig.exe	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
C:\Users\user\AppData\Local\Temp\_MEI64762\xmrig.exe	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
C:\Windows\Temp\_MEI29202\config.json	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
C:\Windows\Temp\xmrig.exe	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
C:\Users\user\AppData\Local\Temp\_MEI59482\xmrig.exe	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
C:\Users\user\AppData\Local\Temp\_MEI13602\xmrig.exe	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
C:\Users\user\AppData\Local\Temp\_MEI71562\xmrig.exe	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
Click to see the 7 entries

Memory Dumps

Source	Rule	Description	Author
0000002A.00000002.2400305234.00000000009B5000.00000004.00000001.01000000.0000004C.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000027.00000002.1640981815.00000000007E0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
0000002A.00000002.2400932598.0000000000DA3000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
0000002A.00000002.2402253163.00000000018D2000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000027.00000002.1641380904.0000000000D1C000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
0000002A.00000002.2400932598.0000000000D78000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
0000002A.00000000.1679670841.00000000009B0000.00000008.00000001.01000000.0000004C.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
0000002A.00000002.2400626776.0000000000D40000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000025.00000003.1637912498.00000000034D5000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000010.00000003.1535330452.000000000264D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
0000002A.00000002.2360410503.0000000000401000.00000040.00000001.01000000.0000004C.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
Process Memory Space: cmd.exe PID: 364	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
Process Memory Space: cmd.exe PID: 2184	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
Process Memory Space: xmrig.exe PID: 3528	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
Click to see the 9 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
42.0.xmrig.exe.400000.0.unpack	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
42.2.xmrig.exe.400000.0.unpack	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
42.2.xmrig.exe.400000.0.unpack	MAL_XMR_Miner_May19_1	Detects Monero Crypto Coin Miner	Florian Roth	0x45ab34:$x1: donate.ssl.xmrig.com 0x45ae41:$x2: * COMMANDS 'h' hashrate, 'p' pause, 'r' resume 0x45a203:$s1: [%s] login error code: %d 0x4c5e72:$s2: \\?\pipe\uv\%p-%lu

Sigma Signatures

System Summary

Sigma detected: Potentially Suspicious Malware Callback Communication

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 109.252.191.150, DestinationIsIpv6: false, DestinationPort: 1817, EventID: 3, Image: C:\Users\user\HelpPane.exe, Initiated: true, ProcessId: 6996, Protocol: tcp, SourceIp: 192.168.2.16, SourceIsIpv6: false, SourcePort: 1434

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 113.225.115.233, DestinationIsIpv6: false, DestinationPort: 8080, EventID: 3, Image: C:\Users\user\HelpPane.exe, Initiated: true, ProcessId: 6996, Protocol: tcp, SourceIp: 192.168.2.16, SourceIsIpv6: false, SourcePort: 1434

Sigma detected: Suspicious Copy From or To System Directory

Source: Process started

Author: Florian Roth (Nextron Systems), Markus Neis, Tim Shelton (HAWK.IO), Nasreddine Bencherchali (Nextron Systems): Data: Command: C:\Windows\system32\cmd.exe /c copy /y C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe C:\Users\user\HelpPane.exe, CommandLine: C:\Windows\system32\cmd.exe /c copy /y C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe C:\Users\user\HelpPane.exe, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: "C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe" , ParentImage: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, ParentProcessId: 6216, ParentProcessName: 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, ProcessCommandLine: C:\Windows\system32\cmd.exe /c copy /y C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe C:\Users\user\HelpPane.exe, ProcessId: 2652, ProcessName: cmd.exe

Sigma detected: Suspicious Outbound SMTP Connections

Source: Network Connection

Author: frack113: Data: DestinationIp: 177.74.143.153, DestinationIsIpv6: false, DestinationPort: 2525, EventID: 3, Image: C:\Users\user\HelpPane.exe, Initiated: true, ProcessId: 6996, Protocol: tcp, SourceIp: 192.168.2.16, SourceIsIpv6: false, SourcePort: 1434

Sigma detected: Use Short Name Path in Command Line

Source: Process started

Author: frack113, Nasreddine Bencherchali: Data: Command: C:\Windows\system32\cmd.exe /c copy /y C:\Windows\TEMP\_MEI29~1\xmrig.exe C:\Windows\TEMP\xmrig.exe, CommandLine: C:\Windows\system32\cmd.exe /c copy /y C:\Windows\TEMP\_MEI29~1\xmrig.exe C:\Windows\TEMP\xmrig.exe, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: "C:\Users\user\HelpPane.exe", ParentImage: C:\Users\user\HelpPane.exe, ParentProcessId: 6996, ParentProcessName: HelpPane.exe, ProcessCommandLine: C:\Windows\system32\cmd.exe /c copy /y C:\Windows\TEMP\_MEI29~1\xmrig.exe C:\Windows\TEMP\xmrig.exe, ProcessId: 364, ProcessName: cmd.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 656, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 6004, ProcessName: svchost.exe

Snort Signatures

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 1.10.212.38 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:23.890466
SID:	2030919
Source Port:	43604
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.217.85.121 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:22.758413
SID:	2030919
Source Port:	53858
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.204.205.131 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:43.037490
SID:	2030919
Source Port:	8082
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 123.8.93.1 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:23.312873
SID:	2030919
Source Port:	6881
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 42.224.87.163 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:17.222998
SID:	2030919
Source Port:	37497
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 112.248.100.78 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:27.051441
SID:	2030919
Source Port:	19401
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.197.169.210 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:41.979061
SID:	2030919
Source Port:	3252
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.212.164.12 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:39.664318
SID:	2030919
Source Port:	5353
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 42.224.170.152 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:23.722876
SID:	2030919
Source Port:	5353
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 115.62.186.177 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:58.734196
SID:	2030919
Source Port:	6881
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 219.156.175.192 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:24.517474
SID:	2030919
Source Port:	8000
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 112.248.190.167 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:26.082451
SID:	2030919
Source Port:	16433
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 59.93.28.51 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:05.526822
SID:	2030919
Source Port:	59147
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.72.69.83 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:37.561960
SID:	2030919
Source Port:	9510
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.194.209.234 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:42.912869
SID:	2030919
Source Port:	11211
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 113.24.186.62 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:39.364107
SID:	2030919
Source Port:	8000
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.252.202.181 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:38.292433
SID:	2030919
Source Port:	30301
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 222.141.89.244 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:45.115501
SID:	2030919
Source Port:	7229
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 42.230.188.102 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:49.217050
SID:	2030919
Source Port:	63554
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 103.40.255.245 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:56.540641
SID:	2030919
Source Port:	8080
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.205.56.122 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:48.795582
SID:	2030919
Source Port:	8080
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 170.78.39.82 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:15.423154
SID:	2030919
Source Port:	9972
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 182.127.71.174 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:13.676375
SID:	2030919
Source Port:	7780
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.254.179.77 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:40.429126
SID:	2030919
Source Port:	18473
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 39.90.147.149 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:50.695381
SID:	2030919
Source Port:	1027
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 42.178.83.32 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:07.352648
SID:	2030919
Source Port:	43369
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 182.126.92.41 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:14.103500
SID:	2030919
Source Port:	6881
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 219.157.138.77 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:35.143470
SID:	2030919
Source Port:	30193
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.221.96.240 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:17.317388
SID:	2030919
Source Port:	18616
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 115.56.178.247 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:26.472988
SID:	2030919
Source Port:	8080
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 27.158.93.188 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:25.146716
SID:	2030919
Source Port:	13315
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 59.95.132.231 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:24.093824
SID:	2030919
Source Port:	14765
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.204.195.86 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:58.322114
SID:	2030919
Source Port:	5060
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 115.55.242.43 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:53.884664
SID:	2030919
Source Port:	39737
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.204.200.35 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:59.891277
SID:	2030919
Source Port:	11211
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 217.213.110.165 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:49.808892
SID:	2030919
Source Port:	57501
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 219.156.34.215 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:20.560829
SID:	2030919
Source Port:	8080
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 120.85.113.160 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:29.930438
SID:	2030919
Source Port:	5273
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 115.55.76.81 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:56.619276
SID:	2030919
Source Port:	4000
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.201.8.111 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:02.254192
SID:	2030919
Source Port:	58482
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.206.137.150 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:35.369017
SID:	2030919
Source Port:	44526
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 49.77.71.39 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:59.818847
SID:	2030919
Source Port:	53643
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.216.25.204 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:16.725621
SID:	2030919
Source Port:	28920
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 59.89.1.74 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:15.854008
SID:	2030919
Source Port:	52467
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.248.49.85 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:41.898262
SID:	2030919
Source Port:	45434
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.255.205.50 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:39.113990
SID:	2030919
Source Port:	8083
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.204.205.162 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:09.482488
SID:	2030919
Source Port:	8082
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 95.169.197.246 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:05.598980
SID:	2030919
Source Port:	11211
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 123.10.147.38 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:52.056447
SID:	2030919
Source Port:	5353
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 222.140.171.151 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:19.879979
SID:	2030919
Source Port:	3109
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 61.53.41.246 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:50.706600
SID:	2030919
Source Port:	54421
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 61.52.37.166 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:10.642894
SID:	2030919
Source Port:	4210
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 62.56.245.49 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:24.074974
SID:	2030919
Source Port:	25193
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 123.129.135.175 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:14.499362
SID:	2030919
Source Port:	11256
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 123.12.234.222 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:20.182312
SID:	2030919
Source Port:	21902
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.204.56.33 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:09.819419
SID:	2030919
Source Port:	8083
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.204.195.7 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:04.882384
SID:	2030919
Source Port:	15023
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 60.254.81.36 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:23.967044
SID:	2030919
Source Port:	8080
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 42.227.237.218 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:02.666955
SID:	2030919
Source Port:	57791
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.72.76.39 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:55.846726
SID:	2030919
Source Port:	13472
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 123.14.113.70 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:04.188891
SID:	2030919
Source Port:	36160
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 116.75.250.171 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:59.968315
SID:	2030919
Source Port:	22762
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.141.162.151 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:55.570692
SID:	2030919
Source Port:	5060
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 27.6.26.116 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:50.746937
SID:	2030919
Source Port:	54158
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.206.187.119 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:43.042167
SID:	2030919
Source Port:	6881
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 222.137.180.67 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:59.799227
SID:	2030919
Source Port:	61642
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.207.66.108 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:23.465528
SID:	2030919
Source Port:	48594
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 124.95.13.142 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:46.558119
SID:	2030919
Source Port:	8000
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 120.85.183.182 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:45.132689
SID:	2030919
Source Port:	5752
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.194.209.48 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:57.550764
SID:	2030919
Source Port:	1434
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.192.123.197 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:40.572346
SID:	2030919
Source Port:	30301
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.204.197.17 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:58.308730
SID:	2030919
Source Port:	5353
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 59.180.163.124 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:38.598696
SID:	2030919
Source Port:	8181
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 42.227.164.44 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:58.250594
SID:	2030919
Source Port:	45784
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 59.99.130.59 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:02.247890
SID:	2030919
Source Port:	8000
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 113.230.233.35 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:12.320643
SID:	2030919
Source Port:	26138
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.141.68.155 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:05.928671
SID:	2030919
Source Port:	8080
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.72.81.231 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:55.775098
SID:	2030919
Source Port:	7459
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.217.33.24 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:31.967075
SID:	2030919
Source Port:	18836
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 112.83.1.68 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:09.380403
SID:	2030919
Source Port:	3442
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.204.196.32 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:49.669285
SID:	2030919
Source Port:	8081
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 123.191.91.8 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:50.719881
SID:	2030919
Source Port:	1027
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 59.92.217.4 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:38.578383
SID:	2030919
Source Port:	8860
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.204.192.49 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:58.797948
SID:	2030919
Source Port:	30301
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 42.239.252.68 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:50.219686
SID:	2030919
Source Port:	7398
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 120.57.86.47 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:03.542894
SID:	2030919
Source Port:	6881
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.72.75.52 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:44.250266
SID:	2030919
Source Port:	14339
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.220.149.48 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:38.871410
SID:	2030919
Source Port:	8082
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 115.63.32.132 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:40.705562
SID:	2030919
Source Port:	4000
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 222.140.185.244 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:51.001249
SID:	2030919
Source Port:	63604
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 123.129.129.158 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:26.754890
SID:	2030919
Source Port:	6881
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 42.235.46.80 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:12.020972
SID:	2030919
Source Port:	5060
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 59.184.79.224 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:58.911013
SID:	2030919
Source Port:	53166
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 182.117.30.233 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:58.313874
SID:	2030919
Source Port:	19307
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 5.188.64.229 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:34.237893
SID:	2030919
Source Port:	5353
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 119.116.155.73 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:54.676544
SID:	2030919
Source Port:	62968
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 219.157.52.237 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:27.548781
SID:	2030919
Source Port:	38422
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 59.93.24.172 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:09.014188
SID:	2030919
Source Port:	1027
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.204.204.228 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:48.556459
SID:	2030919
Source Port:	24245
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 42.235.103.107 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:15.442352
SID:	2030919
Source Port:	58783
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 115.58.55.170 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:07.758960
SID:	2030919
Source Port:	8082
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 42.224.181.131 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:13.636395
SID:	2030919
Source Port:	34601
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 222.141.120.99 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:14.253396
SID:	2030919
Source Port:	40306
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 222.138.22.175 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:14.259530
SID:	2030919
Source Port:	1027
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.72.69.34 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:16.733802
SID:	2030919
Source Port:	10539
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 115.61.52.125 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:17.404237
SID:	2030919
Source Port:	51721
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 59.93.21.219 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:23.467698
SID:	2030919
Source Port:	1027
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 59.180.184.123 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:46.329417
SID:	2030919
Source Port:	57641
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 59.182.146.210 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:12.627800
SID:	2030919
Source Port:	58321
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 59.93.186.37 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:16.012903
SID:	2030919
Source Port:	5353
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.222.253.19 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:24.091293
SID:	2030919
Source Port:	59275
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 1.10.212.35 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:22.764947
SID:	2030919
Source Port:	30485
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 59.95.130.130 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:24.418356
SID:	2030919
Source Port:	8000
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 175.174.51.163 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:59.011307
SID:	2030919
Source Port:	62553
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 222.138.127.237 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:07.348851
SID:	2030919
Source Port:	22671
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.204.193.173 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:44.088614
SID:	2030919
Source Port:	30301
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.204.196.119 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:24.127952
SID:	2030919
Source Port:	4140
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.194.209.35 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:08.027266
SID:	2030919
Source Port:	11285
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.217.34.1 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:20.468445
SID:	2030919
Source Port:	27377
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 120.56.13.44 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:47.358277
SID:	2030919
Source Port:	36627
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 116.138.176.173 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:43.994622
SID:	2030919
Source Port:	4908
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 42.230.39.63 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:19.883895
SID:	2030919
Source Port:	11907
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 175.178.238.26 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:47.327722
SID:	2030919
Source Port:	8080
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.204.195.199 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:15.673370
SID:	2030919
Source Port:	8419
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 123.173.4.179 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:15.918995
SID:	2030919
Source Port:	30301
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 112.248.172.90 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:49.492556
SID:	2030919
Source Port:	19307
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.206.186.245 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:53.337770
SID:	2030919
Source Port:	10629
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 42.226.71.95 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:00.972567
SID:	2030919
Source Port:	29452
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 112.252.255.116 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:46.573162
SID:	2030919
Source Port:	5125
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 182.121.11.249 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:45.249250
SID:	2030919
Source Port:	5060
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.254.182.105 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:10.958306
SID:	2030919
Source Port:	8083
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 119.179.236.7 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:09.847559
SID:	2030919
Source Port:	46505
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 42.53.180.95 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:00.618455
SID:	2030919
Source Port:	9332
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 190.109.227.211 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:11.897995
SID:	2030919
Source Port:	31173
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 120.85.114.24 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:16.852178
SID:	2030919
Source Port:	22953
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 113.236.105.239 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:23.966461
SID:	2030919
Source Port:	6881
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 120.85.117.215 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:14.734169
SID:	2030919
Source Port:	9101
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 42.86.169.112 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:50.783214
SID:	2030919
Source Port:	44386
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.50.73.154 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:20.938721
SID:	2030919
Source Port:	6881
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 113.236.254.106 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:47.421959
SID:	2030919
Source Port:	27244
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 175.173.94.100 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:37.370332
SID:	2030919
Source Port:	22502
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.204.205.192 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:01.278773
SID:	2030919
Source Port:	55619
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.204.200.160 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:39.098096
SID:	2030919
Source Port:	8080
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 1.10.212.34 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:24.369595
SID:	2030919
Source Port:	41848
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.141.133.78 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:03.562225
SID:	2030919
Source Port:	39039
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.255.92.28 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:14.207285
SID:	2030919
Source Port:	40771
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.141.51.159 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:16.102625
SID:	2030919
Source Port:	12878
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 182.117.29.5 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:45.869843
SID:	2030919
Source Port:	44426
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 123.11.13.9 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:38.654409
SID:	2030919
Source Port:	38385
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 115.55.247.124 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:38.426578
SID:	2030919
Source Port:	7039
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 106.3.130.252 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:57.396215
SID:	2030919
Source Port:	16147
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 115.55.6.157 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:06.800008
SID:	2030919
Source Port:	65505
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 59.88.177.223 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:35.983597
SID:	2030919
Source Port:	16913
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 182.124.109.55 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:08.023576
SID:	2030919
Source Port:	54274
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 112.231.118.128 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:36.190081
SID:	2030919
Source Port:	30301
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.200.185.252 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:12.371894
SID:	2030919
Source Port:	55318
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.245.219.24 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:19.024744
SID:	2030919
Source Port:	11211
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.200.89.104 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:22.055976
SID:	2030919
Source Port:	62187
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 119.109.211.76 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:09.191306
SID:	2030919
Source Port:	11211
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.141.136.230 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:38.523049
SID:	2030919
Source Port:	4727
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 27.7.214.11 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:54.869906
SID:	2030919
Source Port:	8000
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.196.38.47 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:16.323616
SID:	2030919
Source Port:	42676
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 59.180.182.110 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:36.983075
SID:	2030919
Source Port:	1027
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 59.178.213.250 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:24.329017
SID:	2030919
Source Port:	52265
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.252.193.49 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:37.441923
SID:	2030919
Source Port:	6881
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.63.114.20 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:52.867547
SID:	2030919
Source Port:	34281
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 182.124.41.78 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:29.164332
SID:	2030919
Source Port:	55750
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 182.117.108.148 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:25.962131
SID:	2030919
Source Port:	5060
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 59.93.129.236 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:55.674553
SID:	2030919
Source Port:	55547
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 148.66.134.158 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:59.831795
SID:	2030919
Source Port:	5060
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 120.85.91.225 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:50.064172
SID:	2030919
Source Port:	2815
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.252.192.228 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:38.543062
SID:	2030919
Source Port:	23918
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 42.52.67.36 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:39.594542
SID:	2030919
Source Port:	4000
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.248.60.28 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:28.572264
SID:	2030919
Source Port:	2452
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.204.205.213 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:22.408993
SID:	2030919
Source Port:	46833
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 42.234.216.63 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:51.241802
SID:	2030919
Source Port:	17852
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 39.77.34.71 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:50.969820
SID:	2030919
Source Port:	47106
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.72.69.50 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:36.327073
SID:	2030919
Source Port:	17414
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 221.15.195.14 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:08.865149
SID:	2030919
Source Port:	4736
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 1.10.215.156 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:35.320646
SID:	2030919
Source Port:	1900
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 123.5.144.22 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:39.586353
SID:	2030919
Source Port:	8081
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 120.85.113.130 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:48.591035
SID:	2030919
Source Port:	12364
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 221.230.38.202 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:52.728200
SID:	2030919
Source Port:	5353
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.72.76.147 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:34.869888
SID:	2030919
Source Port:	18567
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.204.193.72 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:34.189005
SID:	2030919
Source Port:	8082
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.72.71.211 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:35.205580
SID:	2030919
Source Port:	7664
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 110.181.71.253 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:48.643535
SID:	2030919
Source Port:	4000
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 115.56.149.177 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:59.258391
SID:	2030919
Source Port:	45931
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 61.0.11.32 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:49.707404
SID:	2030919
Source Port:	5353
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 113.168.89.195 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:47.697262
SID:	2030919
Source Port:	8000
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 1.10.212.34 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:24.005245
SID:	2030919
Source Port:	36524
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 182.121.152.137 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:45.730155
SID:	2030919
Source Port:	4000
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 1.70.87.160 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:04.190762
SID:	2030919
Source Port:	6881
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 1.10.212.35 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:21.368498
SID:	2030919
Source Port:	53619
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 186.148.245.119 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:55.372920
SID:	2030919
Source Port:	36130
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 91.143.171.160 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:57.501751
SID:	2030919
Source Port:	4864
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.204.207.155 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:13.893100
SID:	2030919
Source Port:	4950
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.141.177.171 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:35.469666
SID:	2030919
Source Port:	46426
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.220.145.85 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:22.161515
SID:	2030919
Source Port:	6003
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 1.10.212.34 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:24.921914
SID:	2030919
Source Port:	28803
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.204.196.236 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:34.105037
SID:	2030919
Source Port:	17542
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.200.187.201 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:22.928195
SID:	2030919
Source Port:	30301
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 219.156.26.209 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:27.999824
SID:	2030919
Source Port:	8083
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 119.189.215.205 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:59.898497
SID:	2030919
Source Port:	15465
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 89.130.132.127 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:06.072557
SID:	2030919
Source Port:	8800
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 219.155.187.101 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:13.211344
SID:	2030919
Source Port:	19758
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.72.69.169 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:41.299596
SID:	2030919
Source Port:	16677
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 119.117.247.228 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:54.884638
SID:	2030919
Source Port:	42309
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 61.3.88.141 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:17.069793
SID:	2030919
Source Port:	6913
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 72.70.180.247 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:01.378658
SID:	2030919
Source Port:	56838
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 125.44.218.201 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:44.096449
SID:	2030919
Source Port:	13185
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.220.146.21 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:30.840655
SID:	2030919
Source Port:	6881
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 59.95.219.225 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:52.867067
SID:	2030919
Source Port:	61491
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.217.37.25 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:47.414718
SID:	2030919
Source Port:	8082
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 27.206.82.4 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:21.368411
SID:	2030919
Source Port:	47897
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 39.79.135.49 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:47.596843
SID:	2030919
Source Port:	8083
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 120.85.91.247 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:17.357467
SID:	2030919
Source Port:	8033
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.204.195.113 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:35.703761
SID:	2030919
Source Port:	53738
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 119.163.161.191 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:43.361397
SID:	2030919
Source Port:	56641
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 61.3.91.209 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:10.081372
SID:	2030919
Source Port:	30301
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 125.25.183.174 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:09.570372
SID:	2030919
Source Port:	8083
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 1.10.212.33 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:54.734730
SID:	2030919
Source Port:	10829
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 115.57.57.44 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:37.362522
SID:	2030919
Source Port:	8080
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.248.46.29 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:32.977435
SID:	2030919
Source Port:	5060
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 59.93.23.182 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:21.718990
SID:	2030919
Source Port:	8082
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 219.155.211.123 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:12.404872
SID:	2030919
Source Port:	6881
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.222.252.36 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:11.632852
SID:	2030919
Source Port:	27728
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.217.50.113 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:06.920983
SID:	2030919
Source Port:	55596
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.242.236.163 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:21.716355
SID:	2030919
Source Port:	8083
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 121.61.147.248 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:52.750264
SID:	2030919
Source Port:	8083
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 113.238.13.15 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:24.243462
SID:	2030919
Source Port:	47564
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 88.147.174.83 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:55.545294
SID:	2030919
Source Port:	9729
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 112.248.138.4 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:04.593318
SID:	2030919
Source Port:	38532
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 61.53.93.185 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:47.342243
SID:	2030919
Source Port:	45329
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.217.51.50 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:46.603460
SID:	2030919
Source Port:	6881
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 59.93.182.5 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:35.991106
SID:	2030919
Source Port:	64693
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 219.157.64.104 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:03.566148
SID:	2030919
Source Port:	8082
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.72.88.14 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:05.529437
SID:	2030919
Source Port:	15400
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 59.89.3.215 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:24.101567
SID:	2030919
Source Port:	56018
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.248.48.13 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:44.132773
SID:	2030919
Source Port:	53575
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.204.193.59 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:09.131657
SID:	2030919
Source Port:	59358
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.201.10.81 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:59.104411
SID:	2030919
Source Port:	1895
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.72.68.245 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:33.141770
SID:	2030919
Source Port:	5494
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 59.96.165.120 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:11.415799
SID:	2030919
Source Port:	7791
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 182.124.11.228 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:07.720884
SID:	2030919
Source Port:	62191
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 42.237.49.201 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:36.038909
SID:	2030919
Source Port:	37178
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 120.85.91.116 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:05.437334
SID:	2030919
Source Port:	1249
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 125.41.0.47 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:43.006975
SID:	2030919
Source Port:	30203
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 1.10.212.35 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:21.258853
SID:	2030919
Source Port:	7511
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 59.182.156.229 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:01.468758
SID:	2030919
Source Port:	17706
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 24.53.139.167 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:23.480791
SID:	2030919
Source Port:	46874
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 123.8.50.74 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:14.351626
SID:	2030919
Source Port:	8081
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 160.153.235.195 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:00.563004
SID:	2030919
Source Port:	23451
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 14.121.147.25 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:14.226435
SID:	2030919
Source Port:	43931
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 182.117.40.222 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:04.729686
SID:	2030919
Source Port:	46461
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 112.237.110.189 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:20.462914
SID:	2030919
Source Port:	24036
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 59.93.129.243 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:30.225986
SID:	2030919
Source Port:	1027
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 118.79.217.192 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:23.727423
SID:	2030919
Source Port:	11211
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.141.227.103 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:23.734591
SID:	2030919
Source Port:	5060
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.200.89.8 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:40.928810
SID:	2030919
Source Port:	6881
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 81.68.153.169 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:30.686166
SID:	2030919
Source Port:	16054
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.72.75.15 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:41.367187
SID:	2030919
Source Port:	6674
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 112.239.102.15 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:17.772466
SID:	2030919
Source Port:	32922
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 59.93.30.163 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:49.665838
SID:	2030919
Source Port:	30301
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.216.31.32 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:23.976436
SID:	2030919
Source Port:	4000
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 115.49.1.0 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:48.119821
SID:	2030919
Source Port:	6990
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 123.12.183.139 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:22.976093
SID:	2030919
Source Port:	46505
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.204.195.167 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:33.245239
SID:	2030919
Source Port:	40542
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.214.98.23 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:23.677427
SID:	2030919
Source Port:	2064
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.216.64.111 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:39.905843
SID:	2030919
Source Port:	49006
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.204.203.59 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:57.495626
SID:	2030919
Source Port:	32658
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 1.10.211.124 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:38.230031
SID:	2030919
Source Port:	5060
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 219.157.164.3 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:16.163978
SID:	2030919
Source Port:	5353
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 120.61.29.87 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:24.298457
SID:	2030919
Source Port:	8083
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.204.207.227 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:49.179091
SID:	2030919
Source Port:	46849
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.235.52.188 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:55.754806
SID:	2030919
Source Port:	41500
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 121.225.81.102 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:56.548841
SID:	2030919
Source Port:	13457
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 59.93.183.200 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:59.952500
SID:	2030919
Source Port:	4137
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 1.10.212.35 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:07.437899
SID:	2030919
Source Port:	26751
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 119.179.253.22 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:13.287414
SID:	2030919
Source Port:	41654
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.209.8.221 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:50.789118
SID:	2030919
Source Port:	38219
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 59.182.121.221 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:02.975339
SID:	2030919
Source Port:	13468
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 115.58.151.170 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:51.215544
SID:	2030919
Source Port:	4000
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 120.85.119.134 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:45.148138
SID:	2030919
Source Port:	20433
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.72.77.243 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:34.363024
SID:	2030919
Source Port:	1574
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 120.86.254.175 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:14.217410
SID:	2030919
Source Port:	11127
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 182.121.84.2 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:56.581106
SID:	2030919
Source Port:	20185
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 58.178.116.82 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:11.042655
SID:	2030919
Source Port:	15073
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 222.134.173.166 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:21.283578
SID:	2030919
Source Port:	5060
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 59.180.163.252 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:41.873370
SID:	2030919
Source Port:	4000
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 119.185.170.18 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:22.093652
SID:	2030919
Source Port:	63104
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 1.10.212.36 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:24.263967
SID:	2030919
Source Port:	22732
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 124.235.243.85 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:15.905491
SID:	2030919
Source Port:	30301
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 182.124.40.132 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:39.601800
SID:	2030919
Source Port:	60648
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.242.239.113 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:24.038361
SID:	2030919
Source Port:	42578
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 113.228.133.250 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:14.349574
SID:	2030919
Source Port:	57674
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 121.31.133.142 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:02.560839
SID:	2030919
Source Port:	36310
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 123.129.134.22 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:38.131744
SID:	2030919
Source Port:	42083
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 125.41.186.241 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:43.913337
SID:	2030919
Source Port:	8080
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.204.199.23 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:49.664109
SID:	2030919
Source Port:	8959
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 1.10.212.35 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:23.592620
SID:	2030919
Source Port:	15070
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 95.32.130.44 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:10.883499
SID:	2030919
Source Port:	1302
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 59.88.188.147 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:02.386353
SID:	2030919
Source Port:	46287
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.199.77.97 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:56.513352
SID:	2030919
Source Port:	8083
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.72.88.89 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:20.204238
SID:	2030919
Source Port:	18441
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 40.133.224.20 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:14.380665
SID:	2030919
Source Port:	41073
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 120.85.112.235 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:19.926204
SID:	2030919
Source Port:	23278
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 125.41.215.118 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:10.067316
SID:	2030919
Source Port:	40901
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.204.205.132 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:15.676466
SID:	2030919
Source Port:	60556
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 121.239.56.243 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:54.611950
SID:	2030919
Source Port:	12290
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 221.15.48.45 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:15.087034
SID:	2030919
Source Port:	8000
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 59.89.67.135 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:02.374716
SID:	2030919
Source Port:	8081
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 1.10.212.36 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:19.809368
SID:	2030919
Source Port:	32931
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.253.209.123 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:12.853516
SID:	2030919
Source Port:	39964
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 120.85.92.237 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:41.803692
SID:	2030919
Source Port:	8927
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.216.24.112 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:09.006515
SID:	2030919
Source Port:	63393
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 42.227.201.198 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:24.570492
SID:	2030919
Source Port:	8000
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.248.60.176 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:03.190332
SID:	2030919
Source Port:	62281
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 60.23.233.227 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:54.651965
SID:	2030919
Source Port:	57362
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 115.58.81.120 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:57.297964
SID:	2030919
Source Port:	8083
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 219.157.178.183 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:15.026362
SID:	2030919
Source Port:	28409
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.72.70.34 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:59.856127
SID:	2030919
Source Port:	21818
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 115.56.181.247 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:51.269027
SID:	2030919
Source Port:	62465
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 210.22.177.142 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:55.588961
SID:	2030919
Source Port:	56572
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.72.69.188 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:23.602444
SID:	2030919
Source Port:	4097
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 42.233.215.68 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:13.241006
SID:	2030919
Source Port:	20651
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 182.120.49.23 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:12.270279
SID:	2030919
Source Port:	25265
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 42.229.252.77 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:54.945061
SID:	2030919
Source Port:	33796
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 59.92.190.128 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:40.862098
SID:	2030919
Source Port:	8080
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 59.89.6.169 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:38.347776
SID:	2030919
Source Port:	4000
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 222.141.122.93 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:53.208250
SID:	2030919
Source Port:	41451
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 59.93.181.91 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:11.861629
SID:	2030919
Source Port:	12729
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 61.3.178.191 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:09.476037
SID:	2030919
Source Port:	52367
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 115.48.47.113 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:47.339588
SID:	2030919
Source Port:	29452
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 59.184.51.207 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:49.670047
SID:	2030919
Source Port:	1027
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.72.81.26 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:05.472530
SID:	2030919
Source Port:	10251
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.50.73.202 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:09.512932
SID:	2030919
Source Port:	32763
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.72.75.89 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:38.607333
SID:	2030919
Source Port:	13453
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 221.14.63.43 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:10.568308
SID:	2030919
Source Port:	43441
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 186.148.245.61 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:09.585875
SID:	2030919
Source Port:	1434
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 123.12.14.51 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:17.529815
SID:	2030919
Source Port:	7246
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 42.229.137.3 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:23.880595
SID:	2030919
Source Port:	3356
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 219.156.35.200 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:19.126809
SID:	2030919
Source Port:	5060
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.204.200.151 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:22.439623
SID:	2030919
Source Port:	4000
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 59.93.182.53 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:24.125495
SID:	2030919
Source Port:	4000
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.72.71.230 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:23.373784
SID:	2030919
Source Port:	2356
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.241.110.40 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:16.507208
SID:	2030919
Source Port:	46488
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.204.197.182 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:21.982090
SID:	2030919
Source Port:	8081
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 27.158.92.99 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:59.203632
SID:	2030919
Source Port:	25605
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.204.198.82 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:03.611174
SID:	2030919
Source Port:	43763
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.204.207.97 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:51.339721
SID:	2030919
Source Port:	8081
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.204.207.60 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:54.482365
SID:	2030919
Source Port:	1027
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.197.24.81 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:51.469527
SID:	2030919
Source Port:	63208
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.205.143.103 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:38.624532
SID:	2030919
Source Port:	6881
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 27.215.45.174 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:24.508559
SID:	2030919
Source Port:	40246
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 222.138.201.95 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:17.166306
SID:	2030919
Source Port:	8081
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 112.229.214.51 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:25.786703
SID:	2030919
Source Port:	26162
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.194.215.155 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:54.743483
SID:	2030919
Source Port:	50348
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 61.52.83.122 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:10.052074
SID:	2030919
Source Port:	4909
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 119.115.240.145 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:20.927317
SID:	2030919
Source Port:	8083
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 120.85.113.6 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:21.143980
SID:	2030919
Source Port:	18568
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.201.7.203 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:02.249860
SID:	2030919
Source Port:	15551
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 182.121.207.64 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:42.916072
SID:	2030919
Source Port:	50494
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 47.76.76.152 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:14.239834
SID:	2030919
Source Port:	8081
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.248.22.80 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:47.507432
SID:	2030919
Source Port:	5353
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 45.119.84.144 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:19.752662
SID:	2030919
Source Port:	5060
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 59.184.54.156 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:41.917341
SID:	2030919
Source Port:	6881
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 27.215.47.70 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:15.041266
SID:	2030919
Source Port:	10420
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 120.61.23.226 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:12.574743
SID:	2030919
Source Port:	55510
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.217.63.12 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:51.868166
SID:	2030919
Source Port:	5353
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 59.99.130.139 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:59.902365
SID:	2030919
Source Port:	4203
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.235.148.106 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:52.909259
SID:	2030919
Source Port:	8082
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 120.85.112.45 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:16.391423
SID:	2030919
Source Port:	16885
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 120.27.131.41 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:18.824417
SID:	2030919
Source Port:	5787
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.72.69.255 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:05.474104
SID:	2030919
Source Port:	6581
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.194.210.197 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:58.308146
SID:	2030919
Source Port:	35307
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.212.18.86 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:50.851210
SID:	2030919
Source Port:	8082
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 27.47.3.23 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:18.723370
SID:	2030919
Source Port:	10588
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.72.68.170 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:15.001164
SID:	2030919
Source Port:	6583
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.206.189.66 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:24.061078
SID:	2030919
Source Port:	62790
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 80.202.217.118 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:10.869456
SID:	2030919
Source Port:	61120
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 175.30.113.242 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:21.522320
SID:	2030919
Source Port:	8000
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.72.77.22 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:16.348443
SID:	2030919
Source Port:	8483
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.201.13.21 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:58.310027
SID:	2030919
Source Port:	62949
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 103.131.60.178 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:14.759892
SID:	2030919
Source Port:	9710
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 59.92.179.251 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:06.854013
SID:	2030919
Source Port:	8083
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.204.206.154 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:23.828289
SID:	2030919
Source Port:	63688
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 59.184.52.84 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:20.349000
SID:	2030919
Source Port:	8083
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 39.90.144.47 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:15.256955
SID:	2030919
Source Port:	44356
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 42.86.156.64 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:13.735835
SID:	2030919
Source Port:	64339
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.215.214.232 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:53.404903
SID:	2030919
Source Port:	59181
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 59.92.42.81 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:38.537709
SID:	2030919
Source Port:	38822
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.206.188.187 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:45.269226
SID:	2030919
Source Port:	8081
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 59.99.139.221 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:30.786053
SID:	2030919
Source Port:	8080
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 123.129.154.98 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:54.778688
SID:	2030919
Source Port:	29009
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 42.239.171.195 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:57.197554
SID:	2030919
Source Port:	17588
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 59.93.188.218 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:41.026036
SID:	2030919
Source Port:	5695
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.207.75.211 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:42.931995
SID:	2030919
Source Port:	8081
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.211.213.60 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:06.534653
SID:	2030919
Source Port:	19320
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 83.97.73.228 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:24.205323
SID:	2030919
Source Port:	30734
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.211.208.253 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:41.876191
SID:	2030919
Source Port:	1027
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 42.235.172.106 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:52.079295
SID:	2030919
Source Port:	1848
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 123.59.105.78 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:55.575695
SID:	2030919
Source Port:	21446
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.72.88.220 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:25.268569
SID:	2030919
Source Port:	1168
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 59.99.143.204 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:24.307076
SID:	2030919
Source Port:	39913
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 110.182.250.177 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:03.607556
SID:	2030919
Source Port:	55599
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 182.243.157.74 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:59.838610
SID:	2030919
Source Port:	6881
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.199.7.99 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:22.919861
SID:	2030919
Source Port:	30301
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 58.47.26.195 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:42.908732
SID:	2030919
Source Port:	30301
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.204.202.127 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:34.104354
SID:	2030919
Source Port:	14219
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 113.221.31.88 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:55.587429
SID:	2030919
Source Port:	8000
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.193.80.25 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:31.858058
SID:	2030919
Source Port:	29605
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.217.83.91 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:11.879944
SID:	2030919
Source Port:	55534
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 186.148.245.178 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:48.471471
SID:	2030919
Source Port:	1905
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 59.93.180.177 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:05.517647
SID:	2030919
Source Port:	8779
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 59.91.188.62 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:43.063823
SID:	2030919
Source Port:	4000
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 61.53.148.24 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:03.961660
SID:	2030919
Source Port:	62593
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 125.45.9.61 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:02.174451
SID:	2030919
Source Port:	8082
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.204.205.154 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:15.051322
SID:	2030919
Source Port:	5144
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 47.107.92.35 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:26.219816
SID:	2030919
Source Port:	8083
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 123.129.129.98 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:28.723243
SID:	2030919
Source Port:	1027
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 115.55.237.202 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:16.104300
SID:	2030919
Source Port:	20300
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.204.196.25 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:35.370835
SID:	2030919
Source Port:	43493
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 119.179.255.119 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:50.095507
SID:	2030919
Source Port:	5060
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 59.92.189.24 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:19.898234
SID:	2030919
Source Port:	2462
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 125.47.102.58 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:28.055836
SID:	2030919
Source Port:	51240
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 1.10.212.38 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:24.380127
SID:	2030919
Source Port:	17521
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 42.57.236.253 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:57.467822
SID:	2030919
Source Port:	51456
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 42.235.166.108 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:25.327800
SID:	2030919
Source Port:	8080
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 115.55.241.78 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:53.431541
SID:	2030919
Source Port:	5353
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.242.192.132 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:23.990277
SID:	2030919
Source Port:	40231
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.211.213.151 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:09.954207
SID:	2030919
Source Port:	9294
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.199.77.72 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:22.443197
SID:	2030919
Source Port:	1027
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 182.112.54.173 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:21.560486
SID:	2030919
Source Port:	29721
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.204.197.93 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:58.304386
SID:	2030919
Source Port:	31290
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.141.154.0 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:52.770279
SID:	2030919
Source Port:	7607
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.199.6.158 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:05.369784
SID:	2030919
Source Port:	8083
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.213.114.81 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:10.423051
SID:	2030919
Source Port:	25966
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 59.96.165.229 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:11.882654
SID:	2030919
Source Port:	6548
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 61.3.89.151 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:08.151739
SID:	2030919
Source Port:	13672
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.141.160.235 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:01.362948
SID:	2030919
Source Port:	47145
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.72.68.90 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:34.384963
SID:	2030919
Source Port:	3496
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 188.150.231.39 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:22.547430
SID:	2030919
Source Port:	9007
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 1.70.169.208 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:40.842275
SID:	2030919
Source Port:	13733
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 27.37.112.79 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:03.561049
SID:	2030919
Source Port:	25843
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 61.3.185.160 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:13.320734
SID:	2030919
Source Port:	43455
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 125.27.181.199 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:24.877004
SID:	2030919
Source Port:	23490
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.202.75.204 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:22.006240
SID:	2030919
Source Port:	8000
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 42.4.109.110 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:39.136328
SID:	2030919
Source Port:	8000
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 42.235.96.85 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:26.160561
SID:	2030919
Source Port:	11256
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 59.89.192.210 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:24.038414
SID:	2030919
Source Port:	27854
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 38.137.0.22 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:35.222859
SID:	2030919
Source Port:	28547
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 27.215.140.205 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:01.656602
SID:	2030919
Source Port:	48112
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.199.9.115 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:08.520896
SID:	2030919
Source Port:	6881
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.252.166.58 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:23.999173
SID:	2030919
Source Port:	8080
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.206.135.24 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:48.001272
SID:	2030919
Source Port:	1812
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 112.239.101.154 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:53.561613
SID:	2030919
Source Port:	59635
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 61.52.134.158 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:37.486874
SID:	2030919
Source Port:	37235
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 221.15.146.215 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:50.967361
SID:	2030919
Source Port:	23326
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 114.218.141.66 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:24.198435
SID:	2030919
Source Port:	47086
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.204.201.17 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:29.806832
SID:	2030919
Source Port:	5060
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.204.192.234 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:34.119772
SID:	2030919
Source Port:	62110
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 190.109.229.181 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:36.486849
SID:	2030919
Source Port:	40772
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 186.148.245.209 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:14.641042
SID:	2030919
Source Port:	14291
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 1.10.147.64 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:35.187018
SID:	2030919
Source Port:	20997
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.235.78.163 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:42.026685
SID:	2030919
Source Port:	8000
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.204.200.193 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:05.515675
SID:	2030919
Source Port:	1027
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 221.15.77.222 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:13.551541
SID:	2030919
Source Port:	40234
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 182.114.228.16 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:51.885986
SID:	2030919
Source Port:	3600
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 125.41.245.135 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:11.799162
SID:	2030919
Source Port:	15328
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 120.85.112.88 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:27.830549
SID:	2030919
Source Port:	27808
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.141.142.251 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:38.530812
SID:	2030919
Source Port:	1900
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 111.70.31.106 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:35.121037
SID:	2030919
Source Port:	4000
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 61.0.9.172 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:36.674675
SID:	2030919
Source Port:	30495
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.204.196.16 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:54.724543
SID:	2030919
Source Port:	30301
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.204.205.182 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:24.299052
SID:	2030919
Source Port:	51405
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 137.175.46.64 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:14.103766
SID:	2030919
Source Port:	6736
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 123.13.53.84 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:20.731520
SID:	2030919
Source Port:	5060
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 42.234.243.115 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:18.045595
SID:	2030919
Source Port:	30784
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.199.77.246 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:20.804238
SID:	2030919
Source Port:	34324
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.242.142.105 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:49.861583
SID:	2030919
Source Port:	3277
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.220.109.13 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:57.569867
SID:	2030919
Source Port:	63412
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.199.79.80 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:04.880708
SID:	2030919
Source Port:	8000
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.204.207.91 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:49.155911
SID:	2030919
Source Port:	8000
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 1.10.212.37 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:23.633285
SID:	2030919
Source Port:	42954
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 115.60.250.85 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:10.451729
SID:	2030919
Source Port:	51040
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 176.193.204.236 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:18.554558
SID:	2030919
Source Port:	5353
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 218.61.110.165 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:11.793097
SID:	2030919
Source Port:	6881
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 115.63.15.46 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:56.578383
SID:	2030919
Source Port:	8081
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 222.246.209.22 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:34.033274
SID:	2030919
Source Port:	5060
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 61.3.83.110 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:00.793680
SID:	2030919
Source Port:	44716
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 1.10.212.36 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:02.829321
SID:	2030919
Source Port:	25450
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.204.199.199 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:36.707324
SID:	2030919
Source Port:	22004
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.220.151.41 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:48.586492
SID:	2030919
Source Port:	24563
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 59.88.216.46 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:04.893432
SID:	2030919
Source Port:	8698
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 182.116.120.31 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:16.545846
SID:	2030919
Source Port:	56641
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.204.193.44 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:31.874478
SID:	2030919
Source Port:	8082
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 59.93.181.224 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:23.255371
SID:	2030919
Source Port:	6485
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 61.1.146.173 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:38.539613
SID:	2030919
Source Port:	8082
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 182.116.12.99 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:10.350891
SID:	2030919
Source Port:	8083
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 61.52.225.131 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:37.337594
SID:	2030919
Source Port:	18566
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 210.10.131.189 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:59.079495
SID:	2030919
Source Port:	2330
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.141.246.164 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:34.072117
SID:	2030919
Source Port:	44911
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.216.247.154 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:22.775914
SID:	2030919
Source Port:	15289
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 59.96.165.172 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:09.969622
SID:	2030919
Source Port:	27477
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 125.45.71.29 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:25.703688
SID:	2030919
Source Port:	15656
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 61.52.55.159 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:55.817366
SID:	2030919
Source Port:	58685
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 115.96.142.129 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:09.948347
SID:	2030919
Source Port:	30301
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 61.53.92.85 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:59.803718
SID:	2030919
Source Port:	24761
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 42.177.198.181 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:23.080594
SID:	2030919
Source Port:	8081
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 59.88.125.203 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:02.382724
SID:	2030919
Source Port:	26378
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 182.96.200.243 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:52.671731
SID:	2030919
Source Port:	25895
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 93.84.86.104 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:14.497355
SID:	2030919
Source Port:	28609
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 112.248.191.194 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:13.430972
SID:	2030919
Source Port:	5060
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 1.10.212.35 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:24.915692
SID:	2030919
Source Port:	3064
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 102.219.60.62 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:24.996582
SID:	2030919
Source Port:	11211
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.252.206.57 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:02.263550
SID:	2030919
Source Port:	8081
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.211.223.31 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:35.396740
SID:	2030919
Source Port:	30600
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.194.169.133 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:48.572689
SID:	2030919
Source Port:	1434
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 120.85.113.138 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:27.661934
SID:	2030919
Source Port:	26072
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.206.177.107 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:23.520399
SID:	2030919
Source Port:	1027
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 42.54.146.165 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:40.680201
SID:	2030919
Source Port:	30907
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 182.126.246.55 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:10.209554
SID:	2030919
Source Port:	24720
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.204.198.192 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:38.526052
SID:	2030919
Source Port:	5353
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 122.155.0.70 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:41.822217
SID:	2030919
Source Port:	10388
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 222.138.79.171 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:09.861414
SID:	2030919
Source Port:	51754
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 112.248.246.123 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:45.124874
SID:	2030919
Source Port:	33981
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 1.10.212.36 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:24.520670
SID:	2030919
Source Port:	8717
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 115.48.148.224 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:15.205485
SID:	2030919
Source Port:	21545
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 175.31.169.95 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:57.448985
SID:	2030919
Source Port:	8081
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 119.179.251.57 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:11.334511
SID:	2030919
Source Port:	4000
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.198.26.118 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:34.108540
SID:	2030919
Source Port:	56757
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 42.224.0.233 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:37.354644
SID:	2030919
Source Port:	60614
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 1.215.138.43 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:46.249655
SID:	2030919
Source Port:	17433
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.216.64.146 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:08.023076
SID:	2030919
Source Port:	65494
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.72.68.44 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:25.188606
SID:	2030919
Source Port:	4221
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 1.10.212.34 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:24.559261
SID:	2030919
Source Port:	43361
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 219.157.58.43 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:40.075477
SID:	2030919
Source Port:	4000
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 59.184.57.0 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:12.824152
SID:	2030919
Source Port:	61227
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 59.93.30.134 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:23.465011
SID:	2030919
Source Port:	8080
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.215.212.67 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:41.867402
SID:	2030919
Source Port:	52384
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 59.89.207.116 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:36.336260
SID:	2030919
Source Port:	41547
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 219.157.136.69 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:24.689121
SID:	2030919
Source Port:	4000
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 125.43.88.225 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:16.736797
SID:	2030919
Source Port:	45784
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 59.99.138.62 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:37.491235
SID:	2030919
Source Port:	11489
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 123.185.49.90 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:49.038289
SID:	2030919
Source Port:	8083
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 222.139.77.245 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:48.754826
SID:	2030919
Source Port:	52002
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 115.60.251.49 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:04.932077
SID:	2030919
Source Port:	42715
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 1.10.212.37 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:25.546941
SID:	2030919
Source Port:	64402
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.141.226.116 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:28.846819
SID:	2030919
Source Port:	45756
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 42.226.73.189 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:41.416806
SID:	2030919
Source Port:	30301
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 59.98.28.250 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:43.714453
SID:	2030919
Source Port:	5353
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 59.89.5.185 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:01.965488
SID:	2030919
Source Port:	36181
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.204.196.54 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:10.917696
SID:	2030919
Source Port:	5060
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 186.148.245.183 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:21.170544
SID:	2030919
Source Port:	25070
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 59.93.18.150 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:45.217871
SID:	2030919
Source Port:	21444
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 81.182.184.141 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:42.897675
SID:	2030919
Source Port:	18235
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 182.59.50.30 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:45.193813
SID:	2030919
Source Port:	17145
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.204.200.89 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:10.517604
SID:	2030919
Source Port:	30301
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.206.180.199 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:23.712096
SID:	2030919
Source Port:	22967
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.201.10.133 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:16.322120
SID:	2030919
Source Port:	8082
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.200.176.213 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:34.350598
SID:	2030919
Source Port:	50235
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.72.78.46 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:52.794510
SID:	2030919
Source Port:	4429
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 42.224.117.97 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:01.947055
SID:	2030919
Source Port:	28162
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 59.98.30.191 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:59.258721
SID:	2030919
Source Port:	9221
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 115.50.26.45 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:48.482212
SID:	2030919
Source Port:	30872
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 59.89.4.237 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:19.613353
SID:	2030919
Source Port:	61544
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.72.70.129 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:36.492848
SID:	2030919
Source Port:	10226
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 124.234.219.207 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:17.074733
SID:	2030919
Source Port:	30301
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.204.207.242 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:49.223058
SID:	2030919
Source Port:	25089
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 119.183.15.96 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:23.590625
SID:	2030919
Source Port:	4000
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 27.157.170.250 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:45.118240
SID:	2030919
Source Port:	13570
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 59.92.202.217 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:13.609117
SID:	2030919
Source Port:	50587
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 61.0.206.146 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:23.999934
SID:	2030919
Source Port:	24364
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 115.51.28.98 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:05.759122
SID:	2030919
Source Port:	4000
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.204.197.108 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:35.550643
SID:	2030919
Source Port:	57356
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.204.198.55 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:24.295541
SID:	2030919
Source Port:	8000
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.248.61.132 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:30.804908
SID:	2030919
Source Port:	30301
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 188.149.142.208 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:20.208233
SID:	2030919
Source Port:	17607
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 219.154.173.51 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:44.266392
SID:	2030919
Source Port:	60648
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.204.203.159 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:58.309376
SID:	2030919
Source Port:	29299
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 1.10.212.34 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:15.350721
SID:	2030919
Source Port:	4631
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 42.236.221.163 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:02.978866
SID:	2030919
Source Port:	41451
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 120.63.221.76 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:38.564083
SID:	2030919
Source Port:	6881
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 182.127.39.107 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:27.388450
SID:	2030919
Source Port:	5353
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 175.174.72.130 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:12.287763
SID:	2030919
Source Port:	50064
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 125.47.226.54 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:14.965881
SID:	2030919
Source Port:	18040
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 39.89.216.141 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:25.534257
SID:	2030919
Source Port:	6881
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 182.60.2.75 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:16.353484
SID:	2030919
Source Port:	1027
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.204.201.41 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:35.198095
SID:	2030919
Source Port:	1434
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 59.93.189.20 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:53.792821
SID:	2030919
Source Port:	25886
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 58.47.104.176 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:48.474328
SID:	2030919
Source Port:	4000
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.72.76.17 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:15.002851
SID:	2030919
Source Port:	5416
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.204.197.94 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:49.661562
SID:	2030919
Source Port:	19426
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 37.255.208.94 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:35.886642
SID:	2030919
Source Port:	7659
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 182.56.169.191 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:39.928216
SID:	2030919
Source Port:	8082
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 120.85.117.166 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:46.261649
SID:	2030919
Source Port:	2547
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.242.236.98 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:38.629683
SID:	2030919
Source Port:	11593
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.215.223.233 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:21.152823
SID:	2030919
Source Port:	8080
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 115.63.188.170 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:25.482660
SID:	2030919
Source Port:	6881
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 115.201.152.228 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:30.666638
SID:	2030919
Source Port:	5353
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 39.73.69.176 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:15.277409
SID:	2030919
Source Port:	8081
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.217.43.183 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:17.623970
SID:	2030919
Source Port:	49456
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.206.142.219 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:47.434337
SID:	2030919
Source Port:	25287
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.248.23.3 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:55.701123
SID:	2030919
Source Port:	30301
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 120.86.254.163 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:06.882312
SID:	2030919
Source Port:	1367
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.205.61.150 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:36.333042
SID:	2030919
Source Port:	4000
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.220.147.13 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:42.333656
SID:	2030919
Source Port:	11753
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 112.242.167.52 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:43.603694
SID:	2030919
Source Port:	65175
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 59.173.71.223 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:24.203579
SID:	2030919
Source Port:	8000
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 120.85.115.216 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:58.254800
SID:	2030919
Source Port:	21216
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 59.93.186.55 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:09.031541
SID:	2030919
Source Port:	8000
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 120.86.254.251 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:06.639101
SID:	2030919
Source Port:	4811
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.141.59.111 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:08.856777
SID:	2030919
Source Port:	8083
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 59.93.180.51 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:24.262427
SID:	2030919
Source Port:	4000
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 87.253.4.0 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:33.145413
SID:	2030919
Source Port:	8000
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.204.206.245 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:45.322695
SID:	2030919
Source Port:	36598
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 115.61.18.2 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:07.485386
SID:	2030919
Source Port:	5060
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 200.111.102.27 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:00.556520
SID:	2030919
Source Port:	1027
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 115.63.48.21 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:08.075299
SID:	2030919
Source Port:	1027
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.207.74.83 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:58.323036
SID:	2030919
Source Port:	46118
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 123.194.35.224 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:50.802898
SID:	2030919
Source Port:	1900
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.202.65.13 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:34.711246
SID:	2030919
Source Port:	4856
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.72.75.250 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:44.292222
SID:	2030919
Source Port:	2530
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 42.53.37.6 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:48.477565
SID:	2030919
Source Port:	30918
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 182.126.86.152 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:19.833678
SID:	2030919
Source Port:	11256
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 59.89.0.87 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:08.618428
SID:	2030919
Source Port:	5060
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.63.241.203 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:23.992174
SID:	2030919
Source Port:	30301
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 59.184.50.233 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:37.447879
SID:	2030919
Source Port:	51774
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.252.203.248 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:07.511145
SID:	2030919
Source Port:	15152
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 120.56.12.238 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:58.799571
SID:	2030919
Source Port:	26763
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 222.140.182.46 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:45.122184
SID:	2030919
Source Port:	6881
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 59.89.70.144 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:22.789538
SID:	2030919
Source Port:	30301
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 42.230.216.234 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:51.814148
SID:	2030919
Source Port:	7452
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.72.81.202 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:53.752598
SID:	2030919
Source Port:	6463
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 182.120.15.189 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:25.521377
SID:	2030919
Source Port:	10615
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.204.195.230 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:41.886382
SID:	2030919
Source Port:	27297
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 59.93.20.87 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:46.339161
SID:	2030919
Source Port:	17999
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.204.204.167 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:11.408179
SID:	2030919
Source Port:	20895
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 115.48.155.200 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:26.656229
SID:	2030919
Source Port:	62491
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 222.137.122.31 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:06.802142
SID:	2030919
Source Port:	7614
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 113.246.16.130 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:49.868530
SID:	2030919
Source Port:	25601
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 188.149.139.44 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:14.297039
SID:	2030919
Source Port:	8082
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 1.10.212.38 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:35.480190
SID:	2030919
Source Port:	8648
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 209.59.113.249 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:12.631552
SID:	2030919
Source Port:	57674
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 59.178.16.198 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:24.145821
SID:	2030919
Source Port:	23589
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 120.61.23.171 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:08.523652
SID:	2030919
Source Port:	55861
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 1.10.212.38 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:13.901134
SID:	2030919
Source Port:	4266
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 61.2.104.221 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:24.334701
SID:	2030919
Source Port:	5353
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 112.248.114.227 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:53.897835
SID:	2030919
Source Port:	5516
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 60.246.138.175 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:18.570523
SID:	2030919
Source Port:	62851
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.208.100.100 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:34.132972
SID:	2030919
Source Port:	4000
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 120.85.114.246 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:54.657409
SID:	2030919
Source Port:	4087
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.243.247.148 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:55.747861
SID:	2030919
Source Port:	1027
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 95.32.210.253 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:20.836362
SID:	2030919
Source Port:	1792
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 123.14.214.241 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:23.990230
SID:	2030919
Source Port:	8000
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 42.86.126.69 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:44.034805
SID:	2030919
Source Port:	46440
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 120.85.183.175 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:07.356889
SID:	2030919
Source Port:	32075
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.217.48.133 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:45.197112
SID:	2030919
Source Port:	1027
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 59.89.67.166 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:22.465497
SID:	2030919
Source Port:	4000
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 42.230.159.161 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:12.429967
SID:	2030919
Source Port:	46505
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 119.185.58.10 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:38.518054
SID:	2030919
Source Port:	48066
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.217.82.79 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:17.920857
SID:	2030919
Source Port:	8082
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 121.227.165.70 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:15.923350
SID:	2030919
Source Port:	38751
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 106.56.48.164 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:49.861144
SID:	2030919
Source Port:	5060
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 59.93.29.166 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:02.581151
SID:	2030919
Source Port:	1027
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.204.206.250 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:42.998033
SID:	2030919
Source Port:	51242
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 59.93.28.1 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:50.116793
SID:	2030919
Source Port:	8080
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 182.120.46.143 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:52.738206
SID:	2030919
Source Port:	30301
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 59.92.44.255 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:32.991547
SID:	2030919
Source Port:	30653
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.253.220.76 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:22.477018
SID:	2030919
Source Port:	11431
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 123.9.198.179 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:11.433396
SID:	2030919
Source Port:	30203
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 1.70.176.235 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:05.171077
SID:	2030919
Source Port:	30372
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 42.225.207.69 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:10.602711
SID:	2030919
Source Port:	1027
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 59.89.206.19 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:32.986466
SID:	2030919
Source Port:	30040
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 113.221.27.96 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:46.305576
SID:	2030919
Source Port:	8080
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 59.92.179.20 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:54.801375
SID:	2030919
Source Port:	20906
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 60.6.211.248 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:14.260713
SID:	2030919
Source Port:	8082
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 175.10.89.226 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:46.377520
SID:	2030919
Source Port:	5499
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 59.92.180.163 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:17.667458
SID:	2030919
Source Port:	1027
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 59.99.133.21 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:01.508542
SID:	2030919
Source Port:	13296
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 42.239.134.227 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:06.534078
SID:	2030919
Source Port:	21817
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 42.234.244.67 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:42.132727
SID:	2030919
Source Port:	54564
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.252.34.202 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:24.314016
SID:	2030919
Source Port:	5060
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 59.89.69.112 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:09.190093
SID:	2030919
Source Port:	52118
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 27.215.82.209 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:45.523911
SID:	2030919
Source Port:	9134
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.252.169.124 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:12.863147
SID:	2030919
Source Port:	38803
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.141.230.54 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:44.135490
SID:	2030919
Source Port:	8081
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.248.63.69 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:11.898775
SID:	2030919
Source Port:	12691
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.141.229.85 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:15.001873
SID:	2030919
Source Port:	5353
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 59.93.181.222 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:17.073824
SID:	2030919
Source Port:	4000
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 1.10.212.37 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:07.124389
SID:	2030919
Source Port:	3060
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.253.221.8 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:23.791630
SID:	2030919
Source Port:	63388
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.204.196.76 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:42.538085
SID:	2030919
Source Port:	54463
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.204.206.98 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:10.914665
SID:	2030919
Source Port:	53901
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 59.89.1.112 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:40.872593
SID:	2030919
Source Port:	23323
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 59.184.54.5 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:39.675000
SID:	2030919
Source Port:	1027
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.204.207.18 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:56.443865
SID:	2030919
Source Port:	20342
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.248.19.154 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:35.501190
SID:	2030919
Source Port:	40576
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 1.10.212.37 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:24.941232
SID:	2030919
Source Port:	40207
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 223.13.63.131 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:30.681410
SID:	2030919
Source Port:	10386
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 123.4.78.94 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:39.238558
SID:	2030919
Source Port:	1027
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.254.62.134 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:05.556530
SID:	2030919
Source Port:	6881
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 42.232.209.229 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:17.028592
SID:	2030919
Source Port:	46999
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.204.202.74 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:46.324423
SID:	2030919
Source Port:	18361
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 59.99.136.56 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:06.181531
SID:	2030919
Source Port:	8081
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 113.239.64.251 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:49.751323
SID:	2030919
Source Port:	6881
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.204.202.141 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:01.534289
SID:	2030919
Source Port:	48928
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.248.55.248 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:59.140440
SID:	2030919
Source Port:	19570
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.204.194.232 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:18.034407
SID:	2030919
Source Port:	5060
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 61.1.145.203 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:49.682049
SID:	2030919
Source Port:	38606
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.204.199.81 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:09.955035
SID:	2030919
Source Port:	5353
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 59.88.185.45 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:56.253633
SID:	2030919
Source Port:	39033
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 113.230.80.68 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:49.699571
SID:	2030919
Source Port:	8080
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 221.1.225.65 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:19.957447
SID:	2030919
Source Port:	55101
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 223.13.61.70 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:57.408764
SID:	2030919
Source Port:	28879
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 112.248.188.197 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:05.797015
SID:	2030919
Source Port:	48388
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 112.239.98.243 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:48.081168
SID:	2030919
Source Port:	1027
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 45.189.207.241 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:22.463056
SID:	2030919
Source Port:	8083
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.219.90.178 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:16.109576
SID:	2030919
Source Port:	44318
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 116.111.31.44 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:05.692922
SID:	2030919
Source Port:	30301
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.200.93.30 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:46.473271
SID:	2030919
Source Port:	48456
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 222.142.251.75 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:37.346619
SID:	2030919
Source Port:	60464
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 115.51.45.104 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:24.577040
SID:	2030919
Source Port:	65505
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.205.63.20 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:22.936330
SID:	2030919
Source Port:	8083
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 27.215.137.232 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:19.109322
SID:	2030919
Source Port:	30203
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 59.89.6.89 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:53.902012
SID:	2030919
Source Port:	52485
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 125.43.243.149 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:08.844678
SID:	2030919
Source Port:	64407
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 182.116.118.157 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:17.600915
SID:	2030919
Source Port:	8000
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.141.37.160 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:09.420684
SID:	2030919
Source Port:	3592
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 59.93.181.149 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:06.201288
SID:	2030919
Source Port:	8081
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.199.79.175 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:16.312307
SID:	2030919
Source Port:	21320
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 115.55.248.136 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:27.582929
SID:	2030919
Source Port:	1027
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.72.81.211 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:17.293884
SID:	2030919
Source Port:	8488
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.255.92.148 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:09.249608
SID:	2030919
Source Port:	20348
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 123.8.67.82 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:16.107676
SID:	2030919
Source Port:	21988
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.212.163.173 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:20.256334
SID:	2030919
Source Port:	20352
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.213.81.219 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:41.896373
SID:	2030919
Source Port:	44609
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 49.234.57.41 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:09.920822
SID:	2030919
Source Port:	21168
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 164.163.25.146 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:59.008816
SID:	2030919
Source Port:	31215
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 59.93.180.61 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:24.137168
SID:	2030919
Source Port:	1027
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.60.101.203 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:46.199235
SID:	2030919
Source Port:	8083
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.199.79.96 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:23.791028
SID:	2030919
Source Port:	6881
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 120.211.222.79 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:24.485160
SID:	2030919
Source Port:	8267
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.253.217.232 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:52.835168
SID:	2030919
Source Port:	8000
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 115.58.85.247 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:41.791189
SID:	2030919
Source Port:	43260
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 42.5.53.19 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:13.242471
SID:	2030919
Source Port:	4000
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 106.112.179.121 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:16.864263
SID:	2030919
Source Port:	41346
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 1.10.212.34 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:09.999371
SID:	2030919
Source Port:	10470
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.141.33.56 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:00.026527
SID:	2030919
Source Port:	5634
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 175.146.231.173 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:40.703649
SID:	2030919
Source Port:	55732
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 182.124.201.173 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:23.263795
SID:	2030919
Source Port:	28409
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 85.215.242.168 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:11.303197
SID:	2030919
Source Port:	6881
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 115.58.155.116 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:43.754248
SID:	2030919
Source Port:	5353
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.248.48.99 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:19.861989
SID:	2030919
Source Port:	30301
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 59.182.146.73 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:24.165021
SID:	2030919
Source Port:	6881
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 123.10.213.191 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:10.407414
SID:	2030919
Source Port:	19307
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 42.177.196.181 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:03.563935
SID:	2030919
Source Port:	64257
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.141.158.194 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:15.252452
SID:	2030919
Source Port:	1434
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 39.81.255.243 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:07.096353
SID:	2030919
Source Port:	11256
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.141.129.252 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:12.036859
SID:	2030919
Source Port:	49521
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 221.15.240.248 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:01.335699
SID:	2030919
Source Port:	28409
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.192.123.219 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:24.208867
SID:	2030919
Source Port:	8000
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 164.163.25.241 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:58.189558
SID:	2030919
Source Port:	8083
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 124.7.139.186 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:16.309163
SID:	2030919
Source Port:	11211
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.252.206.190 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:41.892287
SID:	2030919
Source Port:	59301
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 1.10.212.36 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:28.727772
SID:	2030919
Source Port:	28784
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.199.15.116 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:44.106362
SID:	2030919
Source Port:	48376
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 223.8.217.59 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:56.547295
SID:	2030919
Source Port:	8083
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.216.16.221 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:59.901656
SID:	2030919
Source Port:	8080
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 59.88.183.47 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:04.275411
SID:	2030919
Source Port:	1737
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 42.228.43.79 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:25.138208
SID:	2030919
Source Port:	44255
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.222.254.212 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:48.634816
SID:	2030919
Source Port:	55583
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.206.180.21 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:52.899232
SID:	2030919
Source Port:	11211
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 115.60.18.173 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:06.110909
SID:	2030919
Source Port:	1497
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.217.58.52 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:37.414378
SID:	2030919
Source Port:	8082
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 42.224.29.185 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:44.021767
SID:	2030919
Source Port:	5353
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 42.239.238.196 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:17.288765
SID:	2030919
Source Port:	8083
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 125.43.35.59 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:25.599931
SID:	2030919
Source Port:	21407
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 59.184.76.78 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:56.637450
SID:	2030919
Source Port:	11211
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 59.89.125.248 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:36.385048
SID:	2030919
Source Port:	1027
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 59.184.68.106 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:03.610613
SID:	2030919
Source Port:	8080
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.220.31.184 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:23.618487
SID:	2030919
Source Port:	20957
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 222.127.147.207 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:24.315129
SID:	2030919
Source Port:	123
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 59.89.71.209 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:10.538438
SID:	2030919
Source Port:	8081
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.215.213.211 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:10.494899
SID:	2030919
Source Port:	6881
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 115.56.97.102 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:07.690047
SID:	2030919
Source Port:	45784
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.252.40.22 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:49.671590
SID:	2030919
Source Port:	6881
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 112.239.22.116 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:53.823069
SID:	2030919
Source Port:	45920
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.204.196.255 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:04.879656
SID:	2030919
Source Port:	24853
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 42.235.40.58 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:23.818319
SID:	2030919
Source Port:	58178
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.211.211.241 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:23.654958
SID:	2030919
Source Port:	47625
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 59.93.186.197 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:47.426512
SID:	2030919
Source Port:	6881
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 39.49.26.52 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:26.090394
SID:	2030919
Source Port:	27591
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.204.193.20 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:04.879791
SID:	2030919
Source Port:	59628
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 61.2.81.125 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:12.858435
SID:	2030919
Source Port:	8082
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.204.200.143 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:31.863837
SID:	2030919
Source Port:	6881
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 42.230.219.43 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:05.685459
SID:	2030919
Source Port:	2151
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 120.85.93.151 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:35.299737
SID:	2030919
Source Port:	4830
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 59.89.69.122 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:33.086966
SID:	2030919
Source Port:	34806
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 198.16.58.241 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:06.731806
SID:	2030919
Source Port:	30301
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 115.50.56.115 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:57.466340
SID:	2030919
Source Port:	8082
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 124.131.132.95 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:46.009251
SID:	2030919
Source Port:	23412
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 59.89.204.198 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:23.086510
SID:	2030919
Source Port:	60062
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 59.92.161.26 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:09.193530
SID:	2030919
Source Port:	4000
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 109.108.218.34 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:51.137582
SID:	2030919
Source Port:	1434
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 123.130.186.62 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:40.534682
SID:	2030919
Source Port:	4000
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 221.14.112.172 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:54.668508
SID:	2030919
Source Port:	28409
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.204.199.213 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:36.309502
SID:	2030919
Source Port:	21861
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 123.175.92.230 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:17.858425
SID:	2030919
Source Port:	41705
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.204.202.223 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:47.422652
SID:	2030919
Source Port:	8000
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.204.203.68 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:31.958347
SID:	2030919
Source Port:	8083
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 182.112.40.209 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:49.899942
SID:	2030919
Source Port:	31161
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 123.9.102.125 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:23.962708
SID:	2030919
Source Port:	8080
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.204.200.144 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:50.777678
SID:	2030919
Source Port:	38183
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 39.187.67.68 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:34.932066
SID:	2030919
Source Port:	7429
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 123.8.16.239 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:46.227589
SID:	2030919
Source Port:	5060
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.216.245.142 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:16.810894
SID:	2030919
Source Port:	16728
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 125.25.174.221 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:56.435897
SID:	2030919
Source Port:	30301
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 59.93.181.185 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:19.678826
SID:	2030919
Source Port:	57131
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 27.209.150.45 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:23.368262
SID:	2030919
Source Port:	5060
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 123.5.148.230 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:26.593278
SID:	2030919
Source Port:	5060
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 182.123.194.161 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:22.905231
SID:	2030919
Source Port:	56061
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 175.175.188.249 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:57.554023
SID:	2030919
Source Port:	4375
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.196.45.191 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:12.040044
SID:	2030919
Source Port:	1027
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 120.56.9.158 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:49.357784
SID:	2030919
Source Port:	30301
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 113.26.82.43 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:42.929529
SID:	2030919
Source Port:	11211
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 59.178.92.49 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:14.707304
SID:	2030919
Source Port:	4770
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 120.85.183.32 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:35.294676
SID:	2030919
Source Port:	9489
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 119.179.238.174 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:56.553980
SID:	2030919
Source Port:	60648
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.204.192.67 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:32.959448
SID:	2030919
Source Port:	45334
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.72.71.146 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:20.350427
SID:	2030919
Source Port:	6445
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.252.174.76 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:21.014162
SID:	2030919
Source Port:	1434
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 182.60.4.213 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:04.913404
SID:	2030919
Source Port:	8082
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 123.14.35.111 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:26.776116
SID:	2030919
Source Port:	8082
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 27.215.212.142 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:55.587265
SID:	2030919
Source Port:	1027
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.204.192.110 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:56.647544
SID:	2030919
Source Port:	65459
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.201.11.68 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:35.633617
SID:	2030919
Source Port:	8081
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 113.228.150.105 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:56.656572
SID:	2030919
Source Port:	63764
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 120.57.220.81 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:42:16.704633
SID:	2030919
Source Port:	20654
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.253.214.191 - Destination IP: 192.168.2.16

Timestamp:	05/08/24-08:41:49.317128
SID:	2030919
Source Port:	1900
Destination Port:	1434
Protocol:	UDP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\_MEI13602\xmrig.exe

Avira: detection malicious, Label: PUA/GM.Miner.OW

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\_MEI13602\back.jpg	ReversingLabs: Detection: 70%
Source: C:\Users\user\AppData\Local\Temp\_MEI13602\back.jpg	Virustotal: Detection: 69%			Perma Link

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\_MEI13602\xmrig.exe

Joe Sandbox ML: detected

Bitcoin Miner

Yara detected Xmrig cryptocurrency miner

Source: Yara match	File source: 42.0.xmrig.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 42.2.xmrig.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000002A.00000002.2400305234.00000000009B5000.00000004.00000001.01000000.0000004C.sdmp, type: MEMORY
Source: Yara match	File source: 00000027.00000002.1640981815.00000000007E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002A.00000002.2400932598.0000000000DA3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002A.00000002.2402253163.00000000018D2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000027.00000002.1641380904.0000000000D1C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002A.00000002.2400932598.0000000000D78000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002A.00000000.1679670841.00000000009B0000.00000008.00000001.01000000.0000004C.sdmp, type: MEMORY
Source: Yara match	File source: 0000002A.00000002.2400626776.0000000000D40000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000025.00000003.1637912498.00000000034D5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000003.1535330452.000000000264D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002A.00000002.2360410503.0000000000401000.00000040.00000001.01000000.0000004C.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: cmd.exe PID: 364, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: cmd.exe PID: 2184, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: xmrig.exe PID: 3528, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\_MEI13602\config.json, type: DROPPED
Source: Yara match	File source: C:\Windows\Temp\config.json, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\_MEI64762\config.json, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\_MEI59482\config.json, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\_MEI71562\config.json, type: DROPPED
Source: Yara match	File source: C:\Windows\Temp\_MEI29202\xmrig.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\_MEI64762\xmrig.exe, type: DROPPED
Source: Yara match	File source: C:\Windows\Temp\_MEI29202\config.json, type: DROPPED
Source: Yara match	File source: C:\Windows\Temp\xmrig.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\_MEI59482\xmrig.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\_MEI13602\xmrig.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\_MEI71562\xmrig.exe, type: DROPPED

Found strings related to Crypto-Mining

Source: xmrig.exe, 0000002A.00000002.2360410503.0000000000401000.00000040.00000001.01000000.0000004C.sdmp	String found in binary or memory: stratum+tcp://
Source: cmd.exe, 00000027.00000002.1640981815.00000000007E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: "algo": "cryptonight",
Source: xmrig.exe, 0000002A.00000002.2360410503.0000000000401000.00000040.00000001.01000000.0000004C.sdmp	String found in binary or memory: -o, --url=URL URL of mining server
Source: xmrig.exe, 0000002A.00000002.2360410503.0000000000401000.00000040.00000001.01000000.0000004C.sdmp	String found in binary or memory: stratum+tcp://
Source: xmrig.exe, 0000002A.00000002.2360410503.0000000000401000.00000040.00000001.01000000.0000004C.sdmp	String found in binary or memory: Usage: xmrig [OPTIONS]
Source: cmd.exe, 00000025.00000003.1637912498.00000000034D5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: FileDescriptionXMRig CPU miner.

Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe

File opened: C:\Users\user\AppData\Local\Temp\_MEI71562\msvcr90.dll

Jump to behavior

Source:	Binary string: O:\src\pywin32\build\temp.win32-2.7\Release\_win32sysloader.pdb source: 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000010.00000003.1529000361.0000000000ED1000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001A.00000003.1570649002.0000000002551000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001E.00000003.1604095650.0000000003013000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 00000020.00000003.1618937725.0000000001203000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\build27\cpython\PCBuild\python27.pdb1v source: 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000011.00000002.1566376619.000000006CF51000.00000040.00000001.01000000.00000009.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000015.00000002.1699424273.000000006CC32000.00000040.00000001.01000000.00000016.sdmp, HelpPane.exe, 00000021.00000002.2459301185.000000006C702000.00000040.00000001.01000000.0000003E.sdmp
Source:	Binary string: C:\build27\cpython\PCBuild\_hashlib.pdb% source: 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000011.00000002.1563185803.000000006CCD1000.00000040.00000001.01000000.0000000E.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000015.00000002.1691361963.000000006C889000.00000040.00000001.01000000.0000001B.sdmp, HelpPane.exe, 00000021.00000002.2451643036.000000006C359000.00000040.00000001.01000000.00000043.sdmp
Source:	Binary string: C:\build27\cpython\PCBuild\_ctypes.pdb source: 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000015.00000002.1707382765.0000000073A82000.00000040.00000001.01000000.00000018.sdmp, HelpPane.exe, 00000021.00000002.2466945092.0000000073DE2000.00000040.00000001.01000000.00000040.sdmp
Source:	Binary string: C:\build27\cpython\PCBuild\_hashlib.pdb source: 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000015.00000002.1691361963.000000006C889000.00000040.00000001.01000000.0000001B.sdmp, HelpPane.exe, 00000021.00000002.2451643036.000000006C359000.00000040.00000001.01000000.00000043.sdmp
Source:	Binary string: C:\build27\cpython\PCBuild\_socket.pdb source: 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000015.00000002.1706989687.0000000073A41000.00000040.00000001.01000000.00000019.sdmp, HelpPane.exe, 0000001B.00000002.1598286919.0000000073E11000.00000040.00000001.01000000.00000027.sdmp, HelpPane.exe, 00000021.00000002.2466593137.0000000073DB1000.00000040.00000001.01000000.00000041.sdmp
Source:	Binary string: O:\src\pywin32\build\temp.win32-2.7\Release\pywintypes.pdb source: 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000011.00000002.1561923280.000000001E7A1000.00000040.00000001.01000000.00000012.sdmp
Source:	Binary string: O:\src\pywin32\build\temp.win32-2.7\Release\servicemanager.pdb source: 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000011.00000002.1562321143.000000001E7D1000.00000040.00000001.01000000.00000015.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000015.00000002.1690258741.000000001E7D4000.00000040.00000001.01000000.00000022.sdmp, HelpPane.exe, 00000021.00000002.2451063871.000000001E7D4000.00000040.00000001.01000000.0000004A.sdmp
Source:	Binary string: O:\src\pywin32\build\temp.win32-2.7\Release\pywintypes.pdb$ source: 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000011.00000002.1561923280.000000001E7A1000.00000040.00000001.01000000.00000012.sdmp
Source:	Binary string: O:\src\pywin32\build\temp.win32-2.7\Release\win32service.pdbl source: 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000011.00000002.1562974427.000000001ECB1000.00000040.00000001.01000000.00000011.sdmp
Source:	Binary string: msvcm90.i386.pdb source: 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000010.00000003.1529260880.0000000000ED1000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000014.00000003.1547561156.0000000000F10000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: O:\src\pywin32\build\temp.win32-2.7\Release\win32api.pdb source: 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000011.00000002.1562490344.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp
Source:	Binary string: O:\src\pywin32\build\temp.win32-2.7\Release\win32service.pdb source: 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000011.00000002.1562974427.000000001ECB1000.00000040.00000001.01000000.00000011.sdmp
Source:	Binary string: C:\build27\cpython\PCBuild\python27.pdb source: 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000011.00000002.1566376619.000000006CF51000.00000040.00000001.01000000.00000009.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000015.00000002.1699424273.000000006CC32000.00000040.00000001.01000000.00000016.sdmp, HelpPane.exe, 00000021.00000002.2459301185.000000006C702000.00000040.00000001.01000000.0000003E.sdmp
Source:	Binary string: O:\src\pywin32\build\temp.win32-2.7\Release\servicemanager.pdb19 source: 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000011.00000002.1562321143.000000001E7D1000.00000040.00000001.01000000.00000015.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000015.00000002.1690258741.000000001E7D4000.00000040.00000001.01000000.00000022.sdmp, HelpPane.exe, 00000021.00000002.2451063871.000000001E7D4000.00000040.00000001.01000000.0000004A.sdmp
Source:	Binary string: C:\build27\cpython\PCBuild\_ssl.pdb source: 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000011.00000002.1564482512.000000006CDE1000.00000040.00000001.01000000.0000000D.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000015.00000002.1694555704.000000006C9EF000.00000040.00000001.01000000.0000001A.sdmp, HelpPane.exe, 00000021.00000002.2454900296.000000006C4BF000.00000040.00000001.01000000.00000042.sdmp
Source:	Binary string: O:\src\pywin32\build\temp.win32-2.7\Release\win32event.pdb source: 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000011.00000002.1562784907.000000001E9B1000.00000040.00000001.01000000.00000014.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000015.00000002.1690953701.000000001E9B4000.00000040.00000001.01000000.00000021.sdmp, HelpPane.exe, 00000021.00000002.2451350043.000000001E9B4000.00000040.00000001.01000000.00000049.sdmp
Source:	Binary string: C:\build27\cpython\PCBuild\_ctypes.pdba source: 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000011.00000002.1571192833.00000000747F1000.00000040.00000001.01000000.0000000B.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000015.00000002.1707382765.0000000073A82000.00000040.00000001.01000000.00000018.sdmp, HelpPane.exe, 00000021.00000002.2466945092.0000000073DE2000.00000040.00000001.01000000.00000040.sdmp

Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 17_2_1E8C1F60 PyArg_ParseTuple,?PyWinObject_AsString@@YAHPAU_object@@PAPADHPAK@Z,PyList_New,FindFirstFileA,GetLastError,?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z,PyList_Append,?PyObject_FromWIN32_FIND_DATAA@@YAPAU_object@@PAU_WIN32_FIND_DATAA@@@Z,PyList_Append,FindNextFileA,GetLastError,?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z,?PyWinObject_FreeString@@YAXPAD@Z,FindClose,		17_2_1E8C1F60
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 21_2_6C986D30 FindFirstFileA,FindNextFileA,		21_2_6C986D30

Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe

Code function: 17_2_034141B0 PyList_New,SetErrorMode,PyArg_ParseTuple,PyObject_IsTrue,PyEval_SaveThread,GetLogicalDriveStringsA,PyEval_RestoreThread,PyErr_SetFromWindowsErr,PyEval_SaveThread,GetDriveTypeA,PyEval_RestoreThread,GetVolumeInformationA,SetLastError,FindFirstVolumeMountPointA,Py_BuildValue,PyList_Append,FindNextVolumeMountPointA,FindVolumeMountPointClose,Py_BuildValue,PyList_Append,SetErrorMode,FindVolumeMountPointClose,SetErrorMode,

17_2_034141B0

Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 4x nop then movd mm0, dword ptr [edx]		17_2_6CD6DDB0
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 4x nop then movd mm0, dword ptr [edx]		21_2_6C83DDB0

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.204.200.143:6881 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 47.107.92.35:8083 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 190.109.227.211:31173 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 164.163.25.241:8083 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 45.189.207.241:8083 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.141.226.116:45756 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 115.201.152.228:5353 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.72.88.220:1168 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.72.75.89:13453 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 1.10.212.34:43361 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.214.98.23:2064 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.204.202.127:14219 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.219.90.178:44318 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 124.7.139.186:11211 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.248.61.132:30301 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 87.253.4.0:8000 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 59.89.69.122:34806 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.204.192.67:45334 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.72.68.245:5494 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.208.100.100:4000 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 120.27.131.41:5787 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.72.76.39:13472 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.193.80.25:29605 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.72.68.44:4221 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.204.193.44:8082 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.235.52.188:41500 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 59.89.70.144:30301 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 137.175.46.64:6736 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.72.77.243:1574 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 5.188.64.229:5353 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.204.195.167:40542 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.248.49.85:45434 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 1.10.212.35:53619 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.204.195.113:53738 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 1.10.212.38:8648 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 223.13.63.131:10386 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.141.246.164:44911 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 109.108.218.34:1434 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 59.92.44.255:30653 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 59.99.139.221:8080 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 81.68.153.169:16054 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.141.229.85:5353 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.213.81.219:44609 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.141.51.159:12878 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 59.89.206.19:30040 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.248.60.28:2452 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.211.223.31:30600 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.252.202.181:30301 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.204.201.41:1434 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.204.193.72:8082 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.204.201.17:5060 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 59.93.129.243:1027 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 59.89.125.248:1027 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 59.93.30.134:8080 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 1.10.212.35:7511 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 188.149.142.208:17607 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 38.137.0.22:28547 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.220.146.21:6881 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.204.203.68:8083 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 217.213.110.165:57501 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.141.136.230:4727 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 188.149.139.44:8082 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 103.40.255.245:8080 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 59.92.42.81:38822 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.217.33.24:18836 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 37.255.208.94:7659 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 61.3.178.191:52367 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 24.53.139.167:46874 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.204.198.82:43763 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.72.68.90:3496 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 59.89.207.116:41547 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.72.69.34:10539 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 59.93.181.149:8081 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.248.46.29:5060 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 59.93.180.61:1027 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.141.177.171:46426 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 59.98.30.191:9221 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.204.199.213:21861 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 198.16.58.241:30301 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.72.71.211:7664 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.220.151.41:24563 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 222.246.209.22:5060 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.204.196.236:17542 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.198.26.118:56757 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.204.192.234:62110 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.217.58.52:8082 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 175.173.94.100:22502 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.200.176.213:50235 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.202.65.13:4856 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.72.76.147:18567 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 39.187.67.68:7429 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.72.88.14:15400 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 111.70.31.106:4000 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 115.57.57.44:8080 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 219.157.138.77:30193 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 1.10.147.64:20997 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 59.182.146.210:58321 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.205.61.150:4000 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.217.43.183:49456 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.141.158.194:1434 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.248.19.154:40576 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.72.81.231:7459 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.204.196.76:54463 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.204.197.108:57356 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 123.11.13.9:38385 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.201.11.68:8081 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.202.75.204:8000 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 42.237.49.201:37178 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 49.234.57.41:21168 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 47.76.76.152:8081 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 61.52.225.131:18566 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.141.142.251:1900 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.72.69.50:17414 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.200.89.104:62187 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 123.5.144.22:8081 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.242.236.163:8083 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.252.192.228:23918 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.50.73.154:6881 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 190.109.229.181:40772 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.72.70.129:10226 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 61.0.9.172:30495 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 125.25.174.221:30301 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.204.199.199:22004 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 59.180.182.110:1027 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 209.59.113.249:57674 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 222.142.251.75:60464 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 42.224.0.233:60614 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 59.182.156.229:17706 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 59.96.165.229:6548 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.252.193.49:6881 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 59.184.50.233:51774 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 95.169.197.246:11211 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 61.52.134.158:37235 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 59.99.138.62:11489 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.72.69.83:9510 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 59.92.179.251:8083 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 219.157.58.43:4000 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 123.129.134.22:42083 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 27.157.170.250:13570 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 120.85.92.237:8927 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 1.10.211.124:5060 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 112.252.255.116:5125 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.215.212.67:52384 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 59.180.163.252:4000 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 59.89.6.169:4000 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 1.70.169.208:13733 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.72.76.17:5416 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 115.55.247.124:7039 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 59.92.190.128:8080 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 119.185.58.10:48066 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.204.198.192:5353 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 61.1.146.173:8082 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.253.214.191:1900 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 120.63.221.76:6881 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 59.92.217.4:8860 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 59.180.163.124:8181 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.205.143.103:6881 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.242.236.98:11593 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 182.56.169.191:8082 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.72.81.211:8488 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.220.149.48:8082 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.204.200.160:8080 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.255.205.50:8083 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 42.4.109.110:8000 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 123.4.78.94:1027 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 42.54.146.165:30907 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 113.24.186.62:8000 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.252.206.190:59301 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 59.184.54.156:6881 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 59.91.188.62:4000 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 164.163.25.146:31215 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 42.52.67.36:4000 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 182.124.40.132:60648 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.212.164.12:5353 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 42.233.215.68:20651 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 59.184.54.5:1027 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 1.10.212.37:3060 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 59.89.1.112:23323 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.216.64.111:49006 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 59.88.183.47:1737 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.213.114.81:25966 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 42.230.188.102:63554 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.204.195.230:27297 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.72.69.169:16677 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.254.179.77:18473 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 123.130.186.62:4000 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.192.123.197:30301 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 42.230.39.63:11907 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 42.234.216.63:17852 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 114.218.141.66:47086 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 175.146.231.173:55732 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 115.63.32.132:4000 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 122.155.0.70:10388 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.206.187.119:6881 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 59.89.0.87:5060 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.200.89.8:6881 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 59.93.188.218:5695 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 115.58.151.170:4000 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.72.75.15:6674 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 42.226.73.189:30301 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 115.56.181.247:62465 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 115.58.85.247:43260 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 123.173.4.179:30301 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.60.101.203:8083 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 219.154.173.51:60648 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.211.208.253:1027 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.209.8.221:38219 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 210.10.131.189:2330 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.197.169.210:3252 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.235.78.163:8000 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 120.85.183.182:5752 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.217.48.133:1027 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 42.234.244.67:54564 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 119.163.161.191:56641 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 112.248.246.123:33981 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.220.147.13:11753 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 182.117.29.5:44426 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.206.188.187:8081 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 222.141.89.244:7229 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 81.182.184.141:18235 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 58.47.26.195:30301 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 148.66.134.158:5060 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.194.209.234:11211 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 182.121.207.64:50494 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 1.215.138.43:17433 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 113.26.82.43:11211 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.207.75.211:8081 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.204.206.245:36598 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.204.193.173:30301 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.204.206.250:51242 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 125.41.0.47:30203 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.204.205.131:8082 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.72.75.250:2530 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 115.48.47.113:29452 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 120.85.119.134:20433 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 112.242.167.52:65175 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 113.236.254.106:27244 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 113.221.27.96:8080 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 59.98.28.250:5353 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 176.193.204.236:5353 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 115.58.155.116:5353 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 59.93.182.5:64693 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 123.8.16.239:5060 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.204.56.33:8083 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 1.10.212.36:28784 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 59.93.181.185:57131 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 125.41.186.241:8080 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 116.138.176.173:4908 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 186.148.245.178:1905 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 42.224.29.185:5353 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 42.86.126.69:46440 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 125.44.218.201:13185 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 59.180.184.123:57641 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.199.15.116:48376 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 61.1.145.203:38606 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.248.48.13:53575 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.141.230.54:8081 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.72.75.52:14339 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 39.77.34.71:47106 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 59.93.28.1:8080 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 120.85.117.166:2547 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 59.93.186.197:6881 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 1.10.212.38:4266 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 59.178.92.49:4770 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 175.178.238.26:8080 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 222.140.182.46:6881 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 175.10.89.226:5499 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 182.59.50.30:17145 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 59.93.18.150:21444 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 182.121.11.249:5060 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 27.215.82.209:9134 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.204.202.74:18361 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 182.121.152.137:4000 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 112.248.138.4:38532 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 1.10.212.37:40207 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 124.131.132.95:23412 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 113.246.16.130:25601 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 115.55.76.81:4000 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.204.205.154:5144 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 59.93.20.87:17999 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 59.92.202.217:50587 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.222.254.212:55583 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.200.93.30:48456 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 124.95.13.142:8000 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 1.10.212.34:36524 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.217.51.50:6881 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 1.10.212.34:10470 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 112.248.114.227:5516 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 61.53.93.185:45329 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 112.231.118.128:30301 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 120.56.13.44:36627 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 115.62.186.177:6881 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.217.37.25:8082 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.204.196.16:30301 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.204.197.94:19426 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.204.202.223:8000 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.204.196.32:8081 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.201.13.21:62949 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.206.142.219:25287 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 120.85.91.225:2815 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.248.22.80:5353 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 61.0.11.32:5353 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 39.79.135.49:8083 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 106.56.48.164:5060 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 113.168.89.195:8000 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 27.215.47.70:10420 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 182.112.40.209:31161 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.206.135.24:1812 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.141.154.0:7607 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 59.184.51.207:1027 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 112.239.98.243:1027 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 175.30.113.242:8000 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 115.49.1.0:6990 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 160.153.235.195:23451 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.217.63.12:5353 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 58.47.104.176:4000 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 42.53.37.6:30918 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 115.50.26.45:30872 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.204.204.228:24245 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.194.169.133:1434 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 120.85.113.130:12364 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 110.181.71.253:4000 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 222.139.77.245:52002 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 222.141.122.93:41451 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.205.56.122:8080 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 123.185.49.90:8083 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 112.239.22.116:45920 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.204.207.91:8000 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.204.207.227:46849 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.204.207.242:25089 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 219.157.136.69:4000 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 120.56.9.158:30301 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 112.248.172.90:19307 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 61.53.41.246:54421 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.196.45.191:1027 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.141.33.56:5634 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.204.199.23:8959 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 59.93.30.163:30301 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.252.40.22:6881 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 113.230.80.68:8080 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 113.239.64.251:6881 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 123.194.35.224:1900 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.242.142.105:3277 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.253.217.232:8000 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 119.179.255.119:5060 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 42.239.252.68:7398 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 59.92.179.20:20906 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 27.6.26.116:54158 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.63.114.20:34281 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.72.81.202:6463 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 42.177.198.181:8081 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 39.90.147.149:1027 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 123.191.91.8:1027 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.204.200.144:38183 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 42.86.169.112:44386 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 59.88.185.45:39033 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.212.18.86:8082 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 221.15.146.215:23326 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 59.89.6.89:52485 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 222.140.185.244:63604 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 112.248.100.78:19401 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 182.120.46.143:30301 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 219.156.175.192:8000 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.204.205.182:51405 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.204.207.97:8081 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 182.117.30.233:19307 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.197.24.81:63208 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 182.117.108.148:5060 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 221.15.195.14:4736 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 221.230.38.202:5353 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 186.148.245.119:36130 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 42.230.216.234:7452 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.72.78.46:4429 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.248.23.3:30301 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 182.114.228.16:3600 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 121.61.147.248:8083 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 123.10.147.38:5353 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 42.235.172.106:1848 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 27.158.92.99:25605 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 115.51.28.98:4000 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 182.96.200.243:25895 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 121.239.56.243:12290 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 123.59.105.78:21446 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 42.229.252.77:33796 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 40.133.224.20:41073 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 59.95.219.225:61491 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.72.69.255:6581 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.206.180.21:11211 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.235.148.106:8082 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.206.186.245:10629 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.215.214.232:59181 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 115.55.241.78:5353 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 210.22.177.142:56572 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 112.239.101.154:59635 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 120.85.114.246:4087 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.72.69.188:4097 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 59.93.189.20:25886 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 60.23.233.227:57362 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 1.10.212.34:28803 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.204.195.86:5060 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 115.55.242.43:39737 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 123.14.35.111:8082 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 120.85.115.216:21216 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 182.121.84.2:20185 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 106.3.130.252:16147 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 112.248.188.197:48388 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 115.63.15.46:8081 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.204.207.60:1027 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 223.13.61.70:28879 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.204.203.59:32658 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 222.141.120.99:40306 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 27.215.212.142:1027 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 221.14.112.172:28409 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 119.116.155.73:62968 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.204.197.182:8081 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 1.10.212.33:10829 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.194.215.155:50348 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 123.129.154.98:29009 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.243.247.148:1027 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 27.7.214.11:8000 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 119.117.247.228:42309 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.204.197.17:5353 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 113.228.150.105:63764 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 59.89.192.210:27854 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 85.215.242.168:6881 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 186.148.245.61:1434 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 59.184.76.78:11211 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 88.147.174.83:9729 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.141.162.151:5060 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 113.221.31.88:8000 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 123.10.213.191:19307 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 59.93.129.236:55547 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.204.197.93:31290 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.204.193.20:59628 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 61.52.55.159:58685 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 125.27.181.199:23490 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 1.10.212.36:8717 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 27.158.93.188:13315 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 1.10.212.36:32931 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 222.137.180.67:61642 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.248.60.176:62281 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.204.207.18:20342 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.199.6.158:8083 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.207.74.83:46118 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.199.77.97:8083 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 223.8.217.59:8083 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 121.225.81.102:13457 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 119.179.238.174:60648 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 175.31.169.95:8081 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.141.227.103:5060 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 42.57.236.253:51456 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 1.10.212.36:25450 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.204.192.110:65459 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.201.10.81:1895 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 42.235.40.58:58178 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.204.200.35:11211 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 1.10.212.34:4631 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 115.60.251.49:42715 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 221.1.225.65:55101 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 42.224.117.97:28162 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 42.239.171.195:17588 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 115.58.81.120:8083 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.216.16.221:8080 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 200.111.102.27:1027 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 45.119.84.144:5060 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 115.50.56.115:8082 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 60.246.138.175:62851 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 91.143.171.160:4864 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.194.209.48:1434 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 175.175.188.249:4375 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.220.109.13:63412 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 42.227.164.44:45784 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 123.129.129.158:6881 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.194.210.197:35307 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.204.203.159:29299 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 59.89.3.215:56018 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 61.3.83.110:44716 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 27.215.45.174:40246 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 59.178.213.250:52265 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.204.192.49:30301 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 120.56.12.238:26763 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 59.184.79.224:53166 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 61.53.148.24:62593 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 59.184.68.106:8080 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 175.174.51.163:62553 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.248.55.248:19570 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 59.89.5.185:36181 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 115.56.149.177:45931 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 61.53.92.85:24761 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 123.14.113.70:36160 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 49.77.71.39:53643 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 42.53.180.95:9332 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 125.45.9.61:8082 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 182.243.157.74:6881 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 115.55.6.157:65505 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.72.70.34:21818 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 59.93.183.200:4137 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 119.189.215.205:15465 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 59.99.130.139:4203 -> 192.168.2.16:1434
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.217.83.91:55534 -> 192.168.2.16:1434

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 50008 -> 2121
Source: unknown	Network traffic detected: HTTP traffic on port 52668 -> 2121
Source: unknown	Network traffic detected: HTTP traffic on port 52995 -> 2121

Source: unknown

Network traffic detected: IP country count 28

Source: global traffic	TCP traffic: 192.168.2.16:49706 -> 202.141.230.46:2121
Source: global traffic	TCP traffic: 192.168.2.16:49709 -> 187.232.63.30:2121
Source: global traffic	TCP traffic: 192.168.2.16:49710 -> 88.3.252.23:2121
Source: global traffic	TCP traffic: 192.168.2.16:49712 -> 88.138.242.230:2121
Source: global traffic	TCP traffic: 192.168.2.16:49714 -> 117.3.236.203:2121
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 220.174.66.41:2121
Source: global traffic	TCP traffic: 192.168.2.16:49718 -> 190.199.135.222:2121
Source: global traffic	TCP traffic: 192.168.2.16:49720 -> 20.27.129.45:2121
Source: global traffic	TCP traffic: 192.168.2.16:49722 -> 45.225.213.66:2121
Source: global traffic	TCP traffic: 192.168.2.16:49724 -> 98.144.80.128:2121
Source: global traffic	TCP traffic: 192.168.2.16:49726 -> 51.241.196.118:2121
Source: global traffic	TCP traffic: 192.168.2.16:49728 -> 119.176.139.75:2121
Source: global traffic	TCP traffic: 192.168.2.16:49730 -> 38.38.120.85:2121
Source: global traffic	TCP traffic: 192.168.2.16:49732 -> 187.137.19.229:2121
Source: global traffic	TCP traffic: 192.168.2.16:49734 -> 109.130.248.23:2121
Source: global traffic	TCP traffic: 192.168.2.16:49736 -> 34.128.248.69:2121
Source: global traffic	TCP traffic: 192.168.2.16:49738 -> 121.132.64.213:2121
Source: global traffic	TCP traffic: 192.168.2.16:49740 -> 20.99.154.51:2121
Source: global traffic	TCP traffic: 192.168.2.16:49741 -> 122.17.56.127:2121
Source: global traffic	TCP traffic: 192.168.2.16:49744 -> 60.137.216.231:2121
Source: global traffic	TCP traffic: 192.168.2.16:49747 -> 217.73.16.9:2121
Source: global traffic	TCP traffic: 192.168.2.16:49749 -> 174.49.126.122:2121
Source: global traffic	TCP traffic: 192.168.2.16:49750 -> 72.240.221.220:2121
Source: global traffic	TCP traffic: 192.168.2.16:49752 -> 122.234.24.202:2121
Source: global traffic	TCP traffic: 192.168.2.16:49754 -> 134.130.247.222:2121
Source: global traffic	TCP traffic: 192.168.2.16:49756 -> 92.252.102.247:2121
Source: global traffic	TCP traffic: 192.168.2.16:49758 -> 40.88.10.206:2121
Source: global traffic	TCP traffic: 192.168.2.16:49760 -> 107.184.133.230:2121
Source: global traffic	TCP traffic: 192.168.2.16:49762 -> 185.35.189.48:2121
Source: global traffic	TCP traffic: 192.168.2.16:49764 -> 173.93.196.30:2121
Source: global traffic	TCP traffic: 192.168.2.16:49766 -> 106.203.218.54:2121
Source: global traffic	TCP traffic: 192.168.2.16:49768 -> 207.148.31.31:2121
Source: global traffic	TCP traffic: 192.168.2.16:49770 -> 60.141.44.63:2121
Source: global traffic	TCP traffic: 192.168.2.16:49772 -> 126.55.113.199:2121
Source: global traffic	TCP traffic: 192.168.2.16:49774 -> 68.6.178.222:2121
Source: global traffic	TCP traffic: 192.168.2.16:49776 -> 76.184.71.237:2121
Source: global traffic	TCP traffic: 192.168.2.16:49778 -> 180.195.247.176:2121
Source: global traffic	TCP traffic: 192.168.2.16:49781 -> 75.68.30.94:2121
Source: global traffic	TCP traffic: 192.168.2.16:49782 -> 221.2.50.105:2121
Source: global traffic	TCP traffic: 192.168.2.16:49784 -> 113.13.157.160:2121
Source: global traffic	TCP traffic: 192.168.2.16:49785 -> 112.144.219.240:2121
Source: global traffic	TCP traffic: 192.168.2.16:49788 -> 222.138.218.131:2121
Source: global traffic	TCP traffic: 192.168.2.16:49790 -> 24.63.48.54:2121
Source: global traffic	TCP traffic: 192.168.2.16:49792 -> 59.41.145.142:2121
Source: global traffic	TCP traffic: 192.168.2.16:49794 -> 117.10.175.148:2121
Source: global traffic	TCP traffic: 192.168.2.16:49797 -> 84.176.189.204:2121
Source: global traffic	TCP traffic: 192.168.2.16:49799 -> 87.16.29.239:2121
Source: global traffic	TCP traffic: 192.168.2.16:49801 -> 174.61.242.178:2121
Source: global traffic	TCP traffic: 192.168.2.16:49802 -> 58.232.199.163:2121
Source: global traffic	TCP traffic: 192.168.2.16:49804 -> 182.35.245.77:2121
Source: global traffic	TCP traffic: 192.168.2.16:49806 -> 213.37.158.68:2121
Source: global traffic	TCP traffic: 192.168.2.16:49807 -> 112.252.80.62:2121
Source: global traffic	TCP traffic: 192.168.2.16:49810 -> 59.14.157.129:2121
Source: global traffic	TCP traffic: 192.168.2.16:49812 -> 23.12.109.151:2121
Source: global traffic	TCP traffic: 192.168.2.16:49813 -> 72.10.97.97:2121
Source: global traffic	TCP traffic: 192.168.2.16:49816 -> 107.174.245.116:2121
Source: global traffic	TCP traffic: 192.168.2.16:49818 -> 120.92.55.9:2121
Source: global traffic	TCP traffic: 192.168.2.16:49819 -> 83.58.227.82:2121
Source: global traffic	TCP traffic: 192.168.2.16:49822 -> 189.178.166.57:2121
Source: global traffic	TCP traffic: 192.168.2.16:49824 -> 67.9.27.76:2121
Source: global traffic	TCP traffic: 192.168.2.16:49826 -> 74.101.156.83:2121
Source: global traffic	TCP traffic: 192.168.2.16:49828 -> 125.132.197.159:2121
Source: global traffic	TCP traffic: 192.168.2.16:49830 -> 2.219.242.97:2121
Source: global traffic	TCP traffic: 192.168.2.16:49832 -> 67.2.29.149:2121
Source: global traffic	TCP traffic: 192.168.2.16:49833 -> 72.253.222.60:2121
Source: global traffic	TCP traffic: 192.168.2.16:49836 -> 189.188.209.240:2121
Source: global traffic	TCP traffic: 192.168.2.16:49837 -> 124.48.8.141:2121
Source: global traffic	TCP traffic: 192.168.2.16:49840 -> 98.27.54.26:2121
Source: global traffic	TCP traffic: 192.168.2.16:49842 -> 126.78.5.163:2121
Source: global traffic	TCP traffic: 192.168.2.16:49844 -> 179.247.85.29:2121
Source: global traffic	TCP traffic: 192.168.2.16:49846 -> 1.28.158.199:2121
Source: global traffic	TCP traffic: 192.168.2.16:49848 -> 46.167.107.13:2121
Source: global traffic	TCP traffic: 192.168.2.16:49850 -> 73.79.84.228:2121
Source: global traffic	TCP traffic: 192.168.2.16:49852 -> 221.224.127.141:2121
Source: global traffic	TCP traffic: 192.168.2.16:49854 -> 8.139.140.192:2121
Source: global traffic	TCP traffic: 192.168.2.16:49856 -> 200.127.5.88:2121
Source: global traffic	TCP traffic: 192.168.2.16:49858 -> 79.33.67.53:2121
Source: global traffic	TCP traffic: 192.168.2.16:49860 -> 197.15.64.148:2121
Source: global traffic	TCP traffic: 192.168.2.16:49862 -> 94.9.112.206:2121
Source: global traffic	TCP traffic: 192.168.2.16:49864 -> 39.129.73.19:2121
Source: global traffic	TCP traffic: 192.168.2.16:49866 -> 23.229.188.101:2121
Source: global traffic	TCP traffic: 192.168.2.16:49868 -> 137.184.114.51:2121
Source: global traffic	TCP traffic: 192.168.2.16:49870 -> 59.80.54.225:2121
Source: global traffic	TCP traffic: 192.168.2.16:49872 -> 72.192.14.127:2121
Source: global traffic	TCP traffic: 192.168.2.16:49874 -> 178.157.90.142:2121
Source: global traffic	TCP traffic: 192.168.2.16:49876 -> 221.200.218.169:2121
Source: global traffic	TCP traffic: 192.168.2.16:49878 -> 124.132.191.24:2121
Source: global traffic	TCP traffic: 192.168.2.16:49880 -> 84.194.9.127:2121
Source: global traffic	TCP traffic: 192.168.2.16:49882 -> 189.163.237.97:2121
Source: global traffic	TCP traffic: 192.168.2.16:49884 -> 38.77.59.183:2121
Source: global traffic	TCP traffic: 192.168.2.16:49886 -> 61.77.52.76:2121
Source: global traffic	TCP traffic: 192.168.2.16:49888 -> 91.249.55.22:2121
Source: global traffic	TCP traffic: 192.168.2.16:49890 -> 124.90.159.99:2121
Source: global traffic	TCP traffic: 192.168.2.16:49892 -> 90.180.159.186:2121
Source: global traffic	TCP traffic: 192.168.2.16:49894 -> 20.89.42.33:2121
Source: global traffic	TCP traffic: 192.168.2.16:49898 -> 196.210.0.111:2121
Source: global traffic	TCP traffic: 192.168.2.16:49900 -> 119.231.203.174:2121
Source: global traffic	TCP traffic: 192.168.2.16:49902 -> 216.183.51.214:2121
Source: global traffic	TCP traffic: 192.168.2.16:49904 -> 93.212.38.207:2121
Source: global traffic	TCP traffic: 192.168.2.16:49906 -> 185.18.133.19:2121
Source: global traffic	TCP traffic: 192.168.2.16:49908 -> 217.11.35.173:2121
Source: global traffic	TCP traffic: 192.168.2.16:49910 -> 39.27.13.134:2121
Source: global traffic	TCP traffic: 192.168.2.16:49912 -> 85.247.109.248:2121
Source: global traffic	TCP traffic: 192.168.2.16:49914 -> 211.37.73.195:2121
Source: global traffic	TCP traffic: 192.168.2.16:49916 -> 92.252.174.158:2121
Source: global traffic	TCP traffic: 192.168.2.16:49918 -> 39.58.197.109:2121
Source: global traffic	TCP traffic: 192.168.2.16:49919 -> 86.20.170.121:2121
Source: global traffic	TCP traffic: 192.168.2.16:49922 -> 179.244.78.184:2121
Source: global traffic	TCP traffic: 192.168.2.16:49924 -> 188.179.76.56:2121
Source: global traffic	TCP traffic: 192.168.2.16:49926 -> 73.117.145.210:2121
Source: global traffic	TCP traffic: 192.168.2.16:49928 -> 223.112.252.89:2121
Source: global traffic	TCP traffic: 192.168.2.16:49930 -> 95.153.49.77:2121
Source: global traffic	TCP traffic: 192.168.2.16:49932 -> 185.252.215.74:2121
Source: global traffic	TCP traffic: 192.168.2.16:49935 -> 2.122.182.57:2121
Source: global traffic	TCP traffic: 192.168.2.16:49936 -> 91.36.126.116:2121
Source: global traffic	TCP traffic: 192.168.2.16:49938 -> 178.211.237.37:2121
Source: global traffic	TCP traffic: 192.168.2.16:49940 -> 181.175.197.255:2121
Source: global traffic	TCP traffic: 192.168.2.16:49942 -> 219.157.216.200:2121
Source: global traffic	TCP traffic: 192.168.2.16:49944 -> 223.13.57.142:2121
Source: global traffic	TCP traffic: 192.168.2.16:49946 -> 216.201.52.26:2121
Source: global traffic	TCP traffic: 192.168.2.16:49948 -> 118.214.111.215:2121
Source: global traffic	TCP traffic: 192.168.2.16:49950 -> 27.213.95.111:2121
Source: global traffic	TCP traffic: 192.168.2.16:49952 -> 73.67.38.37:2121
Source: global traffic	TCP traffic: 192.168.2.16:49954 -> 211.211.70.243:2121
Source: global traffic	TCP traffic: 192.168.2.16:49955 -> 133.159.212.113:2121
Source: global traffic	TCP traffic: 192.168.2.16:49956 -> 197.49.46.137:2121
Source: global traffic	TCP traffic: 192.168.2.16:49958 -> 92.107.132.216:2121
Source: global traffic	TCP traffic: 192.168.2.16:49961 -> 88.12.163.193:2121
Source: global traffic	TCP traffic: 192.168.2.16:49965 -> 87.13.248.211:2121
Source: global traffic	TCP traffic: 192.168.2.16:49966 -> 103.21.62.148:2121
Source: global traffic	TCP traffic: 192.168.2.16:49967 -> 35.171.239.79:2121
Source: global traffic	TCP traffic: 192.168.2.16:49970 -> 23.241.156.235:2121
Source: global traffic	TCP traffic: 192.168.2.16:49975 -> 171.237.167.200:2121
Source: global traffic	TCP traffic: 192.168.2.16:49976 -> 80.65.79.44:2121
Source: global traffic	TCP traffic: 192.168.2.16:49978 -> 23.192.166.102:2121
Source: global traffic	TCP traffic: 192.168.2.16:49980 -> 86.13.48.192:2121
Source: global traffic	TCP traffic: 192.168.2.16:49983 -> 211.104.99.158:2121
Source: global traffic	TCP traffic: 192.168.2.16:49985 -> 115.112.79.149:2121
Source: global traffic	TCP traffic: 192.168.2.16:49986 -> 210.106.251.150:2121
Source: global traffic	TCP traffic: 192.168.2.16:49974 -> 37.28.15.192:2121
Source: global traffic	TCP traffic: 192.168.2.16:49988 -> 102.27.2.20:2121
Source: global traffic	TCP traffic: 192.168.2.16:49990 -> 123.4.235.233:2121
Source: global traffic	TCP traffic: 192.168.2.16:49992 -> 45.153.57.22:2121
Source: global traffic	TCP traffic: 192.168.2.16:49994 -> 212.193.50.13:2121
Source: global traffic	TCP traffic: 192.168.2.16:49996 -> 118.52.252.40:2121
Source: global traffic	TCP traffic: 192.168.2.16:49997 -> 27.33.157.64:2121
Source: global traffic	TCP traffic: 192.168.2.16:49999 -> 104.21.239.40:2121
Source: global traffic	TCP traffic: 192.168.2.16:50002 -> 204.254.177.81:2121
Source: global traffic	TCP traffic: 192.168.2.16:50005 -> 124.76.80.236:2121
Source: global traffic	TCP traffic: 192.168.2.16:50006 -> 20.4.159.89:2121
Source: global traffic	TCP traffic: 192.168.2.16:50008 -> 34.149.79.8:2121
Source: global traffic	TCP traffic: 192.168.2.16:50010 -> 86.90.22.187:2121
Source: global traffic	TCP traffic: 192.168.2.16:50011 -> 95.101.166.24:2121
Source: global traffic	TCP traffic: 192.168.2.16:50013 -> 79.145.211.71:2121
Source: global traffic	TCP traffic: 192.168.2.16:50016 -> 213.49.25.250:2121
Source: global traffic	TCP traffic: 192.168.2.16:50019 -> 24.99.37.171:2121
Source: global traffic	TCP traffic: 192.168.2.16:50020 -> 67.189.152.9:2121
Source: global traffic	TCP traffic: 192.168.2.16:50022 -> 93.123.134.76:2121
Source: global traffic	TCP traffic: 192.168.2.16:50024 -> 95.115.71.162:2121
Source: global traffic	TCP traffic: 192.168.2.16:50026 -> 75.183.52.97:2121
Source: global traffic	TCP traffic: 192.168.2.16:50028 -> 187.233.203.114:2121
Source: global traffic	TCP traffic: 192.168.2.16:50029 -> 203.128.203.48:2121
Source: global traffic	TCP traffic: 192.168.2.16:50032 -> 81.198.111.173:2121
Source: global traffic	TCP traffic: 192.168.2.16:50034 -> 178.64.38.166:2121
Source: global traffic	TCP traffic: 192.168.2.16:50036 -> 201.110.133.95:2121
Source: global traffic	TCP traffic: 192.168.2.16:50039 -> 205.211.202.1:2121
Source: global traffic	TCP traffic: 192.168.2.16:50040 -> 91.146.153.183:2121
Source: global traffic	TCP traffic: 192.168.2.16:50042 -> 95.52.30.52:2121
Source: global traffic	TCP traffic: 192.168.2.16:50045 -> 94.33.136.136:2121
Source: global traffic	TCP traffic: 192.168.2.16:50046 -> 5.71.7.211:2121
Source: global traffic	TCP traffic: 192.168.2.16:50047 -> 130.233.94.223:2121
Source: global traffic	TCP traffic: 192.168.2.16:50050 -> 18.238.143.28:2121
Source: global traffic	TCP traffic: 192.168.2.16:50052 -> 121.133.25.163:2121
Source: global traffic	TCP traffic: 192.168.2.16:50054 -> 92.64.11.129:2121
Source: global traffic	TCP traffic: 192.168.2.16:50056 -> 89.106.127.202:2121
Source: global traffic	TCP traffic: 192.168.2.16:50058 -> 181.24.179.233:2121
Source: global traffic	TCP traffic: 192.168.2.16:50060 -> 31.214.210.76:2121
Source: global traffic	TCP traffic: 192.168.2.16:50062 -> 93.23.184.172:2121
Source: global traffic	TCP traffic: 192.168.2.16:50064 -> 119.113.69.12:2121
Source: global traffic	TCP traffic: 192.168.2.16:50066 -> 187.158.40.132:2121
Source: global traffic	TCP traffic: 192.168.2.16:50068 -> 70.104.196.79:2121
Source: global traffic	TCP traffic: 192.168.2.16:50071 -> 223.231.177.195:2121
Source: global traffic	TCP traffic: 192.168.2.16:50072 -> 20.53.160.214:2121
Source: global traffic	TCP traffic: 192.168.2.16:50073 -> 139.180.55.89:2121
Source: global traffic	TCP traffic: 192.168.2.16:50076 -> 24.177.67.22:2121
Source: global traffic	TCP traffic: 192.168.2.16:50078 -> 79.27.122.148:2121
Source: global traffic	TCP traffic: 192.168.2.16:50079 -> 187.18.231.64:2121
Source: global traffic	TCP traffic: 192.168.2.16:50082 -> 96.50.237.171:2121
Source: global traffic	TCP traffic: 192.168.2.16:50085 -> 178.1.32.243:2121
Source: global traffic	TCP traffic: 192.168.2.16:50086 -> 24.130.106.21:2121
Source: global traffic	TCP traffic: 192.168.2.16:50088 -> 77.203.56.164:2121
Source: global traffic	TCP traffic: 192.168.2.16:50091 -> 175.234.156.232:2121
Source: global traffic	TCP traffic: 192.168.2.16:50092 -> 188.148.10.89:2121
Source: global traffic	TCP traffic: 192.168.2.16:50094 -> 66.130.205.82:2121
Source: global traffic	TCP traffic: 192.168.2.16:50095 -> 207.172.169.15:2121
Source: global traffic	TCP traffic: 192.168.2.16:50098 -> 47.243.207.139:2121
Source: global traffic	TCP traffic: 192.168.2.16:50099 -> 177.207.16.68:2121
Source: global traffic	TCP traffic: 192.168.2.16:50103 -> 219.74.199.173:2121
Source: global traffic	TCP traffic: 192.168.2.16:50104 -> 163.180.232.87:2121
Source: global traffic	TCP traffic: 192.168.2.16:50106 -> 79.234.90.250:2121
Source: global traffic	TCP traffic: 192.168.2.16:50108 -> 73.14.28.18:2121
Source: global traffic	TCP traffic: 192.168.2.16:50110 -> 49.164.93.64:2121
Source: global traffic	TCP traffic: 192.168.2.16:50112 -> 94.10.134.105:2121
Source: global traffic	TCP traffic: 192.168.2.16:50114 -> 24.12.206.219:2121
Source: global traffic	TCP traffic: 192.168.2.16:50116 -> 79.209.25.45:2121
Source: global traffic	TCP traffic: 192.168.2.16:50118 -> 166.151.156.117:2121
Source: global traffic	TCP traffic: 192.168.2.16:50120 -> 178.198.107.39:2121
Source: global traffic	TCP traffic: 192.168.2.16:50122 -> 75.136.134.31:2121
Source: global traffic	TCP traffic: 192.168.2.16:50124 -> 80.117.188.48:2121
Source: global traffic	TCP traffic: 192.168.2.16:50126 -> 50.80.39.237:2121
Source: global traffic	TCP traffic: 192.168.2.16:50129 -> 90.210.81.136:2121
Source: global traffic	TCP traffic: 192.168.2.16:50130 -> 139.59.79.85:2121
Source: global traffic	TCP traffic: 192.168.2.16:50132 -> 171.79.111.124:2121
Source: global traffic	TCP traffic: 192.168.2.16:50134 -> 179.197.172.68:2121
Source: global traffic	TCP traffic: 192.168.2.16:50136 -> 80.18.101.99:2121
Source: global traffic	TCP traffic: 192.168.2.16:50138 -> 183.173.247.100:2121
Source: global traffic	TCP traffic: 192.168.2.16:50140 -> 157.254.106.222:2121
Source: global traffic	TCP traffic: 192.168.2.16:50142 -> 105.209.161.139:2121
Source: global traffic	TCP traffic: 192.168.2.16:50144 -> 27.75.137.166:2121
Source: global traffic	TCP traffic: 192.168.2.16:50146 -> 73.12.247.170:2121
Source: global traffic	TCP traffic: 192.168.2.16:50148 -> 14.248.57.220:2121
Source: global traffic	TCP traffic: 192.168.2.16:50150 -> 83.50.47.165:2121
Source: global traffic	TCP traffic: 192.168.2.16:50152 -> 67.249.182.208:2121
Source: global traffic	TCP traffic: 192.168.2.16:50154 -> 74.75.255.17:2121
Source: global traffic	TCP traffic: 192.168.2.16:50156 -> 118.220.220.143:2121
Source: global traffic	TCP traffic: 192.168.2.16:50158 -> 122.168.163.39:2121
Source: global traffic	TCP traffic: 192.168.2.16:50160 -> 139.185.33.251:2121
Source: global traffic	TCP traffic: 192.168.2.16:50162 -> 189.189.234.175:2121
Source: global traffic	TCP traffic: 192.168.2.16:50164 -> 123.112.167.56:2121
Source: global traffic	TCP traffic: 192.168.2.16:50166 -> 113.17.21.229:2121
Source: global traffic	TCP traffic: 192.168.2.16:50168 -> 20.115.22.255:2121
Source: global traffic	TCP traffic: 192.168.2.16:50170 -> 119.242.104.72:2121
Source: global traffic	TCP traffic: 192.168.2.16:50173 -> 189.147.28.233:2121
Source: global traffic	TCP traffic: 192.168.2.16:50176 -> 42.82.192.53:2121
Source: global traffic	TCP traffic: 192.168.2.16:50178 -> 76.101.92.121:2121
Source: global traffic	TCP traffic: 192.168.2.16:50181 -> 4.206.146.112:2121
Source: global traffic	TCP traffic: 192.168.2.16:50180 -> 184.92.186.129:2121
Source: global traffic	TCP traffic: 192.168.2.16:50184 -> 109.130.229.15:2121
Source: global traffic	TCP traffic: 192.168.2.16:50186 -> 146.75.86.69:2121
Source: global traffic	TCP traffic: 192.168.2.16:50188 -> 38.154.167.222:2121
Source: global traffic	TCP traffic: 192.168.2.16:50190 -> 38.12.232.73:2121
Source: global traffic	TCP traffic: 192.168.2.16:50193 -> 1.232.152.196:2121
Source: global traffic	TCP traffic: 192.168.2.16:50194 -> 153.3.237.182:2121
Source: global traffic	TCP traffic: 192.168.2.16:50196 -> 89.197.227.65:2121
Source: global traffic	TCP traffic: 192.168.2.16:50197 -> 91.118.29.181:2121
Source: global traffic	TCP traffic: 192.168.2.16:50198 -> 41.107.171.233:2121
Source: global traffic	TCP traffic: 192.168.2.16:50201 -> 219.104.236.32:2121
Source: global traffic	TCP traffic: 192.168.2.16:50203 -> 96.16.83.158:2121
Source: global traffic	TCP traffic: 192.168.2.16:50206 -> 183.119.252.76:2121
Source: global traffic	TCP traffic: 192.168.2.16:50209 -> 49.235.102.237:2121
Source: global traffic	TCP traffic: 192.168.2.16:50212 -> 171.246.110.71:2121
Source: global traffic	TCP traffic: 192.168.2.16:50214 -> 115.244.167.85:2121
Source: global traffic	TCP traffic: 192.168.2.16:50218 -> 191.191.24.153:2121
Source: global traffic	TCP traffic: 192.168.2.16:50217 -> 18.161.91.79:2121
Source: global traffic	TCP traffic: 192.168.2.16:50221 -> 77.75.121.3:2121
Source: global traffic	TCP traffic: 192.168.2.16:50223 -> 222.160.120.231:2121
Source: global traffic	TCP traffic: 192.168.2.16:50225 -> 73.235.136.12:2121
Source: global traffic	TCP traffic: 192.168.2.16:50210 -> 124.175.188.59:2121
Source: global traffic	TCP traffic: 192.168.2.16:50227 -> 201.130.99.91:2121
Source: global traffic	TCP traffic: 192.168.2.16:50228 -> 39.87.149.104:2121
Source: global traffic	TCP traffic: 192.168.2.16:50230 -> 160.223.208.239:2121
Source: global traffic	TCP traffic: 192.168.2.16:50234 -> 3.255.123.211:2121
Source: global traffic	TCP traffic: 192.168.2.16:50233 -> 134.255.240.224:2121
Source: global traffic	TCP traffic: 192.168.2.16:50236 -> 211.203.213.243:2121
Source: global traffic	TCP traffic: 192.168.2.16:50237 -> 68.38.82.38:2121
Source: global traffic	TCP traffic: 192.168.2.16:50244 -> 49.161.36.224:2121
Source: global traffic	TCP traffic: 192.168.2.16:50248 -> 149.96.187.162:2121
Source: global traffic	TCP traffic: 192.168.2.16:50246 -> 59.62.230.49:2121
Source: global traffic	TCP traffic: 192.168.2.16:50249 -> 14.86.253.70:2121
Source: global traffic	TCP traffic: 192.168.2.16:50253 -> 66.189.156.99:2121
Source: global traffic	TCP traffic: 192.168.2.16:50252 -> 68.150.164.127:2121
Source: global traffic	TCP traffic: 192.168.2.16:50241 -> 87.226.2.245:2121
Source: global traffic	TCP traffic: 192.168.2.16:50254 -> 108.26.144.105:2121
Source: global traffic	TCP traffic: 192.168.2.16:50256 -> 201.35.137.125:2121
Source: global traffic	TCP traffic: 192.168.2.16:50258 -> 90.246.237.33:2121
Source: global traffic	TCP traffic: 192.168.2.16:50260 -> 46.175.4.125:2121
Source: global traffic	TCP traffic: 192.168.2.16:50262 -> 20.222.111.34:2121
Source: global traffic	TCP traffic: 192.168.2.16:50264 -> 77.130.185.28:2121
Source: global traffic	TCP traffic: 192.168.2.16:50266 -> 45.7.88.51:2121
Source: global traffic	TCP traffic: 192.168.2.16:50267 -> 71.229.38.180:2121
Source: global traffic	TCP traffic: 192.168.2.16:50270 -> 1.225.129.9:2121
Source: global traffic	TCP traffic: 192.168.2.16:50271 -> 103.120.132.17:2121
Source: global traffic	TCP traffic: 192.168.2.16:50274 -> 190.3.106.234:2121
Source: global traffic	TCP traffic: 192.168.2.16:50275 -> 80.138.234.3:2121
Source: global traffic	TCP traffic: 192.168.2.16:50278 -> 88.221.151.7:2121
Source: global traffic	TCP traffic: 192.168.2.16:50280 -> 175.121.57.126:2121
Source: global traffic	TCP traffic: 192.168.2.16:50282 -> 181.71.244.102:2121
Source: global traffic	TCP traffic: 192.168.2.16:50284 -> 95.238.61.250:2121
Source: global traffic	TCP traffic: 192.168.2.16:50288 -> 167.71.66.165:2121
Source: global traffic	TCP traffic: 192.168.2.16:50287 -> 189.225.118.213:2121
Source: global traffic	TCP traffic: 192.168.2.16:50290 -> 109.136.44.230:2121
Source: global traffic	TCP traffic: 192.168.2.16:50292 -> 94.136.16.189:2121
Source: global traffic	TCP traffic: 192.168.2.16:50294 -> 105.97.141.224:2121
Source: global traffic	TCP traffic: 192.168.2.16:50298 -> 96.250.94.212:2121
Source: global traffic	TCP traffic: 192.168.2.16:50300 -> 82.140.49.243:2121
Source: global traffic	TCP traffic: 192.168.2.16:50302 -> 106.244.57.130:2121
Source: global traffic	TCP traffic: 192.168.2.16:50304 -> 175.205.92.244:2121
Source: global traffic	TCP traffic: 192.168.2.16:50306 -> 23.144.192.245:2121
Source: global traffic	TCP traffic: 192.168.2.16:50308 -> 92.104.238.147:2121
Source: global traffic	TCP traffic: 192.168.2.16:50310 -> 88.136.65.138:2121
Source: global traffic	TCP traffic: 192.168.2.16:50312 -> 174.4.136.10:2121
Source: global traffic	TCP traffic: 192.168.2.16:50314 -> 123.144.241.64:2121
Source: global traffic	TCP traffic: 192.168.2.16:50316 -> 76.21.40.96:2121
Source: global traffic	TCP traffic: 192.168.2.16:50318 -> 58.121.190.195:2121
Source: global traffic	TCP traffic: 192.168.2.16:50320 -> 68.144.62.62:2121
Source: global traffic	TCP traffic: 192.168.2.16:50322 -> 69.139.73.181:2121
Source: global traffic	TCP traffic: 192.168.2.16:50324 -> 71.28.183.56:2121
Source: global traffic	TCP traffic: 192.168.2.16:50326 -> 82.79.35.202:2121
Source: global traffic	TCP traffic: 192.168.2.16:50328 -> 125.247.204.97:2121
Source: global traffic	TCP traffic: 192.168.2.16:50330 -> 165.227.135.59:2121
Source: global traffic	TCP traffic: 192.168.2.16:50332 -> 65.60.157.69:2121
Source: global traffic	TCP traffic: 192.168.2.16:50334 -> 175.116.228.90:2121
Source: global traffic	TCP traffic: 192.168.2.16:50336 -> 58.37.12.209:2121
Source: global traffic	TCP traffic: 192.168.2.16:50345 -> 68.144.255.196:2121
Source: global traffic	TCP traffic: 192.168.2.16:50347 -> 219.249.223.42:2121
Source: global traffic	TCP traffic: 192.168.2.16:50349 -> 197.8.254.242:2121
Source: global traffic	TCP traffic: 192.168.2.16:50351 -> 174.79.38.52:2121
Source: global traffic	TCP traffic: 192.168.2.16:50353 -> 23.1.29.50:2121
Source: global traffic	TCP traffic: 192.168.2.16:50355 -> 141.156.239.196:2121
Source: global traffic	TCP traffic: 192.168.2.16:50357 -> 181.170.184.192:2121
Source: global traffic	TCP traffic: 192.168.2.16:50359 -> 109.136.157.146:2121
Source: global traffic	TCP traffic: 192.168.2.16:50361 -> 27.18.69.179:2121
Source: global traffic	TCP traffic: 192.168.2.16:50363 -> 59.92.247.174:2121
Source: global traffic	TCP traffic: 192.168.2.16:50366 -> 117.147.255.88:2121
Source: global traffic	TCP traffic: 192.168.2.16:50367 -> 66.57.225.25:2121
Source: global traffic	TCP traffic: 192.168.2.16:50369 -> 70.173.246.183:2121
Source: global traffic	TCP traffic: 192.168.2.16:50371 -> 104.83.35.248:2121
Source: global traffic	TCP traffic: 192.168.2.16:50373 -> 73.68.146.88:2121
Source: global traffic	TCP traffic: 192.168.2.16:50377 -> 82.180.72.40:2121
Source: global traffic	TCP traffic: 192.168.2.16:50379 -> 126.1.45.71:2121
Source: global traffic	TCP traffic: 192.168.2.16:50380 -> 75.238.200.198:2121
Source: global traffic	TCP traffic: 192.168.2.16:50383 -> 219.68.211.98:2121
Source: global traffic	TCP traffic: 192.168.2.16:50385 -> 218.228.65.115:2121
Source: global traffic	TCP traffic: 192.168.2.16:50387 -> 83.57.150.95:2121
Source: global traffic	TCP traffic: 192.168.2.16:50392 -> 76.89.108.36:2121
Source: global traffic	TCP traffic: 192.168.2.16:50393 -> 189.70.118.127:2121
Source: global traffic	TCP traffic: 192.168.2.16:50398 -> 168.81.231.66:2121
Source: global traffic	TCP traffic: 192.168.2.16:50402 -> 47.236.184.40:2121
Source: global traffic	TCP traffic: 192.168.2.16:50405 -> 220.71.176.141:2121
Source: global traffic	TCP traffic: 192.168.2.16:50406 -> 104.121.16.7:2121
Source: global traffic	TCP traffic: 192.168.2.16:50408 -> 115.11.79.59:2121
Source: global traffic	TCP traffic: 192.168.2.16:50409 -> 112.147.13.3:2121
Source: global traffic	TCP traffic: 192.168.2.16:50412 -> 79.147.28.191:2121
Source: global traffic	TCP traffic: 192.168.2.16:50414 -> 178.192.70.16:2121
Source: global traffic	TCP traffic: 192.168.2.16:50416 -> 108.21.188.121:2121
Source: global traffic	TCP traffic: 192.168.2.16:50419 -> 84.26.50.147:2121
Source: global traffic	TCP traffic: 192.168.2.16:50421 -> 60.122.110.91:2121
Source: global traffic	TCP traffic: 192.168.2.16:50422 -> 27.7.8.56:2121
Source: global traffic	TCP traffic: 192.168.2.16:50423 -> 39.65.232.109:2121
Source: global traffic	TCP traffic: 192.168.2.16:50427 -> 46.89.57.220:2121
Source: global traffic	TCP traffic: 192.168.2.16:50429 -> 71.192.97.248:2121
Source: global traffic	TCP traffic: 192.168.2.16:50431 -> 14.61.202.134:2121
Source: global traffic	TCP traffic: 192.168.2.16:50433 -> 24.86.223.52:2121
Source: global traffic	TCP traffic: 192.168.2.16:50436 -> 115.1.152.253:2121
Source: global traffic	TCP traffic: 192.168.2.16:50438 -> 151.224.102.22:2121
Source: global traffic	TCP traffic: 192.168.2.16:50440 -> 110.49.63.132:2121
Source: global traffic	TCP traffic: 192.168.2.16:50442 -> 93.224.25.244:2121
Source: global traffic	TCP traffic: 192.168.2.16:50444 -> 67.162.131.234:2121
Source: global traffic	TCP traffic: 192.168.2.16:50446 -> 110.246.88.180:2121
Source: global traffic	TCP traffic: 192.168.2.16:50450 -> 174.27.167.255:2121
Source: global traffic	TCP traffic: 192.168.2.16:50451 -> 23.27.21.247:2121
Source: global traffic	TCP traffic: 192.168.2.16:50452 -> 175.241.55.242:2121
Source: global traffic	TCP traffic: 192.168.2.16:50454 -> 73.25.54.119:2121
Source: global traffic	TCP traffic: 192.168.2.16:50456 -> 60.53.210.99:2121
Source: global traffic	TCP traffic: 192.168.2.16:50458 -> 218.56.222.188:2121
Source: global traffic	TCP traffic: 192.168.2.16:50460 -> 125.120.130.52:2121
Source: global traffic	TCP traffic: 192.168.2.16:50462 -> 86.30.180.122:2121
Source: global traffic	TCP traffic: 192.168.2.16:50464 -> 27.117.127.209:2121
Source: global traffic	TCP traffic: 192.168.2.16:50468 -> 134.238.198.128:2121
Source: global traffic	TCP traffic: 192.168.2.16:50469 -> 122.173.239.62:2121
Source: global traffic	TCP traffic: 192.168.2.16:50470 -> 126.237.161.134:2121
Source: global traffic	TCP traffic: 192.168.2.16:50472 -> 188.83.164.192:2121
Source: global traffic	TCP traffic: 192.168.2.16:50474 -> 24.131.164.226:2121
Source: global traffic	TCP traffic: 192.168.2.16:50475 -> 36.26.159.46:2121
Source: global traffic	TCP traffic: 192.168.2.16:50478 -> 78.101.135.91:2121
Source: global traffic	TCP traffic: 192.168.2.16:50480 -> 183.99.74.58:2121
Source: global traffic	TCP traffic: 192.168.2.16:50482 -> 119.185.119.239:2121
Source: global traffic	TCP traffic: 192.168.2.16:50484 -> 184.68.210.101:2121
Source: global traffic	TCP traffic: 192.168.2.16:50486 -> 217.238.127.243:2121
Source: global traffic	TCP traffic: 192.168.2.16:50489 -> 69.255.145.154:2121
Source: global traffic	TCP traffic: 192.168.2.16:50490 -> 210.131.155.110:2121
Source: global traffic	TCP traffic: 192.168.2.16:50492 -> 113.24.67.53:2121
Source: global traffic	TCP traffic: 192.168.2.16:50494 -> 60.151.63.142:2121
Source: global traffic	TCP traffic: 192.168.2.16:50496 -> 189.106.23.71:2121
Source: global traffic	TCP traffic: 192.168.2.16:50498 -> 121.190.67.79:2121
Source: global traffic	TCP traffic: 192.168.2.16:50500 -> 81.154.91.122:2121
Source: global traffic	TCP traffic: 192.168.2.16:50501 -> 68.2.237.24:2121
Source: global traffic	TCP traffic: 192.168.2.16:50504 -> 181.208.58.40:2121
Source: global traffic	TCP traffic: 192.168.2.16:50506 -> 47.196.20.197:2121
Source: global traffic	TCP traffic: 192.168.2.16:50508 -> 118.46.121.98:2121
Source: global traffic	TCP traffic: 192.168.2.16:50512 -> 20.172.220.30:2121
Source: global traffic	TCP traffic: 192.168.2.16:50513 -> 104.17.88.189:2121
Source: global traffic	TCP traffic: 192.168.2.16:50515 -> 154.81.34.141:2121
Source: global traffic	TCP traffic: 192.168.2.16:50519 -> 60.137.5.118:2121
Source: global traffic	TCP traffic: 192.168.2.16:50522 -> 116.33.122.235:2121
Source: global traffic	TCP traffic: 192.168.2.16:50525 -> 220.95.156.86:2121
Source: global traffic	TCP traffic: 192.168.2.16:50529 -> 85.167.167.80:2121
Source: global traffic	TCP traffic: 192.168.2.16:50534 -> 2.217.228.54:2121
Source: global traffic	TCP traffic: 192.168.2.16:50539 -> 187.208.244.80:2121
Source: global traffic	TCP traffic: 192.168.2.16:50541 -> 175.121.86.174:2121
Source: global traffic	TCP traffic: 192.168.2.16:50546 -> 188.172.30.125:2121
Source: global traffic	TCP traffic: 192.168.2.16:50550 -> 108.15.160.47:2121
Source: global traffic	TCP traffic: 192.168.2.16:50554 -> 101.80.45.13:2121
Source: global traffic	TCP traffic: 192.168.2.16:50557 -> 173.176.244.243:2121
Source: global traffic	TCP traffic: 192.168.2.16:50559 -> 209.183.141.21:2121
Source: global traffic	TCP traffic: 192.168.2.16:50563 -> 117.122.241.177:2121
Source: global traffic	TCP traffic: 192.168.2.16:50565 -> 83.76.172.75:2121
Source: global traffic	TCP traffic: 192.168.2.16:50566 -> 165.169.125.137:2121
Source: global traffic	TCP traffic: 192.168.2.16:50569 -> 74.215.88.154:2121
Source: global traffic	TCP traffic: 192.168.2.16:50571 -> 168.100.203.193:2121
Source: global traffic	TCP traffic: 192.168.2.16:50575 -> 217.121.103.26:2121
Source: global traffic	TCP traffic: 192.168.2.16:50579 -> 119.130.67.138:2121
Source: global traffic	TCP traffic: 192.168.2.16:50582 -> 99.245.238.42:2121
Source: global traffic	TCP traffic: 192.168.2.16:50587 -> 122.117.36.51:2121
Source: global traffic	TCP traffic: 192.168.2.16:50589 -> 18.238.193.209:2121
Source: global traffic	TCP traffic: 192.168.2.16:50591 -> 47.147.17.78:2121
Source: global traffic	TCP traffic: 192.168.2.16:50593 -> 105.98.9.48:2121
Source: global traffic	TCP traffic: 192.168.2.16:50595 -> 31.167.145.83:2121
Source: global traffic	TCP traffic: 192.168.2.16:50597 -> 98.53.167.176:2121
Source: global traffic	TCP traffic: 192.168.2.16:50599 -> 175.228.191.237:2121
Source: global traffic	TCP traffic: 192.168.2.16:50601 -> 87.56.22.23:2121
Source: global traffic	TCP traffic: 192.168.2.16:50603 -> 80.184.105.246:2121
Source: global traffic	TCP traffic: 192.168.2.16:50605 -> 220.94.220.101:2121
Source: global traffic	TCP traffic: 192.168.2.16:50608 -> 189.82.4.46:2121
Source: global traffic	TCP traffic: 192.168.2.16:50609 -> 93.211.90.41:2121
Source: global traffic	TCP traffic: 192.168.2.16:50611 -> 174.57.15.124:2121
Source: global traffic	TCP traffic: 192.168.2.16:50615 -> 93.200.149.130:2121
Source: global traffic	TCP traffic: 192.168.2.16:50614 -> 201.50.159.167:2121
Source: global traffic	TCP traffic: 192.168.2.16:50617 -> 75.203.63.250:2121
Source: global traffic	TCP traffic: 192.168.2.16:50620 -> 94.248.198.31:2121
Source: global traffic	TCP traffic: 192.168.2.16:50621 -> 24.240.231.180:2121
Source: global traffic	TCP traffic: 192.168.2.16:50623 -> 121.188.219.78:2121
Source: global traffic	TCP traffic: 192.168.2.16:50625 -> 182.210.166.181:2121
Source: global traffic	TCP traffic: 192.168.2.16:50627 -> 96.5.195.29:2121
Source: global traffic	TCP traffic: 192.168.2.16:50631 -> 222.134.112.234:2121
Source: global traffic	TCP traffic: 192.168.2.16:50633 -> 118.241.147.202:2121
Source: global traffic	TCP traffic: 192.168.2.16:50635 -> 203.169.193.41:2121
Source: global traffic	TCP traffic: 192.168.2.16:50637 -> 117.223.205.236:2121
Source: global traffic	TCP traffic: 192.168.2.16:50639 -> 196.185.118.50:2121
Source: global traffic	TCP traffic: 192.168.2.16:50641 -> 173.94.208.111:2121
Source: global traffic	TCP traffic: 192.168.2.16:50642 -> 71.28.130.111:2121
Source: global traffic	TCP traffic: 192.168.2.16:50645 -> 118.201.139.137:2121
Source: global traffic	TCP traffic: 192.168.2.16:50647 -> 114.199.191.58:2121
Source: global traffic	TCP traffic: 192.168.2.16:50649 -> 96.110.124.89:2121
Source: global traffic	TCP traffic: 192.168.2.16:50651 -> 149.165.129.10:2121
Source: global traffic	TCP traffic: 192.168.2.16:50654 -> 117.55.191.68:2121
Source: global traffic	TCP traffic: 192.168.2.16:50658 -> 185.187.236.74:2121
Source: global traffic	TCP traffic: 192.168.2.16:50660 -> 150.249.78.235:2121
Source: global traffic	TCP traffic: 192.168.2.16:50662 -> 23.199.47.76:2121
Source: global traffic	TCP traffic: 192.168.2.16:50667 -> 182.215.181.166:2121
Source: global traffic	TCP traffic: 192.168.2.16:50671 -> 124.171.67.161:2121
Source: global traffic	TCP traffic: 192.168.2.16:50674 -> 114.253.195.224:2121
Source: global traffic	TCP traffic: 192.168.2.16:50676 -> 41.249.84.185:2121
Source: global traffic	TCP traffic: 192.168.2.16:50678 -> 62.194.129.219:2121
Source: global traffic	TCP traffic: 192.168.2.16:50680 -> 187.93.61.109:2121
Source: global traffic	TCP traffic: 192.168.2.16:50682 -> 20.82.244.57:2121
Source: global traffic	TCP traffic: 192.168.2.16:50684 -> 91.124.109.201:2121
Source: global traffic	TCP traffic: 192.168.2.16:50686 -> 89.146.194.41:2121
Source: global traffic	TCP traffic: 192.168.2.16:50688 -> 74.199.143.226:2121
Source: global traffic	TCP traffic: 192.168.2.16:50691 -> 188.83.33.111:2121
Source: global traffic	TCP traffic: 192.168.2.16:50693 -> 5.157.128.113:2121
Source: global traffic	TCP traffic: 192.168.2.16:50695 -> 88.203.169.112:2121
Source: global traffic	TCP traffic: 192.168.2.16:50697 -> 153.166.130.220:2121
Source: global traffic	TCP traffic: 192.168.2.16:50699 -> 220.71.50.238:2121
Source: global traffic	TCP traffic: 192.168.2.16:50702 -> 148.255.21.179:2121
Source: global traffic	TCP traffic: 192.168.2.16:50704 -> 104.19.117.184:2121
Source: global traffic	TCP traffic: 192.168.2.16:50706 -> 5.161.14.111:2121
Source: global traffic	TCP traffic: 192.168.2.16:50708 -> 125.161.237.221:2121
Source: global traffic	TCP traffic: 192.168.2.16:50711 -> 13.114.86.103:2121
Source: global traffic	TCP traffic: 192.168.2.16:50712 -> 113.211.46.82:2121
Source: global traffic	TCP traffic: 192.168.2.16:50714 -> 73.188.101.101:2121
Source: global traffic	TCP traffic: 192.168.2.16:50717 -> 89.217.82.219:2121
Source: global traffic	TCP traffic: 192.168.2.16:50719 -> 100.25.239.63:2121
Source: global traffic	TCP traffic: 192.168.2.16:50723 -> 125.132.248.234:2121
Source: global traffic	TCP traffic: 192.168.2.16:50721 -> 139.193.23.42:2121
Source: global traffic	TCP traffic: 192.168.2.16:50726 -> 37.209.172.36:2121
Source: global traffic	TCP traffic: 192.168.2.16:50728 -> 124.162.52.179:2121
Source: global traffic	TCP traffic: 192.168.2.16:50729 -> 14.95.143.135:2121
Source: global traffic	TCP traffic: 192.168.2.16:50730 -> 222.97.72.53:2121
Source: global traffic	TCP traffic: 192.168.2.16:50732 -> 146.112.45.212:2121
Source: global traffic	TCP traffic: 192.168.2.16:50734 -> 82.14.81.130:2121
Source: global traffic	TCP traffic: 192.168.2.16:50736 -> 5.146.116.46:2121
Source: global traffic	TCP traffic: 192.168.2.16:50738 -> 91.148.140.11:2121
Source: global traffic	TCP traffic: 192.168.2.16:50740 -> 103.221.228.41:2121
Source: global traffic	TCP traffic: 192.168.2.16:50742 -> 179.24.77.182:2121
Source: global traffic	TCP traffic: 192.168.2.16:50744 -> 216.212.41.244:2121
Source: global traffic	TCP traffic: 192.168.2.16:50747 -> 121.173.245.205:2121
Source: global traffic	TCP traffic: 192.168.2.16:50749 -> 107.180.163.199:2121
Source: global traffic	TCP traffic: 192.168.2.16:50750 -> 174.84.63.229:2121
Source: global traffic	TCP traffic: 192.168.2.16:50752 -> 187.224.87.250:2121
Source: global traffic	TCP traffic: 192.168.2.16:50754 -> 191.6.221.165:2121
Source: global traffic	TCP traffic: 192.168.2.16:50756 -> 58.226.219.111:2121
Source: global traffic	TCP traffic: 192.168.2.16:50758 -> 185.108.141.19:2121
Source: global traffic	TCP traffic: 192.168.2.16:50762 -> 50.103.197.66:2121
Source: global traffic	TCP traffic: 192.168.2.16:50765 -> 138.248.244.221:2121
Source: global traffic	TCP traffic: 192.168.2.16:50771 -> 81.8.54.42:2121
Source: global traffic	TCP traffic: 192.168.2.16:50776 -> 88.201.125.24:2121
Source: global traffic	TCP traffic: 192.168.2.16:50778 -> 220.75.162.147:2121
Source: global traffic	TCP traffic: 192.168.2.16:50782 -> 160.121.125.199:2121
Source: global traffic	TCP traffic: 192.168.2.16:50783 -> 68.87.13.200:2121

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1

Source: Joe Sandbox View

ASN Name: CHINA169-BACKBONECHINAUNICOMChina169BackboneCN CHINA169-BACKBONECHINAUNICOMChina169BackboneCN

Source: unknown

FTP traffic detected: 38.38.120.85:21 -> 192.168.2.16:49729 220---------- Welcome to Pure-FTPd [privsep] [TLS] ---------- 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 12 of 50 allowed. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 12 of 50 allowed.220-Local time is now 14:41. Server port: 21. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 12 of 50 allowed.220-Local time is now 14:41. Server port: 21.220-This is a private system - No anonymous login 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 12 of 50 allowed.220-Local time is now 14:41. Server port: 21.220-This is a private system - No anonymous login220-IPv6 connections are also welcome on this server. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 12 of 50 allowed.220-Local time is now 14:41. Server port: 21.220-This is a private system - No anonymous login220-IPv6 connections are also welcome on this server.220 You will be disconnected after 15 minutes of inactivity.

Source: unknown	TCP traffic detected without corresponding DNS query: 202.141.230.46
Source: unknown	TCP traffic detected without corresponding DNS query: 88.3.252.23
Source: unknown	TCP traffic detected without corresponding DNS query: 202.141.230.46
Source: unknown	TCP traffic detected without corresponding DNS query: 187.232.63.30
Source: unknown	TCP traffic detected without corresponding DNS query: 187.232.63.30
Source: unknown	TCP traffic detected without corresponding DNS query: 88.3.252.23
Source: unknown	TCP traffic detected without corresponding DNS query: 88.138.242.230
Source: unknown	TCP traffic detected without corresponding DNS query: 88.138.242.230
Source: unknown	TCP traffic detected without corresponding DNS query: 117.3.236.203
Source: unknown	TCP traffic detected without corresponding DNS query: 117.3.236.203
Source: unknown	TCP traffic detected without corresponding DNS query: 220.174.66.41
Source: unknown	TCP traffic detected without corresponding DNS query: 220.174.66.41
Source: unknown	TCP traffic detected without corresponding DNS query: 190.199.135.222
Source: unknown	TCP traffic detected without corresponding DNS query: 190.199.135.222
Source: unknown	TCP traffic detected without corresponding DNS query: 20.27.129.45
Source: unknown	TCP traffic detected without corresponding DNS query: 20.27.129.45
Source: unknown	TCP traffic detected without corresponding DNS query: 45.225.213.66
Source: unknown	TCP traffic detected without corresponding DNS query: 45.225.213.66
Source: unknown	TCP traffic detected without corresponding DNS query: 98.144.80.128
Source: unknown	TCP traffic detected without corresponding DNS query: 98.144.80.128
Source: unknown	TCP traffic detected without corresponding DNS query: 51.241.196.118
Source: unknown	TCP traffic detected without corresponding DNS query: 51.241.196.118
Source: unknown	TCP traffic detected without corresponding DNS query: 119.176.139.75
Source: unknown	TCP traffic detected without corresponding DNS query: 119.176.139.75
Source: unknown	TCP traffic detected without corresponding DNS query: 38.38.120.85
Source: unknown	TCP traffic detected without corresponding DNS query: 38.38.120.85
Source: unknown	TCP traffic detected without corresponding DNS query: 187.137.19.229
Source: unknown	TCP traffic detected without corresponding DNS query: 187.137.19.229
Source: unknown	TCP traffic detected without corresponding DNS query: 109.130.248.23
Source: unknown	TCP traffic detected without corresponding DNS query: 109.130.248.23
Source: unknown	TCP traffic detected without corresponding DNS query: 34.128.248.69
Source: unknown	TCP traffic detected without corresponding DNS query: 34.128.248.69
Source: unknown	TCP traffic detected without corresponding DNS query: 121.132.64.213
Source: unknown	TCP traffic detected without corresponding DNS query: 121.132.64.213
Source: unknown	TCP traffic detected without corresponding DNS query: 20.99.154.51
Source: unknown	TCP traffic detected without corresponding DNS query: 20.99.154.51
Source: unknown	TCP traffic detected without corresponding DNS query: 122.17.56.127
Source: unknown	TCP traffic detected without corresponding DNS query: 122.17.56.127
Source: unknown	TCP traffic detected without corresponding DNS query: 60.137.216.231
Source: unknown	TCP traffic detected without corresponding DNS query: 60.137.216.231
Source: unknown	TCP traffic detected without corresponding DNS query: 174.49.126.122
Source: unknown	TCP traffic detected without corresponding DNS query: 217.73.16.9
Source: unknown	TCP traffic detected without corresponding DNS query: 217.73.16.9
Source: unknown	TCP traffic detected without corresponding DNS query: 72.240.221.220
Source: unknown	TCP traffic detected without corresponding DNS query: 174.49.126.122
Source: unknown	TCP traffic detected without corresponding DNS query: 72.240.221.220
Source: unknown	TCP traffic detected without corresponding DNS query: 122.234.24.202
Source: unknown	TCP traffic detected without corresponding DNS query: 122.234.24.202
Source: unknown	TCP traffic detected without corresponding DNS query: 134.130.247.222
Source: unknown	TCP traffic detected without corresponding DNS query: 134.130.247.222

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1

Source: global traffic	DNS traffic detected: DNS query: dht.transmissionbt.com
Source: global traffic	DNS traffic detected: DNS query: xmr.crypto-pool.fr
Source: global traffic	DNS traffic detected: DNS query: router.bittorrent.com
Source: global traffic	DNS traffic detected: DNS query: router.utorrent.com
Source: global traffic	DNS traffic detected: DNS query: bttracker.debian.org

Source: 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000011.00000003.1548318526.0000000002A98000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000015.00000003.1665319094.00000000036C4000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001B.00000003.1583344375.00000000029EC000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001B.00000003.1586418626.0000000002A71000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001B.00000002.1594865111.0000000002A7B000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001F.00000002.1645792869.0000000002F38000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001F.00000003.1633383367.0000000002F1F000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 00000021.00000002.2387784874.0000000001632000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://breakingcode.wordpress.com/)
Source: 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000011.00000002.1558860257.00000000030F4000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000011.00000003.1548509909.0000000003181000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000011.00000002.1558930870.0000000003181000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000011.00000003.1552585942.00000000030F2000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000011.00000003.1546141632.00000000030D0000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000015.00000003.1665420021.0000000003313000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000015.00000003.1670072570.0000000003369000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000015.00000002.1680758614.00000000036C0000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000015.00000002.1680550064.0000000003369000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001B.00000002.1592700989.0000000002698000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001B.00000003.1582978042.000000000267F000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001B.00000003.1589010203.0000000002BB1000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001B.00000003.1584262772.0000000002BAE000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001B.00000002.1596516460.0000000002BB2000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001F.00000002.1645792869.0000000002F38000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001F.00000002.1651816131.00000000034BF000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001F.00000003.1636684856.00000000034BE000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001F.00000003.1633383367.0000000002F1F000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 00000021.00000002.2387784874.00000000016AD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://bugs.python.org/issue6973.
Source: svchost.exe, 00000002.00000002.2383234692.0000017C95800000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000011.00000003.1546141632.000000000301A000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000011.00000003.1551169694.00000000030A9000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000015.00000002.1680902276.0000000003760000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000015.00000003.1663756315.00000000036CD000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001B.00000002.1595079338.0000000002AC1000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001F.00000002.1649970812.00000000033D1000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 00000021.00000002.2401785898.00000000017B1000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 00000021.00000002.2387784874.00000000016AD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.python.org/3/library/functools.html#functools.lru_cache
Source: 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000011.00000002.1558860257.00000000030F4000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000011.00000003.1548509909.0000000003181000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000011.00000002.1558930870.0000000003181000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000011.00000003.1552585942.00000000030F2000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000011.00000003.1546141632.00000000030D0000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000015.00000003.1665420021.0000000003313000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000015.00000003.1670072570.0000000003369000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000015.00000002.1680758614.00000000036C0000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000015.00000002.1680550064.0000000003369000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001B.00000002.1592700989.0000000002698000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001B.00000003.1582978042.000000000267F000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001B.00000003.1589010203.0000000002BB1000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001B.00000003.1584262772.0000000002BAE000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001B.00000002.1596516460.0000000002BB2000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001F.00000002.1645792869.0000000002F38000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001F.00000002.1651816131.00000000034BF000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001F.00000003.1636684856.00000000034BE000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001F.00000003.1633383367.0000000002F1F000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 00000021.00000002.2387784874.00000000016AD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.python.org/3/library/subprocess.html
Source: 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000011.00000003.1548688208.0000000002C44000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000011.00000003.1552585942.00000000030EF000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000011.00000002.1558160428.0000000002C83000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000011.00000003.1546141632.00000000030D0000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000015.00000003.1665420021.0000000003313000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000015.00000003.1670072570.0000000003321000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000015.00000003.1666841335.00000000036C2000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000015.00000002.1680824552.00000000036C3000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001B.00000003.1586142862.00000000029BA000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001B.00000002.1595079338.0000000002AC1000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001F.00000002.1649970812.00000000033D1000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001F.00000003.1639282818.00000000032E6000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001F.00000002.1648805788.00000000032F4000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 00000021.00000002.2378968453.0000000001481000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 00000021.00000002.2401785898.00000000017B1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.python.org/library/socket.html#socket.setdefaulttimeout
Source: svchost.exe, 00000002.00000003.1202934326.0000017C956F0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000011.00000003.1551169694.00000000030C2000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000011.00000003.1546141632.000000000301A000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000011.00000003.1546141632.00000000030D0000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000015.00000002.1680902276.0000000003779000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000015.00000003.1663756315.00000000036CD000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001B.00000002.1595079338.0000000002AC1000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001F.00000002.1649970812.00000000033D1000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 00000021.00000002.2378968453.0000000001481000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 00000021.00000002.2401785898.00000000017B1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://goo.gl/zeJZl
Source: 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000011.00000002.1558160428.0000000002CBD000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000011.00000003.1548688208.0000000002C44000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000015.00000003.1665420021.0000000003313000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000015.00000003.1670072570.0000000003358000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001B.00000002.1595079338.0000000002AC1000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001F.00000002.1649970812.00000000033D1000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 00000021.00000002.2401785898.00000000017B1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://mail.python.org/pipermail/python-dev/2012-June/120787.html
Source: 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000011.00000003.1548318526.0000000002A98000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000015.00000003.1665319094.00000000036C4000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001B.00000003.1583344375.00000000029EC000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001B.00000003.1586418626.0000000002A71000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001B.00000002.1594865111.0000000002A7B000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001F.00000002.1645792869.0000000002F38000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001F.00000003.1633383367.0000000002F1F000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 00000021.00000002.2387784874.0000000001632000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://motomastyle.com/)
Source: 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000011.00000003.1548318526.0000000002A98000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000015.00000003.1665319094.00000000036C4000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001B.00000003.1583344375.00000000029EC000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001B.00000003.1586418626.0000000002A71000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001B.00000002.1594865111.0000000002A7B000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001F.00000002.1645792869.0000000002F38000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001F.00000003.1633383367.0000000002F1F000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 00000021.00000002.2387784874.0000000001632000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://pyloris.sourceforge.net/).
Source: 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000011.00000002.1566376619.000000006CF51000.00000040.00000001.01000000.00000009.sdmp	String found in binary or memory: http://python.org/dev/peps/pep-0263/
Source: 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000011.00000003.1551975369.0000000002B61000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000015.00000003.1669178757.000000000320E000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001B.00000003.1588099914.000000000294F000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001F.00000003.1642101744.000000000325F000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001F.00000002.1647155454.0000000003294000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 00000021.00000002.2387784874.0000000001632000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://tools.ietf.org/html/rfc6125#section-6.4.3
Source: svchost.exe, 00000005.00000002.1367139186.0000022BC8613000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.bingmapsportal.com
Source: 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000011.00000002.1558160428.0000000002CBD000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000011.00000003.1548688208.0000000002C44000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000011.00000002.1556111438.00000000029D1000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000015.00000003.1665420021.0000000003313000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000015.00000003.1671020242.0000000003320000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000015.00000002.1675197722.0000000003081000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001B.00000003.1583344375.00000000029EC000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001B.00000003.1586418626.0000000002A71000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001B.00000002.1591896001.00000000025C1000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001F.00000003.1634905823.00000000032FC000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001F.00000002.1644483289.0000000002E61000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001F.00000003.1639888476.0000000003384000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001F.00000002.1649735478.0000000003384000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 00000021.00000002.2378968453.0000000001481000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 00000021.00000002.2387784874.00000000016AD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.faqs.org/rfcs/rfc2822.html
Source: 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000011.00000002.1558160428.0000000002CBD000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000011.00000003.1548688208.0000000002C44000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000015.00000003.1665420021.0000000003313000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000015.00000003.1671020242.0000000003320000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001B.00000003.1583344375.00000000029EC000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001B.00000003.1586418626.0000000002A71000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001F.00000003.1634905823.00000000032FC000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001F.00000003.1639888476.0000000003384000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001F.00000002.1649735478.0000000003384000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 00000021.00000002.2387784874.00000000016AD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.faqs.org/rfcs/rfc822.html
Source: 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000011.00000003.1548688208.0000000002C44000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000011.00000002.1558160428.0000000002C83000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000015.00000002.1680550064.000000000337C000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000015.00000003.1665420021.000000000337C000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000015.00000003.1670072570.000000000337C000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001B.00000003.1583344375.00000000029EC000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001B.00000003.1586418626.0000000002A71000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001F.00000003.1634905823.00000000032FC000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001F.00000003.1639888476.0000000003384000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 00000021.00000002.2387784874.00000000016AD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-parameters-6
Source: 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000011.00000002.1563185803.000000006CCD1000.00000040.00000001.01000000.0000000E.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000011.00000002.1564482512.000000006CDE1000.00000040.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://www.openssl.org/support/faq.html
Source: 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000011.00000002.1563185803.000000006CCD1000.00000040.00000001.01000000.0000000E.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000011.00000002.1564482512.000000006CDE1000.00000040.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://www.openssl.org/support/faq.htmlC:
Source: 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000011.00000003.1548688208.0000000002BFD000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000015.00000002.1679910074.00000000032A2000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000015.00000003.1667406783.0000000003272000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001B.00000003.1583344375.00000000029EC000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001F.00000003.1634905823.00000000032FC000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 00000021.00000002.2378968453.0000000001481000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.python.org/
Source: 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000011.00000002.1558930870.0000000003170000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000011.00000003.1546141632.00000000030D0000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000015.00000003.1662182435.00000000037CE000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000015.00000002.1683781638.00000000037FE000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001B.00000003.1584262772.0000000002BAE000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001B.00000003.1589010203.0000000002C3C000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001F.00000003.1636684856.00000000034BE000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001F.00000002.1652574954.000000000354C000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 00000021.00000002.2401785898.00000000017B1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.python.org/dev/peps/pep-0205/
Source: cacerts.txt.26.dr	String found in binary or memory: http://www.valicert.com/
Source: svchost.exe, 00000005.00000003.1366654994.0000022BC8658000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://appexmapsappupdate.blob.core.windows.net
Source: svchost.exe, 00000005.00000002.1367299375.0000022BC8659000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000005.00000003.1366654994.0000022BC8658000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/V1/MapControlConfiguration/native/
Source: svchost.exe, 00000005.00000003.1366590796.0000022BC8662000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000005.00000003.1366521059.0000022BC866E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000005.00000003.1366629858.0000022BC865E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000005.00000003.1366654994.0000022BC8658000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000005.00000003.1366697386.0000022BC865A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Imagery/Copyright/
Source: svchost.exe, 00000005.00000003.1366654994.0000022BC8658000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Locations
Source: svchost.exe, 00000005.00000003.1366562208.0000022BC8667000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Routes/
Source: svchost.exe, 00000005.00000003.1366521059.0000022BC866E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Transit/Stops/
Source: svchost.exe, 00000005.00000003.1366654994.0000022BC8658000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.ditu.live.com/mapcontrol/logging.ashx
Source: svchost.exe, 00000005.00000002.1367256135.0000022BC863F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000005.00000003.1366809213.0000022BC8665000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000005.00000003.1366590796.0000022BC8662000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000005.00000003.1366654994.0000022BC8658000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000005.00000003.1366697386.0000022BC865A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Imagery/Copyright/
Source: svchost.exe, 00000005.00000003.1366654994.0000022BC8658000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Locations
Source: svchost.exe, 00000005.00000003.1366562208.0000022BC8667000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000005.00000002.1367193039.0000022BC862B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/
Source: svchost.exe, 00000005.00000003.1366654994.0000022BC8658000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Driving
Source: svchost.exe, 00000005.00000003.1366654994.0000022BC8658000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Transit
Source: svchost.exe, 00000005.00000003.1366654994.0000022BC8658000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Walking
Source: svchost.exe, 00000005.00000003.1366809213.0000022BC8665000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000005.00000003.1366590796.0000022BC8662000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Traffic/Incidents/
Source: svchost.exe, 00000005.00000002.1367256135.0000022BC863F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Transit/Schedules/
Source: svchost.exe, 00000005.00000003.1366654994.0000022BC8658000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/mapcontrol/logging.ashx
Source: svchost.exe, 00000005.00000003.1366725627.0000022BC8643000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000005.00000003.1366590796.0000022BC8662000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/webservices/v1/LoggingService/LoggingService.svc/Log?
Source: svchost.exe, 00000005.00000003.1366771313.0000022BC8630000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000005.00000003.1366590796.0000022BC8662000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gd?pv=1&r=
Source: svchost.exe, 00000005.00000002.1367256135.0000022BC863F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gdi?pv=1&r=
Source: svchost.exe, 00000005.00000003.1366590796.0000022BC8662000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gdv?pv=1&r=
Source: svchost.exe, 00000005.00000003.1366725627.0000022BC8643000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gri?pv=1&r=
Source: svchost.exe, 00000005.00000002.1367211171.0000022BC8634000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dynamic.t
Source: svchost.exe, 00000005.00000003.1366654994.0000022BC8658000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dynamic.t0.tiles.ditu.live.com/comp/gen.ashx
Source: svchost.exe, 00000005.00000003.1366562208.0000022BC8667000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000005.00000002.1367193039.0000022BC862B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ecn.dev.virtualearth.net/REST/v1/Imagery/Copyright/
Source: svchost.exe, 00000002.00000003.1202934326.0000017C95763000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/Prod-C:
Source: svchost.exe, 00000002.00000003.1202934326.0000017C95752000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2-C:
Source: xmrig.exe, 0000002A.00000002.2360410503.0000000000401000.00000040.00000001.01000000.0000004C.sdmp	String found in binary or memory: https://gcc.gnu.org/bugs/):
Source: 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000010.00000003.1530246873.0000000000ED1000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000010.00000003.1529000361.0000000000ED1000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000010.00000003.1531972082.0000000000ED1000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000010.00000003.1532860752.0000000000ED1000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000010.00000003.1532421943.0000000000EE0000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000010.00000003.1531677393.0000000000ED1000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000010.00000003.1532570933.0000000000ED1000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000010.00000003.1532515689.0000000000ED1000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000011.00000002.1563108682.000000001ECC0000.00000004.00000001.01000000.00000011.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000011.00000002.1562417397.000000001E7DD000.00000004.00000001.01000000.00000015.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000011.00000002.1562233172.000000001E7C2000.00000004.00000001.01000000.00000012.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000011.00000002.1562730939.000000001E8E0000.00000004.00000001.01000000.00000013.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000011.00000002.1562906331.000000001E9BC000.00000004.00000001.01000000.00000014.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000014.00000003.1553069270.0000000000F04000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000014.00000003.1549305574.0000000000F01000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000014.00000003.1552714327.0000000000F07000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000014.00000003.1552982239.0000000000F01000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000014.00000003.1550802524.0000000000F09000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000014.00000003.1553307900.0000000000F03000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000014.00000003.1551812101.0000000000F03000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000014.00000003.1552838551.0000000000F11000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mhammond/pywin320
Source: 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000011.00000003.1548688208.0000000002BFD000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000015.00000002.1679910074.00000000032A2000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000015.00000003.1667406783.0000000003272000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001B.00000003.1583344375.00000000029EC000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001F.00000003.1634905823.00000000032FC000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 00000021.00000002.2378968453.0000000001481000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mahler:8092/site-updates.py
Source: svchost.exe, 00000005.00000003.1366725627.0000022BC8643000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/comp/gen.ashx
Source: svchost.exe, 00000005.00000003.1366710386.0000022BC864B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gd?pv=1&r=
Source: svchost.exe, 00000005.00000003.1366757942.0000022BC863D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000005.00000002.1367299375.0000022BC8659000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000005.00000003.1366725627.0000022BC8643000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000005.00000003.1366710386.0000022BC864B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000005.00000003.1366654994.0000022BC8658000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdi?pv=1&r=
Source: svchost.exe, 00000005.00000003.1366642622.0000022BC865D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdv?pv=1&r=
Source: svchost.exe, 00000005.00000002.1367193039.0000022BC862B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gri?pv=1&r=
Source: svchost.exe, 00000005.00000003.1366654994.0000022BC8658000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t0.ssl.ak.tiles.virtualearth.net/tiles/gen
Source: svchost.exe, 00000005.00000002.1367299375.0000022BC8659000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000005.00000003.1366654994.0000022BC8658000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tiles.virtualearth.net/tiles/cmd/StreetSideBubbleMetaData?north=
Source: 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000011.00000002.1558930870.0000000003145000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000011.00000003.1546141632.00000000030D0000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000015.00000002.1683781638.00000000037D3000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000015.00000003.1662182435.00000000037CE000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001B.00000003.1589010203.0000000002C0A000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001B.00000003.1584262772.0000000002BAE000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001F.00000003.1636684856.00000000034BE000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001F.00000002.1652574954.000000000351A000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 00000021.00000002.2401785898.00000000017B1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/accounts/ClientLogin
Source: 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000015.00000003.1662182435.00000000037CE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/accounts/ClientLoginR

Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe

Code function: 17_2_1E8C36D0 PyArg_ParseTuple,PyEval_SaveThread,GetKeyboardState,PyEval_RestoreThread,?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z,PyString_FromStringAndSize,

17_2_1E8C36D0

Spam, unwanted Advertisements and Ransom Demands

Writes many files with high entropy

Source: C:\Program Files\7-Zip\7zG.exe	File created: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.zip entropy: 7.99997038378	Jump to dropped file
Source: C:\Program Files\7-Zip\7zG.exe	File created: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe entropy: 7.99271522496	Jump to dropped file
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI71562\_ssl.pyd entropy: 7.99647189671	Jump to dropped file
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI71562\_hashlib.pyd entropy: 7.99655727617	Jump to dropped file
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI71562\python27.dll entropy: 7.99025694692	Jump to dropped file
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI59482\_hashlib.pyd entropy: 7.99655727617	Jump to dropped file
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI59482\_ssl.pyd entropy: 7.99647189671	Jump to dropped file
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI59482\python27.dll entropy: 7.99025694692	Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Users\user\HelpPane.exe entropy: 7.99271522496	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI64762\_hashlib.pyd entropy: 7.99655727617	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI64762\_ssl.pyd entropy: 7.99647189671	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI64762\python27.dll entropy: 7.99025694692	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI13602\python27.dll entropy: 7.99025694692	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI13602\_hashlib.pyd entropy: 7.99655727617	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI13602\_ssl.pyd entropy: 7.99647189671	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Windows\Temp\_MEI29202\_hashlib.pyd entropy: 7.99655727617	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Windows\Temp\_MEI29202\_ssl.pyd entropy: 7.99647189671	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Windows\Temp\_MEI29202\python27.dll entropy: 7.99025694692	Jump to dropped file

Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe

Code function: 17_2_1ECB1D10 PyArg_ParseTuple,?PyWinObject_AsSECURITY_ATTRIBUTES@@YAHPAU_object@@PAPAU_SECURITY_ATTRIBUTES@@H@Z,?PyWinObject_AsWCHAR@@YAHPAU_object@@PAPA_WHPAK@Z,CreateDesktopW,GetLastError,?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z,?PyWinObject_FreeWCHAR@@YAXPA_W@Z,

17_2_1ECB1D10

System Summary

Malicious sample detected (through community Yara rule)

Source: 42.2.xmrig.exe.400000.0.unpack, type: UNPACKEDPE

Matched rule: Detects Monero Crypto Coin Miner Author: Florian Roth

Creates files with lurking names (e.g. Crack.exe)

Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI71562\ftpcrack.exe.manifest	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI59482\ftpcrack.exe.manifest	Jump to behavior
Source: C:\Users\user\HelpPane.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI64762\ftpcrack.exe.manifest	Jump to behavior
Source: C:\Users\user\HelpPane.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI13602\ftpcrack.exe.manifest	Jump to behavior
Source: C:\Users\user\HelpPane.exe	File created: C:\Windows\TEMP\_MEI29202\ftpcrack.exe.manifest	Jump to behavior

Drops password protected ZIP file

Source: 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.zip.8.dr

Zip Entry: encrypted

Source: C:\Users\user\HelpPane.exe

Process Stats: CPU usage > 24%

Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 17_2_03412190 PyList_New,GetActiveProcessorCount,PyErr_SetFromWindowsErr,PyExc_RuntimeError,PyErr_SetString,PyErr_NoMemory,NtQuerySystemInformation,Py_BuildValue,PyList_Append,73BB3B4E,73BB3B4E,	17_2_03412190
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 17_2_03416970 CreateEventA,CreateEventA,CreateEventA,RtlInitializeCriticalSection,RtlEnterCriticalSection,GetProcessHeap,PyList_New,GetProcessHeap,HeapFree,GetProcessHeap,RtlAllocateHeap,NtQuerySystemInformation,PyErr_NoMemory,GetCurrentProcess,DuplicateHandle,GetProcessHeap,HeapFree,GetProcessHeap,RtlAllocateHeap,PyUnicodeUCS2_FromWideChar,PyList_Append,GetProcessHeap,HeapFree,CloseHandle,PyErr_SetFromWindowsErr,GetProcessHeap,HeapFree,CloseHandle,GetProcessHeap,HeapFree,RtlLeaveCriticalSection,	17_2_03416970
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 17_2_03416100 OpenProcess,GetCurrentProcess,IsWow64Process,IsWow64Process,IsWow64Process,PyErr_Clear,PyErr_Clear,NtQueryInformationProcess,ReadProcessMemory,ReadProcessMemory,ReadProcessMemory,PyErr_NoMemory,ReadProcessMemory,CloseHandle,CloseHandle,73BB3B4E,	17_2_03416100
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 17_2_03413920 PyArg_ParseTuple,NtSetInformationProcess,CloseHandle,_Py_NoneStruct,_Py_NoneStruct,	17_2_03413920
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 17_2_03415650 GetActiveProcessorCount,PyErr_SetFromWindowsErr,PyExc_RuntimeError,PyErr_SetString,PyErr_NoMemory,NtQuerySystemInformation,PyErr_NoMemory,NtQuerySystemInformation,PyErr_NoMemory,NtQuerySystemInformation,73BB3B4E,73BB3B4E,73BB3B4E,73BB3B4E,73BB3B4E,73BB3B4E,73BB3B4E,73BB3B4E,Py_BuildValue,	17_2_03415650
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 17_2_03412420 PyArg_ParseTuple,PyObject_IsTrue,NtSuspendProcess,NtResumeProcess,CloseHandle,_Py_NoneStruct,_Py_NoneStruct,	17_2_03412420
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 17_2_03411E30 GetProcessHeap,GetProcessHeap,RtlAllocateHeap,NtQueryVirtualMemory,GetProcessHeap,HeapFree,GetProcessHeap,RtlAllocateHeap,NtQueryVirtualMemory,PyExc_RuntimeError,PyErr_SetString,PyErr_Clear,GetProcessHeap,HeapFree,	17_2_03411E30
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 17_2_03415CD0 PyErr_NoMemory,73BB3B4E,NtQuerySystemInformation,73BB3B4E,PyErr_NoMemory,73BB3B4E,	17_2_03415CD0
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 17_2_03416880 WaitForSingleObject,SetEvent,WaitForSingleObject,NtQueryObject,SetEvent,	17_2_03416880
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 17_2_03416C80 PyList_New,RtlAllocateHeap,GetProcessHeap,HeapFree,GetProcessHeap,RtlAllocateHeap,NtQuerySystemInformation,CloseHandle,GetProcessHeap,HeapFree,PyErr_NoMemory,GetCurrentProcess,GetCurrentProcess,DuplicateHandle,CreateFileMappingA,MapViewOfFile,GetCurrentProcess,GetMappedFileNameA,PyUnicodeUCS2_FromWideChar,PyList_Append,UnmapViewOfFile,CloseHandle,CloseHandle,	17_2_03416C80
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 17_2_03413890 PyArg_ParseTuple,NtQueryInformationProcess,CloseHandle,Py_BuildValue,	17_2_03413890
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 17_2_034164B0 PyExc_RuntimeError,PyErr_SetString,OpenProcess,NtQueryInformationProcess,NtQueryInformationProcess,PyErr_NoMemory,73BB3B4E,CloseHandle,73BB3B4E,CloseHandle,	17_2_034164B0

Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe

Code function: 17_2_03413F40: PyDict_New,CreateFileA,DeviceIoControl,GetLastError,DeviceIoControl,__aulldiv,__aulldiv,Py_BuildValue,PyDict_SetItemString,GetLastError,GetLastError,GetLastError,CloseHandle,PyErr_SetFromWindowsErr,CloseHandle,

17_2_03413F40

Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe

Code function: 17_2_1ECB40C0 PyArg_ParseTuple,?PyWinObject_AsHANDLE@@YAHPAU_object@@PAPAX@Z,PyEval_SaveThread,DeleteService,PyEval_RestoreThread,?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z,_Py_NoneStruct,

17_2_1ECB40C0

Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 17_2_1E8C3FA0 PyArg_ParseTuple,PyEval_SaveThread,ExitWindowsEx,PyEval_RestoreThread,?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z,_Py_NoneStruct,_Py_NoneStruct,		17_2_1E8C3FA0
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 17_2_1E8C3F10 PyArg_ParseTuple,PyEval_SaveThread,ExitWindowsEx,PyEval_RestoreThread,?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z,_Py_NoneStruct,_Py_NoneStruct,		17_2_1E8C3F10

Source: C:\Windows\System32\svchost.exe	File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp			Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	File created: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\PeerDistRepub

Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 17_2_029B7890	17_2_029B7890
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 17_2_03412CC0	17_2_03412CC0
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 17_2_03421ED0	17_2_03421ED0
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 17_2_10002D19	17_2_10002D19
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 17_2_10001000	17_2_10001000
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 17_2_10001700	17_2_10001700
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 17_2_10001CB0	17_2_10001CB0
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 17_2_100014D0	17_2_100014D0
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 17_2_1E7C0FA0	17_2_1E7C0FA0
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 17_2_1E7DB690	17_2_1E7DB690
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 17_2_1E8DF120	17_2_1E8DF120
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 17_2_1E9BA490	17_2_1E9BA490
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 17_2_6CD06CC0	17_2_6CD06CC0
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 17_2_6CD68C90	17_2_6CD68C90
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 17_2_6CD04C18	17_2_6CD04C18
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 17_2_6CD66D60	17_2_6CD66D60
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 17_2_6CD66F80	17_2_6CD66F80
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 17_2_6CD84F70	17_2_6CD84F70
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 17_2_6CCDE8E0	17_2_6CCDE8E0
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 17_2_6CCF0930	17_2_6CCF0930
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 17_2_6CD06A80	17_2_6CD06A80
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 17_2_6CD66A70	17_2_6CD66A70
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 17_2_6CD50A60	17_2_6CD50A60
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 17_2_6CD04BDC	17_2_6CD04BDC
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 17_2_6CD7ABC0	17_2_6CD7ABC0
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 17_2_6CCE6B40	17_2_6CCE6B40
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 17_2_6CD04B40	17_2_6CD04B40
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 17_2_6CD66B40	17_2_6CD66B40
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 17_2_6CD7CB40	17_2_6CD7CB40
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 17_2_6CCEE6E0	17_2_6CCEE6E0
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 17_2_6CD82660	17_2_6CD82660
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 17_2_6CD687D0	17_2_6CD687D0
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 17_2_6CD667F0	17_2_6CD667F0
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 17_2_6CD82790	17_2_6CD82790
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 17_2_6CD32780	17_2_6CD32780
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 17_2_6CD6808C	17_2_6CD6808C
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 17_2_6CCE0060	17_2_6CCE0060
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 17_2_6CD68000	17_2_6CD68000
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 17_2_6CCFC1D0	17_2_6CCFC1D0
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 17_2_6CCE0190	17_2_6CCE0190
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 17_2_6CD66170	17_2_6CD66170
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 17_2_6CCEE160	17_2_6CCEE160
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 17_2_6CCE0100	17_2_6CCE0100
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 17_2_6CD7E2E0	17_2_6CD7E2E0
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 17_2_6CD6626B	17_2_6CD6626B
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 17_2_6CD7DC80	17_2_6CD7DC80
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 17_2_6CCEDCB0	17_2_6CCEDCB0
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 17_2_6CD81DE0	17_2_6CD81DE0
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 17_2_6CD67DB0	17_2_6CD67DB0
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 17_2_6CCF7D00	17_2_6CCF7D00
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 17_2_6CCF3D00	17_2_6CCF3D00
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 17_2_6CD5FD00	17_2_6CD5FD00
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 17_2_6CCDFEB0	17_2_6CCDFEB0
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 17_2_6CD7DE00	17_2_6CD7DE00
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 17_2_6CCDFE10	17_2_6CCDFE10
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 17_2_6CD85FC0	17_2_6CD85FC0
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 17_2_6CD7DF80	17_2_6CD7DF80
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 17_2_6CCDFF50	17_2_6CCDFF50
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 17_2_6CD5F870	17_2_6CD5F870
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 17_2_6CD1D810	17_2_6CD1D810
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 17_2_6CCD1960	17_2_6CCD1960
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 17_2_6CD31AB0	17_2_6CD31AB0
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 21_2_6C8A4B40	21_2_6C8A4B40
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 21_2_6C838C90	21_2_6C838C90
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 21_2_6C7D4C18	21_2_6C7D4C18
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 21_2_6C7D6CC0	21_2_6C7D6CC0
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 21_2_6C836D60	21_2_6C836D60
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 21_2_6C836F80	21_2_6C836F80
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 21_2_6C7AE8E0	21_2_6C7AE8E0
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 21_2_6C7C0930	21_2_6C7C0930
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 21_2_6C820A60	21_2_6C820A60
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 21_2_6C836A70	21_2_6C836A70
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 21_2_6C7D6A80	21_2_6C7D6A80
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 21_2_6C7B6B40	21_2_6C7B6B40
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 21_2_6C7D4B40	21_2_6C7D4B40
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 21_2_6C7D4BDC	21_2_6C7D4BDC
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 21_2_6C836B40	21_2_6C836B40
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 21_2_6C84CB40	21_2_6C84CB40
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 21_2_6C7BE6E0	21_2_6C7BE6E0
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 21_2_6C802780	21_2_6C802780
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 21_2_6C8387D0	21_2_6C8387D0
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 21_2_6C8367F0	21_2_6C8367F0
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 21_2_6C83808C	21_2_6C83808C
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 21_2_6C7B0060	21_2_6C7B0060
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 21_2_6C838000	21_2_6C838000
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 21_2_6C842000	21_2_6C842000
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 21_2_6C7BE160	21_2_6C7BE160
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 21_2_6C7B0100	21_2_6C7B0100
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 21_2_6C7CC1D0	21_2_6C7CC1D0
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 21_2_6C7B0190	21_2_6C7B0190
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 21_2_6C836170	21_2_6C836170
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 21_2_6C83626B	21_2_6C83626B
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 21_2_6C84DC80	21_2_6C84DC80
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 21_2_6C7BDCB0	21_2_6C7BDCB0
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 21_2_6C837DB0	21_2_6C837DB0
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 21_2_6C7C7D00	21_2_6C7C7D00
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 21_2_6C7C3D00	21_2_6C7C3D00
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 21_2_6C82FD00	21_2_6C82FD00
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 21_2_6C7AFE10	21_2_6C7AFE10
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 21_2_6C84DE00	21_2_6C84DE00
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 21_2_6C7AFEB0	21_2_6C7AFEB0
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 21_2_6C7AFF50	21_2_6C7AFF50
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 21_2_6C7ED810	21_2_6C7ED810
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 21_2_6C82F870	21_2_6C82F870
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 21_2_6C7A1960	21_2_6C7A1960
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 21_2_6C801AB0	21_2_6C801AB0
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 21_2_6C7AFB40	21_2_6C7AFB40
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 21_2_6C84DB40	21_2_6C84DB40
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 21_2_6C8374C0	21_2_6C8374C0
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 21_2_6C831400	21_2_6C831400
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 21_2_6C7BD4F0	21_2_6C7BD4F0
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 21_2_6C7B9520	21_2_6C7B9520
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 21_2_6C8355F0	21_2_6C8355F0
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 21_2_6C7F55C0	21_2_6C7F55C0
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 21_2_6C831540	21_2_6C831540
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 21_2_6C7FB610	21_2_6C7FB610
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 21_2_6C7FD600	21_2_6C7FD600
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 21_2_6C805650	21_2_6C805650
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 21_2_6C8357D0	21_2_6C8357D0
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 21_2_6C84D710	21_2_6C84D710
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 21_2_6C837750	21_2_6C837750
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 21_2_6C84D180	21_2_6C84D180
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 21_2_6C837160	21_2_6C837160
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 21_2_6C8572DD	21_2_6C8572DD
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 21_2_6C7A12D0	21_2_6C7A12D0
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 21_2_6C8213B0	21_2_6C8213B0
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 21_2_6C855317	21_2_6C855317
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 21_2_6C7ED3C0	21_2_6C7ED3C0
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 21_2_6C936C90	21_2_6C936C90
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 21_2_6C932C80	21_2_6C932C80
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 21_2_6C94AC40	21_2_6C94AC40
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 21_2_6C988C70	21_2_6C988C70
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 21_2_6C934D50	21_2_6C934D50
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 21_2_6C962EA0	21_2_6C962EA0
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 21_2_6C938E20	21_2_6C938E20
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 21_2_6C94EFB0	21_2_6C94EFB0
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 21_2_6C8DCFA0	21_2_6C8DCFA0
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 21_2_6C934F70	21_2_6C934F70
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 21_2_6C988F70	21_2_6C988F70
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 21_2_6C906840	21_2_6C906840
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 21_2_6C934870	21_2_6C934870

Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Temp\_MEI13602\Crypto.Cipher._AES.pyd C1A900615C9500C46B9602C30C53F299290B03632208EF1152AF8830AB73AD17
Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Temp\_MEI13602\_ctypes.pyd 6456FEA123E04BCEC8A8EED26160E1DF5482E69D187D3E1A0C428995472AC134

Source: C:\Windows\System32\svchost.exe

Process token adjusted: Security

Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: String function: 6CCD8480 appears 119 times
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: String function: 6CCDBC60 appears 106 times
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: String function: 03411090 appears 35 times
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: String function: 1E7A9F20 appears 44 times
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: String function: 6C7A4220 appears 159 times
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: String function: 6CCD4220 appears 806 times

Source: 42.2.xmrig.exe.400000.0.unpack, type: UNPACKEDPE

Matched rule: MAL_XMR_Miner_May19_1 date = 2019-05-31, author = Florian Roth, description = Detects Monero Crypto Coin Miner, score = d6df423efb576f167bc28b3c08d10c397007ba323a0de92d1e504a3f490752fc, reference = https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/

Source: msvcr90.dll.16.dr	Static PE information: Section: UPX1 ZLIB complexity 0.9932069359756097
Source: python27.dll.16.dr	Static PE information: Section: UPX1 ZLIB complexity 0.9987474020190024
Source: _ssl.pyd.16.dr	Static PE information: Section: UPX1 ZLIB complexity 0.9969374194587629
Source: _hashlib.pyd.16.dr	Static PE information: Section: UPX1 ZLIB complexity 0.9965934530336257
Source: unicodedata.pyd.16.dr	Static PE information: Section: UPX1 ZLIB complexity 0.9941517223011364
Source: msvcr90.dll.20.dr	Static PE information: Section: UPX1 ZLIB complexity 0.9932069359756097
Source: python27.dll.20.dr	Static PE information: Section: UPX1 ZLIB complexity 0.9987474020190024
Source: _hashlib.pyd.20.dr	Static PE information: Section: UPX1 ZLIB complexity 0.9965934530336257
Source: _ssl.pyd.20.dr	Static PE information: Section: UPX1 ZLIB complexity 0.9969374194587629
Source: unicodedata.pyd.20.dr	Static PE information: Section: UPX1 ZLIB complexity 0.9941517223011364

Source: classification engine

Classification label: mal100.rans.troj.evad.mine.winZIP@58/169@16/100

Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe

Code function: 17_2_1E7A9F20 ?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z,GetLastError,?PyWin_GetErrorMessageModule@@YAPAUHINSTANCE__@@K@Z,FormatMessageA,?PyWinObject_FromTCHAR@@YAPAU_object@@PBDH@Z,?PyWinCoreString_FromString@@YAPAU_object@@PBDH@Z,Py_BuildValue,LocalFree,PyErr_SetObject,

17_2_1E7A9F20

Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe

Code function: 17_2_03416F10 LookupPrivilegeValueA,AdjustTokenPrivileges,AdjustTokenPrivileges,AdjustTokenPrivileges,

17_2_03416F10

Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe

Code function: 17_2_03413C20 PyArg_ParseTuple,PyArg_ParseTuple,PyEval_SaveThread,GetDiskFreeSpaceExW,PyErr_Clear,PyArg_ParseTuple,PyEval_SaveThread,GetDiskFreeSpaceExA,PyEval_RestoreThread,PyErr_SetFromWindowsErrWithFilename,Py_BuildValue,

17_2_03413C20

Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe

Code function: ?PyWinObject_AsMultipleString@@YAHPAU_object@@PAPA_WHPAK@Z,CreateServiceW,?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z,?PyWinObject_FreeMultipleString@@YAXPA_W@Z,Py_BuildValue,?PyWinObject_FreeMultipleString@@YAXPA_W@Z,

17_2_1ECB2120

Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe

Code function: 17_2_03411C70 PyArg_ParseTuple,CreateToolhelp32Snapshot,Process32FirstW,CloseHandle,Process32NextW,CloseHandle,CloseHandle,PyUnicodeUCS2_FromWideChar,

17_2_03411C70

Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe

Code function: 17_2_1E7AA5B0 ?PyWinObject_FreeResourceId@@YAXPA_W@Z,

17_2_1E7AA5B0

Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe

Code function: 17_2_03417AA0 PyArg_ParseTuple,StartServiceA,CloseServiceHandle,_Py_NoneStruct,_Py_NoneStruct,

17_2_03417AA0

Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 17_2_1E7D1C30 PyEval_SaveThread,StartServiceCtrlDispatcherW,PyEval_RestoreThread,?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z,_Py_NoneStruct,_Py_NoneStruct,	17_2_1E7D1C30
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 17_2_1E7D2D10 PythonService_main,GetCommandLineW,CommandLineToArgvW,GetModuleFileNameW,GetModuleHandleW,LoadStringW,PythonService_PrepareToHostSingle,StartServiceCtrlDispatcherW,GetLastError,	17_2_1E7D2D10
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 17_2_1E7D15A0 PythonService_StartServiceCtrlDispatcher,StartServiceCtrlDispatcherW,	17_2_1E7D15A0

Source: C:\Program Files\7-Zip\7zG.exe

File created: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:1272:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:5208:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3688:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:1788:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:5968:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6232:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:2088:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6400:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:1752:120:WilError_03

Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe

File created: C:\Users\user\AppData\Local\Temp\_MEI71562

Jump to behavior

Source: C:\Windows\SysWOW64\taskkill.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( ProcessId = 2284)

Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\rundll32.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown

Process created: C:\Windows\System32\rundll32.exe C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding

Source: 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	String found in binary or memory: set-addPolicy
Source: 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	String found in binary or memory: id-cmc-addExtensions

Source: unknown	Process created: C:\Windows\System32\rundll32.exe C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k NetworkService -p
Source: unknown	Process created: C:\Windows\System32\SgrmBroker.exe C:\Windows\system32\SgrmBroker.exe
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
Source: unknown	Process created: C:\Program Files\7-Zip\7zG.exe "C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\" -ad -an -ai#7zMap21038:114:7zEvent22422
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s wscsvc
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k UnistackSvcGroup
Source: unknown	Process created: C:\Program Files\7-Zip\7zG.exe "C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\" -an -ai#7zMap6425:244:7zEvent24752
Source: unknown	Process created: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe "C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe"
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Process created: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe "C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe"
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Process created: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe "C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe"
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Process created: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe "C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe"
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c copy /y C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe C:\Users\user\HelpPane.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c C:\Users\user\HelpPane.exe --startup auto install
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\HelpPane.exe C:\Users\user\HelpPane.exe --startup auto install
Source: C:\Users\user\HelpPane.exe	Process created: C:\Users\user\HelpPane.exe C:\Users\user\HelpPane.exe --startup auto install
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c C:\Users\user\HelpPane.exe start
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\HelpPane.exe C:\Users\user\HelpPane.exe start
Source: C:\Users\user\HelpPane.exe	Process created: C:\Users\user\HelpPane.exe C:\Users\user\HelpPane.exe start
Source: unknown	Process created: C:\Users\user\HelpPane.exe "C:\Users\user\HelpPane.exe"
Source: C:\Users\user\HelpPane.exe	Process created: C:\Users\user\HelpPane.exe "C:\Users\user\HelpPane.exe"
Source: C:\Users\user\HelpPane.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /pid 2284 /f
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /pid 2284 /f
Source: C:\Users\user\HelpPane.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c copy /y C:\Windows\TEMP\_MEI29~1\xmrig.exe C:\Windows\TEMP\xmrig.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\HelpPane.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c copy /y C:\Windows\TEMP\_MEI29~1\config.json C:\Windows\TEMP\config.json
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\HelpPane.exe	Process created: C:\Windows\Temp\xmrig.exe C:\Windows\TEMP\xmrig.exe
Source: C:\Windows\Temp\xmrig.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\HelpPane.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh firewall add allowedprogram C:\Users\user\HelpPane.exe "MyApp" ENABLE
Source: C:\Windows\SysWOW64\netsh.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\spoolsv.exe C:\Windows\System32\spoolsv.exe
Source: C:\Windows\System32\svchost.exe	Process created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k SDRSVC
Source: C:\Windows\System32\svchost.exe	Process created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Process created: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe "C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe"	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Process created: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe "C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe"	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c copy /y C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe C:\Users\user\HelpPane.exe	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c C:\Users\user\HelpPane.exe --startup auto install	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c C:\Users\user\HelpPane.exe start	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\HelpPane.exe C:\Users\user\HelpPane.exe --startup auto install	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Process created: C:\Users\user\HelpPane.exe C:\Users\user\HelpPane.exe --startup auto install	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\HelpPane.exe C:\Users\user\HelpPane.exe start	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Process created: C:\Users\user\HelpPane.exe C:\Users\user\HelpPane.exe start	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Process created: C:\Users\user\HelpPane.exe "C:\Users\user\HelpPane.exe"	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /pid 2284 /f
Source: C:\Users\user\HelpPane.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c copy /y C:\Windows\TEMP\_MEI29~1\xmrig.exe C:\Windows\TEMP\xmrig.exe
Source: C:\Users\user\HelpPane.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c copy /y C:\Windows\TEMP\_MEI29~1\config.json C:\Windows\TEMP\config.json
Source: C:\Users\user\HelpPane.exe	Process created: C:\Windows\Temp\xmrig.exe C:\Windows\TEMP\xmrig.exe
Source: C:\Users\user\HelpPane.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh firewall add allowedprogram C:\Users\user\HelpPane.exe "MyApp" ENABLE
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /pid 2284 /f

Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: moshost.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mapsbtsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mosstorage.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ztrace_maps.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ztrace_maps.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ztrace_maps.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mapconfiguration.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: storsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fltlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bcd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wer.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: storageusage.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Program Files\7-Zip\7zG.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files\7-Zip\7zG.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Program Files\7-Zip\7zG.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Program Files\7-Zip\7zG.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Program Files\7-Zip\7zG.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Program Files\7-Zip\7zG.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Program Files\7-Zip\7zG.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Program Files\7-Zip\7zG.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Program Files\7-Zip\7zG.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Program Files\7-Zip\7zG.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Program Files\7-Zip\7zG.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Program Files\7-Zip\7zG.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usosvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: updatepolicy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usocoreps.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usoapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: aphostservice.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: networkhelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userdataplatformhelperutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mccspal.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: syncutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: syncutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dmcfgutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dmcmnutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dmxmlhelputils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: inproclogger.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: windows.networking.connectivity.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: synccontroller.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pimstore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: aphostclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: accountaccessor.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: systemeventsbrokerclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userdatalanguageutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mccsengineshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pimstore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cemapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userdatatypehelperutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: phoneutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Program Files\7-Zip\7zG.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files\7-Zip\7zG.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Program Files\7-Zip\7zG.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Program Files\7-Zip\7zG.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Program Files\7-Zip\7zG.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Program Files\7-Zip\7zG.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Program Files\7-Zip\7zG.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Program Files\7-Zip\7zG.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Program Files\7-Zip\7zG.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Program Files\7-Zip\7zG.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Program Files\7-Zip\7zG.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Program Files\7-Zip\7zG.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Section loaded: pdh.dll	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Section loaded: pywintypes27.dll	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Section loaded: pdh.dll	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Section loaded: pywintypes27.dll	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Section loaded: pdh.dll	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Section loaded: pywintypes27.dll	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Section loaded: pdh.dll	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Section loaded: pywintypes27.dll	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\HelpPane.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\HelpPane.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\HelpPane.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\HelpPane.exe	Section loaded: pdh.dll
Source: C:\Users\user\HelpPane.exe	Section loaded: powrprof.dll
Source: C:\Users\user\HelpPane.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\HelpPane.exe	Section loaded: umpdc.dll
Source: C:\Users\user\HelpPane.exe	Section loaded: winsta.dll
Source: C:\Users\user\HelpPane.exe	Section loaded: pywintypes27.dll
Source: C:\Users\user\HelpPane.exe	Section loaded: version.dll
Source: C:\Users\user\HelpPane.exe	Section loaded: secur32.dll
Source: C:\Users\user\HelpPane.exe	Section loaded: sspicli.dll
Source: C:\Users\user\HelpPane.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Users\user\HelpPane.exe	Section loaded: dhcpcsvc.dll
Source: C:\Users\user\HelpPane.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\HelpPane.exe	Section loaded: mswsock.dll
Source: C:\Users\user\HelpPane.exe	Section loaded: apphelp.dll
Source: C:\Users\user\HelpPane.exe	Section loaded: wsock32.dll
Source: C:\Users\user\HelpPane.exe	Section loaded: napinsp.dll
Source: C:\Users\user\HelpPane.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\HelpPane.exe	Section loaded: wshbth.dll
Source: C:\Users\user\HelpPane.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\HelpPane.exe	Section loaded: winrnr.dll
Source: C:\Users\user\HelpPane.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\HelpPane.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: ntmarta.dll
Source: C:\Windows\Temp\xmrig.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\Temp\xmrig.exe	Section loaded: userenv.dll
Source: C:\Windows\Temp\xmrig.exe	Section loaded: powrprof.dll
Source: C:\Windows\Temp\xmrig.exe	Section loaded: umpdc.dll
Source: C:\Windows\Temp\xmrig.exe	Section loaded: mswsock.dll
Source: C:\Windows\Temp\xmrig.exe	Section loaded: napinsp.dll
Source: C:\Windows\Temp\xmrig.exe	Section loaded: pnrpnsp.dll
Source: C:\Windows\Temp\xmrig.exe	Section loaded: wshbth.dll
Source: C:\Windows\Temp\xmrig.exe	Section loaded: nlaapi.dll
Source: C:\Windows\Temp\xmrig.exe	Section loaded: dnsapi.dll
Source: C:\Windows\Temp\xmrig.exe	Section loaded: winrnr.dll
Source: C:\Windows\Temp\xmrig.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\Temp\xmrig.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\Temp\xmrig.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ifmon.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mprapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasmontr.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasapi32.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasman.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasman.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mfc42u.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: authfwcfg.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwpolicyiomgr.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: firewallapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dnsapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwbase.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dhcpcmonitor.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dot3cfg.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dot3api.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: onex.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: eappcfg.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ncrypt.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: eappprxy.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ntasn1.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwcfg.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: hnetmon.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netshell.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nlaapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netsetupapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netiohlp.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winnsi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshhttp.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: httpapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshipsec.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: activeds.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: polstore.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winipsec.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: adsldpc.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: adsldpc.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshwfp.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cabinet.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: p2pnetsh.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: p2p.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rpcnsh.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: whhelper.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winhttp.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wlancfg.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wlanapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wshelper.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wevtapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mswsock.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: peerdistsh.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wcmapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rmclient.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mobilenetworking.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: slc.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: sppc.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ktmw32.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mprmsg.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\spoolsv.exe	Section loaded: dsrole.dll
Source: C:\Windows\System32\spoolsv.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\spoolsv.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\spoolsv.exe	Section loaded: ualapi.dll
Source: C:\Windows\System32\spoolsv.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\spoolsv.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\spoolsv.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\spoolsv.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\spoolsv.exe	Section loaded: mswsock.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: mpclient.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: secur32.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: sspicli.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: version.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: msasn1.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: userenv.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: gpapi.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: wbemcomn.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: amsi.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: profapi.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: wscapi.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: urlmon.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: iertutil.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: srvcli.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: netutils.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: slc.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: sppc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: sdrsvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: sxshared.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: sxproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: sdengin2.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: spp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: bcd.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll

Source: C:\Program Files\7-Zip\7zG.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{56FDF344-FD6D-11d0-958A-006097C9A090}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files\7-Zip\7zG.exe

Window detected: Number of UI elements: 15

Source: 240506-b7lv1sfmcw_pw_infected.zip

Static file information: File size 6171992 > 1048576

Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe

File opened: C:\Users\user\AppData\Local\Temp\_MEI71562\msvcr90.dll

Jump to behavior

Source:	Binary string: O:\src\pywin32\build\temp.win32-2.7\Release\_win32sysloader.pdb source: 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000010.00000003.1529000361.0000000000ED1000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001A.00000003.1570649002.0000000002551000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001E.00000003.1604095650.0000000003013000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 00000020.00000003.1618937725.0000000001203000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\build27\cpython\PCBuild\python27.pdb1v source: 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000011.00000002.1566376619.000000006CF51000.00000040.00000001.01000000.00000009.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000015.00000002.1699424273.000000006CC32000.00000040.00000001.01000000.00000016.sdmp, HelpPane.exe, 00000021.00000002.2459301185.000000006C702000.00000040.00000001.01000000.0000003E.sdmp
Source:	Binary string: C:\build27\cpython\PCBuild\_hashlib.pdb% source: 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000011.00000002.1563185803.000000006CCD1000.00000040.00000001.01000000.0000000E.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000015.00000002.1691361963.000000006C889000.00000040.00000001.01000000.0000001B.sdmp, HelpPane.exe, 00000021.00000002.2451643036.000000006C359000.00000040.00000001.01000000.00000043.sdmp
Source:	Binary string: C:\build27\cpython\PCBuild\_ctypes.pdb source: 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000015.00000002.1707382765.0000000073A82000.00000040.00000001.01000000.00000018.sdmp, HelpPane.exe, 00000021.00000002.2466945092.0000000073DE2000.00000040.00000001.01000000.00000040.sdmp
Source:	Binary string: C:\build27\cpython\PCBuild\_hashlib.pdb source: 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000015.00000002.1691361963.000000006C889000.00000040.00000001.01000000.0000001B.sdmp, HelpPane.exe, 00000021.00000002.2451643036.000000006C359000.00000040.00000001.01000000.00000043.sdmp
Source:	Binary string: C:\build27\cpython\PCBuild\_socket.pdb source: 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000015.00000002.1706989687.0000000073A41000.00000040.00000001.01000000.00000019.sdmp, HelpPane.exe, 0000001B.00000002.1598286919.0000000073E11000.00000040.00000001.01000000.00000027.sdmp, HelpPane.exe, 00000021.00000002.2466593137.0000000073DB1000.00000040.00000001.01000000.00000041.sdmp
Source:	Binary string: O:\src\pywin32\build\temp.win32-2.7\Release\pywintypes.pdb source: 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000011.00000002.1561923280.000000001E7A1000.00000040.00000001.01000000.00000012.sdmp
Source:	Binary string: O:\src\pywin32\build\temp.win32-2.7\Release\servicemanager.pdb source: 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000011.00000002.1562321143.000000001E7D1000.00000040.00000001.01000000.00000015.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000015.00000002.1690258741.000000001E7D4000.00000040.00000001.01000000.00000022.sdmp, HelpPane.exe, 00000021.00000002.2451063871.000000001E7D4000.00000040.00000001.01000000.0000004A.sdmp
Source:	Binary string: O:\src\pywin32\build\temp.win32-2.7\Release\pywintypes.pdb$ source: 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000011.00000002.1561923280.000000001E7A1000.00000040.00000001.01000000.00000012.sdmp
Source:	Binary string: O:\src\pywin32\build\temp.win32-2.7\Release\win32service.pdbl source: 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000011.00000002.1562974427.000000001ECB1000.00000040.00000001.01000000.00000011.sdmp
Source:	Binary string: msvcm90.i386.pdb source: 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000010.00000003.1529260880.0000000000ED1000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000014.00000003.1547561156.0000000000F10000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: O:\src\pywin32\build\temp.win32-2.7\Release\win32api.pdb source: 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000011.00000002.1562490344.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp
Source:	Binary string: O:\src\pywin32\build\temp.win32-2.7\Release\win32service.pdb source: 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000011.00000002.1562974427.000000001ECB1000.00000040.00000001.01000000.00000011.sdmp
Source:	Binary string: C:\build27\cpython\PCBuild\python27.pdb source: 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000011.00000002.1566376619.000000006CF51000.00000040.00000001.01000000.00000009.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000015.00000002.1699424273.000000006CC32000.00000040.00000001.01000000.00000016.sdmp, HelpPane.exe, 00000021.00000002.2459301185.000000006C702000.00000040.00000001.01000000.0000003E.sdmp
Source:	Binary string: O:\src\pywin32\build\temp.win32-2.7\Release\servicemanager.pdb19 source: 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000011.00000002.1562321143.000000001E7D1000.00000040.00000001.01000000.00000015.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000015.00000002.1690258741.000000001E7D4000.00000040.00000001.01000000.00000022.sdmp, HelpPane.exe, 00000021.00000002.2451063871.000000001E7D4000.00000040.00000001.01000000.0000004A.sdmp
Source:	Binary string: C:\build27\cpython\PCBuild\_ssl.pdb source: 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000011.00000002.1564482512.000000006CDE1000.00000040.00000001.01000000.0000000D.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000015.00000002.1694555704.000000006C9EF000.00000040.00000001.01000000.0000001A.sdmp, HelpPane.exe, 00000021.00000002.2454900296.000000006C4BF000.00000040.00000001.01000000.00000042.sdmp
Source:	Binary string: O:\src\pywin32\build\temp.win32-2.7\Release\win32event.pdb source: 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000011.00000002.1562784907.000000001E9B1000.00000040.00000001.01000000.00000014.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000015.00000002.1690953701.000000001E9B4000.00000040.00000001.01000000.00000021.sdmp, HelpPane.exe, 00000021.00000002.2451350043.000000001E9B4000.00000040.00000001.01000000.00000049.sdmp
Source:	Binary string: C:\build27\cpython\PCBuild\_ctypes.pdba source: 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000011.00000002.1571192833.00000000747F1000.00000040.00000001.01000000.0000000B.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000015.00000002.1707382765.0000000073A82000.00000040.00000001.01000000.00000018.sdmp, HelpPane.exe, 00000021.00000002.2466945092.0000000073DE2000.00000040.00000001.01000000.00000040.sdmp

Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe

Code function: 17_2_1E7AACE0 _DllMain@12,GetModuleHandleA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,RtlInitializeCriticalSection,TlsAlloc,RtlDeleteCriticalSection,TlsFree,

17_2_1E7AACE0

Source: _socket.pyd.16.dr	Static PE information: section name: UPX2
Source: _ssl.pyd.16.dr	Static PE information: section name: UPX2
Source: bz2.pyd.16.dr	Static PE information: section name: UPX2
Source: netifaces.pyd.16.dr	Static PE information: section name: UPX2
Source: Crypto.Cipher._AES.pyd.16.dr	Static PE information: section name: UPX2
Source: _ctypes.pyd.16.dr	Static PE information: section name: UPX2
Source: _hashlib.pyd.16.dr	Static PE information: section name: UPX2
Source: psutil._psutil_windows.pyd.16.dr	Static PE information: section name: UPX2
Source: pyexpat.pyd.16.dr	Static PE information: section name: UPX2
Source: select.pyd.16.dr	Static PE information: section name: UPX2
Source: unicodedata.pyd.16.dr	Static PE information: section name: UPX2
Source: back.jpg.16.dr	Static PE information: section name: UPX2
Source: Crypto.Cipher._AES.pyd.20.dr	Static PE information: section name: UPX2
Source: _ctypes.pyd.20.dr	Static PE information: section name: UPX2
Source: _hashlib.pyd.20.dr	Static PE information: section name: UPX2
Source: _socket.pyd.20.dr	Static PE information: section name: UPX2
Source: _ssl.pyd.20.dr	Static PE information: section name: UPX2
Source: bz2.pyd.20.dr	Static PE information: section name: UPX2
Source: netifaces.pyd.20.dr	Static PE information: section name: UPX2
Source: psutil._psutil_windows.pyd.20.dr	Static PE information: section name: UPX2
Source: pyexpat.pyd.20.dr	Static PE information: section name: UPX2
Source: select.pyd.20.dr	Static PE information: section name: UPX2
Source: unicodedata.pyd.20.dr	Static PE information: section name: UPX2
Source: back.jpg.20.dr	Static PE information: section name: UPX2

Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 17_2_03418A11 push ecx; ret	17_2_03418A24
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 17_2_1000520B push 0000006Ah; retf	17_2_1000527C
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 17_2_1000520D push 0000006Ah; retf	17_2_1000527C
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 17_2_10003B21 push ecx; ret	17_2_10003B34
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 17_2_100051A3 push 0000006Ah; retf	17_2_1000527C
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 17_2_1E7ABEB5 push ecx; ret	17_2_1E7ABEC8
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 17_2_1E7D391D push ecx; ret	17_2_1E7D3930
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 17_2_1E8CDEE1 push ecx; ret	17_2_1E8CDEF4
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 17_2_1E9B2ED1 push ecx; ret	17_2_1E9B2EE4
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 17_2_1ECBA0C3 push ds; retf	17_2_1ECBA0C4
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 17_2_1ECBA2C3 push ss; retf	17_2_1ECBA2C6
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 17_2_1ECB8650 push edi; retf	17_2_1ECB8652
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 17_2_1ECB860B push ebp; retf	17_2_1ECB860E
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 17_2_1ECB8611 push esi; retf	17_2_1ECB8612
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 17_2_1ECB8631 push esi; retf	17_2_1ECB8632
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 17_2_1ECB85E8 push ebp; retf	17_2_1ECB85F2
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 17_2_1ECB85F3 push ebp; retf	17_2_1ECB85F6
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 17_2_1ECBA183 pushad ; retf	17_2_1ECBA185
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 17_2_1ECB5991 push ecx; ret	17_2_1ECB59A4
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 17_2_1ECB8107 push ecx; retf	17_2_1ECB8112
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 17_2_6CD88511 push ecx; ret	17_2_6CD88524
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 21_2_6C858511 push ecx; ret	21_2_6C858524
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 21_2_6C7A5691 push esp; ret	21_2_6C7A5693
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 21_2_6C7CD741 push esp; ret	21_2_6C7CD743
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 21_2_6C8D2981 push esp; ret	21_2_6C8D2983

Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1

Persistence and Installation Behavior

Contains functionality to infect the boot sector

Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: PyDict_New,CreateFileA,DeviceIoControl,GetLastError,DeviceIoControl,__aulldiv,__aulldiv,Py_BuildValue,PyDict_SetItemString,GetLastError,GetLastError,GetLastError,CloseHandle,PyErr_SetFromWindowsErr,CloseHandle, \\.\PhysicalDrive%d	17_2_03413F40
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: PyDict_New,CreateFileA,DeviceIoControl,GetLastError,DeviceIoControl,__aulldiv,__aulldiv,Py_BuildValue,PyDict_SetItemString,GetLastError,GetLastError,GetLastError,CloseHandle,PyErr_SetFromWindowsErr,CloseHandle, PhysicalDrive%i	17_2_03413F40
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: PyDict_New,CreateFileA,DeviceIoControl,GetLastError,DeviceIoControl,__aulldiv,__aulldiv,Py_BuildValue,PyDict_SetItemString,GetLastError,GetLastError,GetLastError,CloseHandle,PyErr_SetFromWindowsErr,CloseHandle, DeviceIoControl -> ERROR_INVALID_FUNCTION; ignore PhysicalDrive%i	17_2_03413F40
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: PyDict_New,CreateFileA,DeviceIoControl,GetLastError,DeviceIoControl,__aulldiv,__aulldiv,Py_BuildValue,PyDict_SetItemString,GetLastError,GetLastError,GetLastError,CloseHandle,PyErr_SetFromWindowsErr,CloseHandle, DeviceIoControl -> ERROR_NOT_SUPPORTED; ignore PhysicalDrive%i	17_2_03413F40

Found pyInstaller with non standard icon

Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Process created: "C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe"
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Process created: "C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe"
Source: C:\Users\user\HelpPane.exe	Process created: C:\Users\user\HelpPane.exe --startup auto install
Source: C:\Users\user\HelpPane.exe	Process created: C:\Users\user\HelpPane.exe start

Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI71562\perfmon.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI59482\_hashlib.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI13602\pywintypes27.dll	Jump to dropped file
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI59482\psutil._psutil_windows.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI71562\select.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI13602\bz2.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Windows\Temp\_MEI29202\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI64762\back.jpg	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI13602\win32service.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI64762\_ssl.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI59482\bz2.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI64762\win32event.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI71562\msvcr90.dll	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Windows\Temp\_MEI29202\bz2.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI64762\win32evtlog.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI71562\pyexpat.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI71562\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI13602\win32api.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Windows\Temp\_MEI29202\back.jpg	Jump to dropped file
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI59482\msvcm90.dll	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Windows\Temp\_MEI29202\python27.dll	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI64762\_socket.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI71562\win32api.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI13602\win32evtlog.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI59482\xmrig.exe	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI64762\_hashlib.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI71562\_win32sysloader.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI13602\msvcp90.dll	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI64762\pyexpat.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI59482\Crypto.Cipher._AES.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI13602\_win32sysloader.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI71562\bz2.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI64762\python27.dll	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Windows\Temp\_MEI29202\perfmon.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI64762\servicemanager.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI59482\msvcp90.dll	Jump to dropped file
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI71562\msvcp90.dll	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Windows\Temp\_MEI29202\Crypto.Cipher._AES.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI71562\python27.dll	Jump to dropped file
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI59482\win32service.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI13602\xmrig.exe	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI64762\_win32sysloader.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI59482\win32api.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI71562\_hashlib.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI71562\_ctypes.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Windows\Temp\_MEI29202\_ctypes.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI59482\select.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI64762\msvcp90.dll	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI13602\_hashlib.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI13602\perfmon.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI71562\xmrig.exe	Jump to dropped file
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI59482\perfmon.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Windows\Temp\_MEI29202\select.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI59482\_ctypes.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Windows\Temp\_MEI29202\win32service.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI13602\_ctypes.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Windows\Temp\_MEI29202\win32evtlog.pyd	Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Users\user\HelpPane.exe	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Windows\Temp\_MEI29202\msvcp90.dll	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI64762\_ctypes.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI64762\bz2.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI13602\python27.dll	Jump to dropped file
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI59482\win32evtlog.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Windows\Temp\_MEI29202\xmrig.exe	Jump to dropped file
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI59482\_socket.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI71562\pywintypes27.dll	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI64762\psutil._psutil_windows.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI64762\select.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI71562\_ssl.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI71562\Crypto.Cipher._AES.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI13602\netifaces.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI64762\xmrig.exe	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI64762\msvcr90.dll	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI64762\perfmon.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI59482\win32event.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI59482\_win32sysloader.pyd	Jump to dropped file
Source: C:\Program Files\7-Zip\7zG.exe	File created: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI13602\msvcm90.dll	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI13602\win32event.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI71562\win32event.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI13602\psutil._psutil_windows.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI71562\netifaces.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI64762\pywintypes27.dll	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI64762\netifaces.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Windows\Temp\_MEI29202\msvcm90.dll	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Windows\Temp\_MEI29202\psutil._psutil_windows.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI64762\win32service.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI71562\back.jpg	Jump to dropped file
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI59482\pyexpat.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI71562\msvcm90.dll	Jump to dropped file
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI59482\servicemanager.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Windows\Temp\_MEI29202\_hashlib.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Windows\Temp\_MEI29202\netifaces.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Windows\Temp\_MEI29202\msvcr90.dll	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI64762\Crypto.Cipher._AES.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI13602\select.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI71562\psutil._psutil_windows.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI71562\servicemanager.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI13602\pyexpat.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Windows\Temp\_MEI29202\_ssl.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI59482\python27.dll	Jump to dropped file
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI59482\back.jpg	Jump to dropped file
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI71562\_socket.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI59482\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Windows\Temp\_MEI29202\_win32sysloader.pyd	Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Windows\Temp\xmrig.exe	Jump to dropped file
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI59482\netifaces.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI59482\msvcr90.dll	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI64762\win32api.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI13602\_socket.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI13602\servicemanager.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI64762\msvcm90.dll	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI64762\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Windows\Temp\_MEI29202\_socket.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI71562\win32evtlog.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI71562\win32service.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Windows\Temp\_MEI29202\win32event.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI13602\back.jpg	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI13602\Crypto.Cipher._AES.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI59482\_ssl.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI13602\_ssl.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Windows\Temp\_MEI29202\pywintypes27.dll	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI13602\msvcr90.dll	Jump to dropped file
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI59482\pywintypes27.dll	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Windows\Temp\_MEI29202\servicemanager.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Windows\Temp\_MEI29202\pyexpat.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Windows\Temp\_MEI29202\win32api.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI13602\unicodedata.pyd	Jump to dropped file

Source: C:\Windows\SysWOW64\cmd.exe

File created: C:\Users\user\HelpPane.exe

Jump to dropped file

Source: C:\Users\user\HelpPane.exe	File created: C:\Windows\Temp\_MEI29202\_hashlib.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Windows\Temp\_MEI29202\msvcp90.dll	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Windows\Temp\_MEI29202\netifaces.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Windows\Temp\_MEI29202\msvcr90.dll	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Windows\Temp\_MEI29202\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Windows\Temp\_MEI29202\xmrig.exe	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Windows\Temp\_MEI29202\perfmon.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Windows\Temp\_MEI29202\Crypto.Cipher._AES.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Windows\Temp\_MEI29202\_ssl.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Windows\Temp\_MEI29202\_win32sysloader.pyd	Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Windows\Temp\xmrig.exe	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Windows\Temp\_MEI29202\bz2.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Windows\Temp\_MEI29202\_socket.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Windows\Temp\_MEI29202\win32event.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Windows\Temp\_MEI29202\back.jpg	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Windows\Temp\_MEI29202\_ctypes.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Windows\Temp\_MEI29202\python27.dll	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Windows\Temp\_MEI29202\pywintypes27.dll	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Windows\Temp\_MEI29202\msvcm90.dll	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Windows\Temp\_MEI29202\psutil._psutil_windows.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Windows\Temp\_MEI29202\servicemanager.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Windows\Temp\_MEI29202\pyexpat.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Windows\Temp\_MEI29202\win32api.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Windows\Temp\_MEI29202\select.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Windows\Temp\_MEI29202\win32service.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Windows\Temp\_MEI29202\win32evtlog.pyd	Jump to dropped file

Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI71562\back.jpg	Jump to dropped file
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI59482\back.jpg	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI64762\back.jpg	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI13602\back.jpg	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Windows\Temp\_MEI29202\back.jpg	Jump to dropped file

Boot Survival

Contains functionality to infect the boot sector

Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: PyDict_New,CreateFileA,DeviceIoControl,GetLastError,DeviceIoControl,__aulldiv,__aulldiv,Py_BuildValue,PyDict_SetItemString,GetLastError,GetLastError,GetLastError,CloseHandle,PyErr_SetFromWindowsErr,CloseHandle, \\.\PhysicalDrive%d	17_2_03413F40
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: PyDict_New,CreateFileA,DeviceIoControl,GetLastError,DeviceIoControl,__aulldiv,__aulldiv,Py_BuildValue,PyDict_SetItemString,GetLastError,GetLastError,GetLastError,CloseHandle,PyErr_SetFromWindowsErr,CloseHandle, PhysicalDrive%i	17_2_03413F40
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: PyDict_New,CreateFileA,DeviceIoControl,GetLastError,DeviceIoControl,__aulldiv,__aulldiv,Py_BuildValue,PyDict_SetItemString,GetLastError,GetLastError,GetLastError,CloseHandle,PyErr_SetFromWindowsErr,CloseHandle, DeviceIoControl -> ERROR_INVALID_FUNCTION; ignore PhysicalDrive%i	17_2_03413F40
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: PyDict_New,CreateFileA,DeviceIoControl,GetLastError,DeviceIoControl,__aulldiv,__aulldiv,Py_BuildValue,PyDict_SetItemString,GetLastError,GetLastError,GetLastError,CloseHandle,PyErr_SetFromWindowsErr,CloseHandle, DeviceIoControl -> ERROR_NOT_SUPPORTED; ignore PhysicalDrive%i	17_2_03413F40

Drops PE files to the user root directory

Source: C:\Windows\SysWOW64\cmd.exe

File created: C:\Users\user\HelpPane.exe

Jump to dropped file

Source: C:\Users\user\HelpPane.exe

Registry key created: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\StateftpService\PythonClass

Jump to behavior

Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe

Code function: 17_2_03417AA0 PyArg_ParseTuple,StartServiceA,CloseServiceHandle,_Py_NoneStruct,_Py_NoneStruct,

17_2_03417AA0

Hooking and other Techniques for Hiding and Protection

Creates files inside the volume driver (system volume information)

Source: C:\Windows\System32\svchost.exe

File created: C:\System Volume Information\Windows Backup

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 50008 -> 2121
Source: unknown	Network traffic detected: HTTP traffic on port 52668 -> 2121
Source: unknown	Network traffic detected: HTTP traffic on port 52995 -> 2121

Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe

17_2_1E7AACE0

Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\HelpPane.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\HelpPane.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Temp\xmrig.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\Temp\xmrig.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Temp\xmrig.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Windows\System32\svchost.exe

File opened / queried: SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}

Jump to behavior

Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe

Code function: 21_2_6C83D6A0 rdtsc

21_2_6C83D6A0

Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: PyList_New,OpenSCManagerA,EnumServicesStatusExW,EnumServicesStatusExW,GetLastError,73BB3B4E,EnumServicesStatusExW,PyUnicodeUCS2_FromWideChar,PyUnicodeUCS2_FromWideChar,PyUnicodeUCS2_FromWideChar,Py_BuildValue,PyList_Append,CloseServiceHandle,73BB3B4E,CloseServiceHandle,73BB3B4E,	17_2_03417320
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: PyArg_ParseTuple,?PyWinObject_AsHANDLE@@YAHPAU_object@@PAPAX@Z,PyEval_SaveThread,EnumServicesStatusW,EnumServicesStatusW,GetLastError,EnumServicesStatusW,PyEval_RestoreThread,?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z,PyTuple_New,?PyWinObject_FromOLECHAR@@YAPAU_object@@PB_W@Z,?PyWinObject_FromOLECHAR@@YAPAU_object@@PB_W@Z,?PyWinObject_FromOLECHAR@@YAPAU_object@@PB_W@Z,Py_BuildValue,PyTuple_SetItem,	17_2_1ECB2380
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: _Py_NoneStruct,PyExc_NotImplementedError,PyErr_SetString,?PyWinObject_FreeWCHAR@@YAXPA_W@Z,?PyWinObject_AsHANDLE@@YAHPAU_object@@PAPAX@Z,?PyWinObject_AsHANDLE@@YAHPAU_object@@PAPAX@Z,PyArg_ParseTuple,?PyWinObject_FreeWCHAR@@YAXPA_W@Z,PyExc_NotImplementedError,PyErr_SetString,?PyWinObject_FreeWCHAR@@YAXPA_W@Z,?PyWinObject_AsWCHAR@@YAHPAU_object@@PAPA_WHPAK@Z,PyList_New,?PyWinObject_FreeWCHAR@@YAXPA_W@Z,Py_BuildValue,?PyWinObject_FromOLECHAR@@YAPAU_object@@PB_W@Z,PyEval_SaveThread,EnumServicesStatusExW,PyEval_RestoreThread,GetLastError,?PyWinObject_FromOLECHAR@@YAPAU_object@@PB_W@Z,?PyWinObject_FromOLECHAR@@YAPAU_object@@PB_W@Z,Py_BuildValue,PyList_Append,73BB3B4E,?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z,PyErr_NoMemory,73BB3B4E,?PyWinObject_FreeWCHAR@@YAXPA_W@Z,	17_2_1ECB2570

Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59482\_hashlib.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI71562\perfmon.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59482\psutil._psutil_windows.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI71562\select.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI13602\bz2.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	Dropped PE file which has not been started: C:\Windows\Temp\_MEI29202\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64762\back.jpg	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI13602\win32service.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64762\_ssl.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59482\bz2.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64762\win32event.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI71562\msvcr90.dll	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	Dropped PE file which has not been started: C:\Windows\Temp\_MEI29202\bz2.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64762\win32evtlog.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI71562\pyexpat.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI71562\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI13602\win32api.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	Dropped PE file which has not been started: C:\Windows\Temp\_MEI29202\back.jpg	Jump to dropped file
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59482\msvcm90.dll	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	Dropped PE file which has not been started: C:\Windows\Temp\_MEI29202\python27.dll	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64762\_socket.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI71562\win32api.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI13602\win32evtlog.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64762\_hashlib.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI71562\_win32sysloader.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI13602\msvcp90.dll	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64762\pyexpat.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59482\Crypto.Cipher._AES.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI13602\_win32sysloader.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI71562\bz2.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64762\python27.dll	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	Dropped PE file which has not been started: C:\Windows\Temp\_MEI29202\perfmon.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64762\servicemanager.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI71562\msvcp90.dll	Jump to dropped file
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59482\msvcp90.dll	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	Dropped PE file which has not been started: C:\Windows\Temp\_MEI29202\Crypto.Cipher._AES.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI71562\python27.dll	Jump to dropped file
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59482\win32service.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI71562\_ctypes.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59482\win32api.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI71562\_hashlib.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64762\_win32sysloader.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	Dropped PE file which has not been started: C:\Windows\Temp\_MEI29202\_ctypes.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59482\select.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI13602\_hashlib.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64762\msvcp90.dll	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI13602\perfmon.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59482\perfmon.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	Dropped PE file which has not been started: C:\Windows\Temp\_MEI29202\select.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59482\_ctypes.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	Dropped PE file which has not been started: C:\Windows\Temp\_MEI29202\win32service.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	Dropped PE file which has not been started: C:\Windows\Temp\_MEI29202\win32evtlog.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI13602\_ctypes.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	Dropped PE file which has not been started: C:\Windows\Temp\_MEI29202\msvcp90.dll	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64762\_ctypes.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64762\bz2.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI13602\python27.dll	Jump to dropped file
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59482\win32evtlog.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59482\_socket.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64762\psutil._psutil_windows.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64762\select.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI71562\_ssl.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI71562\Crypto.Cipher._AES.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI13602\netifaces.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64762\perfmon.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64762\msvcr90.dll	Jump to dropped file
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59482\_win32sysloader.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59482\win32event.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI13602\msvcm90.dll	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI13602\win32event.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI71562\win32event.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI13602\psutil._psutil_windows.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI71562\netifaces.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	Dropped PE file which has not been started: C:\Windows\Temp\_MEI29202\psutil._psutil_windows.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	Dropped PE file which has not been started: C:\Windows\Temp\_MEI29202\msvcm90.dll	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64762\netifaces.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64762\win32service.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI71562\back.jpg	Jump to dropped file
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59482\pyexpat.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59482\servicemanager.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	Dropped PE file which has not been started: C:\Windows\Temp\_MEI29202\_hashlib.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI71562\msvcm90.dll	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	Dropped PE file which has not been started: C:\Windows\Temp\_MEI29202\netifaces.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	Dropped PE file which has not been started: C:\Windows\Temp\_MEI29202\msvcr90.dll	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64762\Crypto.Cipher._AES.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI13602\select.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI71562\psutil._psutil_windows.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI71562\servicemanager.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI13602\pyexpat.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	Dropped PE file which has not been started: C:\Windows\Temp\_MEI29202\_ssl.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59482\python27.dll	Jump to dropped file
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59482\back.jpg	Jump to dropped file
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59482\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI71562\_socket.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	Dropped PE file which has not been started: C:\Windows\Temp\_MEI29202\_win32sysloader.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59482\netifaces.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59482\msvcr90.dll	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI13602\_socket.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64762\win32api.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI13602\servicemanager.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64762\msvcm90.dll	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	Dropped PE file which has not been started: C:\Windows\Temp\_MEI29202\_socket.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64762\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI71562\win32service.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI71562\win32evtlog.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	Dropped PE file which has not been started: C:\Windows\Temp\_MEI29202\win32event.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI13602\back.jpg	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI13602\Crypto.Cipher._AES.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI13602\_ssl.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59482\_ssl.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI13602\msvcr90.dll	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	Dropped PE file which has not been started: C:\Windows\Temp\_MEI29202\servicemanager.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	Dropped PE file which has not been started: C:\Windows\Temp\_MEI29202\pyexpat.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	Dropped PE file which has not been started: C:\Windows\Temp\_MEI29202\win32api.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI13602\unicodedata.pyd	Jump to dropped file

Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	API coverage: 2.1 %
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	API coverage: 2.4 %

Source: C:\Windows\System32\svchost.exe TID: 6172	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\HelpPane.exe TID: 1060	Thread sleep time: -1020000s >= -30000s
Source: C:\Users\user\HelpPane.exe TID: 1060	Thread sleep time: -60000s >= -30000s

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\HelpPane.exe	Last function: Thread delayed
Source: C:\Users\user\HelpPane.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\svchost.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File Volume queried: C:\Windows\System32 FullSizeInformation	Jump to behavior

Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 17_2_1E8C1F60 PyArg_ParseTuple,?PyWinObject_AsString@@YAHPAU_object@@PAPADHPAK@Z,PyList_New,FindFirstFileA,GetLastError,?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z,PyList_Append,?PyObject_FromWIN32_FIND_DATAA@@YAPAU_object@@PAU_WIN32_FIND_DATAA@@@Z,PyList_Append,FindNextFileA,GetLastError,?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z,?PyWinObject_FreeString@@YAXPAD@Z,FindClose,		17_2_1E8C1F60
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 21_2_6C986D30 FindFirstFileA,FindNextFileA,		21_2_6C986D30

Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe

17_2_034141B0

Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe

Code function: 17_2_03417FF0 GetSystemInfo,

17_2_03417FF0

Source: C:\Users\user\HelpPane.exe	Thread delayed: delay time: 60000
Source: C:\Users\user\HelpPane.exe	Thread delayed: delay time: 60000

Source: svchost.exe, 00000007.00000002.2366755518.000002065A235000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: &@\??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: svchost.exe, 00000007.00000002.2371333927.000002065A28D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000
Source: svchost.exe, 00000007.00000002.2366755518.000002065A24D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: #disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: svchost.exe, 00000007.00000002.2366755518.000002065A24D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: netsh.exe, 0000002C.00000002.1708970782.0000000000F24000.00000004.00000020.00020000.00000000.sdmp, netsh.exe, 0000002C.00000003.1707296971.0000000000F21000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllQ
Source: HelpPane.exe, 00000021.00000002.2366256179.0000000000C35000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll]].Mp
Source: svchost.exe, 00000002.00000002.2371599045.0000017C9022F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2386172584.0000017C9585B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2386693504.0000017C95862000.00000004.00000020.00020000.00000000.sdmp, xmrig.exe, 0000002A.00000002.2400932598.0000000000D78000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: svchost.exe, 00000007.00000002.2370091459.000002065A264000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: @SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000
Source: svchost.exe, 00000007.00000002.2362877147.000002065A200000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: HvHostWdiSystemHostScDeviceEnumWiaRpctrkwksAudioEndpointBuilderhidservdot3svcUmRdpServiceDsSvcfhsvcvmickvpexchangevmicshutdownvmicguestinterfacevmicvmsessionsvsvcStorSvcWwanSvcvmicvssDevQueryBrokerNgcSvcsysmainNetmanTabletInputServicePcaSvcDisplayEnhancementServiceIPxlatCfgSvcDeviceAssociationServiceNcbServiceEmbeddedModeSensorServicewlansvcCscServiceWPDBusEnumMixedRealityOpenXRSvc
Source: svchost.exe, 00000007.00000002.2371333927.000002065A28D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\DosDevices\D:
Source: xmrig.exe, 0000002A.00000002.2400932598.0000000000D78000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW(
Source: svchost.exe, 00000007.00000002.2371333927.000002065A280000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: HelpPane.exe, 00000021.00000002.2378968453.0000000001481000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: sAppXSvcBDESVCBITSdembthservcamsvcCDPSvcClipSVCDhcpxt'diagsvcDoSvc__dot3svcDsmSvcDsSvc__DusmSvcEaphostfdPHostfhsvcgpsvcgupdatehidservHvHosticssvcIKEEXTKeyIsoKtmRmServerlfsvclltdsvclmhostsLxpSvcmpssvcMSDTCMSiSCSINcaSvcNetmanNgcSvcNlaSvcp2psvcPcaSvcPNRPsvcPowerPowereProfSvcQWAVERasAutoRasManRmSvcRpcSsSamSsSDRSVCSENSSensesmphostSpoolersppsvcSSDPSRVSstpSvcstisvcStorSvcsvsvcswprvSysMainSysMainTapiSrvThemesThemesTrkWksuhssvcUsoSvcVacSvcvmicrdvvmicvssW32TimeWcmsvcwcncsvcWecsvcWerSvcWiaRpcWinmgmtWinRMwisvcWlanSvcwlidsvcwlpasvcWManSvcwscsvcWSearchWwanSvc
Source: cacert.pem.26.dr	Binary or memory string: zJVSk/BwJVmcIGfE7vmLV2H0knZ9P4SNVbfo5azV8fUZVqZa+5Acr5Pr5RzUZ5dd
Source: 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000011.00000002.1554906069.0000000000E05000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000015.00000002.1673012150.0000000001304000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001B.00000002.1591498754.0000000000B34000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001F.00000002.1643911572.0000000001393000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: spoolsv.exe, 0000002E.00000002.2359433401.00000000008DB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dlloo

Source: C:\Users\user\HelpPane.exe

Process information queried: ProcessInformation

Anti Debugging

Found API chain indicative of debugger detection

Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe

Debugger detection routine: QueryPerformanceCounter, DebugActiveProcess, DecisionNodes, ExitProcess or Sleep

graph_17-67335

Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe

Code function: 21_2_6C83D6A0 rdtsc

21_2_6C83D6A0

Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe

Code function: 17_2_03418B0E IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

17_2_03418B0E

Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe

17_2_1E7AACE0

Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe

Code function: 17_2_03411F60 PyArg_ParseTuple,CloseHandle,GetProcessHeap,HeapFree,CloseHandle,Py_BuildValue,

17_2_03411F60

Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Process token adjusted: Debug
Source: C:\Users\user\HelpPane.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug

Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 17_2_03418B0E IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	17_2_03418B0E
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 17_2_10003C1E IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	17_2_10003C1E
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 17_2_1E7AC310 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	17_2_1E7AC310
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 17_2_1E7D3A1A IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	17_2_1E7D3A1A
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 17_2_1E8CDFDE IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	17_2_1E8CDFDE
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 17_2_1E9B2FCE IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	17_2_1E9B2FCE
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 17_2_1ECB5A9A IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	17_2_1ECB5A9A
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 17_2_6CD87C08 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	17_2_6CD87C08
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 21_2_6C857C08 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	21_2_6C857C08

Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe

Code function: 17_2_1E8CABA0 PyArg_ParseTuple,PyEval_SaveThread,keybd_event,PyEval_RestoreThread,_Py_NoneStruct,_Py_NoneStruct,

17_2_1E8CABA0

Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe

Code function: 17_2_1E8CAC20 PyArg_ParseTuple,PyEval_SaveThread,mouse_event,PyEval_RestoreThread,_Py_NoneStruct,_Py_NoneStruct,

17_2_1E8CAC20

Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Process created: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe "C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe"	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Process created: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe "C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe"	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c copy /y C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe C:\Users\user\HelpPane.exe	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c C:\Users\user\HelpPane.exe --startup auto install	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c C:\Users\user\HelpPane.exe start	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\HelpPane.exe C:\Users\user\HelpPane.exe --startup auto install	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Process created: C:\Users\user\HelpPane.exe C:\Users\user\HelpPane.exe --startup auto install	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\HelpPane.exe C:\Users\user\HelpPane.exe start	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Process created: C:\Users\user\HelpPane.exe C:\Users\user\HelpPane.exe start	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Process created: C:\Users\user\HelpPane.exe "C:\Users\user\HelpPane.exe"	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /pid 2284 /f
Source: C:\Users\user\HelpPane.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c copy /y C:\Windows\TEMP\_MEI29~1\xmrig.exe C:\Windows\TEMP\xmrig.exe
Source: C:\Users\user\HelpPane.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c copy /y C:\Windows\TEMP\_MEI29~1\config.json C:\Windows\TEMP\config.json
Source: C:\Users\user\HelpPane.exe	Process created: C:\Windows\Temp\xmrig.exe C:\Windows\TEMP\xmrig.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /pid 2284 /f

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /pid 2284 /f

Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe

Code function: 17_2_1E7A6310 ?SetSecurityDescriptorDacl@PySECURITY_DESCRIPTOR@@SAPAU_object@@PAU2@0@Z,PyArg_ParseTuple,?PyWinObject_AsACL@@YAHPAU_object@@PAPAU_ACL@@H@Z,?_MakeAbsoluteSD@@YAHPAXPAPAX@Z,SetSecurityDescriptorDacl,?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z,?SetSD@PySECURITY_DESCRIPTOR@@QAEHPAX@Z,_Py_NoneStruct,73BB3B4E,73BB3B4E,73BB3B4E,

17_2_1E7A6310

Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe

Code function: 17_2_1E7A7760 ?PyWinMethod_NewSID@@YAPAU_object@@PAU1@0@Z,PyArg_ParseTuple,PyArg_ParseTuple,PyErr_Clear,PyErr_Clear,PyArg_ParseTuple,PyErr_Clear,PyArg_ParseTuple,PySequence_Check,PyExc_TypeError,PyErr_SetString,PySequence_Size,PySequence_Tuple,PyArg_ParseTuple,PyExc_TypeError,PyErr_SetString,AllocateAndInitializeSid,?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z,??0PySID@@QAE@PAX@Z,??0PySID@@QAE@HPAX@Z,

17_2_1E7A7760

Source: 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000011.00000003.1546141632.00000000030D0000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001F.00000003.1636684856.0000000003556000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: DOF_PROGMAN`
Source: 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000011.00000003.1546141632.00000000030D0000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000015.00000003.1660725032.000000000383B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: DOF_PROGMAN

Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe

Code function: 21_2_6C83D4C0 cpuid

21_2_6C83D4C0

Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C: VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C: VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C: VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI71562\Crypto.Cipher._AES.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI71562\_ctypes.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI71562\_socket.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI71562\_ssl.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI71562\_hashlib.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI71562\psutil._psutil_windows.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI71562\netifaces.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI71562\win32service.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI71562\win32api.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI71562\win32event.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI71562\servicemanager.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59482\Crypto.Cipher._AES.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59482\_ctypes.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59482\_socket.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59482\_hashlib.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59482\psutil._psutil_windows.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59482\netifaces.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59482\win32service.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59482\win32api.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI59482\win32event.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI64762\Crypto.Cipher._AES.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI64762\_ctypes.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI64762\_socket.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI64762\_ssl.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI64762\_hashlib.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI64762\psutil._psutil_windows.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI64762\netifaces.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI64762\win32service.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI64762\win32api.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI64762\win32event.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI64762\servicemanager.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13602\Crypto.Cipher._AES.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13602\_ctypes.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13602\_socket.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13602\_hashlib.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13602\psutil._psutil_windows.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13602\netifaces.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13602\win32service.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13602\win32api.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13602\win32event.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13602\servicemanager.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\_MEI29202\Crypto.Cipher._AES.pyd VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\_MEI29202\_ctypes.pyd VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\_MEI29202\_socket.pyd VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\_MEI29202\_hashlib.pyd VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\_MEI29202\psutil._psutil_windows.pyd VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\_MEI29202\netifaces.pyd VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\_MEI29202\win32service.pyd VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\link.txt VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation

Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe

Code function: 17_2_034120B0 GetSystemTimes,PyErr_SetFromWindowsErr,Py_BuildValue,

17_2_034120B0

Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe

Code function: 17_2_1E8C2D40 PyArg_ParseTuple,GetUserNameA,?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z,?PyWinObject_FromTCHAR@@YAPAU_object@@PBDH@Z,

17_2_1E8C2D40

Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe

Code function: 17_2_1E7A7AD0 ?Format@PyTime@@SAPAU_object@@PAU2@0@Z,PyArg_ParseTuple,?PyWinObject_AsString@@YAHPAU_object@@PAPADHPAK@Z,VariantTimeToSystemTime,GetTimeZoneInformation,?PyWinCoreString_FromString@@YAPAU_object@@PBDH@Z,?PyWinObject_FreeString@@YAXPAD@Z,PyExc_ValueError,PyErr_SetString,

17_2_1E7A7AD0

Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe

Code function: 17_2_03417EE0 RtlGetVersion,

17_2_03417EE0

Source: C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Changes security center settings (notifications, updates, antivirus, firewall)

Source: C:\Windows\System32\svchost.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center cval

Jump to behavior

Modifies the windows firewall

Source: C:\Users\user\HelpPane.exe

Process created: C:\Windows\SysWOW64\netsh.exe netsh firewall add allowedprogram C:\Users\user\HelpPane.exe "MyApp" ENABLE

Uses netsh to modify the Windows network and firewall settings

Source: C:\Users\user\HelpPane.exe

Process created: C:\Windows\SysWOW64\netsh.exe netsh firewall add allowedprogram C:\Users\user\HelpPane.exe "MyApp" ENABLE

Source: svchost.exe, 0000000B.00000002.2372616266.0000023F96B02000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: gramFiles%\Windows Defender\MsMpeng.exe
Source: svchost.exe, 0000000B.00000002.2372616266.0000023F96B02000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecNotificationQuery - ROOT\SecurityCenter : SELECT * FROM __InstanceOperationEvent WHERE TargetInstance ISA 'AntiVirusProduct' OR TargetInstance ISA 'FirewallProduct' OR TargetInstance ISA 'AntiSpywareProduct'
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct

Source: HelpPane.exe, 00000021.00000002.2387784874.00000000016AD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: WIN_8t
Source: HelpPane.exe, 00000021.00000002.2387784874.00000000016AD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: WIN_SERVER_2008t
Source: HelpPane.exe, 00000021.00000002.2387784874.00000000016AD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: WIN_SERVER_2003t
Source: HelpPane.exe, 00000021.00000002.2401785898.00000000017B1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: IS_WIN_XP
Source: HelpPane.exe, 00000021.00000002.2387784874.00000000016AD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: tIS_WIN_XPRft
Source: 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000011.00000003.1546141632.00000000030D0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: WIN_SERVER_20038
Source: HelpPane.exe, 00000021.00000002.2401785898.00000000017B1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: WIN_XP
Source: HelpPane.exe, 00000021.00000002.2387784874.00000000016AD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: WIN_SERVER_2008tWIN_VISTAt
Source: HelpPane.exe, 0000001B.00000003.1584262772.0000000002BAE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: WIN_XP`q
Source: HelpPane.exe, 00000021.00000002.2401785898.00000000017B1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: WIN_SERVER_2008
Source: HelpPane.exe, 00000021.00000002.2401785898.00000000017B1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: >>> if get_winver() <= WIN_VISTA:
Source: 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000015.00000003.1662182435.0000000003787000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: WIN_78P
Source: 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000015.00000002.1683781638.00000000037B4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: WIN_SERVER_2003p
Source: HelpPane.exe, 00000021.00000002.2401785898.00000000017B1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: WIN_SERVER_2003
Source: HelpPane.exe, 0000001F.00000002.1651816131.00000000034F7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: WIN_XP qO
Source: HelpPane.exe, 00000021.00000002.2401785898.00000000017B1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: WIN_7
Source: HelpPane.exe, 00000021.00000002.2401785898.00000000017B1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: WIN_8
Source: HelpPane.exe, 00000021.00000002.2387784874.00000000016AD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: WIN_XPRCR-
Source: HelpPane.exe, 00000021.00000002.2387784874.00000000016AD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: WIN_7t
Source: 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000011.00000003.1546141632.00000000030D0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: WIN_XP
Source: HelpPane.exe, 00000021.00000002.2387784874.00000000016AD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: WIN_XPRC
Source: 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000011.00000003.1552716529.0000000002A79000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: >>> if get_winver() <= WIN_VISTA:
Source: HelpPane.exe, 00000021.00000002.2387784874.00000000016AD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: IS_WIN_XPRf
Source: HelpPane.exe, 00000021.00000002.2401785898.00000000017B1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: WIN_VISTA
Source: 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000015.00000002.1683781638.00000000037A3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: WIN_73X{
Source: HelpPane.exe, 00000021.00000002.2387784874.00000000016AD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: WIN_VISTAt

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	11 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	31 Disable or Modify Tools	11 Input Capture	2 System Time Discovery	Remote Services	1 Archive Collected Data	1 Ingress Tool Transfer	1 Exfiltration Over Alternative Protocol	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	1 Native API	1 Create Account	1 Access Token Manipulation	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	11 Input Capture	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 Command and Scripting Interpreter	23 Windows Service	23 Windows Service	31 Obfuscated Files or Information	Security Account Manager	1 System Service Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	11 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	12 Service Execution	1 Bootkit	12 Process Injection	11 Software Packing	NTDS	3 File and Directory Discovery	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	38 System Information Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	341 Masquerading	Cached Domain Credentials	271 Security Software Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	131 Virtualization/Sandbox Evasion	DCSync	131 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Access Token Manipulation	Proc Filesystem	3 Process Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	12 Process Injection	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	1 Bootkit	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	1 Rundll32	Input Capture	System Network Connections Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\_MEI13602\xmrig.exe	100%	Avira	PUA/GM.Miner.OW
C:\Users\user\AppData\Local\Temp\_MEI13602\xmrig.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\_MEI13602\Crypto.Cipher._AES.pyd	3%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI13602\Crypto.Cipher._AES.pyd	1%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\_MEI13602\_ctypes.pyd	3%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI13602\_ctypes.pyd	1%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\_MEI13602\_hashlib.pyd	3%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI13602\_hashlib.pyd	1%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\_MEI13602\_socket.pyd	3%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI13602\_socket.pyd	1%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\_MEI13602\_ssl.pyd	3%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI13602\_ssl.pyd	3%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\_MEI13602\_win32sysloader.pyd	3%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI13602\_win32sysloader.pyd	0%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\_MEI13602\back.jpg	70%	ReversingLabs	Win32.Trojan.Mozi
C:\Users\user\AppData\Local\Temp\_MEI13602\back.jpg	69%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\_MEI13602\bz2.pyd	3%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI13602\bz2.pyd	3%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\_MEI13602\msvcm90.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI13602\msvcm90.dll	0%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\_MEI13602\msvcp90.dll	7%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI13602\msvcp90.dll	0%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\_MEI13602\msvcr90.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI13602\msvcr90.dll	1%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\_MEI13602\netifaces.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI13602\netifaces.pyd	2%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\_MEI13602\perfmon.pyd	3%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI13602\perfmon.pyd	1%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\_MEI13602\psutil._psutil_windows.pyd	3%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI13602\psutil._psutil_windows.pyd	3%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\_MEI13602\pyexpat.pyd	3%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI13602\pyexpat.pyd	3%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\_MEI13602\python27.dll	7%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI13602\python27.dll	0%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\_MEI13602\pywintypes27.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI13602\pywintypes27.dll	1%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\_MEI13602\select.pyd	3%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI13602\select.pyd	1%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\_MEI13602\servicemanager.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI13602\servicemanager.pyd	1%	Virustotal		Browse

Source	Detection	Scanner	Label	Link
https://dynamic.t	0%	URL Reputation	safe
https://mahler:8092/site-updates.py	0%	Avira URL Cloud	safe
http://crl.ver)	0%	Avira URL Cloud	safe
http://motomastyle.com/)	0%	Avira URL Cloud	safe
http://www.valicert.com/	0%	Avira URL Cloud	safe
http://www.valicert.com/	0%	Virustotal		Browse
http://motomastyle.com/)	0%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
dht.transmissionbt.com	87.98.162.88	true	false	high
bttracker.acc.umu.se	130.239.18.158	true	false	high
router.bittorrent.com	67.215.246.10	true	false	high
router.utorrent.com	82.221.103.244	true	false	high
xmr.crypto-pool.fr	unknown	unknown	false	high
bttracker.debian.org	unknown	unknown	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://gcc.gnu.org/bugs/):	xmrig.exe, 0000002A.00000002.2360410503.0000000000401000.00000040.00000001.01000000.0000004C.sdmp	false		high
https://mahler:8092/site-updates.py	5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000011.00000003.1548688208.0000000002BFD000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000015.00000002.1679910074.00000000032A2000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000015.00000003.1667406783.0000000003272000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001B.00000003.1583344375.00000000029EC000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001F.00000003.1634905823.00000000032FC000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 00000021.00000002.2378968453.0000000001481000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
http://docs.python.org/3/library/functools.html#functools.lru_cache	5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000011.00000003.1546141632.000000000301A000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000011.00000003.1551169694.00000000030A9000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000015.00000002.1680902276.0000000003760000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000015.00000003.1663756315.00000000036CD000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001B.00000002.1595079338.0000000002AC1000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001F.00000002.1649970812.00000000033D1000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 00000021.00000002.2401785898.00000000017B1000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 00000021.00000002.2387784874.00000000016AD000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dev.ditu.live.com/REST/v1/Routes/	svchost.exe, 00000005.00000003.1366562208.0000022BC8667000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dev.virtualearth.net/REST/v1/Routes/Driving	svchost.exe, 00000005.00000003.1366654994.0000022BC8658000.00000004.00000020.00020000.00000000.sdmp	false		high
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/comp/gen.ashx	svchost.exe, 00000005.00000003.1366725627.0000022BC8643000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.python.org/	5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000011.00000003.1548688208.0000000002BFD000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000015.00000002.1679910074.00000000032A2000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000015.00000003.1667406783.0000000003272000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001B.00000003.1583344375.00000000029EC000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001F.00000003.1634905823.00000000032FC000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 00000021.00000002.2378968453.0000000001481000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dev.virtualearth.net/REST/v1/Routes/Walking	svchost.exe, 00000005.00000003.1366654994.0000022BC8658000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.google.com/accounts/ClientLogin	5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000011.00000002.1558930870.0000000003145000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000011.00000003.1546141632.00000000030D0000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000015.00000002.1683781638.00000000037D3000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000015.00000003.1662182435.00000000037CE000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001B.00000003.1589010203.0000000002C0A000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001B.00000003.1584262772.0000000002BAE000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001F.00000003.1636684856.00000000034BE000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001F.00000002.1652574954.000000000351A000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 00000021.00000002.2401785898.00000000017B1000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.openssl.org/support/faq.html	5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000011.00000002.1563185803.000000006CCD1000.00000040.00000001.01000000.0000000E.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000011.00000002.1564482512.000000006CDE1000.00000040.00000001.01000000.0000000D.sdmp	false		high
https://dev.ditu.live.com/mapcontrol/logging.ashx	svchost.exe, 00000005.00000003.1366654994.0000022BC8658000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dev.ditu.live.com/REST/v1/Imagery/Copyright/	svchost.exe, 00000005.00000003.1366590796.0000022BC8662000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000005.00000003.1366521059.0000022BC866E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000005.00000003.1366629858.0000022BC865E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000005.00000003.1366654994.0000022BC8658000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000005.00000003.1366697386.0000022BC865A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gri?pv=1&r=	svchost.exe, 00000005.00000002.1367193039.0000022BC862B000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-parameters-6	5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000011.00000003.1548688208.0000000002C44000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000011.00000002.1558160428.0000000002C83000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000015.00000002.1680550064.000000000337C000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000015.00000003.1665420021.000000000337C000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000015.00000003.1670072570.000000000337C000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001B.00000003.1583344375.00000000029EC000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001B.00000003.1586418626.0000000002A71000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001F.00000003.1634905823.00000000032FC000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001F.00000003.1639888476.0000000003384000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 00000021.00000002.2387784874.00000000016AD000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dev.virtualearth.net/REST/v1/Transit/Schedules/	svchost.exe, 00000005.00000002.1367256135.0000022BC863F000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.faqs.org/rfcs/rfc2822.html	5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000011.00000002.1558160428.0000000002CBD000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000011.00000003.1548688208.0000000002C44000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000011.00000002.1556111438.00000000029D1000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000015.00000003.1665420021.0000000003313000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000015.00000003.1671020242.0000000003320000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000015.00000002.1675197722.0000000003081000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001B.00000003.1583344375.00000000029EC000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001B.00000003.1586418626.0000000002A71000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001B.00000002.1591896001.00000000025C1000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001F.00000003.1634905823.00000000032FC000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001F.00000002.1644483289.0000000002E61000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001F.00000003.1639888476.0000000003384000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001F.00000002.1649735478.0000000003384000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 00000021.00000002.2378968453.0000000001481000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 00000021.00000002.2387784874.00000000016AD000.00000004.00000020.00020000.00000000.sdmp	false		high
http://mail.python.org/pipermail/python-dev/2012-June/120787.html	5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000011.00000002.1558160428.0000000002CBD000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000011.00000003.1548688208.0000000002C44000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000015.00000003.1665420021.0000000003313000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000015.00000003.1670072570.0000000003358000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001B.00000002.1595079338.0000000002AC1000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001F.00000002.1649970812.00000000033D1000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 00000021.00000002.2401785898.00000000017B1000.00000004.00000020.00020000.00000000.sdmp	false		high
http://docs.python.org/3/library/subprocess.html	5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000011.00000002.1558860257.00000000030F4000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000011.00000003.1548509909.0000000003181000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000011.00000002.1558930870.0000000003181000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000011.00000003.1552585942.00000000030F2000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000011.00000003.1546141632.00000000030D0000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000015.00000003.1665420021.0000000003313000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000015.00000003.1670072570.0000000003369000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000015.00000002.1680758614.00000000036C0000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000015.00000002.1680550064.0000000003369000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001B.00000002.1592700989.0000000002698000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001B.00000003.1582978042.000000000267F000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001B.00000003.1589010203.0000000002BB1000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001B.00000003.1584262772.0000000002BAE000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001B.00000002.1596516460.0000000002BB2000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001F.00000002.1645792869.0000000002F38000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001F.00000002.1651816131.00000000034BF000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001F.00000003.1636684856.00000000034BE000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001F.00000003.1633383367.0000000002F1F000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 00000021.00000002.2387784874.00000000016AD000.00000004.00000020.00020000.00000000.sdmp	false		high
http://goo.gl/zeJZl	5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000011.00000003.1551169694.00000000030C2000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000011.00000003.1546141632.000000000301A000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000011.00000003.1546141632.00000000030D0000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000015.00000002.1680902276.0000000003779000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000015.00000003.1663756315.00000000036CD000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001B.00000002.1595079338.0000000002AC1000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001F.00000002.1649970812.00000000033D1000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 00000021.00000002.2378968453.0000000001481000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 00000021.00000002.2401785898.00000000017B1000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.python.org/dev/peps/pep-0205/	5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000011.00000002.1558930870.0000000003170000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000011.00000003.1546141632.00000000030D0000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000015.00000003.1662182435.00000000037CE000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000015.00000002.1683781638.00000000037FE000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001B.00000003.1584262772.0000000002BAE000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001B.00000003.1589010203.0000000002C3C000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001F.00000003.1636684856.00000000034BE000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001F.00000002.1652574954.000000000354C000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 00000021.00000002.2401785898.00000000017B1000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.bingmapsportal.com	svchost.exe, 00000005.00000002.1367139186.0000022BC8613000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dev.virtualearth.net/REST/v1/Imagery/Copyright/	svchost.exe, 00000005.00000002.1367256135.0000022BC863F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000005.00000003.1366809213.0000022BC8665000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000005.00000003.1366590796.0000022BC8662000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000005.00000003.1366654994.0000022BC8658000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000005.00000003.1366697386.0000022BC865A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ecn.dev.virtualearth.net/REST/v1/Imagery/Copyright/	svchost.exe, 00000005.00000003.1366562208.0000022BC8667000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000005.00000002.1367193039.0000022BC862B000.00000004.00000020.00020000.00000000.sdmp	false		high
http://pyloris.sourceforge.net/).	5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000011.00000003.1548318526.0000000002A98000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000015.00000003.1665319094.00000000036C4000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001B.00000003.1583344375.00000000029EC000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001B.00000003.1586418626.0000000002A71000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001B.00000002.1594865111.0000000002A7B000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001F.00000002.1645792869.0000000002F38000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001F.00000003.1633383367.0000000002F1F000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 00000021.00000002.2387784874.0000000001632000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dynamic.t0.tiles.ditu.live.com/comp/gen.ashx	svchost.exe, 00000005.00000003.1366654994.0000022BC8658000.00000004.00000020.00020000.00000000.sdmp	false		high
http://python.org/dev/peps/pep-0263/	5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000011.00000002.1566376619.000000006CF51000.00000040.00000001.01000000.00000009.sdmp	false		high
http://www.valicert.com/	cacerts.txt.26.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdv?pv=1&r=	svchost.exe, 00000005.00000003.1366642622.0000022BC865D000.00000004.00000020.00020000.00000000.sdmp	false		high
http://motomastyle.com/)	5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000011.00000003.1548318526.0000000002A98000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000015.00000003.1665319094.00000000036C4000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001B.00000003.1583344375.00000000029EC000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001B.00000003.1586418626.0000000002A71000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001B.00000002.1594865111.0000000002A7B000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001F.00000002.1645792869.0000000002F38000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001F.00000003.1633383367.0000000002F1F000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 00000021.00000002.2387784874.0000000001632000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://dev.ditu.live.com/REST/v1/Transit/Stops/	svchost.exe, 00000005.00000003.1366521059.0000022BC866E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dev.virtualearth.net/REST/v1/Routes/	svchost.exe, 00000005.00000003.1366562208.0000022BC8667000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000005.00000002.1367193039.0000022BC862B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dev.virtualearth.net/REST/v1/Traffic/Incidents/	svchost.exe, 00000005.00000003.1366809213.0000022BC8665000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000005.00000003.1366590796.0000022BC8662000.00000004.00000020.00020000.00000000.sdmp	false		high
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdi?pv=1&r=	svchost.exe, 00000005.00000003.1366757942.0000022BC863D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000005.00000002.1367299375.0000022BC8659000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000005.00000003.1366725627.0000022BC8643000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000005.00000003.1366710386.0000022BC864B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000005.00000003.1366654994.0000022BC8658000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dynamic.api.tiles.ditu.live.com/odvs/gri?pv=1&r=	svchost.exe, 00000005.00000003.1366725627.0000022BC8643000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.ver)	svchost.exe, 00000002.00000002.2383234692.0000017C95800000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
https://dev.virtualearth.net/webservices/v1/LoggingService/LoggingService.svc/Log?	svchost.exe, 00000005.00000003.1366725627.0000022BC8643000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000005.00000003.1366590796.0000022BC8662000.00000004.00000020.00020000.00000000.sdmp	false		high
http://bugs.python.org/issue6973.	5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000011.00000002.1558860257.00000000030F4000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000011.00000003.1548509909.0000000003181000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000011.00000002.1558930870.0000000003181000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000011.00000003.1552585942.00000000030F2000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000011.00000003.1546141632.00000000030D0000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000015.00000003.1665420021.0000000003313000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000015.00000003.1670072570.0000000003369000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000015.00000002.1680758614.00000000036C0000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000015.00000002.1680550064.0000000003369000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001B.00000002.1592700989.0000000002698000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001B.00000003.1582978042.000000000267F000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001B.00000003.1589010203.0000000002BB1000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001B.00000003.1584262772.0000000002BAE000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001B.00000002.1596516460.0000000002BB2000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001F.00000002.1645792869.0000000002F38000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001F.00000002.1651816131.00000000034BF000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001F.00000003.1636684856.00000000034BE000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001F.00000003.1633383367.0000000002F1F000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 00000021.00000002.2387784874.00000000016AD000.00000004.00000020.00020000.00000000.sdmp	false		high
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gd?pv=1&r=	svchost.exe, 00000005.00000003.1366710386.0000022BC864B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dev.virtualearth.net/REST/v1/Locations	svchost.exe, 00000005.00000003.1366654994.0000022BC8658000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dev.ditu.live.com/REST/V1/MapControlConfiguration/native/	svchost.exe, 00000005.00000002.1367299375.0000022BC8659000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000005.00000003.1366654994.0000022BC8658000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dev.virtualearth.net/mapcontrol/logging.ashx	svchost.exe, 00000005.00000003.1366654994.0000022BC8658000.00000004.00000020.00020000.00000000.sdmp	false		high
http://breakingcode.wordpress.com/)	5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000011.00000003.1548318526.0000000002A98000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000015.00000003.1665319094.00000000036C4000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001B.00000003.1583344375.00000000029EC000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001B.00000003.1586418626.0000000002A71000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001B.00000002.1594865111.0000000002A7B000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001F.00000002.1645792869.0000000002F38000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001F.00000003.1633383367.0000000002F1F000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 00000021.00000002.2387784874.0000000001632000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dynamic.api.tiles.ditu.live.com/odvs/gdi?pv=1&r=	svchost.exe, 00000005.00000002.1367256135.0000022BC863F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dynamic.t	svchost.exe, 00000005.00000002.1367211171.0000022BC8634000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://g.live.com/odclientsettings/Prod-C:	svchost.exe, 00000002.00000003.1202934326.0000017C95763000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tools.ietf.org/html/rfc6125#section-6.4.3	5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000011.00000003.1551975369.0000000002B61000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000015.00000003.1669178757.000000000320E000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001B.00000003.1588099914.000000000294F000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001F.00000003.1642101744.000000000325F000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001F.00000002.1647155454.0000000003294000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 00000021.00000002.2387784874.0000000001632000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.openssl.org/support/faq.htmlC:	5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000011.00000002.1563185803.000000006CCD1000.00000040.00000001.01000000.0000000E.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000011.00000002.1564482512.000000006CDE1000.00000040.00000001.01000000.0000000D.sdmp	false		high
https://dev.virtualearth.net/REST/v1/Routes/Transit	svchost.exe, 00000005.00000003.1366654994.0000022BC8658000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/mhammond/pywin320	5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000010.00000003.1530246873.0000000000ED1000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000010.00000003.1529000361.0000000000ED1000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000010.00000003.1531972082.0000000000ED1000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000010.00000003.1532860752.0000000000ED1000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000010.00000003.1532421943.0000000000EE0000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000010.00000003.1531677393.0000000000ED1000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000010.00000003.1532570933.0000000000ED1000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000010.00000003.1532515689.0000000000ED1000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000011.00000002.1563108682.000000001ECC0000.00000004.00000001.01000000.00000011.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000011.00000002.1562417397.000000001E7DD000.00000004.00000001.01000000.00000015.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000011.00000002.1562233172.000000001E7C2000.00000004.00000001.01000000.00000012.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000011.00000002.1562730939.000000001E8E0000.00000004.00000001.01000000.00000013.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000011.00000002.1562906331.000000001E9BC000.00000004.00000001.01000000.00000014.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000014.00000003.1553069270.0000000000F04000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000014.00000003.1549305574.0000000000F01000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000014.00000003.1552714327.0000000000F07000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000014.00000003.1552982239.0000000000F01000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000014.00000003.1550802524.0000000000F09000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000014.00000003.1553307900.0000000000F03000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000014.00000003.1551812101.0000000000F03000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000014.00000003.1552838551.0000000000F11000.00000004.00000020.00020000.00000000.sdmp	false		high
https://g.live.com/odclientsettings/ProdV2-C:	svchost.exe, 00000002.00000003.1202934326.0000017C95752000.00000004.00000800.00020000.00000000.sdmp	false		high
https://t0.ssl.ak.tiles.virtualearth.net/tiles/gen	svchost.exe, 00000005.00000003.1366654994.0000022BC8658000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.google.com/accounts/ClientLoginR	5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000015.00000003.1662182435.00000000037CE000.00000004.00000020.00020000.00000000.sdmp	false		high
https://tiles.virtualearth.net/tiles/cmd/StreetSideBubbleMetaData?north=	svchost.exe, 00000005.00000002.1367299375.0000022BC8659000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000005.00000003.1366654994.0000022BC8658000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dynamic.api.tiles.ditu.live.com/odvs/gdv?pv=1&r=	svchost.exe, 00000005.00000003.1366590796.0000022BC8662000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.faqs.org/rfcs/rfc822.html	5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000011.00000002.1558160428.0000000002CBD000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000011.00000003.1548688208.0000000002C44000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000015.00000003.1665420021.0000000003313000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000015.00000003.1671020242.0000000003320000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001B.00000003.1583344375.00000000029EC000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001B.00000003.1586418626.0000000002A71000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001F.00000003.1634905823.00000000032FC000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001F.00000003.1639888476.0000000003384000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001F.00000002.1649735478.0000000003384000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 00000021.00000002.2387784874.00000000016AD000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dev.ditu.live.com/REST/v1/Locations	svchost.exe, 00000005.00000003.1366654994.0000022BC8658000.00000004.00000020.00020000.00000000.sdmp	false		high
http://docs.python.org/library/socket.html#socket.setdefaulttimeout	5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000011.00000003.1548688208.0000000002C44000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000011.00000003.1552585942.00000000030EF000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000011.00000002.1558160428.0000000002C83000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000011.00000003.1546141632.00000000030D0000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000015.00000003.1665420021.0000000003313000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000015.00000003.1670072570.0000000003321000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000015.00000003.1666841335.00000000036C2000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000015.00000002.1680824552.00000000036C3000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001B.00000003.1586142862.00000000029BA000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001B.00000002.1595079338.0000000002AC1000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001F.00000002.1649970812.00000000033D1000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001F.00000003.1639282818.00000000032E6000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001F.00000002.1648805788.00000000032F4000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 00000021.00000002.2378968453.0000000001481000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 00000021.00000002.2401785898.00000000017B1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dynamic.api.tiles.ditu.live.com/odvs/gd?pv=1&r=	svchost.exe, 00000005.00000003.1366771313.0000022BC8630000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000005.00000003.1366590796.0000022BC8662000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
42.237.49.201	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	true
42.224.87.163	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
5.228.30.1	unknown	Russian Federation	42610	NCNET-ASRU	false
125.59.228.153	unknown	Hong Kong	9908	HKCABLE2-HK-APHKCableTVLtdHK	false
114.69.8.66	unknown	Japan	2519	VECTANTARTERIANetworksCorporationJP	false
166.132.251.171	unknown	United States	20057	ATT-MOBILITY-LLC-AS20057US	false
33.165.128.201	unknown	United States	2686	ATGS-MMD-ASUS	false
175.125.176.180	unknown	Korea Republic of	9318	SKB-ASSKBroadbandCoLtdKR	false
101.182.156.29	unknown	Australia	1221	ASN-TELSTRATelstraCorporationLtdAU	false
218.86.210.217	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
138.235.173.204	unknown	New Zealand	11231	GETTYSBURG-DOMUS	false
89.224.159.178	unknown	France	12670	AS-COMPLETELFR	false
38.34.236.33	unknown	United States	174	COGENT-174US	false
59.94.103.94	unknown	India	9829	BSNL-NIBNationalInternetBackboneIN	false
117.204.203.68	unknown	India	9829	BSNL-NIBNationalInternetBackboneIN	true
12.184.47.179	unknown	United States	7018	ATT-INTERNET4US	false
2.71.236.97	unknown	Sweden	44034	HI3GSE	false
222.113.99.215	unknown	Korea Republic of	4766	KIXS-AS-KRKoreaTelecomKR	false
173.45.76.36	unknown	United States	10297	ENET-2US	false
186.189.91.18	unknown	Argentina	28075	ARLINKSAAR	false
121.184.174.245	unknown	Korea Republic of	4766	KIXS-AS-KRKoreaTelecomKR	false
84.69.104.29	unknown	United Kingdom	5378	VodafoneGB	false
84.236.115.109	unknown	Hungary	20845	DIGICABLEHU	false
197.85.75.117	unknown	South Africa	10474	OPTINETZA	false
105.214.99.140	unknown	South Africa	16637	MTNNS-ASZA	false
1.241.172.105	unknown	Korea Republic of	38408	GOEAY-AS-KRGYEONGGIPROVINCIALANYANGOFFICEOFEDUCATION	false
206.107.193.21	unknown	United States	12241	NCTCNET-AS1US	false
9.206.211.17	unknown	United States	3356	LEVEL3US	false
117.220.145.201	unknown	India	9829	BSNL-NIBNationalInternetBackboneIN	false
216.154.236.131	unknown	United States	16966	SBCIDC-LSAN03US	false
117.204.203.98	unknown	India	9829	BSNL-NIBNationalInternetBackboneIN	false
20.41.150.192	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
177.201.66.48	unknown	Brazil	8167	BrasilTelecomSA-FilialDistritoFederalBR	false
117.198.31.15	unknown	India	9829	BSNL-NIBNationalInternetBackboneIN	false
158.176.34.195	unknown	United States	721	DNIC-ASBLK-00721-00726US	false
186.72.96.89	unknown	Panama	11556	CableWirelessPanamaPA	false
90.247.176.102	unknown	United Kingdom	5378	VodafoneGB	false
78.132.140.174	unknown	Russian Federation	13056	RT-TMB-ASTambovbranchRU	false
134.19.135.7	unknown	Russian Federation	204137	ORIONNET-IRKRU	false
117.129.10.190	unknown	China	56048	CMNET-BEIJING-APChinaMobileCommunicaitonsCorporationCN	false
115.90.53.214	unknown	Korea Republic of	3786	LGDACOMLGDACOMCorporationKR	false
187.118.230.9	unknown	Brazil	26599	TELEFONICABRASILSABR	false
117.187.160.123	unknown	China	9808	CMNET-GDGuangdongMobileCommunicationCoLtdCN	false
174.6.79.142	unknown	Canada	6327	SHAWCA	false
149.54.172.147	unknown	Japan	7524	HANSHINITECHANKYUHANSHINCOLTDJP	false
93.204.129.92	unknown	Germany	3320	DTAGInternetserviceprovideroperationsDE	false
113.13.157.160	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
117.248.28.191	unknown	India	9829	BSNL-NIBNationalInternetBackboneIN	false
109.241.54.95	unknown	Poland	29314	VECTRANET-ASAlZwyciestwa25381-525GdyniaPolandPL	false
59.184.63.155	unknown	India	17813	MTNL-APMahanagarTelephoneNigamLimitedIN	false
129.176.151.113	unknown	United States	7973	MAYOUS	false
37.187.104.135	unknown	France	16276	OVHFR	false
56.188.36.232	unknown	United States	2686	ATGS-MMD-ASUS	false
120.59.35.38	unknown	India	17813	MTNL-APMahanagarTelephoneNigamLimitedIN	false
218.148.27.97	unknown	Korea Republic of	4766	KIXS-AS-KRKoreaTelecomKR	false
119.130.67.138	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
49.3.187.144	unknown	Australia	4804	MPX-ASMicroplexPTYLTDAU	false
89.162.86.210	unknown	Norway	29695	ALTIBOX_ASNorwayNO	false
210.6.44.210	unknown	Hong Kong	9269	HKBN-AS-APHongKongBroadbandNetworkLtdHK	false
172.98.71.235	unknown	United States	46562	TOTAL-SERVER-SOLUTIONSUS	false
14.69.93.166	unknown	Korea Republic of	4766	KIXS-AS-KRKoreaTelecomKR	false
73.170.185.2	unknown	United States	7922	COMCAST-7922US	false
219.135.111.130	unknown	China	58466	CT-GUANGZHOU-IDCCHINANETGuangdongprovincenetworkCN	false
164.92.178.50	unknown	United States	46930	ASN-DPSDUS	false
37.27.107.122	unknown	Iran (ISLAMIC Republic Of)	39232	UNINETAZ	false
37.145.99.140	unknown	Russian Federation	8402	CORBINA-ASOJSCVimpelcomRU	false
171.6.174.90	unknown	Thailand	45758	TRIPLETNET-AS-APTripleTInternetTripleTBroadbandTH	false
112.223.108.182	unknown	Korea Republic of	3786	LGDACOMLGDACOMCorporationKR	false
218.32.108.110	unknown	Taiwan; Republic of China (ROC)	9919	NCIC-TWNewCenturyInfoCommTechCoLtdTW	false
200.112.162.106	unknown	Argentina	22080	BroadbandtechSAAR	false
117.204.199.199	unknown	India	9829	BSNL-NIBNationalInternetBackboneIN	true
173.69.179.200	unknown	United States	701	UUNETUS	false
77.130.185.28	unknown	France	15557	LDCOMNETFR	false
119.231.203.174	unknown	Japan	17511	OPTAGEOPTAGEIncJP	false
133.66.143.89	unknown	Japan	17946	GUCCGifuUniversityJP	false
5.228.119.247	unknown	Russian Federation	42610	NCNET-ASRU	false
182.207.58.91	unknown	China	17799	CHINATELECOM-LN-AS-APasnforLiaoningProvincialNetofCT	false
177.131.28.60	unknown	Brazil	262378	CompuserviceEmpreendimentosLtdaBR	false
46.129.190.97	unknown	Netherlands	33915	TNF-ASNL	false
187.23.214.191	unknown	Brazil	28573	CLAROSABR	false
76.104.115.188	unknown	United States	7922	COMCAST-7922US	false
165.72.29.85	unknown	Czech Republic	2571	DHLNETCZ	false
53.221.122.183	unknown	Germany	31399	DAIMLER-ASITIGNGlobalNetworkDE	false
14.192.214.92	unknown	Malaysia	9534	MAXIS-AS1-APBinariangBerhadMY	false
23.208.54.103	unknown	United States	16625	AKAMAI-ASUS	false
199.183.62.95	unknown	United States	7029	WINDSTREAMUS	false
31.179.179.70	unknown	Poland	6830	LIBERTYGLOBALLibertyGlobalformerlyUPCBroadbandHolding	false
101.80.251.148	unknown	China	4812	CHINANET-SH-APChinaTelecomGroupCN	false
59.95.130.130	unknown	India	9829	BSNL-NIBNationalInternetBackboneIN	false
41.91.123.159	unknown	Egypt	33771	SAFARICOM-LIMITEDKE	false
24.228.129.149	unknown	United States	6128	CABLE-NET-1US	false
78.250.171.200	unknown	France	12322	PROXADFR	false
121.113.240.60	unknown	Japan	4713	OCNNTTCommunicationsCorporationJP	false
42.235.44.217	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
212.21.23.146	unknown	Russian Federation	8427	MAGINFO-ASMagnitogorskRussiaRU	false
112.161.55.169	unknown	Korea Republic of	4766	KIXS-AS-KRKoreaTelecomKR	false
112.115.143.134	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
35.240.35.155	unknown	United States	15169	GOOGLEUS	false
47.71.80.88	unknown	United States	3209	VODANETInternationalIP-BackboneofVodafoneDE	false
215.150.178.132	unknown	United States	721	DNIC-ASBLK-00721-00726US	false

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1437957
Start date and time:	2024-05-08 08:39:51 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 12m 6s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	49
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	1
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	240506-b7lv1sfmcw_pw_infected.zip
Detection:	MAL
Classification:	mal100.rans.troj.evad.mine.winZIP@58/169@16/100
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 92% Number of executed functions: 14 Number of non-executed functions: 458
Cookbook Comments:	Found application associated with file extension: .zip

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, consent.exe, SIHClient.exe, MoUsoCoreWorker.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 96.7.158.101
Excluded domains from analysis (whitelisted): fs.microsoft.com, slscr.update.microsoft.com, e16604.g.akamaiedge.net, ctldl.windowsupdate.com, prod.fs.microsoft.com.akadns.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtQueryVolumeInformationFile calls found.

Simulations

Behavior and APIs

Time	Type	Description
08:40:27	API Interceptor	2x Sleep call for process: svchost.exe modified
08:41:15	API Interceptor	1249x Sleep call for process: HelpPane.exe modified
08:41:35	API Interceptor	1x Sleep call for process: MpCmdRun.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
206.107.193.21	EqNoI24jIj.elf	Get hash	malicious	Mirai	Browse
78.132.140.174	sora.mips	Get hash	malicious	Mirai	Browse
197.85.75.117	ftIGtsgqN3.elf	Get hash	malicious	Mirai, Moobot	Browse
197.85.75.117	mpsl.elf	Get hash	malicious	Mirai, Moobot	Browse
105.214.99.140	5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.zip	Get hash	malicious	Xmrig	Browse
1.241.172.105	240506-b7lv1sfmcw_pw_infected.zip	Get hash	malicious	Xmrig	Browse
	5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.zip	Get hash	malicious	Xmrig	Browse
	Photo.scr.exe	Get hash	malicious	Xmrig	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bttracker.acc.umu.se	240506-b7lv1sfmcw_pw_infected.zip	Get hash	malicious	Xmrig	Browse	130.239.18.158
	5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.zip	Get hash	malicious	Xmrig	Browse	130.239.18.158
	na.elf	Get hash	malicious	Mirai	Browse	130.239.18.158
	Photo.scr.exe	Get hash	malicious	Xmrig	Browse	130.239.18.158
	bin.sh	Get hash	malicious	Mirai	Browse	130.239.18.158
	bin.sh	Get hash	malicious	Mirai	Browse	130.239.18.158
	AV.scr	Get hash	malicious	Xmrig	Browse	130.239.18.158
	Photo.scr	Get hash	malicious	Xmrig	Browse	130.239.18.158
	AV.scr	Get hash	malicious	Xmrig	Browse	130.239.18.158
	3aakN9FzA5	Get hash	malicious	Gafgyt Mirai	Browse	130.239.18.158
router.bittorrent.com	240506-b7lv1sfmcw_pw_infected.zip	Get hash	malicious	Xmrig	Browse	67.215.246.10
	5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.zip	Get hash	malicious	Xmrig	Browse	67.215.246.10
	BitTorrent-7.6.exe	Get hash	malicious	Unknown	Browse	67.215.246.10
	BitTorrent-7.6.exe	Get hash	malicious	Unknown	Browse	67.215.246.10
	na.elf	Get hash	malicious	Mirai	Browse	67.215.246.10
	SecuriteInfo.com.W32.uTorrent.A.gen.Eldorado.30680.8608.exe	Get hash	malicious	Unknown	Browse	67.215.246.10
	SecuriteInfo.com.W32.uTorrent.A.gen.Eldorado.30680.8608.exe	Get hash	malicious	Unknown	Browse	67.215.246.10
	Photo.scr.exe	Get hash	malicious	Xmrig	Browse	67.215.246.10
	bin.sh	Get hash	malicious	Mirai	Browse	67.215.246.10
	bin.sh	Get hash	malicious	Mirai	Browse	67.215.246.10
router.utorrent.com	240506-b7lv1sfmcw_pw_infected.zip	Get hash	malicious	Xmrig	Browse	82.221.103.244
	5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.zip	Get hash	malicious	Xmrig	Browse	82.221.103.244
	BitTorrent-7.6.exe	Get hash	malicious	Unknown	Browse	82.221.103.244
	BitTorrent-7.6.exe	Get hash	malicious	Unknown	Browse	82.221.103.244
	na.elf	Get hash	malicious	Mirai	Browse	82.221.103.244
	SecuriteInfo.com.W32.uTorrent.A.gen.Eldorado.30680.8608.exe	Get hash	malicious	Unknown	Browse	82.221.103.244
	SecuriteInfo.com.W32.uTorrent.A.gen.Eldorado.30680.8608.exe	Get hash	malicious	Unknown	Browse	82.221.103.244
	Photo.scr.exe	Get hash	malicious	Xmrig	Browse	82.221.103.244
	bin.sh	Get hash	malicious	Mirai	Browse	82.221.103.244
	bin.sh	Get hash	malicious	Mirai	Browse	82.221.103.244
dht.transmissionbt.com	240506-b7lv1sfmcw_pw_infected.zip	Get hash	malicious	Xmrig	Browse	87.98.162.88
	5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.zip	Get hash	malicious	Xmrig	Browse	87.98.162.88
	na.elf	Get hash	malicious	Mirai	Browse	87.98.162.88
	Photo.scr.exe	Get hash	malicious	Xmrig	Browse	87.98.162.88
	bin.sh	Get hash	malicious	Mirai	Browse	212.129.33.59
	bin.sh	Get hash	malicious	Mirai	Browse	212.129.33.59
	AV.scr	Get hash	malicious	Xmrig	Browse	212.129.33.59
	Photo.scr	Get hash	malicious	Xmrig	Browse	87.98.162.88
	AV.scr	Get hash	malicious	Xmrig	Browse	212.129.33.59
	3aakN9FzA5	Get hash	malicious	Gafgyt Mirai	Browse	87.98.162.88

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
NCNET-ASRU	arm7.elf	Get hash	malicious	Mirai	Browse	109.173.24.160
	0Vjz9RSZxz.elf	Get hash	malicious	Mirai	Browse	46.242.79.23
	3P4acRdms1.elf	Get hash	malicious	Mirai	Browse	46.242.79.18
	NMdpQecbkg.elf	Get hash	malicious	Mirai	Browse	109.173.119.125
	SecuriteInfo.com.Trojan.InstallCore.4086.15026.2213.exe	Get hash	malicious	PrivateLoader, PureLog Stealer	Browse	46.242.55.93
	MYb7GhRJl7.elf	Get hash	malicious	Mirai	Browse	46.242.31.61
	SFTNQEBmOA.elf	Get hash	malicious	Unknown	Browse	77.37.144.82
	vN07UXsZlU.elf	Get hash	malicious	Mirai	Browse	46.242.79.73
	DqbYZ8Ns4k.elf	Get hash	malicious	Mirai	Browse	85.30.222.224
	QDpFqspZaI.elf	Get hash	malicious	Mirai	Browse	46.242.79.78
CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	gL3eLP81mu.elf	Get hash	malicious	Mirai, Okiru	Browse	60.26.69.50
	Mu9xueyCfR.elf	Get hash	malicious	Mirai, Okiru	Browse	110.248.243.217
	BduAJLAMAy.elf	Get hash	malicious	Mirai, Okiru	Browse	175.149.158.54
	240506-b7lv1sfmcw_pw_infected.zip	Get hash	malicious	Xmrig	Browse	1.63.35.179
	TZ0CZuIFh6.elf	Get hash	malicious	Mirai	Browse	113.230.180.129
	23cu4ulxOg.elf	Get hash	malicious	Mirai	Browse	110.240.165.251
	XQGR9Orz4m.elf	Get hash	malicious	Mirai	Browse	222.143.146.137
	nBNNVLnUqX.elf	Get hash	malicious	Mirai	Browse	27.197.55.31
	IrRNGfAWLp.elf	Get hash	malicious	Mirai	Browse	123.147.105.157
	5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.zip	Get hash	malicious	Xmrig	Browse	125.43.93.177
HKCABLE2-HK-APHKCableTVLtdHK	FZAuI72f4q.elf	Get hash	malicious	Unknown	Browse	222.167.42.190
	RDFchOT4i0.exe	Get hash	malicious	Unknown	Browse	218.252.244.126
	3OcPSlVa7n.elf	Get hash	malicious	Mirai	Browse	125.59.216.44
	hiqWVuoNwf.elf	Get hash	malicious	Mirai	Browse	61.15.226.124
	b8SFaKFQBb.elf	Get hash	malicious	Mirai	Browse	61.10.229.118
	xQwEu422am.elf	Get hash	malicious	Mirai	Browse	61.15.214.35
	9fh0epPcJb.elf	Get hash	malicious	Mirai	Browse	222.166.49.71
	hYxGptbUmA.elf	Get hash	malicious	Unknown	Browse	218.253.14.2
	TF2AD5Jnbu.elf	Get hash	malicious	Unknown	Browse	218.254.13.178
	4eGsl7kZ8Y.elf	Get hash	malicious	Mirai	Browse	203.168.169.28
CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	gL3eLP81mu.elf	Get hash	malicious	Mirai, Okiru	Browse	60.26.69.50
	Mu9xueyCfR.elf	Get hash	malicious	Mirai, Okiru	Browse	110.248.243.217
	BduAJLAMAy.elf	Get hash	malicious	Mirai, Okiru	Browse	175.149.158.54
	240506-b7lv1sfmcw_pw_infected.zip	Get hash	malicious	Xmrig	Browse	1.63.35.179
	TZ0CZuIFh6.elf	Get hash	malicious	Mirai	Browse	113.230.180.129
	23cu4ulxOg.elf	Get hash	malicious	Mirai	Browse	110.240.165.251
	XQGR9Orz4m.elf	Get hash	malicious	Mirai	Browse	222.143.146.137
	nBNNVLnUqX.elf	Get hash	malicious	Mirai	Browse	27.197.55.31
	IrRNGfAWLp.elf	Get hash	malicious	Mirai	Browse	123.147.105.157
	5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.zip	Get hash	malicious	Xmrig	Browse	125.43.93.177

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\_MEI13602\_ctypes.pyd	240506-b7lv1sfmcw_pw_infected.zip	Get hash	malicious	Xmrig	Browse
	5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.zip	Get hash	malicious	Xmrig	Browse
	240424-ll91tsge34_pw_infected.zip	Get hash	malicious	Xmrig	Browse
	Photo.scr.exe	Get hash	malicious	Xmrig	Browse
	AV.scr	Get hash	malicious	Xmrig	Browse
	Photo.scr	Get hash	malicious	Xmrig	Browse
	AV.scr	Get hash	malicious	Xmrig	Browse
C:\Users\user\AppData\Local\Temp\_MEI13602\Crypto.Cipher._AES.pyd	240506-b7lv1sfmcw_pw_infected.zip	Get hash	malicious	Xmrig	Browse
	5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.zip	Get hash	malicious	Xmrig	Browse
	240424-ll91tsge34_pw_infected.zip	Get hash	malicious	Xmrig	Browse
	Photo.scr.exe	Get hash	malicious	Xmrig	Browse
	AV.scr	Get hash	malicious	Xmrig	Browse
	Photo.scr	Get hash	malicious	Xmrig	Browse
	AV.scr	Get hash	malicious	Xmrig	Browse

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7946097181866244
Encrypted:	false
SSDEEP:	3072:yJjAgNE4Pj5vHcjTcyBP9UjaaQ/ka4qWQ:QAgN8nj/ka4
MD5:	4B575E8D06E1FB32AF1E6471E09915E6
SHA1:	D621E7835E1512231C11571F574ADC0F6995323C
SHA-256:	89B5F8F47265EBECBE90022B861604B7DCCA20AD98DA809B345A7BBF9FAD9E3B
SHA-512:	EE342D5D3154BE3C6BEE890BD172F1676AAD34346B4B25454167CAF50A35DE9A7878B00F6F74452F221D135021D3780DB8CED16BE2413E77B71EDFEED8128401
Malicious:	false
Preview:	..6.........@..@.....{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@....................................d6d6.#.........`h.................h.......6.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x2e59846a, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7864759782593057
Encrypted:	false
SSDEEP:	1536:DSB2ESB2SSjlK/6vDfi5Wy10MctJ+t9ka4XQ0/Ykr3g16L2UPkLk+kyt4eCu3uZB:Dazaovh7uka4Es2U1RFNp3pvHzrHBHz
MD5:	ECA3D4B78919AC1A1D0C2011EF830D12
SHA1:	6AF0187F2F8B5B7B772778E4372C0FCA5E8DFFB0
SHA-256:	DFEB386E5F8173D9E724A2042781D1EB9E2D5AEEB09CBDA2CE1945C038A8BE3C
SHA-512:	482EC150FA800ECE90863CE787ED76B0C27220D94B59902B1779910D0928E4327E2DF4261F62FD42BCD80C037651DA52627D984EAA3B1BE7E2CFCE390527E93D
Malicious:	false
Preview:	.Y.j... ...............X\...;...{......................0.z...... ...{...(...\|].h.\|.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ............{...............................................................................................................................................................................................2...{...................................h.p.(...\|{=................I.A7.(...\|]..........................#......h.\|.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	PGP symmetric key encrypted data - salted & iterated -
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08144549966781206
Encrypted:	false
SSDEEP:	3:31llEYeJrJpYoMsjv/Ss/IGYZX/0jtJptlAllSdLvl+/rS56/:lllEzJ9SJsY8X5AQN0e
MD5:	A23BB7AAA5594ACBF8EB2A61BA3C06E6
SHA1:	28B77219C2A1F1430568C3A81CC1373D18936B16
SHA-256:	57CD6E93A4EF4A2D65FA3E20A90984D9C6AA494C42120BAC18BF368DF64AF5B5
SHA-512:	A46F71758FC79FC2F51D073FF2E9153BB0A04331C27A1F6CB3C5062B62589D3D33FB505B6DCD00B549BD749FEC3B467B29F4CE8EC49FB184DB9689007E66C6A6
Malicious:	false
Preview:	...i.....................................;...{...(...\|].. ...{........... ...{... ...{..#.#.. ...{.\|................I.A7.(...\|].........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\USOShared\Logs\System\UpdateSessionOrchestration.eee4f034-8eeb-4401-9a1e-ac155fc48dae.1.etl

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	4096
Entropy (8bit):	1.1926752059613817
Encrypted:	false
SSDEEP:	12:lXjqj2xX/7EjQkk56GWtbgjO3s7Nxk56G5lURSxlWv5XN:1tVkGtm2jGt5gBN
MD5:	3655F325BF415C654A42D776DB21BE9C
SHA1:	4479CF8B32372EC4A0B21FA19EB0B5F69E01E9DB
SHA-256:	7EB9A423113110BA91E425260A36FD8580CA9706D52F0DA03DBBE9732CD679A8
SHA-512:	3403B3A1C9CF23E9CD38A57E65AD6DD99A8B8B8E6A30C28FE3D7C58E3530A489F8B95B5B07F2C2CAC1A76819B34BD366E664327297459B5FDF1C056B641A39FF
Malicious:	false
Preview:	............................................................................D.............,.....................eJ..............Zb..K....(..........................................@.t.z.r.e.s...d.l.l.,.-.3.2.2.......................................................@.t.z.r.e.s...d.l.l.,.-.3.2.1.............................................................&8.Y............,.............U.p.d.a.t.e.S.e.s.s.i.o.n.O.r.c.h.e.s.t.r.a.t.i.o.n...C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.U.S.O.S.h.a.r.e.d.\.L.o.g.s.\.S.y.s.t.e.m.\.U.p.d.a.t.e.S.e.s.s.i.o.n.O.r.c.h.e.s.t.r.a.t.i.o.n...e.e.e.4.f.0.3.4.-.8.e.e.b.-.4.4.0.1.-.9.a.1.e.-.a.c.1.5.5.f.c.4.8.d.a.e...1...e.t.l...........P.P...........,.....................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI13602\Crypto.Cipher._AES.pyd

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	7.553130526678379
Encrypted:	false
SSDEEP:	384:50Q1C9jViLl7hDB6n/PtHU2wr8gj93KqmilaNJawcudoD7U:dC8LU/PBU8itClnbcuyD7U
MD5:	371397E80A55D432DA47311B8EF25317
SHA1:	71617777D6A2500D6464D7B394C8BE5F1E4E119E
SHA-256:	C1A900615C9500C46B9602C30C53F299290B03632208EF1152AF8830AB73AD17
SHA-512:	3139E2848ACF02CC8475449F213873D2C2B7196F6A55C70D2D8F8B487020387740364E5CA0AA584624D1B9B01B965146A2F0E15EEF34830C7C0ECBB8637DAE03
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3% Antivirus: Virustotal, Detection: 1%, Browse
Joe Sandbox View:	Filename: 240506-b7lv1sfmcw_pw_infected.zip, Detection: malicious, Browse Filename: 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.zip, Detection: malicious, Browse Filename: 240424-ll91tsge34_pw_infected.zip, Detection: malicious, Browse Filename: Photo.scr.exe, Detection: malicious, Browse Filename: AV.scr, Detection: malicious, Browse Filename: Photo.scr, Detection: malicious, Browse Filename: AV.scr, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........+\8.J2k.J2k.J2k.Ik.J2k...k.J2k...k.J2k...k.J2k.2.k.J2k.J3k.J2k...k.J2k...k.J2k...k.J2kRich.J2k........PE..L....4.S...........!.....@..........`...................................................................................D...........................................................................8...H...........................................UPX0....................................UPX1.....@.......:..................@...UPX2.................>..............@......................................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI13602\Include\pyconfig.h

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	C source, ASCII text
Category:	dropped
Size (bytes):	21321
Entropy (8bit):	5.345136937906198
Encrypted:	false
SSDEEP:	384:pGpFpaU1kgCw8r+MIP8Bj5DvVySh3awQBoerw8W+PYV0FGYfN/+:pGpFpb+IU99UShATrw8W+AKF/+
MD5:	BC185DE8B2437963368A85FDD9852951
SHA1:	1459F1428214FCCA7F203FB3A3AFF28E16EB9C1B
SHA-256:	8B130D901E0F83B55699D565F103F2F8F1B3A51712EBB4B9646EA517CC1F04D6
SHA-512:	918469D9A59FE059F3C7C93F34C8D2D07CB8A9BF5E953A1527922ED5C65FF4A2DF50BBC78ED9CE146BF3A1FB6F1763F061262FA4A937BEEEE1FEB8A99E31339E
Malicious:	false
Preview:	#ifndef Py_CONFIG_H.#define Py_CONFIG_H../* pyconfig.h. NOT Generated automatically by configure...This is a manually maintained version used for the Watcom,.Borland and Microsoft Visual C++ compilers. It is a.standard part of the Python distribution...WINDOWS DEFINES:.The code specific to Windows should be wrapped around one of.the following #defines..MS_WIN64 - Code specific to the MS Win64 API.MS_WIN32 - Code specific to the MS Win32 (and Win64) API (obsolete, this covers all supported APIs).MS_WINDOWS - Code specific to Windows, but all versions..MS_WINCE - Code specific to Windows CE.Py_ENABLE_SHARED - Code if the Python core is built as a DLL...Also note that neither "_M_IX86" or "_MSC_VER" should be used for.any purpose other than "Windows Intel x86 specific" and "Microsoft.compiler specific". Therefore, these should be very rare....NOTE: The following symbols are deprecated:.NT, USE_DL_EXPORT, USE_DL_IMPORT, DL_EXPORT, DL_IMPORT.MS_CORE_DLL...WIN32 is still required for the

C:\Users\user\AppData\Local\Temp\_MEI13602\Microsoft.VC90.CRT.manifest

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1050
Entropy (8bit):	5.382436822526041
Encrypted:	false
SSDEEP:	24:2dtn3mGv+zg4NnEN4XKHVJrMmV6LSWV5rcb3S:ch35+zg4i0KHVVdOmS
MD5:	BFB93876892CCA8E2AD0021585C34C8B
SHA1:	0DDE1B225C98825A09D8FF85F462571C9C862E35
SHA-256:	0D060ED7C25159B7B75F16D449963BFD639C15B3C5280BC7897403268C2B9F35
SHA-512:	FE70540B3B3FA88B32DFB2FF7406A3A9819E7862B850D871B932996BBEFFDBC70D7192D6E3196A8583B2DB756CA9CC278505AFBE585BA30EB1222D4F8BE15B7B
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<assembly manifestVersion="1.0" xmlns="urn:schemas-microsoft-com:asm.v1">.. <noInheritable/>.. <assemblyIdentity name="Microsoft.VC90.CRT" processorArchitecture="x86" publicKeyToken="1fc8b3b9a1e18e3b" type="win32" version="9.0.30729.6161"/>.. <file hash="7021457b391b35606e708c69987e4b6f606609ee" hashalg="SHA1" name="msvcr90.dll"/>.. <file hash="88549dd3ce8eaa62ca8aad0e96ddd9fec2203628" hashalg="SHA1" name="msvcp90.dll"/>.. <file hash="65ef374affa5b48827e539b35b3275c201b41fc9" hashalg="SHA1" name="msvcm90.dll"/>.. <compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1">.. <application>.. <supportedOS Id="{1f676c76-80e1-4239-95bb-83d0f6d0da78}"/>.. <supportedOS Id="{4a2f28e3-53b9-4441-ba9c-d69d4a4a6e38}"/>.. <supportedOS Id="{e2011457-1546-43c5-a5fe-008deee3d3f0}"/>.. <supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}"/>.. <supportedOS Id="{8e0f7a12-bfb3-4fe8-b9a5-48fd50a15a9a}"/>..

C:\Users\user\AppData\Local\Temp\_MEI13602\_ctypes.pyd

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	37888
Entropy (8bit):	7.848484052157707
Encrypted:	false
SSDEEP:	768:pAXLisB/qV2nQnf33sWcCRWKZac3VWw6cLA3zReukhRnbcuyD7U:pAnBi8nQf3sYToclt6cLUCRnouy8
MD5:	6CB8B560EFBC381651D2045F1571D7C8
SHA1:	15283A7A467ADB7B6D7A7182F660DD783F90E483
SHA-256:	6456FEA123E04BCEC8A8EED26160E1DF5482E69D187D3E1A0C428995472AC134
SHA-512:	CA2958095E8E08B5EF05EC9DE15B7D1EB180923A40B90356DB56A124101C96D8E745001948B89DBE9D6B9CE3C2029F7E9EAF20C73FA1D410A821D6605830BFC0
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3% Antivirus: Virustotal, Detection: 1%, Browse
Joe Sandbox View:	Filename: 240506-b7lv1sfmcw_pw_infected.zip, Detection: malicious, Browse Filename: 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.zip, Detection: malicious, Browse Filename: 240424-ll91tsge34_pw_infected.zip, Detection: malicious, Browse Filename: Photo.scr.exe, Detection: malicious, Browse Filename: AV.scr, Detection: malicious, Browse Filename: Photo.scr, Detection: malicious, Browse Filename: AV.scr, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...................F.....W.....P......@..........Z.....A.....B...Rich..................PE..L...*>CX...........!............. .. ....0................................................@.........................<...........<.......................................................................H...........................................UPX0..... ..............................UPX1.........0......................@...UPX2................................@......................................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI13602\_hashlib.pyd

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	351744
Entropy (8bit):	7.996557276168139
Encrypted:	true
SSDEEP:	6144:Xh0byJKrtKOFhjnTtMoy8gpVI/xxWo/nX0NKOzyGFmJ559Vq2SeTsRgIIGYMowwZ:2bymtjF1TtMod/xweDK7FmJ5rLVYTIGm
MD5:	EE134421FBABEB565E4F3CA721331C2E
SHA1:	4B03BDD142C6A7BB6F74ABE968C5B76B63E06059
SHA-256:	7863E1BEDFE1FFC720B67B2EB7B3491DB9D2B8E56B5574E6A40FF90336B8DAFA
SHA-512:	D27FF65B6A8BF2E5E70D2865E72EEE6930E76C2A3990428C54FC998743D3C540C5C984B5D1429E8FFBE3D160AE1F6782CD6D3CA40822F81D2052BA168595D1FA
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3% Antivirus: Virustotal, Detection: 1%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......z.$.>.J.>.J.>.J.7...4.J.7...1.J.7...<.J.7...3.J.>.K..J.>.J...J.7...Y.J.7...?.J.7...?.J.Rich>.J.........................PE..L....>CX...........!.....`..........@K.......`...............................p............@.........................pa..L....`..p............................a.......................................W..H...........................................UPX0....................................UPX1.....`.......X..................@...UPX2.........`.......\..............@......................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI13602\_socket.pyd

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	22016
Entropy (8bit):	7.706254752795193
Encrypted:	false
SSDEEP:	384:CCNDRisVUlkycq27U4r0rOc606B8k4gG35aiQjgO6OPjGL2e1ua7aNJawcudoD7P:v7VUcq27Jr0rOmbwE4jGLhohnbcuyD7B
MD5:	BE47363992C7DD90019276D35FA8DA76
SHA1:	CCF7EBBE829DA08EFD95A53D4BA0C0D4938F6169
SHA-256:	BE10254B111713BEF20A13D561DE61CA3C74A34C64DDC5B10825C64AB2C46734
SHA-512:	573F9111535A9A136FCAAA5C1A16C347F7327626768D849513D69C9848406B1002DCC5B8C17A291EF2E6519587533CA806018EE471A39D330F032A9E7E635EA7
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3% Antivirus: Virustotal, Detection: 1%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......AV2..7\..7\..7\..O..7\..O..7\..O..7\..7]..7\..O..7\..O..7\..O..7\..O..7\.Rich.7\.........................PE..L...X>CX...........!.....P..........0.....................................................@.............................d...................................d...........................................H...........................................UPX0....................................UPX1.....P.......P..................@...UPX2.................T..............@..............................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI13602\_ssl.pyd

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	498688
Entropy (8bit):	7.996471896707535
Encrypted:	true
SSDEEP:	12288:FHNz5hZdNGitmdIA8byo3k4Ff9m3fTByPf6So+2RON1jjoS:P3fNTtmd2bkof43fTkR2gH
MD5:	68C3AD86E0A8833C29AD1BE10D3C025D
SHA1:	04488362814B2F3AE07C4E8DF8E45868D48B447F
SHA-256:	C236271B92A0F1D3304337F2E2444107F34D8E26272981F48C47DB347133566C
SHA-512:	BB2819D913033CC26DCD1E5CBF015DACDBF747D29C72BFD41BFE0D74BB77E51A61CF9BE4B67B6348938837125F1D0F80AF0AC33531E00CEA1585535952A22785
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3% Antivirus: Virustotal, Detection: 3%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........HFu.)(&.)(&.)(&.Q.&.)(&.Q.&.)(&.Q.&.)(&.)(&.)(&.))&9)(&.Q.&.)(&.Q.&.((&.Q.&.)(&.Q.&.)(&Rich.)(&................PE..L...q>CX...........!.................e....................................................@............................D............................................................................q..H...........................................UPX0....................................UPX1................................@...UPX2................................@..............................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI13602\_win32sysloader.pyd

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	4.992693298555373
Encrypted:	false
SSDEEP:	192:t2VnGV7o5QUEZWm6Uk3fvf3X7THIL3YO+8I:tVU5QUEz6hfLTH98
MD5:	B4A567D80CCC08FB1C7FBB765847AFDA
SHA1:	B7FF2C68BA2887AAF5D029F41922E626C72B716D
SHA-256:	DBB0F9C499A710BBC8BCDE4ECC3577A6C9548262D6CE4434ED5A0708CBC787DD
SHA-512:	DDFEC25304BABE2DF55958F512F61AFD9AF88DDA499FE87931D17A9EEBF048449885A06A24BDDBC8604E11F07CED3C2ECE7F89C28290CAB5D1BF3816D22128DB
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......M.oC.............J.............................../........................Rich............PE..L......[...........!......................... ....;..........................`......................................P&..Z...\"..P....@..l....................P....... ..............................8!..@............ ...............................text...`........................... ..`.rdata....... ......................@..@.data........0......................@....rsrc...l....@......................@..@.reloc.......P......................@..B........................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI13602\back.jpg

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	47107
Entropy (8bit):	6.2032294727594985
Encrypted:	false
SSDEEP:	768:z9v1zJKaohy0Za9jwmrALVaka3sgBXHDizIdI9e2E:5v1zJ3nuswbLVgZsceO
MD5:	4AE078DD5085E97D3605F20DC079412A
SHA1:	1BABFCF2D374AE590970A3BE2E0E27BC04922546
SHA-256:	ED551536FF22587CDF7701A279E088EB370A4121E7A3FA1F3C8B121E767318A2
SHA-512:	BF163C63120CC5035087E4FF0035D9DAEB100218C62969AA6AA75D539108323295EB9CC28ABB0906C21CE8AEA25DACD1D0AAB3F3FE9C765D35348F0A7DA000AE
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 70% Antivirus: Virustotal, Detection: 69%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......]....S......"...8.P....... ..`u...0.................................................... .....................................................................................................................................................UPX0..... ..............................UPX1.....P...0...H..................@...UPX2.................J..............@...3.93.UPX!.....3r#l..JW..CE...0..&.......U..S...........t?........'.........9.r.....t...'.....s.t&...$....,1....$6.....X[]._V`..u....tG..oo.t$lE_D$.....=......."....1......uG...c..4....uF1..e.[^]..o...f.L.!.+.y..........................8</....fp.v..U..$........../...........O/...e..]...........#3f.E.f.E......m.._..;.}e.......f.t"............U.1.3-...}..~2.k......!..........7{..+...7..\|...............G.:..S........w. ........ ..%+{.n..$...e.>.m....u..,(.....k_.'lk.C2$C&'(.5.`cv/..

C:\Users\user\AppData\Local\Temp\_MEI13602\bz2.pyd

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	35840
Entropy (8bit):	7.816957595202127
Encrypted:	false
SSDEEP:	768:IHCeOgq+kCitCVj5rz2Ya+r9qLYp9R9JoWnbcuyD7UiT:IHXr8CBd9NpfXxnouy8
MD5:	C9C00BC854A39E66B27787D188F9E8D7
SHA1:	21F20CF6C628B529DB4BDB853B679F9BF23590E3
SHA-256:	29520DF660A5BBD704B9106A6650A66E4F5766B904D05F97146668D41DBF5839
SHA-512:	8887B5CA542220CAC04D5A6A22A06F95DB560F4FE0F9A128CEB642ED9716ABCFFBA2146CCE682EB16C4DA3F423649A61904A73C4357D9FDBD5DDF606790199A3
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3% Antivirus: Virustotal, Detection: 3%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......}.S.9.=K9.=K9.=K..K:.=K0..K:.=K0..K7.=K0..K;.=K0..K>.=K9.<KS.=K0..K1.=K0..K8.=K0..K8.=KRich9.=K................PE..L...?>CX...........!.................W.......p............................................@..........................p..D....p...............................q.......................................c..H...........................................UPX0....................................UPX1................................@...UPX2.........p......................@..............................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI13602\certifi\cacert.pem

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	284518
Entropy (8bit):	6.05114864026174
Encrypted:	false
SSDEEP:	6144:GriCfLXd1YU58fVuKlnm5plZ0PXCRrcMBbADwYC+MslE:GrdT3YZuz5LwCRrcMije
MD5:	DD2DD543395692705F7DDA0F5E7750FA
SHA1:	40D7CE60393978A29FB0E0B1E849658E48CF7887
SHA-256:	397B833E5ACF89A2709B964401A9ACA68D24B62349B72BBE38684E586AA07A27
SHA-512:	3BA0D6AD8B6838B04FBFDEBAD20EB5544C093BA592B517AA383708A34CE2BD215DB2BF010090251674DBCFD4EDA3C44F770C9FBF314304DE918D7E59E2596CF2
Malicious:	false
Preview:	.# Issuer: CN=GlobalSign Root CA O=GlobalSign nv-sa OU=Root CA.# Subject: CN=GlobalSign Root CA O=GlobalSign nv-sa OU=Root CA.# Label: "GlobalSign Root CA".# Serial: 4835703278459707669005204.# MD5 Fingerprint: 3e:45:52:15:09:51:92:e1:b7:5d:37:9f:b1:87:29:8a.# SHA1 Fingerprint: b1:bc:96:8b:d4:f4:9d:62:2a:a8:9a:81:f2:15:01:52:a4:1d:82:9c.# SHA256 Fingerprint: eb:d4:10:40:e4:bb:3e:c7:42:c9:e3:81:d3:1e:f2:a4:1a:48:b6:68:5c:96:e7:ce:f3:c1:df:6c:d4:33:1c:99.-----BEGIN CERTIFICATE-----.MIIDdTCCAl2gAwIBAgILBAAAAAABFUtaw5QwDQYJKoZIhvcNAQEFBQAwVzELMAkG.A1UEBhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24gbnYtc2ExEDAOBgNVBAsTB1Jv.b3QgQ0ExGzAZBgNVBAMTEkdsb2JhbFNpZ24gUm9vdCBDQTAeFw05ODA5MDExMjAw.MDBaFw0yODAxMjgxMjAwMDBaMFcxCzAJBgNVBAYTAkJFMRkwFwYDVQQKExBHbG9i.YWxTaWduIG52LXNhMRAwDgYDVQQLEwdSb290IENBMRswGQYDVQQDExJHbG9iYWxT.aWduIFJvb3QgQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDaDuaZ.jc6j40+Kfvvxi4Mla+pIH/EqsLmVEQS98GPR4mdmzxzdzxtIK+6NiY6arymAZavp.xy0Sy6scTHAHoT0KMM0VjU/43dSMUBUc71DuxC73/OlS8pF94G3VNTCOXkNz

C:\Users\user\AppData\Local\Temp\_MEI13602\config.json

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1206
Entropy (8bit):	4.275024024623091
Encrypted:	false
SSDEEP:	24:pCKENTHgbeZlE1jCAh1RHEdOgNanAOSWSula:UKuTHgbYlUZHEdrNAla
MD5:	50CC63E4A1B24622CF61ED566B03E98F
SHA1:	92E5874785BB76E4579559BA70E116A6149349F5
SHA-256:	348F388C57DFB77B0CAACD8304725E10DC69A52EEC41AE695327787AD1853C92
SHA-512:	9A291DB9CF396687F3878590B1EB65CD7DA2E6FC3D6DE64A3B8CB08116B646371F432100E16B0ECD4F2916D05D67830F949AC2A3CA559A3A8D56616DF2BE98C7
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: C:\Users\user\AppData\Local\Temp\_MEI13602\config.json, Author: Joe Security
Preview:	{. "algo": "cryptonight",. "api": {. "port": 0,. "access-token": null,. "id": null,. "worker-id": null,. "ipv6": false,. "restricted": true. },. "autosave": true,. "av": 0,. "background": true,. "colors": true,. "cpu-affinity": null,. "cpu-priority": null,. "donate-level": 1,. "huge-pages": true,. "hw-aes": null,. "log-file": null,. "max-cpu-usage": 70,. "pools": [. {. "url": "xmr.crypto-pool.fr:3333",. "user": "47BD6QNfkWf8ZMQSdqp2tY1AdG8ofsEPf4mcDp1YB4AX32hUjoLjuDaNrYzXk7cQcoPBzAuQrmQTgNgpo6XPqSBLCnfsjaV",. "pass": "x",. "rig-id": null,. "nicehash": false,. "keepalive": false,. "variant": -1,. "enabled": true,. "tls": false,. "tls-fingerprint": null. }. ],. "print-time": 60,. "retries": 5,. "retry-pause": 5,. "safe": false,. "threads": [. {.

C:\Users\user\AppData\Local\Temp\_MEI13602\ftpcrack.exe.manifest

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1345
Entropy (8bit):	5.283640732769631
Encrypted:	false
SSDEEP:	24:2dtn3ZoWglN2v+zg4NnEN4XKDmc0+bLg4fNRme5rcb3S:ch3DgX2+zg4i0KDmJ+bLg4VRmemS
MD5:	B5DEA49B86C5BB5D9CD8D64A09F70065
SHA1:	487EF676EBD244EBC3CF197F70DA7A5E393FB96E
SHA-256:	78B1160F6ADAB34D144AD19A0F4B83F83453F1E18460BBDFBE17AD354B62AF7D
SHA-512:	1B5914F4C52F47A33C57F5F6428482E6766099BF43D4E8616CE4AABC4A917C24B2E0C98C841F0D7E7B8A202F40FF960885535539BF70CC7C7ED8687C7ECE010C
Malicious:	true
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<assembly manifestVersion="1.0" xmlns="urn:schemas-microsoft-com:asm.v1">.. <assemblyIdentity name="ftpcrack" processorArchitecture="x86" type="win32" version="1.0.0.0"/>.. <dependency>.. <dependentAssembly>.. <assemblyIdentity name="Microsoft.VC90.CRT" processorArchitecture="x86" publicKeyToken="1fc8b3b9a1e18e3b" type="win32" version="9.0.30729.6161"/>.. <compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1"/>.. </dependentAssembly>.. </dependency>.. <dependency>.. <dependentAssembly>.. <assemblyIdentity language="*" name="Microsoft.Windows.Common-Controls" processorArchitecture="x86" publicKeyToken="6595b64144ccf1df" type="win32" version="6.0.0.0"/>.. <compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1"/>.. </dependentAssembly>.. </dependency>.. <compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1">.. <application>.. <supportedOS Id="{1f676c76-80e

C:\Users\user\AppData\Local\Temp\_MEI13602\httplib2\cacerts.txt

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	135546
Entropy (8bit):	6.039525643754334
Encrypted:	false
SSDEEP:	3072:FVrovvEjVplrqHSdX+zpfQq7ZiyZOF5mdFENAKHn1HtYfei8i31MCSjfpVpKbIcf:3cmHuBfaUFENX3YfEl3plcs+
MD5:	14BA876BA2515A25BBB511F24BF06653
SHA1:	291DCDEE67E880B21FD7001CB8350C3ECEE4CAC8
SHA-256:	2039836A620F956EC094EAAE7C9B41A04C76F31130898B11014D9E83C905F0DE
SHA-512:	5035F82DF06308A14F6626C54382B3AB34B6D664C8394B48F75275F69DCC2B93266D843B51F0B586E5F12FCD70FE3660B5B08AFC20738DF6D8C812592C0D71E4
Malicious:	false
Preview:	# Issuer: CN=GTE CyberTrust Global Root O=GTE Corporation OU=GTE CyberTrust Solutions, Inc..# Subject: CN=GTE CyberTrust Global Root O=GTE Corporation OU=GTE CyberTrust Solutions, Inc..# Label: "GTE CyberTrust Global Root".# Serial: 421.# MD5 Fingerprint: ca:3d:d3:68:f1:03:5c:d0:32:fa:b8:2b:59:e8:5a:db.# SHA1 Fingerprint: 97:81:79:50:d8:1c:96:70:cc:34:d8:09:cf:79:44:31:36:7e:f4:74.# SHA256 Fingerprint: a5:31:25:18:8d:21:10:aa:96:4b:02:c7:b7:c6:da:32:03:17:08:94:e5:fb:71:ff:fb:66:67:d5:e6:81:0a:36.-----BEGIN CERTIFICATE-----.MIICWjCCAcMCAgGlMA0GCSqGSIb3DQEBBAUAMHUxCzAJBgNVBAYTAlVTMRgwFgYD.VQQKEw9HVEUgQ29ycG9yYXRpb24xJzAlBgNVBAsTHkdURSBDeWJlclRydXN0IFNv.bHV0aW9ucywgSW5jLjEjMCEGA1UEAxMaR1RFIEN5YmVyVHJ1c3QgR2xvYmFsIFJv.b3QwHhcNOTgwODEzMDAyOTAwWhcNMTgwODEzMjM1OTAwWjB1MQswCQYDVQQGEwJV.UzEYMBYGA1UEChMPR1RFIENvcnBvcmF0aW9uMScwJQYDVQQLEx5HVEUgQ3liZXJU.cnVzdCBTb2x1dGlvbnMsIEluYy4xIzAhBgNVBAMTGkdURSBDeWJlclRydXN0IEds.b2JhbCBSb290MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCVD6C28FCc6HrH.iM3dFw4usJTQGz0

C:\Users\user\AppData\Local\Temp\_MEI13602\msvcm90.dll

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	225280
Entropy (8bit):	6.034911041879855
Encrypted:	false
SSDEEP:	3072:6yZeocziNzMLSMOYscmLWbAX+dP4Upoh86Goao14JU87/amFYw8fF01OyASLE:PYOMqc8oAXGP4Upoe6fa3/amiX2Oyp
MD5:	D34A527493F39AF4491B3E909DC697CA
SHA1:	AFEE32FCD9CE160680371357A072F58C5F790D48
SHA-256:	7A74DA389FBD10A710C294C2E914DC6F18E05F028F07958A2FA53AC44F0E4B90
SHA-512:	0DABC5455EB02601D7C40A9C49B3ADE750B1118934EF3785FB314FA313437BC02B243571ABA25F1661A69DCEA36838530C12762A2E6602D14A9B03770A82CCA6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........;...h...h...h..ah...h1.dh...h..gh...h...h...h.-.h...h...h...h..qh...h..vh...h..`h...h..fh...h..ch...hRich...h........................PE..L.....M...........!.....:..........Z........P....?x.........................0......^.....@......................... 3..4....&..d...............................d...P...............................H...@...............(...........p...H............text...T9.......:.................. ..`.data........P.......>..............@....rsrc................H..............@..@.reloc...#.......$...L..............@..B........................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI13602\msvcp90.dll

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	335184
Entropy (8bit):	6.343962999919931
Encrypted:	false
SSDEEP:	6144:fmIIPLSg4p0t4271NWoSYEMS6VhUgiW6QR7t5183Ooc8SHkC2eQ:fmIeLSgo0S271QoSQhUgiW6QR7t51831
MD5:	92EA2DB0E788894C43753C550216A886
SHA1:	DA8C7A178BA0CA80D321666F5642A7436B640602
SHA-256:	9694756F43B20ABC50F95646C54E9E36CD6EDF8EED3DB846064567399F4E7566
SHA-512:	90E72A68C7267E8D0986A75247AE7B2339E4C2A981D686342B2EF90B1FCF9695B558D0BD5932F7C53524E02CC664B974BA76783FDE919B24EB36795DB3300BA6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 7% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........#%..Mv..Mv..Mv.66v..Mv...v..Mv..Lv:.Mv...v..Mv...v..Mv...v..Mv...v..Mv...v..Mv...v..Mv...v..MvRich..Mv........................PE..L.....M...........!................P.... ...0....Hx.........................0............@.........................p4..,....3.......0.......................&......................................()..H...........................................UPX0....................................UPX1......... ......................@....rsrc........0......................@..............................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI13602\msvcr90.dll

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	250192
Entropy (8bit):	7.900323441964523
Encrypted:	false
SSDEEP:	6144:EODM4c99eLswEOva4g4fpgMf4FfIoSNjbZdGJCJLuEyKIqqOmiqsEqmQI0wye/c:EODM1HagYaMf4FAoSNjHmHyyc
MD5:	199D34B03C7D0EB804A6D9869184B8D4
SHA1:	03148854519D0970C1BBDC089D3E8DE1AED61C47
SHA-256:	DF86421E354F817607F2BAFC9188569242FCF9DD564B28F3E2915C86A0BA1F54
SHA-512:	E4269CA993393422A90231DAABD390771A635EEB0817A9D00DCCEF496372BB4B57B615529F26A2E8132BDE825CDACA07D965D207421C02EA6471DA214354361E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 1%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..................6.........!.R...7.....&.....0.....6.....3...Rich..........PE..L.....M...........!.....@.......0..0f...@........Rx......................................@.........................@....\|.....x....................................................................r..H...........................................UPX0.....0..............................UPX1.....@...@...4..................@....rsrc................8..............@..............................................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI13602\netifaces.pyd

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	11264
Entropy (8bit):	7.145184945732974
Encrypted:	false
SSDEEP:	192:uKqSCMOF44HPPtLm+9a3ozToPmzYUaFaNJhLkwcud2DH9VwGfctH:ubS9s44vPtLR9aUPJ+aNJawcudoD7U
MD5:	C7807680A69196C3EE66C4CFB3E271AC
SHA1:	D3EA74C9E3B810C6A1EE4296B97E20F2F45C9461
SHA-256:	1A6C57AC8031582477B1D3463A65B6EB006EEA704E27C8C4B812B99EA910428D
SHA-512:	A5D893132AD889E98B434DA7FD5CA377AFB1800FD8D3230CCED5E9FDE576FCEC943DD22FA48810BA6D93C510EBAA8AC5A94EC1B9D639FD6C533C5BBD4737CF15
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 2%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......FL...-...-...-...U...-...U...-...-..J-...U...-...U...-...U...-...U...-..Rich.-..........................PE..L...,.-\...........!.....0.......P...x...`..........................................................................4...P.......4...................................................................p...H...........................................UPX0.....P..............................UPX1.....0...`...&..................@...UPX2.................*..............@......................................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI13602\perfmon.pyd

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	11264
Entropy (8bit):	6.948652527580434
Encrypted:	false
SSDEEP:	192:0xeSnTQM3MsUjU+viJBctKiyiLKPfFaNJhLkwcud2DH9VwGfct0XlpoI6J:0xe4R3scJBcMWYdaNJawcudoD7UmlSI
MD5:	EE813500A441B5FFDACD853E95BEE669
SHA1:	7F05F1493380AF3FE08F55524F6FF90C47C0CC4D
SHA-256:	AC491704AF920BE0E503F0243D2D371E230622E213E9F082347B52C0A7B009C2
SHA-512:	060D079A93ADD067EB062D2B1CB9977719BE68AE1223B0219DBB14CC9C6C66FF47D9929945636B577BC7F1BB84D5500B88ACD5F7BF636CC63BD4C88534AF724E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3% Antivirus: Virustotal, Detection: 1%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........0...c...c...c..9c...c.gc...c.qc...c.ac...c...c...c.vc...c.`c...c.cc...cRich...c................PE..L...C..[...........!.....0.......`.......p........n.................................................................t...L...P...$.......P...............................................................H...........................................UPX0.....`..............................UPX1.....0...p..."..................@....rsrc................&..............@......................................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI13602\psutil._psutil_windows.pyd

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	25600
Entropy (8bit):	7.700665778298437
Encrypted:	false
SSDEEP:	384:3qUURhEUVDrn5EMvG04YMJIoa67+5pGr0qLWMAUm7NFYGz45/+aNJawcudoD7ULt:aUjUXBjPAGHqLm7N/z4dnbcuyD7UL
MD5:	2FC800FCC46A597921C2ED447AEB09AC
SHA1:	72004227E5C60C8460F835A170798AA22861B79E
SHA-256:	2E4AD3D08118DA77C928C4614BFECB34397CFAF53F5D46D7C7E5F1DA3172C1F1
SHA-512:	A17022B364615B45A1873AEA0DE922A2988E4D75A8F4E63ECB9CA7DD46263E684B1F28B82BD77B046BBE2AD03CE65C5DACF98EACCAE861A30F137E0118A87225
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3% Antivirus: Virustotal, Detection: 3%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......E.6...X...X...X......X......X......X...Y...X......X......X......X.Rich..X.........PE..L...;b.\...........!.....`...................0...............................@.......................................2..\....0...............................2.......................................*..H...........................................UPX0....................................UPX1.....`.......\..................@...UPX2.........0.......`..............@......................................................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI13602\pyexpat.pyd

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	52736
Entropy (8bit):	7.904524114628073
Encrypted:	false
SSDEEP:	1536:omazZr7ECJ0E6kFg85F/rFi2LU60XZlofDYq0nouy8:9aFr9mE6kF7hrcCU6Qlewout
MD5:	AD560121EFD8E249FC3414200D98F75F
SHA1:	73040F9BC04E733A85DA00E364EF85583F505636
SHA-256:	0BEB3B16F9A11F93137365A1179D2062A414ADABA337BCAC05A083A921775B50
SHA-512:	6DA2B01773DCE658DCFD9219DD8D093F60EAFF669ED600C9A62EFC39FB3E362F051A499FAC85777C1B8F364B1AD2E134E080CAE720FC5477711A7ED7F191A5C7
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3% Antivirus: Virustotal, Detection: 3%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........2.\...\...\......\......\......\......\...]..\......\......\......\.Rich..\.................PE..L...4>CX...........!................Pj....................................................@............................L...................................$.......................................(v..H...........................................UPX0....................................UPX1................................@...UPX2................................@......................................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI13602\python27.dll

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	898048
Entropy (8bit):	7.990256946915668
Encrypted:	true
SSDEEP:	24576:I0cNEHSDC9XmwbTV/mv+nQW0mj7IaqtsoejWg3c:jHhmhmI9eo63
MD5:	8C44826A640B3CF0B32B0258C65FEE07
SHA1:	E3F9FE6366D0876BFA8B903B20D2ACF06416F1BC
SHA-256:	FBAD053D962BAC96865AC3372958D697711800FDC46F36C87011BB5E89026614
SHA-512:	884E2C01C088B9AE86D4605FED1CF8E9B17F99CF887EFC5644F4A91959ECD89148CCA3E9FDAA6AB9E8C4DFD2D61DBDFD442A95B13DAB7E5CD027B4782D473355
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 7% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......#..^g.y.g.y.g.y....~.y.n...l.y.n...i.y.n...e.y.n...l.y.g.x.[.y.n.....y.n...f.y.n...f.y.n...f.y.Richg.y.................PE..L... >CX...........!.....0.......0...Z..@...p...............................+...........@.........................pz.t\|..,y.D....p.,...........................................................f.H...........................................UPX0.....0..............................UPX1.....0...@...(..................@....rsrc........p......,..............@......................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI13602\pywintypes27.dll

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	53248
Entropy (8bit):	7.425128830518154
Encrypted:	false
SSDEEP:	1536:eTwUerP24SfDRd2TACkwqyfnouy81cSPDuwQ0:eTleODRd2ew/Pout1cSru
MD5:	07B436BFA1C7B4FFC21FB39358158060
SHA1:	7F5A47CDAB9A7D93BBBD204CEDFFCA61D3F80C84
SHA-256:	82C2926CB03A04392FA479801D505E2A387446BCA978FF930177121DB2FDB461
SHA-512:	13EBCB83F478C859CA808003933769B84290E108648B69F33043653263C5B4BD37ED5CA8D521B46A1D9122EB232F7E5D05A25E16F250D5573CF85CD5CDEFB2EF
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 1%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......qz.Y5...5...5....Tz.7...+Iy.6...+Io.8.....".4...+I..1.....'.>...5.......+Ih.$...+I~.4...+I}.4...Rich5...................PE..L...:..[...........!.........P............... ....z..........................p.......................................%..PJ..h#....... ..h...................Po..........................................H...........................................UPX0....................................UPX1.............\|..................@....rsrc....P... ...P..................@......................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI13602\select.pyd

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	9216
Entropy (8bit):	7.003407892450472
Encrypted:	false
SSDEEP:	192:qhogHS4TaqZXRQKKXYVEvySc3IFaNJhLkwcud2DH9VwGfctX:qhLS4TaqxhfCHc38aNJawcudoD7U
MD5:	57EB00056AC8C38CD4F3153FB9507F13
SHA1:	DDEE8E74FCC81B6301145F27C0F1CCF4B9185E1C
SHA-256:	7B90EC138AC8415D9B747612063D19147FEC2B1E99DE97C3B5636E8CA40B346E
SHA-512:	05F7EF6BD065D7DB3F41DFA95187FA40A14F58FA5D4705F2DF5982DB18EEB6D4E93C473D05932436BF645E76E0B23532867011E92EF953EC247B55648ED9C6EF
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3% Antivirus: Virustotal, Detection: 1%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........i)...z...z...z...z...z...z...z...z...z...z...z...z...z...z...z...z...z...z...zRich...z........PE..L...5>CX...........!..... .......P..pq...`................................................@.............................H...................................H.......................................P}..H...........................................UPX0.....P..............................UPX1..... ...`......................@...UPX2................."..............@..............................................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI13602\servicemanager.pyd

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	7.2228399102917615
Encrypted:	false
SSDEEP:	384:FVtYwprbL7fLBtdYzKNg13ZOPaNJawcudoD7UfMX:vawBbLFYzKNg1plnbcuyD7UfMX
MD5:	6A95BCF45E4BE23CC2634EF5BAD17660
SHA1:	7D13B791588CB800C2ADD75FF8E74C3C493A8143
SHA-256:	60DA4B4E628B7DC1115615128AC554AEB29B50A61629AD5AEEB5CC9D2BD86202
SHA-512:	D3C80B025647444F42D42E82CAD50C4383728F7F8C9E16AA9D87450CA864B0B97B5F8F47E80328A4A2B67CE7D06C9A8F1DAE8C5B3C798DE1B2A50164161E69C8
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 1%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........o....K...K...K...K...K...K...K...K...KR..K...K...K...K...K...K...K...K...K...K...K...KRich...K........................PE..L......[...........!.....@........................}.....................................................................\...........................................................................h...H...........................................UPX0....................................UPX1.....@.......4..................@....rsrc................8..............@......................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI13602\unicodedata.pyd

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	181760
Entropy (8bit):	7.989160583257678
Encrypted:	false
SSDEEP:	3072:Rfe2dO8KvTdjKGssSXwgtXZT32qenyxHBKs//4wd3RP29sZ6lI883out:Rfe2bKvEw+k2kw/4wZRPS3coS
MD5:	9A465CFAA788E29E7B1366C012EBC75C
SHA1:	10D9C49BB6652D9B04E17608D9ED35B036112647
SHA-256:	35C84D824DB175DD71046806A59BC711021ABCE04698FA304B1E2A9855E50A9C
SHA-512:	31BEE259C78CEB1E4F5C52E7B2CBD0EB62A071FC9C748DF47AB824E383EFDC3B218168700341B96D139DABFB3E4D7644341F22E52982B7C7F135A9E35B300B00
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......{H..?).?).?).6QE.=).6QS.1).6QT.=).6QC.8).?)..).6QY.>).6QB.>).6QA.>).Rich?).................PE..L...6>CX...........!......................................................................@.............................T...................................,.......................................x...H...........................................UPX0....................................UPX1................................@...UPX2................................@......................................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI13602\win32api.pyd

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	34816
Entropy (8bit):	7.794879575971907
Encrypted:	false
SSDEEP:	768:etKTLIw2eRBsqBvKddE/wW68vEvfW2qmSOyinbcuyD7Uqmx:DCeLrGderDH2FXyinouy8qmx
MD5:	42C475231F4835BB1A5F94B0D3DA4520
SHA1:	FCFAE296DD10C92D973A57D61BBF5C0F4A15ED6B
SHA-256:	87CEEB1B7586DB730F48988A07018F9C8AF57934FF7F173A869542207F46B0F1
SHA-512:	D1A699B8497E8843F990F6F719A904A7751FE2A9404CB195BE2D94341728A7372CD93D379B576E6031980E1DA53F2336805C6BF59E799B63565CD63D4931C02A
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......[-..L...L...L.......L.......L.......L...J..L...L..UM.......L.......L.......L..Rich.L..................PE..L......[...........!.............p.. ...............................................................................P.......X...........X...............................................................H....................B..@...................UPX0.....p..............................UPX1.............~..................@....rsrc...............................@......................................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI13602\win32event.pyd

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	11264
Entropy (8bit):	6.799438399701252
Encrypted:	false
SSDEEP:	192:jNxmpzSvHU53Uon53eXqY1K/CjrELQc432Xq0FaNJhLkwcud2DH9VwGfctLj/t:Xmp2/UR95aP1pgEc432XBaNJawcudoDU
MD5:	796306BE7A1ABCFFB8853EE9CEB5BEAE
SHA1:	93762CF53958A3A99B674986FCF3C53C489133ED
SHA-256:	26E6D883E9E61BF872425526A9B8C7BB229C3B9D2F82BB3C0BF500660DBE1995
SHA-512:	5919A837FA1FCAEA91B14D02DA306928D5E523E4591DCA290422C9EB9BE15F2EE626A8379F5C953F2B08E7A6B2CD67618652B9EFA9ACE8ABD47A8BD7CD8C2F64
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........k..{8..{8..{8..8..{8..8..{8..8..{8 ..8..{8..z8..{8..8..{8..8..{8..8..{8Rich..{8................PE..L...T..[...........!.....0..............................................................................................P...`...\.......`...........................................................h...H...........................................UPX0....................................UPX1.....0......."..................@....rsrc................&..............@......................................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI13602\win32evtlog.pyd

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	19968
Entropy (8bit):	7.436093769968754
Encrypted:	false
SSDEEP:	384:Wo5FgP/m1xaGAONAt4ZvFqQggg3LgsAWUh31lA2W1waNJawcudoD7UGwGS:WmuP+TOONp5UQ/Zs8FlAfnbcuyD7UGwX
MD5:	317360BE68901D11F3D02AF1C151A4DC
SHA1:	570BF03BE1A737CF3D0CF3FC8E77261CF64E2051
SHA-256:	AC9C5C4BAA4DE19BDDF55313F29182F26EB80312C31266413672C61424A5C6E0
SHA-512:	25C25C23DD4FE1957CDFAD833D4570553C2627775008F3939525B6A3D1892F8B6CB7A9F20D454166338DF4DFC8A98306A1160016AE4CB2E9464944945AFA0A82
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........E..i+..i+..i+.E&...i+..;...i+..;...i+..;...i+.%...i+..i*.hi+..;...i+..;...i+..;...i+..;...i+.Rich.i+.................PE..L......[...........!.....P...................0...............................@.......................................4..T....3..P....0......................L5.......................................!..H.......................@...................UPX0....................................UPX1.....P.......D..................@....rsrc........0.......H..............@......................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI13602\win32service.pyd

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	18432
Entropy (8bit):	7.513143648749714
Encrypted:	false
SSDEEP:	384:DvSTTJQxdZ3goCVdvSbw66apC1aNJawcudoD7U46:LSTT+1KF1onbcuyD7U46
MD5:	F23A62491BD945C050E3E1D13909E9E7
SHA1:	B8DAC4E00163533157A17E3B56D05E049A2375A2
SHA-256:	E52B5532A6764AAAE67DB557412B3F77EBDC8A14A72771A1C6414A83BB3FC15C
SHA-512:	52200CF9687752DB43BBAE703192C841694D5BD976FA56C0F25E0478CFB97681BC77677C1A8907167612DDF9FE6A561945FBEB0180022670AF97BF41B5B11766
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........[..[..[.....Z..E.-.Z..E.;.V..E.+.]...!s.\..[.....E.<.^..E.*.Z..E.,.Z..E.).Z..Rich[..........PE..L...q..[...........!.....@..........................................................................................8...T...............................................................................H...........................................UPX0....................................UPX1.....@.......>..................@....rsrc................B..............@..............................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI13602\xmrig.exe

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	1905664
Entropy (8bit):	7.9235088812144
Encrypted:	false
SSDEEP:	49152:jeXVwyagUSymDH29F4+rthFTo6YZfnH8:0VKgUSymDH29ttzToX1nc
MD5:	13BDD9CD9F7E51746172996262B5A873
SHA1:	3834F8179ABD7A827E927505F3C226AC8BBCF3EE
SHA-256:	4BF737B29FF521BC263EB1F2C1C5EA04B47470CCCD1BEAE245D98DEF389929BD
SHA-512:	49879918505D042312F20B2FC8310A8C4A58AA266ED1AB05E0481F7E11385DA0920CF9D756F842EB98E4394F14725385B74A99B38FC8A60222FA4CC873CB8040
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: C:\Users\user\AppData\Local\Temp\_MEI13602\xmrig.exe, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....\.....................`...0>...Z..@>...[...@..........................`[............... ...................... X.x....][.<.....[..]....................................................Z.....................................................UPX0.....0>.............................UPX1.........@>.....................@....rsrc....`....[..`..................@...3.94.UPX!....E.G...@.`.Z.....$Z.$/.w.......&...'....1.f.=.@9....MZ..,......($..#...th.....82..tJ......$.,./,......+.l..Ho..~B.......:..6....L.=Dc..tm....-<h....f..<2...u..?PEl..u..Q....-l..~?....j..x.......]...........K".v.g?w...k+...yt`,........o..7>,. ..D$...............7......b..0.{..,.~...[U......WV.U.S..\|.0~....+..).b.........@....................5.o.E.....d....x....l0.9..9...3....o._..........=...u...;.v.f...R..0..`.lm...--...I...X/(......9J9..~?.v...&+.. P.kSn.l......LJ...

C:\Users\user\AppData\Local\Temp\_MEI59482\Crypto.Cipher._AES.pyd

Download File

Process:	C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	7.553130526678379
Encrypted:	false
SSDEEP:	384:50Q1C9jViLl7hDB6n/PtHU2wr8gj93KqmilaNJawcudoD7U:dC8LU/PBU8itClnbcuyD7U
MD5:	371397E80A55D432DA47311B8EF25317
SHA1:	71617777D6A2500D6464D7B394C8BE5F1E4E119E
SHA-256:	C1A900615C9500C46B9602C30C53F299290B03632208EF1152AF8830AB73AD17
SHA-512:	3139E2848ACF02CC8475449F213873D2C2B7196F6A55C70D2D8F8B487020387740364E5CA0AA584624D1B9B01B965146A2F0E15EEF34830C7C0ECBB8637DAE03
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........+\8.J2k.J2k.J2k.Ik.J2k...k.J2k...k.J2k...k.J2k.2.k.J2k.J3k.J2k...k.J2k...k.J2k...k.J2kRich.J2k........PE..L....4.S...........!.....@..........`...................................................................................D...........................................................................8...H...........................................UPX0....................................UPX1.....@.......:..................@...UPX2.................>..............@......................................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI59482\Include\pyconfig.h

Download File

Process:	C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe
File Type:	C source, ASCII text
Category:	dropped
Size (bytes):	21321
Entropy (8bit):	5.345136937906198
Encrypted:	false
SSDEEP:	384:pGpFpaU1kgCw8r+MIP8Bj5DvVySh3awQBoerw8W+PYV0FGYfN/+:pGpFpb+IU99UShATrw8W+AKF/+
MD5:	BC185DE8B2437963368A85FDD9852951
SHA1:	1459F1428214FCCA7F203FB3A3AFF28E16EB9C1B
SHA-256:	8B130D901E0F83B55699D565F103F2F8F1B3A51712EBB4B9646EA517CC1F04D6
SHA-512:	918469D9A59FE059F3C7C93F34C8D2D07CB8A9BF5E953A1527922ED5C65FF4A2DF50BBC78ED9CE146BF3A1FB6F1763F061262FA4A937BEEEE1FEB8A99E31339E
Malicious:	false
Preview:	#ifndef Py_CONFIG_H.#define Py_CONFIG_H../* pyconfig.h. NOT Generated automatically by configure...This is a manually maintained version used for the Watcom,.Borland and Microsoft Visual C++ compilers. It is a.standard part of the Python distribution...WINDOWS DEFINES:.The code specific to Windows should be wrapped around one of.the following #defines..MS_WIN64 - Code specific to the MS Win64 API.MS_WIN32 - Code specific to the MS Win32 (and Win64) API (obsolete, this covers all supported APIs).MS_WINDOWS - Code specific to Windows, but all versions..MS_WINCE - Code specific to Windows CE.Py_ENABLE_SHARED - Code if the Python core is built as a DLL...Also note that neither "_M_IX86" or "_MSC_VER" should be used for.any purpose other than "Windows Intel x86 specific" and "Microsoft.compiler specific". Therefore, these should be very rare....NOTE: The following symbols are deprecated:.NT, USE_DL_EXPORT, USE_DL_IMPORT, DL_EXPORT, DL_IMPORT.MS_CORE_DLL...WIN32 is still required for the

C:\Users\user\AppData\Local\Temp\_MEI59482\Microsoft.VC90.CRT.manifest

Download File

Process:	C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1050
Entropy (8bit):	5.382436822526041
Encrypted:	false
SSDEEP:	24:2dtn3mGv+zg4NnEN4XKHVJrMmV6LSWV5rcb3S:ch35+zg4i0KHVVdOmS
MD5:	BFB93876892CCA8E2AD0021585C34C8B
SHA1:	0DDE1B225C98825A09D8FF85F462571C9C862E35
SHA-256:	0D060ED7C25159B7B75F16D449963BFD639C15B3C5280BC7897403268C2B9F35
SHA-512:	FE70540B3B3FA88B32DFB2FF7406A3A9819E7862B850D871B932996BBEFFDBC70D7192D6E3196A8583B2DB756CA9CC278505AFBE585BA30EB1222D4F8BE15B7B
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<assembly manifestVersion="1.0" xmlns="urn:schemas-microsoft-com:asm.v1">.. <noInheritable/>.. <assemblyIdentity name="Microsoft.VC90.CRT" processorArchitecture="x86" publicKeyToken="1fc8b3b9a1e18e3b" type="win32" version="9.0.30729.6161"/>.. <file hash="7021457b391b35606e708c69987e4b6f606609ee" hashalg="SHA1" name="msvcr90.dll"/>.. <file hash="88549dd3ce8eaa62ca8aad0e96ddd9fec2203628" hashalg="SHA1" name="msvcp90.dll"/>.. <file hash="65ef374affa5b48827e539b35b3275c201b41fc9" hashalg="SHA1" name="msvcm90.dll"/>.. <compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1">.. <application>.. <supportedOS Id="{1f676c76-80e1-4239-95bb-83d0f6d0da78}"/>.. <supportedOS Id="{4a2f28e3-53b9-4441-ba9c-d69d4a4a6e38}"/>.. <supportedOS Id="{e2011457-1546-43c5-a5fe-008deee3d3f0}"/>.. <supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}"/>.. <supportedOS Id="{8e0f7a12-bfb3-4fe8-b9a5-48fd50a15a9a}"/>..

C:\Users\user\AppData\Local\Temp\_MEI59482\_ctypes.pyd

Download File

Process:	C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	37888
Entropy (8bit):	7.848484052157707
Encrypted:	false
SSDEEP:	768:pAXLisB/qV2nQnf33sWcCRWKZac3VWw6cLA3zReukhRnbcuyD7U:pAnBi8nQf3sYToclt6cLUCRnouy8
MD5:	6CB8B560EFBC381651D2045F1571D7C8
SHA1:	15283A7A467ADB7B6D7A7182F660DD783F90E483
SHA-256:	6456FEA123E04BCEC8A8EED26160E1DF5482E69D187D3E1A0C428995472AC134
SHA-512:	CA2958095E8E08B5EF05EC9DE15B7D1EB180923A40B90356DB56A124101C96D8E745001948B89DBE9D6B9CE3C2029F7E9EAF20C73FA1D410A821D6605830BFC0
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...................F.....W.....P......@..........Z.....A.....B...Rich..................PE..L...*>CX...........!............. .. ....0................................................@.........................<...........<.......................................................................H...........................................UPX0..... ..............................UPX1.........0......................@...UPX2................................@......................................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI59482\_hashlib.pyd

Download File

Process:	C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	351744
Entropy (8bit):	7.996557276168139
Encrypted:	true
SSDEEP:	6144:Xh0byJKrtKOFhjnTtMoy8gpVI/xxWo/nX0NKOzyGFmJ559Vq2SeTsRgIIGYMowwZ:2bymtjF1TtMod/xweDK7FmJ5rLVYTIGm
MD5:	EE134421FBABEB565E4F3CA721331C2E
SHA1:	4B03BDD142C6A7BB6F74ABE968C5B76B63E06059
SHA-256:	7863E1BEDFE1FFC720B67B2EB7B3491DB9D2B8E56B5574E6A40FF90336B8DAFA
SHA-512:	D27FF65B6A8BF2E5E70D2865E72EEE6930E76C2A3990428C54FC998743D3C540C5C984B5D1429E8FFBE3D160AE1F6782CD6D3CA40822F81D2052BA168595D1FA
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......z.$.>.J.>.J.>.J.7...4.J.7...1.J.7...<.J.7...3.J.>.K..J.>.J...J.7...Y.J.7...?.J.7...?.J.Rich>.J.........................PE..L....>CX...........!.....`..........@K.......`...............................p............@.........................pa..L....`..p............................a.......................................W..H...........................................UPX0....................................UPX1.....`.......X..................@...UPX2.........`.......\..............@......................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI59482\_socket.pyd

Download File

Process:	C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	22016
Entropy (8bit):	7.706254752795193
Encrypted:	false
SSDEEP:	384:CCNDRisVUlkycq27U4r0rOc606B8k4gG35aiQjgO6OPjGL2e1ua7aNJawcudoD7P:v7VUcq27Jr0rOmbwE4jGLhohnbcuyD7B
MD5:	BE47363992C7DD90019276D35FA8DA76
SHA1:	CCF7EBBE829DA08EFD95A53D4BA0C0D4938F6169
SHA-256:	BE10254B111713BEF20A13D561DE61CA3C74A34C64DDC5B10825C64AB2C46734
SHA-512:	573F9111535A9A136FCAAA5C1A16C347F7327626768D849513D69C9848406B1002DCC5B8C17A291EF2E6519587533CA806018EE471A39D330F032A9E7E635EA7
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......AV2..7\..7\..7\..O..7\..O..7\..O..7\..7]..7\..O..7\..O..7\..O..7\..O..7\.Rich.7\.........................PE..L...X>CX...........!.....P..........0.....................................................@.............................d...................................d...........................................H...........................................UPX0....................................UPX1.....P.......P..................@...UPX2.................T..............@..............................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI59482\_ssl.pyd

Download File

Process:	C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	498688
Entropy (8bit):	7.996471896707535
Encrypted:	true
SSDEEP:	12288:FHNz5hZdNGitmdIA8byo3k4Ff9m3fTByPf6So+2RON1jjoS:P3fNTtmd2bkof43fTkR2gH
MD5:	68C3AD86E0A8833C29AD1BE10D3C025D
SHA1:	04488362814B2F3AE07C4E8DF8E45868D48B447F
SHA-256:	C236271B92A0F1D3304337F2E2444107F34D8E26272981F48C47DB347133566C
SHA-512:	BB2819D913033CC26DCD1E5CBF015DACDBF747D29C72BFD41BFE0D74BB77E51A61CF9BE4B67B6348938837125F1D0F80AF0AC33531E00CEA1585535952A22785
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........HFu.)(&.)(&.)(&.Q.&.)(&.Q.&.)(&.Q.&.)(&.)(&.)(&.))&9)(&.Q.&.)(&.Q.&.((&.Q.&.)(&.Q.&.)(&Rich.)(&................PE..L...q>CX...........!.................e....................................................@............................D............................................................................q..H...........................................UPX0....................................UPX1................................@...UPX2................................@..............................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI59482\_win32sysloader.pyd

Download File

Process:	C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	4.992693298555373
Encrypted:	false
SSDEEP:	192:t2VnGV7o5QUEZWm6Uk3fvf3X7THIL3YO+8I:tVU5QUEz6hfLTH98
MD5:	B4A567D80CCC08FB1C7FBB765847AFDA
SHA1:	B7FF2C68BA2887AAF5D029F41922E626C72B716D
SHA-256:	DBB0F9C499A710BBC8BCDE4ECC3577A6C9548262D6CE4434ED5A0708CBC787DD
SHA-512:	DDFEC25304BABE2DF55958F512F61AFD9AF88DDA499FE87931D17A9EEBF048449885A06A24BDDBC8604E11F07CED3C2ECE7F89C28290CAB5D1BF3816D22128DB
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......M.oC.............J.............................../........................Rich............PE..L......[...........!......................... ....;..........................`......................................P&..Z...\"..P....@..l....................P....... ..............................8!..@............ ...............................text...`........................... ..`.rdata....... ......................@..@.data........0......................@....rsrc...l....@......................@..@.reloc.......P......................@..B........................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI59482\back.jpg

Download File

Process:	C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	47107
Entropy (8bit):	6.2032294727594985
Encrypted:	false
SSDEEP:	768:z9v1zJKaohy0Za9jwmrALVaka3sgBXHDizIdI9e2E:5v1zJ3nuswbLVgZsceO
MD5:	4AE078DD5085E97D3605F20DC079412A
SHA1:	1BABFCF2D374AE590970A3BE2E0E27BC04922546
SHA-256:	ED551536FF22587CDF7701A279E088EB370A4121E7A3FA1F3C8B121E767318A2
SHA-512:	BF163C63120CC5035087E4FF0035D9DAEB100218C62969AA6AA75D539108323295EB9CC28ABB0906C21CE8AEA25DACD1D0AAB3F3FE9C765D35348F0A7DA000AE
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......]....S......"...8.P....... ..`u...0.................................................... .....................................................................................................................................................UPX0..... ..............................UPX1.....P...0...H..................@...UPX2.................J..............@...3.93.UPX!.....3r#l..JW..CE...0..&.......U..S...........t?........'.........9.r.....t...'.....s.t&...$....,1....$6.....X[]._V`..u....tG..oo.t$lE_D$.....=......."....1......uG...c..4....uF1..e.[^]..o...f.L.!.+.y..........................8</....fp.v..U..$........../...........O/...e..]...........#3f.E.f.E......m.._..;.}e.......f.t"............U.1.3-...}..~2.k......!..........7{..+...7..\|...............G.:..S........w. ........ ..%+{.n..$...e.>.m....u..,(.....k_.'lk.C2$C&'(.5.`cv/..

C:\Users\user\AppData\Local\Temp\_MEI59482\bz2.pyd

Download File

Process:	C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	35840
Entropy (8bit):	7.816957595202127
Encrypted:	false
SSDEEP:	768:IHCeOgq+kCitCVj5rz2Ya+r9qLYp9R9JoWnbcuyD7UiT:IHXr8CBd9NpfXxnouy8
MD5:	C9C00BC854A39E66B27787D188F9E8D7
SHA1:	21F20CF6C628B529DB4BDB853B679F9BF23590E3
SHA-256:	29520DF660A5BBD704B9106A6650A66E4F5766B904D05F97146668D41DBF5839
SHA-512:	8887B5CA542220CAC04D5A6A22A06F95DB560F4FE0F9A128CEB642ED9716ABCFFBA2146CCE682EB16C4DA3F423649A61904A73C4357D9FDBD5DDF606790199A3
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......}.S.9.=K9.=K9.=K..K:.=K0..K:.=K0..K7.=K0..K;.=K0..K>.=K9.<KS.=K0..K1.=K0..K8.=K0..K8.=KRich9.=K................PE..L...?>CX...........!.................W.......p............................................@..........................p..D....p...............................q.......................................c..H...........................................UPX0....................................UPX1................................@...UPX2.........p......................@..............................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI59482\certifi\cacert.pem

Download File

Process:	C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	284518
Entropy (8bit):	6.05114864026174
Encrypted:	false
SSDEEP:	6144:GriCfLXd1YU58fVuKlnm5plZ0PXCRrcMBbADwYC+MslE:GrdT3YZuz5LwCRrcMije
MD5:	DD2DD543395692705F7DDA0F5E7750FA
SHA1:	40D7CE60393978A29FB0E0B1E849658E48CF7887
SHA-256:	397B833E5ACF89A2709B964401A9ACA68D24B62349B72BBE38684E586AA07A27
SHA-512:	3BA0D6AD8B6838B04FBFDEBAD20EB5544C093BA592B517AA383708A34CE2BD215DB2BF010090251674DBCFD4EDA3C44F770C9FBF314304DE918D7E59E2596CF2
Malicious:	false
Preview:	.# Issuer: CN=GlobalSign Root CA O=GlobalSign nv-sa OU=Root CA.# Subject: CN=GlobalSign Root CA O=GlobalSign nv-sa OU=Root CA.# Label: "GlobalSign Root CA".# Serial: 4835703278459707669005204.# MD5 Fingerprint: 3e:45:52:15:09:51:92:e1:b7:5d:37:9f:b1:87:29:8a.# SHA1 Fingerprint: b1:bc:96:8b:d4:f4:9d:62:2a:a8:9a:81:f2:15:01:52:a4:1d:82:9c.# SHA256 Fingerprint: eb:d4:10:40:e4:bb:3e:c7:42:c9:e3:81:d3:1e:f2:a4:1a:48:b6:68:5c:96:e7:ce:f3:c1:df:6c:d4:33:1c:99.-----BEGIN CERTIFICATE-----.MIIDdTCCAl2gAwIBAgILBAAAAAABFUtaw5QwDQYJKoZIhvcNAQEFBQAwVzELMAkG.A1UEBhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24gbnYtc2ExEDAOBgNVBAsTB1Jv.b3QgQ0ExGzAZBgNVBAMTEkdsb2JhbFNpZ24gUm9vdCBDQTAeFw05ODA5MDExMjAw.MDBaFw0yODAxMjgxMjAwMDBaMFcxCzAJBgNVBAYTAkJFMRkwFwYDVQQKExBHbG9i.YWxTaWduIG52LXNhMRAwDgYDVQQLEwdSb290IENBMRswGQYDVQQDExJHbG9iYWxT.aWduIFJvb3QgQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDaDuaZ.jc6j40+Kfvvxi4Mla+pIH/EqsLmVEQS98GPR4mdmzxzdzxtIK+6NiY6arymAZavp.xy0Sy6scTHAHoT0KMM0VjU/43dSMUBUc71DuxC73/OlS8pF94G3VNTCOXkNz

C:\Users\user\AppData\Local\Temp\_MEI59482\config.json

Download File

Process:	C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1206
Entropy (8bit):	4.275024024623091
Encrypted:	false
SSDEEP:	24:pCKENTHgbeZlE1jCAh1RHEdOgNanAOSWSula:UKuTHgbYlUZHEdrNAla
MD5:	50CC63E4A1B24622CF61ED566B03E98F
SHA1:	92E5874785BB76E4579559BA70E116A6149349F5
SHA-256:	348F388C57DFB77B0CAACD8304725E10DC69A52EEC41AE695327787AD1853C92
SHA-512:	9A291DB9CF396687F3878590B1EB65CD7DA2E6FC3D6DE64A3B8CB08116B646371F432100E16B0ECD4F2916D05D67830F949AC2A3CA559A3A8D56616DF2BE98C7
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: C:\Users\user\AppData\Local\Temp\_MEI59482\config.json, Author: Joe Security
Preview:	{. "algo": "cryptonight",. "api": {. "port": 0,. "access-token": null,. "id": null,. "worker-id": null,. "ipv6": false,. "restricted": true. },. "autosave": true,. "av": 0,. "background": true,. "colors": true,. "cpu-affinity": null,. "cpu-priority": null,. "donate-level": 1,. "huge-pages": true,. "hw-aes": null,. "log-file": null,. "max-cpu-usage": 70,. "pools": [. {. "url": "xmr.crypto-pool.fr:3333",. "user": "47BD6QNfkWf8ZMQSdqp2tY1AdG8ofsEPf4mcDp1YB4AX32hUjoLjuDaNrYzXk7cQcoPBzAuQrmQTgNgpo6XPqSBLCnfsjaV",. "pass": "x",. "rig-id": null,. "nicehash": false,. "keepalive": false,. "variant": -1,. "enabled": true,. "tls": false,. "tls-fingerprint": null. }. ],. "print-time": 60,. "retries": 5,. "retry-pause": 5,. "safe": false,. "threads": [. {.

C:\Users\user\AppData\Local\Temp\_MEI59482\ftpcrack.exe.manifest

Download File

Process:	C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1345
Entropy (8bit):	5.283640732769631
Encrypted:	false
SSDEEP:	24:2dtn3ZoWglN2v+zg4NnEN4XKDmc0+bLg4fNRme5rcb3S:ch3DgX2+zg4i0KDmJ+bLg4VRmemS
MD5:	B5DEA49B86C5BB5D9CD8D64A09F70065
SHA1:	487EF676EBD244EBC3CF197F70DA7A5E393FB96E
SHA-256:	78B1160F6ADAB34D144AD19A0F4B83F83453F1E18460BBDFBE17AD354B62AF7D
SHA-512:	1B5914F4C52F47A33C57F5F6428482E6766099BF43D4E8616CE4AABC4A917C24B2E0C98C841F0D7E7B8A202F40FF960885535539BF70CC7C7ED8687C7ECE010C
Malicious:	true
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<assembly manifestVersion="1.0" xmlns="urn:schemas-microsoft-com:asm.v1">.. <assemblyIdentity name="ftpcrack" processorArchitecture="x86" type="win32" version="1.0.0.0"/>.. <dependency>.. <dependentAssembly>.. <assemblyIdentity name="Microsoft.VC90.CRT" processorArchitecture="x86" publicKeyToken="1fc8b3b9a1e18e3b" type="win32" version="9.0.30729.6161"/>.. <compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1"/>.. </dependentAssembly>.. </dependency>.. <dependency>.. <dependentAssembly>.. <assemblyIdentity language="*" name="Microsoft.Windows.Common-Controls" processorArchitecture="x86" publicKeyToken="6595b64144ccf1df" type="win32" version="6.0.0.0"/>.. <compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1"/>.. </dependentAssembly>.. </dependency>.. <compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1">.. <application>.. <supportedOS Id="{1f676c76-80e

C:\Users\user\AppData\Local\Temp\_MEI59482\httplib2\cacerts.txt

Download File

Process:	C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	135546
Entropy (8bit):	6.039525643754334
Encrypted:	false
SSDEEP:	3072:FVrovvEjVplrqHSdX+zpfQq7ZiyZOF5mdFENAKHn1HtYfei8i31MCSjfpVpKbIcf:3cmHuBfaUFENX3YfEl3plcs+
MD5:	14BA876BA2515A25BBB511F24BF06653
SHA1:	291DCDEE67E880B21FD7001CB8350C3ECEE4CAC8
SHA-256:	2039836A620F956EC094EAAE7C9B41A04C76F31130898B11014D9E83C905F0DE
SHA-512:	5035F82DF06308A14F6626C54382B3AB34B6D664C8394B48F75275F69DCC2B93266D843B51F0B586E5F12FCD70FE3660B5B08AFC20738DF6D8C812592C0D71E4
Malicious:	false
Preview:	# Issuer: CN=GTE CyberTrust Global Root O=GTE Corporation OU=GTE CyberTrust Solutions, Inc..# Subject: CN=GTE CyberTrust Global Root O=GTE Corporation OU=GTE CyberTrust Solutions, Inc..# Label: "GTE CyberTrust Global Root".# Serial: 421.# MD5 Fingerprint: ca:3d:d3:68:f1:03:5c:d0:32:fa:b8:2b:59:e8:5a:db.# SHA1 Fingerprint: 97:81:79:50:d8:1c:96:70:cc:34:d8:09:cf:79:44:31:36:7e:f4:74.# SHA256 Fingerprint: a5:31:25:18:8d:21:10:aa:96:4b:02:c7:b7:c6:da:32:03:17:08:94:e5:fb:71:ff:fb:66:67:d5:e6:81:0a:36.-----BEGIN CERTIFICATE-----.MIICWjCCAcMCAgGlMA0GCSqGSIb3DQEBBAUAMHUxCzAJBgNVBAYTAlVTMRgwFgYD.VQQKEw9HVEUgQ29ycG9yYXRpb24xJzAlBgNVBAsTHkdURSBDeWJlclRydXN0IFNv.bHV0aW9ucywgSW5jLjEjMCEGA1UEAxMaR1RFIEN5YmVyVHJ1c3QgR2xvYmFsIFJv.b3QwHhcNOTgwODEzMDAyOTAwWhcNMTgwODEzMjM1OTAwWjB1MQswCQYDVQQGEwJV.UzEYMBYGA1UEChMPR1RFIENvcnBvcmF0aW9uMScwJQYDVQQLEx5HVEUgQ3liZXJU.cnVzdCBTb2x1dGlvbnMsIEluYy4xIzAhBgNVBAMTGkdURSBDeWJlclRydXN0IEds.b2JhbCBSb290MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCVD6C28FCc6HrH.iM3dFw4usJTQGz0

C:\Users\user\AppData\Local\Temp\_MEI59482\msvcm90.dll

Download File

Process:	C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	225280
Entropy (8bit):	6.034911041879855
Encrypted:	false
SSDEEP:	3072:6yZeocziNzMLSMOYscmLWbAX+dP4Upoh86Goao14JU87/amFYw8fF01OyASLE:PYOMqc8oAXGP4Upoe6fa3/amiX2Oyp
MD5:	D34A527493F39AF4491B3E909DC697CA
SHA1:	AFEE32FCD9CE160680371357A072F58C5F790D48
SHA-256:	7A74DA389FBD10A710C294C2E914DC6F18E05F028F07958A2FA53AC44F0E4B90
SHA-512:	0DABC5455EB02601D7C40A9C49B3ADE750B1118934EF3785FB314FA313437BC02B243571ABA25F1661A69DCEA36838530C12762A2E6602D14A9B03770A82CCA6
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........;...h...h...h..ah...h1.dh...h..gh...h...h...h.-.h...h...h...h..qh...h..vh...h..`h...h..fh...h..ch...hRich...h........................PE..L.....M...........!.....:..........Z........P....?x.........................0......^.....@......................... 3..4....&..d...............................d...P...............................H...@...............(...........p...H............text...T9.......:.................. ..`.data........P.......>..............@....rsrc................H..............@..@.reloc...#.......$...L..............@..B........................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI59482\msvcp90.dll

Download File

Process:	C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	335184
Entropy (8bit):	6.343962999919931
Encrypted:	false
SSDEEP:	6144:fmIIPLSg4p0t4271NWoSYEMS6VhUgiW6QR7t5183Ooc8SHkC2eQ:fmIeLSgo0S271QoSQhUgiW6QR7t51831
MD5:	92EA2DB0E788894C43753C550216A886
SHA1:	DA8C7A178BA0CA80D321666F5642A7436B640602
SHA-256:	9694756F43B20ABC50F95646C54E9E36CD6EDF8EED3DB846064567399F4E7566
SHA-512:	90E72A68C7267E8D0986A75247AE7B2339E4C2A981D686342B2EF90B1FCF9695B558D0BD5932F7C53524E02CC664B974BA76783FDE919B24EB36795DB3300BA6
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........#%..Mv..Mv..Mv.66v..Mv...v..Mv..Lv:.Mv...v..Mv...v..Mv...v..Mv...v..Mv...v..Mv...v..Mv...v..MvRich..Mv........................PE..L.....M...........!................P.... ...0....Hx.........................0............@.........................p4..,....3.......0.......................&......................................()..H...........................................UPX0....................................UPX1......... ......................@....rsrc........0......................@..............................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI59482\msvcr90.dll

Download File

Process:	C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	250192
Entropy (8bit):	7.900323441964523
Encrypted:	false
SSDEEP:	6144:EODM4c99eLswEOva4g4fpgMf4FfIoSNjbZdGJCJLuEyKIqqOmiqsEqmQI0wye/c:EODM1HagYaMf4FAoSNjHmHyyc
MD5:	199D34B03C7D0EB804A6D9869184B8D4
SHA1:	03148854519D0970C1BBDC089D3E8DE1AED61C47
SHA-256:	DF86421E354F817607F2BAFC9188569242FCF9DD564B28F3E2915C86A0BA1F54
SHA-512:	E4269CA993393422A90231DAABD390771A635EEB0817A9D00DCCEF496372BB4B57B615529F26A2E8132BDE825CDACA07D965D207421C02EA6471DA214354361E
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..................6.........!.R...7.....&.....0.....6.....3...Rich..........PE..L.....M...........!.....@.......0..0f...@........Rx......................................@.........................@....\|.....x....................................................................r..H...........................................UPX0.....0..............................UPX1.....@...@...4..................@....rsrc................8..............@..............................................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI59482\netifaces.pyd

Download File

Process:	C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	11264
Entropy (8bit):	7.145184945732974
Encrypted:	false
SSDEEP:	192:uKqSCMOF44HPPtLm+9a3ozToPmzYUaFaNJhLkwcud2DH9VwGfctH:ubS9s44vPtLR9aUPJ+aNJawcudoD7U
MD5:	C7807680A69196C3EE66C4CFB3E271AC
SHA1:	D3EA74C9E3B810C6A1EE4296B97E20F2F45C9461
SHA-256:	1A6C57AC8031582477B1D3463A65B6EB006EEA704E27C8C4B812B99EA910428D
SHA-512:	A5D893132AD889E98B434DA7FD5CA377AFB1800FD8D3230CCED5E9FDE576FCEC943DD22FA48810BA6D93C510EBAA8AC5A94EC1B9D639FD6C533C5BBD4737CF15
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......FL...-...-...-...U...-...U...-...-..J-...U...-...U...-...U...-...U...-..Rich.-..........................PE..L...,.-\...........!.....0.......P...x...`..........................................................................4...P.......4...................................................................p...H...........................................UPX0.....P..............................UPX1.....0...`...&..................@...UPX2.................*..............@......................................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI59482\perfmon.pyd

Download File

Process:	C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	11264
Entropy (8bit):	6.948652527580434
Encrypted:	false
SSDEEP:	192:0xeSnTQM3MsUjU+viJBctKiyiLKPfFaNJhLkwcud2DH9VwGfct0XlpoI6J:0xe4R3scJBcMWYdaNJawcudoD7UmlSI
MD5:	EE813500A441B5FFDACD853E95BEE669
SHA1:	7F05F1493380AF3FE08F55524F6FF90C47C0CC4D
SHA-256:	AC491704AF920BE0E503F0243D2D371E230622E213E9F082347B52C0A7B009C2
SHA-512:	060D079A93ADD067EB062D2B1CB9977719BE68AE1223B0219DBB14CC9C6C66FF47D9929945636B577BC7F1BB84D5500B88ACD5F7BF636CC63BD4C88534AF724E
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........0...c...c...c..9c...c.gc...c.qc...c.ac...c...c...c.vc...c.`c...c.cc...cRich...c................PE..L...C..[...........!.....0.......`.......p........n.................................................................t...L...P...$.......P...............................................................H...........................................UPX0.....`..............................UPX1.....0...p..."..................@....rsrc................&..............@......................................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI59482\psutil._psutil_windows.pyd

Download File

Process:	C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	25600
Entropy (8bit):	7.700665778298437
Encrypted:	false
SSDEEP:	384:3qUURhEUVDrn5EMvG04YMJIoa67+5pGr0qLWMAUm7NFYGz45/+aNJawcudoD7ULt:aUjUXBjPAGHqLm7N/z4dnbcuyD7UL
MD5:	2FC800FCC46A597921C2ED447AEB09AC
SHA1:	72004227E5C60C8460F835A170798AA22861B79E
SHA-256:	2E4AD3D08118DA77C928C4614BFECB34397CFAF53F5D46D7C7E5F1DA3172C1F1
SHA-512:	A17022B364615B45A1873AEA0DE922A2988E4D75A8F4E63ECB9CA7DD46263E684B1F28B82BD77B046BBE2AD03CE65C5DACF98EACCAE861A30F137E0118A87225
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......E.6...X...X...X......X......X......X...Y...X......X......X......X.Rich..X.........PE..L...;b.\...........!.....`...................0...............................@.......................................2..\....0...............................2.......................................*..H...........................................UPX0....................................UPX1.....`.......\..................@...UPX2.........0.......`..............@......................................................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI59482\pyexpat.pyd

Download File

Process:	C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	52736
Entropy (8bit):	7.904524114628073
Encrypted:	false
SSDEEP:	1536:omazZr7ECJ0E6kFg85F/rFi2LU60XZlofDYq0nouy8:9aFr9mE6kF7hrcCU6Qlewout
MD5:	AD560121EFD8E249FC3414200D98F75F
SHA1:	73040F9BC04E733A85DA00E364EF85583F505636
SHA-256:	0BEB3B16F9A11F93137365A1179D2062A414ADABA337BCAC05A083A921775B50
SHA-512:	6DA2B01773DCE658DCFD9219DD8D093F60EAFF669ED600C9A62EFC39FB3E362F051A499FAC85777C1B8F364B1AD2E134E080CAE720FC5477711A7ED7F191A5C7
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........2.\...\...\......\......\......\......\...]..\......\......\......\.Rich..\.................PE..L...4>CX...........!................Pj....................................................@............................L...................................$.......................................(v..H...........................................UPX0....................................UPX1................................@...UPX2................................@......................................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI59482\python27.dll

Download File

Process:	C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	898048
Entropy (8bit):	7.990256946915668
Encrypted:	true
SSDEEP:	24576:I0cNEHSDC9XmwbTV/mv+nQW0mj7IaqtsoejWg3c:jHhmhmI9eo63
MD5:	8C44826A640B3CF0B32B0258C65FEE07
SHA1:	E3F9FE6366D0876BFA8B903B20D2ACF06416F1BC
SHA-256:	FBAD053D962BAC96865AC3372958D697711800FDC46F36C87011BB5E89026614
SHA-512:	884E2C01C088B9AE86D4605FED1CF8E9B17F99CF887EFC5644F4A91959ECD89148CCA3E9FDAA6AB9E8C4DFD2D61DBDFD442A95B13DAB7E5CD027B4782D473355
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......#..^g.y.g.y.g.y....~.y.n...l.y.n...i.y.n...e.y.n...l.y.g.x.[.y.n.....y.n...f.y.n...f.y.n...f.y.Richg.y.................PE..L... >CX...........!.....0.......0...Z..@...p...............................+...........@.........................pz.t\|..,y.D....p.,...........................................................f.H...........................................UPX0.....0..............................UPX1.....0...@...(..................@....rsrc........p......,..............@......................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI59482\pywintypes27.dll

Download File

Process:	C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	53248
Entropy (8bit):	7.425128830518154
Encrypted:	false
SSDEEP:	1536:eTwUerP24SfDRd2TACkwqyfnouy81cSPDuwQ0:eTleODRd2ew/Pout1cSru
MD5:	07B436BFA1C7B4FFC21FB39358158060
SHA1:	7F5A47CDAB9A7D93BBBD204CEDFFCA61D3F80C84
SHA-256:	82C2926CB03A04392FA479801D505E2A387446BCA978FF930177121DB2FDB461
SHA-512:	13EBCB83F478C859CA808003933769B84290E108648B69F33043653263C5B4BD37ED5CA8D521B46A1D9122EB232F7E5D05A25E16F250D5573CF85CD5CDEFB2EF
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......qz.Y5...5...5....Tz.7...+Iy.6...+Io.8.....".4...+I..1.....'.>...5.......+Ih.$...+I~.4...+I}.4...Rich5...................PE..L...:..[...........!.........P............... ....z..........................p.......................................%..PJ..h#....... ..h...................Po..........................................H...........................................UPX0....................................UPX1.............\|..................@....rsrc....P... ...P..................@......................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI59482\select.pyd

Download File

Process:	C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	9216
Entropy (8bit):	7.003407892450472
Encrypted:	false
SSDEEP:	192:qhogHS4TaqZXRQKKXYVEvySc3IFaNJhLkwcud2DH9VwGfctX:qhLS4TaqxhfCHc38aNJawcudoD7U
MD5:	57EB00056AC8C38CD4F3153FB9507F13
SHA1:	DDEE8E74FCC81B6301145F27C0F1CCF4B9185E1C
SHA-256:	7B90EC138AC8415D9B747612063D19147FEC2B1E99DE97C3B5636E8CA40B346E
SHA-512:	05F7EF6BD065D7DB3F41DFA95187FA40A14F58FA5D4705F2DF5982DB18EEB6D4E93C473D05932436BF645E76E0B23532867011E92EF953EC247B55648ED9C6EF
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........i)...z...z...z...z...z...z...z...z...z...z...z...z...z...z...z...z...z...z...zRich...z........PE..L...5>CX...........!..... .......P..pq...`................................................@.............................H...................................H.......................................P}..H...........................................UPX0.....P..............................UPX1..... ...`......................@...UPX2................."..............@..............................................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI59482\servicemanager.pyd

Download File

Process:	C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	7.2228399102917615
Encrypted:	false
SSDEEP:	384:FVtYwprbL7fLBtdYzKNg13ZOPaNJawcudoD7UfMX:vawBbLFYzKNg1plnbcuyD7UfMX
MD5:	6A95BCF45E4BE23CC2634EF5BAD17660
SHA1:	7D13B791588CB800C2ADD75FF8E74C3C493A8143
SHA-256:	60DA4B4E628B7DC1115615128AC554AEB29B50A61629AD5AEEB5CC9D2BD86202
SHA-512:	D3C80B025647444F42D42E82CAD50C4383728F7F8C9E16AA9D87450CA864B0B97B5F8F47E80328A4A2B67CE7D06C9A8F1DAE8C5B3C798DE1B2A50164161E69C8
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........o....K...K...K...K...K...K...K...K...KR..K...K...K...K...K...K...K...K...K...K...K...KRich...K........................PE..L......[...........!.....@........................}.....................................................................\...........................................................................h...H...........................................UPX0....................................UPX1.....@.......4..................@....rsrc................8..............@......................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI59482\unicodedata.pyd

Download File

Process:	C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	181760
Entropy (8bit):	7.989160583257678
Encrypted:	false
SSDEEP:	3072:Rfe2dO8KvTdjKGssSXwgtXZT32qenyxHBKs//4wd3RP29sZ6lI883out:Rfe2bKvEw+k2kw/4wZRPS3coS
MD5:	9A465CFAA788E29E7B1366C012EBC75C
SHA1:	10D9C49BB6652D9B04E17608D9ED35B036112647
SHA-256:	35C84D824DB175DD71046806A59BC711021ABCE04698FA304B1E2A9855E50A9C
SHA-512:	31BEE259C78CEB1E4F5C52E7B2CBD0EB62A071FC9C748DF47AB824E383EFDC3B218168700341B96D139DABFB3E4D7644341F22E52982B7C7F135A9E35B300B00
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......{H..?).?).?).6QE.=).6QS.1).6QT.=).6QC.8).?)..).6QY.>).6QB.>).6QA.>).Rich?).................PE..L...6>CX...........!......................................................................@.............................T...................................,.......................................x...H...........................................UPX0....................................UPX1................................@...UPX2................................@......................................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI59482\win32api.pyd

Download File

Process:	C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	34816
Entropy (8bit):	7.794879575971907
Encrypted:	false
SSDEEP:	768:etKTLIw2eRBsqBvKddE/wW68vEvfW2qmSOyinbcuyD7Uqmx:DCeLrGderDH2FXyinouy8qmx
MD5:	42C475231F4835BB1A5F94B0D3DA4520
SHA1:	FCFAE296DD10C92D973A57D61BBF5C0F4A15ED6B
SHA-256:	87CEEB1B7586DB730F48988A07018F9C8AF57934FF7F173A869542207F46B0F1
SHA-512:	D1A699B8497E8843F990F6F719A904A7751FE2A9404CB195BE2D94341728A7372CD93D379B576E6031980E1DA53F2336805C6BF59E799B63565CD63D4931C02A
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......[-..L...L...L.......L.......L.......L...J..L...L..UM.......L.......L.......L..Rich.L..................PE..L......[...........!.............p.. ...............................................................................P.......X...........X...............................................................H....................B..@...................UPX0.....p..............................UPX1.............~..................@....rsrc...............................@......................................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI59482\win32event.pyd

Download File

Process:	C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	11264
Entropy (8bit):	6.799438399701252
Encrypted:	false
SSDEEP:	192:jNxmpzSvHU53Uon53eXqY1K/CjrELQc432Xq0FaNJhLkwcud2DH9VwGfctLj/t:Xmp2/UR95aP1pgEc432XBaNJawcudoDU
MD5:	796306BE7A1ABCFFB8853EE9CEB5BEAE
SHA1:	93762CF53958A3A99B674986FCF3C53C489133ED
SHA-256:	26E6D883E9E61BF872425526A9B8C7BB229C3B9D2F82BB3C0BF500660DBE1995
SHA-512:	5919A837FA1FCAEA91B14D02DA306928D5E523E4591DCA290422C9EB9BE15F2EE626A8379F5C953F2B08E7A6B2CD67618652B9EFA9ACE8ABD47A8BD7CD8C2F64
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........k..{8..{8..{8..8..{8..8..{8..8..{8 ..8..{8..z8..{8..8..{8..8..{8..8..{8Rich..{8................PE..L...T..[...........!.....0..............................................................................................P...`...\.......`...........................................................h...H...........................................UPX0....................................UPX1.....0......."..................@....rsrc................&..............@......................................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI59482\win32evtlog.pyd

Download File

Process:	C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	19968
Entropy (8bit):	7.436093769968754
Encrypted:	false
SSDEEP:	384:Wo5FgP/m1xaGAONAt4ZvFqQggg3LgsAWUh31lA2W1waNJawcudoD7UGwGS:WmuP+TOONp5UQ/Zs8FlAfnbcuyD7UGwX
MD5:	317360BE68901D11F3D02AF1C151A4DC
SHA1:	570BF03BE1A737CF3D0CF3FC8E77261CF64E2051
SHA-256:	AC9C5C4BAA4DE19BDDF55313F29182F26EB80312C31266413672C61424A5C6E0
SHA-512:	25C25C23DD4FE1957CDFAD833D4570553C2627775008F3939525B6A3D1892F8B6CB7A9F20D454166338DF4DFC8A98306A1160016AE4CB2E9464944945AFA0A82
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........E..i+..i+..i+.E&...i+..;...i+..;...i+..;...i+.%...i+..i*.hi+..;...i+..;...i+..;...i+..;...i+.Rich.i+.................PE..L......[...........!.....P...................0...............................@.......................................4..T....3..P....0......................L5.......................................!..H.......................@...................UPX0....................................UPX1.....P.......D..................@....rsrc........0.......H..............@......................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI59482\win32service.pyd

Download File

Process:	C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	18432
Entropy (8bit):	7.513143648749714
Encrypted:	false
SSDEEP:	384:DvSTTJQxdZ3goCVdvSbw66apC1aNJawcudoD7U46:LSTT+1KF1onbcuyD7U46
MD5:	F23A62491BD945C050E3E1D13909E9E7
SHA1:	B8DAC4E00163533157A17E3B56D05E049A2375A2
SHA-256:	E52B5532A6764AAAE67DB557412B3F77EBDC8A14A72771A1C6414A83BB3FC15C
SHA-512:	52200CF9687752DB43BBAE703192C841694D5BD976FA56C0F25E0478CFB97681BC77677C1A8907167612DDF9FE6A561945FBEB0180022670AF97BF41B5B11766
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........[..[..[.....Z..E.-.Z..E.;.V..E.+.]...!s.\..[.....E.<.^..E.*.Z..E.,.Z..E.).Z..Rich[..........PE..L...q..[...........!.....@..........................................................................................8...T...............................................................................H...........................................UPX0....................................UPX1.....@.......>..................@....rsrc................B..............@..............................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI59482\xmrig.exe

Download File

Process:	C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	1905664
Entropy (8bit):	7.9235088812144
Encrypted:	false
SSDEEP:	49152:jeXVwyagUSymDH29F4+rthFTo6YZfnH8:0VKgUSymDH29ttzToX1nc
MD5:	13BDD9CD9F7E51746172996262B5A873
SHA1:	3834F8179ABD7A827E927505F3C226AC8BBCF3EE
SHA-256:	4BF737B29FF521BC263EB1F2C1C5EA04B47470CCCD1BEAE245D98DEF389929BD
SHA-512:	49879918505D042312F20B2FC8310A8C4A58AA266ED1AB05E0481F7E11385DA0920CF9D756F842EB98E4394F14725385B74A99B38FC8A60222FA4CC873CB8040
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: C:\Users\user\AppData\Local\Temp\_MEI59482\xmrig.exe, Author: Joe Security
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....\.....................`...0>...Z..@>...[...@..........................`[............... ...................... X.x....][.<.....[..]....................................................Z.....................................................UPX0.....0>.............................UPX1.........@>.....................@....rsrc....`....[..`..................@...3.94.UPX!....E.G...@.`.Z.....$Z.$/.w.......&...'....1.f.=.@9....MZ..,......($..#...th.....82..tJ......$.,./,......+.l..Ho..~B.......:..6....L.=Dc..tm....-<h....f..<2...u..?PEl..u..Q....-l..~?....j..x.......]...........K".v.g?w...k+...yt`,........o..7>,. ..D$...............7......b..0.{..,.~...[U......WV.U.S..\|.0~....+..).b.........@....................5.o.E.....d....x....l0.9..9...3....o._..........=...u...;.v.f...R..0..`.lm...--...I...X/(......9J9..~?.v...&+.. P.kSn.l......LJ...

C:\Users\user\AppData\Local\Temp\_MEI64762\Crypto.Cipher._AES.pyd

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	7.553130526678379
Encrypted:	false
SSDEEP:	384:50Q1C9jViLl7hDB6n/PtHU2wr8gj93KqmilaNJawcudoD7U:dC8LU/PBU8itClnbcuyD7U
MD5:	371397E80A55D432DA47311B8EF25317
SHA1:	71617777D6A2500D6464D7B394C8BE5F1E4E119E
SHA-256:	C1A900615C9500C46B9602C30C53F299290B03632208EF1152AF8830AB73AD17
SHA-512:	3139E2848ACF02CC8475449F213873D2C2B7196F6A55C70D2D8F8B487020387740364E5CA0AA584624D1B9B01B965146A2F0E15EEF34830C7C0ECBB8637DAE03
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........+\8.J2k.J2k.J2k.Ik.J2k...k.J2k...k.J2k...k.J2k.2.k.J2k.J3k.J2k...k.J2k...k.J2k...k.J2kRich.J2k........PE..L....4.S...........!.....@..........`...................................................................................D...........................................................................8...H...........................................UPX0....................................UPX1.....@.......:..................@...UPX2.................>..............@......................................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI64762\Include\pyconfig.h

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	C source, ASCII text
Category:	dropped
Size (bytes):	21321
Entropy (8bit):	5.345136937906198
Encrypted:	false
SSDEEP:	384:pGpFpaU1kgCw8r+MIP8Bj5DvVySh3awQBoerw8W+PYV0FGYfN/+:pGpFpb+IU99UShATrw8W+AKF/+
MD5:	BC185DE8B2437963368A85FDD9852951
SHA1:	1459F1428214FCCA7F203FB3A3AFF28E16EB9C1B
SHA-256:	8B130D901E0F83B55699D565F103F2F8F1B3A51712EBB4B9646EA517CC1F04D6
SHA-512:	918469D9A59FE059F3C7C93F34C8D2D07CB8A9BF5E953A1527922ED5C65FF4A2DF50BBC78ED9CE146BF3A1FB6F1763F061262FA4A937BEEEE1FEB8A99E31339E
Malicious:	false
Preview:	#ifndef Py_CONFIG_H.#define Py_CONFIG_H../* pyconfig.h. NOT Generated automatically by configure...This is a manually maintained version used for the Watcom,.Borland and Microsoft Visual C++ compilers. It is a.standard part of the Python distribution...WINDOWS DEFINES:.The code specific to Windows should be wrapped around one of.the following #defines..MS_WIN64 - Code specific to the MS Win64 API.MS_WIN32 - Code specific to the MS Win32 (and Win64) API (obsolete, this covers all supported APIs).MS_WINDOWS - Code specific to Windows, but all versions..MS_WINCE - Code specific to Windows CE.Py_ENABLE_SHARED - Code if the Python core is built as a DLL...Also note that neither "_M_IX86" or "_MSC_VER" should be used for.any purpose other than "Windows Intel x86 specific" and "Microsoft.compiler specific". Therefore, these should be very rare....NOTE: The following symbols are deprecated:.NT, USE_DL_EXPORT, USE_DL_IMPORT, DL_EXPORT, DL_IMPORT.MS_CORE_DLL...WIN32 is still required for the

C:\Users\user\AppData\Local\Temp\_MEI64762\Microsoft.VC90.CRT.manifest

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1050
Entropy (8bit):	5.382436822526041
Encrypted:	false
SSDEEP:	24:2dtn3mGv+zg4NnEN4XKHVJrMmV6LSWV5rcb3S:ch35+zg4i0KHVVdOmS
MD5:	BFB93876892CCA8E2AD0021585C34C8B
SHA1:	0DDE1B225C98825A09D8FF85F462571C9C862E35
SHA-256:	0D060ED7C25159B7B75F16D449963BFD639C15B3C5280BC7897403268C2B9F35
SHA-512:	FE70540B3B3FA88B32DFB2FF7406A3A9819E7862B850D871B932996BBEFFDBC70D7192D6E3196A8583B2DB756CA9CC278505AFBE585BA30EB1222D4F8BE15B7B
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<assembly manifestVersion="1.0" xmlns="urn:schemas-microsoft-com:asm.v1">.. <noInheritable/>.. <assemblyIdentity name="Microsoft.VC90.CRT" processorArchitecture="x86" publicKeyToken="1fc8b3b9a1e18e3b" type="win32" version="9.0.30729.6161"/>.. <file hash="7021457b391b35606e708c69987e4b6f606609ee" hashalg="SHA1" name="msvcr90.dll"/>.. <file hash="88549dd3ce8eaa62ca8aad0e96ddd9fec2203628" hashalg="SHA1" name="msvcp90.dll"/>.. <file hash="65ef374affa5b48827e539b35b3275c201b41fc9" hashalg="SHA1" name="msvcm90.dll"/>.. <compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1">.. <application>.. <supportedOS Id="{1f676c76-80e1-4239-95bb-83d0f6d0da78}"/>.. <supportedOS Id="{4a2f28e3-53b9-4441-ba9c-d69d4a4a6e38}"/>.. <supportedOS Id="{e2011457-1546-43c5-a5fe-008deee3d3f0}"/>.. <supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}"/>.. <supportedOS Id="{8e0f7a12-bfb3-4fe8-b9a5-48fd50a15a9a}"/>..

C:\Users\user\AppData\Local\Temp\_MEI64762\_ctypes.pyd

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	37888
Entropy (8bit):	7.848484052157707
Encrypted:	false
SSDEEP:	768:pAXLisB/qV2nQnf33sWcCRWKZac3VWw6cLA3zReukhRnbcuyD7U:pAnBi8nQf3sYToclt6cLUCRnouy8
MD5:	6CB8B560EFBC381651D2045F1571D7C8
SHA1:	15283A7A467ADB7B6D7A7182F660DD783F90E483
SHA-256:	6456FEA123E04BCEC8A8EED26160E1DF5482E69D187D3E1A0C428995472AC134
SHA-512:	CA2958095E8E08B5EF05EC9DE15B7D1EB180923A40B90356DB56A124101C96D8E745001948B89DBE9D6B9CE3C2029F7E9EAF20C73FA1D410A821D6605830BFC0
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...................F.....W.....P......@..........Z.....A.....B...Rich..................PE..L...*>CX...........!............. .. ....0................................................@.........................<...........<.......................................................................H...........................................UPX0..... ..............................UPX1.........0......................@...UPX2................................@......................................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI64762\_hashlib.pyd

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	351744
Entropy (8bit):	7.996557276168139
Encrypted:	true
SSDEEP:	6144:Xh0byJKrtKOFhjnTtMoy8gpVI/xxWo/nX0NKOzyGFmJ559Vq2SeTsRgIIGYMowwZ:2bymtjF1TtMod/xweDK7FmJ5rLVYTIGm
MD5:	EE134421FBABEB565E4F3CA721331C2E
SHA1:	4B03BDD142C6A7BB6F74ABE968C5B76B63E06059
SHA-256:	7863E1BEDFE1FFC720B67B2EB7B3491DB9D2B8E56B5574E6A40FF90336B8DAFA
SHA-512:	D27FF65B6A8BF2E5E70D2865E72EEE6930E76C2A3990428C54FC998743D3C540C5C984B5D1429E8FFBE3D160AE1F6782CD6D3CA40822F81D2052BA168595D1FA
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......z.$.>.J.>.J.>.J.7...4.J.7...1.J.7...<.J.7...3.J.>.K..J.>.J...J.7...Y.J.7...?.J.7...?.J.Rich>.J.........................PE..L....>CX...........!.....`..........@K.......`...............................p............@.........................pa..L....`..p............................a.......................................W..H...........................................UPX0....................................UPX1.....`.......X..................@...UPX2.........`.......\..............@......................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI64762\_socket.pyd

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	22016
Entropy (8bit):	7.706254752795193
Encrypted:	false
SSDEEP:	384:CCNDRisVUlkycq27U4r0rOc606B8k4gG35aiQjgO6OPjGL2e1ua7aNJawcudoD7P:v7VUcq27Jr0rOmbwE4jGLhohnbcuyD7B
MD5:	BE47363992C7DD90019276D35FA8DA76
SHA1:	CCF7EBBE829DA08EFD95A53D4BA0C0D4938F6169
SHA-256:	BE10254B111713BEF20A13D561DE61CA3C74A34C64DDC5B10825C64AB2C46734
SHA-512:	573F9111535A9A136FCAAA5C1A16C347F7327626768D849513D69C9848406B1002DCC5B8C17A291EF2E6519587533CA806018EE471A39D330F032A9E7E635EA7
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......AV2..7\..7\..7\..O..7\..O..7\..O..7\..7]..7\..O..7\..O..7\..O..7\..O..7\.Rich.7\.........................PE..L...X>CX...........!.....P..........0.....................................................@.............................d...................................d...........................................H...........................................UPX0....................................UPX1.....P.......P..................@...UPX2.................T..............@..............................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI64762\_ssl.pyd

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	498688
Entropy (8bit):	7.996471896707535
Encrypted:	true
SSDEEP:	12288:FHNz5hZdNGitmdIA8byo3k4Ff9m3fTByPf6So+2RON1jjoS:P3fNTtmd2bkof43fTkR2gH
MD5:	68C3AD86E0A8833C29AD1BE10D3C025D
SHA1:	04488362814B2F3AE07C4E8DF8E45868D48B447F
SHA-256:	C236271B92A0F1D3304337F2E2444107F34D8E26272981F48C47DB347133566C
SHA-512:	BB2819D913033CC26DCD1E5CBF015DACDBF747D29C72BFD41BFE0D74BB77E51A61CF9BE4B67B6348938837125F1D0F80AF0AC33531E00CEA1585535952A22785
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........HFu.)(&.)(&.)(&.Q.&.)(&.Q.&.)(&.Q.&.)(&.)(&.)(&.))&9)(&.Q.&.)(&.Q.&.((&.Q.&.)(&.Q.&.)(&Rich.)(&................PE..L...q>CX...........!.................e....................................................@............................D............................................................................q..H...........................................UPX0....................................UPX1................................@...UPX2................................@..............................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI64762\_win32sysloader.pyd

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	4.992693298555373
Encrypted:	false
SSDEEP:	192:t2VnGV7o5QUEZWm6Uk3fvf3X7THIL3YO+8I:tVU5QUEz6hfLTH98
MD5:	B4A567D80CCC08FB1C7FBB765847AFDA
SHA1:	B7FF2C68BA2887AAF5D029F41922E626C72B716D
SHA-256:	DBB0F9C499A710BBC8BCDE4ECC3577A6C9548262D6CE4434ED5A0708CBC787DD
SHA-512:	DDFEC25304BABE2DF55958F512F61AFD9AF88DDA499FE87931D17A9EEBF048449885A06A24BDDBC8604E11F07CED3C2ECE7F89C28290CAB5D1BF3816D22128DB
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......M.oC.............J.............................../........................Rich............PE..L......[...........!......................... ....;..........................`......................................P&..Z...\"..P....@..l....................P....... ..............................8!..@............ ...............................text...`........................... ..`.rdata....... ......................@..@.data........0......................@....rsrc...l....@......................@..@.reloc.......P......................@..B........................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI64762\back.jpg

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	47107
Entropy (8bit):	6.2032294727594985
Encrypted:	false
SSDEEP:	768:z9v1zJKaohy0Za9jwmrALVaka3sgBXHDizIdI9e2E:5v1zJ3nuswbLVgZsceO
MD5:	4AE078DD5085E97D3605F20DC079412A
SHA1:	1BABFCF2D374AE590970A3BE2E0E27BC04922546
SHA-256:	ED551536FF22587CDF7701A279E088EB370A4121E7A3FA1F3C8B121E767318A2
SHA-512:	BF163C63120CC5035087E4FF0035D9DAEB100218C62969AA6AA75D539108323295EB9CC28ABB0906C21CE8AEA25DACD1D0AAB3F3FE9C765D35348F0A7DA000AE
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......]....S......"...8.P....... ..`u...0.................................................... .....................................................................................................................................................UPX0..... ..............................UPX1.....P...0...H..................@...UPX2.................J..............@...3.93.UPX!.....3r#l..JW..CE...0..&.......U..S...........t?........'.........9.r.....t...'.....s.t&...$....,1....$6.....X[]._V`..u....tG..oo.t$lE_D$.....=......."....1......uG...c..4....uF1..e.[^]..o...f.L.!.+.y..........................8</....fp.v..U..$........../...........O/...e..]...........#3f.E.f.E......m.._..;.}e.......f.t"............U.1.3-...}..~2.k......!..........7{..+...7..\|...............G.:..S........w. ........ ..%+{.n..$...e.>.m....u..,(.....k_.'lk.C2$C&'(.5.`cv/..

C:\Users\user\AppData\Local\Temp\_MEI64762\bz2.pyd

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	35840
Entropy (8bit):	7.816957595202127
Encrypted:	false
SSDEEP:	768:IHCeOgq+kCitCVj5rz2Ya+r9qLYp9R9JoWnbcuyD7UiT:IHXr8CBd9NpfXxnouy8
MD5:	C9C00BC854A39E66B27787D188F9E8D7
SHA1:	21F20CF6C628B529DB4BDB853B679F9BF23590E3
SHA-256:	29520DF660A5BBD704B9106A6650A66E4F5766B904D05F97146668D41DBF5839
SHA-512:	8887B5CA542220CAC04D5A6A22A06F95DB560F4FE0F9A128CEB642ED9716ABCFFBA2146CCE682EB16C4DA3F423649A61904A73C4357D9FDBD5DDF606790199A3
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......}.S.9.=K9.=K9.=K..K:.=K0..K:.=K0..K7.=K0..K;.=K0..K>.=K9.<KS.=K0..K1.=K0..K8.=K0..K8.=KRich9.=K................PE..L...?>CX...........!.................W.......p............................................@..........................p..D....p...............................q.......................................c..H...........................................UPX0....................................UPX1................................@...UPX2.........p......................@..............................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI64762\certifi\cacert.pem

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	284518
Entropy (8bit):	6.05114864026174
Encrypted:	false
SSDEEP:	6144:GriCfLXd1YU58fVuKlnm5plZ0PXCRrcMBbADwYC+MslE:GrdT3YZuz5LwCRrcMije
MD5:	DD2DD543395692705F7DDA0F5E7750FA
SHA1:	40D7CE60393978A29FB0E0B1E849658E48CF7887
SHA-256:	397B833E5ACF89A2709B964401A9ACA68D24B62349B72BBE38684E586AA07A27
SHA-512:	3BA0D6AD8B6838B04FBFDEBAD20EB5544C093BA592B517AA383708A34CE2BD215DB2BF010090251674DBCFD4EDA3C44F770C9FBF314304DE918D7E59E2596CF2
Malicious:	false
Preview:	.# Issuer: CN=GlobalSign Root CA O=GlobalSign nv-sa OU=Root CA.# Subject: CN=GlobalSign Root CA O=GlobalSign nv-sa OU=Root CA.# Label: "GlobalSign Root CA".# Serial: 4835703278459707669005204.# MD5 Fingerprint: 3e:45:52:15:09:51:92:e1:b7:5d:37:9f:b1:87:29:8a.# SHA1 Fingerprint: b1:bc:96:8b:d4:f4:9d:62:2a:a8:9a:81:f2:15:01:52:a4:1d:82:9c.# SHA256 Fingerprint: eb:d4:10:40:e4:bb:3e:c7:42:c9:e3:81:d3:1e:f2:a4:1a:48:b6:68:5c:96:e7:ce:f3:c1:df:6c:d4:33:1c:99.-----BEGIN CERTIFICATE-----.MIIDdTCCAl2gAwIBAgILBAAAAAABFUtaw5QwDQYJKoZIhvcNAQEFBQAwVzELMAkG.A1UEBhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24gbnYtc2ExEDAOBgNVBAsTB1Jv.b3QgQ0ExGzAZBgNVBAMTEkdsb2JhbFNpZ24gUm9vdCBDQTAeFw05ODA5MDExMjAw.MDBaFw0yODAxMjgxMjAwMDBaMFcxCzAJBgNVBAYTAkJFMRkwFwYDVQQKExBHbG9i.YWxTaWduIG52LXNhMRAwDgYDVQQLEwdSb290IENBMRswGQYDVQQDExJHbG9iYWxT.aWduIFJvb3QgQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDaDuaZ.jc6j40+Kfvvxi4Mla+pIH/EqsLmVEQS98GPR4mdmzxzdzxtIK+6NiY6arymAZavp.xy0Sy6scTHAHoT0KMM0VjU/43dSMUBUc71DuxC73/OlS8pF94G3VNTCOXkNz

C:\Users\user\AppData\Local\Temp\_MEI64762\config.json

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1206
Entropy (8bit):	4.275024024623091
Encrypted:	false
SSDEEP:	24:pCKENTHgbeZlE1jCAh1RHEdOgNanAOSWSula:UKuTHgbYlUZHEdrNAla
MD5:	50CC63E4A1B24622CF61ED566B03E98F
SHA1:	92E5874785BB76E4579559BA70E116A6149349F5
SHA-256:	348F388C57DFB77B0CAACD8304725E10DC69A52EEC41AE695327787AD1853C92
SHA-512:	9A291DB9CF396687F3878590B1EB65CD7DA2E6FC3D6DE64A3B8CB08116B646371F432100E16B0ECD4F2916D05D67830F949AC2A3CA559A3A8D56616DF2BE98C7
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: C:\Users\user\AppData\Local\Temp\_MEI64762\config.json, Author: Joe Security
Preview:	{. "algo": "cryptonight",. "api": {. "port": 0,. "access-token": null,. "id": null,. "worker-id": null,. "ipv6": false,. "restricted": true. },. "autosave": true,. "av": 0,. "background": true,. "colors": true,. "cpu-affinity": null,. "cpu-priority": null,. "donate-level": 1,. "huge-pages": true,. "hw-aes": null,. "log-file": null,. "max-cpu-usage": 70,. "pools": [. {. "url": "xmr.crypto-pool.fr:3333",. "user": "47BD6QNfkWf8ZMQSdqp2tY1AdG8ofsEPf4mcDp1YB4AX32hUjoLjuDaNrYzXk7cQcoPBzAuQrmQTgNgpo6XPqSBLCnfsjaV",. "pass": "x",. "rig-id": null,. "nicehash": false,. "keepalive": false,. "variant": -1,. "enabled": true,. "tls": false,. "tls-fingerprint": null. }. ],. "print-time": 60,. "retries": 5,. "retry-pause": 5,. "safe": false,. "threads": [. {.

C:\Users\user\AppData\Local\Temp\_MEI64762\ftpcrack.exe.manifest

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1345
Entropy (8bit):	5.283640732769631
Encrypted:	false
SSDEEP:	24:2dtn3ZoWglN2v+zg4NnEN4XKDmc0+bLg4fNRme5rcb3S:ch3DgX2+zg4i0KDmJ+bLg4VRmemS
MD5:	B5DEA49B86C5BB5D9CD8D64A09F70065
SHA1:	487EF676EBD244EBC3CF197F70DA7A5E393FB96E
SHA-256:	78B1160F6ADAB34D144AD19A0F4B83F83453F1E18460BBDFBE17AD354B62AF7D
SHA-512:	1B5914F4C52F47A33C57F5F6428482E6766099BF43D4E8616CE4AABC4A917C24B2E0C98C841F0D7E7B8A202F40FF960885535539BF70CC7C7ED8687C7ECE010C
Malicious:	true
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<assembly manifestVersion="1.0" xmlns="urn:schemas-microsoft-com:asm.v1">.. <assemblyIdentity name="ftpcrack" processorArchitecture="x86" type="win32" version="1.0.0.0"/>.. <dependency>.. <dependentAssembly>.. <assemblyIdentity name="Microsoft.VC90.CRT" processorArchitecture="x86" publicKeyToken="1fc8b3b9a1e18e3b" type="win32" version="9.0.30729.6161"/>.. <compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1"/>.. </dependentAssembly>.. </dependency>.. <dependency>.. <dependentAssembly>.. <assemblyIdentity language="*" name="Microsoft.Windows.Common-Controls" processorArchitecture="x86" publicKeyToken="6595b64144ccf1df" type="win32" version="6.0.0.0"/>.. <compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1"/>.. </dependentAssembly>.. </dependency>.. <compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1">.. <application>.. <supportedOS Id="{1f676c76-80e

C:\Users\user\AppData\Local\Temp\_MEI64762\httplib2\cacerts.txt

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	135546
Entropy (8bit):	6.039525643754334
Encrypted:	false
SSDEEP:	3072:FVrovvEjVplrqHSdX+zpfQq7ZiyZOF5mdFENAKHn1HtYfei8i31MCSjfpVpKbIcf:3cmHuBfaUFENX3YfEl3plcs+
MD5:	14BA876BA2515A25BBB511F24BF06653
SHA1:	291DCDEE67E880B21FD7001CB8350C3ECEE4CAC8
SHA-256:	2039836A620F956EC094EAAE7C9B41A04C76F31130898B11014D9E83C905F0DE
SHA-512:	5035F82DF06308A14F6626C54382B3AB34B6D664C8394B48F75275F69DCC2B93266D843B51F0B586E5F12FCD70FE3660B5B08AFC20738DF6D8C812592C0D71E4
Malicious:	false
Preview:	# Issuer: CN=GTE CyberTrust Global Root O=GTE Corporation OU=GTE CyberTrust Solutions, Inc..# Subject: CN=GTE CyberTrust Global Root O=GTE Corporation OU=GTE CyberTrust Solutions, Inc..# Label: "GTE CyberTrust Global Root".# Serial: 421.# MD5 Fingerprint: ca:3d:d3:68:f1:03:5c:d0:32:fa:b8:2b:59:e8:5a:db.# SHA1 Fingerprint: 97:81:79:50:d8:1c:96:70:cc:34:d8:09:cf:79:44:31:36:7e:f4:74.# SHA256 Fingerprint: a5:31:25:18:8d:21:10:aa:96:4b:02:c7:b7:c6:da:32:03:17:08:94:e5:fb:71:ff:fb:66:67:d5:e6:81:0a:36.-----BEGIN CERTIFICATE-----.MIICWjCCAcMCAgGlMA0GCSqGSIb3DQEBBAUAMHUxCzAJBgNVBAYTAlVTMRgwFgYD.VQQKEw9HVEUgQ29ycG9yYXRpb24xJzAlBgNVBAsTHkdURSBDeWJlclRydXN0IFNv.bHV0aW9ucywgSW5jLjEjMCEGA1UEAxMaR1RFIEN5YmVyVHJ1c3QgR2xvYmFsIFJv.b3QwHhcNOTgwODEzMDAyOTAwWhcNMTgwODEzMjM1OTAwWjB1MQswCQYDVQQGEwJV.UzEYMBYGA1UEChMPR1RFIENvcnBvcmF0aW9uMScwJQYDVQQLEx5HVEUgQ3liZXJU.cnVzdCBTb2x1dGlvbnMsIEluYy4xIzAhBgNVBAMTGkdURSBDeWJlclRydXN0IEds.b2JhbCBSb290MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCVD6C28FCc6HrH.iM3dFw4usJTQGz0

C:\Users\user\AppData\Local\Temp\_MEI64762\msvcm90.dll

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	225280
Entropy (8bit):	6.034911041879855
Encrypted:	false
SSDEEP:	3072:6yZeocziNzMLSMOYscmLWbAX+dP4Upoh86Goao14JU87/amFYw8fF01OyASLE:PYOMqc8oAXGP4Upoe6fa3/amiX2Oyp
MD5:	D34A527493F39AF4491B3E909DC697CA
SHA1:	AFEE32FCD9CE160680371357A072F58C5F790D48
SHA-256:	7A74DA389FBD10A710C294C2E914DC6F18E05F028F07958A2FA53AC44F0E4B90
SHA-512:	0DABC5455EB02601D7C40A9C49B3ADE750B1118934EF3785FB314FA313437BC02B243571ABA25F1661A69DCEA36838530C12762A2E6602D14A9B03770A82CCA6
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........;...h...h...h..ah...h1.dh...h..gh...h...h...h.-.h...h...h...h..qh...h..vh...h..`h...h..fh...h..ch...hRich...h........................PE..L.....M...........!.....:..........Z........P....?x.........................0......^.....@......................... 3..4....&..d...............................d...P...............................H...@...............(...........p...H............text...T9.......:.................. ..`.data........P.......>..............@....rsrc................H..............@..@.reloc...#.......$...L..............@..B........................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI64762\msvcp90.dll

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	335184
Entropy (8bit):	6.343962999919931
Encrypted:	false
SSDEEP:	6144:fmIIPLSg4p0t4271NWoSYEMS6VhUgiW6QR7t5183Ooc8SHkC2eQ:fmIeLSgo0S271QoSQhUgiW6QR7t51831
MD5:	92EA2DB0E788894C43753C550216A886
SHA1:	DA8C7A178BA0CA80D321666F5642A7436B640602
SHA-256:	9694756F43B20ABC50F95646C54E9E36CD6EDF8EED3DB846064567399F4E7566
SHA-512:	90E72A68C7267E8D0986A75247AE7B2339E4C2A981D686342B2EF90B1FCF9695B558D0BD5932F7C53524E02CC664B974BA76783FDE919B24EB36795DB3300BA6
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........#%..Mv..Mv..Mv.66v..Mv...v..Mv..Lv:.Mv...v..Mv...v..Mv...v..Mv...v..Mv...v..Mv...v..Mv...v..MvRich..Mv........................PE..L.....M...........!................P.... ...0....Hx.........................0............@.........................p4..,....3.......0.......................&......................................()..H...........................................UPX0....................................UPX1......... ......................@....rsrc........0......................@..............................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI64762\msvcr90.dll

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	250192
Entropy (8bit):	7.900323441964523
Encrypted:	false
SSDEEP:	6144:EODM4c99eLswEOva4g4fpgMf4FfIoSNjbZdGJCJLuEyKIqqOmiqsEqmQI0wye/c:EODM1HagYaMf4FAoSNjHmHyyc
MD5:	199D34B03C7D0EB804A6D9869184B8D4
SHA1:	03148854519D0970C1BBDC089D3E8DE1AED61C47
SHA-256:	DF86421E354F817607F2BAFC9188569242FCF9DD564B28F3E2915C86A0BA1F54
SHA-512:	E4269CA993393422A90231DAABD390771A635EEB0817A9D00DCCEF496372BB4B57B615529F26A2E8132BDE825CDACA07D965D207421C02EA6471DA214354361E
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..................6.........!.R...7.....&.....0.....6.....3...Rich..........PE..L.....M...........!.....@.......0..0f...@........Rx......................................@.........................@....\|.....x....................................................................r..H...........................................UPX0.....0..............................UPX1.....@...@...4..................@....rsrc................8..............@..............................................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI64762\netifaces.pyd

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	11264
Entropy (8bit):	7.145184945732974
Encrypted:	false
SSDEEP:	192:uKqSCMOF44HPPtLm+9a3ozToPmzYUaFaNJhLkwcud2DH9VwGfctH:ubS9s44vPtLR9aUPJ+aNJawcudoD7U
MD5:	C7807680A69196C3EE66C4CFB3E271AC
SHA1:	D3EA74C9E3B810C6A1EE4296B97E20F2F45C9461
SHA-256:	1A6C57AC8031582477B1D3463A65B6EB006EEA704E27C8C4B812B99EA910428D
SHA-512:	A5D893132AD889E98B434DA7FD5CA377AFB1800FD8D3230CCED5E9FDE576FCEC943DD22FA48810BA6D93C510EBAA8AC5A94EC1B9D639FD6C533C5BBD4737CF15
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......FL...-...-...-...U...-...U...-...-..J-...U...-...U...-...U...-...U...-..Rich.-..........................PE..L...,.-\...........!.....0.......P...x...`..........................................................................4...P.......4...................................................................p...H...........................................UPX0.....P..............................UPX1.....0...`...&..................@...UPX2.................*..............@......................................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI64762\perfmon.pyd

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	11264
Entropy (8bit):	6.948652527580434
Encrypted:	false
SSDEEP:	192:0xeSnTQM3MsUjU+viJBctKiyiLKPfFaNJhLkwcud2DH9VwGfct0XlpoI6J:0xe4R3scJBcMWYdaNJawcudoD7UmlSI
MD5:	EE813500A441B5FFDACD853E95BEE669
SHA1:	7F05F1493380AF3FE08F55524F6FF90C47C0CC4D
SHA-256:	AC491704AF920BE0E503F0243D2D371E230622E213E9F082347B52C0A7B009C2
SHA-512:	060D079A93ADD067EB062D2B1CB9977719BE68AE1223B0219DBB14CC9C6C66FF47D9929945636B577BC7F1BB84D5500B88ACD5F7BF636CC63BD4C88534AF724E
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........0...c...c...c..9c...c.gc...c.qc...c.ac...c...c...c.vc...c.`c...c.cc...cRich...c................PE..L...C..[...........!.....0.......`.......p........n.................................................................t...L...P...$.......P...............................................................H...........................................UPX0.....`..............................UPX1.....0...p..."..................@....rsrc................&..............@......................................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI64762\psutil._psutil_windows.pyd

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	25600
Entropy (8bit):	7.700665778298437
Encrypted:	false
SSDEEP:	384:3qUURhEUVDrn5EMvG04YMJIoa67+5pGr0qLWMAUm7NFYGz45/+aNJawcudoD7ULt:aUjUXBjPAGHqLm7N/z4dnbcuyD7UL
MD5:	2FC800FCC46A597921C2ED447AEB09AC
SHA1:	72004227E5C60C8460F835A170798AA22861B79E
SHA-256:	2E4AD3D08118DA77C928C4614BFECB34397CFAF53F5D46D7C7E5F1DA3172C1F1
SHA-512:	A17022B364615B45A1873AEA0DE922A2988E4D75A8F4E63ECB9CA7DD46263E684B1F28B82BD77B046BBE2AD03CE65C5DACF98EACCAE861A30F137E0118A87225
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......E.6...X...X...X......X......X......X...Y...X......X......X......X.Rich..X.........PE..L...;b.\...........!.....`...................0...............................@.......................................2..\....0...............................2.......................................*..H...........................................UPX0....................................UPX1.....`.......\..................@...UPX2.........0.......`..............@......................................................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI64762\pyexpat.pyd

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	52736
Entropy (8bit):	7.904524114628073
Encrypted:	false
SSDEEP:	1536:omazZr7ECJ0E6kFg85F/rFi2LU60XZlofDYq0nouy8:9aFr9mE6kF7hrcCU6Qlewout
MD5:	AD560121EFD8E249FC3414200D98F75F
SHA1:	73040F9BC04E733A85DA00E364EF85583F505636
SHA-256:	0BEB3B16F9A11F93137365A1179D2062A414ADABA337BCAC05A083A921775B50
SHA-512:	6DA2B01773DCE658DCFD9219DD8D093F60EAFF669ED600C9A62EFC39FB3E362F051A499FAC85777C1B8F364B1AD2E134E080CAE720FC5477711A7ED7F191A5C7
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........2.\...\...\......\......\......\......\...]..\......\......\......\.Rich..\.................PE..L...4>CX...........!................Pj....................................................@............................L...................................$.......................................(v..H...........................................UPX0....................................UPX1................................@...UPX2................................@......................................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI64762\python27.dll

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	898048
Entropy (8bit):	7.990256946915668
Encrypted:	true
SSDEEP:	24576:I0cNEHSDC9XmwbTV/mv+nQW0mj7IaqtsoejWg3c:jHhmhmI9eo63
MD5:	8C44826A640B3CF0B32B0258C65FEE07
SHA1:	E3F9FE6366D0876BFA8B903B20D2ACF06416F1BC
SHA-256:	FBAD053D962BAC96865AC3372958D697711800FDC46F36C87011BB5E89026614
SHA-512:	884E2C01C088B9AE86D4605FED1CF8E9B17F99CF887EFC5644F4A91959ECD89148CCA3E9FDAA6AB9E8C4DFD2D61DBDFD442A95B13DAB7E5CD027B4782D473355
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......#..^g.y.g.y.g.y....~.y.n...l.y.n...i.y.n...e.y.n...l.y.g.x.[.y.n.....y.n...f.y.n...f.y.n...f.y.Richg.y.................PE..L... >CX...........!.....0.......0...Z..@...p...............................+...........@.........................pz.t\|..,y.D....p.,...........................................................f.H...........................................UPX0.....0..............................UPX1.....0...@...(..................@....rsrc........p......,..............@......................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI64762\pywintypes27.dll

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	53248
Entropy (8bit):	7.425128830518154
Encrypted:	false
SSDEEP:	1536:eTwUerP24SfDRd2TACkwqyfnouy81cSPDuwQ0:eTleODRd2ew/Pout1cSru
MD5:	07B436BFA1C7B4FFC21FB39358158060
SHA1:	7F5A47CDAB9A7D93BBBD204CEDFFCA61D3F80C84
SHA-256:	82C2926CB03A04392FA479801D505E2A387446BCA978FF930177121DB2FDB461
SHA-512:	13EBCB83F478C859CA808003933769B84290E108648B69F33043653263C5B4BD37ED5CA8D521B46A1D9122EB232F7E5D05A25E16F250D5573CF85CD5CDEFB2EF
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......qz.Y5...5...5....Tz.7...+Iy.6...+Io.8.....".4...+I..1.....'.>...5.......+Ih.$...+I~.4...+I}.4...Rich5...................PE..L...:..[...........!.........P............... ....z..........................p.......................................%..PJ..h#....... ..h...................Po..........................................H...........................................UPX0....................................UPX1.............\|..................@....rsrc....P... ...P..................@......................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI64762\select.pyd

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	9216
Entropy (8bit):	7.003407892450472
Encrypted:	false
SSDEEP:	192:qhogHS4TaqZXRQKKXYVEvySc3IFaNJhLkwcud2DH9VwGfctX:qhLS4TaqxhfCHc38aNJawcudoD7U
MD5:	57EB00056AC8C38CD4F3153FB9507F13
SHA1:	DDEE8E74FCC81B6301145F27C0F1CCF4B9185E1C
SHA-256:	7B90EC138AC8415D9B747612063D19147FEC2B1E99DE97C3B5636E8CA40B346E
SHA-512:	05F7EF6BD065D7DB3F41DFA95187FA40A14F58FA5D4705F2DF5982DB18EEB6D4E93C473D05932436BF645E76E0B23532867011E92EF953EC247B55648ED9C6EF
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........i)...z...z...z...z...z...z...z...z...z...z...z...z...z...z...z...z...z...z...zRich...z........PE..L...5>CX...........!..... .......P..pq...`................................................@.............................H...................................H.......................................P}..H...........................................UPX0.....P..............................UPX1..... ...`......................@...UPX2................."..............@..............................................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI64762\servicemanager.pyd

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	7.2228399102917615
Encrypted:	false
SSDEEP:	384:FVtYwprbL7fLBtdYzKNg13ZOPaNJawcudoD7UfMX:vawBbLFYzKNg1plnbcuyD7UfMX
MD5:	6A95BCF45E4BE23CC2634EF5BAD17660
SHA1:	7D13B791588CB800C2ADD75FF8E74C3C493A8143
SHA-256:	60DA4B4E628B7DC1115615128AC554AEB29B50A61629AD5AEEB5CC9D2BD86202
SHA-512:	D3C80B025647444F42D42E82CAD50C4383728F7F8C9E16AA9D87450CA864B0B97B5F8F47E80328A4A2B67CE7D06C9A8F1DAE8C5B3C798DE1B2A50164161E69C8
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........o....K...K...K...K...K...K...K...K...KR..K...K...K...K...K...K...K...K...K...K...K...KRich...K........................PE..L......[...........!.....@........................}.....................................................................\...........................................................................h...H...........................................UPX0....................................UPX1.....@.......4..................@....rsrc................8..............@......................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI64762\unicodedata.pyd

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	181760
Entropy (8bit):	7.989160583257678
Encrypted:	false
SSDEEP:	3072:Rfe2dO8KvTdjKGssSXwgtXZT32qenyxHBKs//4wd3RP29sZ6lI883out:Rfe2bKvEw+k2kw/4wZRPS3coS
MD5:	9A465CFAA788E29E7B1366C012EBC75C
SHA1:	10D9C49BB6652D9B04E17608D9ED35B036112647
SHA-256:	35C84D824DB175DD71046806A59BC711021ABCE04698FA304B1E2A9855E50A9C
SHA-512:	31BEE259C78CEB1E4F5C52E7B2CBD0EB62A071FC9C748DF47AB824E383EFDC3B218168700341B96D139DABFB3E4D7644341F22E52982B7C7F135A9E35B300B00
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......{H..?).?).?).6QE.=).6QS.1).6QT.=).6QC.8).?)..).6QY.>).6QB.>).6QA.>).Rich?).................PE..L...6>CX...........!......................................................................@.............................T...................................,.......................................x...H...........................................UPX0....................................UPX1................................@...UPX2................................@......................................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI64762\win32api.pyd

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	34816
Entropy (8bit):	7.794879575971907
Encrypted:	false
SSDEEP:	768:etKTLIw2eRBsqBvKddE/wW68vEvfW2qmSOyinbcuyD7Uqmx:DCeLrGderDH2FXyinouy8qmx
MD5:	42C475231F4835BB1A5F94B0D3DA4520
SHA1:	FCFAE296DD10C92D973A57D61BBF5C0F4A15ED6B
SHA-256:	87CEEB1B7586DB730F48988A07018F9C8AF57934FF7F173A869542207F46B0F1
SHA-512:	D1A699B8497E8843F990F6F719A904A7751FE2A9404CB195BE2D94341728A7372CD93D379B576E6031980E1DA53F2336805C6BF59E799B63565CD63D4931C02A
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......[-..L...L...L.......L.......L.......L...J..L...L..UM.......L.......L.......L..Rich.L..................PE..L......[...........!.............p.. ...............................................................................P.......X...........X...............................................................H....................B..@...................UPX0.....p..............................UPX1.............~..................@....rsrc...............................@......................................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI64762\win32event.pyd

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	11264
Entropy (8bit):	6.799438399701252
Encrypted:	false
SSDEEP:	192:jNxmpzSvHU53Uon53eXqY1K/CjrELQc432Xq0FaNJhLkwcud2DH9VwGfctLj/t:Xmp2/UR95aP1pgEc432XBaNJawcudoDU
MD5:	796306BE7A1ABCFFB8853EE9CEB5BEAE
SHA1:	93762CF53958A3A99B674986FCF3C53C489133ED
SHA-256:	26E6D883E9E61BF872425526A9B8C7BB229C3B9D2F82BB3C0BF500660DBE1995
SHA-512:	5919A837FA1FCAEA91B14D02DA306928D5E523E4591DCA290422C9EB9BE15F2EE626A8379F5C953F2B08E7A6B2CD67618652B9EFA9ACE8ABD47A8BD7CD8C2F64
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........k..{8..{8..{8..8..{8..8..{8..8..{8 ..8..{8..z8..{8..8..{8..8..{8..8..{8Rich..{8................PE..L...T..[...........!.....0..............................................................................................P...`...\.......`...........................................................h...H...........................................UPX0....................................UPX1.....0......."..................@....rsrc................&..............@......................................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI64762\win32evtlog.pyd

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	19968
Entropy (8bit):	7.436093769968754
Encrypted:	false
SSDEEP:	384:Wo5FgP/m1xaGAONAt4ZvFqQggg3LgsAWUh31lA2W1waNJawcudoD7UGwGS:WmuP+TOONp5UQ/Zs8FlAfnbcuyD7UGwX
MD5:	317360BE68901D11F3D02AF1C151A4DC
SHA1:	570BF03BE1A737CF3D0CF3FC8E77261CF64E2051
SHA-256:	AC9C5C4BAA4DE19BDDF55313F29182F26EB80312C31266413672C61424A5C6E0
SHA-512:	25C25C23DD4FE1957CDFAD833D4570553C2627775008F3939525B6A3D1892F8B6CB7A9F20D454166338DF4DFC8A98306A1160016AE4CB2E9464944945AFA0A82
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........E..i+..i+..i+.E&...i+..;...i+..;...i+..;...i+.%...i+..i*.hi+..;...i+..;...i+..;...i+..;...i+.Rich.i+.................PE..L......[...........!.....P...................0...............................@.......................................4..T....3..P....0......................L5.......................................!..H.......................@...................UPX0....................................UPX1.....P.......D..................@....rsrc........0.......H..............@......................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI64762\win32service.pyd

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	18432
Entropy (8bit):	7.513143648749714
Encrypted:	false
SSDEEP:	384:DvSTTJQxdZ3goCVdvSbw66apC1aNJawcudoD7U46:LSTT+1KF1onbcuyD7U46
MD5:	F23A62491BD945C050E3E1D13909E9E7
SHA1:	B8DAC4E00163533157A17E3B56D05E049A2375A2
SHA-256:	E52B5532A6764AAAE67DB557412B3F77EBDC8A14A72771A1C6414A83BB3FC15C
SHA-512:	52200CF9687752DB43BBAE703192C841694D5BD976FA56C0F25E0478CFB97681BC77677C1A8907167612DDF9FE6A561945FBEB0180022670AF97BF41B5B11766
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........[..[..[.....Z..E.-.Z..E.;.V..E.+.]...!s.\..[.....E.<.^..E.*.Z..E.,.Z..E.).Z..Rich[..........PE..L...q..[...........!.....@..........................................................................................8...T...............................................................................H...........................................UPX0....................................UPX1.....@.......>..................@....rsrc................B..............@..............................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI64762\xmrig.exe

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	1905664
Entropy (8bit):	7.9235088812144
Encrypted:	false
SSDEEP:	49152:jeXVwyagUSymDH29F4+rthFTo6YZfnH8:0VKgUSymDH29ttzToX1nc
MD5:	13BDD9CD9F7E51746172996262B5A873
SHA1:	3834F8179ABD7A827E927505F3C226AC8BBCF3EE
SHA-256:	4BF737B29FF521BC263EB1F2C1C5EA04B47470CCCD1BEAE245D98DEF389929BD
SHA-512:	49879918505D042312F20B2FC8310A8C4A58AA266ED1AB05E0481F7E11385DA0920CF9D756F842EB98E4394F14725385B74A99B38FC8A60222FA4CC873CB8040
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: C:\Users\user\AppData\Local\Temp\_MEI64762\xmrig.exe, Author: Joe Security
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....\.....................`...0>...Z..@>...[...@..........................`[............... ...................... X.x....][.<.....[..]....................................................Z.....................................................UPX0.....0>.............................UPX1.........@>.....................@....rsrc....`....[..`..................@...3.94.UPX!....E.G...@.`.Z.....$Z.$/.w.......&...'....1.f.=.@9....MZ..,......($..#...th.....82..tJ......$.,./,......+.l..Ho..~B.......:..6....L.=Dc..tm....-<h....f..<2...u..?PEl..u..Q....-l..~?....j..x.......]...........K".v.g?w...k+...yt`,........o..7>,. ..D$...............7......b..0.{..,.~...[U......WV.U.S..\|.0~....+..).b.........@....................5.o.E.....d....x....l0.9..9...3....o._..........=...u...;.v.f...R..0..`.lm...--...I...X/(......9J9..~?.v...&+.. P.kSn.l......LJ...

C:\Users\user\AppData\Local\Temp\_MEI71562\Crypto.Cipher._AES.pyd

Download File

Process:	C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	7.553130526678379
Encrypted:	false
SSDEEP:	384:50Q1C9jViLl7hDB6n/PtHU2wr8gj93KqmilaNJawcudoD7U:dC8LU/PBU8itClnbcuyD7U
MD5:	371397E80A55D432DA47311B8EF25317
SHA1:	71617777D6A2500D6464D7B394C8BE5F1E4E119E
SHA-256:	C1A900615C9500C46B9602C30C53F299290B03632208EF1152AF8830AB73AD17
SHA-512:	3139E2848ACF02CC8475449F213873D2C2B7196F6A55C70D2D8F8B487020387740364E5CA0AA584624D1B9B01B965146A2F0E15EEF34830C7C0ECBB8637DAE03
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........+\8.J2k.J2k.J2k.Ik.J2k...k.J2k...k.J2k...k.J2k.2.k.J2k.J3k.J2k...k.J2k...k.J2k...k.J2kRich.J2k........PE..L....4.S...........!.....@..........`...................................................................................D...........................................................................8...H...........................................UPX0....................................UPX1.....@.......:..................@...UPX2.................>..............@......................................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI71562\Include\pyconfig.h

Download File

Process:	C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe
File Type:	C source, ASCII text
Category:	dropped
Size (bytes):	21321
Entropy (8bit):	5.345136937906198
Encrypted:	false
SSDEEP:	384:pGpFpaU1kgCw8r+MIP8Bj5DvVySh3awQBoerw8W+PYV0FGYfN/+:pGpFpb+IU99UShATrw8W+AKF/+
MD5:	BC185DE8B2437963368A85FDD9852951
SHA1:	1459F1428214FCCA7F203FB3A3AFF28E16EB9C1B
SHA-256:	8B130D901E0F83B55699D565F103F2F8F1B3A51712EBB4B9646EA517CC1F04D6
SHA-512:	918469D9A59FE059F3C7C93F34C8D2D07CB8A9BF5E953A1527922ED5C65FF4A2DF50BBC78ED9CE146BF3A1FB6F1763F061262FA4A937BEEEE1FEB8A99E31339E
Malicious:	false
Preview:	#ifndef Py_CONFIG_H.#define Py_CONFIG_H../* pyconfig.h. NOT Generated automatically by configure...This is a manually maintained version used for the Watcom,.Borland and Microsoft Visual C++ compilers. It is a.standard part of the Python distribution...WINDOWS DEFINES:.The code specific to Windows should be wrapped around one of.the following #defines..MS_WIN64 - Code specific to the MS Win64 API.MS_WIN32 - Code specific to the MS Win32 (and Win64) API (obsolete, this covers all supported APIs).MS_WINDOWS - Code specific to Windows, but all versions..MS_WINCE - Code specific to Windows CE.Py_ENABLE_SHARED - Code if the Python core is built as a DLL...Also note that neither "_M_IX86" or "_MSC_VER" should be used for.any purpose other than "Windows Intel x86 specific" and "Microsoft.compiler specific". Therefore, these should be very rare....NOTE: The following symbols are deprecated:.NT, USE_DL_EXPORT, USE_DL_IMPORT, DL_EXPORT, DL_IMPORT.MS_CORE_DLL...WIN32 is still required for the

C:\Users\user\AppData\Local\Temp\_MEI71562\Microsoft.VC90.CRT.manifest

Download File

Process:	C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1050
Entropy (8bit):	5.382436822526041
Encrypted:	false
SSDEEP:	24:2dtn3mGv+zg4NnEN4XKHVJrMmV6LSWV5rcb3S:ch35+zg4i0KHVVdOmS
MD5:	BFB93876892CCA8E2AD0021585C34C8B
SHA1:	0DDE1B225C98825A09D8FF85F462571C9C862E35
SHA-256:	0D060ED7C25159B7B75F16D449963BFD639C15B3C5280BC7897403268C2B9F35
SHA-512:	FE70540B3B3FA88B32DFB2FF7406A3A9819E7862B850D871B932996BBEFFDBC70D7192D6E3196A8583B2DB756CA9CC278505AFBE585BA30EB1222D4F8BE15B7B
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<assembly manifestVersion="1.0" xmlns="urn:schemas-microsoft-com:asm.v1">.. <noInheritable/>.. <assemblyIdentity name="Microsoft.VC90.CRT" processorArchitecture="x86" publicKeyToken="1fc8b3b9a1e18e3b" type="win32" version="9.0.30729.6161"/>.. <file hash="7021457b391b35606e708c69987e4b6f606609ee" hashalg="SHA1" name="msvcr90.dll"/>.. <file hash="88549dd3ce8eaa62ca8aad0e96ddd9fec2203628" hashalg="SHA1" name="msvcp90.dll"/>.. <file hash="65ef374affa5b48827e539b35b3275c201b41fc9" hashalg="SHA1" name="msvcm90.dll"/>.. <compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1">.. <application>.. <supportedOS Id="{1f676c76-80e1-4239-95bb-83d0f6d0da78}"/>.. <supportedOS Id="{4a2f28e3-53b9-4441-ba9c-d69d4a4a6e38}"/>.. <supportedOS Id="{e2011457-1546-43c5-a5fe-008deee3d3f0}"/>.. <supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}"/>.. <supportedOS Id="{8e0f7a12-bfb3-4fe8-b9a5-48fd50a15a9a}"/>..

C:\Users\user\AppData\Local\Temp\_MEI71562\_ctypes.pyd

Download File

Process:	C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	37888
Entropy (8bit):	7.848484052157707
Encrypted:	false
SSDEEP:	768:pAXLisB/qV2nQnf33sWcCRWKZac3VWw6cLA3zReukhRnbcuyD7U:pAnBi8nQf3sYToclt6cLUCRnouy8
MD5:	6CB8B560EFBC381651D2045F1571D7C8
SHA1:	15283A7A467ADB7B6D7A7182F660DD783F90E483
SHA-256:	6456FEA123E04BCEC8A8EED26160E1DF5482E69D187D3E1A0C428995472AC134
SHA-512:	CA2958095E8E08B5EF05EC9DE15B7D1EB180923A40B90356DB56A124101C96D8E745001948B89DBE9D6B9CE3C2029F7E9EAF20C73FA1D410A821D6605830BFC0
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...................F.....W.....P......@..........Z.....A.....B...Rich..................PE..L...*>CX...........!............. .. ....0................................................@.........................<...........<.......................................................................H...........................................UPX0..... ..............................UPX1.........0......................@...UPX2................................@......................................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI71562\_hashlib.pyd

Download File

Process:	C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	351744
Entropy (8bit):	7.996557276168139
Encrypted:	true
SSDEEP:	6144:Xh0byJKrtKOFhjnTtMoy8gpVI/xxWo/nX0NKOzyGFmJ559Vq2SeTsRgIIGYMowwZ:2bymtjF1TtMod/xweDK7FmJ5rLVYTIGm
MD5:	EE134421FBABEB565E4F3CA721331C2E
SHA1:	4B03BDD142C6A7BB6F74ABE968C5B76B63E06059
SHA-256:	7863E1BEDFE1FFC720B67B2EB7B3491DB9D2B8E56B5574E6A40FF90336B8DAFA
SHA-512:	D27FF65B6A8BF2E5E70D2865E72EEE6930E76C2A3990428C54FC998743D3C540C5C984B5D1429E8FFBE3D160AE1F6782CD6D3CA40822F81D2052BA168595D1FA
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......z.$.>.J.>.J.>.J.7...4.J.7...1.J.7...<.J.7...3.J.>.K..J.>.J...J.7...Y.J.7...?.J.7...?.J.Rich>.J.........................PE..L....>CX...........!.....`..........@K.......`...............................p............@.........................pa..L....`..p............................a.......................................W..H...........................................UPX0....................................UPX1.....`.......X..................@...UPX2.........`.......\..............@......................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI71562\_socket.pyd

Download File

Process:	C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	22016
Entropy (8bit):	7.706254752795193
Encrypted:	false
SSDEEP:	384:CCNDRisVUlkycq27U4r0rOc606B8k4gG35aiQjgO6OPjGL2e1ua7aNJawcudoD7P:v7VUcq27Jr0rOmbwE4jGLhohnbcuyD7B
MD5:	BE47363992C7DD90019276D35FA8DA76
SHA1:	CCF7EBBE829DA08EFD95A53D4BA0C0D4938F6169
SHA-256:	BE10254B111713BEF20A13D561DE61CA3C74A34C64DDC5B10825C64AB2C46734
SHA-512:	573F9111535A9A136FCAAA5C1A16C347F7327626768D849513D69C9848406B1002DCC5B8C17A291EF2E6519587533CA806018EE471A39D330F032A9E7E635EA7
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......AV2..7\..7\..7\..O..7\..O..7\..O..7\..7]..7\..O..7\..O..7\..O..7\..O..7\.Rich.7\.........................PE..L...X>CX...........!.....P..........0.....................................................@.............................d...................................d...........................................H...........................................UPX0....................................UPX1.....P.......P..................@...UPX2.................T..............@..............................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI71562\_ssl.pyd

Download File

Process:	C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	498688
Entropy (8bit):	7.996471896707535
Encrypted:	true
SSDEEP:	12288:FHNz5hZdNGitmdIA8byo3k4Ff9m3fTByPf6So+2RON1jjoS:P3fNTtmd2bkof43fTkR2gH
MD5:	68C3AD86E0A8833C29AD1BE10D3C025D
SHA1:	04488362814B2F3AE07C4E8DF8E45868D48B447F
SHA-256:	C236271B92A0F1D3304337F2E2444107F34D8E26272981F48C47DB347133566C
SHA-512:	BB2819D913033CC26DCD1E5CBF015DACDBF747D29C72BFD41BFE0D74BB77E51A61CF9BE4B67B6348938837125F1D0F80AF0AC33531E00CEA1585535952A22785
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........HFu.)(&.)(&.)(&.Q.&.)(&.Q.&.)(&.Q.&.)(&.)(&.)(&.))&9)(&.Q.&.)(&.Q.&.((&.Q.&.)(&.Q.&.)(&Rich.)(&................PE..L...q>CX...........!.................e....................................................@............................D............................................................................q..H...........................................UPX0....................................UPX1................................@...UPX2................................@..............................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI71562\_win32sysloader.pyd

Download File

Process:	C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	4.992693298555373
Encrypted:	false
SSDEEP:	192:t2VnGV7o5QUEZWm6Uk3fvf3X7THIL3YO+8I:tVU5QUEz6hfLTH98
MD5:	B4A567D80CCC08FB1C7FBB765847AFDA
SHA1:	B7FF2C68BA2887AAF5D029F41922E626C72B716D
SHA-256:	DBB0F9C499A710BBC8BCDE4ECC3577A6C9548262D6CE4434ED5A0708CBC787DD
SHA-512:	DDFEC25304BABE2DF55958F512F61AFD9AF88DDA499FE87931D17A9EEBF048449885A06A24BDDBC8604E11F07CED3C2ECE7F89C28290CAB5D1BF3816D22128DB
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......M.oC.............J.............................../........................Rich............PE..L......[...........!......................... ....;..........................`......................................P&..Z...\"..P....@..l....................P....... ..............................8!..@............ ...............................text...`........................... ..`.rdata....... ......................@..@.data........0......................@....rsrc...l....@......................@..@.reloc.......P......................@..B........................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI71562\back.jpg

Download File

Process:	C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	47107
Entropy (8bit):	6.2032294727594985
Encrypted:	false
SSDEEP:	768:z9v1zJKaohy0Za9jwmrALVaka3sgBXHDizIdI9e2E:5v1zJ3nuswbLVgZsceO
MD5:	4AE078DD5085E97D3605F20DC079412A
SHA1:	1BABFCF2D374AE590970A3BE2E0E27BC04922546
SHA-256:	ED551536FF22587CDF7701A279E088EB370A4121E7A3FA1F3C8B121E767318A2
SHA-512:	BF163C63120CC5035087E4FF0035D9DAEB100218C62969AA6AA75D539108323295EB9CC28ABB0906C21CE8AEA25DACD1D0AAB3F3FE9C765D35348F0A7DA000AE
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......]....S......"...8.P....... ..`u...0.................................................... .....................................................................................................................................................UPX0..... ..............................UPX1.....P...0...H..................@...UPX2.................J..............@...3.93.UPX!.....3r#l..JW..CE...0..&.......U..S...........t?........'.........9.r.....t...'.....s.t&...$....,1....$6.....X[]._V`..u....tG..oo.t$lE_D$.....=......."....1......uG...c..4....uF1..e.[^]..o...f.L.!.+.y..........................8</....fp.v..U..$........../...........O/...e..]...........#3f.E.f.E......m.._..;.}e.......f.t"............U.1.3-...}..~2.k......!..........7{..+...7..\|...............G.:..S........w. ........ ..%+{.n..$...e.>.m....u..,(.....k_.'lk.C2$C&'(.5.`cv/..

C:\Users\user\AppData\Local\Temp\_MEI71562\bz2.pyd

Download File

Process:	C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	35840
Entropy (8bit):	7.816957595202127
Encrypted:	false
SSDEEP:	768:IHCeOgq+kCitCVj5rz2Ya+r9qLYp9R9JoWnbcuyD7UiT:IHXr8CBd9NpfXxnouy8
MD5:	C9C00BC854A39E66B27787D188F9E8D7
SHA1:	21F20CF6C628B529DB4BDB853B679F9BF23590E3
SHA-256:	29520DF660A5BBD704B9106A6650A66E4F5766B904D05F97146668D41DBF5839
SHA-512:	8887B5CA542220CAC04D5A6A22A06F95DB560F4FE0F9A128CEB642ED9716ABCFFBA2146CCE682EB16C4DA3F423649A61904A73C4357D9FDBD5DDF606790199A3
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......}.S.9.=K9.=K9.=K..K:.=K0..K:.=K0..K7.=K0..K;.=K0..K>.=K9.<KS.=K0..K1.=K0..K8.=K0..K8.=KRich9.=K................PE..L...?>CX...........!.................W.......p............................................@..........................p..D....p...............................q.......................................c..H...........................................UPX0....................................UPX1................................@...UPX2.........p......................@..............................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI71562\certifi\cacert.pem

Download File

Process:	C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	284518
Entropy (8bit):	6.05114864026174
Encrypted:	false
SSDEEP:	6144:GriCfLXd1YU58fVuKlnm5plZ0PXCRrcMBbADwYC+MslE:GrdT3YZuz5LwCRrcMije
MD5:	DD2DD543395692705F7DDA0F5E7750FA
SHA1:	40D7CE60393978A29FB0E0B1E849658E48CF7887
SHA-256:	397B833E5ACF89A2709B964401A9ACA68D24B62349B72BBE38684E586AA07A27
SHA-512:	3BA0D6AD8B6838B04FBFDEBAD20EB5544C093BA592B517AA383708A34CE2BD215DB2BF010090251674DBCFD4EDA3C44F770C9FBF314304DE918D7E59E2596CF2
Malicious:	false
Preview:	.# Issuer: CN=GlobalSign Root CA O=GlobalSign nv-sa OU=Root CA.# Subject: CN=GlobalSign Root CA O=GlobalSign nv-sa OU=Root CA.# Label: "GlobalSign Root CA".# Serial: 4835703278459707669005204.# MD5 Fingerprint: 3e:45:52:15:09:51:92:e1:b7:5d:37:9f:b1:87:29:8a.# SHA1 Fingerprint: b1:bc:96:8b:d4:f4:9d:62:2a:a8:9a:81:f2:15:01:52:a4:1d:82:9c.# SHA256 Fingerprint: eb:d4:10:40:e4:bb:3e:c7:42:c9:e3:81:d3:1e:f2:a4:1a:48:b6:68:5c:96:e7:ce:f3:c1:df:6c:d4:33:1c:99.-----BEGIN CERTIFICATE-----.MIIDdTCCAl2gAwIBAgILBAAAAAABFUtaw5QwDQYJKoZIhvcNAQEFBQAwVzELMAkG.A1UEBhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24gbnYtc2ExEDAOBgNVBAsTB1Jv.b3QgQ0ExGzAZBgNVBAMTEkdsb2JhbFNpZ24gUm9vdCBDQTAeFw05ODA5MDExMjAw.MDBaFw0yODAxMjgxMjAwMDBaMFcxCzAJBgNVBAYTAkJFMRkwFwYDVQQKExBHbG9i.YWxTaWduIG52LXNhMRAwDgYDVQQLEwdSb290IENBMRswGQYDVQQDExJHbG9iYWxT.aWduIFJvb3QgQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDaDuaZ.jc6j40+Kfvvxi4Mla+pIH/EqsLmVEQS98GPR4mdmzxzdzxtIK+6NiY6arymAZavp.xy0Sy6scTHAHoT0KMM0VjU/43dSMUBUc71DuxC73/OlS8pF94G3VNTCOXkNz

C:\Users\user\AppData\Local\Temp\_MEI71562\config.json

Download File

Process:	C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1206
Entropy (8bit):	4.275024024623091
Encrypted:	false
SSDEEP:	24:pCKENTHgbeZlE1jCAh1RHEdOgNanAOSWSula:UKuTHgbYlUZHEdrNAla
MD5:	50CC63E4A1B24622CF61ED566B03E98F
SHA1:	92E5874785BB76E4579559BA70E116A6149349F5
SHA-256:	348F388C57DFB77B0CAACD8304725E10DC69A52EEC41AE695327787AD1853C92
SHA-512:	9A291DB9CF396687F3878590B1EB65CD7DA2E6FC3D6DE64A3B8CB08116B646371F432100E16B0ECD4F2916D05D67830F949AC2A3CA559A3A8D56616DF2BE98C7
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: C:\Users\user\AppData\Local\Temp\_MEI71562\config.json, Author: Joe Security
Preview:	{. "algo": "cryptonight",. "api": {. "port": 0,. "access-token": null,. "id": null,. "worker-id": null,. "ipv6": false,. "restricted": true. },. "autosave": true,. "av": 0,. "background": true,. "colors": true,. "cpu-affinity": null,. "cpu-priority": null,. "donate-level": 1,. "huge-pages": true,. "hw-aes": null,. "log-file": null,. "max-cpu-usage": 70,. "pools": [. {. "url": "xmr.crypto-pool.fr:3333",. "user": "47BD6QNfkWf8ZMQSdqp2tY1AdG8ofsEPf4mcDp1YB4AX32hUjoLjuDaNrYzXk7cQcoPBzAuQrmQTgNgpo6XPqSBLCnfsjaV",. "pass": "x",. "rig-id": null,. "nicehash": false,. "keepalive": false,. "variant": -1,. "enabled": true,. "tls": false,. "tls-fingerprint": null. }. ],. "print-time": 60,. "retries": 5,. "retry-pause": 5,. "safe": false,. "threads": [. {.

C:\Users\user\AppData\Local\Temp\_MEI71562\ftpcrack.exe.manifest

Download File

Process:	C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1345
Entropy (8bit):	5.283640732769631
Encrypted:	false
SSDEEP:	24:2dtn3ZoWglN2v+zg4NnEN4XKDmc0+bLg4fNRme5rcb3S:ch3DgX2+zg4i0KDmJ+bLg4VRmemS
MD5:	B5DEA49B86C5BB5D9CD8D64A09F70065
SHA1:	487EF676EBD244EBC3CF197F70DA7A5E393FB96E
SHA-256:	78B1160F6ADAB34D144AD19A0F4B83F83453F1E18460BBDFBE17AD354B62AF7D
SHA-512:	1B5914F4C52F47A33C57F5F6428482E6766099BF43D4E8616CE4AABC4A917C24B2E0C98C841F0D7E7B8A202F40FF960885535539BF70CC7C7ED8687C7ECE010C
Malicious:	true
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<assembly manifestVersion="1.0" xmlns="urn:schemas-microsoft-com:asm.v1">.. <assemblyIdentity name="ftpcrack" processorArchitecture="x86" type="win32" version="1.0.0.0"/>.. <dependency>.. <dependentAssembly>.. <assemblyIdentity name="Microsoft.VC90.CRT" processorArchitecture="x86" publicKeyToken="1fc8b3b9a1e18e3b" type="win32" version="9.0.30729.6161"/>.. <compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1"/>.. </dependentAssembly>.. </dependency>.. <dependency>.. <dependentAssembly>.. <assemblyIdentity language="*" name="Microsoft.Windows.Common-Controls" processorArchitecture="x86" publicKeyToken="6595b64144ccf1df" type="win32" version="6.0.0.0"/>.. <compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1"/>.. </dependentAssembly>.. </dependency>.. <compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1">.. <application>.. <supportedOS Id="{1f676c76-80e

C:\Users\user\AppData\Local\Temp\_MEI71562\httplib2\cacerts.txt

Download File

Process:	C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	135546
Entropy (8bit):	6.039525643754334
Encrypted:	false
SSDEEP:	3072:FVrovvEjVplrqHSdX+zpfQq7ZiyZOF5mdFENAKHn1HtYfei8i31MCSjfpVpKbIcf:3cmHuBfaUFENX3YfEl3plcs+
MD5:	14BA876BA2515A25BBB511F24BF06653
SHA1:	291DCDEE67E880B21FD7001CB8350C3ECEE4CAC8
SHA-256:	2039836A620F956EC094EAAE7C9B41A04C76F31130898B11014D9E83C905F0DE
SHA-512:	5035F82DF06308A14F6626C54382B3AB34B6D664C8394B48F75275F69DCC2B93266D843B51F0B586E5F12FCD70FE3660B5B08AFC20738DF6D8C812592C0D71E4
Malicious:	false
Preview:	# Issuer: CN=GTE CyberTrust Global Root O=GTE Corporation OU=GTE CyberTrust Solutions, Inc..# Subject: CN=GTE CyberTrust Global Root O=GTE Corporation OU=GTE CyberTrust Solutions, Inc..# Label: "GTE CyberTrust Global Root".# Serial: 421.# MD5 Fingerprint: ca:3d:d3:68:f1:03:5c:d0:32:fa:b8:2b:59:e8:5a:db.# SHA1 Fingerprint: 97:81:79:50:d8:1c:96:70:cc:34:d8:09:cf:79:44:31:36:7e:f4:74.# SHA256 Fingerprint: a5:31:25:18:8d:21:10:aa:96:4b:02:c7:b7:c6:da:32:03:17:08:94:e5:fb:71:ff:fb:66:67:d5:e6:81:0a:36.-----BEGIN CERTIFICATE-----.MIICWjCCAcMCAgGlMA0GCSqGSIb3DQEBBAUAMHUxCzAJBgNVBAYTAlVTMRgwFgYD.VQQKEw9HVEUgQ29ycG9yYXRpb24xJzAlBgNVBAsTHkdURSBDeWJlclRydXN0IFNv.bHV0aW9ucywgSW5jLjEjMCEGA1UEAxMaR1RFIEN5YmVyVHJ1c3QgR2xvYmFsIFJv.b3QwHhcNOTgwODEzMDAyOTAwWhcNMTgwODEzMjM1OTAwWjB1MQswCQYDVQQGEwJV.UzEYMBYGA1UEChMPR1RFIENvcnBvcmF0aW9uMScwJQYDVQQLEx5HVEUgQ3liZXJU.cnVzdCBTb2x1dGlvbnMsIEluYy4xIzAhBgNVBAMTGkdURSBDeWJlclRydXN0IEds.b2JhbCBSb290MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCVD6C28FCc6HrH.iM3dFw4usJTQGz0

C:\Users\user\AppData\Local\Temp\_MEI71562\msvcm90.dll

Download File

Process:	C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	225280
Entropy (8bit):	6.034911041879855
Encrypted:	false
SSDEEP:	3072:6yZeocziNzMLSMOYscmLWbAX+dP4Upoh86Goao14JU87/amFYw8fF01OyASLE:PYOMqc8oAXGP4Upoe6fa3/amiX2Oyp
MD5:	D34A527493F39AF4491B3E909DC697CA
SHA1:	AFEE32FCD9CE160680371357A072F58C5F790D48
SHA-256:	7A74DA389FBD10A710C294C2E914DC6F18E05F028F07958A2FA53AC44F0E4B90
SHA-512:	0DABC5455EB02601D7C40A9C49B3ADE750B1118934EF3785FB314FA313437BC02B243571ABA25F1661A69DCEA36838530C12762A2E6602D14A9B03770A82CCA6
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........;...h...h...h..ah...h1.dh...h..gh...h...h...h.-.h...h...h...h..qh...h..vh...h..`h...h..fh...h..ch...hRich...h........................PE..L.....M...........!.....:..........Z........P....?x.........................0......^.....@......................... 3..4....&..d...............................d...P...............................H...@...............(...........p...H............text...T9.......:.................. ..`.data........P.......>..............@....rsrc................H..............@..@.reloc...#.......$...L..............@..B........................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI71562\msvcp90.dll

Download File

Process:	C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	335184
Entropy (8bit):	6.343962999919931
Encrypted:	false
SSDEEP:	6144:fmIIPLSg4p0t4271NWoSYEMS6VhUgiW6QR7t5183Ooc8SHkC2eQ:fmIeLSgo0S271QoSQhUgiW6QR7t51831
MD5:	92EA2DB0E788894C43753C550216A886
SHA1:	DA8C7A178BA0CA80D321666F5642A7436B640602
SHA-256:	9694756F43B20ABC50F95646C54E9E36CD6EDF8EED3DB846064567399F4E7566
SHA-512:	90E72A68C7267E8D0986A75247AE7B2339E4C2A981D686342B2EF90B1FCF9695B558D0BD5932F7C53524E02CC664B974BA76783FDE919B24EB36795DB3300BA6
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........#%..Mv..Mv..Mv.66v..Mv...v..Mv..Lv:.Mv...v..Mv...v..Mv...v..Mv...v..Mv...v..Mv...v..Mv...v..MvRich..Mv........................PE..L.....M...........!................P.... ...0....Hx.........................0............@.........................p4..,....3.......0.......................&......................................()..H...........................................UPX0....................................UPX1......... ......................@....rsrc........0......................@..............................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI71562\msvcr90.dll

Download File

Process:	C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	250192
Entropy (8bit):	7.900323441964523
Encrypted:	false
SSDEEP:	6144:EODM4c99eLswEOva4g4fpgMf4FfIoSNjbZdGJCJLuEyKIqqOmiqsEqmQI0wye/c:EODM1HagYaMf4FAoSNjHmHyyc
MD5:	199D34B03C7D0EB804A6D9869184B8D4
SHA1:	03148854519D0970C1BBDC089D3E8DE1AED61C47
SHA-256:	DF86421E354F817607F2BAFC9188569242FCF9DD564B28F3E2915C86A0BA1F54
SHA-512:	E4269CA993393422A90231DAABD390771A635EEB0817A9D00DCCEF496372BB4B57B615529F26A2E8132BDE825CDACA07D965D207421C02EA6471DA214354361E
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..................6.........!.R...7.....&.....0.....6.....3...Rich..........PE..L.....M...........!.....@.......0..0f...@........Rx......................................@.........................@....\|.....x....................................................................r..H...........................................UPX0.....0..............................UPX1.....@...@...4..................@....rsrc................8..............@..............................................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI71562\netifaces.pyd

Download File

Process:	C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	11264
Entropy (8bit):	7.145184945732974
Encrypted:	false
SSDEEP:	192:uKqSCMOF44HPPtLm+9a3ozToPmzYUaFaNJhLkwcud2DH9VwGfctH:ubS9s44vPtLR9aUPJ+aNJawcudoD7U
MD5:	C7807680A69196C3EE66C4CFB3E271AC
SHA1:	D3EA74C9E3B810C6A1EE4296B97E20F2F45C9461
SHA-256:	1A6C57AC8031582477B1D3463A65B6EB006EEA704E27C8C4B812B99EA910428D
SHA-512:	A5D893132AD889E98B434DA7FD5CA377AFB1800FD8D3230CCED5E9FDE576FCEC943DD22FA48810BA6D93C510EBAA8AC5A94EC1B9D639FD6C533C5BBD4737CF15
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......FL...-...-...-...U...-...U...-...-..J-...U...-...U...-...U...-...U...-..Rich.-..........................PE..L...,.-\...........!.....0.......P...x...`..........................................................................4...P.......4...................................................................p...H...........................................UPX0.....P..............................UPX1.....0...`...&..................@...UPX2.................*..............@......................................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI71562\perfmon.pyd

Download File

Process:	C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	11264
Entropy (8bit):	6.948652527580434
Encrypted:	false
SSDEEP:	192:0xeSnTQM3MsUjU+viJBctKiyiLKPfFaNJhLkwcud2DH9VwGfct0XlpoI6J:0xe4R3scJBcMWYdaNJawcudoD7UmlSI
MD5:	EE813500A441B5FFDACD853E95BEE669
SHA1:	7F05F1493380AF3FE08F55524F6FF90C47C0CC4D
SHA-256:	AC491704AF920BE0E503F0243D2D371E230622E213E9F082347B52C0A7B009C2
SHA-512:	060D079A93ADD067EB062D2B1CB9977719BE68AE1223B0219DBB14CC9C6C66FF47D9929945636B577BC7F1BB84D5500B88ACD5F7BF636CC63BD4C88534AF724E
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........0...c...c...c..9c...c.gc...c.qc...c.ac...c...c...c.vc...c.`c...c.cc...cRich...c................PE..L...C..[...........!.....0.......`.......p........n.................................................................t...L...P...$.......P...............................................................H...........................................UPX0.....`..............................UPX1.....0...p..."..................@....rsrc................&..............@......................................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI71562\psutil._psutil_windows.pyd

Download File

Process:	C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	25600
Entropy (8bit):	7.700665778298437
Encrypted:	false
SSDEEP:	384:3qUURhEUVDrn5EMvG04YMJIoa67+5pGr0qLWMAUm7NFYGz45/+aNJawcudoD7ULt:aUjUXBjPAGHqLm7N/z4dnbcuyD7UL
MD5:	2FC800FCC46A597921C2ED447AEB09AC
SHA1:	72004227E5C60C8460F835A170798AA22861B79E
SHA-256:	2E4AD3D08118DA77C928C4614BFECB34397CFAF53F5D46D7C7E5F1DA3172C1F1
SHA-512:	A17022B364615B45A1873AEA0DE922A2988E4D75A8F4E63ECB9CA7DD46263E684B1F28B82BD77B046BBE2AD03CE65C5DACF98EACCAE861A30F137E0118A87225
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......E.6...X...X...X......X......X......X...Y...X......X......X......X.Rich..X.........PE..L...;b.\...........!.....`...................0...............................@.......................................2..\....0...............................2.......................................*..H...........................................UPX0....................................UPX1.....`.......\..................@...UPX2.........0.......`..............@......................................................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI71562\pyexpat.pyd

Download File

Process:	C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	52736
Entropy (8bit):	7.904524114628073
Encrypted:	false
SSDEEP:	1536:omazZr7ECJ0E6kFg85F/rFi2LU60XZlofDYq0nouy8:9aFr9mE6kF7hrcCU6Qlewout
MD5:	AD560121EFD8E249FC3414200D98F75F
SHA1:	73040F9BC04E733A85DA00E364EF85583F505636
SHA-256:	0BEB3B16F9A11F93137365A1179D2062A414ADABA337BCAC05A083A921775B50
SHA-512:	6DA2B01773DCE658DCFD9219DD8D093F60EAFF669ED600C9A62EFC39FB3E362F051A499FAC85777C1B8F364B1AD2E134E080CAE720FC5477711A7ED7F191A5C7
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........2.\...\...\......\......\......\......\...]..\......\......\......\.Rich..\.................PE..L...4>CX...........!................Pj....................................................@............................L...................................$.......................................(v..H...........................................UPX0....................................UPX1................................@...UPX2................................@......................................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI71562\python27.dll

Download File

Process:	C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	898048
Entropy (8bit):	7.990256946915668
Encrypted:	true
SSDEEP:	24576:I0cNEHSDC9XmwbTV/mv+nQW0mj7IaqtsoejWg3c:jHhmhmI9eo63
MD5:	8C44826A640B3CF0B32B0258C65FEE07
SHA1:	E3F9FE6366D0876BFA8B903B20D2ACF06416F1BC
SHA-256:	FBAD053D962BAC96865AC3372958D697711800FDC46F36C87011BB5E89026614
SHA-512:	884E2C01C088B9AE86D4605FED1CF8E9B17F99CF887EFC5644F4A91959ECD89148CCA3E9FDAA6AB9E8C4DFD2D61DBDFD442A95B13DAB7E5CD027B4782D473355
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......#..^g.y.g.y.g.y....~.y.n...l.y.n...i.y.n...e.y.n...l.y.g.x.[.y.n.....y.n...f.y.n...f.y.n...f.y.Richg.y.................PE..L... >CX...........!.....0.......0...Z..@...p...............................+...........@.........................pz.t\|..,y.D....p.,...........................................................f.H...........................................UPX0.....0..............................UPX1.....0...@...(..................@....rsrc........p......,..............@......................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI71562\pywintypes27.dll

Download File

Process:	C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	53248
Entropy (8bit):	7.425128830518154
Encrypted:	false
SSDEEP:	1536:eTwUerP24SfDRd2TACkwqyfnouy81cSPDuwQ0:eTleODRd2ew/Pout1cSru
MD5:	07B436BFA1C7B4FFC21FB39358158060
SHA1:	7F5A47CDAB9A7D93BBBD204CEDFFCA61D3F80C84
SHA-256:	82C2926CB03A04392FA479801D505E2A387446BCA978FF930177121DB2FDB461
SHA-512:	13EBCB83F478C859CA808003933769B84290E108648B69F33043653263C5B4BD37ED5CA8D521B46A1D9122EB232F7E5D05A25E16F250D5573CF85CD5CDEFB2EF
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......qz.Y5...5...5....Tz.7...+Iy.6...+Io.8.....".4...+I..1.....'.>...5.......+Ih.$...+I~.4...+I}.4...Rich5...................PE..L...:..[...........!.........P............... ....z..........................p.......................................%..PJ..h#....... ..h...................Po..........................................H...........................................UPX0....................................UPX1.............\|..................@....rsrc....P... ...P..................@......................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI71562\select.pyd

Download File

Process:	C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	9216
Entropy (8bit):	7.003407892450472
Encrypted:	false
SSDEEP:	192:qhogHS4TaqZXRQKKXYVEvySc3IFaNJhLkwcud2DH9VwGfctX:qhLS4TaqxhfCHc38aNJawcudoD7U
MD5:	57EB00056AC8C38CD4F3153FB9507F13
SHA1:	DDEE8E74FCC81B6301145F27C0F1CCF4B9185E1C
SHA-256:	7B90EC138AC8415D9B747612063D19147FEC2B1E99DE97C3B5636E8CA40B346E
SHA-512:	05F7EF6BD065D7DB3F41DFA95187FA40A14F58FA5D4705F2DF5982DB18EEB6D4E93C473D05932436BF645E76E0B23532867011E92EF953EC247B55648ED9C6EF
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........i)...z...z...z...z...z...z...z...z...z...z...z...z...z...z...z...z...z...z...zRich...z........PE..L...5>CX...........!..... .......P..pq...`................................................@.............................H...................................H.......................................P}..H...........................................UPX0.....P..............................UPX1..... ...`......................@...UPX2................."..............@..............................................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI71562\servicemanager.pyd

Download File

Process:	C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	7.2228399102917615
Encrypted:	false
SSDEEP:	384:FVtYwprbL7fLBtdYzKNg13ZOPaNJawcudoD7UfMX:vawBbLFYzKNg1plnbcuyD7UfMX
MD5:	6A95BCF45E4BE23CC2634EF5BAD17660
SHA1:	7D13B791588CB800C2ADD75FF8E74C3C493A8143
SHA-256:	60DA4B4E628B7DC1115615128AC554AEB29B50A61629AD5AEEB5CC9D2BD86202
SHA-512:	D3C80B025647444F42D42E82CAD50C4383728F7F8C9E16AA9D87450CA864B0B97B5F8F47E80328A4A2B67CE7D06C9A8F1DAE8C5B3C798DE1B2A50164161E69C8
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........o....K...K...K...K...K...K...K...K...KR..K...K...K...K...K...K...K...K...K...K...K...KRich...K........................PE..L......[...........!.....@........................}.....................................................................\...........................................................................h...H...........................................UPX0....................................UPX1.....@.......4..................@....rsrc................8..............@......................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI71562\unicodedata.pyd

Download File

Process:	C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	181760
Entropy (8bit):	7.989160583257678
Encrypted:	false
SSDEEP:	3072:Rfe2dO8KvTdjKGssSXwgtXZT32qenyxHBKs//4wd3RP29sZ6lI883out:Rfe2bKvEw+k2kw/4wZRPS3coS
MD5:	9A465CFAA788E29E7B1366C012EBC75C
SHA1:	10D9C49BB6652D9B04E17608D9ED35B036112647
SHA-256:	35C84D824DB175DD71046806A59BC711021ABCE04698FA304B1E2A9855E50A9C
SHA-512:	31BEE259C78CEB1E4F5C52E7B2CBD0EB62A071FC9C748DF47AB824E383EFDC3B218168700341B96D139DABFB3E4D7644341F22E52982B7C7F135A9E35B300B00
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......{H..?).?).?).6QE.=).6QS.1).6QT.=).6QC.8).?)..).6QY.>).6QB.>).6QA.>).Rich?).................PE..L...6>CX...........!......................................................................@.............................T...................................,.......................................x...H...........................................UPX0....................................UPX1................................@...UPX2................................@......................................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI71562\win32api.pyd

Download File

Process:	C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	34816
Entropy (8bit):	7.794879575971907
Encrypted:	false
SSDEEP:	768:etKTLIw2eRBsqBvKddE/wW68vEvfW2qmSOyinbcuyD7Uqmx:DCeLrGderDH2FXyinouy8qmx
MD5:	42C475231F4835BB1A5F94B0D3DA4520
SHA1:	FCFAE296DD10C92D973A57D61BBF5C0F4A15ED6B
SHA-256:	87CEEB1B7586DB730F48988A07018F9C8AF57934FF7F173A869542207F46B0F1
SHA-512:	D1A699B8497E8843F990F6F719A904A7751FE2A9404CB195BE2D94341728A7372CD93D379B576E6031980E1DA53F2336805C6BF59E799B63565CD63D4931C02A
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......[-..L...L...L.......L.......L.......L...J..L...L..UM.......L.......L.......L..Rich.L..................PE..L......[...........!.............p.. ...............................................................................P.......X...........X...............................................................H....................B..@...................UPX0.....p..............................UPX1.............~..................@....rsrc...............................@......................................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI71562\win32event.pyd

Download File

Process:	C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	11264
Entropy (8bit):	6.799438399701252
Encrypted:	false
SSDEEP:	192:jNxmpzSvHU53Uon53eXqY1K/CjrELQc432Xq0FaNJhLkwcud2DH9VwGfctLj/t:Xmp2/UR95aP1pgEc432XBaNJawcudoDU
MD5:	796306BE7A1ABCFFB8853EE9CEB5BEAE
SHA1:	93762CF53958A3A99B674986FCF3C53C489133ED
SHA-256:	26E6D883E9E61BF872425526A9B8C7BB229C3B9D2F82BB3C0BF500660DBE1995
SHA-512:	5919A837FA1FCAEA91B14D02DA306928D5E523E4591DCA290422C9EB9BE15F2EE626A8379F5C953F2B08E7A6B2CD67618652B9EFA9ACE8ABD47A8BD7CD8C2F64
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........k..{8..{8..{8..8..{8..8..{8..8..{8 ..8..{8..z8..{8..8..{8..8..{8..8..{8Rich..{8................PE..L...T..[...........!.....0..............................................................................................P...`...\.......`...........................................................h...H...........................................UPX0....................................UPX1.....0......."..................@....rsrc................&..............@......................................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI71562\win32evtlog.pyd

Download File

Process:	C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	19968
Entropy (8bit):	7.436093769968754
Encrypted:	false
SSDEEP:	384:Wo5FgP/m1xaGAONAt4ZvFqQggg3LgsAWUh31lA2W1waNJawcudoD7UGwGS:WmuP+TOONp5UQ/Zs8FlAfnbcuyD7UGwX
MD5:	317360BE68901D11F3D02AF1C151A4DC
SHA1:	570BF03BE1A737CF3D0CF3FC8E77261CF64E2051
SHA-256:	AC9C5C4BAA4DE19BDDF55313F29182F26EB80312C31266413672C61424A5C6E0
SHA-512:	25C25C23DD4FE1957CDFAD833D4570553C2627775008F3939525B6A3D1892F8B6CB7A9F20D454166338DF4DFC8A98306A1160016AE4CB2E9464944945AFA0A82
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........E..i+..i+..i+.E&...i+..;...i+..;...i+..;...i+.%...i+..i*.hi+..;...i+..;...i+..;...i+..;...i+.Rich.i+.................PE..L......[...........!.....P...................0...............................@.......................................4..T....3..P....0......................L5.......................................!..H.......................@...................UPX0....................................UPX1.....P.......D..................@....rsrc........0.......H..............@......................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI71562\win32service.pyd

Download File

Process:	C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	18432
Entropy (8bit):	7.513143648749714
Encrypted:	false
SSDEEP:	384:DvSTTJQxdZ3goCVdvSbw66apC1aNJawcudoD7U46:LSTT+1KF1onbcuyD7U46
MD5:	F23A62491BD945C050E3E1D13909E9E7
SHA1:	B8DAC4E00163533157A17E3B56D05E049A2375A2
SHA-256:	E52B5532A6764AAAE67DB557412B3F77EBDC8A14A72771A1C6414A83BB3FC15C
SHA-512:	52200CF9687752DB43BBAE703192C841694D5BD976FA56C0F25E0478CFB97681BC77677C1A8907167612DDF9FE6A561945FBEB0180022670AF97BF41B5B11766
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........[..[..[.....Z..E.-.Z..E.;.V..E.+.]...!s.\..[.....E.<.^..E.*.Z..E.,.Z..E.).Z..Rich[..........PE..L...q..[...........!.....@..........................................................................................8...T...............................................................................H...........................................UPX0....................................UPX1.....@.......>..................@....rsrc................B..............@..............................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI71562\xmrig.exe

Download File

Process:	C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	1905664
Entropy (8bit):	7.9235088812144
Encrypted:	false
SSDEEP:	49152:jeXVwyagUSymDH29F4+rthFTo6YZfnH8:0VKgUSymDH29ttzToX1nc
MD5:	13BDD9CD9F7E51746172996262B5A873
SHA1:	3834F8179ABD7A827E927505F3C226AC8BBCF3EE
SHA-256:	4BF737B29FF521BC263EB1F2C1C5EA04B47470CCCD1BEAE245D98DEF389929BD
SHA-512:	49879918505D042312F20B2FC8310A8C4A58AA266ED1AB05E0481F7E11385DA0920CF9D756F842EB98E4394F14725385B74A99B38FC8A60222FA4CC873CB8040
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: C:\Users\user\AppData\Local\Temp\_MEI71562\xmrig.exe, Author: Joe Security
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....\.....................`...0>...Z..@>...[...@..........................`[............... ...................... X.x....][.<.....[..]....................................................Z.....................................................UPX0.....0>.............................UPX1.........@>.....................@....rsrc....`....[..`..................@...3.94.UPX!....E.G...@.`.Z.....$Z.$/.w.......&...'....1.f.=.@9....MZ..,......($..#...th.....82..tJ......$.,./,......+.l..Ho..~B.......:..6....L.=Dc..tm....-<h....f..<2...u..?PEl..u..Q....-l..~?....j..x.......]...........K".v.g?w...k+...yt`,........o..7>,. ..D$...............7......b..0.{..,.~...[U......WV.U.S..\|.0~....+..).b.........@....................5.o.E.....d....x....l0.9..9...3....o._..........=...u...;.v.f...R..0..`.lm...--...I...X/(......9J9..~?.v...&+.. P.kSn.l......LJ...

C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe

Download File

Process:	C:\Program Files\7-Zip\7zG.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	6271268
Entropy (8bit):	7.992715224964703
Encrypted:	true
SSDEEP:	98304:RLVSThOfTCiFBXmfFs+JMHpCVoR8oMEOJ6Ty3RvX+jb5jC3ajz4F4VRc:HBfTCiUswVSLOJgyBGv5jGQW4VR
MD5:	A9D4007C9419A6E8D55805B8F8F52DE0
SHA1:	9F9D47EC6DD80BFCB4C3E0A1530B89D2D587C230
SHA-256:	5D9FE2735D4399D98E6E6A792B1FEB26D6F2D9A5D77944ECACB4B4837E5E5FCA
SHA-512:	DF727118E22BE2C36C14BCA3D084A7260F085BF528BFDC1DA8467BC5ADB654C34E20367ED733593810D9D54E9CA0137C015A4A34F09CB06D1145E60CBF16AECF
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........hZ............,Y......,Y..4...,Y..............................E:......................................Rich............................PE..L......[.........."..................y............@.......................................@.................................\...P......................................................................@............................................text...4........................... ..`.rdata..d...........................@..@.data...............................@....gfids..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................

C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.zip

Download File

Process:	C:\Program Files\7-Zip\7zG.exe
File Type:	Zip archive data, at least v5.1 to extract, compression method=AES Encrypted
Category:	dropped
Size (bytes):	6169802
Entropy (8bit):	7.999970383778711
Encrypted:	true
SSDEEP:	98304:nPSVZGDjSLYNkHoZBXc0Csy8OJN+wmZrTR+75Phy3J1SNFspH0sr0Pn2D6wqd0G3:nKVZGWi/3r5g/+wO87xs51SGon2XGh/p
MD5:	712479D0327772AB6F33210166864396
SHA1:	3F1EB29D0DF58E6894885DEB81C9E768852C5B81
SHA-256:	E6DE7ADA1B561986658C12FB727F83287C6835142754B30B149A53C410D52C59
SHA-512:	038D3A00BF42C1183CDE0EC6217F5E62BDA4D54D095994D7D73291660E7C59259BC0C250FBA3307837320968DF891A8773F02583867D2A202C5C4784F9FB3CBE
Malicious:	true
Preview:	PK..3...c....X..\..#^.$._.D...5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe......AE.....z...W\.D1.5.Z.q .].Ib.T......H.6...+.V.Gb..!=,.l...AI9d.......\|e........"Rs..%.'_..S......b.9.o}B.Ev......rQ..f.) h<.DD.Lj_.. TB.]A..;..%mv=......D.4...'....&2u..ii....?....rm..E.7..\.P..)..E.., O..b=.:>...E?$Id.#$.......u.....\..J%...Nm...}.....H...ou..nL.....e..Z.J+..w....L...'v....Z.....O.....a....w .....>.dl%6W...-..3.'){P.....j..XeL81..T.....o..6...E...........Q.{..z..z..@.tVo.uC:).t..1./..J...\...:.}....9.,OI...j.z...9<4..U".KM...KcBL..W6.Z1..p@%...$.C.H...~.O.x....o.t...3.{..... .v...h.5......C....%{m..DV.^d...I..,ox..L....'..pD.]...Y.SV...uNUw..."7.Q.`.!..w....@.....".oNk.4......7]..,.....T...u....h...7"...........\|.\A.s.Hw4;..r."q.....;...m..5L.,.#. ......w........t=1...Mzy.-......[M.....G..Y>.^..-r2Y..P..Et...K.B.....>..b3.54.....p............*..G...%4[W....s..T...P...Z3..i..Z'...U......h[.4ES...e..?..)..p..6..g...=V.......Z..

C:\Users\user\HelpPane.exe

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	6271268
Entropy (8bit):	7.992715224964703
Encrypted:	true
SSDEEP:	98304:RLVSThOfTCiFBXmfFs+JMHpCVoR8oMEOJ6Ty3RvX+jb5jC3ajz4F4VRc:HBfTCiUswVSLOJgyBGv5jGQW4VR
MD5:	A9D4007C9419A6E8D55805B8F8F52DE0
SHA1:	9F9D47EC6DD80BFCB4C3E0A1530B89D2D587C230
SHA-256:	5D9FE2735D4399D98E6E6A792B1FEB26D6F2D9A5D77944ECACB4B4837E5E5FCA
SHA-512:	DF727118E22BE2C36C14BCA3D084A7260F085BF528BFDC1DA8467BC5ADB654C34E20367ED733593810D9D54E9CA0137C015A4A34F09CB06D1145E60CBF16AECF
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........hZ............,Y......,Y..4...,Y..............................E:......................................Rich............................PE..L......[.........."..................y............@.......................................@.................................\...P......................................................................@............................................text...4........................... ..`.rdata..d...........................@..@.data...............................@....gfids..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\MpCmdRun.log

Download File

Process:	C:\Program Files\Windows Defender\MpCmdRun.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	modified
Size (bytes):	4926
Entropy (8bit):	3.2451370284861794
Encrypted:	false
SSDEEP:	48:FaqdF78F7B+AAHdKoqKFxcxkFiF7KaqdF7I++AAHdKoqKFxcxkFqI:cEOB+AAsoJjykePEP+AAsoJjykF
MD5:	D47AEE1819322B2AB3D9476483824706
SHA1:	C6E037C4B3236D392C2EA07A266BD070EEBA896E
SHA-256:	E3685BF8DE105007933F747B2C3C663A9E5B19F06A918A98AE942E3A61CD8458
SHA-512:	E062F9795C519D57DE0EE863E5A4ACF84FE25CF3A7651C2BDF133A4E3334A49028183F9B6C18E68347E65374818B395CD01DEDF32BC542D1388ABF19070E96E3
Malicious:	false
Preview:	..........-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.....M.p.C.m.d.R.u.n.:. .C.o.m.m.a.n.d. .L.i.n.e.:. .".C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r.\.m.p.c.m.d.r.u.n...e.x.e.". .-.w.d.e.n.a.b.l.e..... .S.t.a.r.t. .T.i.m.e.:. .. F.r.i. .. O.c.t. .. 0.6. .. 2.0.2.3. .1.1.:.3.5.:.2.9.........M.p.E.n.s.u.r.e.P.r.o.c.e.s.s.M.i.t.i.g.a.t.i.o.n.P.o.l.i.c.y.:. .h.r. .=. .0.x.1.....W.D.E.n.a.b.l.e........................................ .W.S.C. .S.t.a.t.e. .I.n.f.o. ................................................................. .A.n.t.i.V.i.r.u.s.P.r.o.d.u.c.t. ..............................d.i.s.p.l.a.y.N.a.m.e. .=. .[.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r.].....p.a.t.h.T.o.S.i.g.n.e.d.P.r.o.d.u.c.t.E.x.e. .=. .[.w.i.n.d.o.w.s.d.

C:\Windows\Temp\_MEI29202\Crypto.Cipher._AES.pyd

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	7.553130526678379
Encrypted:	false
SSDEEP:	384:50Q1C9jViLl7hDB6n/PtHU2wr8gj93KqmilaNJawcudoD7U:dC8LU/PBU8itClnbcuyD7U
MD5:	371397E80A55D432DA47311B8EF25317
SHA1:	71617777D6A2500D6464D7B394C8BE5F1E4E119E
SHA-256:	C1A900615C9500C46B9602C30C53F299290B03632208EF1152AF8830AB73AD17
SHA-512:	3139E2848ACF02CC8475449F213873D2C2B7196F6A55C70D2D8F8B487020387740364E5CA0AA584624D1B9B01B965146A2F0E15EEF34830C7C0ECBB8637DAE03
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........+\8.J2k.J2k.J2k.Ik.J2k...k.J2k...k.J2k...k.J2k.2.k.J2k.J3k.J2k...k.J2k...k.J2k...k.J2kRich.J2k........PE..L....4.S...........!.....@..........`...................................................................................D...........................................................................8...H...........................................UPX0....................................UPX1.....@.......:..................@...UPX2.................>..............@......................................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Windows\Temp\_MEI29202\Include\pyconfig.h

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	C source, ASCII text
Category:	dropped
Size (bytes):	21321
Entropy (8bit):	5.345136937906198
Encrypted:	false
SSDEEP:	384:pGpFpaU1kgCw8r+MIP8Bj5DvVySh3awQBoerw8W+PYV0FGYfN/+:pGpFpb+IU99UShATrw8W+AKF/+
MD5:	BC185DE8B2437963368A85FDD9852951
SHA1:	1459F1428214FCCA7F203FB3A3AFF28E16EB9C1B
SHA-256:	8B130D901E0F83B55699D565F103F2F8F1B3A51712EBB4B9646EA517CC1F04D6
SHA-512:	918469D9A59FE059F3C7C93F34C8D2D07CB8A9BF5E953A1527922ED5C65FF4A2DF50BBC78ED9CE146BF3A1FB6F1763F061262FA4A937BEEEE1FEB8A99E31339E
Malicious:	false
Preview:	#ifndef Py_CONFIG_H.#define Py_CONFIG_H../* pyconfig.h. NOT Generated automatically by configure...This is a manually maintained version used for the Watcom,.Borland and Microsoft Visual C++ compilers. It is a.standard part of the Python distribution...WINDOWS DEFINES:.The code specific to Windows should be wrapped around one of.the following #defines..MS_WIN64 - Code specific to the MS Win64 API.MS_WIN32 - Code specific to the MS Win32 (and Win64) API (obsolete, this covers all supported APIs).MS_WINDOWS - Code specific to Windows, but all versions..MS_WINCE - Code specific to Windows CE.Py_ENABLE_SHARED - Code if the Python core is built as a DLL...Also note that neither "_M_IX86" or "_MSC_VER" should be used for.any purpose other than "Windows Intel x86 specific" and "Microsoft.compiler specific". Therefore, these should be very rare....NOTE: The following symbols are deprecated:.NT, USE_DL_EXPORT, USE_DL_IMPORT, DL_EXPORT, DL_IMPORT.MS_CORE_DLL...WIN32 is still required for the

C:\Windows\Temp\_MEI29202\Microsoft.VC90.CRT.manifest

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1050
Entropy (8bit):	5.382436822526041
Encrypted:	false
SSDEEP:	24:2dtn3mGv+zg4NnEN4XKHVJrMmV6LSWV5rcb3S:ch35+zg4i0KHVVdOmS
MD5:	BFB93876892CCA8E2AD0021585C34C8B
SHA1:	0DDE1B225C98825A09D8FF85F462571C9C862E35
SHA-256:	0D060ED7C25159B7B75F16D449963BFD639C15B3C5280BC7897403268C2B9F35
SHA-512:	FE70540B3B3FA88B32DFB2FF7406A3A9819E7862B850D871B932996BBEFFDBC70D7192D6E3196A8583B2DB756CA9CC278505AFBE585BA30EB1222D4F8BE15B7B
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<assembly manifestVersion="1.0" xmlns="urn:schemas-microsoft-com:asm.v1">.. <noInheritable/>.. <assemblyIdentity name="Microsoft.VC90.CRT" processorArchitecture="x86" publicKeyToken="1fc8b3b9a1e18e3b" type="win32" version="9.0.30729.6161"/>.. <file hash="7021457b391b35606e708c69987e4b6f606609ee" hashalg="SHA1" name="msvcr90.dll"/>.. <file hash="88549dd3ce8eaa62ca8aad0e96ddd9fec2203628" hashalg="SHA1" name="msvcp90.dll"/>.. <file hash="65ef374affa5b48827e539b35b3275c201b41fc9" hashalg="SHA1" name="msvcm90.dll"/>.. <compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1">.. <application>.. <supportedOS Id="{1f676c76-80e1-4239-95bb-83d0f6d0da78}"/>.. <supportedOS Id="{4a2f28e3-53b9-4441-ba9c-d69d4a4a6e38}"/>.. <supportedOS Id="{e2011457-1546-43c5-a5fe-008deee3d3f0}"/>.. <supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}"/>.. <supportedOS Id="{8e0f7a12-bfb3-4fe8-b9a5-48fd50a15a9a}"/>..

C:\Windows\Temp\_MEI29202\_ctypes.pyd

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	37888
Entropy (8bit):	7.848484052157707
Encrypted:	false
SSDEEP:	768:pAXLisB/qV2nQnf33sWcCRWKZac3VWw6cLA3zReukhRnbcuyD7U:pAnBi8nQf3sYToclt6cLUCRnouy8
MD5:	6CB8B560EFBC381651D2045F1571D7C8
SHA1:	15283A7A467ADB7B6D7A7182F660DD783F90E483
SHA-256:	6456FEA123E04BCEC8A8EED26160E1DF5482E69D187D3E1A0C428995472AC134
SHA-512:	CA2958095E8E08B5EF05EC9DE15B7D1EB180923A40B90356DB56A124101C96D8E745001948B89DBE9D6B9CE3C2029F7E9EAF20C73FA1D410A821D6605830BFC0
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...................F.....W.....P......@..........Z.....A.....B...Rich..................PE..L...*>CX...........!............. .. ....0................................................@.........................<...........<.......................................................................H...........................................UPX0..... ..............................UPX1.........0......................@...UPX2................................@......................................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Windows\Temp\_MEI29202\_hashlib.pyd

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	351744
Entropy (8bit):	7.996557276168139
Encrypted:	true
SSDEEP:	6144:Xh0byJKrtKOFhjnTtMoy8gpVI/xxWo/nX0NKOzyGFmJ559Vq2SeTsRgIIGYMowwZ:2bymtjF1TtMod/xweDK7FmJ5rLVYTIGm
MD5:	EE134421FBABEB565E4F3CA721331C2E
SHA1:	4B03BDD142C6A7BB6F74ABE968C5B76B63E06059
SHA-256:	7863E1BEDFE1FFC720B67B2EB7B3491DB9D2B8E56B5574E6A40FF90336B8DAFA
SHA-512:	D27FF65B6A8BF2E5E70D2865E72EEE6930E76C2A3990428C54FC998743D3C540C5C984B5D1429E8FFBE3D160AE1F6782CD6D3CA40822F81D2052BA168595D1FA
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......z.$.>.J.>.J.>.J.7...4.J.7...1.J.7...<.J.7...3.J.>.K..J.>.J...J.7...Y.J.7...?.J.7...?.J.Rich>.J.........................PE..L....>CX...........!.....`..........@K.......`...............................p............@.........................pa..L....`..p............................a.......................................W..H...........................................UPX0....................................UPX1.....`.......X..................@...UPX2.........`.......\..............@......................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Windows\Temp\_MEI29202\_socket.pyd

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	22016
Entropy (8bit):	7.706254752795193
Encrypted:	false
SSDEEP:	384:CCNDRisVUlkycq27U4r0rOc606B8k4gG35aiQjgO6OPjGL2e1ua7aNJawcudoD7P:v7VUcq27Jr0rOmbwE4jGLhohnbcuyD7B
MD5:	BE47363992C7DD90019276D35FA8DA76
SHA1:	CCF7EBBE829DA08EFD95A53D4BA0C0D4938F6169
SHA-256:	BE10254B111713BEF20A13D561DE61CA3C74A34C64DDC5B10825C64AB2C46734
SHA-512:	573F9111535A9A136FCAAA5C1A16C347F7327626768D849513D69C9848406B1002DCC5B8C17A291EF2E6519587533CA806018EE471A39D330F032A9E7E635EA7
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......AV2..7\..7\..7\..O..7\..O..7\..O..7\..7]..7\..O..7\..O..7\..O..7\..O..7\.Rich.7\.........................PE..L...X>CX...........!.....P..........0.....................................................@.............................d...................................d...........................................H...........................................UPX0....................................UPX1.....P.......P..................@...UPX2.................T..............@..............................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Windows\Temp\_MEI29202\_ssl.pyd

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	498688
Entropy (8bit):	7.996471896707535
Encrypted:	true
SSDEEP:	12288:FHNz5hZdNGitmdIA8byo3k4Ff9m3fTByPf6So+2RON1jjoS:P3fNTtmd2bkof43fTkR2gH
MD5:	68C3AD86E0A8833C29AD1BE10D3C025D
SHA1:	04488362814B2F3AE07C4E8DF8E45868D48B447F
SHA-256:	C236271B92A0F1D3304337F2E2444107F34D8E26272981F48C47DB347133566C
SHA-512:	BB2819D913033CC26DCD1E5CBF015DACDBF747D29C72BFD41BFE0D74BB77E51A61CF9BE4B67B6348938837125F1D0F80AF0AC33531E00CEA1585535952A22785
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........HFu.)(&.)(&.)(&.Q.&.)(&.Q.&.)(&.Q.&.)(&.)(&.)(&.))&9)(&.Q.&.)(&.Q.&.((&.Q.&.)(&.Q.&.)(&Rich.)(&................PE..L...q>CX...........!.................e....................................................@............................D............................................................................q..H...........................................UPX0....................................UPX1................................@...UPX2................................@..............................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Windows\Temp\_MEI29202\_win32sysloader.pyd

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	4.992693298555373
Encrypted:	false
SSDEEP:	192:t2VnGV7o5QUEZWm6Uk3fvf3X7THIL3YO+8I:tVU5QUEz6hfLTH98
MD5:	B4A567D80CCC08FB1C7FBB765847AFDA
SHA1:	B7FF2C68BA2887AAF5D029F41922E626C72B716D
SHA-256:	DBB0F9C499A710BBC8BCDE4ECC3577A6C9548262D6CE4434ED5A0708CBC787DD
SHA-512:	DDFEC25304BABE2DF55958F512F61AFD9AF88DDA499FE87931D17A9EEBF048449885A06A24BDDBC8604E11F07CED3C2ECE7F89C28290CAB5D1BF3816D22128DB
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......M.oC.............J.............................../........................Rich............PE..L......[...........!......................... ....;..........................`......................................P&..Z...\"..P....@..l....................P....... ..............................8!..@............ ...............................text...`........................... ..`.rdata....... ......................@..@.data........0......................@....rsrc...l....@......................@..@.reloc.......P......................@..B........................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\_MEI29202\back.jpg

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	47107
Entropy (8bit):	6.2032294727594985
Encrypted:	false
SSDEEP:	768:z9v1zJKaohy0Za9jwmrALVaka3sgBXHDizIdI9e2E:5v1zJ3nuswbLVgZsceO
MD5:	4AE078DD5085E97D3605F20DC079412A
SHA1:	1BABFCF2D374AE590970A3BE2E0E27BC04922546
SHA-256:	ED551536FF22587CDF7701A279E088EB370A4121E7A3FA1F3C8B121E767318A2
SHA-512:	BF163C63120CC5035087E4FF0035D9DAEB100218C62969AA6AA75D539108323295EB9CC28ABB0906C21CE8AEA25DACD1D0AAB3F3FE9C765D35348F0A7DA000AE
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......]....S......"...8.P....... ..`u...0.................................................... .....................................................................................................................................................UPX0..... ..............................UPX1.....P...0...H..................@...UPX2.................J..............@...3.93.UPX!.....3r#l..JW..CE...0..&.......U..S...........t?........'.........9.r.....t...'.....s.t&...$....,1....$6.....X[]._V`..u....tG..oo.t$lE_D$.....=......."....1......uG...c..4....uF1..e.[^]..o...f.L.!.+.y..........................8</....fp.v..U..$........../...........O/...e..]...........#3f.E.f.E......m.._..;.}e.......f.t"............U.1.3-...}..~2.k......!..........7{..+...7..\|...............G.:..S........w. ........ ..%+{.n..$...e.>.m....u..,(.....k_.'lk.C2$C&'(.5.`cv/..

C:\Windows\Temp\_MEI29202\bz2.pyd

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	35840
Entropy (8bit):	7.816957595202127
Encrypted:	false
SSDEEP:	768:IHCeOgq+kCitCVj5rz2Ya+r9qLYp9R9JoWnbcuyD7UiT:IHXr8CBd9NpfXxnouy8
MD5:	C9C00BC854A39E66B27787D188F9E8D7
SHA1:	21F20CF6C628B529DB4BDB853B679F9BF23590E3
SHA-256:	29520DF660A5BBD704B9106A6650A66E4F5766B904D05F97146668D41DBF5839
SHA-512:	8887B5CA542220CAC04D5A6A22A06F95DB560F4FE0F9A128CEB642ED9716ABCFFBA2146CCE682EB16C4DA3F423649A61904A73C4357D9FDBD5DDF606790199A3
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......}.S.9.=K9.=K9.=K..K:.=K0..K:.=K0..K7.=K0..K;.=K0..K>.=K9.<KS.=K0..K1.=K0..K8.=K0..K8.=KRich9.=K................PE..L...?>CX...........!.................W.......p............................................@..........................p..D....p...............................q.......................................c..H...........................................UPX0....................................UPX1................................@...UPX2.........p......................@..............................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Windows\Temp\_MEI29202\certifi\cacert.pem

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	284518
Entropy (8bit):	6.05114864026174
Encrypted:	false
SSDEEP:	6144:GriCfLXd1YU58fVuKlnm5plZ0PXCRrcMBbADwYC+MslE:GrdT3YZuz5LwCRrcMije
MD5:	DD2DD543395692705F7DDA0F5E7750FA
SHA1:	40D7CE60393978A29FB0E0B1E849658E48CF7887
SHA-256:	397B833E5ACF89A2709B964401A9ACA68D24B62349B72BBE38684E586AA07A27
SHA-512:	3BA0D6AD8B6838B04FBFDEBAD20EB5544C093BA592B517AA383708A34CE2BD215DB2BF010090251674DBCFD4EDA3C44F770C9FBF314304DE918D7E59E2596CF2
Malicious:	false
Preview:	.# Issuer: CN=GlobalSign Root CA O=GlobalSign nv-sa OU=Root CA.# Subject: CN=GlobalSign Root CA O=GlobalSign nv-sa OU=Root CA.# Label: "GlobalSign Root CA".# Serial: 4835703278459707669005204.# MD5 Fingerprint: 3e:45:52:15:09:51:92:e1:b7:5d:37:9f:b1:87:29:8a.# SHA1 Fingerprint: b1:bc:96:8b:d4:f4:9d:62:2a:a8:9a:81:f2:15:01:52:a4:1d:82:9c.# SHA256 Fingerprint: eb:d4:10:40:e4:bb:3e:c7:42:c9:e3:81:d3:1e:f2:a4:1a:48:b6:68:5c:96:e7:ce:f3:c1:df:6c:d4:33:1c:99.-----BEGIN CERTIFICATE-----.MIIDdTCCAl2gAwIBAgILBAAAAAABFUtaw5QwDQYJKoZIhvcNAQEFBQAwVzELMAkG.A1UEBhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24gbnYtc2ExEDAOBgNVBAsTB1Jv.b3QgQ0ExGzAZBgNVBAMTEkdsb2JhbFNpZ24gUm9vdCBDQTAeFw05ODA5MDExMjAw.MDBaFw0yODAxMjgxMjAwMDBaMFcxCzAJBgNVBAYTAkJFMRkwFwYDVQQKExBHbG9i.YWxTaWduIG52LXNhMRAwDgYDVQQLEwdSb290IENBMRswGQYDVQQDExJHbG9iYWxT.aWduIFJvb3QgQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDaDuaZ.jc6j40+Kfvvxi4Mla+pIH/EqsLmVEQS98GPR4mdmzxzdzxtIK+6NiY6arymAZavp.xy0Sy6scTHAHoT0KMM0VjU/43dSMUBUc71DuxC73/OlS8pF94G3VNTCOXkNz

C:\Windows\Temp\_MEI29202\config.json

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1206
Entropy (8bit):	4.275024024623091
Encrypted:	false
SSDEEP:	24:pCKENTHgbeZlE1jCAh1RHEdOgNanAOSWSula:UKuTHgbYlUZHEdrNAla
MD5:	50CC63E4A1B24622CF61ED566B03E98F
SHA1:	92E5874785BB76E4579559BA70E116A6149349F5
SHA-256:	348F388C57DFB77B0CAACD8304725E10DC69A52EEC41AE695327787AD1853C92
SHA-512:	9A291DB9CF396687F3878590B1EB65CD7DA2E6FC3D6DE64A3B8CB08116B646371F432100E16B0ECD4F2916D05D67830F949AC2A3CA559A3A8D56616DF2BE98C7
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: C:\Windows\Temp\_MEI29202\config.json, Author: Joe Security
Preview:	{. "algo": "cryptonight",. "api": {. "port": 0,. "access-token": null,. "id": null,. "worker-id": null,. "ipv6": false,. "restricted": true. },. "autosave": true,. "av": 0,. "background": true,. "colors": true,. "cpu-affinity": null,. "cpu-priority": null,. "donate-level": 1,. "huge-pages": true,. "hw-aes": null,. "log-file": null,. "max-cpu-usage": 70,. "pools": [. {. "url": "xmr.crypto-pool.fr:3333",. "user": "47BD6QNfkWf8ZMQSdqp2tY1AdG8ofsEPf4mcDp1YB4AX32hUjoLjuDaNrYzXk7cQcoPBzAuQrmQTgNgpo6XPqSBLCnfsjaV",. "pass": "x",. "rig-id": null,. "nicehash": false,. "keepalive": false,. "variant": -1,. "enabled": true,. "tls": false,. "tls-fingerprint": null. }. ],. "print-time": 60,. "retries": 5,. "retry-pause": 5,. "safe": false,. "threads": [. {.

C:\Windows\Temp\_MEI29202\ftpcrack.exe.manifest

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1345
Entropy (8bit):	5.283640732769631
Encrypted:	false
SSDEEP:	24:2dtn3ZoWglN2v+zg4NnEN4XKDmc0+bLg4fNRme5rcb3S:ch3DgX2+zg4i0KDmJ+bLg4VRmemS
MD5:	B5DEA49B86C5BB5D9CD8D64A09F70065
SHA1:	487EF676EBD244EBC3CF197F70DA7A5E393FB96E
SHA-256:	78B1160F6ADAB34D144AD19A0F4B83F83453F1E18460BBDFBE17AD354B62AF7D
SHA-512:	1B5914F4C52F47A33C57F5F6428482E6766099BF43D4E8616CE4AABC4A917C24B2E0C98C841F0D7E7B8A202F40FF960885535539BF70CC7C7ED8687C7ECE010C
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<assembly manifestVersion="1.0" xmlns="urn:schemas-microsoft-com:asm.v1">.. <assemblyIdentity name="ftpcrack" processorArchitecture="x86" type="win32" version="1.0.0.0"/>.. <dependency>.. <dependentAssembly>.. <assemblyIdentity name="Microsoft.VC90.CRT" processorArchitecture="x86" publicKeyToken="1fc8b3b9a1e18e3b" type="win32" version="9.0.30729.6161"/>.. <compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1"/>.. </dependentAssembly>.. </dependency>.. <dependency>.. <dependentAssembly>.. <assemblyIdentity language="*" name="Microsoft.Windows.Common-Controls" processorArchitecture="x86" publicKeyToken="6595b64144ccf1df" type="win32" version="6.0.0.0"/>.. <compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1"/>.. </dependentAssembly>.. </dependency>.. <compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1">.. <application>.. <supportedOS Id="{1f676c76-80e

C:\Windows\Temp\_MEI29202\httplib2\cacerts.txt

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	135546
Entropy (8bit):	6.039525643754334
Encrypted:	false
SSDEEP:	3072:FVrovvEjVplrqHSdX+zpfQq7ZiyZOF5mdFENAKHn1HtYfei8i31MCSjfpVpKbIcf:3cmHuBfaUFENX3YfEl3plcs+
MD5:	14BA876BA2515A25BBB511F24BF06653
SHA1:	291DCDEE67E880B21FD7001CB8350C3ECEE4CAC8
SHA-256:	2039836A620F956EC094EAAE7C9B41A04C76F31130898B11014D9E83C905F0DE
SHA-512:	5035F82DF06308A14F6626C54382B3AB34B6D664C8394B48F75275F69DCC2B93266D843B51F0B586E5F12FCD70FE3660B5B08AFC20738DF6D8C812592C0D71E4
Malicious:	false
Preview:	# Issuer: CN=GTE CyberTrust Global Root O=GTE Corporation OU=GTE CyberTrust Solutions, Inc..# Subject: CN=GTE CyberTrust Global Root O=GTE Corporation OU=GTE CyberTrust Solutions, Inc..# Label: "GTE CyberTrust Global Root".# Serial: 421.# MD5 Fingerprint: ca:3d:d3:68:f1:03:5c:d0:32:fa:b8:2b:59:e8:5a:db.# SHA1 Fingerprint: 97:81:79:50:d8:1c:96:70:cc:34:d8:09:cf:79:44:31:36:7e:f4:74.# SHA256 Fingerprint: a5:31:25:18:8d:21:10:aa:96:4b:02:c7:b7:c6:da:32:03:17:08:94:e5:fb:71:ff:fb:66:67:d5:e6:81:0a:36.-----BEGIN CERTIFICATE-----.MIICWjCCAcMCAgGlMA0GCSqGSIb3DQEBBAUAMHUxCzAJBgNVBAYTAlVTMRgwFgYD.VQQKEw9HVEUgQ29ycG9yYXRpb24xJzAlBgNVBAsTHkdURSBDeWJlclRydXN0IFNv.bHV0aW9ucywgSW5jLjEjMCEGA1UEAxMaR1RFIEN5YmVyVHJ1c3QgR2xvYmFsIFJv.b3QwHhcNOTgwODEzMDAyOTAwWhcNMTgwODEzMjM1OTAwWjB1MQswCQYDVQQGEwJV.UzEYMBYGA1UEChMPR1RFIENvcnBvcmF0aW9uMScwJQYDVQQLEx5HVEUgQ3liZXJU.cnVzdCBTb2x1dGlvbnMsIEluYy4xIzAhBgNVBAMTGkdURSBDeWJlclRydXN0IEds.b2JhbCBSb290MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCVD6C28FCc6HrH.iM3dFw4usJTQGz0

C:\Windows\Temp\_MEI29202\msvcm90.dll

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	225280
Entropy (8bit):	6.034911041879855
Encrypted:	false
SSDEEP:	3072:6yZeocziNzMLSMOYscmLWbAX+dP4Upoh86Goao14JU87/amFYw8fF01OyASLE:PYOMqc8oAXGP4Upoe6fa3/amiX2Oyp
MD5:	D34A527493F39AF4491B3E909DC697CA
SHA1:	AFEE32FCD9CE160680371357A072F58C5F790D48
SHA-256:	7A74DA389FBD10A710C294C2E914DC6F18E05F028F07958A2FA53AC44F0E4B90
SHA-512:	0DABC5455EB02601D7C40A9C49B3ADE750B1118934EF3785FB314FA313437BC02B243571ABA25F1661A69DCEA36838530C12762A2E6602D14A9B03770A82CCA6
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........;...h...h...h..ah...h1.dh...h..gh...h...h...h.-.h...h...h...h..qh...h..vh...h..`h...h..fh...h..ch...hRich...h........................PE..L.....M...........!.....:..........Z........P....?x.........................0......^.....@......................... 3..4....&..d...............................d...P...............................H...@...............(...........p...H............text...T9.......:.................. ..`.data........P.......>..............@....rsrc................H..............@..@.reloc...#.......$...L..............@..B........................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\_MEI29202\msvcp90.dll

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	335184
Entropy (8bit):	6.343962999919931
Encrypted:	false
SSDEEP:	6144:fmIIPLSg4p0t4271NWoSYEMS6VhUgiW6QR7t5183Ooc8SHkC2eQ:fmIeLSgo0S271QoSQhUgiW6QR7t51831
MD5:	92EA2DB0E788894C43753C550216A886
SHA1:	DA8C7A178BA0CA80D321666F5642A7436B640602
SHA-256:	9694756F43B20ABC50F95646C54E9E36CD6EDF8EED3DB846064567399F4E7566
SHA-512:	90E72A68C7267E8D0986A75247AE7B2339E4C2A981D686342B2EF90B1FCF9695B558D0BD5932F7C53524E02CC664B974BA76783FDE919B24EB36795DB3300BA6
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........#%..Mv..Mv..Mv.66v..Mv...v..Mv..Lv:.Mv...v..Mv...v..Mv...v..Mv...v..Mv...v..Mv...v..Mv...v..MvRich..Mv........................PE..L.....M...........!................P.... ...0....Hx.........................0............@.........................p4..,....3.......0.......................&......................................()..H...........................................UPX0....................................UPX1......... ......................@....rsrc........0......................@..............................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Windows\Temp\_MEI29202\msvcr90.dll

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	250192
Entropy (8bit):	7.900323441964523
Encrypted:	false
SSDEEP:	6144:EODM4c99eLswEOva4g4fpgMf4FfIoSNjbZdGJCJLuEyKIqqOmiqsEqmQI0wye/c:EODM1HagYaMf4FAoSNjHmHyyc
MD5:	199D34B03C7D0EB804A6D9869184B8D4
SHA1:	03148854519D0970C1BBDC089D3E8DE1AED61C47
SHA-256:	DF86421E354F817607F2BAFC9188569242FCF9DD564B28F3E2915C86A0BA1F54
SHA-512:	E4269CA993393422A90231DAABD390771A635EEB0817A9D00DCCEF496372BB4B57B615529F26A2E8132BDE825CDACA07D965D207421C02EA6471DA214354361E
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..................6.........!.R...7.....&.....0.....6.....3...Rich..........PE..L.....M...........!.....@.......0..0f...@........Rx......................................@.........................@....\|.....x....................................................................r..H...........................................UPX0.....0..............................UPX1.....@...@...4..................@....rsrc................8..............@..............................................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Windows\Temp\_MEI29202\netifaces.pyd

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	11264
Entropy (8bit):	7.145184945732974
Encrypted:	false
SSDEEP:	192:uKqSCMOF44HPPtLm+9a3ozToPmzYUaFaNJhLkwcud2DH9VwGfctH:ubS9s44vPtLR9aUPJ+aNJawcudoD7U
MD5:	C7807680A69196C3EE66C4CFB3E271AC
SHA1:	D3EA74C9E3B810C6A1EE4296B97E20F2F45C9461
SHA-256:	1A6C57AC8031582477B1D3463A65B6EB006EEA704E27C8C4B812B99EA910428D
SHA-512:	A5D893132AD889E98B434DA7FD5CA377AFB1800FD8D3230CCED5E9FDE576FCEC943DD22FA48810BA6D93C510EBAA8AC5A94EC1B9D639FD6C533C5BBD4737CF15
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......FL...-...-...-...U...-...U...-...-..J-...U...-...U...-...U...-...U...-..Rich.-..........................PE..L...,.-\...........!.....0.......P...x...`..........................................................................4...P.......4...................................................................p...H...........................................UPX0.....P..............................UPX1.....0...`...&..................@...UPX2.................*..............@......................................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Windows\Temp\_MEI29202\perfmon.pyd

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	11264
Entropy (8bit):	6.948652527580434
Encrypted:	false
SSDEEP:	192:0xeSnTQM3MsUjU+viJBctKiyiLKPfFaNJhLkwcud2DH9VwGfct0XlpoI6J:0xe4R3scJBcMWYdaNJawcudoD7UmlSI
MD5:	EE813500A441B5FFDACD853E95BEE669
SHA1:	7F05F1493380AF3FE08F55524F6FF90C47C0CC4D
SHA-256:	AC491704AF920BE0E503F0243D2D371E230622E213E9F082347B52C0A7B009C2
SHA-512:	060D079A93ADD067EB062D2B1CB9977719BE68AE1223B0219DBB14CC9C6C66FF47D9929945636B577BC7F1BB84D5500B88ACD5F7BF636CC63BD4C88534AF724E
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........0...c...c...c..9c...c.gc...c.qc...c.ac...c...c...c.vc...c.`c...c.cc...cRich...c................PE..L...C..[...........!.....0.......`.......p........n.................................................................t...L...P...$.......P...............................................................H...........................................UPX0.....`..............................UPX1.....0...p..."..................@....rsrc................&..............@......................................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Windows\Temp\_MEI29202\psutil._psutil_windows.pyd

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	25600
Entropy (8bit):	7.700665778298437
Encrypted:	false
SSDEEP:	384:3qUURhEUVDrn5EMvG04YMJIoa67+5pGr0qLWMAUm7NFYGz45/+aNJawcudoD7ULt:aUjUXBjPAGHqLm7N/z4dnbcuyD7UL
MD5:	2FC800FCC46A597921C2ED447AEB09AC
SHA1:	72004227E5C60C8460F835A170798AA22861B79E
SHA-256:	2E4AD3D08118DA77C928C4614BFECB34397CFAF53F5D46D7C7E5F1DA3172C1F1
SHA-512:	A17022B364615B45A1873AEA0DE922A2988E4D75A8F4E63ECB9CA7DD46263E684B1F28B82BD77B046BBE2AD03CE65C5DACF98EACCAE861A30F137E0118A87225
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......E.6...X...X...X......X......X......X...Y...X......X......X......X.Rich..X.........PE..L...;b.\...........!.....`...................0...............................@.......................................2..\....0...............................2.......................................*..H...........................................UPX0....................................UPX1.....`.......\..................@...UPX2.........0.......`..............@......................................................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Windows\Temp\_MEI29202\pyexpat.pyd

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	52736
Entropy (8bit):	7.904524114628073
Encrypted:	false
SSDEEP:	1536:omazZr7ECJ0E6kFg85F/rFi2LU60XZlofDYq0nouy8:9aFr9mE6kF7hrcCU6Qlewout
MD5:	AD560121EFD8E249FC3414200D98F75F
SHA1:	73040F9BC04E733A85DA00E364EF85583F505636
SHA-256:	0BEB3B16F9A11F93137365A1179D2062A414ADABA337BCAC05A083A921775B50
SHA-512:	6DA2B01773DCE658DCFD9219DD8D093F60EAFF669ED600C9A62EFC39FB3E362F051A499FAC85777C1B8F364B1AD2E134E080CAE720FC5477711A7ED7F191A5C7
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........2.\...\...\......\......\......\......\...]..\......\......\......\.Rich..\.................PE..L...4>CX...........!................Pj....................................................@............................L...................................$.......................................(v..H...........................................UPX0....................................UPX1................................@...UPX2................................@......................................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Windows\Temp\_MEI29202\python27.dll

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	898048
Entropy (8bit):	7.990256946915668
Encrypted:	true
SSDEEP:	24576:I0cNEHSDC9XmwbTV/mv+nQW0mj7IaqtsoejWg3c:jHhmhmI9eo63
MD5:	8C44826A640B3CF0B32B0258C65FEE07
SHA1:	E3F9FE6366D0876BFA8B903B20D2ACF06416F1BC
SHA-256:	FBAD053D962BAC96865AC3372958D697711800FDC46F36C87011BB5E89026614
SHA-512:	884E2C01C088B9AE86D4605FED1CF8E9B17F99CF887EFC5644F4A91959ECD89148CCA3E9FDAA6AB9E8C4DFD2D61DBDFD442A95B13DAB7E5CD027B4782D473355
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......#..^g.y.g.y.g.y....~.y.n...l.y.n...i.y.n...e.y.n...l.y.g.x.[.y.n.....y.n...f.y.n...f.y.n...f.y.Richg.y.................PE..L... >CX...........!.....0.......0...Z..@...p...............................+...........@.........................pz.t\|..,y.D....p.,...........................................................f.H...........................................UPX0.....0..............................UPX1.....0...@...(..................@....rsrc........p......,..............@......................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Windows\Temp\_MEI29202\pywintypes27.dll

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	53248
Entropy (8bit):	7.425128830518154
Encrypted:	false
SSDEEP:	1536:eTwUerP24SfDRd2TACkwqyfnouy81cSPDuwQ0:eTleODRd2ew/Pout1cSru
MD5:	07B436BFA1C7B4FFC21FB39358158060
SHA1:	7F5A47CDAB9A7D93BBBD204CEDFFCA61D3F80C84
SHA-256:	82C2926CB03A04392FA479801D505E2A387446BCA978FF930177121DB2FDB461
SHA-512:	13EBCB83F478C859CA808003933769B84290E108648B69F33043653263C5B4BD37ED5CA8D521B46A1D9122EB232F7E5D05A25E16F250D5573CF85CD5CDEFB2EF
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......qz.Y5...5...5....Tz.7...+Iy.6...+Io.8.....".4...+I..1.....'.>...5.......+Ih.$...+I~.4...+I}.4...Rich5...................PE..L...:..[...........!.........P............... ....z..........................p.......................................%..PJ..h#....... ..h...................Po..........................................H...........................................UPX0....................................UPX1.............\|..................@....rsrc....P... ...P..................@......................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Windows\Temp\_MEI29202\select.pyd

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	9216
Entropy (8bit):	7.003407892450472
Encrypted:	false
SSDEEP:	192:qhogHS4TaqZXRQKKXYVEvySc3IFaNJhLkwcud2DH9VwGfctX:qhLS4TaqxhfCHc38aNJawcudoD7U
MD5:	57EB00056AC8C38CD4F3153FB9507F13
SHA1:	DDEE8E74FCC81B6301145F27C0F1CCF4B9185E1C
SHA-256:	7B90EC138AC8415D9B747612063D19147FEC2B1E99DE97C3B5636E8CA40B346E
SHA-512:	05F7EF6BD065D7DB3F41DFA95187FA40A14F58FA5D4705F2DF5982DB18EEB6D4E93C473D05932436BF645E76E0B23532867011E92EF953EC247B55648ED9C6EF
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........i)...z...z...z...z...z...z...z...z...z...z...z...z...z...z...z...z...z...z...zRich...z........PE..L...5>CX...........!..... .......P..pq...`................................................@.............................H...................................H.......................................P}..H...........................................UPX0.....P..............................UPX1..... ...`......................@...UPX2................."..............@..............................................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Windows\Temp\_MEI29202\servicemanager.pyd

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	7.2228399102917615
Encrypted:	false
SSDEEP:	384:FVtYwprbL7fLBtdYzKNg13ZOPaNJawcudoD7UfMX:vawBbLFYzKNg1plnbcuyD7UfMX
MD5:	6A95BCF45E4BE23CC2634EF5BAD17660
SHA1:	7D13B791588CB800C2ADD75FF8E74C3C493A8143
SHA-256:	60DA4B4E628B7DC1115615128AC554AEB29B50A61629AD5AEEB5CC9D2BD86202
SHA-512:	D3C80B025647444F42D42E82CAD50C4383728F7F8C9E16AA9D87450CA864B0B97B5F8F47E80328A4A2B67CE7D06C9A8F1DAE8C5B3C798DE1B2A50164161E69C8
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........o....K...K...K...K...K...K...K...K...KR..K...K...K...K...K...K...K...K...K...K...K...KRich...K........................PE..L......[...........!.....@........................}.....................................................................\...........................................................................h...H...........................................UPX0....................................UPX1.....@.......4..................@....rsrc................8..............@......................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Windows\Temp\_MEI29202\unicodedata.pyd

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	181760
Entropy (8bit):	7.989160583257678
Encrypted:	false
SSDEEP:	3072:Rfe2dO8KvTdjKGssSXwgtXZT32qenyxHBKs//4wd3RP29sZ6lI883out:Rfe2bKvEw+k2kw/4wZRPS3coS
MD5:	9A465CFAA788E29E7B1366C012EBC75C
SHA1:	10D9C49BB6652D9B04E17608D9ED35B036112647
SHA-256:	35C84D824DB175DD71046806A59BC711021ABCE04698FA304B1E2A9855E50A9C
SHA-512:	31BEE259C78CEB1E4F5C52E7B2CBD0EB62A071FC9C748DF47AB824E383EFDC3B218168700341B96D139DABFB3E4D7644341F22E52982B7C7F135A9E35B300B00
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......{H..?).?).?).6QE.=).6QS.1).6QT.=).6QC.8).?)..).6QY.>).6QB.>).6QA.>).Rich?).................PE..L...6>CX...........!......................................................................@.............................T...................................,.......................................x...H...........................................UPX0....................................UPX1................................@...UPX2................................@......................................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Windows\Temp\_MEI29202\win32api.pyd

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	34816
Entropy (8bit):	7.794879575971907
Encrypted:	false
SSDEEP:	768:etKTLIw2eRBsqBvKddE/wW68vEvfW2qmSOyinbcuyD7Uqmx:DCeLrGderDH2FXyinouy8qmx
MD5:	42C475231F4835BB1A5F94B0D3DA4520
SHA1:	FCFAE296DD10C92D973A57D61BBF5C0F4A15ED6B
SHA-256:	87CEEB1B7586DB730F48988A07018F9C8AF57934FF7F173A869542207F46B0F1
SHA-512:	D1A699B8497E8843F990F6F719A904A7751FE2A9404CB195BE2D94341728A7372CD93D379B576E6031980E1DA53F2336805C6BF59E799B63565CD63D4931C02A
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......[-..L...L...L.......L.......L.......L...J..L...L..UM.......L.......L.......L..Rich.L..................PE..L......[...........!.............p.. ...............................................................................P.......X...........X...............................................................H....................B..@...................UPX0.....p..............................UPX1.............~..................@....rsrc...............................@......................................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Windows\Temp\_MEI29202\win32event.pyd

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	11264
Entropy (8bit):	6.799438399701252
Encrypted:	false
SSDEEP:	192:jNxmpzSvHU53Uon53eXqY1K/CjrELQc432Xq0FaNJhLkwcud2DH9VwGfctLj/t:Xmp2/UR95aP1pgEc432XBaNJawcudoDU
MD5:	796306BE7A1ABCFFB8853EE9CEB5BEAE
SHA1:	93762CF53958A3A99B674986FCF3C53C489133ED
SHA-256:	26E6D883E9E61BF872425526A9B8C7BB229C3B9D2F82BB3C0BF500660DBE1995
SHA-512:	5919A837FA1FCAEA91B14D02DA306928D5E523E4591DCA290422C9EB9BE15F2EE626A8379F5C953F2B08E7A6B2CD67618652B9EFA9ACE8ABD47A8BD7CD8C2F64
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........k..{8..{8..{8..8..{8..8..{8..8..{8 ..8..{8..z8..{8..8..{8..8..{8..8..{8Rich..{8................PE..L...T..[...........!.....0..............................................................................................P...`...\.......`...........................................................h...H...........................................UPX0....................................UPX1.....0......."..................@....rsrc................&..............@......................................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Windows\Temp\_MEI29202\win32evtlog.pyd

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	19968
Entropy (8bit):	7.436093769968754
Encrypted:	false
SSDEEP:	384:Wo5FgP/m1xaGAONAt4ZvFqQggg3LgsAWUh31lA2W1waNJawcudoD7UGwGS:WmuP+TOONp5UQ/Zs8FlAfnbcuyD7UGwX
MD5:	317360BE68901D11F3D02AF1C151A4DC
SHA1:	570BF03BE1A737CF3D0CF3FC8E77261CF64E2051
SHA-256:	AC9C5C4BAA4DE19BDDF55313F29182F26EB80312C31266413672C61424A5C6E0
SHA-512:	25C25C23DD4FE1957CDFAD833D4570553C2627775008F3939525B6A3D1892F8B6CB7A9F20D454166338DF4DFC8A98306A1160016AE4CB2E9464944945AFA0A82
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........E..i+..i+..i+.E&...i+..;...i+..;...i+..;...i+.%...i+..i*.hi+..;...i+..;...i+..;...i+..;...i+.Rich.i+.................PE..L......[...........!.....P...................0...............................@.......................................4..T....3..P....0......................L5.......................................!..H.......................@...................UPX0....................................UPX1.....P.......D..................@....rsrc........0.......H..............@......................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Windows\Temp\_MEI29202\win32service.pyd

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	18432
Entropy (8bit):	7.513143648749714
Encrypted:	false
SSDEEP:	384:DvSTTJQxdZ3goCVdvSbw66apC1aNJawcudoD7U46:LSTT+1KF1onbcuyD7U46
MD5:	F23A62491BD945C050E3E1D13909E9E7
SHA1:	B8DAC4E00163533157A17E3B56D05E049A2375A2
SHA-256:	E52B5532A6764AAAE67DB557412B3F77EBDC8A14A72771A1C6414A83BB3FC15C
SHA-512:	52200CF9687752DB43BBAE703192C841694D5BD976FA56C0F25E0478CFB97681BC77677C1A8907167612DDF9FE6A561945FBEB0180022670AF97BF41B5B11766
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........[..[..[.....Z..E.-.Z..E.;.V..E.+.]...!s.\..[.....E.<.^..E.*.Z..E.,.Z..E.).Z..Rich[..........PE..L...q..[...........!.....@..........................................................................................8...T...............................................................................H...........................................UPX0....................................UPX1.....@.......>..................@....rsrc................B..............@..............................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Windows\Temp\_MEI29202\xmrig.exe

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	1905664
Entropy (8bit):	7.9235088812144
Encrypted:	false
SSDEEP:	49152:jeXVwyagUSymDH29F4+rthFTo6YZfnH8:0VKgUSymDH29ttzToX1nc
MD5:	13BDD9CD9F7E51746172996262B5A873
SHA1:	3834F8179ABD7A827E927505F3C226AC8BBCF3EE
SHA-256:	4BF737B29FF521BC263EB1F2C1C5EA04B47470CCCD1BEAE245D98DEF389929BD
SHA-512:	49879918505D042312F20B2FC8310A8C4A58AA266ED1AB05E0481F7E11385DA0920CF9D756F842EB98E4394F14725385B74A99B38FC8A60222FA4CC873CB8040
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: C:\Windows\Temp\_MEI29202\xmrig.exe, Author: Joe Security
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....\.....................`...0>...Z..@>...[...@..........................`[............... ...................... X.x....][.<.....[..]....................................................Z.....................................................UPX0.....0>.............................UPX1.........@>.....................@....rsrc....`....[..`..................@...3.94.UPX!....E.G...@.`.Z.....$Z.$/.w.......&...'....1.f.=.@9....MZ..,......($..#...th.....82..tJ......$.,./,......+.l..Ho..~B.......:..6....L.=Dc..tm....-<h....f..<2...u..?PEl..u..Q....-l..~?....j..x.......]...........K".v.g?w...k+...yt`,........o..7>,. ..D$...............7......b..0.{..,.~...[U......WV.U.S..\|.0~....+..).b.........@....................5.o.E.....d....x....l0.9..9...3....o._..........=...u...;.v.f...R..0..`.lm...--...I...X/(......9J9..~?.v...&+.. P.kSn.l......LJ...

C:\Windows\Temp\config

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	34
Entropy (8bit):	4.006436738245532
Encrypted:	false
SSDEEP:	3:KUc+TQmb4D3KN0:KUc+5cDf
MD5:	FA9A2993C7D47BD87FCDD7810A417C9D
SHA1:	2D2B7AEB5F8D39B283ADE33AC0BD7BC4CD582530
SHA-256:	F6B5EDA891BCA6AFDCA2D6068FF33309306456A4199D3024FF793427A39CFB98
SHA-512:	B666DAC7EE7E66E14245AC4BC35E51E51A4CF44C9481087AD3E40D10B478FF4B1E9FAE6F59E8F50DD0FE4E9F286907876217CF71BB9DC5F0E5C9C625FF724D5B
Malicious:	true
Preview:	1619016288..[rn]GET[/rn][sv]0[/sv]

C:\Windows\Temp\config.json

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1206
Entropy (8bit):	4.275024024623091
Encrypted:	false
SSDEEP:	24:pCKENTHgbeZlE1jCAh1RHEdOgNanAOSWSula:UKuTHgbYlUZHEdrNAla
MD5:	50CC63E4A1B24622CF61ED566B03E98F
SHA1:	92E5874785BB76E4579559BA70E116A6149349F5
SHA-256:	348F388C57DFB77B0CAACD8304725E10DC69A52EEC41AE695327787AD1853C92
SHA-512:	9A291DB9CF396687F3878590B1EB65CD7DA2E6FC3D6DE64A3B8CB08116B646371F432100E16B0ECD4F2916D05D67830F949AC2A3CA559A3A8D56616DF2BE98C7
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: C:\Windows\Temp\config.json, Author: Joe Security
Preview:	{. "algo": "cryptonight",. "api": {. "port": 0,. "access-token": null,. "id": null,. "worker-id": null,. "ipv6": false,. "restricted": true. },. "autosave": true,. "av": 0,. "background": true,. "colors": true,. "cpu-affinity": null,. "cpu-priority": null,. "donate-level": 1,. "huge-pages": true,. "hw-aes": null,. "log-file": null,. "max-cpu-usage": 70,. "pools": [. {. "url": "xmr.crypto-pool.fr:3333",. "user": "47BD6QNfkWf8ZMQSdqp2tY1AdG8ofsEPf4mcDp1YB4AX32hUjoLjuDaNrYzXk7cQcoPBzAuQrmQTgNgpo6XPqSBLCnfsjaV",. "pass": "x",. "rig-id": null,. "nicehash": false,. "keepalive": false,. "variant": -1,. "enabled": true,. "tls": false,. "tls-fingerprint": null. }. ],. "print-time": 60,. "retries": 5,. "retry-pause": 5,. "safe": false,. "threads": [. {.

C:\Windows\Temp\link.txt

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has command line arguments, Archive, ctime=Sun May 26 13:48:06 2019, mtime=Sun Jun 2 09:48:11 2019, atime=Sun May 26 13:48:06 2019, length=3933296, window=hide
Category:	dropped
Size (bytes):	1952
Entropy (8bit):	3.3086042907696407
Encrypted:	false
SSDEEP:	24:8NqDOlC82vUKJU1+IMJ941y2bY6HoIab/C8fn1vURXTUmu3+IMmmt:8aVnvZJUdMs1yE3HVabhlUymu3fMm
MD5:	3A9349AF006440C7E0DA677724551239
SHA1:	70075BB3B999E825E328302B462DEB1AA337B663
SHA-256:	00401651AF3194EDE5157004B6DBE1EDF836A94CA182221F2C034201FE55E4DC
SHA-512:	588D9EA0C7D770ADF1BE9C887EF2F2CDB42A7205D2DD1288CDA193CD1D99EB689B5DC68765E17724F093EF312B7769290968610C4C6F2BE0432D52D483FF15C0
Malicious:	false
Preview:	L..................F.... ....">.......Q.0.....@.....p.<..........................P.O. .:i.....+00.../C:\...................V.1......N....Windows.@......L...N(V.........................._J..W.i.n.d.o.w.s.....f.2.p.<..N.v .explorer.exe..J......N.v.N.V....Q...........\.........f...e.x.p.l.o.r.e.r...e.x.e.......M...............4.......L...........d.{.....Windows.C:\Windows\explorer.exe..#.....\.....\.....\.....\.....\.W.i.n.d.o.w.s.\.e.x.p.l.o.r.e.r...e.x.e...P.h.o.t.o...s.c.r.........%SystemRoot%\explorer.exe...........................................................................................................................................................................................................................................%.S.y.s.t.e.m.R.o.o.t.%.\.e.x.p.l.o.r.e.r...e.x.e.........................................................................................................................................................................................................

C:\Windows\Temp\xmrig.exe

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	1905664
Entropy (8bit):	7.9235088812144
Encrypted:	false
SSDEEP:	49152:jeXVwyagUSymDH29F4+rthFTo6YZfnH8:0VKgUSymDH29ttzToX1nc
MD5:	13BDD9CD9F7E51746172996262B5A873
SHA1:	3834F8179ABD7A827E927505F3C226AC8BBCF3EE
SHA-256:	4BF737B29FF521BC263EB1F2C1C5EA04B47470CCCD1BEAE245D98DEF389929BD
SHA-512:	49879918505D042312F20B2FC8310A8C4A58AA266ED1AB05E0481F7E11385DA0920CF9D756F842EB98E4394F14725385B74A99B38FC8A60222FA4CC873CB8040
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: C:\Windows\Temp\xmrig.exe, Author: Joe Security
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....\.....................`...0>...Z..@>...[...@..........................`[............... ...................... X.x....][.<.....[..]....................................................Z.....................................................UPX0.....0>.............................UPX1.........@>.....................@....rsrc....`....[..`..................@...3.94.UPX!....E.G...@.`.Z.....$Z.$/.w.......&...'....1.f.=.@9....MZ..,......($..#...th.....82..tJ......$.,./,......+.l..Ho..~B.......:..6....L.=Dc..tm....-<h....f..<2...u..?PEl..u..Q....-l..~?....j..x.......]...........K".v.g?w...k+...yt`,........o..7>,. ..D$...............7......b..0.{..,.~...[U......WV.U.S..\|.0~....+..).b.........@....................5.o.E.....d....x....l0.9..9...3....o._..........=...u...;.v.f...R..0..`.lm...--...I...X/(......9J9..~?.v...&+.. P.kSn.l......LJ...

\Device\ConDrv

Download File

Process:	C:\Windows\SysWOW64\netsh.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	313
Entropy (8bit):	4.971939296804078
Encrypted:	false
SSDEEP:	6:/ojfKsUTGN8Ypox42k9L+DbGMKeQE+vigqAZs2E+AYeDPO+Yswyha:wjPIGNrkHk9iaeIM6ADDPOHyha
MD5:	689E2126A85BF55121488295EE068FA1
SHA1:	09BAAA253A49D80C18326DFBCA106551EBF22DD6
SHA-256:	D968A966EF474068E41256321F77807A042F1965744633D37A203A705662EC25
SHA-512:	C3736A8FC7E6573FA1B26FE6A901C05EE85C55A4A276F8F569D9EADC9A58BEC507D1BB90DBF9EA62AE79A6783178C69304187D6B90441D82E46F5F56172B5C5C
Malicious:	false
Preview:	..IMPORTANT: Command executed successfully...However, "netsh firewall" is deprecated;..use "netsh advfirewall firewall" instead...For more information on using "netsh advfirewall firewall" commands..instead of "netsh firewall", see KB article 947709..at https://go.microsoft.com/fwlink/?linkid=121488 .....Ok.....

Static File Info

General

File type:	Zip archive data, at least v2.0 to extract, compression method=AES Encrypted
Entropy (8bit):	7.999971727359113
TrID:	ZIP compressed archive (8000/1) 99.91% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.09%
File name:	240506-b7lv1sfmcw_pw_infected.zip
File size:	6'171'992 bytes
MD5:	eee9a11acff6ca42d6822287bd877855
SHA1:	cfeb4cc3712467d1249ed60756c81241c3d8e42b
SHA256:	cf3b0c8d16a32ef00df66903044dbd4e293d580e4b86de0db6c77b3096fd905f
SHA512:	a154ddc08a3441292648d8c1d5cffb6ab0cca22d5fccc77c880137c0cc66554de06db13c21019ec8d31ecb0c48b61f9bf0e70170db016f90f95ffe4685a7dde8
SSDEEP:	98304:PLvGAgnfU0BMfKzMCe+pIMOSeX1xxfobtuJudEmqjQ6dsHITWNJbpDizqPwf+1:CAgns0BEgIMDA1x+btuJEhr6yXYfM
TLSH:	9C5633F0EEBA76ED7E11858DA9C7000115F197AC9BE89056FBB8622AD348CFD7E17410
File Content Preview:	PK......c.................D...5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.zip......AE..........A.o...2...b...p....~ri.....vX.........<.......Z..wF...U.Oh..j[]u~.rV....-D~>R6........Q_Y..U.DFRk/....lE%.8t.,....=...Y.h..Sqa....N.[w.3.

File Icon


Icon Hash:	1c1c1e4e4ececedc

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
05/08/24-08:42:23.890466	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	43604	1434	1.10.212.38	192.168.2.16
05/08/24-08:42:22.758413	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	53858	1434	117.217.85.121	192.168.2.16
05/08/24-08:41:43.037490	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8082	1434	117.204.205.131	192.168.2.16
05/08/24-08:42:23.312873	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	6881	1434	123.8.93.1	192.168.2.16
05/08/24-08:42:17.222998	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	37497	1434	42.224.87.163	192.168.2.16
05/08/24-08:42:27.051441	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	19401	1434	112.248.100.78	192.168.2.16
05/08/24-08:41:41.979061	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	3252	1434	117.197.169.210	192.168.2.16
05/08/24-08:41:39.664318	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	5353	1434	117.212.164.12	192.168.2.16
05/08/24-08:42:23.722876	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	5353	1434	42.224.170.152	192.168.2.16
05/08/24-08:41:58.734196	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	6881	1434	115.62.186.177	192.168.2.16
05/08/24-08:42:24.517474	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8000	1434	219.156.175.192	192.168.2.16
05/08/24-08:42:26.082451	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	16433	1434	112.248.190.167	192.168.2.16
05/08/24-08:42:05.526822	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	59147	1434	59.93.28.51	192.168.2.16
05/08/24-08:41:37.561960	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	9510	1434	178.72.69.83	192.168.2.16
05/08/24-08:41:42.912869	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	11211	1434	117.194.209.234	192.168.2.16
05/08/24-08:41:39.364107	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8000	1434	113.24.186.62	192.168.2.16
05/08/24-08:41:38.292433	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	30301	1434	117.252.202.181	192.168.2.16
05/08/24-08:41:45.115501	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	7229	1434	222.141.89.244	192.168.2.16
05/08/24-08:41:49.217050	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	63554	1434	42.230.188.102	192.168.2.16
05/08/24-08:41:56.540641	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8080	1434	103.40.255.245	192.168.2.16
05/08/24-08:41:48.795582	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8080	1434	117.205.56.122	192.168.2.16
05/08/24-08:42:15.423154	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	9972	1434	170.78.39.82	192.168.2.16
05/08/24-08:42:13.676375	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	7780	1434	182.127.71.174	192.168.2.16
05/08/24-08:41:40.429126	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	18473	1434	117.254.179.77	192.168.2.16
05/08/24-08:41:50.695381	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	1027	1434	39.90.147.149	192.168.2.16
05/08/24-08:42:07.352648	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	43369	1434	42.178.83.32	192.168.2.16
05/08/24-08:42:14.103500	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	6881	1434	182.126.92.41	192.168.2.16
05/08/24-08:41:35.143470	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	30193	1434	219.157.138.77	192.168.2.16
05/08/24-08:42:17.317388	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	18616	1434	117.221.96.240	192.168.2.16
05/08/24-08:42:26.472988	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8080	1434	115.56.178.247	192.168.2.16
05/08/24-08:42:25.146716	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	13315	1434	27.158.93.188	192.168.2.16
05/08/24-08:42:24.093824	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	14765	1434	59.95.132.231	192.168.2.16
05/08/24-08:41:58.322114	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	5060	1434	117.204.195.86	192.168.2.16
05/08/24-08:41:53.884664	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	39737	1434	115.55.242.43	192.168.2.16
05/08/24-08:41:59.891277	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	11211	1434	117.204.200.35	192.168.2.16
05/08/24-08:41:49.808892	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	57501	1434	217.213.110.165	192.168.2.16
05/08/24-08:42:20.560829	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8080	1434	219.156.34.215	192.168.2.16
05/08/24-08:42:29.930438	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	5273	1434	120.85.113.160	192.168.2.16
05/08/24-08:41:56.619276	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	4000	1434	115.55.76.81	192.168.2.16
05/08/24-08:42:02.254192	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	58482	1434	117.201.8.111	192.168.2.16
05/08/24-08:42:35.369017	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	44526	1434	117.206.137.150	192.168.2.16
05/08/24-08:41:59.818847	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	53643	1434	49.77.71.39	192.168.2.16
05/08/24-08:42:16.725621	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	28920	1434	117.216.25.204	192.168.2.16
05/08/24-08:42:15.854008	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	52467	1434	59.89.1.74	192.168.2.16
05/08/24-08:41:41.898262	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	45434	1434	117.248.49.85	192.168.2.16
05/08/24-08:41:39.113990	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8083	1434	117.255.205.50	192.168.2.16
05/08/24-08:42:09.482488	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8082	1434	117.204.205.162	192.168.2.16
05/08/24-08:42:05.598980	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	11211	1434	95.169.197.246	192.168.2.16
05/08/24-08:41:52.056447	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	5353	1434	123.10.147.38	192.168.2.16
05/08/24-08:42:19.879979	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	3109	1434	222.140.171.151	192.168.2.16
05/08/24-08:41:50.706600	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	54421	1434	61.53.41.246	192.168.2.16
05/08/24-08:42:10.642894	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	4210	1434	61.52.37.166	192.168.2.16
05/08/24-08:42:24.074974	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	25193	1434	62.56.245.49	192.168.2.16
05/08/24-08:42:14.499362	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	11256	1434	123.129.135.175	192.168.2.16
05/08/24-08:42:20.182312	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	21902	1434	123.12.234.222	192.168.2.16
05/08/24-08:42:09.819419	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8083	1434	117.204.56.33	192.168.2.16
05/08/24-08:42:04.882384	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	15023	1434	117.204.195.7	192.168.2.16
05/08/24-08:42:23.967044	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8080	1434	60.254.81.36	192.168.2.16
05/08/24-08:42:02.666955	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	57791	1434	42.227.237.218	192.168.2.16
05/08/24-08:41:55.846726	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	13472	1434	178.72.76.39	192.168.2.16
05/08/24-08:42:04.188891	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	36160	1434	123.14.113.70	192.168.2.16
05/08/24-08:41:59.968315	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	22762	1434	116.75.250.171	192.168.2.16
05/08/24-08:41:55.570692	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	5060	1434	178.141.162.151	192.168.2.16
05/08/24-08:41:50.746937	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	54158	1434	27.6.26.116	192.168.2.16
05/08/24-08:41:43.042167	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	6881	1434	117.206.187.119	192.168.2.16
05/08/24-08:41:59.799227	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	61642	1434	222.137.180.67	192.168.2.16
05/08/24-08:42:23.465528	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	48594	1434	117.207.66.108	192.168.2.16
05/08/24-08:41:46.558119	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8000	1434	124.95.13.142	192.168.2.16
05/08/24-08:41:45.132689	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	5752	1434	120.85.183.182	192.168.2.16
05/08/24-08:41:57.550764	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	1434	1434	117.194.209.48	192.168.2.16
05/08/24-08:41:40.572346	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	30301	1434	117.192.123.197	192.168.2.16
05/08/24-08:41:58.308730	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	5353	1434	117.204.197.17	192.168.2.16
05/08/24-08:41:38.598696	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8181	1434	59.180.163.124	192.168.2.16
05/08/24-08:41:58.250594	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	45784	1434	42.227.164.44	192.168.2.16
05/08/24-08:42:02.247890	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8000	1434	59.99.130.59	192.168.2.16
05/08/24-08:42:12.320643	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	26138	1434	113.230.233.35	192.168.2.16
05/08/24-08:42:05.928671	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8080	1434	178.141.68.155	192.168.2.16
05/08/24-08:41:55.775098	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	7459	1434	178.72.81.231	192.168.2.16
05/08/24-08:41:31.967075	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	18836	1434	117.217.33.24	192.168.2.16
05/08/24-08:42:09.380403	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	3442	1434	112.83.1.68	192.168.2.16
05/08/24-08:41:49.669285	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8081	1434	117.204.196.32	192.168.2.16
05/08/24-08:41:50.719881	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	1027	1434	123.191.91.8	192.168.2.16
05/08/24-08:41:38.578383	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8860	1434	59.92.217.4	192.168.2.16
05/08/24-08:41:58.797948	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	30301	1434	117.204.192.49	192.168.2.16
05/08/24-08:41:50.219686	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	7398	1434	42.239.252.68	192.168.2.16
05/08/24-08:42:03.542894	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	6881	1434	120.57.86.47	192.168.2.16
05/08/24-08:41:44.250266	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	14339	1434	178.72.75.52	192.168.2.16
05/08/24-08:41:38.871410	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8082	1434	117.220.149.48	192.168.2.16
05/08/24-08:41:40.705562	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	4000	1434	115.63.32.132	192.168.2.16
05/08/24-08:41:51.001249	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	63604	1434	222.140.185.244	192.168.2.16
05/08/24-08:42:26.754890	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	6881	1434	123.129.129.158	192.168.2.16
05/08/24-08:42:12.020972	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	5060	1434	42.235.46.80	192.168.2.16
05/08/24-08:41:58.911013	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	53166	1434	59.184.79.224	192.168.2.16
05/08/24-08:41:58.313874	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	19307	1434	182.117.30.233	192.168.2.16
05/08/24-08:41:34.237893	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	5353	1434	5.188.64.229	192.168.2.16
05/08/24-08:41:54.676544	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	62968	1434	119.116.155.73	192.168.2.16
05/08/24-08:42:27.548781	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	38422	1434	219.157.52.237	192.168.2.16
05/08/24-08:42:09.014188	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	1027	1434	59.93.24.172	192.168.2.16
05/08/24-08:41:48.556459	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	24245	1434	117.204.204.228	192.168.2.16
05/08/24-08:42:15.442352	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	58783	1434	42.235.103.107	192.168.2.16
05/08/24-08:42:07.758960	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8082	1434	115.58.55.170	192.168.2.16
05/08/24-08:42:13.636395	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	34601	1434	42.224.181.131	192.168.2.16
05/08/24-08:42:14.253396	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	40306	1434	222.141.120.99	192.168.2.16
05/08/24-08:42:14.259530	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	1027	1434	222.138.22.175	192.168.2.16
05/08/24-08:42:16.733802	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	10539	1434	178.72.69.34	192.168.2.16
05/08/24-08:42:17.404237	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	51721	1434	115.61.52.125	192.168.2.16
05/08/24-08:42:23.467698	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	1027	1434	59.93.21.219	192.168.2.16
05/08/24-08:41:46.329417	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	57641	1434	59.180.184.123	192.168.2.16
05/08/24-08:42:12.627800	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	58321	1434	59.182.146.210	192.168.2.16
05/08/24-08:42:16.012903	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	5353	1434	59.93.186.37	192.168.2.16
05/08/24-08:42:24.091293	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	59275	1434	117.222.253.19	192.168.2.16
05/08/24-08:42:22.764947	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	30485	1434	1.10.212.35	192.168.2.16
05/08/24-08:42:24.418356	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8000	1434	59.95.130.130	192.168.2.16
05/08/24-08:41:59.011307	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	62553	1434	175.174.51.163	192.168.2.16
05/08/24-08:42:07.348851	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	22671	1434	222.138.127.237	192.168.2.16
05/08/24-08:41:44.088614	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	30301	1434	117.204.193.173	192.168.2.16
05/08/24-08:42:24.127952	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	4140	1434	117.204.196.119	192.168.2.16
05/08/24-08:42:08.027266	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	11285	1434	117.194.209.35	192.168.2.16
05/08/24-08:42:20.468445	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	27377	1434	117.217.34.1	192.168.2.16
05/08/24-08:41:47.358277	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	36627	1434	120.56.13.44	192.168.2.16
05/08/24-08:41:43.994622	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	4908	1434	116.138.176.173	192.168.2.16
05/08/24-08:42:19.883895	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	11907	1434	42.230.39.63	192.168.2.16
05/08/24-08:41:47.327722	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8080	1434	175.178.238.26	192.168.2.16
05/08/24-08:42:15.673370	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8419	1434	117.204.195.199	192.168.2.16
05/08/24-08:42:15.918995	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	30301	1434	123.173.4.179	192.168.2.16
05/08/24-08:41:49.492556	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	19307	1434	112.248.172.90	192.168.2.16
05/08/24-08:41:53.337770	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	10629	1434	117.206.186.245	192.168.2.16
05/08/24-08:42:00.972567	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	29452	1434	42.226.71.95	192.168.2.16
05/08/24-08:41:46.573162	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	5125	1434	112.252.255.116	192.168.2.16
05/08/24-08:41:45.249250	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	5060	1434	182.121.11.249	192.168.2.16
05/08/24-08:42:10.958306	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8083	1434	117.254.182.105	192.168.2.16
05/08/24-08:42:09.847559	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	46505	1434	119.179.236.7	192.168.2.16
05/08/24-08:42:00.618455	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	9332	1434	42.53.180.95	192.168.2.16
05/08/24-08:42:11.897995	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	31173	1434	190.109.227.211	192.168.2.16
05/08/24-08:42:16.852178	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	22953	1434	120.85.114.24	192.168.2.16
05/08/24-08:42:23.966461	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	6881	1434	113.236.105.239	192.168.2.16
05/08/24-08:42:14.734169	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	9101	1434	120.85.117.215	192.168.2.16
05/08/24-08:41:50.783214	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	44386	1434	42.86.169.112	192.168.2.16
05/08/24-08:42:20.938721	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	6881	1434	117.50.73.154	192.168.2.16
05/08/24-08:41:47.421959	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	27244	1434	113.236.254.106	192.168.2.16
05/08/24-08:41:37.370332	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	22502	1434	175.173.94.100	192.168.2.16
05/08/24-08:42:01.278773	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	55619	1434	117.204.205.192	192.168.2.16
05/08/24-08:41:39.098096	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8080	1434	117.204.200.160	192.168.2.16
05/08/24-08:42:24.369595	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	41848	1434	1.10.212.34	192.168.2.16
05/08/24-08:42:03.562225	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	39039	1434	178.141.133.78	192.168.2.16
05/08/24-08:42:14.207285	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	40771	1434	117.255.92.28	192.168.2.16
05/08/24-08:42:16.102625	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	12878	1434	178.141.51.159	192.168.2.16
05/08/24-08:41:45.869843	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	44426	1434	182.117.29.5	192.168.2.16
05/08/24-08:41:38.654409	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	38385	1434	123.11.13.9	192.168.2.16
05/08/24-08:41:38.426578	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	7039	1434	115.55.247.124	192.168.2.16
05/08/24-08:41:57.396215	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	16147	1434	106.3.130.252	192.168.2.16
05/08/24-08:42:06.800008	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	65505	1434	115.55.6.157	192.168.2.16
05/08/24-08:42:35.983597	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	16913	1434	59.88.177.223	192.168.2.16
05/08/24-08:42:08.023576	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	54274	1434	182.124.109.55	192.168.2.16
05/08/24-08:42:36.190081	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	30301	1434	112.231.118.128	192.168.2.16
05/08/24-08:42:12.371894	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	55318	1434	117.200.185.252	192.168.2.16
05/08/24-08:42:19.024744	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	11211	1434	117.245.219.24	192.168.2.16
05/08/24-08:42:22.055976	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	62187	1434	117.200.89.104	192.168.2.16
05/08/24-08:42:09.191306	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	11211	1434	119.109.211.76	192.168.2.16
05/08/24-08:41:38.523049	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	4727	1434	178.141.136.230	192.168.2.16
05/08/24-08:41:54.869906	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8000	1434	27.7.214.11	192.168.2.16
05/08/24-08:42:16.323616	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	42676	1434	117.196.38.47	192.168.2.16
05/08/24-08:41:36.983075	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	1027	1434	59.180.182.110	192.168.2.16
05/08/24-08:42:24.329017	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	52265	1434	59.178.213.250	192.168.2.16
05/08/24-08:41:37.441923	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	6881	1434	117.252.193.49	192.168.2.16
05/08/24-08:41:52.867547	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	34281	1434	117.63.114.20	192.168.2.16
05/08/24-08:42:29.164332	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	55750	1434	182.124.41.78	192.168.2.16
05/08/24-08:42:25.962131	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	5060	1434	182.117.108.148	192.168.2.16
05/08/24-08:41:55.674553	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	55547	1434	59.93.129.236	192.168.2.16
05/08/24-08:41:59.831795	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	5060	1434	148.66.134.158	192.168.2.16
05/08/24-08:41:50.064172	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	2815	1434	120.85.91.225	192.168.2.16
05/08/24-08:41:38.543062	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	23918	1434	117.252.192.228	192.168.2.16
05/08/24-08:41:39.594542	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	4000	1434	42.52.67.36	192.168.2.16
05/08/24-08:41:28.572264	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	2452	1434	117.248.60.28	192.168.2.16
05/08/24-08:42:22.408993	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	46833	1434	117.204.205.213	192.168.2.16
05/08/24-08:41:51.241802	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	17852	1434	42.234.216.63	192.168.2.16
05/08/24-08:41:50.969820	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	47106	1434	39.77.34.71	192.168.2.16
05/08/24-08:41:36.327073	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	17414	1434	178.72.69.50	192.168.2.16
05/08/24-08:42:08.865149	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	4736	1434	221.15.195.14	192.168.2.16
05/08/24-08:42:35.320646	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	1900	1434	1.10.215.156	192.168.2.16
05/08/24-08:41:39.586353	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8081	1434	123.5.144.22	192.168.2.16
05/08/24-08:41:48.591035	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	12364	1434	120.85.113.130	192.168.2.16
05/08/24-08:41:52.728200	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	5353	1434	221.230.38.202	192.168.2.16
05/08/24-08:41:34.869888	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	18567	1434	178.72.76.147	192.168.2.16
05/08/24-08:41:34.189005	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8082	1434	117.204.193.72	192.168.2.16
05/08/24-08:41:35.205580	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	7664	1434	178.72.71.211	192.168.2.16
05/08/24-08:41:48.643535	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	4000	1434	110.181.71.253	192.168.2.16
05/08/24-08:41:59.258391	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	45931	1434	115.56.149.177	192.168.2.16
05/08/24-08:41:49.707404	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	5353	1434	61.0.11.32	192.168.2.16
05/08/24-08:41:47.697262	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8000	1434	113.168.89.195	192.168.2.16
05/08/24-08:42:24.005245	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	36524	1434	1.10.212.34	192.168.2.16
05/08/24-08:41:45.730155	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	4000	1434	182.121.152.137	192.168.2.16
05/08/24-08:42:04.190762	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	6881	1434	1.70.87.160	192.168.2.16
05/08/24-08:42:21.368498	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	53619	1434	1.10.212.35	192.168.2.16
05/08/24-08:41:55.372920	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	36130	1434	186.148.245.119	192.168.2.16
05/08/24-08:41:57.501751	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	4864	1434	91.143.171.160	192.168.2.16
05/08/24-08:42:13.893100	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	4950	1434	117.204.207.155	192.168.2.16
05/08/24-08:42:35.469666	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	46426	1434	178.141.177.171	192.168.2.16
05/08/24-08:42:22.161515	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	6003	1434	117.220.145.85	192.168.2.16
05/08/24-08:42:24.921914	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	28803	1434	1.10.212.34	192.168.2.16
05/08/24-08:41:34.105037	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	17542	1434	117.204.196.236	192.168.2.16
05/08/24-08:42:22.928195	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	30301	1434	117.200.187.201	192.168.2.16
05/08/24-08:42:27.999824	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8083	1434	219.156.26.209	192.168.2.16
05/08/24-08:41:59.898497	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	15465	1434	119.189.215.205	192.168.2.16
05/08/24-08:42:06.072557	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8800	1434	89.130.132.127	192.168.2.16
05/08/24-08:42:13.211344	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	19758	1434	219.155.187.101	192.168.2.16
05/08/24-08:41:41.299596	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	16677	1434	178.72.69.169	192.168.2.16
05/08/24-08:41:54.884638	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	42309	1434	119.117.247.228	192.168.2.16
05/08/24-08:42:17.069793	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	6913	1434	61.3.88.141	192.168.2.16
05/08/24-08:42:01.378658	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	56838	1434	72.70.180.247	192.168.2.16
05/08/24-08:41:44.096449	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	13185	1434	125.44.218.201	192.168.2.16
05/08/24-08:41:30.840655	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	6881	1434	117.220.146.21	192.168.2.16
05/08/24-08:41:52.867067	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	61491	1434	59.95.219.225	192.168.2.16
05/08/24-08:41:47.414718	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8082	1434	117.217.37.25	192.168.2.16
05/08/24-08:42:21.368411	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	47897	1434	27.206.82.4	192.168.2.16
05/08/24-08:41:47.596843	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8083	1434	39.79.135.49	192.168.2.16
05/08/24-08:42:17.357467	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8033	1434	120.85.91.247	192.168.2.16
05/08/24-08:41:35.703761	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	53738	1434	117.204.195.113	192.168.2.16
05/08/24-08:41:43.361397	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	56641	1434	119.163.161.191	192.168.2.16
05/08/24-08:42:10.081372	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	30301	1434	61.3.91.209	192.168.2.16
05/08/24-08:42:09.570372	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8083	1434	125.25.183.174	192.168.2.16
05/08/24-08:41:54.734730	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	10829	1434	1.10.212.33	192.168.2.16
05/08/24-08:41:37.362522	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8080	1434	115.57.57.44	192.168.2.16
05/08/24-08:41:32.977435	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	5060	1434	117.248.46.29	192.168.2.16
05/08/24-08:42:21.718990	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8082	1434	59.93.23.182	192.168.2.16
05/08/24-08:42:12.404872	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	6881	1434	219.155.211.123	192.168.2.16
05/08/24-08:42:11.632852	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	27728	1434	117.222.252.36	192.168.2.16
05/08/24-08:42:06.920983	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	55596	1434	117.217.50.113	192.168.2.16
05/08/24-08:42:21.716355	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8083	1434	117.242.236.163	192.168.2.16
05/08/24-08:41:52.750264	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8083	1434	121.61.147.248	192.168.2.16
05/08/24-08:42:24.243462	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	47564	1434	113.238.13.15	192.168.2.16
05/08/24-08:41:55.545294	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	9729	1434	88.147.174.83	192.168.2.16
05/08/24-08:42:04.593318	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	38532	1434	112.248.138.4	192.168.2.16
05/08/24-08:41:47.342243	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	45329	1434	61.53.93.185	192.168.2.16
05/08/24-08:41:46.603460	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	6881	1434	117.217.51.50	192.168.2.16
05/08/24-08:42:35.991106	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	64693	1434	59.93.182.5	192.168.2.16
05/08/24-08:42:03.566148	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8082	1434	219.157.64.104	192.168.2.16
05/08/24-08:42:05.529437	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	15400	1434	178.72.88.14	192.168.2.16
05/08/24-08:42:24.101567	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	56018	1434	59.89.3.215	192.168.2.16
05/08/24-08:41:44.132773	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	53575	1434	117.248.48.13	192.168.2.16
05/08/24-08:42:09.131657	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	59358	1434	117.204.193.59	192.168.2.16
05/08/24-08:41:59.104411	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	1895	1434	117.201.10.81	192.168.2.16
05/08/24-08:41:33.141770	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	5494	1434	178.72.68.245	192.168.2.16
05/08/24-08:42:11.415799	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	7791	1434	59.96.165.120	192.168.2.16
05/08/24-08:42:07.720884	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	62191	1434	182.124.11.228	192.168.2.16
05/08/24-08:41:36.038909	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	37178	1434	42.237.49.201	192.168.2.16
05/08/24-08:42:05.437334	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	1249	1434	120.85.91.116	192.168.2.16
05/08/24-08:41:43.006975	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	30203	1434	125.41.0.47	192.168.2.16
05/08/24-08:42:21.258853	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	7511	1434	1.10.212.35	192.168.2.16
05/08/24-08:42:01.468758	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	17706	1434	59.182.156.229	192.168.2.16
05/08/24-08:42:23.480791	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	46874	1434	24.53.139.167	192.168.2.16
05/08/24-08:42:14.351626	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8081	1434	123.8.50.74	192.168.2.16
05/08/24-08:42:00.563004	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	23451	1434	160.153.235.195	192.168.2.16
05/08/24-08:42:14.226435	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	43931	1434	14.121.147.25	192.168.2.16
05/08/24-08:42:04.729686	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	46461	1434	182.117.40.222	192.168.2.16
05/08/24-08:42:20.462914	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	24036	1434	112.237.110.189	192.168.2.16
05/08/24-08:41:30.225986	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	1027	1434	59.93.129.243	192.168.2.16
05/08/24-08:42:23.727423	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	11211	1434	118.79.217.192	192.168.2.16
05/08/24-08:42:23.734591	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	5060	1434	178.141.227.103	192.168.2.16
05/08/24-08:41:40.928810	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	6881	1434	117.200.89.8	192.168.2.16
05/08/24-08:41:30.686166	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	16054	1434	81.68.153.169	192.168.2.16
05/08/24-08:41:41.367187	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	6674	1434	178.72.75.15	192.168.2.16
05/08/24-08:42:17.772466	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	32922	1434	112.239.102.15	192.168.2.16
05/08/24-08:41:49.665838	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	30301	1434	59.93.30.163	192.168.2.16
05/08/24-08:42:23.976436	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	4000	1434	117.216.31.32	192.168.2.16
05/08/24-08:41:48.119821	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	6990	1434	115.49.1.0	192.168.2.16
05/08/24-08:42:22.976093	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	46505	1434	123.12.183.139	192.168.2.16
05/08/24-08:41:33.245239	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	40542	1434	117.204.195.167	192.168.2.16
05/08/24-08:41:23.677427	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	2064	1434	117.214.98.23	192.168.2.16
05/08/24-08:41:39.905843	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	49006	1434	117.216.64.111	192.168.2.16
05/08/24-08:41:57.495626	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	32658	1434	117.204.203.59	192.168.2.16
05/08/24-08:41:38.230031	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	5060	1434	1.10.211.124	192.168.2.16
05/08/24-08:42:16.163978	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	5353	1434	219.157.164.3	192.168.2.16
05/08/24-08:42:24.298457	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8083	1434	120.61.29.87	192.168.2.16
05/08/24-08:41:49.179091	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	46849	1434	117.204.207.227	192.168.2.16
05/08/24-08:41:55.754806	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	41500	1434	117.235.52.188	192.168.2.16
05/08/24-08:41:56.548841	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	13457	1434	121.225.81.102	192.168.2.16
05/08/24-08:41:59.952500	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	4137	1434	59.93.183.200	192.168.2.16
05/08/24-08:42:07.437899	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	26751	1434	1.10.212.35	192.168.2.16
05/08/24-08:42:13.287414	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	41654	1434	119.179.253.22	192.168.2.16
05/08/24-08:41:50.789118	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	38219	1434	117.209.8.221	192.168.2.16
05/08/24-08:42:02.975339	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	13468	1434	59.182.121.221	192.168.2.16
05/08/24-08:41:51.215544	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	4000	1434	115.58.151.170	192.168.2.16
05/08/24-08:41:45.148138	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	20433	1434	120.85.119.134	192.168.2.16
05/08/24-08:41:34.363024	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	1574	1434	178.72.77.243	192.168.2.16
05/08/24-08:42:14.217410	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	11127	1434	120.86.254.175	192.168.2.16
05/08/24-08:41:56.581106	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	20185	1434	182.121.84.2	192.168.2.16
05/08/24-08:42:11.042655	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	15073	1434	58.178.116.82	192.168.2.16
05/08/24-08:42:21.283578	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	5060	1434	222.134.173.166	192.168.2.16
05/08/24-08:41:41.873370	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	4000	1434	59.180.163.252	192.168.2.16
05/08/24-08:42:22.093652	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	63104	1434	119.185.170.18	192.168.2.16
05/08/24-08:42:24.263967	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	22732	1434	1.10.212.36	192.168.2.16
05/08/24-08:42:15.905491	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	30301	1434	124.235.243.85	192.168.2.16
05/08/24-08:41:39.601800	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	60648	1434	182.124.40.132	192.168.2.16
05/08/24-08:42:24.038361	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	42578	1434	117.242.239.113	192.168.2.16
05/08/24-08:42:14.349574	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	57674	1434	113.228.133.250	192.168.2.16
05/08/24-08:42:02.560839	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	36310	1434	121.31.133.142	192.168.2.16
05/08/24-08:41:38.131744	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	42083	1434	123.129.134.22	192.168.2.16
05/08/24-08:41:43.913337	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8080	1434	125.41.186.241	192.168.2.16
05/08/24-08:41:49.664109	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8959	1434	117.204.199.23	192.168.2.16
05/08/24-08:42:23.592620	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	15070	1434	1.10.212.35	192.168.2.16
05/08/24-08:42:10.883499	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	1302	1434	95.32.130.44	192.168.2.16
05/08/24-08:42:02.386353	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	46287	1434	59.88.188.147	192.168.2.16
05/08/24-08:41:56.513352	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8083	1434	117.199.77.97	192.168.2.16
05/08/24-08:42:20.204238	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	18441	1434	178.72.88.89	192.168.2.16
05/08/24-08:42:14.380665	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	41073	1434	40.133.224.20	192.168.2.16
05/08/24-08:42:19.926204	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	23278	1434	120.85.112.235	192.168.2.16
05/08/24-08:42:10.067316	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	40901	1434	125.41.215.118	192.168.2.16
05/08/24-08:42:15.676466	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	60556	1434	117.204.205.132	192.168.2.16
05/08/24-08:41:54.611950	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	12290	1434	121.239.56.243	192.168.2.16
05/08/24-08:42:15.087034	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8000	1434	221.15.48.45	192.168.2.16
05/08/24-08:42:02.374716	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8081	1434	59.89.67.135	192.168.2.16
05/08/24-08:42:19.809368	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	32931	1434	1.10.212.36	192.168.2.16
05/08/24-08:42:12.853516	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	39964	1434	117.253.209.123	192.168.2.16
05/08/24-08:41:41.803692	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8927	1434	120.85.92.237	192.168.2.16
05/08/24-08:42:09.006515	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	63393	1434	117.216.24.112	192.168.2.16
05/08/24-08:42:24.570492	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8000	1434	42.227.201.198	192.168.2.16
05/08/24-08:42:03.190332	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	62281	1434	117.248.60.176	192.168.2.16
05/08/24-08:41:54.651965	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	57362	1434	60.23.233.227	192.168.2.16
05/08/24-08:41:57.297964	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8083	1434	115.58.81.120	192.168.2.16
05/08/24-08:42:15.026362	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	28409	1434	219.157.178.183	192.168.2.16
05/08/24-08:41:59.856127	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	21818	1434	178.72.70.34	192.168.2.16
05/08/24-08:41:51.269027	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	62465	1434	115.56.181.247	192.168.2.16
05/08/24-08:41:55.588961	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	56572	1434	210.22.177.142	192.168.2.16
05/08/24-08:42:23.602444	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	4097	1434	178.72.69.188	192.168.2.16
05/08/24-08:42:13.241006	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	20651	1434	42.233.215.68	192.168.2.16
05/08/24-08:42:12.270279	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	25265	1434	182.120.49.23	192.168.2.16
05/08/24-08:41:54.945061	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	33796	1434	42.229.252.77	192.168.2.16
05/08/24-08:41:40.862098	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8080	1434	59.92.190.128	192.168.2.16
05/08/24-08:41:38.347776	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	4000	1434	59.89.6.169	192.168.2.16
05/08/24-08:41:53.208250	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	41451	1434	222.141.122.93	192.168.2.16
05/08/24-08:42:11.861629	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	12729	1434	59.93.181.91	192.168.2.16
05/08/24-08:42:09.476037	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	52367	1434	61.3.178.191	192.168.2.16
05/08/24-08:41:47.339588	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	29452	1434	115.48.47.113	192.168.2.16
05/08/24-08:41:49.670047	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	1027	1434	59.184.51.207	192.168.2.16
05/08/24-08:42:05.472530	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	10251	1434	178.72.81.26	192.168.2.16
05/08/24-08:42:09.512932	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	32763	1434	117.50.73.202	192.168.2.16
05/08/24-08:41:38.607333	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	13453	1434	178.72.75.89	192.168.2.16
05/08/24-08:42:10.568308	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	43441	1434	221.14.63.43	192.168.2.16
05/08/24-08:42:09.585875	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	1434	1434	186.148.245.61	192.168.2.16
05/08/24-08:42:17.529815	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	7246	1434	123.12.14.51	192.168.2.16
05/08/24-08:42:23.880595	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	3356	1434	42.229.137.3	192.168.2.16
05/08/24-08:42:19.126809	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	5060	1434	219.156.35.200	192.168.2.16
05/08/24-08:42:22.439623	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	4000	1434	117.204.200.151	192.168.2.16
05/08/24-08:42:24.125495	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	4000	1434	59.93.182.53	192.168.2.16
05/08/24-08:42:23.373784	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	2356	1434	178.72.71.230	192.168.2.16
05/08/24-08:42:16.507208	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	46488	1434	117.241.110.40	192.168.2.16
05/08/24-08:42:21.982090	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8081	1434	117.204.197.182	192.168.2.16
05/08/24-08:41:59.203632	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	25605	1434	27.158.92.99	192.168.2.16
05/08/24-08:42:03.611174	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	43763	1434	117.204.198.82	192.168.2.16
05/08/24-08:41:51.339721	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8081	1434	117.204.207.97	192.168.2.16
05/08/24-08:41:54.482365	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	1027	1434	117.204.207.60	192.168.2.16
05/08/24-08:41:51.469527	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	63208	1434	117.197.24.81	192.168.2.16
05/08/24-08:41:38.624532	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	6881	1434	117.205.143.103	192.168.2.16
05/08/24-08:42:24.508559	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	40246	1434	27.215.45.174	192.168.2.16
05/08/24-08:42:17.166306	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8081	1434	222.138.201.95	192.168.2.16
05/08/24-08:42:25.786703	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	26162	1434	112.229.214.51	192.168.2.16
05/08/24-08:41:54.743483	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	50348	1434	117.194.215.155	192.168.2.16
05/08/24-08:42:10.052074	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	4909	1434	61.52.83.122	192.168.2.16
05/08/24-08:42:20.927317	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8083	1434	119.115.240.145	192.168.2.16
05/08/24-08:42:21.143980	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	18568	1434	120.85.113.6	192.168.2.16
05/08/24-08:42:02.249860	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	15551	1434	117.201.7.203	192.168.2.16
05/08/24-08:41:42.916072	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	50494	1434	182.121.207.64	192.168.2.16
05/08/24-08:42:14.239834	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8081	1434	47.76.76.152	192.168.2.16
05/08/24-08:41:47.507432	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	5353	1434	117.248.22.80	192.168.2.16
05/08/24-08:42:19.752662	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	5060	1434	45.119.84.144	192.168.2.16
05/08/24-08:41:41.917341	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	6881	1434	59.184.54.156	192.168.2.16
05/08/24-08:42:15.041266	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	10420	1434	27.215.47.70	192.168.2.16
05/08/24-08:42:12.574743	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	55510	1434	120.61.23.226	192.168.2.16
05/08/24-08:41:51.868166	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	5353	1434	117.217.63.12	192.168.2.16
05/08/24-08:41:59.902365	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	4203	1434	59.99.130.139	192.168.2.16
05/08/24-08:41:52.909259	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8082	1434	117.235.148.106	192.168.2.16
05/08/24-08:42:16.391423	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	16885	1434	120.85.112.45	192.168.2.16
05/08/24-08:42:18.824417	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	5787	1434	120.27.131.41	192.168.2.16
05/08/24-08:42:05.474104	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	6581	1434	178.72.69.255	192.168.2.16
05/08/24-08:41:58.308146	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	35307	1434	117.194.210.197	192.168.2.16
05/08/24-08:41:50.851210	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8082	1434	117.212.18.86	192.168.2.16
05/08/24-08:42:18.723370	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	10588	1434	27.47.3.23	192.168.2.16
05/08/24-08:42:15.001164	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	6583	1434	178.72.68.170	192.168.2.16
05/08/24-08:42:24.061078	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	62790	1434	117.206.189.66	192.168.2.16
05/08/24-08:42:10.869456	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	61120	1434	80.202.217.118	192.168.2.16
05/08/24-08:42:21.522320	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8000	1434	175.30.113.242	192.168.2.16
05/08/24-08:42:16.348443	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8483	1434	178.72.77.22	192.168.2.16
05/08/24-08:41:58.310027	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	62949	1434	117.201.13.21	192.168.2.16
05/08/24-08:42:14.759892	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	9710	1434	103.131.60.178	192.168.2.16
05/08/24-08:42:06.854013	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8083	1434	59.92.179.251	192.168.2.16
05/08/24-08:42:23.828289	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	63688	1434	117.204.206.154	192.168.2.16
05/08/24-08:42:20.349000	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8083	1434	59.184.52.84	192.168.2.16
05/08/24-08:42:15.256955	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	44356	1434	39.90.144.47	192.168.2.16
05/08/24-08:42:13.735835	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	64339	1434	42.86.156.64	192.168.2.16
05/08/24-08:41:53.404903	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	59181	1434	117.215.214.232	192.168.2.16
05/08/24-08:41:38.537709	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	38822	1434	59.92.42.81	192.168.2.16
05/08/24-08:41:45.269226	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8081	1434	117.206.188.187	192.168.2.16
05/08/24-08:41:30.786053	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8080	1434	59.99.139.221	192.168.2.16
05/08/24-08:41:54.778688	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	29009	1434	123.129.154.98	192.168.2.16
05/08/24-08:41:57.197554	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	17588	1434	42.239.171.195	192.168.2.16
05/08/24-08:41:41.026036	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	5695	1434	59.93.188.218	192.168.2.16
05/08/24-08:41:42.931995	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8081	1434	117.207.75.211	192.168.2.16
05/08/24-08:42:06.534653	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	19320	1434	117.211.213.60	192.168.2.16
05/08/24-08:42:24.205323	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	30734	1434	83.97.73.228	192.168.2.16
05/08/24-08:41:41.876191	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	1027	1434	117.211.208.253	192.168.2.16
05/08/24-08:41:52.079295	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	1848	1434	42.235.172.106	192.168.2.16
05/08/24-08:41:55.575695	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	21446	1434	123.59.105.78	192.168.2.16
05/08/24-08:41:25.268569	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	1168	1434	178.72.88.220	192.168.2.16
05/08/24-08:42:24.307076	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	39913	1434	59.99.143.204	192.168.2.16
05/08/24-08:42:03.607556	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	55599	1434	110.182.250.177	192.168.2.16
05/08/24-08:41:59.838610	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	6881	1434	182.243.157.74	192.168.2.16
05/08/24-08:42:22.919861	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	30301	1434	117.199.7.99	192.168.2.16
05/08/24-08:41:42.908732	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	30301	1434	58.47.26.195	192.168.2.16
05/08/24-08:41:34.104354	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	14219	1434	117.204.202.127	192.168.2.16
05/08/24-08:41:55.587429	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8000	1434	113.221.31.88	192.168.2.16
05/08/24-08:41:31.858058	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	29605	1434	117.193.80.25	192.168.2.16
05/08/24-08:42:11.879944	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	55534	1434	117.217.83.91	192.168.2.16
05/08/24-08:41:48.471471	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	1905	1434	186.148.245.178	192.168.2.16
05/08/24-08:42:05.517647	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8779	1434	59.93.180.177	192.168.2.16
05/08/24-08:41:43.063823	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	4000	1434	59.91.188.62	192.168.2.16
05/08/24-08:42:03.961660	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	62593	1434	61.53.148.24	192.168.2.16
05/08/24-08:42:02.174451	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8082	1434	125.45.9.61	192.168.2.16
05/08/24-08:42:15.051322	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	5144	1434	117.204.205.154	192.168.2.16
05/08/24-08:41:26.219816	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8083	1434	47.107.92.35	192.168.2.16
05/08/24-08:42:28.723243	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	1027	1434	123.129.129.98	192.168.2.16
05/08/24-08:42:16.104300	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	20300	1434	115.55.237.202	192.168.2.16
05/08/24-08:42:35.370835	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	43493	1434	117.204.196.25	192.168.2.16
05/08/24-08:41:50.095507	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	5060	1434	119.179.255.119	192.168.2.16
05/08/24-08:42:19.898234	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	2462	1434	59.92.189.24	192.168.2.16
05/08/24-08:42:28.055836	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	51240	1434	125.47.102.58	192.168.2.16
05/08/24-08:42:24.380127	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	17521	1434	1.10.212.38	192.168.2.16
05/08/24-08:41:57.467822	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	51456	1434	42.57.236.253	192.168.2.16
05/08/24-08:42:25.327800	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8080	1434	42.235.166.108	192.168.2.16
05/08/24-08:41:53.431541	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	5353	1434	115.55.241.78	192.168.2.16
05/08/24-08:42:23.990277	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	40231	1434	117.242.192.132	192.168.2.16
05/08/24-08:42:09.954207	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	9294	1434	117.211.213.151	192.168.2.16
05/08/24-08:42:22.443197	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	1027	1434	117.199.77.72	192.168.2.16
05/08/24-08:42:21.560486	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	29721	1434	182.112.54.173	192.168.2.16
05/08/24-08:41:58.304386	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	31290	1434	117.204.197.93	192.168.2.16
05/08/24-08:41:52.770279	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	7607	1434	178.141.154.0	192.168.2.16
05/08/24-08:42:05.369784	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8083	1434	117.199.6.158	192.168.2.16
05/08/24-08:42:10.423051	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	25966	1434	117.213.114.81	192.168.2.16
05/08/24-08:42:11.882654	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	6548	1434	59.96.165.229	192.168.2.16
05/08/24-08:42:08.151739	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	13672	1434	61.3.89.151	192.168.2.16
05/08/24-08:42:01.362948	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	47145	1434	178.141.160.235	192.168.2.16
05/08/24-08:41:34.384963	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	3496	1434	178.72.68.90	192.168.2.16
05/08/24-08:42:22.547430	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	9007	1434	188.150.231.39	192.168.2.16
05/08/24-08:41:40.842275	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	13733	1434	1.70.169.208	192.168.2.16
05/08/24-08:42:03.561049	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	25843	1434	27.37.112.79	192.168.2.16
05/08/24-08:42:13.320734	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	43455	1434	61.3.185.160	192.168.2.16
05/08/24-08:42:24.877004	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	23490	1434	125.27.181.199	192.168.2.16
05/08/24-08:42:22.006240	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8000	1434	117.202.75.204	192.168.2.16
05/08/24-08:41:39.136328	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8000	1434	42.4.109.110	192.168.2.16
05/08/24-08:42:26.160561	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	11256	1434	42.235.96.85	192.168.2.16
05/08/24-08:42:24.038414	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	27854	1434	59.89.192.210	192.168.2.16
05/08/24-08:41:35.222859	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	28547	1434	38.137.0.22	192.168.2.16
05/08/24-08:42:01.656602	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	48112	1434	27.215.140.205	192.168.2.16
05/08/24-08:42:08.520896	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	6881	1434	117.199.9.115	192.168.2.16
05/08/24-08:42:23.999173	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8080	1434	117.252.166.58	192.168.2.16
05/08/24-08:41:48.001272	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	1812	1434	117.206.135.24	192.168.2.16
05/08/24-08:41:53.561613	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	59635	1434	112.239.101.154	192.168.2.16
05/08/24-08:41:37.486874	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	37235	1434	61.52.134.158	192.168.2.16
05/08/24-08:41:50.967361	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	23326	1434	221.15.146.215	192.168.2.16
05/08/24-08:42:24.198435	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	47086	1434	114.218.141.66	192.168.2.16
05/08/24-08:41:29.806832	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	5060	1434	117.204.201.17	192.168.2.16
05/08/24-08:41:34.119772	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	62110	1434	117.204.192.234	192.168.2.16
05/08/24-08:41:36.486849	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	40772	1434	190.109.229.181	192.168.2.16
05/08/24-08:42:14.641042	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	14291	1434	186.148.245.209	192.168.2.16
05/08/24-08:41:35.187018	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	20997	1434	1.10.147.64	192.168.2.16
05/08/24-08:41:42.026685	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8000	1434	117.235.78.163	192.168.2.16
05/08/24-08:42:05.515675	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	1027	1434	117.204.200.193	192.168.2.16
05/08/24-08:42:13.551541	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	40234	1434	221.15.77.222	192.168.2.16
05/08/24-08:41:51.885986	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	3600	1434	182.114.228.16	192.168.2.16
05/08/24-08:42:11.799162	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	15328	1434	125.41.245.135	192.168.2.16
05/08/24-08:42:27.830549	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	27808	1434	120.85.112.88	192.168.2.16
05/08/24-08:41:38.530812	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	1900	1434	178.141.142.251	192.168.2.16
05/08/24-08:41:35.121037	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	4000	1434	111.70.31.106	192.168.2.16
05/08/24-08:41:36.674675	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	30495	1434	61.0.9.172	192.168.2.16
05/08/24-08:41:54.724543	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	30301	1434	117.204.196.16	192.168.2.16
05/08/24-08:42:24.299052	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	51405	1434	117.204.205.182	192.168.2.16
05/08/24-08:42:14.103766	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	6736	1434	137.175.46.64	192.168.2.16
05/08/24-08:42:20.731520	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	5060	1434	123.13.53.84	192.168.2.16
05/08/24-08:42:18.045595	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	30784	1434	42.234.243.115	192.168.2.16
05/08/24-08:42:20.804238	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	34324	1434	117.199.77.246	192.168.2.16
05/08/24-08:41:49.861583	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	3277	1434	117.242.142.105	192.168.2.16
05/08/24-08:41:57.569867	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	63412	1434	117.220.109.13	192.168.2.16
05/08/24-08:42:04.880708	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8000	1434	117.199.79.80	192.168.2.16
05/08/24-08:41:49.155911	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8000	1434	117.204.207.91	192.168.2.16
05/08/24-08:42:23.633285	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	42954	1434	1.10.212.37	192.168.2.16
05/08/24-08:42:10.451729	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	51040	1434	115.60.250.85	192.168.2.16
05/08/24-08:42:18.554558	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	5353	1434	176.193.204.236	192.168.2.16
05/08/24-08:42:11.793097	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	6881	1434	218.61.110.165	192.168.2.16
05/08/24-08:41:56.578383	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8081	1434	115.63.15.46	192.168.2.16
05/08/24-08:41:34.033274	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	5060	1434	222.246.209.22	192.168.2.16
05/08/24-08:42:00.793680	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	44716	1434	61.3.83.110	192.168.2.16
05/08/24-08:42:02.829321	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	25450	1434	1.10.212.36	192.168.2.16
05/08/24-08:41:36.707324	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	22004	1434	117.204.199.199	192.168.2.16
05/08/24-08:41:48.586492	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	24563	1434	117.220.151.41	192.168.2.16
05/08/24-08:42:04.893432	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8698	1434	59.88.216.46	192.168.2.16
05/08/24-08:42:16.545846	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	56641	1434	182.116.120.31	192.168.2.16
05/08/24-08:41:31.874478	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8082	1434	117.204.193.44	192.168.2.16
05/08/24-08:42:23.255371	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	6485	1434	59.93.181.224	192.168.2.16
05/08/24-08:41:38.539613	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8082	1434	61.1.146.173	192.168.2.16
05/08/24-08:42:10.350891	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8083	1434	182.116.12.99	192.168.2.16
05/08/24-08:41:37.337594	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	18566	1434	61.52.225.131	192.168.2.16
05/08/24-08:41:59.079495	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	2330	1434	210.10.131.189	192.168.2.16
05/08/24-08:41:34.072117	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	44911	1434	178.141.246.164	192.168.2.16
05/08/24-08:42:22.775914	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	15289	1434	117.216.247.154	192.168.2.16
05/08/24-08:42:09.969622	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	27477	1434	59.96.165.172	192.168.2.16
05/08/24-08:42:25.703688	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	15656	1434	125.45.71.29	192.168.2.16
05/08/24-08:41:55.817366	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	58685	1434	61.52.55.159	192.168.2.16
05/08/24-08:42:09.948347	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	30301	1434	115.96.142.129	192.168.2.16
05/08/24-08:41:59.803718	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	24761	1434	61.53.92.85	192.168.2.16
05/08/24-08:42:23.080594	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8081	1434	42.177.198.181	192.168.2.16
05/08/24-08:42:02.382724	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	26378	1434	59.88.125.203	192.168.2.16
05/08/24-08:41:52.671731	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	25895	1434	182.96.200.243	192.168.2.16
05/08/24-08:42:14.497355	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	28609	1434	93.84.86.104	192.168.2.16
05/08/24-08:42:13.430972	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	5060	1434	112.248.191.194	192.168.2.16
05/08/24-08:42:24.915692	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	3064	1434	1.10.212.35	192.168.2.16
05/08/24-08:42:24.996582	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	11211	1434	102.219.60.62	192.168.2.16
05/08/24-08:42:02.263550	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8081	1434	117.252.206.57	192.168.2.16
05/08/24-08:41:35.396740	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	30600	1434	117.211.223.31	192.168.2.16
05/08/24-08:41:48.572689	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	1434	1434	117.194.169.133	192.168.2.16
05/08/24-08:42:27.661934	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	26072	1434	120.85.113.138	192.168.2.16
05/08/24-08:42:23.520399	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	1027	1434	117.206.177.107	192.168.2.16
05/08/24-08:41:40.680201	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	30907	1434	42.54.146.165	192.168.2.16
05/08/24-08:42:10.209554	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	24720	1434	182.126.246.55	192.168.2.16
05/08/24-08:41:38.526052	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	5353	1434	117.204.198.192	192.168.2.16
05/08/24-08:41:41.822217	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	10388	1434	122.155.0.70	192.168.2.16
05/08/24-08:42:09.861414	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	51754	1434	222.138.79.171	192.168.2.16
05/08/24-08:41:45.124874	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	33981	1434	112.248.246.123	192.168.2.16
05/08/24-08:42:24.520670	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8717	1434	1.10.212.36	192.168.2.16
05/08/24-08:42:15.205485	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	21545	1434	115.48.148.224	192.168.2.16
05/08/24-08:41:57.448985	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8081	1434	175.31.169.95	192.168.2.16
05/08/24-08:42:11.334511	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	4000	1434	119.179.251.57	192.168.2.16
05/08/24-08:41:34.108540	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	56757	1434	117.198.26.118	192.168.2.16
05/08/24-08:41:37.354644	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	60614	1434	42.224.0.233	192.168.2.16
05/08/24-08:41:46.249655	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	17433	1434	1.215.138.43	192.168.2.16
05/08/24-08:42:08.023076	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	65494	1434	117.216.64.146	192.168.2.16
05/08/24-08:41:25.188606	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	4221	1434	178.72.68.44	192.168.2.16
05/08/24-08:42:24.559261	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	43361	1434	1.10.212.34	192.168.2.16
05/08/24-08:41:40.075477	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	4000	1434	219.157.58.43	192.168.2.16
05/08/24-08:42:12.824152	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	61227	1434	59.184.57.0	192.168.2.16
05/08/24-08:42:23.465011	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8080	1434	59.93.30.134	192.168.2.16
05/08/24-08:41:41.867402	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	52384	1434	117.215.212.67	192.168.2.16
05/08/24-08:41:36.336260	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	41547	1434	59.89.207.116	192.168.2.16
05/08/24-08:42:24.689121	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	4000	1434	219.157.136.69	192.168.2.16
05/08/24-08:42:16.736797	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	45784	1434	125.43.88.225	192.168.2.16
05/08/24-08:41:37.491235	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	11489	1434	59.99.138.62	192.168.2.16
05/08/24-08:41:49.038289	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8083	1434	123.185.49.90	192.168.2.16
05/08/24-08:41:48.754826	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	52002	1434	222.139.77.245	192.168.2.16
05/08/24-08:42:04.932077	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	42715	1434	115.60.251.49	192.168.2.16
05/08/24-08:42:25.546941	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	64402	1434	1.10.212.37	192.168.2.16
05/08/24-08:41:28.846819	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	45756	1434	178.141.226.116	192.168.2.16
05/08/24-08:41:41.416806	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	30301	1434	42.226.73.189	192.168.2.16
05/08/24-08:41:43.714453	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	5353	1434	59.98.28.250	192.168.2.16
05/08/24-08:42:01.965488	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	36181	1434	59.89.5.185	192.168.2.16
05/08/24-08:42:10.917696	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	5060	1434	117.204.196.54	192.168.2.16
05/08/24-08:42:21.170544	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	25070	1434	186.148.245.183	192.168.2.16
05/08/24-08:41:45.217871	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	21444	1434	59.93.18.150	192.168.2.16
05/08/24-08:41:42.897675	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	18235	1434	81.182.184.141	192.168.2.16
05/08/24-08:41:45.193813	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	17145	1434	182.59.50.30	192.168.2.16
05/08/24-08:42:10.517604	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	30301	1434	117.204.200.89	192.168.2.16
05/08/24-08:42:23.712096	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	22967	1434	117.206.180.199	192.168.2.16
05/08/24-08:42:16.322120	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8082	1434	117.201.10.133	192.168.2.16
05/08/24-08:41:34.350598	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	50235	1434	117.200.176.213	192.168.2.16
05/08/24-08:41:52.794510	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	4429	1434	178.72.78.46	192.168.2.16
05/08/24-08:42:01.947055	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	28162	1434	42.224.117.97	192.168.2.16
05/08/24-08:41:59.258721	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	9221	1434	59.98.30.191	192.168.2.16
05/08/24-08:41:48.482212	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	30872	1434	115.50.26.45	192.168.2.16
05/08/24-08:42:19.613353	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	61544	1434	59.89.4.237	192.168.2.16
05/08/24-08:41:36.492848	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	10226	1434	178.72.70.129	192.168.2.16
05/08/24-08:42:17.074733	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	30301	1434	124.234.219.207	192.168.2.16
05/08/24-08:41:49.223058	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	25089	1434	117.204.207.242	192.168.2.16
05/08/24-08:42:23.590625	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	4000	1434	119.183.15.96	192.168.2.16
05/08/24-08:41:45.118240	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	13570	1434	27.157.170.250	192.168.2.16
05/08/24-08:42:13.609117	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	50587	1434	59.92.202.217	192.168.2.16
05/08/24-08:42:23.999934	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	24364	1434	61.0.206.146	192.168.2.16
05/08/24-08:42:05.759122	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	4000	1434	115.51.28.98	192.168.2.16
05/08/24-08:41:35.550643	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	57356	1434	117.204.197.108	192.168.2.16
05/08/24-08:42:24.295541	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8000	1434	117.204.198.55	192.168.2.16
05/08/24-08:41:30.804908	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	30301	1434	117.248.61.132	192.168.2.16
05/08/24-08:42:20.208233	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	17607	1434	188.149.142.208	192.168.2.16
05/08/24-08:41:44.266392	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	60648	1434	219.154.173.51	192.168.2.16
05/08/24-08:41:58.309376	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	29299	1434	117.204.203.159	192.168.2.16
05/08/24-08:42:15.350721	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	4631	1434	1.10.212.34	192.168.2.16
05/08/24-08:42:02.978866	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	41451	1434	42.236.221.163	192.168.2.16
05/08/24-08:41:38.564083	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	6881	1434	120.63.221.76	192.168.2.16
05/08/24-08:42:27.388450	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	5353	1434	182.127.39.107	192.168.2.16
05/08/24-08:42:12.287763	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	50064	1434	175.174.72.130	192.168.2.16
05/08/24-08:42:14.965881	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	18040	1434	125.47.226.54	192.168.2.16
05/08/24-08:42:25.534257	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	6881	1434	39.89.216.141	192.168.2.16
05/08/24-08:42:16.353484	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	1027	1434	182.60.2.75	192.168.2.16
05/08/24-08:41:35.198095	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	1434	1434	117.204.201.41	192.168.2.16
05/08/24-08:41:53.792821	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	25886	1434	59.93.189.20	192.168.2.16
05/08/24-08:41:48.474328	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	4000	1434	58.47.104.176	192.168.2.16
05/08/24-08:42:15.002851	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	5416	1434	178.72.76.17	192.168.2.16
05/08/24-08:41:49.661562	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	19426	1434	117.204.197.94	192.168.2.16
05/08/24-08:41:35.886642	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	7659	1434	37.255.208.94	192.168.2.16
05/08/24-08:41:39.928216	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8082	1434	182.56.169.191	192.168.2.16
05/08/24-08:41:46.261649	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	2547	1434	120.85.117.166	192.168.2.16
05/08/24-08:41:38.629683	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	11593	1434	117.242.236.98	192.168.2.16
05/08/24-08:42:21.152823	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8080	1434	117.215.223.233	192.168.2.16
05/08/24-08:42:25.482660	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	6881	1434	115.63.188.170	192.168.2.16
05/08/24-08:41:30.666638	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	5353	1434	115.201.152.228	192.168.2.16
05/08/24-08:42:15.277409	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8081	1434	39.73.69.176	192.168.2.16
05/08/24-08:42:17.623970	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	49456	1434	117.217.43.183	192.168.2.16
05/08/24-08:41:47.434337	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	25287	1434	117.206.142.219	192.168.2.16
05/08/24-08:41:55.701123	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	30301	1434	117.248.23.3	192.168.2.16
05/08/24-08:42:06.882312	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	1367	1434	120.86.254.163	192.168.2.16
05/08/24-08:41:36.333042	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	4000	1434	117.205.61.150	192.168.2.16
05/08/24-08:41:42.333656	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	11753	1434	117.220.147.13	192.168.2.16
05/08/24-08:41:43.603694	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	65175	1434	112.242.167.52	192.168.2.16
05/08/24-08:42:24.203579	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8000	1434	59.173.71.223	192.168.2.16
05/08/24-08:41:58.254800	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	21216	1434	120.85.115.216	192.168.2.16
05/08/24-08:42:09.031541	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8000	1434	59.93.186.55	192.168.2.16
05/08/24-08:42:06.639101	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	4811	1434	120.86.254.251	192.168.2.16
05/08/24-08:42:08.856777	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8083	1434	178.141.59.111	192.168.2.16
05/08/24-08:42:24.262427	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	4000	1434	59.93.180.51	192.168.2.16
05/08/24-08:41:33.145413	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8000	1434	87.253.4.0	192.168.2.16
05/08/24-08:41:45.322695	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	36598	1434	117.204.206.245	192.168.2.16
05/08/24-08:42:07.485386	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	5060	1434	115.61.18.2	192.168.2.16
05/08/24-08:42:00.556520	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	1027	1434	200.111.102.27	192.168.2.16
05/08/24-08:42:08.075299	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	1027	1434	115.63.48.21	192.168.2.16
05/08/24-08:41:58.323036	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	46118	1434	117.207.74.83	192.168.2.16
05/08/24-08:41:50.802898	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	1900	1434	123.194.35.224	192.168.2.16
05/08/24-08:41:34.711246	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	4856	1434	117.202.65.13	192.168.2.16
05/08/24-08:41:44.292222	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	2530	1434	178.72.75.250	192.168.2.16
05/08/24-08:41:48.477565	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	30918	1434	42.53.37.6	192.168.2.16
05/08/24-08:42:19.833678	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	11256	1434	182.126.86.152	192.168.2.16
05/08/24-08:42:08.618428	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	5060	1434	59.89.0.87	192.168.2.16
05/08/24-08:42:23.992174	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	30301	1434	117.63.241.203	192.168.2.16
05/08/24-08:41:37.447879	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	51774	1434	59.184.50.233	192.168.2.16
05/08/24-08:42:07.511145	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	15152	1434	117.252.203.248	192.168.2.16
05/08/24-08:41:58.799571	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	26763	1434	120.56.12.238	192.168.2.16
05/08/24-08:41:45.122184	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	6881	1434	222.140.182.46	192.168.2.16
05/08/24-08:42:22.789538	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	30301	1434	59.89.70.144	192.168.2.16
05/08/24-08:41:51.814148	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	7452	1434	42.230.216.234	192.168.2.16
05/08/24-08:41:53.752598	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	6463	1434	178.72.81.202	192.168.2.16
05/08/24-08:42:25.521377	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	10615	1434	182.120.15.189	192.168.2.16
05/08/24-08:41:41.886382	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	27297	1434	117.204.195.230	192.168.2.16
05/08/24-08:41:46.339161	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	17999	1434	59.93.20.87	192.168.2.16
05/08/24-08:42:11.408179	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	20895	1434	117.204.204.167	192.168.2.16
05/08/24-08:42:26.656229	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	62491	1434	115.48.155.200	192.168.2.16
05/08/24-08:42:06.802142	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	7614	1434	222.137.122.31	192.168.2.16
05/08/24-08:41:49.868530	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	25601	1434	113.246.16.130	192.168.2.16
05/08/24-08:42:14.297039	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8082	1434	188.149.139.44	192.168.2.16
05/08/24-08:41:35.480190	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8648	1434	1.10.212.38	192.168.2.16
05/08/24-08:42:12.631552	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	57674	1434	209.59.113.249	192.168.2.16
05/08/24-08:42:24.145821	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	23589	1434	59.178.16.198	192.168.2.16
05/08/24-08:42:08.523652	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	55861	1434	120.61.23.171	192.168.2.16
05/08/24-08:42:13.901134	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	4266	1434	1.10.212.38	192.168.2.16
05/08/24-08:42:24.334701	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	5353	1434	61.2.104.221	192.168.2.16
05/08/24-08:41:53.897835	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	5516	1434	112.248.114.227	192.168.2.16
05/08/24-08:42:18.570523	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	62851	1434	60.246.138.175	192.168.2.16
05/08/24-08:41:34.132972	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	4000	1434	117.208.100.100	192.168.2.16
05/08/24-08:41:54.657409	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	4087	1434	120.85.114.246	192.168.2.16
05/08/24-08:41:55.747861	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	1027	1434	117.243.247.148	192.168.2.16
05/08/24-08:42:20.836362	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	1792	1434	95.32.210.253	192.168.2.16
05/08/24-08:42:23.990230	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8000	1434	123.14.214.241	192.168.2.16
05/08/24-08:41:44.034805	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	46440	1434	42.86.126.69	192.168.2.16
05/08/24-08:42:07.356889	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	32075	1434	120.85.183.175	192.168.2.16
05/08/24-08:41:45.197112	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	1027	1434	117.217.48.133	192.168.2.16
05/08/24-08:42:22.465497	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	4000	1434	59.89.67.166	192.168.2.16
05/08/24-08:42:12.429967	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	46505	1434	42.230.159.161	192.168.2.16
05/08/24-08:41:38.518054	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	48066	1434	119.185.58.10	192.168.2.16
05/08/24-08:42:17.920857	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8082	1434	117.217.82.79	192.168.2.16
05/08/24-08:42:15.923350	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	38751	1434	121.227.165.70	192.168.2.16
05/08/24-08:41:49.861144	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	5060	1434	106.56.48.164	192.168.2.16
05/08/24-08:42:02.581151	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	1027	1434	59.93.29.166	192.168.2.16
05/08/24-08:41:42.998033	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	51242	1434	117.204.206.250	192.168.2.16
05/08/24-08:41:50.116793	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8080	1434	59.93.28.1	192.168.2.16
05/08/24-08:41:52.738206	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	30301	1434	182.120.46.143	192.168.2.16
05/08/24-08:41:32.991547	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	30653	1434	59.92.44.255	192.168.2.16
05/08/24-08:42:22.477018	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	11431	1434	117.253.220.76	192.168.2.16
05/08/24-08:42:11.433396	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	30203	1434	123.9.198.179	192.168.2.16
05/08/24-08:42:05.171077	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	30372	1434	1.70.176.235	192.168.2.16
05/08/24-08:42:10.602711	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	1027	1434	42.225.207.69	192.168.2.16
05/08/24-08:41:32.986466	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	30040	1434	59.89.206.19	192.168.2.16
05/08/24-08:41:46.305576	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8080	1434	113.221.27.96	192.168.2.16
05/08/24-08:41:54.801375	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	20906	1434	59.92.179.20	192.168.2.16
05/08/24-08:42:14.260713	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8082	1434	60.6.211.248	192.168.2.16
05/08/24-08:41:46.377520	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	5499	1434	175.10.89.226	192.168.2.16
05/08/24-08:42:17.667458	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	1027	1434	59.92.180.163	192.168.2.16
05/08/24-08:42:01.508542	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	13296	1434	59.99.133.21	192.168.2.16
05/08/24-08:42:06.534078	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	21817	1434	42.239.134.227	192.168.2.16
05/08/24-08:41:42.132727	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	54564	1434	42.234.244.67	192.168.2.16
05/08/24-08:42:24.314016	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	5060	1434	117.252.34.202	192.168.2.16
05/08/24-08:42:09.190093	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	52118	1434	59.89.69.112	192.168.2.16
05/08/24-08:41:45.523911	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	9134	1434	27.215.82.209	192.168.2.16
05/08/24-08:42:12.863147	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	38803	1434	117.252.169.124	192.168.2.16
05/08/24-08:41:44.135490	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8081	1434	178.141.230.54	192.168.2.16
05/08/24-08:42:11.898775	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	12691	1434	117.248.63.69	192.168.2.16
05/08/24-08:42:15.001873	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	5353	1434	178.141.229.85	192.168.2.16
05/08/24-08:42:17.073824	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	4000	1434	59.93.181.222	192.168.2.16
05/08/24-08:42:07.124389	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	3060	1434	1.10.212.37	192.168.2.16
05/08/24-08:42:23.791630	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	63388	1434	117.253.221.8	192.168.2.16
05/08/24-08:41:42.538085	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	54463	1434	117.204.196.76	192.168.2.16
05/08/24-08:42:10.914665	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	53901	1434	117.204.206.98	192.168.2.16
05/08/24-08:41:40.872593	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	23323	1434	59.89.1.112	192.168.2.16
05/08/24-08:41:39.675000	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	1027	1434	59.184.54.5	192.168.2.16
05/08/24-08:41:56.443865	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	20342	1434	117.204.207.18	192.168.2.16
05/08/24-08:41:35.501190	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	40576	1434	117.248.19.154	192.168.2.16
05/08/24-08:42:24.941232	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	40207	1434	1.10.212.37	192.168.2.16
05/08/24-08:41:30.681410	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	10386	1434	223.13.63.131	192.168.2.16
05/08/24-08:41:39.238558	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	1027	1434	123.4.78.94	192.168.2.16
05/08/24-08:42:05.556530	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	6881	1434	117.254.62.134	192.168.2.16
05/08/24-08:42:17.028592	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	46999	1434	42.232.209.229	192.168.2.16
05/08/24-08:41:46.324423	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	18361	1434	117.204.202.74	192.168.2.16
05/08/24-08:42:06.181531	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8081	1434	59.99.136.56	192.168.2.16
05/08/24-08:41:49.751323	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	6881	1434	113.239.64.251	192.168.2.16
05/08/24-08:42:01.534289	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	48928	1434	117.204.202.141	192.168.2.16
05/08/24-08:41:59.140440	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	19570	1434	117.248.55.248	192.168.2.16
05/08/24-08:42:18.034407	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	5060	1434	117.204.194.232	192.168.2.16
05/08/24-08:41:49.682049	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	38606	1434	61.1.145.203	192.168.2.16
05/08/24-08:42:09.955035	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	5353	1434	117.204.199.81	192.168.2.16
05/08/24-08:41:56.253633	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	39033	1434	59.88.185.45	192.168.2.16
05/08/24-08:41:49.699571	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8080	1434	113.230.80.68	192.168.2.16
05/08/24-08:42:19.957447	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	55101	1434	221.1.225.65	192.168.2.16
05/08/24-08:41:57.408764	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	28879	1434	223.13.61.70	192.168.2.16
05/08/24-08:42:05.797015	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	48388	1434	112.248.188.197	192.168.2.16
05/08/24-08:41:48.081168	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	1027	1434	112.239.98.243	192.168.2.16
05/08/24-08:42:22.463056	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8083	1434	45.189.207.241	192.168.2.16
05/08/24-08:42:16.109576	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	44318	1434	117.219.90.178	192.168.2.16
05/08/24-08:42:05.692922	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	30301	1434	116.111.31.44	192.168.2.16
05/08/24-08:41:46.473271	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	48456	1434	117.200.93.30	192.168.2.16
05/08/24-08:41:37.346619	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	60464	1434	222.142.251.75	192.168.2.16
05/08/24-08:42:24.577040	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	65505	1434	115.51.45.104	192.168.2.16
05/08/24-08:42:22.936330	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8083	1434	117.205.63.20	192.168.2.16
05/08/24-08:42:19.109322	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	30203	1434	27.215.137.232	192.168.2.16
05/08/24-08:41:53.902012	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	52485	1434	59.89.6.89	192.168.2.16
05/08/24-08:42:08.844678	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	64407	1434	125.43.243.149	192.168.2.16
05/08/24-08:42:17.600915	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8000	1434	182.116.118.157	192.168.2.16
05/08/24-08:42:09.420684	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	3592	1434	178.141.37.160	192.168.2.16
05/08/24-08:42:06.201288	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8081	1434	59.93.181.149	192.168.2.16
05/08/24-08:42:16.312307	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	21320	1434	117.199.79.175	192.168.2.16
05/08/24-08:42:27.582929	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	1027	1434	115.55.248.136	192.168.2.16
05/08/24-08:42:17.293884	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8488	1434	178.72.81.211	192.168.2.16
05/08/24-08:42:09.249608	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	20348	1434	117.255.92.148	192.168.2.16
05/08/24-08:42:16.107676	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	21988	1434	123.8.67.82	192.168.2.16
05/08/24-08:42:20.256334	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	20352	1434	117.212.163.173	192.168.2.16
05/08/24-08:41:41.896373	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	44609	1434	117.213.81.219	192.168.2.16
05/08/24-08:42:09.920822	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	21168	1434	49.234.57.41	192.168.2.16
05/08/24-08:41:59.008816	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	31215	1434	164.163.25.146	192.168.2.16
05/08/24-08:42:24.137168	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	1027	1434	59.93.180.61	192.168.2.16
05/08/24-08:41:46.199235	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8083	1434	117.60.101.203	192.168.2.16
05/08/24-08:42:23.791028	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	6881	1434	117.199.79.96	192.168.2.16
05/08/24-08:42:24.485160	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8267	1434	120.211.222.79	192.168.2.16
05/08/24-08:41:52.835168	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8000	1434	117.253.217.232	192.168.2.16
05/08/24-08:41:41.791189	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	43260	1434	115.58.85.247	192.168.2.16
05/08/24-08:42:13.242471	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	4000	1434	42.5.53.19	192.168.2.16
05/08/24-08:42:16.864263	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	41346	1434	106.112.179.121	192.168.2.16
05/08/24-08:42:09.999371	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	10470	1434	1.10.212.34	192.168.2.16
05/08/24-08:42:00.026527	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	5634	1434	178.141.33.56	192.168.2.16
05/08/24-08:41:40.703649	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	55732	1434	175.146.231.173	192.168.2.16
05/08/24-08:42:23.263795	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	28409	1434	182.124.201.173	192.168.2.16
05/08/24-08:42:11.303197	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	6881	1434	85.215.242.168	192.168.2.16
05/08/24-08:41:43.754248	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	5353	1434	115.58.155.116	192.168.2.16
05/08/24-08:42:19.861989	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	30301	1434	117.248.48.99	192.168.2.16
05/08/24-08:42:24.165021	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	6881	1434	59.182.146.73	192.168.2.16
05/08/24-08:42:10.407414	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	19307	1434	123.10.213.191	192.168.2.16
05/08/24-08:42:03.563935	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	64257	1434	42.177.196.181	192.168.2.16
05/08/24-08:42:15.252452	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	1434	1434	178.141.158.194	192.168.2.16
05/08/24-08:42:07.096353	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	11256	1434	39.81.255.243	192.168.2.16
05/08/24-08:42:12.036859	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	49521	1434	178.141.129.252	192.168.2.16
05/08/24-08:42:01.335699	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	28409	1434	221.15.240.248	192.168.2.16
05/08/24-08:42:24.208867	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8000	1434	117.192.123.219	192.168.2.16
05/08/24-08:41:58.189558	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8083	1434	164.163.25.241	192.168.2.16
05/08/24-08:42:16.309163	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	11211	1434	124.7.139.186	192.168.2.16
05/08/24-08:41:41.892287	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	59301	1434	117.252.206.190	192.168.2.16
05/08/24-08:42:28.727772	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	28784	1434	1.10.212.36	192.168.2.16
05/08/24-08:41:44.106362	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	48376	1434	117.199.15.116	192.168.2.16
05/08/24-08:41:56.547295	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8083	1434	223.8.217.59	192.168.2.16
05/08/24-08:41:59.901656	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8080	1434	117.216.16.221	192.168.2.16
05/08/24-08:42:04.275411	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	1737	1434	59.88.183.47	192.168.2.16
05/08/24-08:42:25.138208	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	44255	1434	42.228.43.79	192.168.2.16
05/08/24-08:41:48.634816	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	55583	1434	117.222.254.212	192.168.2.16
05/08/24-08:41:52.899232	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	11211	1434	117.206.180.21	192.168.2.16
05/08/24-08:42:06.110909	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	1497	1434	115.60.18.173	192.168.2.16
05/08/24-08:41:37.414378	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8082	1434	117.217.58.52	192.168.2.16
05/08/24-08:41:44.021767	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	5353	1434	42.224.29.185	192.168.2.16
05/08/24-08:42:17.288765	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8083	1434	42.239.238.196	192.168.2.16
05/08/24-08:42:25.599931	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	21407	1434	125.43.35.59	192.168.2.16
05/08/24-08:41:56.637450	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	11211	1434	59.184.76.78	192.168.2.16
05/08/24-08:41:36.385048	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	1027	1434	59.89.125.248	192.168.2.16
05/08/24-08:42:03.610613	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8080	1434	59.184.68.106	192.168.2.16
05/08/24-08:42:23.618487	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	20957	1434	117.220.31.184	192.168.2.16
05/08/24-08:42:24.315129	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	123	1434	222.127.147.207	192.168.2.16
05/08/24-08:42:10.538438	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8081	1434	59.89.71.209	192.168.2.16
05/08/24-08:42:10.494899	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	6881	1434	117.215.213.211	192.168.2.16
05/08/24-08:42:07.690047	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	45784	1434	115.56.97.102	192.168.2.16
05/08/24-08:41:49.671590	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	6881	1434	117.252.40.22	192.168.2.16
05/08/24-08:41:53.823069	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	45920	1434	112.239.22.116	192.168.2.16
05/08/24-08:42:04.879656	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	24853	1434	117.204.196.255	192.168.2.16
05/08/24-08:42:23.818319	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	58178	1434	42.235.40.58	192.168.2.16
05/08/24-08:42:23.654958	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	47625	1434	117.211.211.241	192.168.2.16
05/08/24-08:41:47.426512	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	6881	1434	59.93.186.197	192.168.2.16
05/08/24-08:42:26.090394	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	27591	1434	39.49.26.52	192.168.2.16
05/08/24-08:42:04.879791	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	59628	1434	117.204.193.20	192.168.2.16
05/08/24-08:42:12.858435	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8082	1434	61.2.81.125	192.168.2.16
05/08/24-08:41:31.863837	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	6881	1434	117.204.200.143	192.168.2.16
05/08/24-08:42:05.685459	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	2151	1434	42.230.219.43	192.168.2.16
05/08/24-08:42:35.299737	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	4830	1434	120.85.93.151	192.168.2.16
05/08/24-08:41:33.086966	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	34806	1434	59.89.69.122	192.168.2.16
05/08/24-08:42:06.731806	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	30301	1434	198.16.58.241	192.168.2.16
05/08/24-08:41:57.466340	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8082	1434	115.50.56.115	192.168.2.16
05/08/24-08:41:46.009251	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	23412	1434	124.131.132.95	192.168.2.16
05/08/24-08:42:23.086510	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	60062	1434	59.89.204.198	192.168.2.16
05/08/24-08:42:09.193530	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	4000	1434	59.92.161.26	192.168.2.16
05/08/24-08:41:51.137582	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	1434	1434	109.108.218.34	192.168.2.16
05/08/24-08:41:40.534682	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	4000	1434	123.130.186.62	192.168.2.16
05/08/24-08:41:54.668508	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	28409	1434	221.14.112.172	192.168.2.16
05/08/24-08:41:36.309502	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	21861	1434	117.204.199.213	192.168.2.16
05/08/24-08:42:17.858425	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	41705	1434	123.175.92.230	192.168.2.16
05/08/24-08:41:47.422652	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8000	1434	117.204.202.223	192.168.2.16
05/08/24-08:41:31.958347	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8083	1434	117.204.203.68	192.168.2.16
05/08/24-08:41:49.899942	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	31161	1434	182.112.40.209	192.168.2.16
05/08/24-08:42:23.962708	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8080	1434	123.9.102.125	192.168.2.16
05/08/24-08:41:50.777678	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	38183	1434	117.204.200.144	192.168.2.16
05/08/24-08:41:34.932066	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	7429	1434	39.187.67.68	192.168.2.16
05/08/24-08:41:46.227589	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	5060	1434	123.8.16.239	192.168.2.16
05/08/24-08:42:16.810894	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	16728	1434	117.216.245.142	192.168.2.16
05/08/24-08:41:56.435897	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	30301	1434	125.25.174.221	192.168.2.16
05/08/24-08:42:19.678826	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	57131	1434	59.93.181.185	192.168.2.16
05/08/24-08:42:23.368262	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	5060	1434	27.209.150.45	192.168.2.16
05/08/24-08:42:26.593278	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	5060	1434	123.5.148.230	192.168.2.16
05/08/24-08:42:22.905231	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	56061	1434	182.123.194.161	192.168.2.16
05/08/24-08:41:57.554023	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	4375	1434	175.175.188.249	192.168.2.16
05/08/24-08:42:12.040044	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	1027	1434	117.196.45.191	192.168.2.16
05/08/24-08:41:49.357784	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	30301	1434	120.56.9.158	192.168.2.16
05/08/24-08:41:42.929529	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	11211	1434	113.26.82.43	192.168.2.16
05/08/24-08:42:14.707304	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	4770	1434	59.178.92.49	192.168.2.16
05/08/24-08:42:35.294676	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	9489	1434	120.85.183.32	192.168.2.16
05/08/24-08:41:56.553980	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	60648	1434	119.179.238.174	192.168.2.16
05/08/24-08:41:32.959448	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	45334	1434	117.204.192.67	192.168.2.16
05/08/24-08:42:20.350427	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	6445	1434	178.72.71.146	192.168.2.16
05/08/24-08:42:21.014162	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	1434	1434	117.252.174.76	192.168.2.16
05/08/24-08:42:04.913404	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8082	1434	182.60.4.213	192.168.2.16
05/08/24-08:42:26.776116	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8082	1434	123.14.35.111	192.168.2.16
05/08/24-08:41:55.587265	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	1027	1434	27.215.212.142	192.168.2.16
05/08/24-08:41:56.647544	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	65459	1434	117.204.192.110	192.168.2.16
05/08/24-08:41:35.633617	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8081	1434	117.201.11.68	192.168.2.16
05/08/24-08:41:56.656572	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	63764	1434	113.228.150.105	192.168.2.16
05/08/24-08:42:16.704633	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	20654	1434	120.57.220.81	192.168.2.16
05/08/24-08:41:49.317128	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	1900	1434	117.253.214.191	192.168.2.16

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 8, 2024 08:41:19.484241962 CEST	49706	2121	192.168.2.16	202.141.230.46
May 8, 2024 08:41:19.484242916 CEST	49707	21	192.168.2.16	88.3.252.23
May 8, 2024 08:41:19.484282970 CEST	49705	21	192.168.2.16	202.141.230.46
May 8, 2024 08:41:19.485271931 CEST	49708	21	192.168.2.16	187.232.63.30
May 8, 2024 08:41:19.485488892 CEST	49709	2121	192.168.2.16	187.232.63.30
May 8, 2024 08:41:19.485620975 CEST	49710	2121	192.168.2.16	88.3.252.23
May 8, 2024 08:41:19.485743046 CEST	49711	21	192.168.2.16	88.138.242.230
May 8, 2024 08:41:19.486382008 CEST	49712	2121	192.168.2.16	88.138.242.230
May 8, 2024 08:41:19.487008095 CEST	49713	21	192.168.2.16	117.3.236.203
May 8, 2024 08:41:19.487124920 CEST	49714	2121	192.168.2.16	117.3.236.203
May 8, 2024 08:41:19.487884998 CEST	49715	21	192.168.2.16	220.174.66.41
May 8, 2024 08:41:19.488184929 CEST	49716	2121	192.168.2.16	220.174.66.41
May 8, 2024 08:41:19.488734007 CEST	49717	21	192.168.2.16	190.199.135.222
May 8, 2024 08:41:19.489767075 CEST	49718	2121	192.168.2.16	190.199.135.222
May 8, 2024 08:41:19.490166903 CEST	49719	21	192.168.2.16	20.27.129.45
May 8, 2024 08:41:19.490577936 CEST	49720	2121	192.168.2.16	20.27.129.45
May 8, 2024 08:41:19.491120100 CEST	49721	21	192.168.2.16	45.225.213.66
May 8, 2024 08:41:19.491527081 CEST	49722	2121	192.168.2.16	45.225.213.66
May 8, 2024 08:41:19.491560936 CEST	49723	21	192.168.2.16	98.144.80.128
May 8, 2024 08:41:19.492063046 CEST	49724	2121	192.168.2.16	98.144.80.128
May 8, 2024 08:41:19.492506027 CEST	49725	21	192.168.2.16	51.241.196.118
May 8, 2024 08:41:19.492882013 CEST	49726	2121	192.168.2.16	51.241.196.118
May 8, 2024 08:41:19.493124008 CEST	49727	21	192.168.2.16	119.176.139.75
May 8, 2024 08:41:19.493920088 CEST	49728	2121	192.168.2.16	119.176.139.75
May 8, 2024 08:41:19.493962049 CEST	49729	21	192.168.2.16	38.38.120.85
May 8, 2024 08:41:19.494405031 CEST	49730	2121	192.168.2.16	38.38.120.85
May 8, 2024 08:41:19.494528055 CEST	49731	21	192.168.2.16	187.137.19.229
May 8, 2024 08:41:19.495181084 CEST	49732	2121	192.168.2.16	187.137.19.229
May 8, 2024 08:41:19.495676041 CEST	49733	21	192.168.2.16	109.130.248.23
May 8, 2024 08:41:19.495954990 CEST	49734	2121	192.168.2.16	109.130.248.23
May 8, 2024 08:41:19.496591091 CEST	49735	21	192.168.2.16	34.128.248.69
May 8, 2024 08:41:19.496963024 CEST	49736	2121	192.168.2.16	34.128.248.69
May 8, 2024 08:41:19.497340918 CEST	49737	21	192.168.2.16	121.132.64.213
May 8, 2024 08:41:19.497684002 CEST	49738	2121	192.168.2.16	121.132.64.213
May 8, 2024 08:41:19.498414993 CEST	49739	21	192.168.2.16	20.99.154.51
May 8, 2024 08:41:19.498867035 CEST	49740	2121	192.168.2.16	20.99.154.51
May 8, 2024 08:41:19.499649048 CEST	49741	2121	192.168.2.16	122.17.56.127
May 8, 2024 08:41:19.499914885 CEST	49742	21	192.168.2.16	122.17.56.127
May 8, 2024 08:41:19.500184059 CEST	49743	21	192.168.2.16	60.137.216.231
May 8, 2024 08:41:19.501355886 CEST	49744	2121	192.168.2.16	60.137.216.231
May 8, 2024 08:41:19.501369953 CEST	49745	21	192.168.2.16	174.49.126.122
May 8, 2024 08:41:19.502268076 CEST	49746	21	192.168.2.16	217.73.16.9
May 8, 2024 08:41:19.502518892 CEST	49747	2121	192.168.2.16	217.73.16.9
May 8, 2024 08:41:19.502824068 CEST	49748	21	192.168.2.16	72.240.221.220
May 8, 2024 08:41:19.502840996 CEST	49749	2121	192.168.2.16	174.49.126.122
May 8, 2024 08:41:19.503247023 CEST	49750	2121	192.168.2.16	72.240.221.220
May 8, 2024 08:41:19.504128933 CEST	49751	21	192.168.2.16	122.234.24.202
May 8, 2024 08:41:19.504280090 CEST	49752	2121	192.168.2.16	122.234.24.202
May 8, 2024 08:41:19.504834890 CEST	49753	21	192.168.2.16	134.130.247.222
May 8, 2024 08:41:19.505229950 CEST	49754	2121	192.168.2.16	134.130.247.222
May 8, 2024 08:41:19.505494118 CEST	49755	21	192.168.2.16	92.252.102.247
May 8, 2024 08:41:19.506027937 CEST	49756	2121	192.168.2.16	92.252.102.247
May 8, 2024 08:41:19.506464005 CEST	49757	21	192.168.2.16	40.88.10.206
May 8, 2024 08:41:19.506918907 CEST	49758	2121	192.168.2.16	40.88.10.206
May 8, 2024 08:41:19.507477045 CEST	49759	21	192.168.2.16	107.184.133.230
May 8, 2024 08:41:19.507599115 CEST	49760	2121	192.168.2.16	107.184.133.230
May 8, 2024 08:41:19.508136988 CEST	49761	21	192.168.2.16	185.35.189.48
May 8, 2024 08:41:19.508650064 CEST	49762	2121	192.168.2.16	185.35.189.48
May 8, 2024 08:41:19.509213924 CEST	49763	21	192.168.2.16	173.93.196.30
May 8, 2024 08:41:19.509643078 CEST	49764	2121	192.168.2.16	173.93.196.30
May 8, 2024 08:41:19.509813070 CEST	49765	21	192.168.2.16	106.203.218.54
May 8, 2024 08:41:19.510514021 CEST	49766	2121	192.168.2.16	106.203.218.54
May 8, 2024 08:41:19.511008024 CEST	49767	21	192.168.2.16	207.148.31.31
May 8, 2024 08:41:19.511424065 CEST	49768	2121	192.168.2.16	207.148.31.31
May 8, 2024 08:41:19.511581898 CEST	49769	21	192.168.2.16	60.141.44.63
May 8, 2024 08:41:19.512248039 CEST	49770	2121	192.168.2.16	60.141.44.63
May 8, 2024 08:41:19.512840986 CEST	49771	21	192.168.2.16	126.55.113.199
May 8, 2024 08:41:19.513258934 CEST	49772	2121	192.168.2.16	126.55.113.199
May 8, 2024 08:41:19.513410091 CEST	49773	21	192.168.2.16	68.6.178.222
May 8, 2024 08:41:19.514084101 CEST	49774	2121	192.168.2.16	68.6.178.222
May 8, 2024 08:41:19.514827013 CEST	49775	21	192.168.2.16	76.184.71.237
May 8, 2024 08:41:19.514955997 CEST	49776	2121	192.168.2.16	76.184.71.237
May 8, 2024 08:41:19.515301943 CEST	49777	21	192.168.2.16	180.195.247.176
May 8, 2024 08:41:19.516139984 CEST	49778	2121	192.168.2.16	180.195.247.176
May 8, 2024 08:41:19.516535997 CEST	49779	21	192.168.2.16	75.68.30.94
May 8, 2024 08:41:19.516952991 CEST	49780	21	192.168.2.16	221.2.50.105
May 8, 2024 08:41:19.517075062 CEST	49781	2121	192.168.2.16	75.68.30.94
May 8, 2024 08:41:19.518285036 CEST	49782	2121	192.168.2.16	221.2.50.105
May 8, 2024 08:41:19.518405914 CEST	49783	21	192.168.2.16	113.13.157.160
May 8, 2024 08:41:19.518644094 CEST	49784	2121	192.168.2.16	113.13.157.160
May 8, 2024 08:41:19.519315958 CEST	49785	2121	192.168.2.16	112.144.219.240
May 8, 2024 08:41:19.519445896 CEST	49786	21	192.168.2.16	112.144.219.240
May 8, 2024 08:41:19.519890070 CEST	49787	21	192.168.2.16	222.138.218.131
May 8, 2024 08:41:19.519978046 CEST	49788	2121	192.168.2.16	222.138.218.131
May 8, 2024 08:41:19.520589113 CEST	49789	21	192.168.2.16	24.63.48.54
May 8, 2024 08:41:19.521289110 CEST	49790	2121	192.168.2.16	24.63.48.54
May 8, 2024 08:41:19.521744013 CEST	49791	21	192.168.2.16	59.41.145.142
May 8, 2024 08:41:19.522072077 CEST	49792	2121	192.168.2.16	59.41.145.142
May 8, 2024 08:41:19.522684097 CEST	49793	21	192.168.2.16	117.10.175.148
May 8, 2024 08:41:19.522787094 CEST	49794	2121	192.168.2.16	117.10.175.148
May 8, 2024 08:41:19.523325920 CEST	49795	21	192.168.2.16	87.16.29.239
May 8, 2024 08:41:19.523785114 CEST	49796	21	192.168.2.16	84.176.189.204
May 8, 2024 08:41:19.524043083 CEST	49797	2121	192.168.2.16	84.176.189.204
May 8, 2024 08:41:19.524629116 CEST	49798	21	192.168.2.16	174.61.242.178
May 8, 2024 08:41:19.524682045 CEST	49799	2121	192.168.2.16	87.16.29.239
May 8, 2024 08:41:19.526540995 CEST	49800	21	192.168.2.16	58.232.199.163
May 8, 2024 08:41:19.526592016 CEST	49801	2121	192.168.2.16	174.61.242.178
May 8, 2024 08:41:19.526659966 CEST	49802	2121	192.168.2.16	58.232.199.163
May 8, 2024 08:41:19.527378082 CEST	49803	21	192.168.2.16	182.35.245.77
May 8, 2024 08:41:19.527848005 CEST	49804	2121	192.168.2.16	182.35.245.77
May 8, 2024 08:41:19.527993917 CEST	49805	21	192.168.2.16	213.37.158.68
May 8, 2024 08:41:19.528707027 CEST	49806	2121	192.168.2.16	213.37.158.68
May 8, 2024 08:41:19.529200077 CEST	49807	2121	192.168.2.16	112.252.80.62
May 8, 2024 08:41:19.529913902 CEST	49808	21	192.168.2.16	59.14.157.129
May 8, 2024 08:41:19.530056953 CEST	49809	21	192.168.2.16	112.252.80.62
May 8, 2024 08:41:19.530183077 CEST	49810	2121	192.168.2.16	59.14.157.129
May 8, 2024 08:41:19.530745029 CEST	49811	21	192.168.2.16	23.12.109.151
May 8, 2024 08:41:19.531172037 CEST	49812	2121	192.168.2.16	23.12.109.151
May 8, 2024 08:41:19.533037901 CEST	49813	2121	192.168.2.16	72.10.97.97
May 8, 2024 08:41:19.533302069 CEST	49814	21	192.168.2.16	107.174.245.116
May 8, 2024 08:41:19.533349037 CEST	49815	21	192.168.2.16	72.10.97.97
May 8, 2024 08:41:19.534147024 CEST	49816	2121	192.168.2.16	107.174.245.116
May 8, 2024 08:41:19.534507036 CEST	49817	21	192.168.2.16	120.92.55.9
May 8, 2024 08:41:19.535191059 CEST	49818	2121	192.168.2.16	120.92.55.9
May 8, 2024 08:41:19.535921097 CEST	49819	2121	192.168.2.16	83.58.227.82
May 8, 2024 08:41:19.536021948 CEST	49820	21	192.168.2.16	83.58.227.82
May 8, 2024 08:41:19.536367893 CEST	49821	21	192.168.2.16	189.178.166.57
May 8, 2024 08:41:19.537252903 CEST	49822	2121	192.168.2.16	189.178.166.57
May 8, 2024 08:41:19.537743092 CEST	49823	21	192.168.2.16	74.101.156.83
May 8, 2024 08:41:19.538417101 CEST	49824	2121	192.168.2.16	67.9.27.76
May 8, 2024 08:41:19.538878918 CEST	49825	21	192.168.2.16	67.9.27.76
May 8, 2024 08:41:19.539145947 CEST	49826	2121	192.168.2.16	74.101.156.83
May 8, 2024 08:41:19.539474010 CEST	49827	21	192.168.2.16	125.132.197.159
May 8, 2024 08:41:19.540515900 CEST	49828	2121	192.168.2.16	125.132.197.159
May 8, 2024 08:41:19.540576935 CEST	49829	21	192.168.2.16	2.219.242.97
May 8, 2024 08:41:19.540904999 CEST	49830	2121	192.168.2.16	2.219.242.97
May 8, 2024 08:41:19.541696072 CEST	49831	21	192.168.2.16	67.2.29.149
May 8, 2024 08:41:19.542174101 CEST	49832	2121	192.168.2.16	67.2.29.149
May 8, 2024 08:41:19.542928934 CEST	49833	2121	192.168.2.16	72.253.222.60
May 8, 2024 08:41:19.543013096 CEST	49834	21	192.168.2.16	72.253.222.60
May 8, 2024 08:41:19.543734074 CEST	49835	21	192.168.2.16	189.188.209.240
May 8, 2024 08:41:19.543979883 CEST	49836	2121	192.168.2.16	189.188.209.240
May 8, 2024 08:41:19.544337988 CEST	49837	2121	192.168.2.16	124.48.8.141
May 8, 2024 08:41:19.544424057 CEST	49838	21	192.168.2.16	124.48.8.141
May 8, 2024 08:41:19.544487000 CEST	49839	21	192.168.2.16	98.27.54.26
May 8, 2024 08:41:19.544895887 CEST	49840	2121	192.168.2.16	98.27.54.26
May 8, 2024 08:41:19.545084000 CEST	49841	21	192.168.2.16	126.78.5.163
May 8, 2024 08:41:19.545562983 CEST	49842	2121	192.168.2.16	126.78.5.163
May 8, 2024 08:41:19.545708895 CEST	49843	21	192.168.2.16	179.247.85.29
May 8, 2024 08:41:19.546103001 CEST	49844	2121	192.168.2.16	179.247.85.29
May 8, 2024 08:41:19.546727896 CEST	49845	21	192.168.2.16	1.28.158.199
May 8, 2024 08:41:19.547002077 CEST	49846	2121	192.168.2.16	1.28.158.199
May 8, 2024 08:41:19.549963951 CEST	49847	21	192.168.2.16	46.167.107.13
May 8, 2024 08:41:19.550204039 CEST	49848	2121	192.168.2.16	46.167.107.13
May 8, 2024 08:41:19.550503016 CEST	49849	21	192.168.2.16	73.79.84.228
May 8, 2024 08:41:19.551018953 CEST	49850	2121	192.168.2.16	73.79.84.228
May 8, 2024 08:41:19.551265955 CEST	49851	21	192.168.2.16	221.224.127.141
May 8, 2024 08:41:19.551615953 CEST	49852	2121	192.168.2.16	221.224.127.141
May 8, 2024 08:41:19.551830053 CEST	49853	21	192.168.2.16	8.139.140.192
May 8, 2024 08:41:19.552314997 CEST	49854	2121	192.168.2.16	8.139.140.192
May 8, 2024 08:41:19.552706957 CEST	49855	21	192.168.2.16	200.127.5.88
May 8, 2024 08:41:19.552937031 CEST	49856	2121	192.168.2.16	200.127.5.88
May 8, 2024 08:41:19.553298950 CEST	49857	21	192.168.2.16	79.33.67.53
May 8, 2024 08:41:19.553594112 CEST	49858	2121	192.168.2.16	79.33.67.53
May 8, 2024 08:41:19.553950071 CEST	49859	21	192.168.2.16	197.15.64.148
May 8, 2024 08:41:19.554339886 CEST	49860	2121	192.168.2.16	197.15.64.148
May 8, 2024 08:41:19.554603100 CEST	49861	21	192.168.2.16	94.9.112.206
May 8, 2024 08:41:19.554905891 CEST	49862	2121	192.168.2.16	94.9.112.206
May 8, 2024 08:41:19.555264950 CEST	49863	21	192.168.2.16	39.129.73.19
May 8, 2024 08:41:19.555509090 CEST	49864	2121	192.168.2.16	39.129.73.19
May 8, 2024 08:41:19.555803061 CEST	49865	21	192.168.2.16	23.229.188.101
May 8, 2024 08:41:19.556140900 CEST	49866	2121	192.168.2.16	23.229.188.101
May 8, 2024 08:41:19.556531906 CEST	49867	21	192.168.2.16	137.184.114.51
May 8, 2024 08:41:19.556683064 CEST	49868	2121	192.168.2.16	137.184.114.51
May 8, 2024 08:41:19.557063103 CEST	49869	21	192.168.2.16	59.80.54.225
May 8, 2024 08:41:19.557483912 CEST	49870	2121	192.168.2.16	59.80.54.225
May 8, 2024 08:41:19.557566881 CEST	49871	21	192.168.2.16	72.192.14.127
May 8, 2024 08:41:19.557993889 CEST	49872	2121	192.168.2.16	72.192.14.127
May 8, 2024 08:41:19.558401108 CEST	49873	21	192.168.2.16	178.157.90.142
May 8, 2024 08:41:19.558609962 CEST	49874	2121	192.168.2.16	178.157.90.142
May 8, 2024 08:41:19.558885098 CEST	49875	21	192.168.2.16	221.200.218.169
May 8, 2024 08:41:19.559060097 CEST	49876	2121	192.168.2.16	221.200.218.169
May 8, 2024 08:41:19.559484005 CEST	49877	21	192.168.2.16	124.132.191.24
May 8, 2024 08:41:19.559767008 CEST	49878	2121	192.168.2.16	124.132.191.24
May 8, 2024 08:41:19.560031891 CEST	49879	21	192.168.2.16	84.194.9.127
May 8, 2024 08:41:19.560348034 CEST	49880	2121	192.168.2.16	84.194.9.127
May 8, 2024 08:41:19.560606003 CEST	49881	21	192.168.2.16	189.163.237.97
May 8, 2024 08:41:19.560951948 CEST	49882	2121	192.168.2.16	189.163.237.97
May 8, 2024 08:41:19.561269045 CEST	49883	21	192.168.2.16	38.77.59.183
May 8, 2024 08:41:19.561537027 CEST	49884	2121	192.168.2.16	38.77.59.183
May 8, 2024 08:41:19.562047005 CEST	49885	21	192.168.2.16	61.77.52.76
May 8, 2024 08:41:19.562340021 CEST	49886	2121	192.168.2.16	61.77.52.76
May 8, 2024 08:41:19.562587023 CEST	49887	21	192.168.2.16	91.249.55.22
May 8, 2024 08:41:19.562824011 CEST	49888	2121	192.168.2.16	91.249.55.22
May 8, 2024 08:41:19.563183069 CEST	49889	21	192.168.2.16	124.90.159.99
May 8, 2024 08:41:19.563538074 CEST	49890	2121	192.168.2.16	124.90.159.99
May 8, 2024 08:41:19.564004898 CEST	49891	21	192.168.2.16	90.180.159.186
May 8, 2024 08:41:19.564157963 CEST	49892	2121	192.168.2.16	90.180.159.186
May 8, 2024 08:41:19.564409018 CEST	49893	21	192.168.2.16	20.89.42.33
May 8, 2024 08:41:19.564732075 CEST	49894	2121	192.168.2.16	20.89.42.33
May 8, 2024 08:41:19.565007925 CEST	49895	21	192.168.2.16	172.232.185.228
May 8, 2024 08:41:19.565408945 CEST	49896	2121	192.168.2.16	172.232.185.228
May 8, 2024 08:41:19.565759897 CEST	49897	21	192.168.2.16	196.210.0.111
May 8, 2024 08:41:19.566083908 CEST	49898	2121	192.168.2.16	196.210.0.111
May 8, 2024 08:41:19.566345930 CEST	49899	21	192.168.2.16	119.231.203.174
May 8, 2024 08:41:19.566524982 CEST	49900	2121	192.168.2.16	119.231.203.174
May 8, 2024 08:41:19.566998959 CEST	49901	21	192.168.2.16	216.183.51.214
May 8, 2024 08:41:19.567229986 CEST	49902	2121	192.168.2.16	216.183.51.214
May 8, 2024 08:41:19.567665100 CEST	49903	21	192.168.2.16	93.212.38.207
May 8, 2024 08:41:19.567923069 CEST	49904	2121	192.168.2.16	93.212.38.207
May 8, 2024 08:41:19.688370943 CEST	21	49729	38.38.120.85	192.168.2.16
May 8, 2024 08:41:19.688458920 CEST	49729	21	192.168.2.16	38.38.120.85
May 8, 2024 08:41:19.727631092 CEST	21	49895	172.232.185.228	192.168.2.16
May 8, 2024 08:41:19.727962971 CEST	2121	49896	172.232.185.228	192.168.2.16
May 8, 2024 08:41:19.737950087 CEST	2121	49868	137.184.114.51	192.168.2.16
May 8, 2024 08:41:19.739645004 CEST	21	49867	137.184.114.51	192.168.2.16
May 8, 2024 08:41:19.757514954 CEST	21	49865	23.229.188.101	192.168.2.16
May 8, 2024 08:41:19.757596970 CEST	49865	21	192.168.2.16	23.229.188.101
May 8, 2024 08:41:19.771646023 CEST	2121	49813	72.10.97.97	192.168.2.16
May 8, 2024 08:41:19.771792889 CEST	21	49815	72.10.97.97	192.168.2.16
May 8, 2024 08:41:19.800154924 CEST	21	49743	60.137.216.231	192.168.2.16
May 8, 2024 08:41:19.801443100 CEST	2121	49744	60.137.216.231	192.168.2.16
May 8, 2024 08:41:19.802716970 CEST	21	49717	190.199.135.222	192.168.2.16
May 8, 2024 08:41:19.804402113 CEST	2121	49718	190.199.135.222	192.168.2.16
May 8, 2024 08:41:19.805680037 CEST	21	49771	126.55.113.199	192.168.2.16
May 8, 2024 08:41:19.805937052 CEST	2121	49772	126.55.113.199	192.168.2.16
May 8, 2024 08:41:19.815702915 CEST	21	49751	122.234.24.202	192.168.2.16
May 8, 2024 08:41:19.820929050 CEST	2121	49752	122.234.24.202	192.168.2.16
May 8, 2024 08:41:19.824644089 CEST	21	49769	60.141.44.63	192.168.2.16
May 8, 2024 08:41:19.826571941 CEST	2121	49770	60.141.44.63	192.168.2.16
May 8, 2024 08:41:19.832906961 CEST	2121	49747	217.73.16.9	192.168.2.16
May 8, 2024 08:41:19.833197117 CEST	2121	49754	134.130.247.222	192.168.2.16
May 8, 2024 08:41:19.833381891 CEST	21	49746	217.73.16.9	192.168.2.16
May 8, 2024 08:41:19.837169886 CEST	21	49753	134.130.247.222	192.168.2.16
May 8, 2024 08:41:19.839123011 CEST	2121	49842	126.78.5.163	192.168.2.16
May 8, 2024 08:41:19.839139938 CEST	21	49841	126.78.5.163	192.168.2.16
May 8, 2024 08:41:19.851443052 CEST	21	49827	125.132.197.159	192.168.2.16
May 8, 2024 08:41:19.854912996 CEST	2121	49714	117.3.236.203	192.168.2.16
May 8, 2024 08:41:19.855740070 CEST	21	49713	117.3.236.203	192.168.2.16
May 8, 2024 08:41:19.856654882 CEST	2121	49804	182.35.245.77	192.168.2.16
May 8, 2024 08:41:19.856910944 CEST	2121	49828	125.132.197.159	192.168.2.16
May 8, 2024 08:41:19.870554924 CEST	2121	49837	124.48.8.141	192.168.2.16
May 8, 2024 08:41:19.876789093 CEST	2121	49886	61.77.52.76	192.168.2.16
May 8, 2024 08:41:19.879597902 CEST	21	49885	61.77.52.76	192.168.2.16
May 8, 2024 08:41:19.883102894 CEST	21	49729	38.38.120.85	192.168.2.16
May 8, 2024 08:41:19.883271933 CEST	49729	21	192.168.2.16	38.38.120.85
May 8, 2024 08:41:19.886040926 CEST	49905	21	192.168.2.16	185.18.133.19
May 8, 2024 08:41:19.924179077 CEST	21	49855	200.127.5.88	192.168.2.16
May 8, 2024 08:41:19.929076910 CEST	2121	49876	221.200.218.169	192.168.2.16
May 8, 2024 08:41:19.932866096 CEST	2121	49856	200.127.5.88	192.168.2.16
May 8, 2024 08:41:19.949549913 CEST	21	49843	179.247.85.29	192.168.2.16
May 8, 2024 08:41:19.949585915 CEST	2121	49844	179.247.85.29	192.168.2.16
May 8, 2024 08:41:19.950164080 CEST	21	49780	221.2.50.105	192.168.2.16
May 8, 2024 08:41:19.961549997 CEST	21	49865	23.229.188.101	192.168.2.16
May 8, 2024 08:41:19.961663961 CEST	49865	21	192.168.2.16	23.229.188.101
May 8, 2024 08:41:19.961971045 CEST	49906	2121	192.168.2.16	185.18.133.19
May 8, 2024 08:41:19.985120058 CEST	2121	49782	221.2.50.105	192.168.2.16
May 8, 2024 08:41:20.044683933 CEST	2121	49898	196.210.0.111	192.168.2.16
May 8, 2024 08:41:20.049263000 CEST	21	49897	196.210.0.111	192.168.2.16
May 8, 2024 08:41:20.049374104 CEST	49897	21	192.168.2.16	196.210.0.111
May 8, 2024 08:41:20.077765942 CEST	21	49729	38.38.120.85	192.168.2.16
May 8, 2024 08:41:20.077847958 CEST	49729	21	192.168.2.16	38.38.120.85
May 8, 2024 08:41:20.078213930 CEST	21	49729	38.38.120.85	192.168.2.16
May 8, 2024 08:41:20.078264952 CEST	49729	21	192.168.2.16	38.38.120.85
May 8, 2024 08:41:20.163573027 CEST	21	49865	23.229.188.101	192.168.2.16
May 8, 2024 08:41:20.163753033 CEST	49865	21	192.168.2.16	23.229.188.101
May 8, 2024 08:41:20.164513111 CEST	21	49865	23.229.188.101	192.168.2.16
May 8, 2024 08:41:20.164565086 CEST	49865	21	192.168.2.16	23.229.188.101
May 8, 2024 08:41:20.231826067 CEST	49896	2121	192.168.2.16	172.232.185.228
May 8, 2024 08:41:20.231827974 CEST	49895	21	192.168.2.16	172.232.185.228
May 8, 2024 08:41:20.247795105 CEST	49868	2121	192.168.2.16	137.184.114.51
May 8, 2024 08:41:20.247955084 CEST	49867	21	192.168.2.16	137.184.114.51
May 8, 2024 08:41:20.279799938 CEST	49815	21	192.168.2.16	72.10.97.97
May 8, 2024 08:41:20.280286074 CEST	49813	2121	192.168.2.16	72.10.97.97
May 8, 2024 08:41:20.311830044 CEST	49743	21	192.168.2.16	60.137.216.231
May 8, 2024 08:41:20.311830044 CEST	49717	21	192.168.2.16	190.199.135.222
May 8, 2024 08:41:20.311844110 CEST	49744	2121	192.168.2.16	60.137.216.231
May 8, 2024 08:41:20.311845064 CEST	49718	2121	192.168.2.16	190.199.135.222
May 8, 2024 08:41:20.311851978 CEST	49772	2121	192.168.2.16	126.55.113.199
May 8, 2024 08:41:20.311981916 CEST	49771	21	192.168.2.16	126.55.113.199
May 8, 2024 08:41:20.327826023 CEST	49769	21	192.168.2.16	60.141.44.63
May 8, 2024 08:41:20.327828884 CEST	49770	2121	192.168.2.16	60.141.44.63
May 8, 2024 08:41:20.329936981 CEST	49752	2121	192.168.2.16	122.234.24.202
May 8, 2024 08:41:20.329936981 CEST	49751	21	192.168.2.16	122.234.24.202
May 8, 2024 08:41:20.342802048 CEST	49754	2121	192.168.2.16	134.130.247.222
May 8, 2024 08:41:20.342820883 CEST	49746	21	192.168.2.16	217.73.16.9
May 8, 2024 08:41:20.342967033 CEST	49753	21	192.168.2.16	134.130.247.222
May 8, 2024 08:41:20.342967987 CEST	49842	2121	192.168.2.16	126.78.5.163
May 8, 2024 08:41:20.349785089 CEST	49747	2121	192.168.2.16	217.73.16.9
May 8, 2024 08:41:20.349977970 CEST	49841	21	192.168.2.16	126.78.5.163
May 8, 2024 08:41:20.358797073 CEST	49827	21	192.168.2.16	125.132.197.159
May 8, 2024 08:41:20.358870029 CEST	49828	2121	192.168.2.16	125.132.197.159
May 8, 2024 08:41:20.358875036 CEST	49804	2121	192.168.2.16	182.35.245.77
May 8, 2024 08:41:20.358875990 CEST	49713	21	192.168.2.16	117.3.236.203
May 8, 2024 08:41:20.358877897 CEST	49714	2121	192.168.2.16	117.3.236.203
May 8, 2024 08:41:20.374811888 CEST	49837	2121	192.168.2.16	124.48.8.141
May 8, 2024 08:41:20.390923023 CEST	49886	2121	192.168.2.16	61.77.52.76
May 8, 2024 08:41:20.390923977 CEST	49885	21	192.168.2.16	61.77.52.76
May 8, 2024 08:41:20.394234896 CEST	2121	49896	172.232.185.228	192.168.2.16
May 8, 2024 08:41:20.394265890 CEST	21	49895	172.232.185.228	192.168.2.16
May 8, 2024 08:41:20.431298971 CEST	2121	49868	137.184.114.51	192.168.2.16
May 8, 2024 08:41:20.433439016 CEST	21	49867	137.184.114.51	192.168.2.16
May 8, 2024 08:41:20.438807011 CEST	49876	2121	192.168.2.16	221.200.218.169
May 8, 2024 08:41:20.439661980 CEST	49856	2121	192.168.2.16	200.127.5.88
May 8, 2024 08:41:20.439662933 CEST	49855	21	192.168.2.16	200.127.5.88
May 8, 2024 08:41:20.454807043 CEST	49844	2121	192.168.2.16	179.247.85.29
May 8, 2024 08:41:20.455064058 CEST	49780	21	192.168.2.16	221.2.50.105
May 8, 2024 08:41:20.455107927 CEST	49843	21	192.168.2.16	179.247.85.29
May 8, 2024 08:41:20.486812115 CEST	49707	21	192.168.2.16	88.3.252.23
May 8, 2024 08:41:20.486813068 CEST	49709	2121	192.168.2.16	187.232.63.30
May 8, 2024 08:41:20.486813068 CEST	49782	2121	192.168.2.16	221.2.50.105
May 8, 2024 08:41:20.486813068 CEST	49706	2121	192.168.2.16	202.141.230.46
May 8, 2024 08:41:20.486825943 CEST	49705	21	192.168.2.16	202.141.230.46
May 8, 2024 08:41:20.486825943 CEST	49708	21	192.168.2.16	187.232.63.30
May 8, 2024 08:41:20.486826897 CEST	49710	2121	192.168.2.16	88.3.252.23
May 8, 2024 08:41:20.486886024 CEST	49712	2121	192.168.2.16	88.138.242.230
May 8, 2024 08:41:20.486891031 CEST	49711	21	192.168.2.16	88.138.242.230
May 8, 2024 08:41:20.501817942 CEST	49719	21	192.168.2.16	20.27.129.45
May 8, 2024 08:41:20.501817942 CEST	49722	2121	192.168.2.16	45.225.213.66
May 8, 2024 08:41:20.501817942 CEST	49716	2121	192.168.2.16	220.174.66.41
May 8, 2024 08:41:20.501832962 CEST	49727	21	192.168.2.16	119.176.139.75
May 8, 2024 08:41:20.501832962 CEST	49733	21	192.168.2.16	109.130.248.23
May 8, 2024 08:41:20.501836061 CEST	49721	21	192.168.2.16	45.225.213.66
May 8, 2024 08:41:20.501836061 CEST	49736	2121	192.168.2.16	34.128.248.69
May 8, 2024 08:41:20.501836061 CEST	49726	2121	192.168.2.16	51.241.196.118
May 8, 2024 08:41:20.501847029 CEST	49730	2121	192.168.2.16	38.38.120.85
May 8, 2024 08:41:20.501848936 CEST	49731	21	192.168.2.16	187.137.19.229
May 8, 2024 08:41:20.501852989 CEST	49723	21	192.168.2.16	98.144.80.128
May 8, 2024 08:41:20.501852989 CEST	49742	21	192.168.2.16	122.17.56.127
May 8, 2024 08:41:20.501861095 CEST	49720	2121	192.168.2.16	20.27.129.45
May 8, 2024 08:41:20.501861095 CEST	49724	2121	192.168.2.16	98.144.80.128
May 8, 2024 08:41:20.501863003 CEST	49732	2121	192.168.2.16	187.137.19.229
May 8, 2024 08:41:20.501866102 CEST	49715	21	192.168.2.16	220.174.66.41
May 8, 2024 08:41:20.501866102 CEST	49734	2121	192.168.2.16	109.130.248.23
May 8, 2024 08:41:20.501866102 CEST	49737	21	192.168.2.16	121.132.64.213
May 8, 2024 08:41:20.501873016 CEST	49725	21	192.168.2.16	51.241.196.118
May 8, 2024 08:41:20.501873016 CEST	49735	21	192.168.2.16	34.128.248.69
May 8, 2024 08:41:20.501883030 CEST	49728	2121	192.168.2.16	119.176.139.75
May 8, 2024 08:41:20.501902103 CEST	49739	21	192.168.2.16	20.99.154.51
May 8, 2024 08:41:20.501902103 CEST	49745	21	192.168.2.16	174.49.126.122
May 8, 2024 08:41:20.501902103 CEST	49740	2121	192.168.2.16	20.99.154.51
May 8, 2024 08:41:20.501903057 CEST	49738	2121	192.168.2.16	121.132.64.213
May 8, 2024 08:41:20.501902103 CEST	49741	2121	192.168.2.16	122.17.56.127
May 8, 2024 08:41:20.517833948 CEST	49756	2121	192.168.2.16	92.252.102.247
May 8, 2024 08:41:20.517833948 CEST	49750	2121	192.168.2.16	72.240.221.220
May 8, 2024 08:41:20.517833948 CEST	49748	21	192.168.2.16	72.240.221.220
May 8, 2024 08:41:20.517837048 CEST	49758	2121	192.168.2.16	40.88.10.206
May 8, 2024 08:41:20.517848969 CEST	49760	2121	192.168.2.16	107.184.133.230
May 8, 2024 08:41:20.517848969 CEST	49762	2121	192.168.2.16	185.35.189.48
May 8, 2024 08:41:20.517854929 CEST	49755	21	192.168.2.16	92.252.102.247
May 8, 2024 08:41:20.517858982 CEST	49759	21	192.168.2.16	107.184.133.230
May 8, 2024 08:41:20.517859936 CEST	49776	2121	192.168.2.16	76.184.71.237
May 8, 2024 08:41:20.517859936 CEST	49763	21	192.168.2.16	173.93.196.30
May 8, 2024 08:41:20.517854929 CEST	49757	21	192.168.2.16	40.88.10.206
May 8, 2024 08:41:20.517860889 CEST	49775	21	192.168.2.16	76.184.71.237
May 8, 2024 08:41:20.517854929 CEST	49749	2121	192.168.2.16	174.49.126.122
May 8, 2024 08:41:20.517860889 CEST	49768	2121	192.168.2.16	207.148.31.31
May 8, 2024 08:41:20.517854929 CEST	49764	2121	192.168.2.16	173.93.196.30
May 8, 2024 08:41:20.517863989 CEST	49774	2121	192.168.2.16	68.6.178.222
May 8, 2024 08:41:20.517864943 CEST	49766	2121	192.168.2.16	106.203.218.54
May 8, 2024 08:41:20.517867088 CEST	49778	2121	192.168.2.16	180.195.247.176
May 8, 2024 08:41:20.517863989 CEST	49765	21	192.168.2.16	106.203.218.54
May 8, 2024 08:41:20.517862082 CEST	49761	21	192.168.2.16	185.35.189.48
May 8, 2024 08:41:20.517891884 CEST	49767	21	192.168.2.16	207.148.31.31
May 8, 2024 08:41:20.517891884 CEST	49779	21	192.168.2.16	75.68.30.94
May 8, 2024 08:41:20.517891884 CEST	49781	2121	192.168.2.16	75.68.30.94
May 8, 2024 08:41:20.517894983 CEST	49773	21	192.168.2.16	68.6.178.222
May 8, 2024 08:41:20.517982960 CEST	49777	21	192.168.2.16	180.195.247.176
May 8, 2024 08:41:20.520004034 CEST	21	49815	72.10.97.97	192.168.2.16
May 8, 2024 08:41:20.520548105 CEST	2121	49813	72.10.97.97	192.168.2.16
May 8, 2024 08:41:20.533813953 CEST	49785	2121	192.168.2.16	112.144.219.240
May 8, 2024 08:41:20.533814907 CEST	49786	21	192.168.2.16	112.144.219.240
May 8, 2024 08:41:20.533816099 CEST	49787	21	192.168.2.16	222.138.218.131
May 8, 2024 08:41:20.533817053 CEST	49783	21	192.168.2.16	113.13.157.160
May 8, 2024 08:41:20.533837080 CEST	49799	2121	192.168.2.16	87.16.29.239
May 8, 2024 08:41:20.533838034 CEST	49796	21	192.168.2.16	84.176.189.204
May 8, 2024 08:41:20.533838987 CEST	49793	21	192.168.2.16	117.10.175.148
May 8, 2024 08:41:20.533838987 CEST	49790	2121	192.168.2.16	24.63.48.54
May 8, 2024 08:41:20.533839941 CEST	49792	2121	192.168.2.16	59.41.145.142
May 8, 2024 08:41:20.533839941 CEST	49789	21	192.168.2.16	24.63.48.54
May 8, 2024 08:41:20.533839941 CEST	49788	2121	192.168.2.16	222.138.218.131
May 8, 2024 08:41:20.533839941 CEST	49794	2121	192.168.2.16	117.10.175.148
May 8, 2024 08:41:20.533844948 CEST	49784	2121	192.168.2.16	113.13.157.160
May 8, 2024 08:41:20.533844948 CEST	49797	2121	192.168.2.16	84.176.189.204
May 8, 2024 08:41:20.533859968 CEST	49795	21	192.168.2.16	87.16.29.239
May 8, 2024 08:41:20.533859968 CEST	49806	2121	192.168.2.16	213.37.158.68
May 8, 2024 08:41:20.533859968 CEST	49808	21	192.168.2.16	59.14.157.129
May 8, 2024 08:41:20.533862114 CEST	49812	2121	192.168.2.16	23.12.109.151
May 8, 2024 08:41:20.533863068 CEST	49807	2121	192.168.2.16	112.252.80.62
May 8, 2024 08:41:20.533863068 CEST	49800	21	192.168.2.16	58.232.199.163
May 8, 2024 08:41:20.533864975 CEST	49791	21	192.168.2.16	59.41.145.142
May 8, 2024 08:41:20.533864975 CEST	49798	21	192.168.2.16	174.61.242.178
May 8, 2024 08:41:20.533864975 CEST	49809	21	192.168.2.16	112.252.80.62
May 8, 2024 08:41:20.533864975 CEST	49802	2121	192.168.2.16	58.232.199.163
May 8, 2024 08:41:20.533864975 CEST	49805	21	192.168.2.16	213.37.158.68
May 8, 2024 08:41:20.533891916 CEST	49810	2121	192.168.2.16	59.14.157.129
May 8, 2024 08:41:20.533891916 CEST	49801	2121	192.168.2.16	174.61.242.178
May 8, 2024 08:41:20.533891916 CEST	49803	21	192.168.2.16	182.35.245.77
May 8, 2024 08:41:20.533981085 CEST	49814	21	192.168.2.16	107.174.245.116
May 8, 2024 08:41:20.533981085 CEST	49811	21	192.168.2.16	23.12.109.151
May 8, 2024 08:41:20.549882889 CEST	49818	2121	192.168.2.16	120.92.55.9
May 8, 2024 08:41:20.549887896 CEST	49834	21	192.168.2.16	72.253.222.60
May 8, 2024 08:41:20.549887896 CEST	49817	21	192.168.2.16	120.92.55.9
May 8, 2024 08:41:20.549887896 CEST	49821	21	192.168.2.16	189.178.166.57
May 8, 2024 08:41:20.549890995 CEST	49820	21	192.168.2.16	83.58.227.82
May 8, 2024 08:41:20.549896002 CEST	49830	2121	192.168.2.16	2.219.242.97
May 8, 2024 08:41:20.549925089 CEST	49823	21	192.168.2.16	74.101.156.83
May 8, 2024 08:41:20.549925089 CEST	49825	21	192.168.2.16	67.9.27.76
May 8, 2024 08:41:20.549925089 CEST	49848	2121	192.168.2.16	46.167.107.13
May 8, 2024 08:41:20.549926996 CEST	49835	21	192.168.2.16	189.188.209.240
May 8, 2024 08:41:20.549927950 CEST	49839	21	192.168.2.16	98.27.54.26
May 8, 2024 08:41:20.549927950 CEST	49826	2121	192.168.2.16	74.101.156.83
May 8, 2024 08:41:20.549926996 CEST	49840	2121	192.168.2.16	98.27.54.26
May 8, 2024 08:41:20.549927950 CEST	49832	2121	192.168.2.16	67.2.29.149
May 8, 2024 08:41:20.549927950 CEST	49831	21	192.168.2.16	67.2.29.149
May 8, 2024 08:41:20.549931049 CEST	49898	2121	192.168.2.16	196.210.0.111
May 8, 2024 08:41:20.549926996 CEST	49845	21	192.168.2.16	1.28.158.199
May 8, 2024 08:41:20.549931049 CEST	49846	2121	192.168.2.16	1.28.158.199
May 8, 2024 08:41:20.549935102 CEST	49822	2121	192.168.2.16	189.178.166.57
May 8, 2024 08:41:20.549935102 CEST	49847	21	192.168.2.16	46.167.107.13
May 8, 2024 08:41:20.549935102 CEST	49849	21	192.168.2.16	73.79.84.228
May 8, 2024 08:41:20.551806927 CEST	49816	2121	192.168.2.16	107.174.245.116
May 8, 2024 08:41:20.551816940 CEST	49824	2121	192.168.2.16	67.9.27.76
May 8, 2024 08:41:20.551816940 CEST	49819	2121	192.168.2.16	83.58.227.82
May 8, 2024 08:41:20.551821947 CEST	49833	2121	192.168.2.16	72.253.222.60
May 8, 2024 08:41:20.551826954 CEST	49829	21	192.168.2.16	2.219.242.97
May 8, 2024 08:41:20.551841021 CEST	49836	2121	192.168.2.16	189.188.209.240
May 8, 2024 08:41:20.551841974 CEST	49838	21	192.168.2.16	124.48.8.141
May 8, 2024 08:41:20.553981066 CEST	49853	21	192.168.2.16	8.139.140.192
May 8, 2024 08:41:20.565829039 CEST	49851	21	192.168.2.16	221.224.127.141
May 8, 2024 08:41:20.565829039 CEST	49850	2121	192.168.2.16	73.79.84.228
May 8, 2024 08:41:20.565829992 CEST	49852	2121	192.168.2.16	221.224.127.141
May 8, 2024 08:41:20.565829992 CEST	49859	21	192.168.2.16	197.15.64.148
May 8, 2024 08:41:20.565846920 CEST	49871	21	192.168.2.16	72.192.14.127
May 8, 2024 08:41:20.565850019 CEST	49875	21	192.168.2.16	221.200.218.169
May 8, 2024 08:41:20.565850019 CEST	49860	2121	192.168.2.16	197.15.64.148
May 8, 2024 08:41:20.565850019 CEST	49878	2121	192.168.2.16	124.132.191.24
May 8, 2024 08:41:20.565851927 CEST	49858	2121	192.168.2.16	79.33.67.53
May 8, 2024 08:41:20.565850019 CEST	49882	2121	192.168.2.16	189.163.237.97
May 8, 2024 08:41:20.565853119 CEST	49862	2121	192.168.2.16	94.9.112.206
May 8, 2024 08:41:20.565853119 CEST	49857	21	192.168.2.16	79.33.67.53
May 8, 2024 08:41:20.565864086 CEST	49873	21	192.168.2.16	178.157.90.142
May 8, 2024 08:41:20.565864086 CEST	49879	21	192.168.2.16	84.194.9.127
May 8, 2024 08:41:20.565864086 CEST	49861	21	192.168.2.16	94.9.112.206
May 8, 2024 08:41:20.565866947 CEST	49870	2121	192.168.2.16	59.80.54.225
May 8, 2024 08:41:20.565870047 CEST	49863	21	192.168.2.16	39.129.73.19
May 8, 2024 08:41:20.565882921 CEST	49872	2121	192.168.2.16	72.192.14.127
May 8, 2024 08:41:20.565884113 CEST	49880	2121	192.168.2.16	84.194.9.127
May 8, 2024 08:41:20.565885067 CEST	49883	21	192.168.2.16	38.77.59.183
May 8, 2024 08:41:20.565885067 CEST	49874	2121	192.168.2.16	178.157.90.142
May 8, 2024 08:41:20.565885067 CEST	49877	21	192.168.2.16	124.132.191.24
May 8, 2024 08:41:20.565885067 CEST	49890	2121	192.168.2.16	124.90.159.99
May 8, 2024 08:41:20.565891027 CEST	49854	2121	192.168.2.16	8.139.140.192
May 8, 2024 08:41:20.565891027 CEST	49869	21	192.168.2.16	59.80.54.225
May 8, 2024 08:41:20.565891027 CEST	49864	2121	192.168.2.16	39.129.73.19
May 8, 2024 08:41:20.565891981 CEST	49866	2121	192.168.2.16	23.229.188.101
May 8, 2024 08:41:20.565906048 CEST	49888	2121	192.168.2.16	91.249.55.22
May 8, 2024 08:41:20.565906048 CEST	49891	21	192.168.2.16	90.180.159.186
May 8, 2024 08:41:20.565907001 CEST	49881	21	192.168.2.16	189.163.237.97
May 8, 2024 08:41:20.565907001 CEST	49892	2121	192.168.2.16	90.180.159.186
May 8, 2024 08:41:20.565912008 CEST	49889	21	192.168.2.16	124.90.159.99
May 8, 2024 08:41:20.565911055 CEST	49884	2121	192.168.2.16	38.77.59.183
May 8, 2024 08:41:20.565911055 CEST	49887	21	192.168.2.16	91.249.55.22
May 8, 2024 08:41:20.565922022 CEST	49893	21	192.168.2.16	20.89.42.33
May 8, 2024 08:41:20.565939903 CEST	49894	2121	192.168.2.16	20.89.42.33
May 8, 2024 08:41:20.570233107 CEST	21	49897	196.210.0.111	192.168.2.16
May 8, 2024 08:41:20.570375919 CEST	49897	21	192.168.2.16	196.210.0.111
May 8, 2024 08:41:20.570738077 CEST	49907	21	192.168.2.16	217.11.35.173
May 8, 2024 08:41:20.581790924 CEST	49899	21	192.168.2.16	119.231.203.174
May 8, 2024 08:41:20.581790924 CEST	49900	2121	192.168.2.16	119.231.203.174
May 8, 2024 08:41:20.581804037 CEST	49901	21	192.168.2.16	216.183.51.214
May 8, 2024 08:41:20.581815004 CEST	49902	2121	192.168.2.16	216.183.51.214
May 8, 2024 08:41:20.581819057 CEST	49903	21	192.168.2.16	93.212.38.207
May 8, 2024 08:41:20.581820011 CEST	49904	2121	192.168.2.16	93.212.38.207
May 8, 2024 08:41:20.597131968 CEST	21	49742	122.17.56.127	192.168.2.16
May 8, 2024 08:41:20.600127935 CEST	2121	49741	122.17.56.127	192.168.2.16
May 8, 2024 08:41:20.604228020 CEST	2121	49772	126.55.113.199	192.168.2.16
May 8, 2024 08:41:20.604377031 CEST	21	49771	126.55.113.199	192.168.2.16
May 8, 2024 08:41:20.611969948 CEST	21	49743	60.137.216.231	192.168.2.16
May 8, 2024 08:41:20.612552881 CEST	2121	49744	60.137.216.231	192.168.2.16
May 8, 2024 08:41:20.624926090 CEST	21	49717	190.199.135.222	192.168.2.16
May 8, 2024 08:41:20.627376080 CEST	2121	49718	190.199.135.222	192.168.2.16
May 8, 2024 08:41:20.638060093 CEST	2121	49842	126.78.5.163	192.168.2.16
May 8, 2024 08:41:20.642935038 CEST	21	49751	122.234.24.202	192.168.2.16
May 8, 2024 08:41:20.643198967 CEST	2121	49770	60.141.44.63	192.168.2.16
May 8, 2024 08:41:20.643734932 CEST	21	49769	60.141.44.63	192.168.2.16
May 8, 2024 08:41:20.646224976 CEST	2121	49752	122.234.24.202	192.168.2.16
May 8, 2024 08:41:20.648601055 CEST	21	49841	126.78.5.163	192.168.2.16
May 8, 2024 08:41:20.669928074 CEST	21	49827	125.132.197.159	192.168.2.16
May 8, 2024 08:41:20.672909021 CEST	2121	49754	134.130.247.222	192.168.2.16
May 8, 2024 08:41:20.675981998 CEST	2121	49828	125.132.197.159	192.168.2.16
May 8, 2024 08:41:20.676110983 CEST	21	49746	217.73.16.9	192.168.2.16
May 8, 2024 08:41:20.677289963 CEST	21	49753	134.130.247.222	192.168.2.16
May 8, 2024 08:41:20.682092905 CEST	2121	49747	217.73.16.9	192.168.2.16
May 8, 2024 08:41:20.687624931 CEST	2121	49804	182.35.245.77	192.168.2.16
May 8, 2024 08:41:20.702522993 CEST	2121	49837	124.48.8.141	192.168.2.16
May 8, 2024 08:41:20.704221010 CEST	2121	49886	61.77.52.76	192.168.2.16
May 8, 2024 08:41:20.708652973 CEST	21	49885	61.77.52.76	192.168.2.16
May 8, 2024 08:41:20.726876974 CEST	2121	49714	117.3.236.203	192.168.2.16
May 8, 2024 08:41:20.727494955 CEST	21	49713	117.3.236.203	192.168.2.16
May 8, 2024 08:41:20.809334993 CEST	2121	49876	221.200.218.169	192.168.2.16
May 8, 2024 08:41:20.815730095 CEST	2121	49856	200.127.5.88	192.168.2.16
May 8, 2024 08:41:20.816414118 CEST	21	49855	200.127.5.88	192.168.2.16
May 8, 2024 08:41:20.838615894 CEST	21	49780	221.2.50.105	192.168.2.16
May 8, 2024 08:41:20.890069962 CEST	2121	49782	221.2.50.105	192.168.2.16
May 8, 2024 08:41:20.897285938 CEST	21	49843	179.247.85.29	192.168.2.16
May 8, 2024 08:41:20.897700071 CEST	2121	49844	179.247.85.29	192.168.2.16
May 8, 2024 08:41:20.901827097 CEST	49896	2121	192.168.2.16	172.232.185.228
May 8, 2024 08:41:20.901837111 CEST	49905	21	192.168.2.16	185.18.133.19
May 8, 2024 08:41:20.901837111 CEST	49895	21	192.168.2.16	172.232.185.228
May 8, 2024 08:41:20.933815002 CEST	49868	2121	192.168.2.16	137.184.114.51
May 8, 2024 08:41:20.935945034 CEST	49867	21	192.168.2.16	137.184.114.51
May 8, 2024 08:41:20.965823889 CEST	49906	2121	192.168.2.16	185.18.133.19
May 8, 2024 08:41:21.029649019 CEST	2121	49898	196.210.0.111	192.168.2.16
May 8, 2024 08:41:21.029886961 CEST	49815	21	192.168.2.16	72.10.97.97
May 8, 2024 08:41:21.029887915 CEST	49813	2121	192.168.2.16	72.10.97.97
May 8, 2024 08:41:21.058192015 CEST	21	49897	196.210.0.111	192.168.2.16
May 8, 2024 08:41:21.058357000 CEST	49897	21	192.168.2.16	196.210.0.111
May 8, 2024 08:41:21.064351082 CEST	2121	49896	172.232.185.228	192.168.2.16
May 8, 2024 08:41:21.064368010 CEST	21	49895	172.232.185.228	192.168.2.16
May 8, 2024 08:41:21.109796047 CEST	49741	2121	192.168.2.16	122.17.56.127
May 8, 2024 08:41:21.109812021 CEST	49772	2121	192.168.2.16	126.55.113.199
May 8, 2024 08:41:21.109812975 CEST	49742	21	192.168.2.16	122.17.56.127
May 8, 2024 08:41:21.109857082 CEST	49771	21	192.168.2.16	126.55.113.199
May 8, 2024 08:41:21.113883018 CEST	2121	49868	137.184.114.51	192.168.2.16
May 8, 2024 08:41:21.118007898 CEST	21	49867	137.184.114.51	192.168.2.16
May 8, 2024 08:41:21.125822067 CEST	49743	21	192.168.2.16	60.137.216.231
May 8, 2024 08:41:21.125845909 CEST	49744	2121	192.168.2.16	60.137.216.231
May 8, 2024 08:41:21.125845909 CEST	49717	21	192.168.2.16	190.199.135.222
May 8, 2024 08:41:21.141808033 CEST	49842	2121	192.168.2.16	126.78.5.163
May 8, 2024 08:41:21.141808033 CEST	49718	2121	192.168.2.16	190.199.135.222
May 8, 2024 08:41:21.157794952 CEST	49752	2121	192.168.2.16	122.234.24.202
May 8, 2024 08:41:21.157794952 CEST	49751	21	192.168.2.16	122.234.24.202
May 8, 2024 08:41:21.157804966 CEST	49769	21	192.168.2.16	60.141.44.63
May 8, 2024 08:41:21.157809019 CEST	49770	2121	192.168.2.16	60.141.44.63
May 8, 2024 08:41:21.157816887 CEST	49841	21	192.168.2.16	126.78.5.163
May 8, 2024 08:41:21.173968077 CEST	49827	21	192.168.2.16	125.132.197.159
May 8, 2024 08:41:21.173978090 CEST	49754	2121	192.168.2.16	134.130.247.222
May 8, 2024 08:41:21.189811945 CEST	49804	2121	192.168.2.16	182.35.245.77
May 8, 2024 08:41:21.189829111 CEST	49828	2121	192.168.2.16	125.132.197.159
May 8, 2024 08:41:21.189830065 CEST	49746	21	192.168.2.16	217.73.16.9
May 8, 2024 08:41:21.189832926 CEST	49747	2121	192.168.2.16	217.73.16.9
May 8, 2024 08:41:21.189851999 CEST	49753	21	192.168.2.16	134.130.247.222
May 8, 2024 08:41:21.205806971 CEST	49837	2121	192.168.2.16	124.48.8.141
May 8, 2024 08:41:21.205935001 CEST	49886	2121	192.168.2.16	61.77.52.76
May 8, 2024 08:41:21.220844030 CEST	49885	21	192.168.2.16	61.77.52.76
May 8, 2024 08:41:21.235810995 CEST	49713	21	192.168.2.16	117.3.236.203
May 8, 2024 08:41:21.235825062 CEST	49714	2121	192.168.2.16	117.3.236.203
May 8, 2024 08:41:21.270235062 CEST	21	49815	72.10.97.97	192.168.2.16
May 8, 2024 08:41:21.270255089 CEST	2121	49813	72.10.97.97	192.168.2.16
May 8, 2024 08:41:21.315823078 CEST	49876	2121	192.168.2.16	221.200.218.169
May 8, 2024 08:41:21.315970898 CEST	49856	2121	192.168.2.16	200.127.5.88
May 8, 2024 08:41:21.331804037 CEST	49855	21	192.168.2.16	200.127.5.88
May 8, 2024 08:41:21.347907066 CEST	49780	21	192.168.2.16	221.2.50.105
May 8, 2024 08:41:21.395914078 CEST	49782	2121	192.168.2.16	221.2.50.105
May 8, 2024 08:41:21.402034044 CEST	2121	49772	126.55.113.199	192.168.2.16
May 8, 2024 08:41:21.402251005 CEST	21	49771	126.55.113.199	192.168.2.16
May 8, 2024 08:41:21.411815882 CEST	49844	2121	192.168.2.16	179.247.85.29
May 8, 2024 08:41:21.411848068 CEST	49843	21	192.168.2.16	179.247.85.29
May 8, 2024 08:41:21.426218987 CEST	21	49743	60.137.216.231	192.168.2.16
May 8, 2024 08:41:21.426233053 CEST	2121	49744	60.137.216.231	192.168.2.16
May 8, 2024 08:41:21.435756922 CEST	2121	49842	126.78.5.163	192.168.2.16
May 8, 2024 08:41:21.437177896 CEST	21	49742	122.17.56.127	192.168.2.16
May 8, 2024 08:41:21.438991070 CEST	21	49717	190.199.135.222	192.168.2.16
May 8, 2024 08:41:21.440155983 CEST	2121	49741	122.17.56.127	192.168.2.16
May 8, 2024 08:41:21.453656912 CEST	21	49841	126.78.5.163	192.168.2.16
May 8, 2024 08:41:21.455343008 CEST	2121	49718	190.199.135.222	192.168.2.16
May 8, 2024 08:41:21.467952013 CEST	21	49751	122.234.24.202	192.168.2.16
May 8, 2024 08:41:21.471210003 CEST	2121	49752	122.234.24.202	192.168.2.16
May 8, 2024 08:41:21.471244097 CEST	21	49769	60.141.44.63	192.168.2.16
May 8, 2024 08:41:21.471303940 CEST	2121	49770	60.141.44.63	192.168.2.16
May 8, 2024 08:41:21.484801054 CEST	21	49827	125.132.197.159	192.168.2.16
May 8, 2024 08:41:21.502037048 CEST	2121	49754	134.130.247.222	192.168.2.16
May 8, 2024 08:41:21.507162094 CEST	2121	49828	125.132.197.159	192.168.2.16
May 8, 2024 08:41:21.518603086 CEST	2121	49804	182.35.245.77	192.168.2.16
May 8, 2024 08:41:21.518685102 CEST	2121	49886	61.77.52.76	192.168.2.16
May 8, 2024 08:41:21.520400047 CEST	2121	49747	217.73.16.9	192.168.2.16
May 8, 2024 08:41:21.521280050 CEST	21	49746	217.73.16.9	192.168.2.16
May 8, 2024 08:41:21.522173882 CEST	21	49753	134.130.247.222	192.168.2.16
May 8, 2024 08:41:21.530823946 CEST	2121	49837	124.48.8.141	192.168.2.16
May 8, 2024 08:41:21.536889076 CEST	21	49885	61.77.52.76	192.168.2.16
May 8, 2024 08:41:21.539828062 CEST	49898	2121	192.168.2.16	196.210.0.111
May 8, 2024 08:41:21.571822882 CEST	49895	21	192.168.2.16	172.232.185.228
May 8, 2024 08:41:21.571825981 CEST	49907	21	192.168.2.16	217.11.35.173
May 8, 2024 08:41:21.571825027 CEST	49896	2121	192.168.2.16	172.232.185.228
May 8, 2024 08:41:21.602910995 CEST	2121	49714	117.3.236.203	192.168.2.16
May 8, 2024 08:41:21.603513002 CEST	21	49713	117.3.236.203	192.168.2.16
May 8, 2024 08:41:21.619812012 CEST	49868	2121	192.168.2.16	137.184.114.51
May 8, 2024 08:41:21.619838953 CEST	49867	21	192.168.2.16	137.184.114.51
May 8, 2024 08:41:21.686326981 CEST	2121	49876	221.200.218.169	192.168.2.16
May 8, 2024 08:41:21.694072008 CEST	2121	49856	200.127.5.88	192.168.2.16
May 8, 2024 08:41:21.704195023 CEST	21	49855	200.127.5.88	192.168.2.16
May 8, 2024 08:41:21.720973015 CEST	21	49780	221.2.50.105	192.168.2.16
May 8, 2024 08:41:21.734316111 CEST	21	49895	172.232.185.228	192.168.2.16
May 8, 2024 08:41:21.734330893 CEST	2121	49896	172.232.185.228	192.168.2.16
May 8, 2024 08:41:21.777131081 CEST	2121	49782	221.2.50.105	192.168.2.16
May 8, 2024 08:41:21.781829119 CEST	49813	2121	192.168.2.16	72.10.97.97
May 8, 2024 08:41:21.781855106 CEST	49815	21	192.168.2.16	72.10.97.97
May 8, 2024 08:41:21.799736023 CEST	2121	49868	137.184.114.51	192.168.2.16
May 8, 2024 08:41:21.801887989 CEST	21	49867	137.184.114.51	192.168.2.16
May 8, 2024 08:41:21.829535961 CEST	21	49843	179.247.85.29	192.168.2.16
May 8, 2024 08:41:21.829874992 CEST	2121	49844	179.247.85.29	192.168.2.16
May 8, 2024 08:41:21.909813881 CEST	49772	2121	192.168.2.16	126.55.113.199
May 8, 2024 08:41:21.909837008 CEST	49771	21	192.168.2.16	126.55.113.199
May 8, 2024 08:41:21.941823959 CEST	49717	21	192.168.2.16	190.199.135.222
May 8, 2024 08:41:21.941827059 CEST	49743	21	192.168.2.16	60.137.216.231
May 8, 2024 08:41:21.941843033 CEST	49741	2121	192.168.2.16	122.17.56.127
May 8, 2024 08:41:21.941843033 CEST	49744	2121	192.168.2.16	60.137.216.231
May 8, 2024 08:41:21.941855907 CEST	49742	21	192.168.2.16	122.17.56.127
May 8, 2024 08:41:21.941865921 CEST	49842	2121	192.168.2.16	126.78.5.163
May 8, 2024 08:41:21.956814051 CEST	49841	21	192.168.2.16	126.78.5.163
May 8, 2024 08:41:21.956815958 CEST	49718	2121	192.168.2.16	190.199.135.222
May 8, 2024 08:41:21.972784042 CEST	49752	2121	192.168.2.16	122.234.24.202
May 8, 2024 08:41:21.972821951 CEST	49769	21	192.168.2.16	60.141.44.63
May 8, 2024 08:41:21.972821951 CEST	49751	21	192.168.2.16	122.234.24.202
May 8, 2024 08:41:21.972970963 CEST	49770	2121	192.168.2.16	60.141.44.63
May 8, 2024 08:41:21.987854004 CEST	49827	21	192.168.2.16	125.132.197.159
May 8, 2024 08:41:22.003834009 CEST	49754	2121	192.168.2.16	134.130.247.222
May 8, 2024 08:41:22.017941952 CEST	2121	49898	196.210.0.111	192.168.2.16
May 8, 2024 08:41:22.018843889 CEST	49828	2121	192.168.2.16	125.132.197.159
May 8, 2024 08:41:22.018845081 CEST	49804	2121	192.168.2.16	182.35.245.77
May 8, 2024 08:41:22.018845081 CEST	49886	2121	192.168.2.16	61.77.52.76
May 8, 2024 08:41:22.019861937 CEST	2121	49813	72.10.97.97	192.168.2.16
May 8, 2024 08:41:22.020157099 CEST	21	49815	72.10.97.97	192.168.2.16
May 8, 2024 08:41:22.033790112 CEST	49747	2121	192.168.2.16	217.73.16.9
May 8, 2024 08:41:22.033799887 CEST	49837	2121	192.168.2.16	124.48.8.141
May 8, 2024 08:41:22.033823967 CEST	49746	21	192.168.2.16	217.73.16.9
May 8, 2024 08:41:22.033835888 CEST	49753	21	192.168.2.16	134.130.247.222
May 8, 2024 08:41:22.049807072 CEST	49885	21	192.168.2.16	61.77.52.76
May 8, 2024 08:41:22.113817930 CEST	49713	21	192.168.2.16	117.3.236.203
May 8, 2024 08:41:22.113820076 CEST	49714	2121	192.168.2.16	117.3.236.203
May 8, 2024 08:41:22.196044922 CEST	49876	2121	192.168.2.16	221.200.218.169
May 8, 2024 08:41:22.196209908 CEST	49856	2121	192.168.2.16	200.127.5.88
May 8, 2024 08:41:22.201971054 CEST	2121	49772	126.55.113.199	192.168.2.16
May 8, 2024 08:41:22.202063084 CEST	21	49771	126.55.113.199	192.168.2.16
May 8, 2024 08:41:22.208806992 CEST	49855	21	192.168.2.16	200.127.5.88
May 8, 2024 08:41:22.226799011 CEST	49780	21	192.168.2.16	221.2.50.105
May 8, 2024 08:41:22.235801935 CEST	2121	49842	126.78.5.163	192.168.2.16
May 8, 2024 08:41:22.240823030 CEST	49896	2121	192.168.2.16	172.232.185.228
May 8, 2024 08:41:22.240823984 CEST	49895	21	192.168.2.16	172.232.185.228
May 8, 2024 08:41:22.242261887 CEST	2121	49744	60.137.216.231	192.168.2.16
May 8, 2024 08:41:22.242275000 CEST	21	49743	60.137.216.231	192.168.2.16
May 8, 2024 08:41:22.243851900 CEST	21	49742	122.17.56.127	192.168.2.16
May 8, 2024 08:41:22.246941090 CEST	2121	49741	122.17.56.127	192.168.2.16
May 8, 2024 08:41:22.254265070 CEST	21	49841	126.78.5.163	192.168.2.16
May 8, 2024 08:41:22.255778074 CEST	21	49717	190.199.135.222	192.168.2.16
May 8, 2024 08:41:22.270965099 CEST	2121	49718	190.199.135.222	192.168.2.16
May 8, 2024 08:41:22.283090115 CEST	21	49751	122.234.24.202	192.168.2.16
May 8, 2024 08:41:22.286264896 CEST	2121	49752	122.234.24.202	192.168.2.16
May 8, 2024 08:41:22.286322117 CEST	21	49769	60.141.44.63	192.168.2.16
May 8, 2024 08:41:22.286948919 CEST	2121	49770	60.141.44.63	192.168.2.16
May 8, 2024 08:41:22.288830996 CEST	49782	2121	192.168.2.16	221.2.50.105
May 8, 2024 08:41:22.299396038 CEST	21	49827	125.132.197.159	192.168.2.16
May 8, 2024 08:41:22.304820061 CEST	49868	2121	192.168.2.16	137.184.114.51
May 8, 2024 08:41:22.304847002 CEST	49867	21	192.168.2.16	137.184.114.51
May 8, 2024 08:41:22.334912062 CEST	2121	49754	134.130.247.222	192.168.2.16
May 8, 2024 08:41:22.335211039 CEST	2121	49886	61.77.52.76	192.168.2.16
May 8, 2024 08:41:22.336798906 CEST	49843	21	192.168.2.16	179.247.85.29
May 8, 2024 08:41:22.336930990 CEST	49844	2121	192.168.2.16	179.247.85.29
May 8, 2024 08:41:22.337014914 CEST	2121	49828	125.132.197.159	192.168.2.16
May 8, 2024 08:41:22.347851992 CEST	2121	49804	182.35.245.77	192.168.2.16
May 8, 2024 08:41:22.359217882 CEST	2121	49837	124.48.8.141	192.168.2.16
May 8, 2024 08:41:22.365334988 CEST	2121	49747	217.73.16.9	192.168.2.16
May 8, 2024 08:41:22.365930080 CEST	21	49746	217.73.16.9	192.168.2.16
May 8, 2024 08:41:22.366547108 CEST	21	49753	134.130.247.222	192.168.2.16
May 8, 2024 08:41:22.367021084 CEST	21	49885	61.77.52.76	192.168.2.16
May 8, 2024 08:41:22.403831959 CEST	21	49895	172.232.185.228	192.168.2.16
May 8, 2024 08:41:22.403847933 CEST	2121	49896	172.232.185.228	192.168.2.16
May 8, 2024 08:41:22.405709028 CEST	49909	21	192.168.2.16	39.27.13.134
May 8, 2024 08:41:22.405710936 CEST	49908	2121	192.168.2.16	217.11.35.173
May 8, 2024 08:41:22.478938103 CEST	2121	49714	117.3.236.203	192.168.2.16
May 8, 2024 08:41:22.479516983 CEST	21	49713	117.3.236.203	192.168.2.16
May 8, 2024 08:41:22.484801054 CEST	2121	49868	137.184.114.51	192.168.2.16
May 8, 2024 08:41:22.485373020 CEST	49910	2121	192.168.2.16	39.27.13.134
May 8, 2024 08:41:22.486938953 CEST	21	49867	137.184.114.51	192.168.2.16
May 8, 2024 08:41:22.487260103 CEST	49911	21	192.168.2.16	85.247.109.248
May 8, 2024 08:41:22.496826887 CEST	49707	21	192.168.2.16	88.3.252.23
May 8, 2024 08:41:22.496830940 CEST	49706	2121	192.168.2.16	202.141.230.46
May 8, 2024 08:41:22.496833086 CEST	49709	2121	192.168.2.16	187.232.63.30
May 8, 2024 08:41:22.496850967 CEST	49712	2121	192.168.2.16	88.138.242.230
May 8, 2024 08:41:22.496853113 CEST	49708	21	192.168.2.16	187.232.63.30
May 8, 2024 08:41:22.496855974 CEST	49710	2121	192.168.2.16	88.3.252.23
May 8, 2024 08:41:22.496855021 CEST	49705	21	192.168.2.16	202.141.230.46
May 8, 2024 08:41:22.496855021 CEST	49711	21	192.168.2.16	88.138.242.230
May 8, 2024 08:41:22.512845039 CEST	49715	21	192.168.2.16	220.174.66.41
May 8, 2024 08:41:22.512846947 CEST	49719	21	192.168.2.16	20.27.129.45
May 8, 2024 08:41:22.512846947 CEST	49722	2121	192.168.2.16	45.225.213.66
May 8, 2024 08:41:22.512865067 CEST	49716	2121	192.168.2.16	220.174.66.41
May 8, 2024 08:41:22.512868881 CEST	49720	2121	192.168.2.16	20.27.129.45
May 8, 2024 08:41:22.512868881 CEST	49724	2121	192.168.2.16	98.144.80.128
May 8, 2024 08:41:22.512868881 CEST	49726	2121	192.168.2.16	51.241.196.118
May 8, 2024 08:41:22.512875080 CEST	49733	21	192.168.2.16	109.130.248.23
May 8, 2024 08:41:22.512878895 CEST	49723	21	192.168.2.16	98.144.80.128
May 8, 2024 08:41:22.512880087 CEST	49730	2121	192.168.2.16	38.38.120.85
May 8, 2024 08:41:22.512881041 CEST	49725	21	192.168.2.16	51.241.196.118
May 8, 2024 08:41:22.512880087 CEST	49727	21	192.168.2.16	119.176.139.75
May 8, 2024 08:41:22.512886047 CEST	49721	21	192.168.2.16	45.225.213.66
May 8, 2024 08:41:22.512886047 CEST	49736	2121	192.168.2.16	34.128.248.69
May 8, 2024 08:41:22.512907982 CEST	49735	21	192.168.2.16	34.128.248.69
May 8, 2024 08:41:22.512911081 CEST	49734	2121	192.168.2.16	109.130.248.23
May 8, 2024 08:41:22.512911081 CEST	49740	2121	192.168.2.16	20.99.154.51
May 8, 2024 08:41:22.512911081 CEST	49732	2121	192.168.2.16	187.137.19.229
May 8, 2024 08:41:22.512912035 CEST	49737	21	192.168.2.16	121.132.64.213
May 8, 2024 08:41:22.512912035 CEST	49745	21	192.168.2.16	174.49.126.122
May 8, 2024 08:41:22.512914896 CEST	49731	21	192.168.2.16	187.137.19.229
May 8, 2024 08:41:22.512912035 CEST	49728	2121	192.168.2.16	119.176.139.75
May 8, 2024 08:41:22.513394117 CEST	49739	21	192.168.2.16	20.99.154.51
May 8, 2024 08:41:22.513396978 CEST	49738	2121	192.168.2.16	121.132.64.213
May 8, 2024 08:41:22.528800011 CEST	49748	21	192.168.2.16	72.240.221.220
May 8, 2024 08:41:22.528803110 CEST	49749	2121	192.168.2.16	174.49.126.122
May 8, 2024 08:41:22.528817892 CEST	49756	2121	192.168.2.16	92.252.102.247
May 8, 2024 08:41:22.528817892 CEST	49759	21	192.168.2.16	107.184.133.230
May 8, 2024 08:41:22.528819084 CEST	49750	2121	192.168.2.16	72.240.221.220
May 8, 2024 08:41:22.528836012 CEST	49776	2121	192.168.2.16	76.184.71.237
May 8, 2024 08:41:22.528837919 CEST	49755	21	192.168.2.16	92.252.102.247
May 8, 2024 08:41:22.528837919 CEST	49760	2121	192.168.2.16	107.184.133.230
May 8, 2024 08:41:22.528837919 CEST	49764	2121	192.168.2.16	173.93.196.30
May 8, 2024 08:41:22.528837919 CEST	49757	21	192.168.2.16	40.88.10.206
May 8, 2024 08:41:22.528840065 CEST	49773	21	192.168.2.16	68.6.178.222
May 8, 2024 08:41:22.528841019 CEST	49761	21	192.168.2.16	185.35.189.48
May 8, 2024 08:41:22.528841972 CEST	49774	2121	192.168.2.16	68.6.178.222
May 8, 2024 08:41:22.528841019 CEST	49777	21	192.168.2.16	180.195.247.176
May 8, 2024 08:41:22.528841019 CEST	49775	21	192.168.2.16	76.184.71.237
May 8, 2024 08:41:22.528841019 CEST	49758	2121	192.168.2.16	40.88.10.206
May 8, 2024 08:41:22.528860092 CEST	49763	21	192.168.2.16	173.93.196.30
May 8, 2024 08:41:22.528862000 CEST	49768	2121	192.168.2.16	207.148.31.31
May 8, 2024 08:41:22.528863907 CEST	49813	2121	192.168.2.16	72.10.97.97
May 8, 2024 08:41:22.528865099 CEST	49778	2121	192.168.2.16	180.195.247.176
May 8, 2024 08:41:22.528865099 CEST	49815	21	192.168.2.16	72.10.97.97
May 8, 2024 08:41:22.528866053 CEST	49766	2121	192.168.2.16	106.203.218.54
May 8, 2024 08:41:22.528865099 CEST	49762	2121	192.168.2.16	185.35.189.48
May 8, 2024 08:41:22.528867960 CEST	49765	21	192.168.2.16	106.203.218.54
May 8, 2024 08:41:22.528866053 CEST	49767	21	192.168.2.16	207.148.31.31
May 8, 2024 08:41:22.528866053 CEST	49779	21	192.168.2.16	75.68.30.94
May 8, 2024 08:41:22.529052019 CEST	49781	2121	192.168.2.16	75.68.30.94
May 8, 2024 08:41:22.529052019 CEST	49898	2121	192.168.2.16	196.210.0.111
May 8, 2024 08:41:22.544790983 CEST	49783	21	192.168.2.16	113.13.157.160
May 8, 2024 08:41:22.544806957 CEST	49786	21	192.168.2.16	112.144.219.240
May 8, 2024 08:41:22.544811964 CEST	49785	2121	192.168.2.16	112.144.219.240
May 8, 2024 08:41:22.544817924 CEST	49787	21	192.168.2.16	222.138.218.131
May 8, 2024 08:41:22.544830084 CEST	49793	21	192.168.2.16	117.10.175.148
May 8, 2024 08:41:22.544832945 CEST	49792	2121	192.168.2.16	59.41.145.142
May 8, 2024 08:41:22.544832945 CEST	49788	2121	192.168.2.16	222.138.218.131
May 8, 2024 08:41:22.544833899 CEST	49796	21	192.168.2.16	84.176.189.204
May 8, 2024 08:41:22.544833899 CEST	49795	21	192.168.2.16	87.16.29.239
May 8, 2024 08:41:22.544835091 CEST	49794	2121	192.168.2.16	117.10.175.148
May 8, 2024 08:41:22.544835091 CEST	49789	21	192.168.2.16	24.63.48.54
May 8, 2024 08:41:22.544833899 CEST	49801	2121	192.168.2.16	174.61.242.178
May 8, 2024 08:41:22.544867992 CEST	49790	2121	192.168.2.16	24.63.48.54
May 8, 2024 08:41:22.544872046 CEST	49799	2121	192.168.2.16	87.16.29.239
May 8, 2024 08:41:22.544872999 CEST	49812	2121	192.168.2.16	23.12.109.151
May 8, 2024 08:41:22.544873953 CEST	49807	2121	192.168.2.16	112.252.80.62
May 8, 2024 08:41:22.544873953 CEST	49784	2121	192.168.2.16	113.13.157.160
May 8, 2024 08:41:22.544873953 CEST	49800	21	192.168.2.16	58.232.199.163
May 8, 2024 08:41:22.544874907 CEST	49798	21	192.168.2.16	174.61.242.178
May 8, 2024 08:41:22.544874907 CEST	49791	21	192.168.2.16	59.41.145.142
May 8, 2024 08:41:22.544874907 CEST	49802	2121	192.168.2.16	58.232.199.163
May 8, 2024 08:41:22.544873953 CEST	49810	2121	192.168.2.16	59.14.157.129
May 8, 2024 08:41:22.544874907 CEST	49805	21	192.168.2.16	213.37.158.68
May 8, 2024 08:41:22.544874907 CEST	49797	2121	192.168.2.16	84.176.189.204
May 8, 2024 08:41:22.544874907 CEST	49803	21	192.168.2.16	182.35.245.77
May 8, 2024 08:41:22.544904947 CEST	49814	21	192.168.2.16	107.174.245.116
May 8, 2024 08:41:22.544904947 CEST	49806	2121	192.168.2.16	213.37.158.68
May 8, 2024 08:41:22.544904947 CEST	49808	21	192.168.2.16	59.14.157.129
May 8, 2024 08:41:22.544905901 CEST	49809	21	192.168.2.16	112.252.80.62
May 8, 2024 08:41:22.544904947 CEST	49811	21	192.168.2.16	23.12.109.151
May 8, 2024 08:41:22.560791969 CEST	49817	21	192.168.2.16	120.92.55.9
May 8, 2024 08:41:22.560792923 CEST	49816	2121	192.168.2.16	107.174.245.116
May 8, 2024 08:41:22.560816050 CEST	49818	2121	192.168.2.16	120.92.55.9
May 8, 2024 08:41:22.560816050 CEST	49833	2121	192.168.2.16	72.253.222.60
May 8, 2024 08:41:22.560817003 CEST	49824	2121	192.168.2.16	67.9.27.76
May 8, 2024 08:41:22.560821056 CEST	49819	2121	192.168.2.16	83.58.227.82
May 8, 2024 08:41:22.560821056 CEST	49823	21	192.168.2.16	74.101.156.83
May 8, 2024 08:41:22.560822964 CEST	49820	21	192.168.2.16	83.58.227.82
May 8, 2024 08:41:22.560822964 CEST	49829	21	192.168.2.16	2.219.242.97
May 8, 2024 08:41:22.560823917 CEST	49821	21	192.168.2.16	189.178.166.57
May 8, 2024 08:41:22.560826063 CEST	49822	2121	192.168.2.16	189.178.166.57
May 8, 2024 08:41:22.560846090 CEST	49845	21	192.168.2.16	1.28.158.199
May 8, 2024 08:41:22.560846090 CEST	49853	21	192.168.2.16	8.139.140.192
May 8, 2024 08:41:22.560847044 CEST	49826	2121	192.168.2.16	74.101.156.83
May 8, 2024 08:41:22.560847044 CEST	49836	2121	192.168.2.16	189.188.209.240
May 8, 2024 08:41:22.560847998 CEST	49846	2121	192.168.2.16	1.28.158.199
May 8, 2024 08:41:22.560847044 CEST	49832	2121	192.168.2.16	67.2.29.149
May 8, 2024 08:41:22.560848951 CEST	49847	21	192.168.2.16	46.167.107.13
May 8, 2024 08:41:22.560848951 CEST	49849	21	192.168.2.16	73.79.84.228
May 8, 2024 08:41:22.560849905 CEST	49831	21	192.168.2.16	67.2.29.149
May 8, 2024 08:41:22.560852051 CEST	49825	21	192.168.2.16	67.9.27.76
May 8, 2024 08:41:22.560852051 CEST	49838	21	192.168.2.16	124.48.8.141
May 8, 2024 08:41:22.560853004 CEST	49848	2121	192.168.2.16	46.167.107.13
May 8, 2024 08:41:22.560853958 CEST	49835	21	192.168.2.16	189.188.209.240
May 8, 2024 08:41:22.562367916 CEST	49830	2121	192.168.2.16	2.219.242.97
May 8, 2024 08:41:22.562381029 CEST	49834	21	192.168.2.16	72.253.222.60
May 8, 2024 08:41:22.562382936 CEST	49839	21	192.168.2.16	98.27.54.26
May 8, 2024 08:41:22.565987110 CEST	49840	2121	192.168.2.16	98.27.54.26
May 8, 2024 08:41:22.566339016 CEST	2121	49876	221.200.218.169	192.168.2.16
May 8, 2024 08:41:22.572846889 CEST	2121	49856	200.127.5.88	192.168.2.16
May 8, 2024 08:41:22.576850891 CEST	49857	21	192.168.2.16	79.33.67.53
May 8, 2024 08:41:22.576850891 CEST	49852	2121	192.168.2.16	221.224.127.141
May 8, 2024 08:41:22.576855898 CEST	49851	21	192.168.2.16	221.224.127.141
May 8, 2024 08:41:22.576855898 CEST	49850	2121	192.168.2.16	73.79.84.228
May 8, 2024 08:41:22.576878071 CEST	49862	2121	192.168.2.16	94.9.112.206
May 8, 2024 08:41:22.576879025 CEST	49860	2121	192.168.2.16	197.15.64.148
May 8, 2024 08:41:22.576878071 CEST	49863	21	192.168.2.16	39.129.73.19
May 8, 2024 08:41:22.576879025 CEST	49854	2121	192.168.2.16	8.139.140.192
May 8, 2024 08:41:22.576879025 CEST	49864	2121	192.168.2.16	39.129.73.19
May 8, 2024 08:41:22.576879025 CEST	49866	2121	192.168.2.16	23.229.188.101
May 8, 2024 08:41:22.576880932 CEST	49858	2121	192.168.2.16	79.33.67.53
May 8, 2024 08:41:22.576881886 CEST	49871	21	192.168.2.16	72.192.14.127
May 8, 2024 08:41:22.576881886 CEST	49872	2121	192.168.2.16	72.192.14.127
May 8, 2024 08:41:22.576881886 CEST	49877	21	192.168.2.16	124.132.191.24
May 8, 2024 08:41:22.576881886 CEST	49861	21	192.168.2.16	94.9.112.206
May 8, 2024 08:41:22.576881886 CEST	49881	21	192.168.2.16	189.163.237.97
May 8, 2024 08:41:22.576901913 CEST	49879	21	192.168.2.16	84.194.9.127
May 8, 2024 08:41:22.576905966 CEST	49883	21	192.168.2.16	38.77.59.183
May 8, 2024 08:41:22.576905966 CEST	49874	2121	192.168.2.16	178.157.90.142
May 8, 2024 08:41:22.576905966 CEST	49890	2121	192.168.2.16	124.90.159.99
May 8, 2024 08:41:22.576905966 CEST	49870	2121	192.168.2.16	59.80.54.225
May 8, 2024 08:41:22.576908112 CEST	49893	21	192.168.2.16	20.89.42.33
May 8, 2024 08:41:22.576906919 CEST	49869	21	192.168.2.16	59.80.54.225
May 8, 2024 08:41:22.576908112 CEST	49880	2121	192.168.2.16	84.194.9.127
May 8, 2024 08:41:22.576906919 CEST	49889	21	192.168.2.16	124.90.159.99
May 8, 2024 08:41:22.576909065 CEST	49873	21	192.168.2.16	178.157.90.142
May 8, 2024 08:41:22.576916933 CEST	49884	2121	192.168.2.16	38.77.59.183
May 8, 2024 08:41:22.576916933 CEST	49887	21	192.168.2.16	91.249.55.22
May 8, 2024 08:41:22.577984095 CEST	49891	21	192.168.2.16	90.180.159.186
May 8, 2024 08:41:22.579101086 CEST	49859	21	192.168.2.16	197.15.64.148
May 8, 2024 08:41:22.579111099 CEST	49875	21	192.168.2.16	221.200.218.169
May 8, 2024 08:41:22.579111099 CEST	49878	2121	192.168.2.16	124.132.191.24
May 8, 2024 08:41:22.579111099 CEST	49882	2121	192.168.2.16	189.163.237.97
May 8, 2024 08:41:22.579125881 CEST	49892	2121	192.168.2.16	90.180.159.186
May 8, 2024 08:41:22.579127073 CEST	49894	2121	192.168.2.16	20.89.42.33
May 8, 2024 08:41:22.579127073 CEST	49888	2121	192.168.2.16	91.249.55.22
May 8, 2024 08:41:22.580354929 CEST	21	49855	200.127.5.88	192.168.2.16
May 8, 2024 08:41:22.592833996 CEST	49899	21	192.168.2.16	119.231.203.174
May 8, 2024 08:41:22.592839003 CEST	49900	2121	192.168.2.16	119.231.203.174
May 8, 2024 08:41:22.592847109 CEST	49901	21	192.168.2.16	216.183.51.214
May 8, 2024 08:41:22.592856884 CEST	49902	2121	192.168.2.16	216.183.51.214
May 8, 2024 08:41:22.592858076 CEST	49903	21	192.168.2.16	93.212.38.207
May 8, 2024 08:41:22.592878103 CEST	49904	2121	192.168.2.16	93.212.38.207
May 8, 2024 08:41:22.605958939 CEST	21	49780	221.2.50.105	192.168.2.16
May 8, 2024 08:41:22.657007933 CEST	2121	49782	221.2.50.105	192.168.2.16
May 8, 2024 08:41:22.704843044 CEST	49771	21	192.168.2.16	126.55.113.199
May 8, 2024 08:41:22.704843998 CEST	49772	2121	192.168.2.16	126.55.113.199
May 8, 2024 08:41:22.726361036 CEST	21	49909	39.27.13.134	192.168.2.16
May 8, 2024 08:41:22.751847982 CEST	49741	2121	192.168.2.16	122.17.56.127
May 8, 2024 08:41:22.751852036 CEST	49842	2121	192.168.2.16	126.78.5.163
May 8, 2024 08:41:22.752075911 CEST	49743	21	192.168.2.16	60.137.216.231
May 8, 2024 08:41:22.752074003 CEST	49744	2121	192.168.2.16	60.137.216.231
May 8, 2024 08:41:22.752078056 CEST	49742	21	192.168.2.16	122.17.56.127
May 8, 2024 08:41:22.767414093 CEST	2121	49813	72.10.97.97	192.168.2.16
May 8, 2024 08:41:22.767469883 CEST	21	49815	72.10.97.97	192.168.2.16
May 8, 2024 08:41:22.767827988 CEST	49841	21	192.168.2.16	126.78.5.163
May 8, 2024 08:41:22.767954111 CEST	49717	21	192.168.2.16	190.199.135.222
May 8, 2024 08:41:22.768269062 CEST	49912	2121	192.168.2.16	85.247.109.248
May 8, 2024 08:41:22.777650118 CEST	21	49843	179.247.85.29	192.168.2.16
May 8, 2024 08:41:22.777734041 CEST	2121	49844	179.247.85.29	192.168.2.16
May 8, 2024 08:41:22.783826113 CEST	49718	2121	192.168.2.16	190.199.135.222
May 8, 2024 08:41:22.784270048 CEST	49751	21	192.168.2.16	122.234.24.202
May 8, 2024 08:41:22.784271955 CEST	49913	21	192.168.2.16	211.37.73.195
May 8, 2024 08:41:22.799829006 CEST	49752	2121	192.168.2.16	122.234.24.202
May 8, 2024 08:41:22.799829006 CEST	49769	21	192.168.2.16	60.141.44.63
May 8, 2024 08:41:22.799829960 CEST	49770	2121	192.168.2.16	60.141.44.63
May 8, 2024 08:41:22.799968958 CEST	49827	21	192.168.2.16	125.132.197.159
May 8, 2024 08:41:22.801158905 CEST	2121	49910	39.27.13.134	192.168.2.16
May 8, 2024 08:41:22.847825050 CEST	49828	2121	192.168.2.16	125.132.197.159
May 8, 2024 08:41:22.847827911 CEST	49754	2121	192.168.2.16	134.130.247.222
May 8, 2024 08:41:22.848319054 CEST	49886	2121	192.168.2.16	61.77.52.76
May 8, 2024 08:41:22.863820076 CEST	49804	2121	192.168.2.16	182.35.245.77
May 8, 2024 08:41:22.864799023 CEST	49837	2121	192.168.2.16	124.48.8.141
May 8, 2024 08:41:22.879818916 CEST	49747	2121	192.168.2.16	217.73.16.9
May 8, 2024 08:41:22.879833937 CEST	49753	21	192.168.2.16	134.130.247.222
May 8, 2024 08:41:22.879838943 CEST	49746	21	192.168.2.16	217.73.16.9
May 8, 2024 08:41:22.879992008 CEST	49885	21	192.168.2.16	61.77.52.76
May 8, 2024 08:41:22.911834955 CEST	49905	21	192.168.2.16	185.18.133.19
May 8, 2024 08:41:22.965306997 CEST	49906	2121	192.168.2.16	185.18.133.19
May 8, 2024 08:41:22.991800070 CEST	49713	21	192.168.2.16	117.3.236.203
May 8, 2024 08:41:22.991827011 CEST	49714	2121	192.168.2.16	117.3.236.203
May 8, 2024 08:41:22.997082949 CEST	2121	49772	126.55.113.199	192.168.2.16
May 8, 2024 08:41:22.997216940 CEST	21	49771	126.55.113.199	192.168.2.16
May 8, 2024 08:41:22.997745037 CEST	49914	2121	192.168.2.16	211.37.73.195
May 8, 2024 08:41:22.997883081 CEST	49915	21	192.168.2.16	92.252.174.158
May 8, 2024 08:41:23.006609917 CEST	2121	49898	196.210.0.111	192.168.2.16
May 8, 2024 08:41:23.045592070 CEST	2121	49842	126.78.5.163	192.168.2.16
May 8, 2024 08:41:23.046222925 CEST	49916	2121	192.168.2.16	92.252.174.158
May 8, 2024 08:41:23.052422047 CEST	21	49743	60.137.216.231	192.168.2.16
May 8, 2024 08:41:23.052438974 CEST	2121	49744	60.137.216.231	192.168.2.16
May 8, 2024 08:41:23.053136110 CEST	49917	21	192.168.2.16	39.58.197.109
May 8, 2024 08:41:23.053173065 CEST	49918	2121	192.168.2.16	39.58.197.109
May 8, 2024 08:41:23.064297915 CEST	21	49742	122.17.56.127	192.168.2.16
May 8, 2024 08:41:23.064459085 CEST	21	49841	126.78.5.163	192.168.2.16
May 8, 2024 08:41:23.067367077 CEST	2121	49741	122.17.56.127	192.168.2.16
May 8, 2024 08:41:23.071928978 CEST	49876	2121	192.168.2.16	221.200.218.169
May 8, 2024 08:41:23.081254959 CEST	21	49717	190.199.135.222	192.168.2.16
May 8, 2024 08:41:23.087795019 CEST	49856	2121	192.168.2.16	200.127.5.88
May 8, 2024 08:41:23.087821007 CEST	49855	21	192.168.2.16	200.127.5.88
May 8, 2024 08:41:23.088311911 CEST	49919	2121	192.168.2.16	86.20.170.121
May 8, 2024 08:41:23.088359118 CEST	49920	21	192.168.2.16	86.20.170.121
May 8, 2024 08:41:23.088427067 CEST	49921	21	192.168.2.16	179.244.78.184
May 8, 2024 08:41:23.088651896 CEST	21	49913	211.37.73.195	192.168.2.16
May 8, 2024 08:41:23.096048117 CEST	21	49751	122.234.24.202	192.168.2.16
May 8, 2024 08:41:23.098058939 CEST	2121	49718	190.199.135.222	192.168.2.16
May 8, 2024 08:41:23.104238987 CEST	49922	2121	192.168.2.16	179.244.78.184
May 8, 2024 08:41:23.111439943 CEST	21	49827	125.132.197.159	192.168.2.16
May 8, 2024 08:41:23.113442898 CEST	21	49769	60.141.44.63	192.168.2.16
May 8, 2024 08:41:23.113495111 CEST	2121	49770	60.141.44.63	192.168.2.16
May 8, 2024 08:41:23.113960981 CEST	49923	21	192.168.2.16	188.179.76.56
May 8, 2024 08:41:23.113993883 CEST	49924	2121	192.168.2.16	188.179.76.56
May 8, 2024 08:41:23.118310928 CEST	2121	49752	122.234.24.202	192.168.2.16
May 8, 2024 08:41:23.119841099 CEST	49780	21	192.168.2.16	221.2.50.105
May 8, 2024 08:41:23.120280981 CEST	49925	21	192.168.2.16	73.117.145.210
May 8, 2024 08:41:23.120300055 CEST	49926	2121	192.168.2.16	73.117.145.210
May 8, 2024 08:41:23.136420012 CEST	49927	21	192.168.2.16	223.112.252.89
May 8, 2024 08:41:23.136450052 CEST	49928	2121	192.168.2.16	223.112.252.89
May 8, 2024 08:41:23.161719084 CEST	2121	49886	61.77.52.76	192.168.2.16
May 8, 2024 08:41:23.165034056 CEST	2121	49828	125.132.197.159	192.168.2.16
May 8, 2024 08:41:23.165714979 CEST	49929	21	192.168.2.16	95.153.49.77
May 8, 2024 08:41:23.167839050 CEST	49782	2121	192.168.2.16	221.2.50.105
May 8, 2024 08:41:23.175936937 CEST	2121	49754	134.130.247.222	192.168.2.16
May 8, 2024 08:41:23.176462889 CEST	49930	2121	192.168.2.16	95.153.49.77
May 8, 2024 08:41:23.184195995 CEST	49931	21	192.168.2.16	185.252.215.74
May 8, 2024 08:41:23.190859079 CEST	2121	49837	124.48.8.141	192.168.2.16
May 8, 2024 08:41:23.193114042 CEST	2121	49804	182.35.245.77	192.168.2.16
May 8, 2024 08:41:23.195671082 CEST	21	49885	61.77.52.76	192.168.2.16
May 8, 2024 08:41:23.196002007 CEST	49932	2121	192.168.2.16	185.252.215.74
May 8, 2024 08:41:23.209980965 CEST	2121	49747	217.73.16.9	192.168.2.16
May 8, 2024 08:41:23.210551977 CEST	49933	21	192.168.2.16	2.122.182.57
May 8, 2024 08:41:23.210978985 CEST	21	49746	217.73.16.9	192.168.2.16
May 8, 2024 08:41:23.212179899 CEST	21	49753	134.130.247.222	192.168.2.16
May 8, 2024 08:41:23.216245890 CEST	49934	21	192.168.2.16	91.36.126.116
May 8, 2024 08:41:23.216330051 CEST	49935	2121	192.168.2.16	2.122.182.57
May 8, 2024 08:41:23.231816053 CEST	49909	21	192.168.2.16	39.27.13.134
May 8, 2024 08:41:23.232208014 CEST	49936	2121	192.168.2.16	91.36.126.116
May 8, 2024 08:41:23.232208014 CEST	49937	21	192.168.2.16	178.211.237.37
May 8, 2024 08:41:23.279818058 CEST	49844	2121	192.168.2.16	179.247.85.29
May 8, 2024 08:41:23.279818058 CEST	49843	21	192.168.2.16	179.247.85.29
May 8, 2024 08:41:23.282701969 CEST	2121	49914	211.37.73.195	192.168.2.16
May 8, 2024 08:41:23.311814070 CEST	49910	2121	192.168.2.16	39.27.13.134
May 8, 2024 08:41:23.358999014 CEST	2121	49714	117.3.236.203	192.168.2.16
May 8, 2024 08:41:23.359525919 CEST	21	49713	117.3.236.203	192.168.2.16
May 8, 2024 08:41:23.359616995 CEST	49938	2121	192.168.2.16	178.211.237.37
May 8, 2024 08:41:23.376146078 CEST	49939	21	192.168.2.16	181.175.197.255
May 8, 2024 08:41:23.407844067 CEST	49908	2121	192.168.2.16	217.11.35.173
May 8, 2024 08:41:23.442312002 CEST	2121	49876	221.200.218.169	192.168.2.16
May 8, 2024 08:41:23.456087112 CEST	49940	2121	192.168.2.16	181.175.197.255
May 8, 2024 08:41:23.460361004 CEST	21	49855	200.127.5.88	192.168.2.16
May 8, 2024 08:41:23.460730076 CEST	49941	21	192.168.2.16	219.157.216.200
May 8, 2024 08:41:23.465666056 CEST	2121	49856	200.127.5.88	192.168.2.16
May 8, 2024 08:41:23.487833023 CEST	49911	21	192.168.2.16	85.247.109.248
May 8, 2024 08:41:23.488194942 CEST	49942	2121	192.168.2.16	219.157.216.200
May 8, 2024 08:41:23.493166924 CEST	21	49780	221.2.50.105	192.168.2.16
May 8, 2024 08:41:23.493730068 CEST	49943	21	192.168.2.16	223.13.57.142
May 8, 2024 08:41:23.500191927 CEST	21	49931	185.252.215.74	192.168.2.16
May 8, 2024 08:41:23.500340939 CEST	2121	49918	39.58.197.109	192.168.2.16
May 8, 2024 08:41:23.512331963 CEST	2121	49932	185.252.215.74	192.168.2.16
May 8, 2024 08:41:23.519815922 CEST	49898	2121	192.168.2.16	196.210.0.111
May 8, 2024 08:41:23.535928011 CEST	2121	49782	221.2.50.105	192.168.2.16
May 8, 2024 08:41:23.536422968 CEST	49944	2121	192.168.2.16	223.13.57.142
May 8, 2024 08:41:23.552743912 CEST	21	49909	39.27.13.134	192.168.2.16
May 8, 2024 08:41:23.583832979 CEST	49907	21	192.168.2.16	217.11.35.173
May 8, 2024 08:41:23.599848032 CEST	49913	21	192.168.2.16	211.37.73.195
May 8, 2024 08:41:23.626416922 CEST	2121	49910	39.27.13.134	192.168.2.16
May 8, 2024 08:41:23.646856070 CEST	2121	49922	179.244.78.184	192.168.2.16
May 8, 2024 08:41:23.650475025 CEST	21	49921	179.244.78.184	192.168.2.16
May 8, 2024 08:41:23.737500906 CEST	21	49843	179.247.85.29	192.168.2.16
May 8, 2024 08:41:23.737641096 CEST	2121	49844	179.247.85.29	192.168.2.16
May 8, 2024 08:41:23.738316059 CEST	49946	2121	192.168.2.16	216.201.52.26
May 8, 2024 08:41:23.738320112 CEST	49945	21	192.168.2.16	216.201.52.26
May 8, 2024 08:41:23.775943041 CEST	49912	2121	192.168.2.16	85.247.109.248
May 8, 2024 08:41:23.791891098 CEST	49914	2121	192.168.2.16	211.37.73.195
May 8, 2024 08:41:23.834281921 CEST	21	49941	219.157.216.200	192.168.2.16
May 8, 2024 08:41:23.855719090 CEST	2121	49942	219.157.216.200	192.168.2.16
May 8, 2024 08:41:23.882901907 CEST	2121	49944	223.13.57.142	192.168.2.16
May 8, 2024 08:41:23.904689074 CEST	21	49913	211.37.73.195	192.168.2.16
May 8, 2024 08:41:23.997916937 CEST	2121	49898	196.210.0.111	192.168.2.16
May 8, 2024 08:41:23.998344898 CEST	49947	21	192.168.2.16	118.214.111.215
May 8, 2024 08:41:23.999818087 CEST	49915	21	192.168.2.16	92.252.174.158
May 8, 2024 08:41:24.015810966 CEST	49931	21	192.168.2.16	185.252.215.74
May 8, 2024 08:41:24.018069983 CEST	49918	2121	192.168.2.16	39.58.197.109
May 8, 2024 08:41:24.019805908 CEST	49932	2121	192.168.2.16	185.252.215.74
May 8, 2024 08:41:24.047823906 CEST	49916	2121	192.168.2.16	92.252.174.158
May 8, 2024 08:41:24.062952042 CEST	49917	21	192.168.2.16	39.58.197.109
May 8, 2024 08:41:24.067790031 CEST	49909	21	192.168.2.16	39.27.13.134
May 8, 2024 08:41:24.076653957 CEST	2121	49914	211.37.73.195	192.168.2.16
May 8, 2024 08:41:24.094832897 CEST	49920	21	192.168.2.16	86.20.170.121
May 8, 2024 08:41:24.099790096 CEST	49919	2121	192.168.2.16	86.20.170.121
May 8, 2024 08:41:24.125819921 CEST	49925	21	192.168.2.16	73.117.145.210
May 8, 2024 08:41:24.125819921 CEST	49923	21	192.168.2.16	188.179.76.56
May 8, 2024 08:41:24.130079031 CEST	49924	2121	192.168.2.16	188.179.76.56
May 8, 2024 08:41:24.130086899 CEST	49926	2121	192.168.2.16	73.117.145.210
May 8, 2024 08:41:24.130093098 CEST	49910	2121	192.168.2.16	39.27.13.134
May 8, 2024 08:41:24.141793013 CEST	49928	2121	192.168.2.16	223.112.252.89
May 8, 2024 08:41:24.141793966 CEST	49927	21	192.168.2.16	223.112.252.89
May 8, 2024 08:41:24.157840014 CEST	49922	2121	192.168.2.16	179.244.78.184
May 8, 2024 08:41:24.157840967 CEST	49921	21	192.168.2.16	179.244.78.184
May 8, 2024 08:41:24.173799992 CEST	49929	21	192.168.2.16	95.153.49.77
May 8, 2024 08:41:24.189798117 CEST	49930	2121	192.168.2.16	95.153.49.77
May 8, 2024 08:41:24.221936941 CEST	49935	2121	192.168.2.16	2.122.182.57
May 8, 2024 08:41:24.221940041 CEST	49934	21	192.168.2.16	91.36.126.116
May 8, 2024 08:41:24.221940041 CEST	49933	21	192.168.2.16	2.122.182.57
May 8, 2024 08:41:24.237832069 CEST	49936	2121	192.168.2.16	91.36.126.116
May 8, 2024 08:41:24.237950087 CEST	49937	21	192.168.2.16	178.211.237.37
May 8, 2024 08:41:24.331947088 CEST	21	49931	185.252.215.74	192.168.2.16
May 8, 2024 08:41:24.335906029 CEST	2121	49932	185.252.215.74	192.168.2.16
May 8, 2024 08:41:24.349816084 CEST	49941	21	192.168.2.16	219.157.216.200
May 8, 2024 08:41:24.365819931 CEST	49942	2121	192.168.2.16	219.157.216.200
May 8, 2024 08:41:24.365976095 CEST	49938	2121	192.168.2.16	178.211.237.37
May 8, 2024 08:41:24.381911039 CEST	49939	21	192.168.2.16	181.175.197.255
May 8, 2024 08:41:24.389225006 CEST	21	49909	39.27.13.134	192.168.2.16
May 8, 2024 08:41:24.397819042 CEST	49944	2121	192.168.2.16	223.13.57.142
May 8, 2024 08:41:24.413822889 CEST	49913	21	192.168.2.16	211.37.73.195
May 8, 2024 08:41:24.443972111 CEST	2121	49910	39.27.13.134	192.168.2.16
May 8, 2024 08:41:24.461858034 CEST	49940	2121	192.168.2.16	181.175.197.255
May 8, 2024 08:41:24.464494944 CEST	2121	49918	39.58.197.109	192.168.2.16
May 8, 2024 08:41:24.495851040 CEST	49948	2121	192.168.2.16	118.214.111.215
May 8, 2024 08:41:24.495915890 CEST	49949	21	192.168.2.16	27.213.95.111
May 8, 2024 08:41:24.495976925 CEST	49950	2121	192.168.2.16	27.213.95.111
May 8, 2024 08:41:24.496030092 CEST	49951	21	192.168.2.16	73.67.38.37
May 8, 2024 08:41:24.496062994 CEST	49952	2121	192.168.2.16	73.67.38.37
May 8, 2024 08:41:24.496115923 CEST	49953	21	192.168.2.16	211.211.70.243
May 8, 2024 08:41:24.496228933 CEST	49954	2121	192.168.2.16	211.211.70.243
May 8, 2024 08:41:24.496279001 CEST	49955	2121	192.168.2.16	133.159.212.113
May 8, 2024 08:41:24.496427059 CEST	49956	2121	192.168.2.16	197.49.46.137
May 8, 2024 08:41:24.496454000 CEST	49957	21	192.168.2.16	103.21.62.148
May 8, 2024 08:41:24.496592999 CEST	49958	2121	192.168.2.16	92.107.132.216
May 8, 2024 08:41:24.496671915 CEST	49959	21	192.168.2.16	88.12.163.193
May 8, 2024 08:41:24.496742964 CEST	49960	21	192.168.2.16	92.107.132.216
May 8, 2024 08:41:24.496886015 CEST	49961	2121	192.168.2.16	88.12.163.193
May 8, 2024 08:41:24.496927023 CEST	49963	21	192.168.2.16	87.13.248.211
May 8, 2024 08:41:24.496928930 CEST	49964	21	192.168.2.16	133.159.212.113
May 8, 2024 08:41:24.496944904 CEST	49965	2121	192.168.2.16	87.13.248.211
May 8, 2024 08:41:24.496963978 CEST	49966	2121	192.168.2.16	103.21.62.148
May 8, 2024 08:41:24.496997118 CEST	49962	21	192.168.2.16	35.171.239.79
May 8, 2024 08:41:24.497066975 CEST	49967	2121	192.168.2.16	35.171.239.79
May 8, 2024 08:41:24.497108936 CEST	49968	21	192.168.2.16	197.49.46.137
May 8, 2024 08:41:24.497123957 CEST	49969	21	192.168.2.16	23.241.156.235
May 8, 2024 08:41:24.508904934 CEST	49943	21	192.168.2.16	223.13.57.142
May 8, 2024 08:41:24.510818958 CEST	49970	2121	192.168.2.16	23.241.156.235
May 8, 2024 08:41:24.510957956 CEST	49971	21	192.168.2.16	37.28.15.192
May 8, 2024 08:41:24.510957956 CEST	49972	21	192.168.2.16	171.237.167.200
May 8, 2024 08:41:24.511034012 CEST	49973	21	192.168.2.16	80.65.79.44
May 8, 2024 08:41:24.511101961 CEST	49975	2121	192.168.2.16	171.237.167.200
May 8, 2024 08:41:24.511120081 CEST	49976	2121	192.168.2.16	80.65.79.44
May 8, 2024 08:41:24.511199951 CEST	49977	21	192.168.2.16	23.192.166.102
May 8, 2024 08:41:24.511220932 CEST	49978	2121	192.168.2.16	23.192.166.102
May 8, 2024 08:41:24.511317015 CEST	49979	21	192.168.2.16	86.13.48.192
May 8, 2024 08:41:24.511409998 CEST	49980	2121	192.168.2.16	86.13.48.192
May 8, 2024 08:41:24.511512995 CEST	49981	21	192.168.2.16	211.104.99.158
May 8, 2024 08:41:24.511557102 CEST	49982	21	192.168.2.16	115.112.79.149
May 8, 2024 08:41:24.511595011 CEST	49983	2121	192.168.2.16	211.104.99.158
May 8, 2024 08:41:24.511650085 CEST	49984	21	192.168.2.16	210.106.251.150
May 8, 2024 08:41:24.511699915 CEST	49985	2121	192.168.2.16	115.112.79.149
May 8, 2024 08:41:24.511729956 CEST	49986	2121	192.168.2.16	210.106.251.150
May 8, 2024 08:41:24.511792898 CEST	49987	21	192.168.2.16	102.27.2.20
May 8, 2024 08:41:24.511851072 CEST	49974	2121	192.168.2.16	37.28.15.192
May 8, 2024 08:41:24.511921883 CEST	49988	2121	192.168.2.16	102.27.2.20
May 8, 2024 08:41:24.511995077 CEST	49989	21	192.168.2.16	123.4.235.233
May 8, 2024 08:41:24.512039900 CEST	49990	2121	192.168.2.16	123.4.235.233
May 8, 2024 08:41:24.512094975 CEST	49991	21	192.168.2.16	45.153.57.22
May 8, 2024 08:41:24.512187004 CEST	49992	2121	192.168.2.16	45.153.57.22
May 8, 2024 08:41:24.527365923 CEST	49993	21	192.168.2.16	212.193.50.13
May 8, 2024 08:41:24.527452946 CEST	49994	2121	192.168.2.16	212.193.50.13
May 8, 2024 08:41:24.527493954 CEST	49995	21	192.168.2.16	118.52.252.40
May 8, 2024 08:41:24.527642965 CEST	49996	2121	192.168.2.16	118.52.252.40
May 8, 2024 08:41:24.527710915 CEST	49997	2121	192.168.2.16	27.33.157.64
May 8, 2024 08:41:24.527786016 CEST	49998	21	192.168.2.16	104.21.239.40
May 8, 2024 08:41:24.527848005 CEST	49999	2121	192.168.2.16	104.21.239.40
May 8, 2024 08:41:24.527867079 CEST	50000	21	192.168.2.16	204.254.177.81
May 8, 2024 08:41:24.527940035 CEST	50001	21	192.168.2.16	27.33.157.64
May 8, 2024 08:41:24.527976990 CEST	50002	2121	192.168.2.16	204.254.177.81
May 8, 2024 08:41:24.528079987 CEST	50003	21	192.168.2.16	20.4.159.89
May 8, 2024 08:41:24.528170109 CEST	50004	21	192.168.2.16	124.76.80.236
May 8, 2024 08:41:24.528177023 CEST	50005	2121	192.168.2.16	124.76.80.236
May 8, 2024 08:41:24.528249025 CEST	50006	2121	192.168.2.16	20.4.159.89
May 8, 2024 08:41:24.528311968 CEST	50007	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:24.528402090 CEST	50008	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:24.528440952 CEST	50009	21	192.168.2.16	86.90.22.187
May 8, 2024 08:41:24.528526068 CEST	50010	2121	192.168.2.16	86.90.22.187
May 8, 2024 08:41:24.528614044 CEST	50011	2121	192.168.2.16	95.101.166.24
May 8, 2024 08:41:24.528630972 CEST	50012	21	192.168.2.16	79.145.211.71
May 8, 2024 08:41:24.528656006 CEST	50013	2121	192.168.2.16	79.145.211.71
May 8, 2024 08:41:24.528784037 CEST	50014	21	192.168.2.16	213.49.25.250
May 8, 2024 08:41:24.528876066 CEST	50015	21	192.168.2.16	95.101.166.24
May 8, 2024 08:41:24.529015064 CEST	50016	2121	192.168.2.16	213.49.25.250
May 8, 2024 08:41:24.529052973 CEST	50017	21	192.168.2.16	24.99.37.171
May 8, 2024 08:41:24.529150009 CEST	50018	21	192.168.2.16	67.189.152.9
May 8, 2024 08:41:24.529160023 CEST	50019	2121	192.168.2.16	24.99.37.171
May 8, 2024 08:41:24.529217958 CEST	50020	2121	192.168.2.16	67.189.152.9
May 8, 2024 08:41:24.529331923 CEST	50021	21	192.168.2.16	93.123.134.76
May 8, 2024 08:41:24.542979956 CEST	50022	2121	192.168.2.16	93.123.134.76
May 8, 2024 08:41:24.542988062 CEST	50023	21	192.168.2.16	95.115.71.162
May 8, 2024 08:41:24.543025017 CEST	50024	2121	192.168.2.16	95.115.71.162
May 8, 2024 08:41:24.543173075 CEST	50025	21	192.168.2.16	75.183.52.97
May 8, 2024 08:41:24.543201923 CEST	50026	2121	192.168.2.16	75.183.52.97
May 8, 2024 08:41:24.543229103 CEST	50027	21	192.168.2.16	187.233.203.114
May 8, 2024 08:41:24.543442965 CEST	50028	2121	192.168.2.16	187.233.203.114
May 8, 2024 08:41:24.543525934 CEST	50029	2121	192.168.2.16	203.128.203.48
May 8, 2024 08:41:24.543541908 CEST	50030	21	192.168.2.16	203.128.203.48
May 8, 2024 08:41:24.543570995 CEST	50031	21	192.168.2.16	81.198.111.173
May 8, 2024 08:41:24.543704033 CEST	50032	2121	192.168.2.16	81.198.111.173
May 8, 2024 08:41:24.543795109 CEST	50033	21	192.168.2.16	178.64.38.166
May 8, 2024 08:41:24.543939114 CEST	50034	2121	192.168.2.16	178.64.38.166
May 8, 2024 08:41:24.543972969 CEST	50035	21	192.168.2.16	201.110.133.95
May 8, 2024 08:41:24.543997049 CEST	50036	2121	192.168.2.16	201.110.133.95
May 8, 2024 08:41:24.544008017 CEST	50037	21	192.168.2.16	205.211.202.1
May 8, 2024 08:41:24.544239998 CEST	50038	21	192.168.2.16	91.146.153.183
May 8, 2024 08:41:24.544260025 CEST	50039	2121	192.168.2.16	205.211.202.1
May 8, 2024 08:41:24.544364929 CEST	50040	2121	192.168.2.16	91.146.153.183
May 8, 2024 08:41:24.544436932 CEST	50041	21	192.168.2.16	95.52.30.52
May 8, 2024 08:41:24.544536114 CEST	50042	2121	192.168.2.16	95.52.30.52
May 8, 2024 08:41:24.544604063 CEST	50043	21	192.168.2.16	94.33.136.136
May 8, 2024 08:41:24.544661999 CEST	50044	21	192.168.2.16	5.71.7.211
May 8, 2024 08:41:24.544692993 CEST	50045	2121	192.168.2.16	94.33.136.136
May 8, 2024 08:41:24.544764996 CEST	50046	2121	192.168.2.16	5.71.7.211
May 8, 2024 08:41:24.544838905 CEST	50047	2121	192.168.2.16	130.233.94.223
May 8, 2024 08:41:24.544840097 CEST	50048	21	192.168.2.16	130.233.94.223
May 8, 2024 08:41:24.558711052 CEST	50049	21	192.168.2.16	18.238.143.28
May 8, 2024 08:41:24.558974028 CEST	50050	2121	192.168.2.16	18.238.143.28
May 8, 2024 08:41:24.559058905 CEST	50051	21	192.168.2.16	121.133.25.163
May 8, 2024 08:41:24.559169054 CEST	50052	2121	192.168.2.16	121.133.25.163
May 8, 2024 08:41:24.559175968 CEST	50053	21	192.168.2.16	92.64.11.129
May 8, 2024 08:41:24.559248924 CEST	50054	2121	192.168.2.16	92.64.11.129
May 8, 2024 08:41:24.559315920 CEST	50055	21	192.168.2.16	89.106.127.202
May 8, 2024 08:41:24.559345961 CEST	50056	2121	192.168.2.16	89.106.127.202
May 8, 2024 08:41:24.559398890 CEST	50057	21	192.168.2.16	181.24.179.233
May 8, 2024 08:41:24.559473038 CEST	50058	2121	192.168.2.16	181.24.179.233
May 8, 2024 08:41:24.559587002 CEST	50059	21	192.168.2.16	31.214.210.76
May 8, 2024 08:41:24.559683084 CEST	50060	2121	192.168.2.16	31.214.210.76
May 8, 2024 08:41:24.559742928 CEST	50061	21	192.168.2.16	93.23.184.172
May 8, 2024 08:41:24.559843063 CEST	50062	2121	192.168.2.16	93.23.184.172
May 8, 2024 08:41:24.559926987 CEST	50063	21	192.168.2.16	119.113.69.12
May 8, 2024 08:41:24.560000896 CEST	50064	2121	192.168.2.16	119.113.69.12
May 8, 2024 08:41:24.560106993 CEST	50065	21	192.168.2.16	187.158.40.132
May 8, 2024 08:41:24.560200930 CEST	50066	2121	192.168.2.16	187.158.40.132
May 8, 2024 08:41:24.560271025 CEST	50067	21	192.168.2.16	70.104.196.79
May 8, 2024 08:41:24.560334921 CEST	50068	2121	192.168.2.16	70.104.196.79
May 8, 2024 08:41:24.560456991 CEST	50069	21	192.168.2.16	223.231.177.195
May 8, 2024 08:41:24.560558081 CEST	50070	21	192.168.2.16	20.53.160.214
May 8, 2024 08:41:24.560594082 CEST	50071	2121	192.168.2.16	223.231.177.195
May 8, 2024 08:41:24.560641050 CEST	50072	2121	192.168.2.16	20.53.160.214
May 8, 2024 08:41:24.560762882 CEST	50073	2121	192.168.2.16	139.180.55.89
May 8, 2024 08:41:24.560784101 CEST	50074	21	192.168.2.16	139.180.55.89
May 8, 2024 08:41:24.560811043 CEST	50075	21	192.168.2.16	24.177.67.22
May 8, 2024 08:41:24.573734045 CEST	50076	2121	192.168.2.16	24.177.67.22
May 8, 2024 08:41:24.574076891 CEST	50077	21	192.168.2.16	79.27.122.148
May 8, 2024 08:41:24.574134111 CEST	50078	2121	192.168.2.16	79.27.122.148
May 8, 2024 08:41:24.574193954 CEST	50079	2121	192.168.2.16	187.18.231.64
May 8, 2024 08:41:24.574210882 CEST	50080	21	192.168.2.16	187.18.231.64
May 8, 2024 08:41:24.574258089 CEST	50081	21	192.168.2.16	96.50.237.171
May 8, 2024 08:41:24.574407101 CEST	50082	2121	192.168.2.16	96.50.237.171
May 8, 2024 08:41:24.574465036 CEST	50083	21	192.168.2.16	178.1.32.243
May 8, 2024 08:41:24.574558020 CEST	50084	21	192.168.2.16	24.130.106.21
May 8, 2024 08:41:24.574626923 CEST	50085	2121	192.168.2.16	178.1.32.243
May 8, 2024 08:41:24.574668884 CEST	50086	2121	192.168.2.16	24.130.106.21
May 8, 2024 08:41:24.574743986 CEST	50087	21	192.168.2.16	77.203.56.164
May 8, 2024 08:41:24.574800014 CEST	50088	2121	192.168.2.16	77.203.56.164
May 8, 2024 08:41:24.574858904 CEST	50089	21	192.168.2.16	175.234.156.232
May 8, 2024 08:41:24.574929953 CEST	50090	21	192.168.2.16	188.148.10.89
May 8, 2024 08:41:24.575810909 CEST	50091	2121	192.168.2.16	175.234.156.232
May 8, 2024 08:41:24.575826883 CEST	50092	2121	192.168.2.16	188.148.10.89
May 8, 2024 08:41:24.575922966 CEST	50093	21	192.168.2.16	66.130.205.82
May 8, 2024 08:41:24.576029062 CEST	50094	2121	192.168.2.16	66.130.205.82
May 8, 2024 08:41:24.576141119 CEST	50095	2121	192.168.2.16	207.172.169.15
May 8, 2024 08:41:24.576191902 CEST	50096	21	192.168.2.16	207.172.169.15
May 8, 2024 08:41:24.576244116 CEST	50097	21	192.168.2.16	47.243.207.139
May 8, 2024 08:41:24.576325893 CEST	50098	2121	192.168.2.16	47.243.207.139
May 8, 2024 08:41:24.576426029 CEST	50099	2121	192.168.2.16	177.207.16.68
May 8, 2024 08:41:24.576517105 CEST	50100	21	192.168.2.16	177.207.16.68
May 8, 2024 08:41:24.576536894 CEST	50101	21	192.168.2.16	219.74.199.173
May 8, 2024 08:41:24.576633930 CEST	50102	21	192.168.2.16	163.180.232.87
May 8, 2024 08:41:24.576693058 CEST	50103	2121	192.168.2.16	219.74.199.173
May 8, 2024 08:41:24.576697111 CEST	50104	2121	192.168.2.16	163.180.232.87
May 8, 2024 08:41:24.587841034 CEST	49914	2121	192.168.2.16	211.37.73.195
May 8, 2024 08:41:24.690566063 CEST	2121	50008	34.149.79.8	192.168.2.16
May 8, 2024 08:41:24.690644979 CEST	50008	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:24.690705061 CEST	21	50007	34.149.79.8	192.168.2.16
May 8, 2024 08:41:24.690762997 CEST	50007	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:24.720674992 CEST	21	49913	211.37.73.195	192.168.2.16
May 8, 2024 08:41:24.722904921 CEST	21	49941	219.157.216.200	192.168.2.16
May 8, 2024 08:41:24.732204914 CEST	2121	49942	219.157.216.200	192.168.2.16
May 8, 2024 08:41:24.750628948 CEST	49945	21	192.168.2.16	216.201.52.26
May 8, 2024 08:41:24.750629902 CEST	49946	2121	192.168.2.16	216.201.52.26
May 8, 2024 08:41:24.752060890 CEST	2121	49944	223.13.57.142	192.168.2.16
May 8, 2024 08:41:24.797899008 CEST	2121	50073	139.180.55.89	192.168.2.16
May 8, 2024 08:41:24.797914028 CEST	21	50074	139.180.55.89	192.168.2.16
May 8, 2024 08:41:24.840249062 CEST	21	49984	210.106.251.150	192.168.2.16
May 8, 2024 08:41:24.841415882 CEST	2121	49986	210.106.251.150	192.168.2.16
May 8, 2024 08:41:24.841840982 CEST	49932	2121	192.168.2.16	185.252.215.74
May 8, 2024 08:41:24.841842890 CEST	49931	21	192.168.2.16	185.252.215.74
May 8, 2024 08:41:24.843816996 CEST	21	49995	118.52.252.40	192.168.2.16
May 8, 2024 08:41:24.850229979 CEST	2121	49996	118.52.252.40	192.168.2.16
May 8, 2024 08:41:24.855758905 CEST	2121	50008	34.149.79.8	192.168.2.16
May 8, 2024 08:41:24.855829954 CEST	50008	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:24.855953932 CEST	50008	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:24.856017113 CEST	50008	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:24.856045008 CEST	21	50007	34.149.79.8	192.168.2.16
May 8, 2024 08:41:24.856097937 CEST	50007	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:24.856251001 CEST	50007	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:24.856363058 CEST	50007	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:24.856367111 CEST	50105	21	192.168.2.16	79.234.90.250
May 8, 2024 08:41:24.856731892 CEST	50106	2121	192.168.2.16	79.234.90.250
May 8, 2024 08:41:24.873964071 CEST	2121	49914	211.37.73.195	192.168.2.16
May 8, 2024 08:41:24.884985924 CEST	21	49993	212.193.50.13	192.168.2.16
May 8, 2024 08:41:24.885602951 CEST	2121	49994	212.193.50.13	192.168.2.16
May 8, 2024 08:41:24.890316963 CEST	50107	21	192.168.2.16	73.14.28.18
May 8, 2024 08:41:24.891259909 CEST	21	50031	81.198.111.173	192.168.2.16
May 8, 2024 08:41:24.893176079 CEST	2121	50032	81.198.111.173	192.168.2.16
May 8, 2024 08:41:24.904853106 CEST	49909	21	192.168.2.16	39.27.13.134
May 8, 2024 08:41:24.911890984 CEST	21	50102	163.180.232.87	192.168.2.16
May 8, 2024 08:41:24.912053108 CEST	2121	50104	163.180.232.87	192.168.2.16
May 8, 2024 08:41:24.923367977 CEST	2121	50099	177.207.16.68	192.168.2.16
May 8, 2024 08:41:24.951803923 CEST	49910	2121	192.168.2.16	39.27.13.134
May 8, 2024 08:41:24.967833996 CEST	49918	2121	192.168.2.16	39.58.197.109
May 8, 2024 08:41:24.968259096 CEST	50108	2121	192.168.2.16	73.14.28.18
May 8, 2024 08:41:24.999937057 CEST	49947	21	192.168.2.16	118.214.111.215
May 8, 2024 08:41:25.022603989 CEST	2121	50008	34.149.79.8	192.168.2.16
May 8, 2024 08:41:25.022733927 CEST	2121	50008	34.149.79.8	192.168.2.16
May 8, 2024 08:41:25.023169041 CEST	21	50007	34.149.79.8	192.168.2.16
May 8, 2024 08:41:25.023297071 CEST	21	50007	34.149.79.8	192.168.2.16
May 8, 2024 08:41:25.161079884 CEST	2121	49932	185.252.215.74	192.168.2.16
May 8, 2024 08:41:25.164794922 CEST	21	49931	185.252.215.74	192.168.2.16
May 8, 2024 08:41:25.222836971 CEST	49913	21	192.168.2.16	211.37.73.195
May 8, 2024 08:41:25.228148937 CEST	21	49909	39.27.13.134	192.168.2.16
May 8, 2024 08:41:25.238831043 CEST	49941	21	192.168.2.16	219.157.216.200
May 8, 2024 08:41:25.240150928 CEST	49942	2121	192.168.2.16	219.157.216.200
May 8, 2024 08:41:25.254962921 CEST	49944	2121	192.168.2.16	223.13.57.142
May 8, 2024 08:41:25.268249035 CEST	2121	49910	39.27.13.134	192.168.2.16
May 8, 2024 08:41:25.300842047 CEST	50073	2121	192.168.2.16	139.180.55.89
May 8, 2024 08:41:25.300843954 CEST	50074	21	192.168.2.16	139.180.55.89
May 8, 2024 08:41:25.349005938 CEST	49986	2121	192.168.2.16	210.106.251.150
May 8, 2024 08:41:25.349006891 CEST	49984	21	192.168.2.16	210.106.251.150
May 8, 2024 08:41:25.349014997 CEST	49995	21	192.168.2.16	118.52.252.40
May 8, 2024 08:41:25.364814997 CEST	49996	2121	192.168.2.16	118.52.252.40
May 8, 2024 08:41:25.380965948 CEST	49914	2121	192.168.2.16	211.37.73.195
May 8, 2024 08:41:25.396806955 CEST	49994	2121	192.168.2.16	212.193.50.13
May 8, 2024 08:41:25.396964073 CEST	49993	21	192.168.2.16	212.193.50.13
May 8, 2024 08:41:25.396964073 CEST	50032	2121	192.168.2.16	81.198.111.173
May 8, 2024 08:41:25.396964073 CEST	50031	21	192.168.2.16	81.198.111.173
May 8, 2024 08:41:25.412821054 CEST	50104	2121	192.168.2.16	163.180.232.87
May 8, 2024 08:41:25.412821054 CEST	50102	21	192.168.2.16	163.180.232.87
May 8, 2024 08:41:25.413028955 CEST	49908	2121	192.168.2.16	217.11.35.173
May 8, 2024 08:41:25.416448116 CEST	2121	49918	39.58.197.109	192.168.2.16
May 8, 2024 08:41:25.428910017 CEST	50099	2121	192.168.2.16	177.207.16.68
May 8, 2024 08:41:25.492822886 CEST	49911	21	192.168.2.16	85.247.109.248
May 8, 2024 08:41:25.508805990 CEST	49951	21	192.168.2.16	73.67.38.37
May 8, 2024 08:41:25.508840084 CEST	49966	2121	192.168.2.16	103.21.62.148
May 8, 2024 08:41:25.508840084 CEST	49954	2121	192.168.2.16	211.211.70.243
May 8, 2024 08:41:25.508840084 CEST	49956	2121	192.168.2.16	197.49.46.137
May 8, 2024 08:41:25.508840084 CEST	49949	21	192.168.2.16	27.213.95.111
May 8, 2024 08:41:25.508840084 CEST	49964	21	192.168.2.16	133.159.212.113
May 8, 2024 08:41:25.508841991 CEST	49952	2121	192.168.2.16	73.67.38.37
May 8, 2024 08:41:25.508841991 CEST	49960	21	192.168.2.16	92.107.132.216
May 8, 2024 08:41:25.508841991 CEST	49948	2121	192.168.2.16	118.214.111.215
May 8, 2024 08:41:25.508841991 CEST	49961	2121	192.168.2.16	88.12.163.193
May 8, 2024 08:41:25.509908915 CEST	49958	2121	192.168.2.16	92.107.132.216
May 8, 2024 08:41:25.509910107 CEST	49967	2121	192.168.2.16	35.171.239.79
May 8, 2024 08:41:25.509923935 CEST	49950	2121	192.168.2.16	27.213.95.111
May 8, 2024 08:41:25.509927034 CEST	49955	2121	192.168.2.16	133.159.212.113
May 8, 2024 08:41:25.509927988 CEST	49953	21	192.168.2.16	211.211.70.243
May 8, 2024 08:41:25.509939909 CEST	49965	2121	192.168.2.16	87.13.248.211
May 8, 2024 08:41:25.509942055 CEST	49959	21	192.168.2.16	88.12.163.193
May 8, 2024 08:41:25.509942055 CEST	49963	21	192.168.2.16	87.13.248.211
May 8, 2024 08:41:25.509943962 CEST	49957	21	192.168.2.16	103.21.62.148
May 8, 2024 08:41:25.509989023 CEST	49968	21	192.168.2.16	197.49.46.137
May 8, 2024 08:41:25.509989023 CEST	49969	21	192.168.2.16	23.241.156.235
May 8, 2024 08:41:25.509989977 CEST	49962	21	192.168.2.16	35.171.239.79
May 8, 2024 08:41:25.524840117 CEST	49975	2121	192.168.2.16	171.237.167.200
May 8, 2024 08:41:25.524841070 CEST	49973	21	192.168.2.16	80.65.79.44
May 8, 2024 08:41:25.524846077 CEST	49970	2121	192.168.2.16	23.241.156.235
May 8, 2024 08:41:25.524848938 CEST	49971	21	192.168.2.16	37.28.15.192
May 8, 2024 08:41:25.524848938 CEST	49981	21	192.168.2.16	211.104.99.158
May 8, 2024 08:41:25.524848938 CEST	49976	2121	192.168.2.16	80.65.79.44
May 8, 2024 08:41:25.524848938 CEST	49972	21	192.168.2.16	171.237.167.200
May 8, 2024 08:41:25.526010036 CEST	49982	21	192.168.2.16	115.112.79.149
May 8, 2024 08:41:25.526010036 CEST	49987	21	192.168.2.16	102.27.2.20
May 8, 2024 08:41:25.526010036 CEST	49985	2121	192.168.2.16	115.112.79.149
May 8, 2024 08:41:25.526010036 CEST	49988	2121	192.168.2.16	102.27.2.20
May 8, 2024 08:41:25.526011944 CEST	49980	2121	192.168.2.16	86.13.48.192
May 8, 2024 08:41:25.526014090 CEST	49978	2121	192.168.2.16	23.192.166.102
May 8, 2024 08:41:25.526011944 CEST	49991	21	192.168.2.16	45.153.57.22
May 8, 2024 08:41:25.526014090 CEST	49979	21	192.168.2.16	86.13.48.192
May 8, 2024 08:41:25.526015043 CEST	49989	21	192.168.2.16	123.4.235.233
May 8, 2024 08:41:25.526015997 CEST	49974	2121	192.168.2.16	37.28.15.192
May 8, 2024 08:41:25.528685093 CEST	21	49913	211.37.73.195	192.168.2.16
May 8, 2024 08:41:25.532433987 CEST	49977	21	192.168.2.16	23.192.166.102
May 8, 2024 08:41:25.532454014 CEST	49983	2121	192.168.2.16	211.104.99.158
May 8, 2024 08:41:25.532454014 CEST	49992	2121	192.168.2.16	45.153.57.22
May 8, 2024 08:41:25.532483101 CEST	49997	2121	192.168.2.16	27.33.157.64
May 8, 2024 08:41:25.532483101 CEST	49999	2121	192.168.2.16	104.21.239.40
May 8, 2024 08:41:25.532486916 CEST	49990	2121	192.168.2.16	123.4.235.233
May 8, 2024 08:41:25.532495022 CEST	50015	21	192.168.2.16	95.101.166.24
May 8, 2024 08:41:25.532495022 CEST	50020	2121	192.168.2.16	67.189.152.9
May 8, 2024 08:41:25.532504082 CEST	50000	21	192.168.2.16	204.254.177.81
May 8, 2024 08:41:25.532504082 CEST	50018	21	192.168.2.16	67.189.152.9
May 8, 2024 08:41:25.539854050 CEST	2121	50073	139.180.55.89	192.168.2.16
May 8, 2024 08:41:25.539870024 CEST	21	50074	139.180.55.89	192.168.2.16
May 8, 2024 08:41:25.540821075 CEST	49998	21	192.168.2.16	104.21.239.40
May 8, 2024 08:41:25.540821075 CEST	50001	21	192.168.2.16	27.33.157.64
May 8, 2024 08:41:25.540824890 CEST	50006	2121	192.168.2.16	20.4.159.89
May 8, 2024 08:41:25.540847063 CEST	50009	21	192.168.2.16	86.90.22.187
May 8, 2024 08:41:25.540847063 CEST	50011	2121	192.168.2.16	95.101.166.24
May 8, 2024 08:41:25.540847063 CEST	50002	2121	192.168.2.16	204.254.177.81
May 8, 2024 08:41:25.540849924 CEST	50004	21	192.168.2.16	124.76.80.236
May 8, 2024 08:41:25.540851116 CEST	50003	21	192.168.2.16	20.4.159.89
May 8, 2024 08:41:25.540851116 CEST	50005	2121	192.168.2.16	124.76.80.236
May 8, 2024 08:41:25.540851116 CEST	50012	21	192.168.2.16	79.145.211.71
May 8, 2024 08:41:25.540851116 CEST	50019	2121	192.168.2.16	24.99.37.171
May 8, 2024 08:41:25.540855885 CEST	50014	21	192.168.2.16	213.49.25.250
May 8, 2024 08:41:25.540855885 CEST	50010	2121	192.168.2.16	86.90.22.187
May 8, 2024 08:41:25.541989088 CEST	50017	21	192.168.2.16	24.99.37.171
May 8, 2024 08:41:25.541990995 CEST	50021	21	192.168.2.16	93.123.134.76
May 8, 2024 08:41:25.541992903 CEST	50016	2121	192.168.2.16	213.49.25.250
May 8, 2024 08:41:25.541992903 CEST	50013	2121	192.168.2.16	79.145.211.71
May 8, 2024 08:41:25.556942940 CEST	50023	21	192.168.2.16	95.115.71.162
May 8, 2024 08:41:25.556941986 CEST	50028	2121	192.168.2.16	187.233.203.114
May 8, 2024 08:41:25.556943893 CEST	50035	21	192.168.2.16	201.110.133.95
May 8, 2024 08:41:25.556946039 CEST	50025	21	192.168.2.16	75.183.52.97
May 8, 2024 08:41:25.556943893 CEST	50046	2121	192.168.2.16	5.71.7.211
May 8, 2024 08:41:25.556946039 CEST	50036	2121	192.168.2.16	201.110.133.95
May 8, 2024 08:41:25.556945086 CEST	50045	2121	192.168.2.16	94.33.136.136
May 8, 2024 08:41:25.556942940 CEST	50039	2121	192.168.2.16	205.211.202.1
May 8, 2024 08:41:25.556948900 CEST	50030	21	192.168.2.16	203.128.203.48
May 8, 2024 08:41:25.556941986 CEST	50047	2121	192.168.2.16	130.233.94.223
May 8, 2024 08:41:25.556947947 CEST	50027	21	192.168.2.16	187.233.203.114
May 8, 2024 08:41:25.556946039 CEST	50022	2121	192.168.2.16	93.123.134.76
May 8, 2024 08:41:25.556942940 CEST	50043	21	192.168.2.16	94.33.136.136
May 8, 2024 08:41:25.556946039 CEST	50034	2121	192.168.2.16	178.64.38.166
May 8, 2024 08:41:25.556948900 CEST	50038	21	192.168.2.16	91.146.153.183
May 8, 2024 08:41:25.556946039 CEST	50029	2121	192.168.2.16	203.128.203.48
May 8, 2024 08:41:25.556947947 CEST	50037	21	192.168.2.16	205.211.202.1
May 8, 2024 08:41:25.556950092 CEST	50042	2121	192.168.2.16	95.52.30.52
May 8, 2024 08:41:25.556946039 CEST	50041	21	192.168.2.16	95.52.30.52
May 8, 2024 08:41:25.556950092 CEST	50026	2121	192.168.2.16	75.183.52.97
May 8, 2024 08:41:25.556946993 CEST	50024	2121	192.168.2.16	95.115.71.162
May 8, 2024 08:41:25.556947947 CEST	50048	21	192.168.2.16	130.233.94.223
May 8, 2024 08:41:25.556946993 CEST	50044	21	192.168.2.16	5.71.7.211
May 8, 2024 08:41:25.556950092 CEST	50033	21	192.168.2.16	178.64.38.166
May 8, 2024 08:41:25.556950092 CEST	50040	2121	192.168.2.16	91.146.153.183
May 8, 2024 08:41:25.572798014 CEST	50051	21	192.168.2.16	121.133.25.163
May 8, 2024 08:41:25.572798014 CEST	50056	2121	192.168.2.16	89.106.127.202
May 8, 2024 08:41:25.572798014 CEST	50060	2121	192.168.2.16	31.214.210.76
May 8, 2024 08:41:25.572815895 CEST	50055	21	192.168.2.16	89.106.127.202
May 8, 2024 08:41:25.572817087 CEST	50072	2121	192.168.2.16	20.53.160.214
May 8, 2024 08:41:25.572817087 CEST	50050	2121	192.168.2.16	18.238.143.28
May 8, 2024 08:41:25.572818041 CEST	50065	21	192.168.2.16	187.158.40.132
May 8, 2024 08:41:25.572818041 CEST	50069	21	192.168.2.16	223.231.177.195
May 8, 2024 08:41:25.572819948 CEST	50066	2121	192.168.2.16	187.158.40.132
May 8, 2024 08:41:25.572824001 CEST	50067	21	192.168.2.16	70.104.196.79
May 8, 2024 08:41:25.572839975 CEST	50052	2121	192.168.2.16	121.133.25.163
May 8, 2024 08:41:25.572843075 CEST	50057	21	192.168.2.16	181.24.179.233
May 8, 2024 08:41:25.572846889 CEST	50070	21	192.168.2.16	20.53.160.214
May 8, 2024 08:41:25.572849035 CEST	50049	21	192.168.2.16	18.238.143.28
May 8, 2024 08:41:25.572850943 CEST	50054	2121	192.168.2.16	92.64.11.129
May 8, 2024 08:41:25.572849035 CEST	50075	21	192.168.2.16	24.177.67.22
May 8, 2024 08:41:25.572850943 CEST	50059	21	192.168.2.16	31.214.210.76
May 8, 2024 08:41:25.572849035 CEST	50062	2121	192.168.2.16	93.23.184.172
May 8, 2024 08:41:25.572869062 CEST	50068	2121	192.168.2.16	70.104.196.79
May 8, 2024 08:41:25.572869062 CEST	50071	2121	192.168.2.16	223.231.177.195
May 8, 2024 08:41:25.572870970 CEST	50063	21	192.168.2.16	119.113.69.12
May 8, 2024 08:41:25.572870970 CEST	50058	2121	192.168.2.16	181.24.179.233
May 8, 2024 08:41:25.572873116 CEST	50053	21	192.168.2.16	92.64.11.129
May 8, 2024 08:41:25.572870970 CEST	50061	21	192.168.2.16	93.23.184.172
May 8, 2024 08:41:25.572870970 CEST	50064	2121	192.168.2.16	119.113.69.12
May 8, 2024 08:41:25.573400974 CEST	50109	21	192.168.2.16	49.164.93.64
May 8, 2024 08:41:25.588823080 CEST	50076	2121	192.168.2.16	24.177.67.22
May 8, 2024 08:41:25.588824034 CEST	50077	21	192.168.2.16	79.27.122.148
May 8, 2024 08:41:25.588824987 CEST	50079	2121	192.168.2.16	187.18.231.64
May 8, 2024 08:41:25.588850975 CEST	50082	2121	192.168.2.16	96.50.237.171
May 8, 2024 08:41:25.588850975 CEST	50090	21	192.168.2.16	188.148.10.89
May 8, 2024 08:41:25.588851929 CEST	50100	21	192.168.2.16	177.207.16.68
May 8, 2024 08:41:25.588851929 CEST	50101	21	192.168.2.16	219.74.199.173
May 8, 2024 08:41:25.588851929 CEST	50092	2121	192.168.2.16	188.148.10.89
May 8, 2024 08:41:25.588851929 CEST	50081	21	192.168.2.16	96.50.237.171
May 8, 2024 08:41:25.588851929 CEST	50088	2121	192.168.2.16	77.203.56.164
May 8, 2024 08:41:25.588876963 CEST	50091	2121	192.168.2.16	175.234.156.232
May 8, 2024 08:41:25.588879108 CEST	50087	21	192.168.2.16	77.203.56.164
May 8, 2024 08:41:25.588879108 CEST	50086	2121	192.168.2.16	24.130.106.21
May 8, 2024 08:41:25.588879108 CEST	50097	21	192.168.2.16	47.243.207.139
May 8, 2024 08:41:25.588879108 CEST	50103	2121	192.168.2.16	219.74.199.173
May 8, 2024 08:41:25.588882923 CEST	50085	2121	192.168.2.16	178.1.32.243
May 8, 2024 08:41:25.588882923 CEST	50094	2121	192.168.2.16	66.130.205.82
May 8, 2024 08:41:25.588882923 CEST	50083	21	192.168.2.16	178.1.32.243
May 8, 2024 08:41:25.588882923 CEST	50093	21	192.168.2.16	66.130.205.82
May 8, 2024 08:41:25.589986086 CEST	50098	2121	192.168.2.16	47.243.207.139
May 8, 2024 08:41:25.590984106 CEST	50078	2121	192.168.2.16	79.27.122.148
May 8, 2024 08:41:25.590996981 CEST	50084	21	192.168.2.16	24.130.106.21
May 8, 2024 08:41:25.590998888 CEST	50080	21	192.168.2.16	187.18.231.64
May 8, 2024 08:41:25.591003895 CEST	50095	2121	192.168.2.16	207.172.169.15
May 8, 2024 08:41:25.591007948 CEST	50089	21	192.168.2.16	175.234.156.232
May 8, 2024 08:41:25.591007948 CEST	50096	21	192.168.2.16	207.172.169.15
May 8, 2024 08:41:25.606034040 CEST	2121	49942	219.157.216.200	192.168.2.16
May 8, 2024 08:41:25.606924057 CEST	2121	49944	223.13.57.142	192.168.2.16
May 8, 2024 08:41:25.612262964 CEST	21	49941	219.157.216.200	192.168.2.16
May 8, 2024 08:41:25.664938927 CEST	21	49995	118.52.252.40	192.168.2.16
May 8, 2024 08:41:25.666732073 CEST	2121	49914	211.37.73.195	192.168.2.16
May 8, 2024 08:41:25.668852091 CEST	49931	21	192.168.2.16	185.252.215.74
May 8, 2024 08:41:25.668929100 CEST	49932	2121	192.168.2.16	185.252.215.74
May 8, 2024 08:41:25.676703930 CEST	21	49984	210.106.251.150	192.168.2.16
May 8, 2024 08:41:25.677799940 CEST	2121	49986	210.106.251.150	192.168.2.16
May 8, 2024 08:41:25.685894966 CEST	2121	49996	118.52.252.40	192.168.2.16
May 8, 2024 08:41:25.731813908 CEST	49909	21	192.168.2.16	39.27.13.134
May 8, 2024 08:41:25.747425079 CEST	21	50031	81.198.111.173	192.168.2.16
May 8, 2024 08:41:25.748742104 CEST	2121	50104	163.180.232.87	192.168.2.16
May 8, 2024 08:41:25.748806953 CEST	21	50102	163.180.232.87	192.168.2.16
May 8, 2024 08:41:25.751116991 CEST	2121	50032	81.198.111.173	192.168.2.16
May 8, 2024 08:41:25.755794048 CEST	21	49993	212.193.50.13	192.168.2.16
May 8, 2024 08:41:25.756380081 CEST	2121	49994	212.193.50.13	192.168.2.16
May 8, 2024 08:41:25.778580904 CEST	2121	50099	177.207.16.68	192.168.2.16
May 8, 2024 08:41:25.779814005 CEST	49910	2121	192.168.2.16	39.27.13.134
May 8, 2024 08:41:25.779958963 CEST	49912	2121	192.168.2.16	85.247.109.248
May 8, 2024 08:41:25.805499077 CEST	2121	49955	133.159.212.113	192.168.2.16
May 8, 2024 08:41:25.843776941 CEST	21	49964	133.159.212.113	192.168.2.16
May 8, 2024 08:41:25.858836889 CEST	50105	21	192.168.2.16	79.234.90.250
May 8, 2024 08:41:25.858836889 CEST	50106	2121	192.168.2.16	79.234.90.250
May 8, 2024 08:41:25.890831947 CEST	50107	21	192.168.2.16	73.14.28.18
May 8, 2024 08:41:25.921850920 CEST	49918	2121	192.168.2.16	39.58.197.109
May 8, 2024 08:41:25.968836069 CEST	50108	2121	192.168.2.16	73.14.28.18
May 8, 2024 08:41:25.987169027 CEST	2121	49932	185.252.215.74	192.168.2.16
May 8, 2024 08:41:25.987185001 CEST	21	49931	185.252.215.74	192.168.2.16
May 8, 2024 08:41:26.000983000 CEST	49915	21	192.168.2.16	92.252.174.158
May 8, 2024 08:41:26.031846046 CEST	49913	21	192.168.2.16	211.37.73.195
May 8, 2024 08:41:26.047828913 CEST	50073	2121	192.168.2.16	139.180.55.89
May 8, 2024 08:41:26.047832012 CEST	50074	21	192.168.2.16	139.180.55.89
May 8, 2024 08:41:26.049988031 CEST	49916	2121	192.168.2.16	92.252.174.158
May 8, 2024 08:41:26.052912951 CEST	21	49909	39.27.13.134	192.168.2.16
May 8, 2024 08:41:26.053343058 CEST	50110	2121	192.168.2.16	49.164.93.64
May 8, 2024 08:41:26.063815117 CEST	49917	21	192.168.2.16	39.58.197.109
May 8, 2024 08:41:26.073710918 CEST	2121	49988	102.27.2.20	192.168.2.16
May 8, 2024 08:41:26.074157000 CEST	21	49987	102.27.2.20	192.168.2.16
May 8, 2024 08:41:26.076453924 CEST	2121	49922	179.244.78.184	192.168.2.16
May 8, 2024 08:41:26.079291105 CEST	21	49921	179.244.78.184	192.168.2.16
May 8, 2024 08:41:26.093950987 CEST	2121	49910	39.27.13.134	192.168.2.16
May 8, 2024 08:41:26.094338894 CEST	50111	21	192.168.2.16	94.10.134.105
May 8, 2024 08:41:26.095918894 CEST	49920	21	192.168.2.16	86.20.170.121
May 8, 2024 08:41:26.111843109 CEST	49919	2121	192.168.2.16	86.20.170.121
May 8, 2024 08:41:26.111864090 CEST	49942	2121	192.168.2.16	219.157.216.200
May 8, 2024 08:41:26.111864090 CEST	49944	2121	192.168.2.16	223.13.57.142
May 8, 2024 08:41:26.127811909 CEST	49925	21	192.168.2.16	73.117.145.210
May 8, 2024 08:41:26.127918959 CEST	49941	21	192.168.2.16	219.157.216.200
May 8, 2024 08:41:26.128253937 CEST	49923	21	192.168.2.16	188.179.76.56
May 8, 2024 08:41:26.143810034 CEST	49927	21	192.168.2.16	223.112.252.89
May 8, 2024 08:41:26.143810034 CEST	49924	2121	192.168.2.16	188.179.76.56
May 8, 2024 08:41:26.143811941 CEST	49926	2121	192.168.2.16	73.117.145.210
May 8, 2024 08:41:26.145992041 CEST	49928	2121	192.168.2.16	223.112.252.89
May 8, 2024 08:41:26.175791979 CEST	49914	2121	192.168.2.16	211.37.73.195
May 8, 2024 08:41:26.175816059 CEST	49929	21	192.168.2.16	95.153.49.77
May 8, 2024 08:41:26.175911903 CEST	49995	21	192.168.2.16	118.52.252.40
May 8, 2024 08:41:26.191800117 CEST	49986	2121	192.168.2.16	210.106.251.150
May 8, 2024 08:41:26.191817999 CEST	49996	2121	192.168.2.16	118.52.252.40
May 8, 2024 08:41:26.191818953 CEST	49930	2121	192.168.2.16	95.153.49.77
May 8, 2024 08:41:26.191829920 CEST	49984	21	192.168.2.16	210.106.251.150
May 8, 2024 08:41:26.222842932 CEST	49934	21	192.168.2.16	91.36.126.116
May 8, 2024 08:41:26.222974062 CEST	49935	2121	192.168.2.16	2.122.182.57
May 8, 2024 08:41:26.223027945 CEST	49933	21	192.168.2.16	2.122.182.57
May 8, 2024 08:41:26.237838984 CEST	49936	2121	192.168.2.16	91.36.126.116
May 8, 2024 08:41:26.252825022 CEST	50104	2121	192.168.2.16	163.180.232.87
May 8, 2024 08:41:26.253684044 CEST	50031	21	192.168.2.16	81.198.111.173
May 8, 2024 08:41:26.253720999 CEST	50032	2121	192.168.2.16	81.198.111.173
May 8, 2024 08:41:26.253736973 CEST	49937	21	192.168.2.16	178.211.237.37
May 8, 2024 08:41:26.253982067 CEST	50102	21	192.168.2.16	163.180.232.87
May 8, 2024 08:41:26.268711090 CEST	49993	21	192.168.2.16	212.193.50.13
May 8, 2024 08:41:26.268712997 CEST	49994	2121	192.168.2.16	212.193.50.13
May 8, 2024 08:41:26.283838987 CEST	50099	2121	192.168.2.16	177.207.16.68
May 8, 2024 08:41:26.285015106 CEST	2121	50073	139.180.55.89	192.168.2.16
May 8, 2024 08:41:26.285029888 CEST	21	50074	139.180.55.89	192.168.2.16
May 8, 2024 08:41:26.315818071 CEST	49955	2121	192.168.2.16	133.159.212.113
May 8, 2024 08:41:26.336723089 CEST	21	49913	211.37.73.195	192.168.2.16
May 8, 2024 08:41:26.337212086 CEST	50112	2121	192.168.2.16	94.10.134.105
May 8, 2024 08:41:26.347831964 CEST	49964	21	192.168.2.16	133.159.212.113
May 8, 2024 08:41:26.368448973 CEST	2121	49918	39.58.197.109	192.168.2.16
May 8, 2024 08:41:26.379837036 CEST	49938	2121	192.168.2.16	178.211.237.37
May 8, 2024 08:41:26.395818949 CEST	49939	21	192.168.2.16	181.175.197.255
May 8, 2024 08:41:26.460710049 CEST	2121	49914	211.37.73.195	192.168.2.16
May 8, 2024 08:41:26.461172104 CEST	50113	21	192.168.2.16	24.12.206.219
May 8, 2024 08:41:26.461652040 CEST	2121	49944	223.13.57.142	192.168.2.16
May 8, 2024 08:41:26.475802898 CEST	49940	2121	192.168.2.16	181.175.197.255
May 8, 2024 08:41:26.478497028 CEST	2121	49942	219.157.216.200	192.168.2.16
May 8, 2024 08:41:26.491811037 CEST	49932	2121	192.168.2.16	185.252.215.74
May 8, 2024 08:41:26.492494106 CEST	21	49995	118.52.252.40	192.168.2.16
May 8, 2024 08:41:26.492523909 CEST	49931	21	192.168.2.16	185.252.215.74
May 8, 2024 08:41:26.500807047 CEST	21	49941	219.157.216.200	192.168.2.16
May 8, 2024 08:41:26.513739109 CEST	2121	49996	118.52.252.40	192.168.2.16
May 8, 2024 08:41:26.519196987 CEST	21	49984	210.106.251.150	192.168.2.16
May 8, 2024 08:41:26.520351887 CEST	2121	49986	210.106.251.150	192.168.2.16
May 8, 2024 08:41:26.523813963 CEST	49943	21	192.168.2.16	223.13.57.142
May 8, 2024 08:41:26.587827921 CEST	49988	2121	192.168.2.16	102.27.2.20
May 8, 2024 08:41:26.587833881 CEST	50109	21	192.168.2.16	49.164.93.64
May 8, 2024 08:41:26.587835073 CEST	49987	21	192.168.2.16	102.27.2.20
May 8, 2024 08:41:26.587833881 CEST	49921	21	192.168.2.16	179.244.78.184
May 8, 2024 08:41:26.588217020 CEST	2121	50104	163.180.232.87	192.168.2.16
May 8, 2024 08:41:26.588248968 CEST	49922	2121	192.168.2.16	179.244.78.184
May 8, 2024 08:41:26.589077950 CEST	21	50102	163.180.232.87	192.168.2.16
May 8, 2024 08:41:26.604424000 CEST	21	50031	81.198.111.173	192.168.2.16
May 8, 2024 08:41:26.605999947 CEST	2121	50032	81.198.111.173	192.168.2.16
May 8, 2024 08:41:26.628575087 CEST	21	49993	212.193.50.13	192.168.2.16
May 8, 2024 08:41:26.628894091 CEST	2121	49994	212.193.50.13	192.168.2.16
May 8, 2024 08:41:26.633640051 CEST	2121	50099	177.207.16.68	192.168.2.16
May 8, 2024 08:41:26.674587011 CEST	2121	49955	133.159.212.113	192.168.2.16
May 8, 2024 08:41:26.716923952 CEST	21	49964	133.159.212.113	192.168.2.16
May 8, 2024 08:41:26.763842106 CEST	49946	2121	192.168.2.16	216.201.52.26
May 8, 2024 08:41:26.763855934 CEST	49945	21	192.168.2.16	216.201.52.26
May 8, 2024 08:41:26.795824051 CEST	50073	2121	192.168.2.16	139.180.55.89
May 8, 2024 08:41:26.795824051 CEST	50074	21	192.168.2.16	139.180.55.89
May 8, 2024 08:41:26.807430029 CEST	2121	49932	185.252.215.74	192.168.2.16
May 8, 2024 08:41:26.807847977 CEST	50114	2121	192.168.2.16	24.12.206.219
May 8, 2024 08:41:26.808343887 CEST	21	49931	185.252.215.74	192.168.2.16
May 8, 2024 08:41:26.827047110 CEST	50115	21	192.168.2.16	79.209.25.45
May 8, 2024 08:41:26.874829054 CEST	49918	2121	192.168.2.16	39.58.197.109
May 8, 2024 08:41:26.969830990 CEST	49944	2121	192.168.2.16	223.13.57.142
May 8, 2024 08:41:26.985825062 CEST	49942	2121	192.168.2.16	219.157.216.200
May 8, 2024 08:41:26.987724066 CEST	2121	49922	179.244.78.184	192.168.2.16
May 8, 2024 08:41:26.991344929 CEST	21	49921	179.244.78.184	192.168.2.16
May 8, 2024 08:41:27.001818895 CEST	49995	21	192.168.2.16	118.52.252.40
May 8, 2024 08:41:27.001832008 CEST	49947	21	192.168.2.16	118.214.111.215
May 8, 2024 08:41:27.001949072 CEST	49941	21	192.168.2.16	219.157.216.200
May 8, 2024 08:41:27.017020941 CEST	49996	2121	192.168.2.16	118.52.252.40
May 8, 2024 08:41:27.032824039 CEST	49984	21	192.168.2.16	210.106.251.150
May 8, 2024 08:41:27.032830954 CEST	49986	2121	192.168.2.16	210.106.251.150
May 8, 2024 08:41:27.034662008 CEST	2121	50073	139.180.55.89	192.168.2.16
May 8, 2024 08:41:27.034677029 CEST	21	50074	139.180.55.89	192.168.2.16
May 8, 2024 08:41:27.064862013 CEST	50110	2121	192.168.2.16	49.164.93.64
May 8, 2024 08:41:27.096812963 CEST	50104	2121	192.168.2.16	163.180.232.87
May 8, 2024 08:41:27.096812963 CEST	50102	21	192.168.2.16	163.180.232.87
May 8, 2024 08:41:27.096961021 CEST	50111	21	192.168.2.16	94.10.134.105
May 8, 2024 08:41:27.112813950 CEST	50031	21	192.168.2.16	81.198.111.173
May 8, 2024 08:41:27.112993956 CEST	50032	2121	192.168.2.16	81.198.111.173
May 8, 2024 08:41:27.143822908 CEST	49994	2121	192.168.2.16	212.193.50.13
May 8, 2024 08:41:27.143959999 CEST	49993	21	192.168.2.16	212.193.50.13
May 8, 2024 08:41:27.143965006 CEST	50099	2121	192.168.2.16	177.207.16.68
May 8, 2024 08:41:27.175844908 CEST	49955	2121	192.168.2.16	133.159.212.113
May 8, 2024 08:41:27.222980976 CEST	49964	21	192.168.2.16	133.159.212.113
May 8, 2024 08:41:27.237015009 CEST	2121	49988	102.27.2.20	192.168.2.16
May 8, 2024 08:41:27.238133907 CEST	21	49987	102.27.2.20	192.168.2.16
May 8, 2024 08:41:27.317560911 CEST	21	49995	118.52.252.40	192.168.2.16
May 8, 2024 08:41:27.321505070 CEST	2121	49918	39.58.197.109	192.168.2.16
May 8, 2024 08:41:27.322015047 CEST	50116	2121	192.168.2.16	79.209.25.45
May 8, 2024 08:41:27.323144913 CEST	2121	49944	223.13.57.142	192.168.2.16
May 8, 2024 08:41:27.339639902 CEST	2121	49996	118.52.252.40	192.168.2.16
May 8, 2024 08:41:27.347806931 CEST	50112	2121	192.168.2.16	94.10.134.105
May 8, 2024 08:41:27.348402977 CEST	50117	21	192.168.2.16	166.151.156.117
May 8, 2024 08:41:27.352372885 CEST	2121	49942	219.157.216.200	192.168.2.16
May 8, 2024 08:41:27.360883951 CEST	21	49984	210.106.251.150	192.168.2.16
May 8, 2024 08:41:27.361996889 CEST	2121	49986	210.106.251.150	192.168.2.16
May 8, 2024 08:41:27.364120960 CEST	50118	2121	192.168.2.16	166.151.156.117
May 8, 2024 08:41:27.374735117 CEST	21	49941	219.157.216.200	192.168.2.16
May 8, 2024 08:41:27.375114918 CEST	50119	21	192.168.2.16	178.198.107.39
May 8, 2024 08:41:27.411248922 CEST	50120	2121	192.168.2.16	178.198.107.39
May 8, 2024 08:41:27.430433035 CEST	2121	50104	163.180.232.87	192.168.2.16
May 8, 2024 08:41:27.430593967 CEST	21	50102	163.180.232.87	192.168.2.16
May 8, 2024 08:41:27.464114904 CEST	21	50031	81.198.111.173	192.168.2.16
May 8, 2024 08:41:27.464591980 CEST	2121	50032	81.198.111.173	192.168.2.16
May 8, 2024 08:41:27.473809004 CEST	50113	21	192.168.2.16	24.12.206.219
May 8, 2024 08:41:27.489835024 CEST	49922	2121	192.168.2.16	179.244.78.184
May 8, 2024 08:41:27.490115881 CEST	50121	21	192.168.2.16	75.136.134.31
May 8, 2024 08:41:27.494393110 CEST	2121	50099	177.207.16.68	192.168.2.16
May 8, 2024 08:41:27.500790119 CEST	21	49993	212.193.50.13	192.168.2.16
May 8, 2024 08:41:27.500803947 CEST	2121	49994	212.193.50.13	192.168.2.16
May 8, 2024 08:41:27.504828930 CEST	49921	21	192.168.2.16	179.244.78.184
May 8, 2024 08:41:27.520824909 CEST	49958	2121	192.168.2.16	92.107.132.216
May 8, 2024 08:41:27.520824909 CEST	49960	21	192.168.2.16	92.107.132.216
May 8, 2024 08:41:27.520824909 CEST	49956	2121	192.168.2.16	197.49.46.137
May 8, 2024 08:41:27.520824909 CEST	49951	21	192.168.2.16	73.67.38.37
May 8, 2024 08:41:27.520849943 CEST	49966	2121	192.168.2.16	103.21.62.148
May 8, 2024 08:41:27.520852089 CEST	49961	2121	192.168.2.16	88.12.163.193
May 8, 2024 08:41:27.520855904 CEST	49953	21	192.168.2.16	211.211.70.243
May 8, 2024 08:41:27.520854950 CEST	49950	2121	192.168.2.16	27.213.95.111
May 8, 2024 08:41:27.520865917 CEST	49968	21	192.168.2.16	197.49.46.137
May 8, 2024 08:41:27.520869017 CEST	49959	21	192.168.2.16	88.12.163.193
May 8, 2024 08:41:27.520869970 CEST	49963	21	192.168.2.16	87.13.248.211
May 8, 2024 08:41:27.520874977 CEST	49962	21	192.168.2.16	35.171.239.79
May 8, 2024 08:41:27.520874977 CEST	49965	2121	192.168.2.16	87.13.248.211
May 8, 2024 08:41:27.520880938 CEST	49957	21	192.168.2.16	103.21.62.148
May 8, 2024 08:41:27.521805048 CEST	49948	2121	192.168.2.16	118.214.111.215
May 8, 2024 08:41:27.521806002 CEST	49969	21	192.168.2.16	23.241.156.235
May 8, 2024 08:41:27.521814108 CEST	49952	2121	192.168.2.16	73.67.38.37
May 8, 2024 08:41:27.521820068 CEST	49949	21	192.168.2.16	27.213.95.111
May 8, 2024 08:41:27.521826029 CEST	49967	2121	192.168.2.16	35.171.239.79
May 8, 2024 08:41:27.521828890 CEST	49954	2121	192.168.2.16	211.211.70.243
May 8, 2024 08:41:27.532305002 CEST	2121	49955	133.159.212.113	192.168.2.16
May 8, 2024 08:41:27.536797047 CEST	49973	21	192.168.2.16	80.65.79.44
May 8, 2024 08:41:27.536813974 CEST	49981	21	192.168.2.16	211.104.99.158
May 8, 2024 08:41:27.536813974 CEST	49972	21	192.168.2.16	171.237.167.200
May 8, 2024 08:41:27.536834955 CEST	49985	2121	192.168.2.16	115.112.79.149
May 8, 2024 08:41:27.536834955 CEST	49971	21	192.168.2.16	37.28.15.192
May 8, 2024 08:41:27.536834955 CEST	49977	21	192.168.2.16	23.192.166.102
May 8, 2024 08:41:27.536834955 CEST	50074	21	192.168.2.16	139.180.55.89
May 8, 2024 08:41:27.536834002 CEST	49983	2121	192.168.2.16	211.104.99.158
May 8, 2024 08:41:27.536839962 CEST	49974	2121	192.168.2.16	37.28.15.192
May 8, 2024 08:41:27.536835909 CEST	49979	21	192.168.2.16	86.13.48.192
May 8, 2024 08:41:27.536854029 CEST	49992	2121	192.168.2.16	45.153.57.22
May 8, 2024 08:41:27.536854029 CEST	49990	2121	192.168.2.16	123.4.235.233
May 8, 2024 08:41:27.536856890 CEST	49982	21	192.168.2.16	115.112.79.149
May 8, 2024 08:41:27.536856890 CEST	50073	2121	192.168.2.16	139.180.55.89
May 8, 2024 08:41:27.536856890 CEST	49975	2121	192.168.2.16	171.237.167.200
May 8, 2024 08:41:27.536856890 CEST	50000	21	192.168.2.16	204.254.177.81
May 8, 2024 08:41:27.536856890 CEST	49997	2121	192.168.2.16	27.33.157.64
May 8, 2024 08:41:27.536858082 CEST	49999	2121	192.168.2.16	104.21.239.40
May 8, 2024 08:41:27.537987947 CEST	50018	21	192.168.2.16	67.189.152.9
May 8, 2024 08:41:27.537990093 CEST	50015	21	192.168.2.16	95.101.166.24
May 8, 2024 08:41:27.537990093 CEST	50020	2121	192.168.2.16	67.189.152.9
May 8, 2024 08:41:27.538307905 CEST	49970	2121	192.168.2.16	23.241.156.235
May 8, 2024 08:41:27.538324118 CEST	49976	2121	192.168.2.16	80.65.79.44
May 8, 2024 08:41:27.538325071 CEST	49978	2121	192.168.2.16	23.192.166.102
May 8, 2024 08:41:27.538336039 CEST	49980	2121	192.168.2.16	86.13.48.192
May 8, 2024 08:41:27.538336992 CEST	49989	21	192.168.2.16	123.4.235.233
May 8, 2024 08:41:27.538336039 CEST	49991	21	192.168.2.16	45.153.57.22
May 8, 2024 08:41:27.552798986 CEST	50006	2121	192.168.2.16	20.4.159.89
May 8, 2024 08:41:27.552807093 CEST	50005	2121	192.168.2.16	124.76.80.236
May 8, 2024 08:41:27.552812099 CEST	50002	2121	192.168.2.16	204.254.177.81
May 8, 2024 08:41:27.552819014 CEST	49998	21	192.168.2.16	104.21.239.40
May 8, 2024 08:41:27.552819014 CEST	50001	21	192.168.2.16	27.33.157.64
May 8, 2024 08:41:27.552819967 CEST	50010	2121	192.168.2.16	86.90.22.187
May 8, 2024 08:41:27.552831888 CEST	50021	21	192.168.2.16	93.123.134.76
May 8, 2024 08:41:27.552834034 CEST	50009	21	192.168.2.16	86.90.22.187
May 8, 2024 08:41:27.552834034 CEST	50003	21	192.168.2.16	20.4.159.89
May 8, 2024 08:41:27.552834988 CEST	50013	2121	192.168.2.16	79.145.211.71
May 8, 2024 08:41:27.552834034 CEST	50011	2121	192.168.2.16	95.101.166.24
May 8, 2024 08:41:27.552834034 CEST	50012	21	192.168.2.16	79.145.211.71
May 8, 2024 08:41:27.552834988 CEST	50004	21	192.168.2.16	124.76.80.236
May 8, 2024 08:41:27.553009033 CEST	50014	21	192.168.2.16	213.49.25.250
May 8, 2024 08:41:27.553009987 CEST	50017	21	192.168.2.16	24.99.37.171
May 8, 2024 08:41:27.553009033 CEST	50016	2121	192.168.2.16	213.49.25.250
May 8, 2024 08:41:27.553010941 CEST	50019	2121	192.168.2.16	24.99.37.171
May 8, 2024 08:41:27.568800926 CEST	50026	2121	192.168.2.16	75.183.52.97
May 8, 2024 08:41:27.568814993 CEST	50044	21	192.168.2.16	5.71.7.211
May 8, 2024 08:41:27.568815947 CEST	50023	21	192.168.2.16	95.115.71.162
May 8, 2024 08:41:27.568816900 CEST	50025	21	192.168.2.16	75.183.52.97
May 8, 2024 08:41:27.568816900 CEST	50029	2121	192.168.2.16	203.128.203.48
May 8, 2024 08:41:27.568816900 CEST	50041	21	192.168.2.16	95.52.30.52
May 8, 2024 08:41:27.568825006 CEST	50039	2121	192.168.2.16	205.211.202.1
May 8, 2024 08:41:27.568826914 CEST	50028	2121	192.168.2.16	187.233.203.114
May 8, 2024 08:41:27.568830013 CEST	50030	21	192.168.2.16	203.128.203.48
May 8, 2024 08:41:27.568830013 CEST	50045	2121	192.168.2.16	94.33.136.136
May 8, 2024 08:41:27.568830013 CEST	50033	21	192.168.2.16	178.64.38.166
May 8, 2024 08:41:27.568835974 CEST	50036	2121	192.168.2.16	201.110.133.95
May 8, 2024 08:41:27.568840981 CEST	50043	21	192.168.2.16	94.33.136.136
May 8, 2024 08:41:27.568840981 CEST	50022	2121	192.168.2.16	93.123.134.76
May 8, 2024 08:41:27.568840981 CEST	50024	2121	192.168.2.16	95.115.71.162
May 8, 2024 08:41:27.568842888 CEST	50027	21	192.168.2.16	187.233.203.114
May 8, 2024 08:41:27.568845987 CEST	50040	2121	192.168.2.16	91.146.153.183
May 8, 2024 08:41:27.568845987 CEST	50038	21	192.168.2.16	91.146.153.183
May 8, 2024 08:41:27.568845987 CEST	50042	2121	192.168.2.16	95.52.30.52
May 8, 2024 08:41:27.568851948 CEST	50034	2121	192.168.2.16	178.64.38.166
May 8, 2024 08:41:27.568851948 CEST	50035	21	192.168.2.16	201.110.133.95
May 8, 2024 08:41:27.568854094 CEST	50037	21	192.168.2.16	205.211.202.1
May 8, 2024 08:41:27.568861008 CEST	50048	21	192.168.2.16	130.233.94.223
May 8, 2024 08:41:27.569022894 CEST	50047	2121	192.168.2.16	130.233.94.223
May 8, 2024 08:41:27.569024086 CEST	50046	2121	192.168.2.16	5.71.7.211
May 8, 2024 08:41:27.584822893 CEST	50057	21	192.168.2.16	181.24.179.233
May 8, 2024 08:41:27.584822893 CEST	50056	2121	192.168.2.16	89.106.127.202
May 8, 2024 08:41:27.584824085 CEST	50050	2121	192.168.2.16	18.238.143.28
May 8, 2024 08:41:27.584826946 CEST	50051	21	192.168.2.16	121.133.25.163
May 8, 2024 08:41:27.584826946 CEST	50054	2121	192.168.2.16	92.64.11.129
May 8, 2024 08:41:27.584826946 CEST	50055	21	192.168.2.16	89.106.127.202
May 8, 2024 08:41:27.584826946 CEST	50049	21	192.168.2.16	18.238.143.28
May 8, 2024 08:41:27.584826946 CEST	50059	21	192.168.2.16	31.214.210.76
May 8, 2024 08:41:27.584850073 CEST	50062	2121	192.168.2.16	93.23.184.172
May 8, 2024 08:41:27.584853888 CEST	50060	2121	192.168.2.16	31.214.210.76
May 8, 2024 08:41:27.584856033 CEST	50065	21	192.168.2.16	187.158.40.132
May 8, 2024 08:41:27.584856033 CEST	50069	21	192.168.2.16	223.231.177.195
May 8, 2024 08:41:27.584856033 CEST	50053	21	192.168.2.16	92.64.11.129
May 8, 2024 08:41:27.584856987 CEST	50067	21	192.168.2.16	70.104.196.79
May 8, 2024 08:41:27.584857941 CEST	50072	2121	192.168.2.16	20.53.160.214
May 8, 2024 08:41:27.584857941 CEST	50070	21	192.168.2.16	20.53.160.214
May 8, 2024 08:41:27.584856033 CEST	50066	2121	192.168.2.16	187.158.40.132
May 8, 2024 08:41:27.584858894 CEST	50058	2121	192.168.2.16	181.24.179.233
May 8, 2024 08:41:27.584860086 CEST	50052	2121	192.168.2.16	121.133.25.163
May 8, 2024 08:41:27.584860086 CEST	50061	21	192.168.2.16	93.23.184.172
May 8, 2024 08:41:27.585988045 CEST	50064	2121	192.168.2.16	119.113.69.12
May 8, 2024 08:41:27.585995913 CEST	50063	21	192.168.2.16	119.113.69.12
May 8, 2024 08:41:27.585997105 CEST	50068	2121	192.168.2.16	70.104.196.79
May 8, 2024 08:41:27.585997105 CEST	50071	2121	192.168.2.16	223.231.177.195
May 8, 2024 08:41:27.585997105 CEST	50075	21	192.168.2.16	24.177.67.22
May 8, 2024 08:41:27.594815969 CEST	21	49964	133.159.212.113	192.168.2.16
May 8, 2024 08:41:27.600807905 CEST	50076	2121	192.168.2.16	24.177.67.22
May 8, 2024 08:41:27.600811005 CEST	50078	2121	192.168.2.16	79.27.122.148
May 8, 2024 08:41:27.600811958 CEST	50077	21	192.168.2.16	79.27.122.148
May 8, 2024 08:41:27.600826025 CEST	50082	2121	192.168.2.16	96.50.237.171
May 8, 2024 08:41:27.600828886 CEST	50079	2121	192.168.2.16	187.18.231.64
May 8, 2024 08:41:27.600828886 CEST	50089	21	192.168.2.16	175.234.156.232
May 8, 2024 08:41:27.600830078 CEST	50100	21	192.168.2.16	177.207.16.68
May 8, 2024 08:41:27.600830078 CEST	50081	21	192.168.2.16	96.50.237.171
May 8, 2024 08:41:27.600831985 CEST	50080	21	192.168.2.16	187.18.231.64
May 8, 2024 08:41:27.600832939 CEST	50101	21	192.168.2.16	219.74.199.173
May 8, 2024 08:41:27.600832939 CEST	50084	21	192.168.2.16	24.130.106.21
May 8, 2024 08:41:27.600852966 CEST	50091	2121	192.168.2.16	175.234.156.232
May 8, 2024 08:41:27.600856066 CEST	50087	21	192.168.2.16	77.203.56.164
May 8, 2024 08:41:27.600856066 CEST	50090	21	192.168.2.16	188.148.10.89
May 8, 2024 08:41:27.600857019 CEST	50086	2121	192.168.2.16	24.130.106.21
May 8, 2024 08:41:27.600857019 CEST	50095	2121	192.168.2.16	207.172.169.15
May 8, 2024 08:41:27.600857019 CEST	50097	21	192.168.2.16	47.243.207.139
May 8, 2024 08:41:27.600857019 CEST	50103	2121	192.168.2.16	219.74.199.173
May 8, 2024 08:41:27.600860119 CEST	50088	2121	192.168.2.16	77.203.56.164
May 8, 2024 08:41:27.600866079 CEST	50085	2121	192.168.2.16	178.1.32.243
May 8, 2024 08:41:27.600866079 CEST	50094	2121	192.168.2.16	66.130.205.82
May 8, 2024 08:41:27.600867033 CEST	50083	21	192.168.2.16	178.1.32.243
May 8, 2024 08:41:27.600866079 CEST	50096	21	192.168.2.16	207.172.169.15
May 8, 2024 08:41:27.600867033 CEST	50093	21	192.168.2.16	66.130.205.82
May 8, 2024 08:41:27.600867033 CEST	50092	2121	192.168.2.16	188.148.10.89
May 8, 2024 08:41:27.601990938 CEST	50098	2121	192.168.2.16	47.243.207.139
May 8, 2024 08:41:27.744829893 CEST	49988	2121	192.168.2.16	102.27.2.20
May 8, 2024 08:41:27.744832993 CEST	49987	21	192.168.2.16	102.27.2.20
May 8, 2024 08:41:27.774085999 CEST	21	50074	139.180.55.89	192.168.2.16
May 8, 2024 08:41:27.774105072 CEST	2121	50073	139.180.55.89	192.168.2.16
May 8, 2024 08:41:27.774604082 CEST	50122	2121	192.168.2.16	75.136.134.31
May 8, 2024 08:41:27.777234077 CEST	50123	21	192.168.2.16	80.117.188.48
May 8, 2024 08:41:27.777262926 CEST	50124	2121	192.168.2.16	80.117.188.48
May 8, 2024 08:41:27.808837891 CEST	50114	2121	192.168.2.16	24.12.206.219
May 8, 2024 08:41:27.824820042 CEST	49995	21	192.168.2.16	118.52.252.40
May 8, 2024 08:41:27.840806961 CEST	50115	21	192.168.2.16	79.209.25.45
May 8, 2024 08:41:27.840822935 CEST	49996	2121	192.168.2.16	118.52.252.40
May 8, 2024 08:41:27.867782116 CEST	2121	49922	179.244.78.184	192.168.2.16
May 8, 2024 08:41:27.871366024 CEST	21	49921	179.244.78.184	192.168.2.16
May 8, 2024 08:41:27.872802973 CEST	50105	21	192.168.2.16	79.234.90.250
May 8, 2024 08:41:27.872817039 CEST	50106	2121	192.168.2.16	79.234.90.250
May 8, 2024 08:41:27.872824907 CEST	49986	2121	192.168.2.16	210.106.251.150
May 8, 2024 08:41:27.872832060 CEST	49984	21	192.168.2.16	210.106.251.150
May 8, 2024 08:41:27.903801918 CEST	50107	21	192.168.2.16	73.14.28.18
May 8, 2024 08:41:27.935833931 CEST	50104	2121	192.168.2.16	163.180.232.87
May 8, 2024 08:41:27.935833931 CEST	50102	21	192.168.2.16	163.180.232.87
May 8, 2024 08:41:27.967865944 CEST	50031	21	192.168.2.16	81.198.111.173
May 8, 2024 08:41:27.968888044 CEST	50032	2121	192.168.2.16	81.198.111.173
May 8, 2024 08:41:27.969391108 CEST	50108	2121	192.168.2.16	73.14.28.18
May 8, 2024 08:41:27.999851942 CEST	50099	2121	192.168.2.16	177.207.16.68
May 8, 2024 08:41:28.000607014 CEST	50125	21	192.168.2.16	50.80.39.237
May 8, 2024 08:41:28.014808893 CEST	49994	2121	192.168.2.16	212.193.50.13
May 8, 2024 08:41:28.014822960 CEST	49993	21	192.168.2.16	212.193.50.13
May 8, 2024 08:41:28.045799017 CEST	49955	2121	192.168.2.16	133.159.212.113
May 8, 2024 08:41:28.046123981 CEST	50126	2121	192.168.2.16	50.80.39.237
May 8, 2024 08:41:28.062211990 CEST	50127	21	192.168.2.16	90.210.81.136
May 8, 2024 08:41:28.094738960 CEST	50128	21	192.168.2.16	139.59.79.85
May 8, 2024 08:41:28.094896078 CEST	50129	2121	192.168.2.16	90.210.81.136
May 8, 2024 08:41:28.094897032 CEST	50130	2121	192.168.2.16	139.59.79.85
May 8, 2024 08:41:28.109808922 CEST	49964	21	192.168.2.16	133.159.212.113
May 8, 2024 08:41:28.110239983 CEST	50131	21	192.168.2.16	171.79.111.124
May 8, 2024 08:41:28.127029896 CEST	50132	2121	192.168.2.16	171.79.111.124
May 8, 2024 08:41:28.127177954 CEST	50133	21	192.168.2.16	179.197.172.68
May 8, 2024 08:41:28.127211094 CEST	50134	2121	192.168.2.16	179.197.172.68
May 8, 2024 08:41:28.127317905 CEST	50135	21	192.168.2.16	80.18.101.99
May 8, 2024 08:41:28.140763998 CEST	21	49995	118.52.252.40	192.168.2.16
May 8, 2024 08:41:28.142261982 CEST	50136	2121	192.168.2.16	80.18.101.99
May 8, 2024 08:41:28.142631054 CEST	50137	21	192.168.2.16	183.173.247.100
May 8, 2024 08:41:28.158210039 CEST	50138	2121	192.168.2.16	183.173.247.100
May 8, 2024 08:41:28.162004948 CEST	2121	49996	118.52.252.40	192.168.2.16
May 8, 2024 08:41:28.174413919 CEST	50139	21	192.168.2.16	157.254.106.222
May 8, 2024 08:41:28.174474955 CEST	50140	2121	192.168.2.16	157.254.106.222
May 8, 2024 08:41:28.190155983 CEST	50141	21	192.168.2.16	105.209.161.139
May 8, 2024 08:41:28.197010040 CEST	2121	49988	102.27.2.20	192.168.2.16
May 8, 2024 08:41:28.198028088 CEST	21	49987	102.27.2.20	192.168.2.16
May 8, 2024 08:41:28.200253963 CEST	21	49984	210.106.251.150	192.168.2.16
May 8, 2024 08:41:28.201477051 CEST	2121	49986	210.106.251.150	192.168.2.16
May 8, 2024 08:41:28.222599983 CEST	50142	2121	192.168.2.16	105.209.161.139
May 8, 2024 08:41:28.222668886 CEST	50143	21	192.168.2.16	27.75.137.166
May 8, 2024 08:41:28.222714901 CEST	50145	21	192.168.2.16	73.12.247.170
May 8, 2024 08:41:28.222728968 CEST	50144	2121	192.168.2.16	27.75.137.166
May 8, 2024 08:41:28.222851992 CEST	50146	2121	192.168.2.16	73.12.247.170
May 8, 2024 08:41:28.238354921 CEST	50147	21	192.168.2.16	14.248.57.220
May 8, 2024 08:41:28.238413095 CEST	50148	2121	192.168.2.16	14.248.57.220
May 8, 2024 08:41:28.269584894 CEST	21	50102	163.180.232.87	192.168.2.16
May 8, 2024 08:41:28.269603968 CEST	2121	50104	163.180.232.87	192.168.2.16
May 8, 2024 08:41:28.270065069 CEST	50149	21	192.168.2.16	83.50.47.165
May 8, 2024 08:41:28.270102978 CEST	50150	2121	192.168.2.16	83.50.47.165
May 8, 2024 08:41:28.315421104 CEST	21	50031	81.198.111.173	192.168.2.16
May 8, 2024 08:41:28.315979958 CEST	50151	21	192.168.2.16	67.249.182.208
May 8, 2024 08:41:28.318162918 CEST	2121	50032	81.198.111.173	192.168.2.16
May 8, 2024 08:41:28.318610907 CEST	50152	2121	192.168.2.16	67.249.182.208
May 8, 2024 08:41:28.333822966 CEST	50116	2121	192.168.2.16	79.209.25.45
May 8, 2024 08:41:28.346606016 CEST	2121	50099	177.207.16.68	192.168.2.16
May 8, 2024 08:41:28.349822044 CEST	50117	21	192.168.2.16	166.151.156.117
May 8, 2024 08:41:28.365844011 CEST	50118	2121	192.168.2.16	166.151.156.117
May 8, 2024 08:41:28.366395950 CEST	50153	21	192.168.2.16	74.75.255.17
May 8, 2024 08:41:28.366447926 CEST	50154	2121	192.168.2.16	74.75.255.17
May 8, 2024 08:41:28.371202946 CEST	21	49993	212.193.50.13	192.168.2.16
May 8, 2024 08:41:28.371959925 CEST	2121	49994	212.193.50.13	192.168.2.16
May 8, 2024 08:41:28.372380972 CEST	50155	21	192.168.2.16	118.220.220.143
May 8, 2024 08:41:28.381824017 CEST	50119	21	192.168.2.16	178.198.107.39
May 8, 2024 08:41:28.382298946 CEST	50156	2121	192.168.2.16	118.220.220.143
May 8, 2024 08:41:28.382329941 CEST	50157	21	192.168.2.16	122.168.163.39
May 8, 2024 08:41:28.412842035 CEST	50120	2121	192.168.2.16	178.198.107.39
May 8, 2024 08:41:28.434638977 CEST	2121	49955	133.159.212.113	192.168.2.16
May 8, 2024 08:41:28.437264919 CEST	50158	2121	192.168.2.16	122.168.163.39
May 8, 2024 08:41:28.461158037 CEST	50159	21	192.168.2.16	139.185.33.251
May 8, 2024 08:41:28.474669933 CEST	21	49964	133.159.212.113	192.168.2.16
May 8, 2024 08:41:28.475114107 CEST	50160	2121	192.168.2.16	139.185.33.251
May 8, 2024 08:41:28.492809057 CEST	50121	21	192.168.2.16	75.136.134.31
May 8, 2024 08:41:28.506620884 CEST	2121	50130	139.59.79.85	192.168.2.16
May 8, 2024 08:41:28.510242939 CEST	50161	21	192.168.2.16	189.189.234.175
May 8, 2024 08:41:28.513398886 CEST	21	50128	139.59.79.85	192.168.2.16
May 8, 2024 08:41:28.518524885 CEST	2121	50138	183.173.247.100	192.168.2.16
May 8, 2024 08:41:28.545794964 CEST	21	50131	171.79.111.124	192.168.2.16
May 8, 2024 08:41:28.558223963 CEST	2121	50132	171.79.111.124	192.168.2.16
May 8, 2024 08:41:28.602821112 CEST	50109	21	192.168.2.16	49.164.93.64
May 8, 2024 08:41:28.697832108 CEST	49988	2121	192.168.2.16	102.27.2.20
May 8, 2024 08:41:28.713824034 CEST	49987	21	192.168.2.16	102.27.2.20
May 8, 2024 08:41:28.746438026 CEST	50162	2121	192.168.2.16	189.189.234.175
May 8, 2024 08:41:28.746457100 CEST	50163	21	192.168.2.16	123.112.167.56
May 8, 2024 08:41:28.777826071 CEST	50123	21	192.168.2.16	80.117.188.48
May 8, 2024 08:41:28.777858973 CEST	50122	2121	192.168.2.16	75.136.134.31
May 8, 2024 08:41:28.777885914 CEST	50124	2121	192.168.2.16	80.117.188.48
May 8, 2024 08:41:28.881220102 CEST	21	50159	139.185.33.251	192.168.2.16
May 8, 2024 08:41:28.893630981 CEST	2121	50160	139.185.33.251	192.168.2.16
May 8, 2024 08:41:29.001210928 CEST	50164	2121	192.168.2.16	123.112.167.56
May 8, 2024 08:41:29.015825987 CEST	50125	21	192.168.2.16	50.80.39.237
May 8, 2024 08:41:29.015942097 CEST	50130	2121	192.168.2.16	139.59.79.85
May 8, 2024 08:41:29.015944958 CEST	50128	21	192.168.2.16	139.59.79.85
May 8, 2024 08:41:29.031799078 CEST	50138	2121	192.168.2.16	183.173.247.100
May 8, 2024 08:41:29.046834946 CEST	50131	21	192.168.2.16	171.79.111.124
May 8, 2024 08:41:29.046838045 CEST	50126	2121	192.168.2.16	50.80.39.237
May 8, 2024 08:41:29.062840939 CEST	50132	2121	192.168.2.16	171.79.111.124
May 8, 2024 08:41:29.062840939 CEST	50127	21	192.168.2.16	90.210.81.136
May 8, 2024 08:41:29.078810930 CEST	50110	2121	192.168.2.16	49.164.93.64
May 8, 2024 08:41:29.094832897 CEST	50129	2121	192.168.2.16	90.210.81.136
May 8, 2024 08:41:29.110970974 CEST	50111	21	192.168.2.16	94.10.134.105
May 8, 2024 08:41:29.142841101 CEST	50135	21	192.168.2.16	80.18.101.99
May 8, 2024 08:41:29.142841101 CEST	50133	21	192.168.2.16	179.197.172.68
May 8, 2024 08:41:29.142844915 CEST	50134	2121	192.168.2.16	179.197.172.68
May 8, 2024 08:41:29.142934084 CEST	50137	21	192.168.2.16	183.173.247.100
May 8, 2024 08:41:29.157825947 CEST	50136	2121	192.168.2.16	80.18.101.99
May 8, 2024 08:41:29.174498081 CEST	2121	49988	102.27.2.20	192.168.2.16
May 8, 2024 08:41:29.175052881 CEST	50165	21	192.168.2.16	113.17.21.229
May 8, 2024 08:41:29.175793886 CEST	21	49987	102.27.2.20	192.168.2.16
May 8, 2024 08:41:29.176121950 CEST	50166	2121	192.168.2.16	113.17.21.229
May 8, 2024 08:41:29.188819885 CEST	50139	21	192.168.2.16	157.254.106.222
May 8, 2024 08:41:29.188822031 CEST	50140	2121	192.168.2.16	157.254.106.222
May 8, 2024 08:41:29.204940081 CEST	50141	21	192.168.2.16	105.209.161.139
May 8, 2024 08:41:29.236821890 CEST	50143	21	192.168.2.16	27.75.137.166
May 8, 2024 08:41:29.236829042 CEST	50146	2121	192.168.2.16	73.12.247.170
May 8, 2024 08:41:29.236829996 CEST	50145	21	192.168.2.16	73.12.247.170
May 8, 2024 08:41:29.236834049 CEST	50144	2121	192.168.2.16	27.75.137.166
May 8, 2024 08:41:29.236834049 CEST	50142	2121	192.168.2.16	105.209.161.139
May 8, 2024 08:41:29.252826929 CEST	50147	21	192.168.2.16	14.248.57.220
May 8, 2024 08:41:29.252827883 CEST	50148	2121	192.168.2.16	14.248.57.220
May 8, 2024 08:41:29.284847021 CEST	50150	2121	192.168.2.16	83.50.47.165
May 8, 2024 08:41:29.284851074 CEST	50149	21	192.168.2.16	83.50.47.165
May 8, 2024 08:41:29.331856012 CEST	50152	2121	192.168.2.16	67.249.182.208
May 8, 2024 08:41:29.331856012 CEST	50151	21	192.168.2.16	67.249.182.208
May 8, 2024 08:41:29.363276005 CEST	50112	2121	192.168.2.16	94.10.134.105
May 8, 2024 08:41:29.378820896 CEST	50153	21	192.168.2.16	74.75.255.17
May 8, 2024 08:41:29.378822088 CEST	50155	21	192.168.2.16	118.220.220.143
May 8, 2024 08:41:29.381984949 CEST	50154	2121	192.168.2.16	74.75.255.17
May 8, 2024 08:41:29.394824982 CEST	50157	21	192.168.2.16	122.168.163.39
May 8, 2024 08:41:29.394826889 CEST	50159	21	192.168.2.16	139.185.33.251
May 8, 2024 08:41:29.398009062 CEST	50156	2121	192.168.2.16	118.220.220.143
May 8, 2024 08:41:29.398010969 CEST	50160	2121	192.168.2.16	139.185.33.251
May 8, 2024 08:41:29.426250935 CEST	2121	50130	139.59.79.85	192.168.2.16
May 8, 2024 08:41:29.434524059 CEST	21	50128	139.59.79.85	192.168.2.16
May 8, 2024 08:41:29.442991018 CEST	50158	2121	192.168.2.16	122.168.163.39
May 8, 2024 08:41:29.474937916 CEST	50113	21	192.168.2.16	24.12.206.219
May 8, 2024 08:41:29.482788086 CEST	21	50131	171.79.111.124	192.168.2.16
May 8, 2024 08:41:29.492230892 CEST	2121	50132	171.79.111.124	192.168.2.16
May 8, 2024 08:41:29.494609118 CEST	2121	50138	183.173.247.100	192.168.2.16
May 8, 2024 08:41:29.507718086 CEST	50167	21	192.168.2.16	20.115.22.255
May 8, 2024 08:41:29.507808924 CEST	50169	21	192.168.2.16	119.242.104.72
May 8, 2024 08:41:29.507808924 CEST	50168	2121	192.168.2.16	20.115.22.255
May 8, 2024 08:41:29.508040905 CEST	50170	2121	192.168.2.16	119.242.104.72
May 8, 2024 08:41:29.508042097 CEST	50171	21	192.168.2.16	172.120.235.139
May 8, 2024 08:41:29.508204937 CEST	50173	2121	192.168.2.16	189.147.28.233
May 8, 2024 08:41:29.508204937 CEST	50172	2121	192.168.2.16	172.120.235.139
May 8, 2024 08:41:29.508384943 CEST	50174	21	192.168.2.16	189.147.28.233
May 8, 2024 08:41:29.508385897 CEST	50176	2121	192.168.2.16	42.82.192.53
May 8, 2024 08:41:29.508521080 CEST	50175	21	192.168.2.16	42.82.192.53
May 8, 2024 08:41:29.508521080 CEST	50177	21	192.168.2.16	76.101.92.121
May 8, 2024 08:41:29.508677006 CEST	50178	2121	192.168.2.16	76.101.92.121
May 8, 2024 08:41:29.508677959 CEST	50179	21	192.168.2.16	184.92.186.129
May 8, 2024 08:41:29.508779049 CEST	50181	2121	192.168.2.16	4.206.146.112
May 8, 2024 08:41:29.508780003 CEST	50180	2121	192.168.2.16	184.92.186.129
May 8, 2024 08:41:29.508900881 CEST	50182	21	192.168.2.16	4.206.146.112
May 8, 2024 08:41:29.508900881 CEST	50183	21	192.168.2.16	109.130.229.15
May 8, 2024 08:41:29.509031057 CEST	50184	2121	192.168.2.16	109.130.229.15
May 8, 2024 08:41:29.509032011 CEST	50185	21	192.168.2.16	146.75.86.69
May 8, 2024 08:41:29.509139061 CEST	50186	2121	192.168.2.16	146.75.86.69
May 8, 2024 08:41:29.521984100 CEST	50161	21	192.168.2.16	189.189.234.175
May 8, 2024 08:41:29.523500919 CEST	50187	21	192.168.2.16	38.154.167.222
May 8, 2024 08:41:29.523720026 CEST	50189	21	192.168.2.16	38.12.232.73
May 8, 2024 08:41:29.523720980 CEST	50188	2121	192.168.2.16	38.154.167.222
May 8, 2024 08:41:29.523890972 CEST	50190	2121	192.168.2.16	38.12.232.73
May 8, 2024 08:41:29.523890972 CEST	50191	21	192.168.2.16	1.232.152.196
May 8, 2024 08:41:29.524013042 CEST	50192	21	192.168.2.16	153.3.237.182
May 8, 2024 08:41:29.524014950 CEST	50193	2121	192.168.2.16	1.232.152.196
May 8, 2024 08:41:29.524149895 CEST	50194	2121	192.168.2.16	153.3.237.182
May 8, 2024 08:41:29.524152040 CEST	50195	21	192.168.2.16	89.197.227.65
May 8, 2024 08:41:29.524307966 CEST	50196	2121	192.168.2.16	89.197.227.65
May 8, 2024 08:41:29.524308920 CEST	50197	2121	192.168.2.16	91.118.29.181
May 8, 2024 08:41:29.524497986 CEST	50198	2121	192.168.2.16	41.107.171.233
May 8, 2024 08:41:29.524498940 CEST	50200	21	192.168.2.16	219.104.236.32
May 8, 2024 08:41:29.524636030 CEST	50202	21	192.168.2.16	96.16.83.158
May 8, 2024 08:41:29.524636984 CEST	50201	2121	192.168.2.16	219.104.236.32
May 8, 2024 08:41:29.524821997 CEST	50199	21	192.168.2.16	41.107.171.233
May 8, 2024 08:41:29.524822950 CEST	50203	2121	192.168.2.16	96.16.83.158
May 8, 2024 08:41:29.524861097 CEST	50204	21	192.168.2.16	91.118.29.181
May 8, 2024 08:41:29.524863005 CEST	50205	21	192.168.2.16	183.119.252.76
May 8, 2024 08:41:29.539664984 CEST	50207	21	192.168.2.16	124.175.188.59
May 8, 2024 08:41:29.539669037 CEST	50206	2121	192.168.2.16	183.119.252.76
May 8, 2024 08:41:29.539741993 CEST	50209	2121	192.168.2.16	49.235.102.237
May 8, 2024 08:41:29.539745092 CEST	50208	21	192.168.2.16	49.235.102.237
May 8, 2024 08:41:29.539932013 CEST	50211	21	192.168.2.16	171.246.110.71
May 8, 2024 08:41:29.539933920 CEST	50212	2121	192.168.2.16	171.246.110.71
May 8, 2024 08:41:29.540031910 CEST	50214	2121	192.168.2.16	115.244.167.85
May 8, 2024 08:41:29.540035009 CEST	50213	21	192.168.2.16	115.244.167.85
May 8, 2024 08:41:29.540222883 CEST	50216	21	192.168.2.16	18.161.91.79
May 8, 2024 08:41:29.540224075 CEST	50215	21	192.168.2.16	201.130.99.91
May 8, 2024 08:41:29.540357113 CEST	50218	2121	192.168.2.16	191.191.24.153
May 8, 2024 08:41:29.540359974 CEST	50217	2121	192.168.2.16	18.161.91.79
May 8, 2024 08:41:29.540441990 CEST	50219	21	192.168.2.16	191.191.24.153
May 8, 2024 08:41:29.540442944 CEST	50220	21	192.168.2.16	77.75.121.3
May 8, 2024 08:41:29.540543079 CEST	50222	21	192.168.2.16	222.160.120.231
May 8, 2024 08:41:29.540545940 CEST	50221	2121	192.168.2.16	77.75.121.3
May 8, 2024 08:41:29.540676117 CEST	50224	21	192.168.2.16	73.235.136.12
May 8, 2024 08:41:29.540678978 CEST	50223	2121	192.168.2.16	222.160.120.231
May 8, 2024 08:41:29.540731907 CEST	50225	2121	192.168.2.16	73.235.136.12
May 8, 2024 08:41:29.540733099 CEST	50226	21	192.168.2.16	39.87.149.104
May 8, 2024 08:41:29.540833950 CEST	50210	2121	192.168.2.16	124.175.188.59
May 8, 2024 08:41:29.540834904 CEST	50227	2121	192.168.2.16	201.130.99.91
May 8, 2024 08:41:29.541985035 CEST	50228	2121	192.168.2.16	39.87.149.104
May 8, 2024 08:41:29.555757999 CEST	50229	21	192.168.2.16	160.223.208.239
May 8, 2024 08:41:29.555758953 CEST	50230	2121	192.168.2.16	160.223.208.239
May 8, 2024 08:41:29.555905104 CEST	50231	21	192.168.2.16	134.255.240.224
May 8, 2024 08:41:29.555907011 CEST	50232	21	192.168.2.16	3.255.123.211
May 8, 2024 08:41:29.556010008 CEST	50234	2121	192.168.2.16	3.255.123.211
May 8, 2024 08:41:29.556011915 CEST	50233	2121	192.168.2.16	134.255.240.224
May 8, 2024 08:41:29.556277990 CEST	50235	21	192.168.2.16	66.189.156.99
May 8, 2024 08:41:29.556278944 CEST	50236	2121	192.168.2.16	211.203.213.243
May 8, 2024 08:41:29.556391954 CEST	50238	21	192.168.2.16	87.226.2.245
May 8, 2024 08:41:29.556394100 CEST	50237	2121	192.168.2.16	68.38.82.38
May 8, 2024 08:41:29.556488991 CEST	50239	21	192.168.2.16	211.203.213.243
May 8, 2024 08:41:29.556488991 CEST	50240	21	192.168.2.16	68.38.82.38
May 8, 2024 08:41:29.556755066 CEST	50242	21	192.168.2.16	68.150.164.127
May 8, 2024 08:41:29.556755066 CEST	50243	21	192.168.2.16	49.161.36.224
May 8, 2024 08:41:29.556849957 CEST	50244	2121	192.168.2.16	49.161.36.224
May 8, 2024 08:41:29.556852102 CEST	50245	21	192.168.2.16	59.62.230.49
May 8, 2024 08:41:29.557055950 CEST	50248	2121	192.168.2.16	149.96.187.162
May 8, 2024 08:41:29.557056904 CEST	50247	21	192.168.2.16	149.96.187.162
May 8, 2024 08:41:29.557109118 CEST	50246	2121	192.168.2.16	59.62.230.49
May 8, 2024 08:41:29.557109118 CEST	50249	2121	192.168.2.16	14.86.253.70
May 8, 2024 08:41:29.557265997 CEST	50251	21	192.168.2.16	14.86.253.70
May 8, 2024 08:41:29.557267904 CEST	50250	21	192.168.2.16	108.26.144.105
May 8, 2024 08:41:29.557353020 CEST	50253	2121	192.168.2.16	66.189.156.99
May 8, 2024 08:41:29.557354927 CEST	50252	2121	192.168.2.16	68.150.164.127
May 8, 2024 08:41:29.561985016 CEST	50241	2121	192.168.2.16	87.226.2.245
May 8, 2024 08:41:29.571716070 CEST	50254	2121	192.168.2.16	108.26.144.105
May 8, 2024 08:41:29.571717978 CEST	50255	21	192.168.2.16	201.35.137.125
May 8, 2024 08:41:29.571871996 CEST	50256	2121	192.168.2.16	201.35.137.125
May 8, 2024 08:41:29.571871996 CEST	50257	21	192.168.2.16	90.246.237.33
May 8, 2024 08:41:29.572014093 CEST	50259	21	192.168.2.16	46.175.4.125
May 8, 2024 08:41:29.572016001 CEST	50258	2121	192.168.2.16	90.246.237.33
May 8, 2024 08:41:29.572199106 CEST	50260	2121	192.168.2.16	46.175.4.125
May 8, 2024 08:41:29.572204113 CEST	50261	21	192.168.2.16	77.130.185.28
May 8, 2024 08:41:29.572273970 CEST	50262	2121	192.168.2.16	20.222.111.34
May 8, 2024 08:41:29.572372913 CEST	50263	21	192.168.2.16	20.222.111.34
May 8, 2024 08:41:29.572374105 CEST	50264	2121	192.168.2.16	77.130.185.28
May 8, 2024 08:41:29.572412968 CEST	50266	2121	192.168.2.16	45.7.88.51
May 8, 2024 08:41:29.572413921 CEST	50265	21	192.168.2.16	45.7.88.51
May 8, 2024 08:41:29.572586060 CEST	50268	21	192.168.2.16	71.229.38.180
May 8, 2024 08:41:29.572587967 CEST	50267	2121	192.168.2.16	71.229.38.180
May 8, 2024 08:41:29.572746992 CEST	50270	2121	192.168.2.16	1.225.129.9
May 8, 2024 08:41:29.572750092 CEST	50269	21	192.168.2.16	1.225.129.9
May 8, 2024 08:41:29.572933912 CEST	50271	2121	192.168.2.16	103.120.132.17
May 8, 2024 08:41:29.572935104 CEST	50272	21	192.168.2.16	103.120.132.17
May 8, 2024 08:41:29.573082924 CEST	50273	21	192.168.2.16	190.3.106.234
May 8, 2024 08:41:29.573085070 CEST	50274	2121	192.168.2.16	190.3.106.234
May 8, 2024 08:41:29.573239088 CEST	50276	21	192.168.2.16	80.138.234.3
May 8, 2024 08:41:29.573244095 CEST	50275	2121	192.168.2.16	80.138.234.3
May 8, 2024 08:41:29.573308945 CEST	50278	2121	192.168.2.16	88.221.151.7
May 8, 2024 08:41:29.573308945 CEST	50277	21	192.168.2.16	88.221.151.7
May 8, 2024 08:41:29.587733984 CEST	50279	21	192.168.2.16	175.121.57.126
May 8, 2024 08:41:29.587733984 CEST	50280	2121	192.168.2.16	175.121.57.126
May 8, 2024 08:41:29.587845087 CEST	50282	2121	192.168.2.16	181.71.244.102
May 8, 2024 08:41:29.587845087 CEST	50281	21	192.168.2.16	181.71.244.102
May 8, 2024 08:41:29.587955952 CEST	50284	2121	192.168.2.16	95.238.61.250
May 8, 2024 08:41:29.587956905 CEST	50283	21	192.168.2.16	95.238.61.250
May 8, 2024 08:41:29.588160992 CEST	50285	21	192.168.2.16	189.225.118.213
May 8, 2024 08:41:29.588160992 CEST	50286	21	192.168.2.16	167.71.66.165
May 8, 2024 08:41:29.588294983 CEST	50288	2121	192.168.2.16	167.71.66.165
May 8, 2024 08:41:29.588295937 CEST	50287	2121	192.168.2.16	189.225.118.213
May 8, 2024 08:41:29.588455915 CEST	50290	2121	192.168.2.16	109.136.44.230
May 8, 2024 08:41:29.588458061 CEST	50289	21	192.168.2.16	109.136.44.230
May 8, 2024 08:41:29.588566065 CEST	50292	2121	192.168.2.16	94.136.16.189
May 8, 2024 08:41:29.588567972 CEST	50291	21	192.168.2.16	94.136.16.189
May 8, 2024 08:41:29.588788986 CEST	50294	2121	192.168.2.16	105.97.141.224
May 8, 2024 08:41:29.588789940 CEST	50293	21	192.168.2.16	105.97.141.224
May 8, 2024 08:41:29.588881016 CEST	50296	21	192.168.2.16	172.85.192.65
May 8, 2024 08:41:29.588882923 CEST	50295	2121	192.168.2.16	172.85.192.65
May 8, 2024 08:41:29.588999987 CEST	50298	2121	192.168.2.16	96.250.94.212
May 8, 2024 08:41:29.589000940 CEST	50297	21	192.168.2.16	96.250.94.212
May 8, 2024 08:41:29.589121103 CEST	50299	21	192.168.2.16	82.140.49.243
May 8, 2024 08:41:29.589122057 CEST	50300	2121	192.168.2.16	82.140.49.243
May 8, 2024 08:41:29.589241028 CEST	50302	2121	192.168.2.16	106.244.57.130
May 8, 2024 08:41:29.589243889 CEST	50301	21	192.168.2.16	106.244.57.130
May 8, 2024 08:41:29.589291096 CEST	50304	2121	192.168.2.16	175.205.92.244
May 8, 2024 08:41:29.589294910 CEST	50303	21	192.168.2.16	175.205.92.244
May 8, 2024 08:41:29.689723015 CEST	21	50171	172.120.235.139	192.168.2.16
May 8, 2024 08:41:29.693983078 CEST	50171	21	192.168.2.16	172.120.235.139
May 8, 2024 08:41:29.760833979 CEST	50163	21	192.168.2.16	123.112.167.56
May 8, 2024 08:41:29.760833979 CEST	50162	2121	192.168.2.16	189.189.234.175
May 8, 2024 08:41:29.762960911 CEST	2121	50210	124.175.188.59	192.168.2.16
May 8, 2024 08:41:29.764049053 CEST	21	50207	124.175.188.59	192.168.2.16
May 8, 2024 08:41:29.807128906 CEST	2121	50193	1.232.152.196	192.168.2.16
May 8, 2024 08:41:29.809967995 CEST	50114	2121	192.168.2.16	24.12.206.219
May 8, 2024 08:41:29.816165924 CEST	21	50159	139.185.33.251	192.168.2.16
May 8, 2024 08:41:29.816500902 CEST	2121	50160	139.185.33.251	192.168.2.16
May 8, 2024 08:41:29.827872992 CEST	2121	50295	172.85.192.65	192.168.2.16
May 8, 2024 08:41:29.828110933 CEST	21	50296	172.85.192.65	192.168.2.16
May 8, 2024 08:41:29.829767942 CEST	2121	50201	219.104.236.32	192.168.2.16
May 8, 2024 08:41:29.840842962 CEST	50115	21	192.168.2.16	79.209.25.45
May 8, 2024 08:41:29.848381042 CEST	21	50205	183.119.252.76	192.168.2.16
May 8, 2024 08:41:29.850861073 CEST	21	50220	77.75.121.3	192.168.2.16
May 8, 2024 08:41:29.851185083 CEST	50220	21	192.168.2.16	77.75.121.3
May 8, 2024 08:41:29.851773024 CEST	2121	50197	91.118.29.181	192.168.2.16
May 8, 2024 08:41:29.853050947 CEST	21	50269	1.225.129.9	192.168.2.16
May 8, 2024 08:41:29.853688955 CEST	21	50204	91.118.29.181	192.168.2.16
May 8, 2024 08:41:29.855659008 CEST	2121	50270	1.225.129.9	192.168.2.16
May 8, 2024 08:41:29.857472897 CEST	50305	21	192.168.2.16	23.144.192.245
May 8, 2024 08:41:29.857476950 CEST	50306	2121	192.168.2.16	23.144.192.245
May 8, 2024 08:41:29.866436958 CEST	2121	50206	183.119.252.76	192.168.2.16
May 8, 2024 08:41:29.870997906 CEST	2121	50282	181.71.244.102	192.168.2.16
May 8, 2024 08:41:29.874372005 CEST	21	50279	175.121.57.126	192.168.2.16
May 8, 2024 08:41:29.875078917 CEST	2121	50280	175.121.57.126	192.168.2.16
May 8, 2024 08:41:29.882129908 CEST	21	50281	181.71.244.102	192.168.2.16
May 8, 2024 08:41:29.890250921 CEST	21	50171	172.120.235.139	192.168.2.16
May 8, 2024 08:41:29.890718937 CEST	50171	21	192.168.2.16	172.120.235.139
May 8, 2024 08:41:29.890722036 CEST	50307	21	192.168.2.16	92.104.238.147
May 8, 2024 08:41:29.905121088 CEST	50308	2121	192.168.2.16	92.104.238.147
May 8, 2024 08:41:29.923100948 CEST	21	50291	94.136.16.189	192.168.2.16
May 8, 2024 08:41:29.928881884 CEST	2121	50292	94.136.16.189	192.168.2.16
May 8, 2024 08:41:29.936876059 CEST	50130	2121	192.168.2.16	139.59.79.85
May 8, 2024 08:41:29.936880112 CEST	50128	21	192.168.2.16	139.59.79.85
May 8, 2024 08:41:29.957391977 CEST	21	50293	105.97.141.224	192.168.2.16
May 8, 2024 08:41:29.957500935 CEST	21	50272	103.120.132.17	192.168.2.16
May 8, 2024 08:41:29.961056948 CEST	2121	50271	103.120.132.17	192.168.2.16
May 8, 2024 08:41:29.967890978 CEST	2121	50294	105.97.141.224	192.168.2.16
May 8, 2024 08:41:29.970315933 CEST	50309	21	192.168.2.16	88.136.65.138
May 8, 2024 08:41:29.970675945 CEST	2121	50214	115.244.167.85	192.168.2.16
May 8, 2024 08:41:29.977799892 CEST	21	50213	115.244.167.85	192.168.2.16
May 8, 2024 08:41:29.985354900 CEST	50131	21	192.168.2.16	171.79.111.124
May 8, 2024 08:41:30.000833988 CEST	50132	2121	192.168.2.16	171.79.111.124
May 8, 2024 08:41:30.000838995 CEST	50138	2121	192.168.2.16	183.173.247.100
May 8, 2024 08:41:30.016901970 CEST	50164	2121	192.168.2.16	123.112.167.56
May 8, 2024 08:41:30.073559999 CEST	21	50171	172.120.235.139	192.168.2.16
May 8, 2024 08:41:30.073611975 CEST	50171	21	192.168.2.16	172.120.235.139
May 8, 2024 08:41:30.162969112 CEST	21	50220	77.75.121.3	192.168.2.16
May 8, 2024 08:41:30.163116932 CEST	50220	21	192.168.2.16	77.75.121.3
May 8, 2024 08:41:30.163480997 CEST	50310	2121	192.168.2.16	88.136.65.138
May 8, 2024 08:41:30.190814972 CEST	50166	2121	192.168.2.16	113.17.21.229
May 8, 2024 08:41:30.190840006 CEST	50165	21	192.168.2.16	113.17.21.229
May 8, 2024 08:41:30.270860910 CEST	50207	21	192.168.2.16	124.175.188.59
May 8, 2024 08:41:30.270951033 CEST	50210	2121	192.168.2.16	124.175.188.59
May 8, 2024 08:41:30.318881989 CEST	50159	21	192.168.2.16	139.185.33.251
May 8, 2024 08:41:30.318901062 CEST	50193	2121	192.168.2.16	1.232.152.196
May 8, 2024 08:41:30.320137978 CEST	50160	2121	192.168.2.16	139.185.33.251
May 8, 2024 08:41:30.334825039 CEST	50296	21	192.168.2.16	172.85.192.65
May 8, 2024 08:41:30.334862947 CEST	50116	2121	192.168.2.16	79.209.25.45
May 8, 2024 08:41:30.335046053 CEST	50295	2121	192.168.2.16	172.85.192.65
May 8, 2024 08:41:30.336000919 CEST	50201	2121	192.168.2.16	219.104.236.32
May 8, 2024 08:41:30.349085093 CEST	2121	50130	139.59.79.85	192.168.2.16
May 8, 2024 08:41:30.350852013 CEST	50205	21	192.168.2.16	183.119.252.76
May 8, 2024 08:41:30.350852966 CEST	50117	21	192.168.2.16	166.151.156.117
May 8, 2024 08:41:30.357605934 CEST	21	50128	139.59.79.85	192.168.2.16
May 8, 2024 08:41:30.366841078 CEST	50204	21	192.168.2.16	91.118.29.181
May 8, 2024 08:41:30.366842031 CEST	50270	2121	192.168.2.16	1.225.129.9
May 8, 2024 08:41:30.366851091 CEST	50197	2121	192.168.2.16	91.118.29.181
May 8, 2024 08:41:30.366853952 CEST	50206	2121	192.168.2.16	183.119.252.76
May 8, 2024 08:41:30.366853952 CEST	50269	21	192.168.2.16	1.225.129.9
May 8, 2024 08:41:30.368134022 CEST	50118	2121	192.168.2.16	166.151.156.117
May 8, 2024 08:41:30.382831097 CEST	50279	21	192.168.2.16	175.121.57.126
May 8, 2024 08:41:30.382846117 CEST	50119	21	192.168.2.16	178.198.107.39
May 8, 2024 08:41:30.382848024 CEST	50280	2121	192.168.2.16	175.121.57.126
May 8, 2024 08:41:30.383769035 CEST	50282	2121	192.168.2.16	181.71.244.102
May 8, 2024 08:41:30.397805929 CEST	50281	21	192.168.2.16	181.71.244.102
May 8, 2024 08:41:30.413831949 CEST	50120	2121	192.168.2.16	178.198.107.39
May 8, 2024 08:41:30.421319962 CEST	21	50131	171.79.111.124	192.168.2.16
May 8, 2024 08:41:30.429713964 CEST	2121	50132	171.79.111.124	192.168.2.16
May 8, 2024 08:41:30.429804087 CEST	50292	2121	192.168.2.16	94.136.16.189
May 8, 2024 08:41:30.429835081 CEST	50291	21	192.168.2.16	94.136.16.189
May 8, 2024 08:41:30.461855888 CEST	50293	21	192.168.2.16	105.97.141.224
May 8, 2024 08:41:30.461857080 CEST	50272	21	192.168.2.16	103.120.132.17
May 8, 2024 08:41:30.469523907 CEST	21	50303	175.205.92.244	192.168.2.16
May 8, 2024 08:41:30.470004082 CEST	2121	50304	175.205.92.244	192.168.2.16
May 8, 2024 08:41:30.473742962 CEST	21	50220	77.75.121.3	192.168.2.16
May 8, 2024 08:41:30.473814964 CEST	50220	21	192.168.2.16	77.75.121.3
May 8, 2024 08:41:30.474070072 CEST	21	50220	77.75.121.3	192.168.2.16
May 8, 2024 08:41:30.474112988 CEST	50220	21	192.168.2.16	77.75.121.3
May 8, 2024 08:41:30.477838993 CEST	50294	2121	192.168.2.16	105.97.141.224
May 8, 2024 08:41:30.477858067 CEST	50271	2121	192.168.2.16	103.120.132.17
May 8, 2024 08:41:30.480062008 CEST	50214	2121	192.168.2.16	115.244.167.85
May 8, 2024 08:41:30.492155075 CEST	2121	50210	124.175.188.59	192.168.2.16
May 8, 2024 08:41:30.493844986 CEST	50213	21	192.168.2.16	115.244.167.85
May 8, 2024 08:41:30.493927956 CEST	50121	21	192.168.2.16	75.136.134.31
May 8, 2024 08:41:30.494410038 CEST	21	50207	124.175.188.59	192.168.2.16
May 8, 2024 08:41:30.509835958 CEST	50167	21	192.168.2.16	20.115.22.255
May 8, 2024 08:41:30.509856939 CEST	50170	2121	192.168.2.16	119.242.104.72
May 8, 2024 08:41:30.509857893 CEST	50173	2121	192.168.2.16	189.147.28.233
May 8, 2024 08:41:30.509857893 CEST	50169	21	192.168.2.16	119.242.104.72
May 8, 2024 08:41:30.509857893 CEST	50168	2121	192.168.2.16	20.115.22.255
May 8, 2024 08:41:30.509857893 CEST	50172	2121	192.168.2.16	172.120.235.139
May 8, 2024 08:41:30.509860039 CEST	50176	2121	192.168.2.16	42.82.192.53
May 8, 2024 08:41:30.509876013 CEST	50177	21	192.168.2.16	76.101.92.121
May 8, 2024 08:41:30.509877920 CEST	50183	21	192.168.2.16	109.130.229.15
May 8, 2024 08:41:30.509877920 CEST	50185	21	192.168.2.16	146.75.86.69
May 8, 2024 08:41:30.509881020 CEST	50182	21	192.168.2.16	4.206.146.112
May 8, 2024 08:41:30.509880066 CEST	50174	21	192.168.2.16	189.147.28.233
May 8, 2024 08:41:30.509881020 CEST	50184	2121	192.168.2.16	109.130.229.15
May 8, 2024 08:41:30.509884119 CEST	50175	21	192.168.2.16	42.82.192.53
May 8, 2024 08:41:30.509884119 CEST	50181	2121	192.168.2.16	4.206.146.112
May 8, 2024 08:41:30.509886026 CEST	50178	2121	192.168.2.16	76.101.92.121
May 8, 2024 08:41:30.509886026 CEST	50180	2121	192.168.2.16	184.92.186.129
May 8, 2024 08:41:30.511992931 CEST	50186	2121	192.168.2.16	146.75.86.69
May 8, 2024 08:41:30.511992931 CEST	50179	21	192.168.2.16	184.92.186.129
May 8, 2024 08:41:30.518485069 CEST	2121	50138	183.173.247.100	192.168.2.16
May 8, 2024 08:41:30.525840998 CEST	50190	2121	192.168.2.16	38.12.232.73
May 8, 2024 08:41:30.525844097 CEST	50187	21	192.168.2.16	38.154.167.222
May 8, 2024 08:41:30.525851965 CEST	50189	21	192.168.2.16	38.12.232.73
May 8, 2024 08:41:30.525856972 CEST	50194	2121	192.168.2.16	153.3.237.182
May 8, 2024 08:41:30.525856972 CEST	50191	21	192.168.2.16	1.232.152.196
May 8, 2024 08:41:30.525856972 CEST	50195	21	192.168.2.16	89.197.227.65
May 8, 2024 08:41:30.525872946 CEST	50188	2121	192.168.2.16	38.154.167.222
May 8, 2024 08:41:30.525897026 CEST	50196	2121	192.168.2.16	89.197.227.65
May 8, 2024 08:41:30.525897026 CEST	50203	2121	192.168.2.16	96.16.83.158
May 8, 2024 08:41:30.525899887 CEST	50202	21	192.168.2.16	96.16.83.158
May 8, 2024 08:41:30.525901079 CEST	50198	2121	192.168.2.16	41.107.171.233
May 8, 2024 08:41:30.525901079 CEST	50199	21	192.168.2.16	41.107.171.233
May 8, 2024 08:41:30.525901079 CEST	50200	21	192.168.2.16	219.104.236.32
May 8, 2024 08:41:30.525902987 CEST	50192	21	192.168.2.16	153.3.237.182
May 8, 2024 08:41:30.541837931 CEST	50208	21	192.168.2.16	49.235.102.237
May 8, 2024 08:41:30.541838884 CEST	50217	2121	192.168.2.16	18.161.91.79
May 8, 2024 08:41:30.541851997 CEST	50224	21	192.168.2.16	73.235.136.12
May 8, 2024 08:41:30.541852951 CEST	50223	2121	192.168.2.16	222.160.120.231
May 8, 2024 08:41:30.541855097 CEST	50215	21	192.168.2.16	201.130.99.91
May 8, 2024 08:41:30.541855097 CEST	50219	21	192.168.2.16	191.191.24.153
May 8, 2024 08:41:30.541853905 CEST	50209	2121	192.168.2.16	49.235.102.237
May 8, 2024 08:41:30.541879892 CEST	50221	2121	192.168.2.16	77.75.121.3
May 8, 2024 08:41:30.541882992 CEST	50212	2121	192.168.2.16	171.246.110.71
May 8, 2024 08:41:30.541881084 CEST	50225	2121	192.168.2.16	73.235.136.12
May 8, 2024 08:41:30.541881084 CEST	50226	21	192.168.2.16	39.87.149.104
May 8, 2024 08:41:30.541882992 CEST	50211	21	192.168.2.16	171.246.110.71
May 8, 2024 08:41:30.541881084 CEST	50222	21	192.168.2.16	222.160.120.231
May 8, 2024 08:41:30.541886091 CEST	50227	2121	192.168.2.16	201.130.99.91
May 8, 2024 08:41:30.541886091 CEST	50216	21	192.168.2.16	18.161.91.79
May 8, 2024 08:41:30.541886091 CEST	50218	2121	192.168.2.16	191.191.24.153
May 8, 2024 08:41:30.541996956 CEST	50228	2121	192.168.2.16	39.87.149.104
May 8, 2024 08:41:30.556862116 CEST	50229	21	192.168.2.16	160.223.208.239
May 8, 2024 08:41:30.556889057 CEST	50233	2121	192.168.2.16	134.255.240.224
May 8, 2024 08:41:30.556894064 CEST	50244	2121	192.168.2.16	49.161.36.224
May 8, 2024 08:41:30.556952000 CEST	50251	21	192.168.2.16	14.86.253.70
May 8, 2024 08:41:30.556962967 CEST	50248	2121	192.168.2.16	149.96.187.162
May 8, 2024 08:41:30.556962967 CEST	50232	21	192.168.2.16	3.255.123.211
May 8, 2024 08:41:30.556962967 CEST	50235	21	192.168.2.16	66.189.156.99
May 8, 2024 08:41:30.556967020 CEST	50243	21	192.168.2.16	49.161.36.224
May 8, 2024 08:41:30.556967974 CEST	50239	21	192.168.2.16	211.203.213.243
May 8, 2024 08:41:30.556989908 CEST	50245	21	192.168.2.16	59.62.230.49
May 8, 2024 08:41:30.556992054 CEST	50253	2121	192.168.2.16	66.189.156.99
May 8, 2024 08:41:30.557076931 CEST	50250	21	192.168.2.16	108.26.144.105
May 8, 2024 08:41:30.557076931 CEST	50252	2121	192.168.2.16	68.150.164.127
May 8, 2024 08:41:30.557076931 CEST	50241	2121	192.168.2.16	87.226.2.245
May 8, 2024 08:41:30.557179928 CEST	50231	21	192.168.2.16	134.255.240.224
May 8, 2024 08:41:30.557188988 CEST	50236	2121	192.168.2.16	211.203.213.243
May 8, 2024 08:41:30.557189941 CEST	50238	21	192.168.2.16	87.226.2.245
May 8, 2024 08:41:30.557189941 CEST	50230	2121	192.168.2.16	160.223.208.239
May 8, 2024 08:41:30.557198048 CEST	50234	2121	192.168.2.16	3.255.123.211
May 8, 2024 08:41:30.557199955 CEST	50249	2121	192.168.2.16	14.86.253.70
May 8, 2024 08:41:30.557199955 CEST	50237	2121	192.168.2.16	68.38.82.38
May 8, 2024 08:41:30.557212114 CEST	50240	21	192.168.2.16	68.38.82.38
May 8, 2024 08:41:30.557212114 CEST	50246	2121	192.168.2.16	59.62.230.49
May 8, 2024 08:41:30.557216883 CEST	50242	21	192.168.2.16	68.150.164.127
May 8, 2024 08:41:30.557218075 CEST	50247	21	192.168.2.16	149.96.187.162
May 8, 2024 08:41:30.571844101 CEST	50254	2121	192.168.2.16	108.26.144.105
May 8, 2024 08:41:30.571845055 CEST	50255	21	192.168.2.16	201.35.137.125
May 8, 2024 08:41:30.572067976 CEST	50256	2121	192.168.2.16	201.35.137.125
May 8, 2024 08:41:30.574352980 CEST	2121	50295	172.85.192.65	192.168.2.16
May 8, 2024 08:41:30.574517012 CEST	21	50296	172.85.192.65	192.168.2.16
May 8, 2024 08:41:30.587837934 CEST	50273	21	192.168.2.16	190.3.106.234
May 8, 2024 08:41:30.587867022 CEST	50261	21	192.168.2.16	77.130.185.28
May 8, 2024 08:41:30.587869883 CEST	50259	21	192.168.2.16	46.175.4.125
May 8, 2024 08:41:30.587871075 CEST	50265	21	192.168.2.16	45.7.88.51
May 8, 2024 08:41:30.587871075 CEST	50288	2121	192.168.2.16	167.71.66.165
May 8, 2024 08:41:30.587872982 CEST	50258	2121	192.168.2.16	90.246.237.33
May 8, 2024 08:41:30.587872982 CEST	50286	21	192.168.2.16	167.71.66.165
May 8, 2024 08:41:30.587873936 CEST	50260	2121	192.168.2.16	46.175.4.125
May 8, 2024 08:41:30.587873936 CEST	50277	21	192.168.2.16	88.221.151.7
May 8, 2024 08:41:30.587873936 CEST	50257	21	192.168.2.16	90.246.237.33
May 8, 2024 08:41:30.587874889 CEST	50283	21	192.168.2.16	95.238.61.250
May 8, 2024 08:41:30.587888956 CEST	50276	21	192.168.2.16	80.138.234.3
May 8, 2024 08:41:30.587889910 CEST	50266	2121	192.168.2.16	45.7.88.51
May 8, 2024 08:41:30.587889910 CEST	50290	2121	192.168.2.16	109.136.44.230
May 8, 2024 08:41:30.587892056 CEST	50268	21	192.168.2.16	71.229.38.180
May 8, 2024 08:41:30.587892056 CEST	50274	2121	192.168.2.16	190.3.106.234
May 8, 2024 08:41:30.587893009 CEST	50262	2121	192.168.2.16	20.222.111.34
May 8, 2024 08:41:30.587897062 CEST	50264	2121	192.168.2.16	77.130.185.28
May 8, 2024 08:41:30.587897062 CEST	50275	2121	192.168.2.16	80.138.234.3
May 8, 2024 08:41:30.587913990 CEST	50263	21	192.168.2.16	20.222.111.34
May 8, 2024 08:41:30.587913990 CEST	50267	2121	192.168.2.16	71.229.38.180
May 8, 2024 08:41:30.588370085 CEST	50278	2121	192.168.2.16	88.221.151.7
May 8, 2024 08:41:30.588370085 CEST	50311	21	192.168.2.16	174.4.136.10
May 8, 2024 08:41:30.601847887 CEST	2121	50193	1.232.152.196	192.168.2.16
May 8, 2024 08:41:30.603842020 CEST	50298	2121	192.168.2.16	96.250.94.212
May 8, 2024 08:41:30.603854895 CEST	50287	2121	192.168.2.16	189.225.118.213
May 8, 2024 08:41:30.603854895 CEST	50302	2121	192.168.2.16	106.244.57.130
May 8, 2024 08:41:30.603861094 CEST	50297	21	192.168.2.16	96.250.94.212
May 8, 2024 08:41:30.603866100 CEST	50300	2121	192.168.2.16	82.140.49.243
May 8, 2024 08:41:30.604772091 CEST	50299	21	192.168.2.16	82.140.49.243
May 8, 2024 08:41:30.609661102 CEST	50284	2121	192.168.2.16	95.238.61.250
May 8, 2024 08:41:30.609671116 CEST	50285	21	192.168.2.16	189.225.118.213
May 8, 2024 08:41:30.609677076 CEST	50289	21	192.168.2.16	109.136.44.230
May 8, 2024 08:41:30.610024929 CEST	50301	21	192.168.2.16	106.244.57.130
May 8, 2024 08:41:30.641366005 CEST	2121	50201	219.104.236.32	192.168.2.16
May 8, 2024 08:41:30.647058010 CEST	21	50269	1.225.129.9	192.168.2.16
May 8, 2024 08:41:30.648478031 CEST	2121	50270	1.225.129.9	192.168.2.16
May 8, 2024 08:41:30.658946037 CEST	2121	50282	181.71.244.102	192.168.2.16
May 8, 2024 08:41:30.669445992 CEST	21	50279	175.121.57.126	192.168.2.16
May 8, 2024 08:41:30.670087099 CEST	2121	50280	175.121.57.126	192.168.2.16
May 8, 2024 08:41:30.674119949 CEST	21	50205	183.119.252.76	192.168.2.16
May 8, 2024 08:41:30.686152935 CEST	21	50281	181.71.244.102	192.168.2.16
May 8, 2024 08:41:30.693021059 CEST	2121	50206	183.119.252.76	192.168.2.16
May 8, 2024 08:41:30.694606066 CEST	2121	50197	91.118.29.181	192.168.2.16
May 8, 2024 08:41:30.695939064 CEST	21	50204	91.118.29.181	192.168.2.16
May 8, 2024 08:41:30.738630056 CEST	2121	50160	139.185.33.251	192.168.2.16
May 8, 2024 08:41:30.738981009 CEST	21	50159	139.185.33.251	192.168.2.16
May 8, 2024 08:41:30.764898062 CEST	21	50291	94.136.16.189	192.168.2.16
May 8, 2024 08:41:30.772608995 CEST	2121	50292	94.136.16.189	192.168.2.16
May 8, 2024 08:41:30.780839920 CEST	50122	2121	192.168.2.16	75.136.134.31
May 8, 2024 08:41:30.782026052 CEST	50123	21	192.168.2.16	80.117.188.48
May 8, 2024 08:41:30.782032967 CEST	50124	2121	192.168.2.16	80.117.188.48
May 8, 2024 08:41:30.830924034 CEST	21	50293	105.97.141.224	192.168.2.16
May 8, 2024 08:41:30.846739054 CEST	21	50272	103.120.132.17	192.168.2.16
May 8, 2024 08:41:30.855444908 CEST	2121	50294	105.97.141.224	192.168.2.16
May 8, 2024 08:41:30.860852957 CEST	50305	21	192.168.2.16	23.144.192.245
May 8, 2024 08:41:30.860852957 CEST	50306	2121	192.168.2.16	23.144.192.245
May 8, 2024 08:41:30.860855103 CEST	50128	21	192.168.2.16	139.59.79.85
May 8, 2024 08:41:30.860852957 CEST	50130	2121	192.168.2.16	139.59.79.85
May 8, 2024 08:41:30.866038084 CEST	2121	50271	103.120.132.17	192.168.2.16
May 8, 2024 08:41:30.892872095 CEST	50307	21	192.168.2.16	92.104.238.147
May 8, 2024 08:41:30.908840895 CEST	50308	2121	192.168.2.16	92.104.238.147
May 8, 2024 08:41:30.910670042 CEST	2121	50214	115.244.167.85	192.168.2.16
May 8, 2024 08:41:30.924830914 CEST	50131	21	192.168.2.16	171.79.111.124
May 8, 2024 08:41:30.931756973 CEST	21	50213	115.244.167.85	192.168.2.16
May 8, 2024 08:41:30.940834045 CEST	50132	2121	192.168.2.16	171.79.111.124
May 8, 2024 08:41:30.972841978 CEST	50309	21	192.168.2.16	88.136.65.138
May 8, 2024 08:41:30.975445032 CEST	50304	2121	192.168.2.16	175.205.92.244
May 8, 2024 08:41:30.975445986 CEST	50303	21	192.168.2.16	175.205.92.244
May 8, 2024 08:41:31.004825115 CEST	50207	21	192.168.2.16	124.175.188.59
May 8, 2024 08:41:31.004849911 CEST	50210	2121	192.168.2.16	124.175.188.59
May 8, 2024 08:41:31.020834923 CEST	50125	21	192.168.2.16	50.80.39.237
May 8, 2024 08:41:31.020870924 CEST	50138	2121	192.168.2.16	183.173.247.100
May 8, 2024 08:41:31.052864075 CEST	50126	2121	192.168.2.16	50.80.39.237
May 8, 2024 08:41:31.067846060 CEST	50127	21	192.168.2.16	90.210.81.136
May 8, 2024 08:41:31.068207026 CEST	50312	2121	192.168.2.16	174.4.136.10
May 8, 2024 08:41:31.083830118 CEST	50295	2121	192.168.2.16	172.85.192.65
May 8, 2024 08:41:31.083836079 CEST	50296	21	192.168.2.16	172.85.192.65
May 8, 2024 08:41:31.099829912 CEST	50129	2121	192.168.2.16	90.210.81.136
May 8, 2024 08:41:31.100333929 CEST	50313	21	192.168.2.16	123.144.241.64
May 8, 2024 08:41:31.115859032 CEST	50193	2121	192.168.2.16	1.232.152.196
May 8, 2024 08:41:31.147841930 CEST	50201	2121	192.168.2.16	219.104.236.32
May 8, 2024 08:41:31.147844076 CEST	50133	21	192.168.2.16	179.197.172.68
May 8, 2024 08:41:31.147842884 CEST	50134	2121	192.168.2.16	179.197.172.68
May 8, 2024 08:41:31.147841930 CEST	50135	21	192.168.2.16	80.18.101.99
May 8, 2024 08:41:31.147842884 CEST	50269	21	192.168.2.16	1.225.129.9
May 8, 2024 08:41:31.147965908 CEST	50137	21	192.168.2.16	183.173.247.100
May 8, 2024 08:41:31.163851023 CEST	50136	2121	192.168.2.16	80.18.101.99
May 8, 2024 08:41:31.163861036 CEST	50270	2121	192.168.2.16	1.225.129.9
May 8, 2024 08:41:31.163867950 CEST	50282	2121	192.168.2.16	181.71.244.102
May 8, 2024 08:41:31.163979053 CEST	50310	2121	192.168.2.16	88.136.65.138
May 8, 2024 08:41:31.179883003 CEST	50280	2121	192.168.2.16	175.121.57.126
May 8, 2024 08:41:31.179888010 CEST	50205	21	192.168.2.16	183.119.252.76
May 8, 2024 08:41:31.179927111 CEST	50279	21	192.168.2.16	175.121.57.126
May 8, 2024 08:41:31.195808887 CEST	50140	2121	192.168.2.16	157.254.106.222
May 8, 2024 08:41:31.195842028 CEST	50197	2121	192.168.2.16	91.118.29.181
May 8, 2024 08:41:31.195843935 CEST	50206	2121	192.168.2.16	183.119.252.76
May 8, 2024 08:41:31.195843935 CEST	50281	21	192.168.2.16	181.71.244.102
May 8, 2024 08:41:31.195997000 CEST	50139	21	192.168.2.16	157.254.106.222
May 8, 2024 08:41:31.211807966 CEST	50204	21	192.168.2.16	91.118.29.181
May 8, 2024 08:41:31.211837053 CEST	50141	21	192.168.2.16	105.209.161.139
May 8, 2024 08:41:31.226891041 CEST	2121	50210	124.175.188.59	192.168.2.16
May 8, 2024 08:41:31.229311943 CEST	21	50207	124.175.188.59	192.168.2.16
May 8, 2024 08:41:31.243849993 CEST	50143	21	192.168.2.16	27.75.137.166
May 8, 2024 08:41:31.243850946 CEST	50144	2121	192.168.2.16	27.75.137.166
May 8, 2024 08:41:31.243850946 CEST	50142	2121	192.168.2.16	105.209.161.139
May 8, 2024 08:41:31.243853092 CEST	50145	21	192.168.2.16	73.12.247.170
May 8, 2024 08:41:31.243858099 CEST	50160	2121	192.168.2.16	139.185.33.251
May 8, 2024 08:41:31.244131088 CEST	50159	21	192.168.2.16	139.185.33.251
May 8, 2024 08:41:31.244134903 CEST	50146	2121	192.168.2.16	73.12.247.170
May 8, 2024 08:41:31.259836912 CEST	50148	2121	192.168.2.16	14.248.57.220
May 8, 2024 08:41:31.259841919 CEST	50147	21	192.168.2.16	14.248.57.220
May 8, 2024 08:41:31.271315098 CEST	2121	50130	139.59.79.85	192.168.2.16
May 8, 2024 08:41:31.275849104 CEST	50291	21	192.168.2.16	94.136.16.189
May 8, 2024 08:41:31.275991917 CEST	50292	2121	192.168.2.16	94.136.16.189
May 8, 2024 08:41:31.279495001 CEST	21	50128	139.59.79.85	192.168.2.16
May 8, 2024 08:41:31.291846991 CEST	50150	2121	192.168.2.16	83.50.47.165
May 8, 2024 08:41:31.291873932 CEST	50149	21	192.168.2.16	83.50.47.165
May 8, 2024 08:41:31.322526932 CEST	2121	50295	172.85.192.65	192.168.2.16
May 8, 2024 08:41:31.322942972 CEST	21	50296	172.85.192.65	192.168.2.16
May 8, 2024 08:41:31.339870930 CEST	50151	21	192.168.2.16	67.249.182.208
May 8, 2024 08:41:31.339873075 CEST	50152	2121	192.168.2.16	67.249.182.208
May 8, 2024 08:41:31.339945078 CEST	50293	21	192.168.2.16	105.97.141.224
May 8, 2024 08:41:31.340455055 CEST	50314	2121	192.168.2.16	123.144.241.64
May 8, 2024 08:41:31.355813980 CEST	50272	21	192.168.2.16	103.120.132.17
May 8, 2024 08:41:31.355999947 CEST	50294	2121	192.168.2.16	105.97.141.224
May 8, 2024 08:41:31.360780954 CEST	21	50131	171.79.111.124	192.168.2.16
May 8, 2024 08:41:31.369719028 CEST	2121	50132	171.79.111.124	192.168.2.16
May 8, 2024 08:41:31.371815920 CEST	50271	2121	192.168.2.16	103.120.132.17
May 8, 2024 08:41:31.387809992 CEST	50153	21	192.168.2.16	74.75.255.17
May 8, 2024 08:41:31.387820005 CEST	50154	2121	192.168.2.16	74.75.255.17
May 8, 2024 08:41:31.387840986 CEST	50155	21	192.168.2.16	118.220.220.143
May 8, 2024 08:41:31.398817062 CEST	2121	50193	1.232.152.196	192.168.2.16
May 8, 2024 08:41:31.403811932 CEST	50156	2121	192.168.2.16	118.220.220.143
May 8, 2024 08:41:31.403814077 CEST	50157	21	192.168.2.16	122.168.163.39
May 8, 2024 08:41:31.419811010 CEST	50214	2121	192.168.2.16	115.244.167.85
May 8, 2024 08:41:31.428067923 CEST	21	50269	1.225.129.9	192.168.2.16
May 8, 2024 08:41:31.435832024 CEST	50213	21	192.168.2.16	115.244.167.85
May 8, 2024 08:41:31.439002991 CEST	2121	50282	181.71.244.102	192.168.2.16
May 8, 2024 08:41:31.441772938 CEST	2121	50138	183.173.247.100	192.168.2.16
May 8, 2024 08:41:31.445250034 CEST	2121	50270	1.225.129.9	192.168.2.16
May 8, 2024 08:41:31.451807976 CEST	50158	2121	192.168.2.16	122.168.163.39
May 8, 2024 08:41:31.452881098 CEST	2121	50201	219.104.236.32	192.168.2.16
May 8, 2024 08:41:31.466589928 CEST	21	50279	175.121.57.126	192.168.2.16
May 8, 2024 08:41:31.467266083 CEST	2121	50280	175.121.57.126	192.168.2.16
May 8, 2024 08:41:31.468157053 CEST	50315	21	192.168.2.16	76.21.40.96
May 8, 2024 08:41:31.482134104 CEST	21	50281	181.71.244.102	192.168.2.16
May 8, 2024 08:41:31.491014004 CEST	21	50303	175.205.92.244	192.168.2.16
May 8, 2024 08:41:31.491436958 CEST	2121	50304	175.205.92.244	192.168.2.16
May 8, 2024 08:41:31.502777100 CEST	21	50205	183.119.252.76	192.168.2.16
May 8, 2024 08:41:31.522054911 CEST	2121	50206	183.119.252.76	192.168.2.16
May 8, 2024 08:41:31.524177074 CEST	2121	50197	91.118.29.181	192.168.2.16
May 8, 2024 08:41:31.531836987 CEST	50161	21	192.168.2.16	189.189.234.175
May 8, 2024 08:41:31.540467978 CEST	21	50204	91.118.29.181	192.168.2.16
May 8, 2024 08:41:31.595841885 CEST	50311	21	192.168.2.16	174.4.136.10
May 8, 2024 08:41:31.612703085 CEST	21	50291	94.136.16.189	192.168.2.16
May 8, 2024 08:41:31.618489981 CEST	2121	50292	94.136.16.189	192.168.2.16
May 8, 2024 08:41:31.657886982 CEST	21	50315	76.21.40.96	192.168.2.16
May 8, 2024 08:41:31.662517071 CEST	2121	50160	139.185.33.251	192.168.2.16
May 8, 2024 08:41:31.664263010 CEST	21	50159	139.185.33.251	192.168.2.16
May 8, 2024 08:41:31.708425999 CEST	21	50293	105.97.141.224	192.168.2.16
May 8, 2024 08:41:31.738033056 CEST	2121	50294	105.97.141.224	192.168.2.16
May 8, 2024 08:41:31.739866972 CEST	50210	2121	192.168.2.16	124.175.188.59
May 8, 2024 08:41:31.739871025 CEST	50207	21	192.168.2.16	124.175.188.59
May 8, 2024 08:41:31.745105982 CEST	21	50272	103.120.132.17	192.168.2.16
May 8, 2024 08:41:31.763772011 CEST	2121	50271	103.120.132.17	192.168.2.16
May 8, 2024 08:41:31.771866083 CEST	50162	2121	192.168.2.16	189.189.234.175
May 8, 2024 08:41:31.786837101 CEST	50163	21	192.168.2.16	123.112.167.56
May 8, 2024 08:41:31.786848068 CEST	50128	21	192.168.2.16	139.59.79.85
May 8, 2024 08:41:31.786879063 CEST	50130	2121	192.168.2.16	139.59.79.85
May 8, 2024 08:41:31.819237947 CEST	50316	2121	192.168.2.16	76.21.40.96
May 8, 2024 08:41:31.834835052 CEST	50295	2121	192.168.2.16	172.85.192.65
May 8, 2024 08:41:31.834851027 CEST	50296	21	192.168.2.16	172.85.192.65
May 8, 2024 08:41:31.835166931 CEST	50317	21	192.168.2.16	58.121.190.195
May 8, 2024 08:41:31.850564003 CEST	2121	50214	115.244.167.85	192.168.2.16
May 8, 2024 08:41:31.866874933 CEST	50131	21	192.168.2.16	171.79.111.124
May 8, 2024 08:41:31.873728037 CEST	21	50213	115.244.167.85	192.168.2.16
May 8, 2024 08:41:31.882886887 CEST	50132	2121	192.168.2.16	171.79.111.124
May 8, 2024 08:41:31.914855957 CEST	50193	2121	192.168.2.16	1.232.152.196
May 8, 2024 08:41:31.930841923 CEST	50269	21	192.168.2.16	1.225.129.9
May 8, 2024 08:41:31.946844101 CEST	50270	2121	192.168.2.16	1.225.129.9
May 8, 2024 08:41:31.946850061 CEST	50282	2121	192.168.2.16	181.71.244.102
May 8, 2024 08:41:31.946850061 CEST	50138	2121	192.168.2.16	183.173.247.100
May 8, 2024 08:41:31.962893009 CEST	2121	50210	124.175.188.59	192.168.2.16
May 8, 2024 08:41:31.965095997 CEST	21	50207	124.175.188.59	192.168.2.16
May 8, 2024 08:41:31.969820023 CEST	50201	2121	192.168.2.16	219.104.236.32
May 8, 2024 08:41:31.969993114 CEST	50280	2121	192.168.2.16	175.121.57.126
May 8, 2024 08:41:31.978831053 CEST	50279	21	192.168.2.16	175.121.57.126
May 8, 2024 08:41:31.994843960 CEST	50281	21	192.168.2.16	181.71.244.102
May 8, 2024 08:41:31.995270014 CEST	50303	21	192.168.2.16	175.205.92.244
May 8, 2024 08:41:31.995675087 CEST	50304	2121	192.168.2.16	175.205.92.244
May 8, 2024 08:41:32.008193970 CEST	2121	50316	76.21.40.96	192.168.2.16
May 8, 2024 08:41:32.010824919 CEST	50205	21	192.168.2.16	183.119.252.76
May 8, 2024 08:41:32.026834011 CEST	50164	2121	192.168.2.16	123.112.167.56
May 8, 2024 08:41:32.026846886 CEST	50197	2121	192.168.2.16	91.118.29.181
May 8, 2024 08:41:32.026848078 CEST	50206	2121	192.168.2.16	183.119.252.76
May 8, 2024 08:41:32.042839050 CEST	50204	21	192.168.2.16	91.118.29.181
May 8, 2024 08:41:32.073640108 CEST	2121	50295	172.85.192.65	192.168.2.16
May 8, 2024 08:41:32.073859930 CEST	21	50296	172.85.192.65	192.168.2.16
May 8, 2024 08:41:32.074848890 CEST	50312	2121	192.168.2.16	174.4.136.10
May 8, 2024 08:41:32.106844902 CEST	50313	21	192.168.2.16	123.144.241.64
May 8, 2024 08:41:32.120748043 CEST	21	50317	58.121.190.195	192.168.2.16
May 8, 2024 08:41:32.122864962 CEST	50292	2121	192.168.2.16	94.136.16.189
May 8, 2024 08:41:32.122865915 CEST	50291	21	192.168.2.16	94.136.16.189
May 8, 2024 08:41:32.170819998 CEST	50315	21	192.168.2.16	76.21.40.96
May 8, 2024 08:41:32.170823097 CEST	50160	2121	192.168.2.16	139.185.33.251
May 8, 2024 08:41:32.171060085 CEST	50159	21	192.168.2.16	139.185.33.251
May 8, 2024 08:41:32.197202921 CEST	2121	50130	139.59.79.85	192.168.2.16
May 8, 2024 08:41:32.197747946 CEST	2121	50193	1.232.152.196	192.168.2.16
May 8, 2024 08:41:32.202826023 CEST	50166	2121	192.168.2.16	113.17.21.229
May 8, 2024 08:41:32.202833891 CEST	50165	21	192.168.2.16	113.17.21.229
May 8, 2024 08:41:32.205472946 CEST	21	50128	139.59.79.85	192.168.2.16
May 8, 2024 08:41:32.211050034 CEST	21	50269	1.225.129.9	192.168.2.16
May 8, 2024 08:41:32.218868971 CEST	50293	21	192.168.2.16	105.97.141.224
May 8, 2024 08:41:32.219500065 CEST	50318	2121	192.168.2.16	58.121.190.195
May 8, 2024 08:41:32.219631910 CEST	50319	21	192.168.2.16	68.144.62.62
May 8, 2024 08:41:32.223159075 CEST	2121	50282	181.71.244.102	192.168.2.16
May 8, 2024 08:41:32.228199959 CEST	2121	50270	1.225.129.9	192.168.2.16
May 8, 2024 08:41:32.250825882 CEST	50294	2121	192.168.2.16	105.97.141.224
May 8, 2024 08:41:32.251023054 CEST	50272	21	192.168.2.16	103.120.132.17
May 8, 2024 08:41:32.257405996 CEST	2121	50280	175.121.57.126	192.168.2.16
May 8, 2024 08:41:32.266726017 CEST	21	50279	175.121.57.126	192.168.2.16
May 8, 2024 08:41:32.266876936 CEST	50271	2121	192.168.2.16	103.120.132.17
May 8, 2024 08:41:32.274817944 CEST	2121	50201	219.104.236.32	192.168.2.16
May 8, 2024 08:41:32.282121897 CEST	21	50281	181.71.244.102	192.168.2.16
May 8, 2024 08:41:32.302794933 CEST	21	50131	171.79.111.124	192.168.2.16
May 8, 2024 08:41:32.303322077 CEST	50320	2121	192.168.2.16	68.144.62.62
May 8, 2024 08:41:32.311819077 CEST	2121	50132	171.79.111.124	192.168.2.16
May 8, 2024 08:41:32.312302113 CEST	50321	21	192.168.2.16	69.139.73.181
May 8, 2024 08:41:32.333164930 CEST	50322	2121	192.168.2.16	69.139.73.181
May 8, 2024 08:41:32.334327936 CEST	21	50205	183.119.252.76	192.168.2.16
May 8, 2024 08:41:32.346971035 CEST	50314	2121	192.168.2.16	123.144.241.64
May 8, 2024 08:41:32.352935076 CEST	2121	50206	183.119.252.76	192.168.2.16
May 8, 2024 08:41:32.354938984 CEST	2121	50197	91.118.29.181	192.168.2.16
May 8, 2024 08:41:32.362828016 CEST	50214	2121	192.168.2.16	115.244.167.85
May 8, 2024 08:41:32.363203049 CEST	50323	21	192.168.2.16	71.28.183.56
May 8, 2024 08:41:32.363583088 CEST	2121	50138	183.173.247.100	192.168.2.16
May 8, 2024 08:41:32.368874073 CEST	21	50315	76.21.40.96	192.168.2.16
May 8, 2024 08:41:32.372037888 CEST	21	50204	91.118.29.181	192.168.2.16
May 8, 2024 08:41:32.378829002 CEST	50213	21	192.168.2.16	115.244.167.85
May 8, 2024 08:41:32.379420042 CEST	50324	2121	192.168.2.16	71.28.183.56
May 8, 2024 08:41:32.379473925 CEST	50325	21	192.168.2.16	82.79.35.202
May 8, 2024 08:41:32.379532099 CEST	50326	2121	192.168.2.16	82.79.35.202
May 8, 2024 08:41:32.411173105 CEST	50327	21	192.168.2.16	125.247.204.97
May 8, 2024 08:41:32.457444906 CEST	21	50291	94.136.16.189	192.168.2.16
May 8, 2024 08:41:32.463301897 CEST	2121	50292	94.136.16.189	192.168.2.16
May 8, 2024 08:41:32.474828005 CEST	50207	21	192.168.2.16	124.175.188.59
May 8, 2024 08:41:32.474839926 CEST	50210	2121	192.168.2.16	124.175.188.59
May 8, 2024 08:41:32.491154909 CEST	50328	2121	192.168.2.16	125.247.204.97
May 8, 2024 08:41:32.517563105 CEST	21	50303	175.205.92.244	192.168.2.16
May 8, 2024 08:41:32.518060923 CEST	2121	50304	175.205.92.244	192.168.2.16
May 8, 2024 08:41:32.522824049 CEST	50167	21	192.168.2.16	20.115.22.255
May 8, 2024 08:41:32.522825003 CEST	50170	2121	192.168.2.16	119.242.104.72
May 8, 2024 08:41:32.522841930 CEST	50175	21	192.168.2.16	42.82.192.53
May 8, 2024 08:41:32.522841930 CEST	50172	2121	192.168.2.16	172.120.235.139
May 8, 2024 08:41:32.522842884 CEST	50173	2121	192.168.2.16	189.147.28.233
May 8, 2024 08:41:32.522841930 CEST	50168	2121	192.168.2.16	20.115.22.255
May 8, 2024 08:41:32.522845984 CEST	50176	2121	192.168.2.16	42.82.192.53
May 8, 2024 08:41:32.522845984 CEST	50180	2121	192.168.2.16	184.92.186.129
May 8, 2024 08:41:32.522866964 CEST	50182	21	192.168.2.16	4.206.146.112
May 8, 2024 08:41:32.522866964 CEST	50184	2121	192.168.2.16	109.130.229.15
May 8, 2024 08:41:32.522867918 CEST	50177	21	192.168.2.16	76.101.92.121
May 8, 2024 08:41:32.522869110 CEST	50178	2121	192.168.2.16	76.101.92.121
May 8, 2024 08:41:32.522869110 CEST	50169	21	192.168.2.16	119.242.104.72
May 8, 2024 08:41:32.522869110 CEST	50181	2121	192.168.2.16	4.206.146.112
May 8, 2024 08:41:32.522871017 CEST	50174	21	192.168.2.16	189.147.28.233
May 8, 2024 08:41:32.522871971 CEST	50316	2121	192.168.2.16	76.21.40.96
May 8, 2024 08:41:32.522871971 CEST	50183	21	192.168.2.16	109.130.229.15
May 8, 2024 08:41:32.522871971 CEST	50186	2121	192.168.2.16	146.75.86.69
May 8, 2024 08:41:32.522996902 CEST	50179	21	192.168.2.16	184.92.186.129
May 8, 2024 08:41:32.523000956 CEST	50185	21	192.168.2.16	146.75.86.69
May 8, 2024 08:41:32.528587103 CEST	2121	50318	58.121.190.195	192.168.2.16
May 8, 2024 08:41:32.538825989 CEST	50191	21	192.168.2.16	1.232.152.196
May 8, 2024 08:41:32.538825035 CEST	50187	21	192.168.2.16	38.154.167.222
May 8, 2024 08:41:32.538842916 CEST	50188	2121	192.168.2.16	38.154.167.222
May 8, 2024 08:41:32.538846016 CEST	50189	21	192.168.2.16	38.12.232.73
May 8, 2024 08:41:32.538846016 CEST	50194	2121	192.168.2.16	153.3.237.182
May 8, 2024 08:41:32.538846016 CEST	50198	2121	192.168.2.16	41.107.171.233
May 8, 2024 08:41:32.538849115 CEST	50196	2121	192.168.2.16	89.197.227.65
May 8, 2024 08:41:32.538858891 CEST	50203	2121	192.168.2.16	96.16.83.158
May 8, 2024 08:41:32.538860083 CEST	50202	21	192.168.2.16	96.16.83.158
May 8, 2024 08:41:32.538861990 CEST	50192	21	192.168.2.16	153.3.237.182
May 8, 2024 08:41:32.538863897 CEST	50190	2121	192.168.2.16	38.12.232.73
May 8, 2024 08:41:32.538863897 CEST	50195	21	192.168.2.16	89.197.227.65
May 8, 2024 08:41:32.538866043 CEST	50200	21	192.168.2.16	219.104.236.32
May 8, 2024 08:41:32.539238930 CEST	50199	21	192.168.2.16	41.107.171.233
May 8, 2024 08:41:32.554814100 CEST	50217	2121	192.168.2.16	18.161.91.79
May 8, 2024 08:41:32.554831028 CEST	50208	21	192.168.2.16	49.235.102.237
May 8, 2024 08:41:32.554831982 CEST	50224	21	192.168.2.16	73.235.136.12
May 8, 2024 08:41:32.554832935 CEST	50227	2121	192.168.2.16	201.130.99.91
May 8, 2024 08:41:32.554852009 CEST	50211	21	192.168.2.16	171.246.110.71
May 8, 2024 08:41:32.554852962 CEST	50215	21	192.168.2.16	201.130.99.91
May 8, 2024 08:41:32.554852962 CEST	50219	21	192.168.2.16	191.191.24.153
May 8, 2024 08:41:32.554857969 CEST	50209	2121	192.168.2.16	49.235.102.237
May 8, 2024 08:41:32.554877043 CEST	50226	21	192.168.2.16	39.87.149.104
May 8, 2024 08:41:32.554877043 CEST	50223	2121	192.168.2.16	222.160.120.231
May 8, 2024 08:41:32.554877996 CEST	50221	2121	192.168.2.16	77.75.121.3
May 8, 2024 08:41:32.554877043 CEST	50222	21	192.168.2.16	222.160.120.231
May 8, 2024 08:41:32.554881096 CEST	50216	21	192.168.2.16	18.161.91.79
May 8, 2024 08:41:32.554877996 CEST	50225	2121	192.168.2.16	73.235.136.12
May 8, 2024 08:41:32.554881096 CEST	50218	2121	192.168.2.16	191.191.24.153
May 8, 2024 08:41:32.554878950 CEST	50212	2121	192.168.2.16	171.246.110.71
May 8, 2024 08:41:32.555202007 CEST	50228	2121	192.168.2.16	39.87.149.104
May 8, 2024 08:41:32.570818901 CEST	50232	21	192.168.2.16	3.255.123.211
May 8, 2024 08:41:32.570818901 CEST	50231	21	192.168.2.16	134.255.240.224
May 8, 2024 08:41:32.570820093 CEST	50230	2121	192.168.2.16	160.223.208.239
May 8, 2024 08:41:32.570820093 CEST	50236	2121	192.168.2.16	211.203.213.243
May 8, 2024 08:41:32.570847988 CEST	50235	21	192.168.2.16	66.189.156.99
May 8, 2024 08:41:32.570851088 CEST	50238	21	192.168.2.16	87.226.2.245
May 8, 2024 08:41:32.570852041 CEST	50243	21	192.168.2.16	49.161.36.224
May 8, 2024 08:41:32.570852995 CEST	50239	21	192.168.2.16	211.203.213.243
May 8, 2024 08:41:32.570852995 CEST	50229	21	192.168.2.16	160.223.208.239
May 8, 2024 08:41:32.570853949 CEST	50237	2121	192.168.2.16	68.38.82.38
May 8, 2024 08:41:32.570854902 CEST	50245	21	192.168.2.16	59.62.230.49
May 8, 2024 08:41:32.570852995 CEST	50234	2121	192.168.2.16	3.255.123.211
May 8, 2024 08:41:32.570853949 CEST	50242	21	192.168.2.16	68.150.164.127
May 8, 2024 08:41:32.570852995 CEST	50240	21	192.168.2.16	68.38.82.38
May 8, 2024 08:41:32.570854902 CEST	50249	2121	192.168.2.16	14.86.253.70
May 8, 2024 08:41:32.570852995 CEST	50246	2121	192.168.2.16	59.62.230.49
May 8, 2024 08:41:32.570854902 CEST	50247	21	192.168.2.16	149.96.187.162
May 8, 2024 08:41:32.570879936 CEST	50251	21	192.168.2.16	14.86.253.70
May 8, 2024 08:41:32.570880890 CEST	50233	2121	192.168.2.16	134.255.240.224
May 8, 2024 08:41:32.570882082 CEST	50252	2121	192.168.2.16	68.150.164.127
May 8, 2024 08:41:32.570884943 CEST	50244	2121	192.168.2.16	49.161.36.224
May 8, 2024 08:41:32.570883036 CEST	50250	21	192.168.2.16	108.26.144.105
May 8, 2024 08:41:32.570883036 CEST	50248	2121	192.168.2.16	149.96.187.162
May 8, 2024 08:41:32.570887089 CEST	50253	2121	192.168.2.16	66.189.156.99
May 8, 2024 08:41:32.570986986 CEST	50241	2121	192.168.2.16	87.226.2.245
May 8, 2024 08:41:32.586816072 CEST	50295	2121	192.168.2.16	172.85.192.65
May 8, 2024 08:41:32.586817026 CEST	50255	21	192.168.2.16	201.35.137.125
May 8, 2024 08:41:32.586834908 CEST	50296	21	192.168.2.16	172.85.192.65
May 8, 2024 08:41:32.586834908 CEST	50256	2121	192.168.2.16	201.35.137.125
May 8, 2024 08:41:32.586834908 CEST	50254	2121	192.168.2.16	108.26.144.105
May 8, 2024 08:41:32.587413073 CEST	21	50293	105.97.141.224	192.168.2.16
May 8, 2024 08:41:32.589423895 CEST	2121	50160	139.185.33.251	192.168.2.16
May 8, 2024 08:41:32.589951038 CEST	50329	21	192.168.2.16	165.227.135.59
May 8, 2024 08:41:32.591032028 CEST	21	50159	139.185.33.251	192.168.2.16
May 8, 2024 08:41:32.591430902 CEST	50330	2121	192.168.2.16	165.227.135.59
May 8, 2024 08:41:32.602813005 CEST	50273	21	192.168.2.16	190.3.106.234
May 8, 2024 08:41:32.602813959 CEST	50257	21	192.168.2.16	90.246.237.33
May 8, 2024 08:41:32.602837086 CEST	50288	2121	192.168.2.16	167.71.66.165
May 8, 2024 08:41:32.602838993 CEST	50265	21	192.168.2.16	45.7.88.51
May 8, 2024 08:41:32.602838993 CEST	50259	21	192.168.2.16	46.175.4.125
May 8, 2024 08:41:32.602838993 CEST	50258	2121	192.168.2.16	90.246.237.33
May 8, 2024 08:41:32.602838993 CEST	50286	21	192.168.2.16	167.71.66.165
May 8, 2024 08:41:32.602842093 CEST	50263	21	192.168.2.16	20.222.111.34
May 8, 2024 08:41:32.602842093 CEST	50277	21	192.168.2.16	88.221.151.7
May 8, 2024 08:41:32.602842093 CEST	50283	21	192.168.2.16	95.238.61.250
May 8, 2024 08:41:32.602852106 CEST	50264	2121	192.168.2.16	77.130.185.28
May 8, 2024 08:41:32.602853060 CEST	50266	2121	192.168.2.16	45.7.88.51
May 8, 2024 08:41:32.602853060 CEST	50290	2121	192.168.2.16	109.136.44.230
May 8, 2024 08:41:32.602857113 CEST	50262	2121	192.168.2.16	20.222.111.34
May 8, 2024 08:41:32.602858067 CEST	50261	21	192.168.2.16	77.130.185.28
May 8, 2024 08:41:32.602858067 CEST	50276	21	192.168.2.16	80.138.234.3
May 8, 2024 08:41:32.602861881 CEST	50260	2121	192.168.2.16	46.175.4.125
May 8, 2024 08:41:32.602861881 CEST	50267	2121	192.168.2.16	71.229.38.180
May 8, 2024 08:41:32.604036093 CEST	50268	21	192.168.2.16	71.229.38.180
May 8, 2024 08:41:32.604038000 CEST	50274	2121	192.168.2.16	190.3.106.234
May 8, 2024 08:41:32.604038954 CEST	50275	2121	192.168.2.16	80.138.234.3
May 8, 2024 08:41:32.604038954 CEST	50278	2121	192.168.2.16	88.221.151.7
May 8, 2024 08:41:32.618813992 CEST	50300	2121	192.168.2.16	82.140.49.243
May 8, 2024 08:41:32.618833065 CEST	50302	2121	192.168.2.16	106.244.57.130
May 8, 2024 08:41:32.618833065 CEST	50298	2121	192.168.2.16	96.250.94.212
May 8, 2024 08:41:32.618845940 CEST	50284	2121	192.168.2.16	95.238.61.250
May 8, 2024 08:41:32.618860006 CEST	50285	21	192.168.2.16	189.225.118.213
May 8, 2024 08:41:32.618860960 CEST	50287	2121	192.168.2.16	189.225.118.213
May 8, 2024 08:41:32.618861914 CEST	50289	21	192.168.2.16	109.136.44.230
May 8, 2024 08:41:32.618864059 CEST	50297	21	192.168.2.16	96.250.94.212
May 8, 2024 08:41:32.618864059 CEST	50301	21	192.168.2.16	106.244.57.130
May 8, 2024 08:41:32.620106936 CEST	50299	21	192.168.2.16	82.140.49.243
May 8, 2024 08:41:32.628530979 CEST	2121	50294	105.97.141.224	192.168.2.16
May 8, 2024 08:41:32.634840012 CEST	50317	21	192.168.2.16	58.121.190.195
May 8, 2024 08:41:32.635463953 CEST	21	50272	103.120.132.17	192.168.2.16
May 8, 2024 08:41:32.656888962 CEST	2121	50271	103.120.132.17	192.168.2.16
May 8, 2024 08:41:32.696141005 CEST	2121	50210	124.175.188.59	192.168.2.16
May 8, 2024 08:41:32.698818922 CEST	21	50207	124.175.188.59	192.168.2.16
May 8, 2024 08:41:32.698848963 CEST	50193	2121	192.168.2.16	1.232.152.196
May 8, 2024 08:41:32.699295044 CEST	50331	21	192.168.2.16	65.60.157.69
May 8, 2024 08:41:32.711661100 CEST	2121	50316	76.21.40.96	192.168.2.16
May 8, 2024 08:41:32.713839054 CEST	50269	21	192.168.2.16	1.225.129.9
May 8, 2024 08:41:32.714204073 CEST	50332	2121	192.168.2.16	65.60.157.69
May 8, 2024 08:41:32.729830980 CEST	50270	2121	192.168.2.16	1.225.129.9
May 8, 2024 08:41:32.729835987 CEST	50282	2121	192.168.2.16	181.71.244.102
May 8, 2024 08:41:32.761859894 CEST	50280	2121	192.168.2.16	175.121.57.126
May 8, 2024 08:41:32.777849913 CEST	50279	21	192.168.2.16	175.121.57.126
May 8, 2024 08:41:32.777856112 CEST	50201	2121	192.168.2.16	219.104.236.32
May 8, 2024 08:41:32.778830051 CEST	50333	21	192.168.2.16	175.116.228.90
May 8, 2024 08:41:32.778832912 CEST	50334	2121	192.168.2.16	175.116.228.90
May 8, 2024 08:41:32.778846979 CEST	50335	21	192.168.2.16	58.37.12.209
May 8, 2024 08:41:32.793528080 CEST	2121	50214	115.244.167.85	192.168.2.16
May 8, 2024 08:41:32.793836117 CEST	50281	21	192.168.2.16	181.71.244.102
May 8, 2024 08:41:32.817222118 CEST	21	50213	115.244.167.85	192.168.2.16
May 8, 2024 08:41:32.825567961 CEST	2121	50295	172.85.192.65	192.168.2.16
May 8, 2024 08:41:32.825757980 CEST	21	50296	172.85.192.65	192.168.2.16
May 8, 2024 08:41:32.826101065 CEST	50336	2121	192.168.2.16	58.37.12.209
May 8, 2024 08:41:32.826262951 CEST	50337	21	192.168.2.16	38.38.120.85
May 8, 2024 08:41:32.829612970 CEST	2121	49966	103.21.62.148	192.168.2.16
May 8, 2024 08:41:32.832778931 CEST	21	49957	103.21.62.148	192.168.2.16
May 8, 2024 08:41:32.841855049 CEST	50205	21	192.168.2.16	183.119.252.76
May 8, 2024 08:41:32.857851982 CEST	50197	2121	192.168.2.16	91.118.29.181
May 8, 2024 08:41:32.857853889 CEST	50206	2121	192.168.2.16	183.119.252.76
May 8, 2024 08:41:32.873842001 CEST	50305	21	192.168.2.16	23.144.192.245
May 8, 2024 08:41:32.873842955 CEST	50315	21	192.168.2.16	76.21.40.96
May 8, 2024 08:41:32.873842955 CEST	50306	2121	192.168.2.16	23.144.192.245
May 8, 2024 08:41:32.875159979 CEST	50204	21	192.168.2.16	91.118.29.181
May 8, 2024 08:41:32.904833078 CEST	50307	21	192.168.2.16	92.104.238.147
May 8, 2024 08:41:32.920768023 CEST	21	50317	58.121.190.195	192.168.2.16
May 8, 2024 08:41:32.920854092 CEST	50308	2121	192.168.2.16	92.104.238.147
May 8, 2024 08:41:32.954926968 CEST	21	50331	65.60.157.69	192.168.2.16
May 8, 2024 08:41:32.960580111 CEST	2121	50332	65.60.157.69	192.168.2.16
May 8, 2024 08:41:32.968856096 CEST	50292	2121	192.168.2.16	94.136.16.189
May 8, 2024 08:41:32.970735073 CEST	50291	21	192.168.2.16	94.136.16.189
May 8, 2024 08:41:32.981733084 CEST	2121	50193	1.232.152.196	192.168.2.16
May 8, 2024 08:41:32.982927084 CEST	50338	21	192.168.2.16	23.229.188.101
May 8, 2024 08:41:32.984833956 CEST	50309	21	192.168.2.16	88.136.65.138
May 8, 2024 08:41:32.994065046 CEST	21	50269	1.225.129.9	192.168.2.16
May 8, 2024 08:41:33.000873089 CEST	50339	21	192.168.2.16	196.210.0.111
May 8, 2024 08:41:33.001266956 CEST	50340	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:33.007029057 CEST	2121	50282	181.71.244.102	192.168.2.16
May 8, 2024 08:41:33.009571075 CEST	50341	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:33.011292934 CEST	2121	50270	1.225.129.9	192.168.2.16
May 8, 2024 08:41:33.011626005 CEST	50342	21	192.168.2.16	172.120.235.139
May 8, 2024 08:41:33.018429041 CEST	21	50337	38.38.120.85	192.168.2.16
May 8, 2024 08:41:33.018517017 CEST	50337	21	192.168.2.16	38.38.120.85
May 8, 2024 08:41:33.032125950 CEST	50304	2121	192.168.2.16	175.205.92.244
May 8, 2024 08:41:33.032155037 CEST	50303	21	192.168.2.16	175.205.92.244
May 8, 2024 08:41:33.032162905 CEST	50318	2121	192.168.2.16	58.121.190.195
May 8, 2024 08:41:33.048434019 CEST	50343	21	192.168.2.16	77.75.121.3
May 8, 2024 08:41:33.049515963 CEST	2121	50280	175.121.57.126	192.168.2.16
May 8, 2024 08:41:33.050612926 CEST	50344	21	192.168.2.16	68.144.255.196
May 8, 2024 08:41:33.061744928 CEST	21	50333	175.116.228.90	192.168.2.16
May 8, 2024 08:41:33.062534094 CEST	21	50315	76.21.40.96	192.168.2.16
May 8, 2024 08:41:33.064881086 CEST	21	50279	175.121.57.126	192.168.2.16
May 8, 2024 08:41:33.064959049 CEST	50345	2121	192.168.2.16	68.144.255.196
May 8, 2024 08:41:33.065221071 CEST	50346	21	192.168.2.16	219.249.223.42
May 8, 2024 08:41:33.078185081 CEST	2121	50334	175.116.228.90	192.168.2.16
May 8, 2024 08:41:33.082088947 CEST	21	50281	181.71.244.102	192.168.2.16
May 8, 2024 08:41:33.083121061 CEST	2121	50201	219.104.236.32	192.168.2.16
May 8, 2024 08:41:33.083631992 CEST	50347	2121	192.168.2.16	219.249.223.42
May 8, 2024 08:41:33.095865011 CEST	50293	21	192.168.2.16	105.97.141.224
May 8, 2024 08:41:33.096326113 CEST	50348	21	192.168.2.16	197.8.254.242
May 8, 2024 08:41:33.096499920 CEST	50349	2121	192.168.2.16	197.8.254.242
May 8, 2024 08:41:33.128552914 CEST	50350	21	192.168.2.16	174.79.38.52
May 8, 2024 08:41:33.128654003 CEST	50352	21	192.168.2.16	23.1.29.50
May 8, 2024 08:41:33.128654003 CEST	50351	2121	192.168.2.16	174.79.38.52
May 8, 2024 08:41:33.143819094 CEST	50294	2121	192.168.2.16	105.97.141.224
May 8, 2024 08:41:33.144004107 CEST	50272	21	192.168.2.16	103.120.132.17
May 8, 2024 08:41:33.144191027 CEST	50353	2121	192.168.2.16	23.1.29.50
May 8, 2024 08:41:33.144258976 CEST	50354	21	192.168.2.16	141.156.239.196
May 8, 2024 08:41:33.159837008 CEST	50271	2121	192.168.2.16	103.120.132.17
May 8, 2024 08:41:33.163403988 CEST	2121	50340	34.149.79.8	192.168.2.16
May 8, 2024 08:41:33.163482904 CEST	50340	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:33.164577961 CEST	21	50205	183.119.252.76	192.168.2.16
May 8, 2024 08:41:33.171956062 CEST	21	50341	34.149.79.8	192.168.2.16
May 8, 2024 08:41:33.172023058 CEST	50341	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:33.175859928 CEST	50310	2121	192.168.2.16	88.136.65.138
May 8, 2024 08:41:33.176362038 CEST	50355	2121	192.168.2.16	141.156.239.196
May 8, 2024 08:41:33.176398039 CEST	50356	21	192.168.2.16	181.170.184.192
May 8, 2024 08:41:33.176469088 CEST	50357	2121	192.168.2.16	181.170.184.192
May 8, 2024 08:41:33.183749914 CEST	21	50338	23.229.188.101	192.168.2.16
May 8, 2024 08:41:33.183828115 CEST	50338	21	192.168.2.16	23.229.188.101
May 8, 2024 08:41:33.184407949 CEST	2121	50206	183.119.252.76	192.168.2.16
May 8, 2024 08:41:33.185396910 CEST	2121	50197	91.118.29.181	192.168.2.16
May 8, 2024 08:41:33.192070007 CEST	50358	21	192.168.2.16	109.136.157.146
May 8, 2024 08:41:33.193470001 CEST	21	50342	172.120.235.139	192.168.2.16
May 8, 2024 08:41:33.193540096 CEST	50342	21	192.168.2.16	172.120.235.139
May 8, 2024 08:41:33.204278946 CEST	21	50204	91.118.29.181	192.168.2.16
May 8, 2024 08:41:33.208363056 CEST	50359	2121	192.168.2.16	109.136.157.146
May 8, 2024 08:41:33.208380938 CEST	50360	21	192.168.2.16	27.18.69.179
May 8, 2024 08:41:33.212589025 CEST	21	50337	38.38.120.85	192.168.2.16
May 8, 2024 08:41:33.212768078 CEST	50337	21	192.168.2.16	38.38.120.85
May 8, 2024 08:41:33.223843098 CEST	50319	21	192.168.2.16	68.144.62.62
May 8, 2024 08:41:33.224025965 CEST	50316	2121	192.168.2.16	76.21.40.96
May 8, 2024 08:41:33.224828005 CEST	50361	2121	192.168.2.16	27.18.69.179
May 8, 2024 08:41:33.224999905 CEST	50362	21	192.168.2.16	59.92.247.174
May 8, 2024 08:41:33.225063086 CEST	50363	2121	192.168.2.16	59.92.247.174
May 8, 2024 08:41:33.225126982 CEST	50364	21	192.168.2.16	117.147.255.88
May 8, 2024 08:41:33.225142956 CEST	50365	21	192.168.2.16	66.57.225.25
May 8, 2024 08:41:33.225213051 CEST	50366	2121	192.168.2.16	117.147.255.88
May 8, 2024 08:41:33.240377903 CEST	50367	2121	192.168.2.16	66.57.225.25
May 8, 2024 08:41:33.240431070 CEST	50368	21	192.168.2.16	70.173.246.183
May 8, 2024 08:41:33.272305965 CEST	50369	2121	192.168.2.16	70.173.246.183
May 8, 2024 08:41:33.272344112 CEST	50370	21	192.168.2.16	104.83.35.248
May 8, 2024 08:41:33.303837061 CEST	50320	2121	192.168.2.16	68.144.62.62
May 8, 2024 08:41:33.305491924 CEST	21	50291	94.136.16.189	192.168.2.16
May 8, 2024 08:41:33.305542946 CEST	50214	2121	192.168.2.16	115.244.167.85
May 8, 2024 08:41:33.305890083 CEST	50371	2121	192.168.2.16	104.83.35.248
May 8, 2024 08:41:33.309473991 CEST	2121	50292	94.136.16.189	192.168.2.16
May 8, 2024 08:41:33.319823980 CEST	50321	21	192.168.2.16	69.139.73.181
May 8, 2024 08:41:33.319854021 CEST	50213	21	192.168.2.16	115.244.167.85
May 8, 2024 08:41:33.320400953 CEST	50372	21	192.168.2.16	73.68.146.88
May 8, 2024 08:41:33.320413113 CEST	50373	2121	192.168.2.16	73.68.146.88
May 8, 2024 08:41:33.320478916 CEST	50374	21	192.168.2.16	82.180.72.40
May 8, 2024 08:41:33.325687885 CEST	2121	50340	34.149.79.8	192.168.2.16
May 8, 2024 08:41:33.325793028 CEST	50340	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:33.325861931 CEST	50340	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:33.326133013 CEST	50375	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:33.334444046 CEST	21	50341	34.149.79.8	192.168.2.16
May 8, 2024 08:41:33.334518909 CEST	50341	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:33.334589005 CEST	50341	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:33.334780931 CEST	50376	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:33.335856915 CEST	50322	2121	192.168.2.16	69.139.73.181
May 8, 2024 08:41:33.341617107 CEST	2121	50318	58.121.190.195	192.168.2.16
May 8, 2024 08:41:33.363889933 CEST	21	50343	77.75.121.3	192.168.2.16
May 8, 2024 08:41:33.363986969 CEST	50343	21	192.168.2.16	77.75.121.3
May 8, 2024 08:41:33.366844893 CEST	50323	21	192.168.2.16	71.28.183.56
May 8, 2024 08:41:33.367263079 CEST	50377	2121	192.168.2.16	82.180.72.40
May 8, 2024 08:41:33.367332935 CEST	50378	21	192.168.2.16	126.1.45.71
May 8, 2024 08:41:33.381839991 CEST	50325	21	192.168.2.16	82.79.35.202
May 8, 2024 08:41:33.381856918 CEST	50324	2121	192.168.2.16	71.28.183.56
May 8, 2024 08:41:33.381858110 CEST	50326	2121	192.168.2.16	82.79.35.202
May 8, 2024 08:41:33.382276058 CEST	50379	2121	192.168.2.16	126.1.45.71
May 8, 2024 08:41:33.382432938 CEST	50380	2121	192.168.2.16	75.238.200.198
May 8, 2024 08:41:33.382443905 CEST	50381	21	192.168.2.16	75.238.200.198
May 8, 2024 08:41:33.388634920 CEST	21	50338	23.229.188.101	192.168.2.16
May 8, 2024 08:41:33.388809919 CEST	50338	21	192.168.2.16	23.229.188.101
May 8, 2024 08:41:33.398192883 CEST	21	50342	172.120.235.139	192.168.2.16
May 8, 2024 08:41:33.398312092 CEST	50342	21	192.168.2.16	172.120.235.139
May 8, 2024 08:41:33.406805038 CEST	21	50337	38.38.120.85	192.168.2.16
May 8, 2024 08:41:33.406817913 CEST	21	50337	38.38.120.85	192.168.2.16
May 8, 2024 08:41:33.406924963 CEST	50337	21	192.168.2.16	38.38.120.85
May 8, 2024 08:41:33.411837101 CEST	50327	21	192.168.2.16	125.247.204.97
May 8, 2024 08:41:33.417587996 CEST	2121	50316	76.21.40.96	192.168.2.16
May 8, 2024 08:41:33.427839994 CEST	50317	21	192.168.2.16	58.121.190.195
May 8, 2024 08:41:33.444396019 CEST	50382	21	192.168.2.16	219.68.211.98
May 8, 2024 08:41:33.459851027 CEST	50331	21	192.168.2.16	65.60.157.69
May 8, 2024 08:41:33.466351032 CEST	21	50293	105.97.141.224	192.168.2.16
May 8, 2024 08:41:33.466824055 CEST	50383	2121	192.168.2.16	219.68.211.98
May 8, 2024 08:41:33.475848913 CEST	50332	2121	192.168.2.16	65.60.157.69
May 8, 2024 08:41:33.478775024 CEST	21	50339	196.210.0.111	192.168.2.16
May 8, 2024 08:41:33.478852034 CEST	50339	21	192.168.2.16	196.210.0.111
May 8, 2024 08:41:33.490744114 CEST	2121	50340	34.149.79.8	192.168.2.16
May 8, 2024 08:41:33.490757942 CEST	2121	50375	34.149.79.8	192.168.2.16
May 8, 2024 08:41:33.490864992 CEST	50375	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:33.499371052 CEST	21	50341	34.149.79.8	192.168.2.16
May 8, 2024 08:41:33.499382973 CEST	21	50376	34.149.79.8	192.168.2.16
May 8, 2024 08:41:33.499459982 CEST	50376	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:33.506820917 CEST	50328	2121	192.168.2.16	125.247.204.97
May 8, 2024 08:41:33.511339903 CEST	2121	50349	197.8.254.242	192.168.2.16
May 8, 2024 08:41:33.511629105 CEST	21	50348	197.8.254.242	192.168.2.16
May 8, 2024 08:41:33.518877983 CEST	2121	50357	181.170.184.192	192.168.2.16
May 8, 2024 08:41:33.523235083 CEST	50384	21	192.168.2.16	218.228.65.115
May 8, 2024 08:41:33.523931026 CEST	2121	50294	105.97.141.224	192.168.2.16
May 8, 2024 08:41:33.527568102 CEST	21	50356	181.170.184.192	192.168.2.16
May 8, 2024 08:41:33.531358004 CEST	21	50272	103.120.132.17	192.168.2.16
May 8, 2024 08:41:33.531775951 CEST	50385	2121	192.168.2.16	218.228.65.115
May 8, 2024 08:41:33.539099932 CEST	50386	21	192.168.2.16	83.57.150.95
May 8, 2024 08:41:33.539516926 CEST	21	50303	175.205.92.244	192.168.2.16
May 8, 2024 08:41:33.540000916 CEST	2121	50304	175.205.92.244	192.168.2.16
May 8, 2024 08:41:33.550405025 CEST	2121	50271	103.120.132.17	192.168.2.16
May 8, 2024 08:41:33.550721884 CEST	50387	2121	192.168.2.16	83.57.150.95
May 8, 2024 08:41:33.570884943 CEST	50333	21	192.168.2.16	175.116.228.90
May 8, 2024 08:41:33.571011066 CEST	50315	21	192.168.2.16	76.21.40.96
May 8, 2024 08:41:33.580228090 CEST	21	50342	172.120.235.139	192.168.2.16
May 8, 2024 08:41:33.580781937 CEST	21	50342	172.120.235.139	192.168.2.16
May 8, 2024 08:41:33.581008911 CEST	50342	21	192.168.2.16	172.120.235.139
May 8, 2024 08:41:33.586849928 CEST	50334	2121	192.168.2.16	175.116.228.90
May 8, 2024 08:41:33.589639902 CEST	21	50338	23.229.188.101	192.168.2.16
May 8, 2024 08:41:33.589746952 CEST	21	50338	23.229.188.101	192.168.2.16
May 8, 2024 08:41:33.589989901 CEST	50338	21	192.168.2.16	23.229.188.101
May 8, 2024 08:41:33.602817059 CEST	50311	21	192.168.2.16	174.4.136.10
May 8, 2024 08:41:33.602829933 CEST	50330	2121	192.168.2.16	165.227.135.59
May 8, 2024 08:41:33.602840900 CEST	50329	21	192.168.2.16	165.227.135.59
May 8, 2024 08:41:33.638742924 CEST	21	50337	38.38.120.85	192.168.2.16
May 8, 2024 08:41:33.653026104 CEST	2121	50375	34.149.79.8	192.168.2.16
May 8, 2024 08:41:33.653093100 CEST	50375	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:33.653234005 CEST	50375	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:33.653580904 CEST	50388	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:33.661842108 CEST	21	50376	34.149.79.8	192.168.2.16
May 8, 2024 08:41:33.661933899 CEST	50376	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:33.662020922 CEST	50376	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:33.662241936 CEST	50389	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:33.663753986 CEST	2121	50363	59.92.247.174	192.168.2.16
May 8, 2024 08:41:33.666249990 CEST	21	50378	126.1.45.71	192.168.2.16
May 8, 2024 08:41:33.680620909 CEST	21	50343	77.75.121.3	192.168.2.16
May 8, 2024 08:41:33.680859089 CEST	50343	21	192.168.2.16	77.75.121.3
May 8, 2024 08:41:33.680984974 CEST	2121	50379	126.1.45.71	192.168.2.16
May 8, 2024 08:41:33.706466913 CEST	21	50331	65.60.157.69	192.168.2.16
May 8, 2024 08:41:33.713753939 CEST	21	50317	58.121.190.195	192.168.2.16
May 8, 2024 08:41:33.722543001 CEST	2121	50332	65.60.157.69	192.168.2.16
May 8, 2024 08:41:33.736112118 CEST	2121	50214	115.244.167.85	192.168.2.16
May 8, 2024 08:41:33.736623049 CEST	50390	21	192.168.2.16	76.89.108.36
May 8, 2024 08:41:33.750000954 CEST	50391	21	192.168.2.16	189.70.118.127
May 8, 2024 08:41:33.750035048 CEST	50392	2121	192.168.2.16	76.89.108.36
May 8, 2024 08:41:33.757550955 CEST	21	50213	115.244.167.85	192.168.2.16
May 8, 2024 08:41:33.762018919 CEST	21	50315	76.21.40.96	192.168.2.16
May 8, 2024 08:41:33.778361082 CEST	50393	2121	192.168.2.16	189.70.118.127
May 8, 2024 08:41:33.792186975 CEST	21	50342	172.120.235.139	192.168.2.16
May 8, 2024 08:41:33.792357922 CEST	50342	21	192.168.2.16	172.120.235.139
May 8, 2024 08:41:33.792593002 CEST	50394	21	192.168.2.16	172.120.235.139
May 8, 2024 08:41:33.792839050 CEST	50335	21	192.168.2.16	58.37.12.209
May 8, 2024 08:41:33.817603111 CEST	2121	50375	34.149.79.8	192.168.2.16
May 8, 2024 08:41:33.817929983 CEST	2121	50388	34.149.79.8	192.168.2.16
May 8, 2024 08:41:33.818012953 CEST	50388	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:33.827162981 CEST	21	50376	34.149.79.8	192.168.2.16
May 8, 2024 08:41:33.827241898 CEST	21	50389	34.149.79.8	192.168.2.16
May 8, 2024 08:41:33.827315092 CEST	50389	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:33.834069014 CEST	21	50338	23.229.188.101	192.168.2.16
May 8, 2024 08:41:33.840857029 CEST	50336	2121	192.168.2.16	58.37.12.209
May 8, 2024 08:41:33.856843948 CEST	50318	2121	192.168.2.16	58.121.190.195
May 8, 2024 08:41:33.857716084 CEST	21	50333	175.116.228.90	192.168.2.16
May 8, 2024 08:41:33.888544083 CEST	2121	50334	175.116.228.90	192.168.2.16
May 8, 2024 08:41:33.920886040 CEST	50316	2121	192.168.2.16	76.21.40.96
May 8, 2024 08:41:33.974116087 CEST	21	50342	172.120.235.139	192.168.2.16
May 8, 2024 08:41:33.974183083 CEST	50342	21	192.168.2.16	172.120.235.139
May 8, 2024 08:41:33.974251986 CEST	21	50394	172.120.235.139	192.168.2.16
May 8, 2024 08:41:33.974320889 CEST	50394	21	192.168.2.16	172.120.235.139
May 8, 2024 08:41:33.976119041 CEST	21	50339	196.210.0.111	192.168.2.16
May 8, 2024 08:41:33.976281881 CEST	50339	21	192.168.2.16	196.210.0.111
May 8, 2024 08:41:33.980454922 CEST	2121	50388	34.149.79.8	192.168.2.16
May 8, 2024 08:41:33.980509996 CEST	50388	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:33.980623960 CEST	50388	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:33.980988026 CEST	50395	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:33.989891052 CEST	21	50389	34.149.79.8	192.168.2.16
May 8, 2024 08:41:33.989967108 CEST	50389	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:33.990047932 CEST	50389	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:33.990262032 CEST	50396	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:33.997720957 CEST	21	50343	77.75.121.3	192.168.2.16
May 8, 2024 08:41:33.997795105 CEST	21	50343	77.75.121.3	192.168.2.16
May 8, 2024 08:41:33.997944117 CEST	50343	21	192.168.2.16	77.75.121.3
May 8, 2024 08:41:34.017926931 CEST	50349	2121	192.168.2.16	197.8.254.242
May 8, 2024 08:41:34.018018007 CEST	50348	21	192.168.2.16	197.8.254.242
May 8, 2024 08:41:34.018464088 CEST	50397	21	192.168.2.16	168.81.231.66
May 8, 2024 08:41:34.031821966 CEST	50357	2121	192.168.2.16	181.170.184.192
May 8, 2024 08:41:34.031852961 CEST	50356	21	192.168.2.16	181.170.184.192
May 8, 2024 08:41:34.047861099 CEST	50303	21	192.168.2.16	175.205.92.244
May 8, 2024 08:41:34.047864914 CEST	50304	2121	192.168.2.16	175.205.92.244
May 8, 2024 08:41:34.064049959 CEST	50344	21	192.168.2.16	68.144.255.196
May 8, 2024 08:41:34.079833031 CEST	50345	2121	192.168.2.16	68.144.255.196
May 8, 2024 08:41:34.080389977 CEST	50312	2121	192.168.2.16	174.4.136.10
May 8, 2024 08:41:34.080399990 CEST	50346	21	192.168.2.16	219.249.223.42
May 8, 2024 08:41:34.095848083 CEST	50347	2121	192.168.2.16	219.249.223.42
May 8, 2024 08:41:34.109554052 CEST	2121	50316	76.21.40.96	192.168.2.16
May 8, 2024 08:41:34.111845970 CEST	50313	21	192.168.2.16	123.144.241.64
May 8, 2024 08:41:34.127904892 CEST	50352	21	192.168.2.16	23.1.29.50
May 8, 2024 08:41:34.127904892 CEST	50351	2121	192.168.2.16	174.79.38.52
May 8, 2024 08:41:34.128001928 CEST	50350	21	192.168.2.16	174.79.38.52
May 8, 2024 08:41:34.143871069 CEST	50353	2121	192.168.2.16	23.1.29.50
May 8, 2024 08:41:34.143999100 CEST	50354	21	192.168.2.16	141.156.239.196
May 8, 2024 08:41:34.145622015 CEST	2121	50388	34.149.79.8	192.168.2.16
May 8, 2024 08:41:34.146133900 CEST	2121	50395	34.149.79.8	192.168.2.16
May 8, 2024 08:41:34.146218061 CEST	50395	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:34.154505968 CEST	21	50389	34.149.79.8	192.168.2.16
May 8, 2024 08:41:34.154570103 CEST	21	50396	34.149.79.8	192.168.2.16
May 8, 2024 08:41:34.154640913 CEST	50396	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:34.165994883 CEST	2121	50318	58.121.190.195	192.168.2.16
May 8, 2024 08:41:34.175823927 CEST	50363	2121	192.168.2.16	59.92.247.174
May 8, 2024 08:41:34.176350117 CEST	50398	2121	192.168.2.16	168.81.231.66
May 8, 2024 08:41:34.176350117 CEST	50378	21	192.168.2.16	126.1.45.71
May 8, 2024 08:41:34.190840960 CEST	50355	2121	192.168.2.16	141.156.239.196
May 8, 2024 08:41:34.190841913 CEST	50379	2121	192.168.2.16	126.1.45.71
May 8, 2024 08:41:34.191224098 CEST	50399	21	192.168.2.16	47.236.184.40
May 8, 2024 08:41:34.196962118 CEST	21	50394	172.120.235.139	192.168.2.16
May 8, 2024 08:41:34.197074890 CEST	50394	21	192.168.2.16	172.120.235.139
May 8, 2024 08:41:34.206821918 CEST	50358	21	192.168.2.16	109.136.157.146
May 8, 2024 08:41:34.209991932 CEST	50331	21	192.168.2.16	65.60.157.69
May 8, 2024 08:41:34.222846031 CEST	50360	21	192.168.2.16	27.18.69.179
May 8, 2024 08:41:34.222862005 CEST	50317	21	192.168.2.16	58.121.190.195
May 8, 2024 08:41:34.222863913 CEST	50359	2121	192.168.2.16	109.136.157.146
May 8, 2024 08:41:34.223684072 CEST	50332	2121	192.168.2.16	65.60.157.69
May 8, 2024 08:41:34.238831043 CEST	50362	21	192.168.2.16	59.92.247.174
May 8, 2024 08:41:34.238833904 CEST	50366	2121	192.168.2.16	117.147.255.88
May 8, 2024 08:41:34.238833904 CEST	50365	21	192.168.2.16	66.57.225.25
May 8, 2024 08:41:34.238998890 CEST	50364	21	192.168.2.16	117.147.255.88
May 8, 2024 08:41:34.239000082 CEST	50361	2121	192.168.2.16	27.18.69.179
May 8, 2024 08:41:34.254820108 CEST	50367	2121	192.168.2.16	66.57.225.25
May 8, 2024 08:41:34.254837990 CEST	50368	21	192.168.2.16	70.173.246.183
May 8, 2024 08:41:34.270850897 CEST	50315	21	192.168.2.16	76.21.40.96
May 8, 2024 08:41:34.286849976 CEST	50369	2121	192.168.2.16	70.173.246.183
May 8, 2024 08:41:34.289999962 CEST	50370	21	192.168.2.16	104.83.35.248
May 8, 2024 08:41:34.308648109 CEST	2121	50395	34.149.79.8	192.168.2.16
May 8, 2024 08:41:34.308717966 CEST	50395	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:34.308866024 CEST	50395	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:34.309189081 CEST	50400	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:34.317133904 CEST	21	50396	34.149.79.8	192.168.2.16
May 8, 2024 08:41:34.317207098 CEST	50396	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:34.317311049 CEST	50396	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:34.317539930 CEST	50401	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:34.318892002 CEST	50371	2121	192.168.2.16	104.83.35.248
May 8, 2024 08:41:34.319276094 CEST	50373	2121	192.168.2.16	73.68.146.88
May 8, 2024 08:41:34.334852934 CEST	50372	21	192.168.2.16	73.68.146.88
May 8, 2024 08:41:34.334855080 CEST	50374	21	192.168.2.16	82.180.72.40
May 8, 2024 08:41:34.350845098 CEST	50314	2121	192.168.2.16	123.144.241.64
May 8, 2024 08:41:34.355204105 CEST	21	50343	77.75.121.3	192.168.2.16
May 8, 2024 08:41:34.359812975 CEST	21	50397	168.81.231.66	192.168.2.16
May 8, 2024 08:41:34.366841078 CEST	50333	21	192.168.2.16	175.116.228.90
May 8, 2024 08:41:34.367559910 CEST	50377	2121	192.168.2.16	82.180.72.40
May 8, 2024 08:41:34.372833967 CEST	2121	50357	181.170.184.192	192.168.2.16
May 8, 2024 08:41:34.377691031 CEST	21	50356	181.170.184.192	192.168.2.16
May 8, 2024 08:41:34.378746986 CEST	21	50394	172.120.235.139	192.168.2.16
May 8, 2024 08:41:34.379025936 CEST	21	50394	172.120.235.139	192.168.2.16
May 8, 2024 08:41:34.379223108 CEST	50394	21	192.168.2.16	172.120.235.139
May 8, 2024 08:41:34.381855011 CEST	50381	21	192.168.2.16	75.238.200.198
May 8, 2024 08:41:34.388809919 CEST	50334	2121	192.168.2.16	175.116.228.90
May 8, 2024 08:41:34.396884918 CEST	50380	2121	192.168.2.16	75.238.200.198
May 8, 2024 08:41:34.430993080 CEST	2121	50349	197.8.254.242	192.168.2.16
May 8, 2024 08:41:34.431163073 CEST	21	50348	197.8.254.242	192.168.2.16
May 8, 2024 08:41:34.444858074 CEST	50382	21	192.168.2.16	219.68.211.98
May 8, 2024 08:41:34.456744909 CEST	21	50339	196.210.0.111	192.168.2.16
May 8, 2024 08:41:34.458487988 CEST	21	50331	65.60.157.69	192.168.2.16
May 8, 2024 08:41:34.459805965 CEST	21	50339	196.210.0.111	192.168.2.16
May 8, 2024 08:41:34.459970951 CEST	50339	21	192.168.2.16	196.210.0.111
May 8, 2024 08:41:34.461918116 CEST	21	50315	76.21.40.96	192.168.2.16
May 8, 2024 08:41:34.462409019 CEST	50402	2121	192.168.2.16	47.236.184.40
May 8, 2024 08:41:34.470840931 CEST	2121	50332	65.60.157.69	192.168.2.16
May 8, 2024 08:41:34.471203089 CEST	2121	50395	34.149.79.8	192.168.2.16
May 8, 2024 08:41:34.471586943 CEST	2121	50400	34.149.79.8	192.168.2.16
May 8, 2024 08:41:34.471666098 CEST	50400	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:34.476862907 CEST	50383	2121	192.168.2.16	219.68.211.98
May 8, 2024 08:41:34.478642941 CEST	21	50378	126.1.45.71	192.168.2.16
May 8, 2024 08:41:34.481833935 CEST	21	50396	34.149.79.8	192.168.2.16
May 8, 2024 08:41:34.481966019 CEST	21	50401	34.149.79.8	192.168.2.16
May 8, 2024 08:41:34.482054949 CEST	50401	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:34.491447926 CEST	2121	50379	126.1.45.71	192.168.2.16
May 8, 2024 08:41:34.508810043 CEST	21	50317	58.121.190.195	192.168.2.16
May 8, 2024 08:41:34.510557890 CEST	50403	21	192.168.2.16	104.121.16.7
May 8, 2024 08:41:34.510585070 CEST	50404	21	192.168.2.16	220.71.176.141
May 8, 2024 08:41:34.510654926 CEST	50405	2121	192.168.2.16	220.71.176.141
May 8, 2024 08:41:34.510694981 CEST	50406	2121	192.168.2.16	104.121.16.7
May 8, 2024 08:41:34.510773897 CEST	50407	21	192.168.2.16	112.147.13.3
May 8, 2024 08:41:34.510875940 CEST	50408	2121	192.168.2.16	115.11.79.59
May 8, 2024 08:41:34.510886908 CEST	50409	2121	192.168.2.16	112.147.13.3
May 8, 2024 08:41:34.510915041 CEST	50410	21	192.168.2.16	79.147.28.191
May 8, 2024 08:41:34.511018038 CEST	50411	21	192.168.2.16	115.11.79.59
May 8, 2024 08:41:34.511176109 CEST	50412	2121	192.168.2.16	79.147.28.191
May 8, 2024 08:41:34.511195898 CEST	50413	21	192.168.2.16	178.192.70.16
May 8, 2024 08:41:34.511259079 CEST	50414	2121	192.168.2.16	178.192.70.16
May 8, 2024 08:41:34.511375904 CEST	50415	21	192.168.2.16	108.21.188.121
May 8, 2024 08:41:34.511452913 CEST	50416	2121	192.168.2.16	108.21.188.121
May 8, 2024 08:41:34.511501074 CEST	50417	21	192.168.2.16	60.122.110.91
May 8, 2024 08:41:34.511596918 CEST	50418	21	192.168.2.16	84.26.50.147
May 8, 2024 08:41:34.511636019 CEST	50419	2121	192.168.2.16	84.26.50.147
May 8, 2024 08:41:34.511662006 CEST	50420	21	192.168.2.16	27.7.8.56
May 8, 2024 08:41:34.511724949 CEST	50421	2121	192.168.2.16	60.122.110.91
May 8, 2024 08:41:34.516429901 CEST	2121	50398	168.81.231.66	192.168.2.16
May 8, 2024 08:41:34.524926901 CEST	50384	21	192.168.2.16	218.228.65.115
May 8, 2024 08:41:34.526032925 CEST	50422	2121	192.168.2.16	27.7.8.56
May 8, 2024 08:41:34.526106119 CEST	50423	2121	192.168.2.16	39.65.232.109
May 8, 2024 08:41:34.526237965 CEST	50424	21	192.168.2.16	46.89.57.220
May 8, 2024 08:41:34.526330948 CEST	50425	2121	192.168.2.16	192.173.15.13
May 8, 2024 08:41:34.526345015 CEST	50426	21	192.168.2.16	192.173.15.13
May 8, 2024 08:41:34.526392937 CEST	50427	2121	192.168.2.16	46.89.57.220
May 8, 2024 08:41:34.526453018 CEST	50428	21	192.168.2.16	71.192.97.248
May 8, 2024 08:41:34.526541948 CEST	50429	2121	192.168.2.16	71.192.97.248
May 8, 2024 08:41:34.526642084 CEST	50430	21	192.168.2.16	14.61.202.134
May 8, 2024 08:41:34.526732922 CEST	50432	21	192.168.2.16	24.86.223.52
May 8, 2024 08:41:34.526813030 CEST	50434	21	192.168.2.16	115.1.152.253
May 8, 2024 08:41:34.526815891 CEST	50431	2121	192.168.2.16	14.61.202.134
May 8, 2024 08:41:34.526870966 CEST	50433	2121	192.168.2.16	24.86.223.52
May 8, 2024 08:41:34.526967049 CEST	50435	21	192.168.2.16	39.65.232.109
May 8, 2024 08:41:34.540849924 CEST	50385	2121	192.168.2.16	218.228.65.115
May 8, 2024 08:41:34.540904999 CEST	50386	21	192.168.2.16	83.57.150.95
May 8, 2024 08:41:34.542409897 CEST	50436	2121	192.168.2.16	115.1.152.253
May 8, 2024 08:41:34.542464972 CEST	50437	21	192.168.2.16	151.224.102.22
May 8, 2024 08:41:34.542514086 CEST	50438	2121	192.168.2.16	151.224.102.22
May 8, 2024 08:41:34.542541027 CEST	50439	21	192.168.2.16	110.49.63.132
May 8, 2024 08:41:34.542603016 CEST	50440	2121	192.168.2.16	110.49.63.132
May 8, 2024 08:41:34.542686939 CEST	50441	21	192.168.2.16	93.224.25.244
May 8, 2024 08:41:34.542727947 CEST	50442	2121	192.168.2.16	93.224.25.244
May 8, 2024 08:41:34.542772055 CEST	50443	21	192.168.2.16	67.162.131.234
May 8, 2024 08:41:34.542867899 CEST	50444	2121	192.168.2.16	67.162.131.234
May 8, 2024 08:41:34.542962074 CEST	50446	2121	192.168.2.16	110.246.88.180
May 8, 2024 08:41:34.543052912 CEST	50447	21	192.168.2.16	175.241.55.242
May 8, 2024 08:41:34.543118954 CEST	50448	21	192.168.2.16	174.27.167.255
May 8, 2024 08:41:34.543195963 CEST	50445	21	192.168.2.16	110.246.88.180
May 8, 2024 08:41:34.543231010 CEST	50449	21	192.168.2.16	23.27.21.247
May 8, 2024 08:41:34.543262959 CEST	50450	2121	192.168.2.16	174.27.167.255
May 8, 2024 08:41:34.543262959 CEST	50451	2121	192.168.2.16	23.27.21.247
May 8, 2024 08:41:34.543375015 CEST	50452	2121	192.168.2.16	175.241.55.242
May 8, 2024 08:41:34.556854010 CEST	50387	2121	192.168.2.16	83.57.150.95
May 8, 2024 08:41:34.558913946 CEST	50453	21	192.168.2.16	73.25.54.119
May 8, 2024 08:41:34.559448957 CEST	50454	2121	192.168.2.16	73.25.54.119
May 8, 2024 08:41:34.559612989 CEST	50455	21	192.168.2.16	60.53.210.99
May 8, 2024 08:41:34.559715986 CEST	50456	2121	192.168.2.16	60.53.210.99
May 8, 2024 08:41:34.559716940 CEST	50457	21	192.168.2.16	218.56.222.188
May 8, 2024 08:41:34.559770107 CEST	50458	2121	192.168.2.16	218.56.222.188
May 8, 2024 08:41:34.559792995 CEST	50459	21	192.168.2.16	125.120.130.52
May 8, 2024 08:41:34.559973001 CEST	50461	21	192.168.2.16	86.30.180.122
May 8, 2024 08:41:34.559973001 CEST	50460	2121	192.168.2.16	125.120.130.52
May 8, 2024 08:41:34.559989929 CEST	50462	2121	192.168.2.16	86.30.180.122
May 8, 2024 08:41:34.560117960 CEST	50463	21	192.168.2.16	27.117.127.209
May 8, 2024 08:41:34.560249090 CEST	50464	2121	192.168.2.16	27.117.127.209
May 8, 2024 08:41:34.560266018 CEST	50465	21	192.168.2.16	24.131.164.226
May 8, 2024 08:41:34.560378075 CEST	50466	21	192.168.2.16	134.238.198.128
May 8, 2024 08:41:34.560420036 CEST	50467	21	192.168.2.16	122.173.239.62
May 8, 2024 08:41:34.560503960 CEST	50468	2121	192.168.2.16	134.238.198.128
May 8, 2024 08:41:34.560554981 CEST	50469	2121	192.168.2.16	122.173.239.62
May 8, 2024 08:41:34.560667038 CEST	50470	2121	192.168.2.16	126.237.161.134
May 8, 2024 08:41:34.560667992 CEST	50471	21	192.168.2.16	188.83.164.192
May 8, 2024 08:41:34.560765982 CEST	50473	21	192.168.2.16	36.26.159.46
May 8, 2024 08:41:34.560906887 CEST	50472	2121	192.168.2.16	188.83.164.192
May 8, 2024 08:41:34.560908079 CEST	50474	2121	192.168.2.16	24.131.164.226
May 8, 2024 08:41:34.560929060 CEST	50475	2121	192.168.2.16	36.26.159.46
May 8, 2024 08:41:34.561047077 CEST	50477	21	192.168.2.16	126.237.161.134
May 8, 2024 08:41:34.561064005 CEST	50476	21	192.168.2.16	78.101.135.91
May 8, 2024 08:41:34.562463999 CEST	21	50303	175.205.92.244	192.168.2.16
May 8, 2024 08:41:34.562942982 CEST	2121	50304	175.205.92.244	192.168.2.16
May 8, 2024 08:41:34.574637890 CEST	50478	2121	192.168.2.16	78.101.135.91
May 8, 2024 08:41:34.574786901 CEST	50479	21	192.168.2.16	183.99.74.58
May 8, 2024 08:41:34.574841976 CEST	50480	2121	192.168.2.16	183.99.74.58
May 8, 2024 08:41:34.574861050 CEST	50481	21	192.168.2.16	119.185.119.239
May 8, 2024 08:41:34.574956894 CEST	50482	2121	192.168.2.16	119.185.119.239
May 8, 2024 08:41:34.575048923 CEST	50483	21	192.168.2.16	184.68.210.101
May 8, 2024 08:41:34.575110912 CEST	50484	2121	192.168.2.16	184.68.210.101
May 8, 2024 08:41:34.575171947 CEST	50485	21	192.168.2.16	217.238.127.243
May 8, 2024 08:41:34.575190067 CEST	50486	2121	192.168.2.16	217.238.127.243
May 8, 2024 08:41:34.575238943 CEST	50487	21	192.168.2.16	69.255.145.154
May 8, 2024 08:41:34.575361967 CEST	50488	21	192.168.2.16	210.131.155.110
May 8, 2024 08:41:34.575417042 CEST	50489	2121	192.168.2.16	69.255.145.154
May 8, 2024 08:41:34.575479984 CEST	50490	2121	192.168.2.16	210.131.155.110
May 8, 2024 08:41:34.575566053 CEST	50491	21	192.168.2.16	113.24.67.53
May 8, 2024 08:41:34.575649977 CEST	50492	2121	192.168.2.16	113.24.67.53
May 8, 2024 08:41:34.575726032 CEST	50493	21	192.168.2.16	60.151.63.142
May 8, 2024 08:41:34.575822115 CEST	50494	2121	192.168.2.16	60.151.63.142
May 8, 2024 08:41:34.575825930 CEST	50495	21	192.168.2.16	189.106.23.71
May 8, 2024 08:41:34.575877905 CEST	50496	2121	192.168.2.16	189.106.23.71
May 8, 2024 08:41:34.575917006 CEST	50497	21	192.168.2.16	121.190.67.79
May 8, 2024 08:41:34.575994968 CEST	50498	2121	192.168.2.16	121.190.67.79
May 8, 2024 08:41:34.576065063 CEST	50499	21	192.168.2.16	81.154.91.122
May 8, 2024 08:41:34.576066017 CEST	50500	2121	192.168.2.16	81.154.91.122
May 8, 2024 08:41:34.588573933 CEST	50501	2121	192.168.2.16	68.2.237.24
May 8, 2024 08:41:34.588643074 CEST	50502	21	192.168.2.16	68.2.237.24
May 8, 2024 08:41:34.588673115 CEST	50503	21	192.168.2.16	181.208.58.40
May 8, 2024 08:41:34.588736057 CEST	50504	2121	192.168.2.16	181.208.58.40
May 8, 2024 08:41:34.588783979 CEST	50505	21	192.168.2.16	47.196.20.197
May 8, 2024 08:41:34.588879108 CEST	50506	2121	192.168.2.16	47.196.20.197
May 8, 2024 08:41:34.588923931 CEST	50507	21	192.168.2.16	118.46.121.98
May 8, 2024 08:41:34.588927031 CEST	50508	2121	192.168.2.16	118.46.121.98
May 8, 2024 08:41:34.589489937 CEST	21	50394	172.120.235.139	192.168.2.16
May 8, 2024 08:41:34.589617014 CEST	50394	21	192.168.2.16	172.120.235.139
May 8, 2024 08:41:34.589759111 CEST	50509	21	192.168.2.16	172.120.235.139
May 8, 2024 08:41:34.604458094 CEST	50510	21	192.168.2.16	20.172.220.30
May 8, 2024 08:41:34.604525089 CEST	50511	21	192.168.2.16	104.17.88.189
May 8, 2024 08:41:34.604564905 CEST	50512	2121	192.168.2.16	20.172.220.30
May 8, 2024 08:41:34.604567051 CEST	50513	2121	192.168.2.16	104.17.88.189
May 8, 2024 08:41:34.604669094 CEST	50514	21	192.168.2.16	154.81.34.141
May 8, 2024 08:41:34.604696035 CEST	50515	2121	192.168.2.16	154.81.34.141
May 8, 2024 08:41:34.614141941 CEST	2121	50363	59.92.247.174	192.168.2.16
May 8, 2024 08:41:34.618846893 CEST	50316	2121	192.168.2.16	76.21.40.96
May 8, 2024 08:41:34.634180069 CEST	2121	50400	34.149.79.8	192.168.2.16
May 8, 2024 08:41:34.634243011 CEST	50400	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:34.634376049 CEST	50400	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:34.634670019 CEST	50516	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:34.644833088 CEST	21	50401	34.149.79.8	192.168.2.16
May 8, 2024 08:41:34.644901037 CEST	50401	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:34.644957066 CEST	50401	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:34.645134926 CEST	50517	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:34.649693966 CEST	21	50333	175.116.228.90	192.168.2.16
May 8, 2024 08:41:34.666852951 CEST	50318	2121	192.168.2.16	58.121.190.195
May 8, 2024 08:41:34.688425064 CEST	2121	50334	175.116.228.90	192.168.2.16
May 8, 2024 08:41:34.745848894 CEST	50390	21	192.168.2.16	76.89.108.36
May 8, 2024 08:41:34.761859894 CEST	50391	21	192.168.2.16	189.70.118.127
May 8, 2024 08:41:34.761883974 CEST	50392	2121	192.168.2.16	76.89.108.36
May 8, 2024 08:41:34.773117065 CEST	21	50509	172.120.235.139	192.168.2.16
May 8, 2024 08:41:34.773175001 CEST	21	50394	172.120.235.139	192.168.2.16
May 8, 2024 08:41:34.773195028 CEST	50509	21	192.168.2.16	172.120.235.139
May 8, 2024 08:41:34.773228884 CEST	50394	21	192.168.2.16	172.120.235.139
May 8, 2024 08:41:34.777856112 CEST	50393	2121	192.168.2.16	189.70.118.127
May 8, 2024 08:41:34.796679020 CEST	2121	50400	34.149.79.8	192.168.2.16
May 8, 2024 08:41:34.799377918 CEST	2121	50516	34.149.79.8	192.168.2.16
May 8, 2024 08:41:34.799449921 CEST	50516	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:34.801830053 CEST	21	50514	154.81.34.141	192.168.2.16
May 8, 2024 08:41:34.807806969 CEST	21	50517	34.149.79.8	192.168.2.16
May 8, 2024 08:41:34.807884932 CEST	50517	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:34.808881044 CEST	2121	50316	76.21.40.96	192.168.2.16
May 8, 2024 08:41:34.814409018 CEST	21	50417	60.122.110.91	192.168.2.16
May 8, 2024 08:41:34.814876080 CEST	2121	50421	60.122.110.91	192.168.2.16
May 8, 2024 08:41:34.825181007 CEST	50518	21	192.168.2.16	60.137.5.118
May 8, 2024 08:41:34.830208063 CEST	21	50411	115.11.79.59	192.168.2.16
May 8, 2024 08:41:34.836308002 CEST	2121	50408	115.11.79.59	192.168.2.16
May 8, 2024 08:41:34.843523979 CEST	21	50434	115.1.152.253	192.168.2.16
May 8, 2024 08:41:34.847007990 CEST	21	50430	14.61.202.134	192.168.2.16
May 8, 2024 08:41:34.847362995 CEST	2121	50431	14.61.202.134	192.168.2.16
May 8, 2024 08:41:34.856184006 CEST	2121	50451	23.27.21.247	192.168.2.16
May 8, 2024 08:41:34.857562065 CEST	21	50463	27.117.127.209	192.168.2.16
May 8, 2024 08:41:34.857590914 CEST	50519	2121	192.168.2.16	60.137.5.118
May 8, 2024 08:41:34.857592106 CEST	50520	21	192.168.2.16	116.33.122.235
May 8, 2024 08:41:34.859791994 CEST	21	50449	23.27.21.247	192.168.2.16
May 8, 2024 08:41:34.860873938 CEST	2121	50464	27.117.127.209	192.168.2.16
May 8, 2024 08:41:34.861040115 CEST	2121	50436	115.1.152.253	192.168.2.16
May 8, 2024 08:41:34.865066051 CEST	2121	50452	175.241.55.242	192.168.2.16
May 8, 2024 08:41:34.865436077 CEST	2121	50470	126.237.161.134	192.168.2.16
May 8, 2024 08:41:34.866066933 CEST	21	50477	126.237.161.134	192.168.2.16
May 8, 2024 08:41:34.869271994 CEST	21	50447	175.241.55.242	192.168.2.16
May 8, 2024 08:41:34.872847080 CEST	50397	21	192.168.2.16	168.81.231.66
May 8, 2024 08:41:34.877468109 CEST	21	50493	60.151.63.142	192.168.2.16
May 8, 2024 08:41:34.879762888 CEST	2121	50494	60.151.63.142	192.168.2.16
May 8, 2024 08:41:34.883517981 CEST	2121	50475	36.26.159.46	192.168.2.16
May 8, 2024 08:41:34.888827085 CEST	50357	2121	192.168.2.16	181.170.184.192
May 8, 2024 08:41:34.888844967 CEST	50356	21	192.168.2.16	181.170.184.192
May 8, 2024 08:41:34.889005899 CEST	21	50497	121.190.67.79	192.168.2.16
May 8, 2024 08:41:34.893397093 CEST	2121	50498	121.190.67.79	192.168.2.16
May 8, 2024 08:41:34.898650885 CEST	21	50507	118.46.121.98	192.168.2.16
May 8, 2024 08:41:34.899729013 CEST	21	50473	36.26.159.46	192.168.2.16
May 8, 2024 08:41:34.902657032 CEST	2121	50508	118.46.121.98	192.168.2.16
May 8, 2024 08:41:34.905406952 CEST	50521	21	192.168.2.16	220.95.156.86
May 8, 2024 08:41:34.905466080 CEST	50522	2121	192.168.2.16	116.33.122.235
May 8, 2024 08:41:34.918767929 CEST	21	50491	113.24.67.53	192.168.2.16
May 8, 2024 08:41:34.922102928 CEST	2121	50492	113.24.67.53	192.168.2.16
May 8, 2024 08:41:34.925309896 CEST	2121	50422	27.7.8.56	192.168.2.16
May 8, 2024 08:41:34.928391933 CEST	21	50488	210.131.155.110	192.168.2.16
May 8, 2024 08:41:34.936837912 CEST	50348	21	192.168.2.16	197.8.254.242
May 8, 2024 08:41:34.937990904 CEST	50349	2121	192.168.2.16	197.8.254.242
May 8, 2024 08:41:34.961947918 CEST	2121	50516	34.149.79.8	192.168.2.16
May 8, 2024 08:41:34.962017059 CEST	50516	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:34.962148905 CEST	50516	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:34.962498903 CEST	50523	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:34.967829943 CEST	50331	21	192.168.2.16	65.60.157.69
May 8, 2024 08:41:34.970307112 CEST	21	50517	34.149.79.8	192.168.2.16
May 8, 2024 08:41:34.970380068 CEST	50517	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:34.970498085 CEST	50517	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:34.970732927 CEST	50524	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:34.972692013 CEST	21	50339	196.210.0.111	192.168.2.16
May 8, 2024 08:41:34.976028919 CEST	2121	50318	58.121.190.195	192.168.2.16
May 8, 2024 08:41:34.982860088 CEST	50378	21	192.168.2.16	126.1.45.71
May 8, 2024 08:41:34.982877016 CEST	50332	2121	192.168.2.16	65.60.157.69
May 8, 2024 08:41:34.983191967 CEST	50525	2121	192.168.2.16	220.95.156.86
May 8, 2024 08:41:34.989120007 CEST	2121	50440	110.49.63.132	192.168.2.16
May 8, 2024 08:41:34.993592978 CEST	21	50509	172.120.235.139	192.168.2.16
May 8, 2024 08:41:34.993773937 CEST	50509	21	192.168.2.16	172.120.235.139
May 8, 2024 08:41:34.997852087 CEST	50379	2121	192.168.2.16	126.1.45.71
May 8, 2024 08:41:35.012849092 CEST	50317	21	192.168.2.16	58.121.190.195
May 8, 2024 08:41:35.027836084 CEST	50398	2121	192.168.2.16	168.81.231.66
May 8, 2024 08:41:35.123866081 CEST	50363	2121	192.168.2.16	59.92.247.174
May 8, 2024 08:41:35.124774933 CEST	2121	50516	34.149.79.8	192.168.2.16
May 8, 2024 08:41:35.125066996 CEST	2121	50523	34.149.79.8	192.168.2.16
May 8, 2024 08:41:35.125134945 CEST	50523	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:35.133065939 CEST	21	50517	34.149.79.8	192.168.2.16
May 8, 2024 08:41:35.133218050 CEST	21	50524	34.149.79.8	192.168.2.16
May 8, 2024 08:41:35.133287907 CEST	50524	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:35.135368109 CEST	21	50518	60.137.5.118	192.168.2.16
May 8, 2024 08:41:35.139811993 CEST	50401	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:35.155854940 CEST	50333	21	192.168.2.16	175.116.228.90
May 8, 2024 08:41:35.168948889 CEST	2121	50519	60.137.5.118	192.168.2.16
May 8, 2024 08:41:35.172290087 CEST	50526	21	192.168.2.16	85.167.167.80
May 8, 2024 08:41:35.175460100 CEST	21	50509	172.120.235.139	192.168.2.16
May 8, 2024 08:41:35.175915003 CEST	21	50509	172.120.235.139	192.168.2.16
May 8, 2024 08:41:35.176033020 CEST	50509	21	192.168.2.16	172.120.235.139
May 8, 2024 08:41:35.203861952 CEST	50334	2121	192.168.2.16	175.116.228.90
May 8, 2024 08:41:35.204010963 CEST	50399	21	192.168.2.16	47.236.184.40
May 8, 2024 08:41:35.214246035 CEST	21	50397	168.81.231.66	192.168.2.16
May 8, 2024 08:41:35.214258909 CEST	21	50331	65.60.157.69	192.168.2.16
May 8, 2024 08:41:35.216346025 CEST	21	50521	220.95.156.86	192.168.2.16
May 8, 2024 08:41:35.228585005 CEST	2121	50357	181.170.184.192	192.168.2.16
May 8, 2024 08:41:35.229126930 CEST	2121	50332	65.60.157.69	192.168.2.16
May 8, 2024 08:41:35.236515999 CEST	50319	21	192.168.2.16	68.144.62.62
May 8, 2024 08:41:35.237479925 CEST	21	50356	181.170.184.192	192.168.2.16
May 8, 2024 08:41:35.282008886 CEST	21	50378	126.1.45.71	192.168.2.16
May 8, 2024 08:41:35.287554979 CEST	2121	50523	34.149.79.8	192.168.2.16
May 8, 2024 08:41:35.287656069 CEST	50523	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:35.288978100 CEST	50523	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:35.290527105 CEST	50527	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:35.295720100 CEST	21	50524	34.149.79.8	192.168.2.16
May 8, 2024 08:41:35.295813084 CEST	50524	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:35.296294928 CEST	2121	50379	126.1.45.71	192.168.2.16
May 8, 2024 08:41:35.297167063 CEST	50524	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:35.297411919 CEST	50528	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:35.298352003 CEST	21	50317	58.121.190.195	192.168.2.16
May 8, 2024 08:41:35.298666000 CEST	50529	2121	192.168.2.16	85.167.167.80
May 8, 2024 08:41:35.299154043 CEST	2121	50525	220.95.156.86	192.168.2.16
May 8, 2024 08:41:35.302249908 CEST	21	50401	34.149.79.8	192.168.2.16
May 8, 2024 08:41:35.315846920 CEST	50514	21	192.168.2.16	154.81.34.141
May 8, 2024 08:41:35.315848112 CEST	50320	2121	192.168.2.16	68.144.62.62
May 8, 2024 08:41:35.315860987 CEST	50421	2121	192.168.2.16	60.122.110.91
May 8, 2024 08:41:35.315918922 CEST	50417	21	192.168.2.16	60.122.110.91
May 8, 2024 08:41:35.331846952 CEST	50321	21	192.168.2.16	69.139.73.181
May 8, 2024 08:41:35.331871986 CEST	50411	21	192.168.2.16	115.11.79.59
May 8, 2024 08:41:35.340089083 CEST	2121	50349	197.8.254.242	192.168.2.16
May 8, 2024 08:41:35.340312004 CEST	21	50348	197.8.254.242	192.168.2.16
May 8, 2024 08:41:35.347841024 CEST	50430	21	192.168.2.16	14.61.202.134
May 8, 2024 08:41:35.347847939 CEST	50408	2121	192.168.2.16	115.11.79.59
May 8, 2024 08:41:35.347862005 CEST	50322	2121	192.168.2.16	69.139.73.181
May 8, 2024 08:41:35.347865105 CEST	50434	21	192.168.2.16	115.1.152.253
May 8, 2024 08:41:35.349997044 CEST	50431	2121	192.168.2.16	14.61.202.134
May 8, 2024 08:41:35.363850117 CEST	50463	21	192.168.2.16	27.117.127.209
May 8, 2024 08:41:35.363861084 CEST	50449	21	192.168.2.16	23.27.21.247
May 8, 2024 08:41:35.363862991 CEST	50464	2121	192.168.2.16	27.117.127.209
May 8, 2024 08:41:35.364834070 CEST	50451	2121	192.168.2.16	23.27.21.247
May 8, 2024 08:41:35.366014957 CEST	50436	2121	192.168.2.16	115.1.152.253
May 8, 2024 08:41:35.368500948 CEST	2121	50398	168.81.231.66	192.168.2.16
May 8, 2024 08:41:35.379827976 CEST	50477	21	192.168.2.16	126.237.161.134
May 8, 2024 08:41:35.379863977 CEST	50323	21	192.168.2.16	71.28.183.56
May 8, 2024 08:41:35.379864931 CEST	50493	21	192.168.2.16	60.151.63.142
May 8, 2024 08:41:35.379865885 CEST	50452	2121	192.168.2.16	175.241.55.242
May 8, 2024 08:41:35.379868031 CEST	50494	2121	192.168.2.16	60.151.63.142
May 8, 2024 08:41:35.379870892 CEST	50470	2121	192.168.2.16	126.237.161.134
May 8, 2024 08:41:35.379889965 CEST	50447	21	192.168.2.16	175.241.55.242
May 8, 2024 08:41:35.382158041 CEST	21	50509	172.120.235.139	192.168.2.16
May 8, 2024 08:41:35.382333040 CEST	50509	21	192.168.2.16	172.120.235.139
May 8, 2024 08:41:35.382610083 CEST	50530	21	192.168.2.16	172.120.235.139
May 8, 2024 08:41:35.395844936 CEST	50325	21	192.168.2.16	82.79.35.202
May 8, 2024 08:41:35.395869017 CEST	50324	2121	192.168.2.16	71.28.183.56
May 8, 2024 08:41:35.395869017 CEST	50497	21	192.168.2.16	121.190.67.79
May 8, 2024 08:41:35.395874023 CEST	50326	2121	192.168.2.16	82.79.35.202
May 8, 2024 08:41:35.395875931 CEST	50475	2121	192.168.2.16	36.26.159.46
May 8, 2024 08:41:35.396771908 CEST	50498	2121	192.168.2.16	121.190.67.79
May 8, 2024 08:41:35.411847115 CEST	50473	21	192.168.2.16	36.26.159.46
May 8, 2024 08:41:35.411865950 CEST	50508	2121	192.168.2.16	118.46.121.98
May 8, 2024 08:41:35.411870003 CEST	50327	21	192.168.2.16	125.247.204.97
May 8, 2024 08:41:35.411871910 CEST	50507	21	192.168.2.16	118.46.121.98
May 8, 2024 08:41:35.427849054 CEST	50492	2121	192.168.2.16	113.24.67.53
May 8, 2024 08:41:35.430021048 CEST	50491	21	192.168.2.16	113.24.67.53
May 8, 2024 08:41:35.430022955 CEST	50422	2121	192.168.2.16	27.7.8.56
May 8, 2024 08:41:35.438848019 CEST	21	50333	175.116.228.90	192.168.2.16
May 8, 2024 08:41:35.443887949 CEST	50488	21	192.168.2.16	210.131.155.110
May 8, 2024 08:41:35.454768896 CEST	2121	50523	34.149.79.8	192.168.2.16
May 8, 2024 08:41:35.455897093 CEST	2121	50527	34.149.79.8	192.168.2.16
May 8, 2024 08:41:35.455981970 CEST	50527	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:35.462587118 CEST	21	50524	34.149.79.8	192.168.2.16
May 8, 2024 08:41:35.463294983 CEST	21	50528	34.149.79.8	192.168.2.16
May 8, 2024 08:41:35.463386059 CEST	50528	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:35.475836039 CEST	50402	2121	192.168.2.16	47.236.184.40
May 8, 2024 08:41:35.491831064 CEST	50318	2121	192.168.2.16	58.121.190.195
May 8, 2024 08:41:35.491920948 CEST	50440	2121	192.168.2.16	110.49.63.132
May 8, 2024 08:41:35.503938913 CEST	2121	50334	175.116.228.90	192.168.2.16
May 8, 2024 08:41:35.506856918 CEST	50328	2121	192.168.2.16	125.247.204.97
May 8, 2024 08:41:35.509974957 CEST	21	50514	154.81.34.141	192.168.2.16
May 8, 2024 08:41:35.522845030 CEST	50407	21	192.168.2.16	112.147.13.3
May 8, 2024 08:41:35.522845030 CEST	50403	21	192.168.2.16	104.121.16.7
May 8, 2024 08:41:35.522861004 CEST	50404	21	192.168.2.16	220.71.176.141
May 8, 2024 08:41:35.522861958 CEST	50419	2121	192.168.2.16	84.26.50.147
May 8, 2024 08:41:35.522865057 CEST	50405	2121	192.168.2.16	220.71.176.141
May 8, 2024 08:41:35.522866011 CEST	50415	21	192.168.2.16	108.21.188.121
May 8, 2024 08:41:35.522887945 CEST	50414	2121	192.168.2.16	178.192.70.16
May 8, 2024 08:41:35.522887945 CEST	50416	2121	192.168.2.16	108.21.188.121
May 8, 2024 08:41:35.522887945 CEST	50420	21	192.168.2.16	27.7.8.56
May 8, 2024 08:41:35.522891998 CEST	50412	2121	192.168.2.16	79.147.28.191
May 8, 2024 08:41:35.522892952 CEST	50409	2121	192.168.2.16	112.147.13.3
May 8, 2024 08:41:35.522895098 CEST	50406	2121	192.168.2.16	104.121.16.7
May 8, 2024 08:41:35.522895098 CEST	50413	21	192.168.2.16	178.192.70.16
May 8, 2024 08:41:35.522895098 CEST	50410	21	192.168.2.16	79.147.28.191
May 8, 2024 08:41:35.522895098 CEST	50418	21	192.168.2.16	84.26.50.147
May 8, 2024 08:41:35.538877010 CEST	50426	21	192.168.2.16	192.173.15.13
May 8, 2024 08:41:35.538878918 CEST	50424	21	192.168.2.16	46.89.57.220
May 8, 2024 08:41:35.538883924 CEST	50429	2121	192.168.2.16	71.192.97.248
May 8, 2024 08:41:35.538883924 CEST	50423	2121	192.168.2.16	39.65.232.109
May 8, 2024 08:41:35.538970947 CEST	50425	2121	192.168.2.16	192.173.15.13
May 8, 2024 08:41:35.538971901 CEST	50427	2121	192.168.2.16	46.89.57.220
May 8, 2024 08:41:35.538974047 CEST	50435	21	192.168.2.16	39.65.232.109
May 8, 2024 08:41:35.538975954 CEST	50433	2121	192.168.2.16	24.86.223.52
May 8, 2024 08:41:35.538975954 CEST	50428	21	192.168.2.16	71.192.97.248
May 8, 2024 08:41:35.538975954 CEST	50432	21	192.168.2.16	24.86.223.52
May 8, 2024 08:41:35.553844929 CEST	50438	2121	192.168.2.16	151.224.102.22
May 8, 2024 08:41:35.553844929 CEST	50441	21	192.168.2.16	93.224.25.244
May 8, 2024 08:41:35.553844929 CEST	50439	21	192.168.2.16	110.49.63.132
May 8, 2024 08:41:35.553865910 CEST	50448	21	192.168.2.16	174.27.167.255
May 8, 2024 08:41:35.553867102 CEST	50437	21	192.168.2.16	151.224.102.22
May 8, 2024 08:41:35.553865910 CEST	50444	2121	192.168.2.16	67.162.131.234
May 8, 2024 08:41:35.553869009 CEST	50446	2121	192.168.2.16	110.246.88.180
May 8, 2024 08:41:35.553870916 CEST	50445	21	192.168.2.16	110.246.88.180
May 8, 2024 08:41:35.553873062 CEST	50442	2121	192.168.2.16	93.224.25.244
May 8, 2024 08:41:35.553873062 CEST	50450	2121	192.168.2.16	174.27.167.255
May 8, 2024 08:41:35.553873062 CEST	50443	21	192.168.2.16	67.162.131.234
May 8, 2024 08:41:35.562567949 CEST	2121	50363	59.92.247.174	192.168.2.16
May 8, 2024 08:41:35.564125061 CEST	21	50509	172.120.235.139	192.168.2.16
May 8, 2024 08:41:35.564196110 CEST	50509	21	192.168.2.16	172.120.235.139
May 8, 2024 08:41:35.564296007 CEST	21	50530	172.120.235.139	192.168.2.16
May 8, 2024 08:41:35.564372063 CEST	50530	21	192.168.2.16	172.120.235.139
May 8, 2024 08:41:35.569838047 CEST	50453	21	192.168.2.16	73.25.54.119
May 8, 2024 08:41:35.569838047 CEST	50458	2121	192.168.2.16	218.56.222.188
May 8, 2024 08:41:35.569844007 CEST	50462	2121	192.168.2.16	86.30.180.122
May 8, 2024 08:41:35.569855928 CEST	50456	2121	192.168.2.16	60.53.210.99
May 8, 2024 08:41:35.569860935 CEST	50454	2121	192.168.2.16	73.25.54.119
May 8, 2024 08:41:35.569863081 CEST	50466	21	192.168.2.16	134.238.198.128
May 8, 2024 08:41:35.569864035 CEST	50474	2121	192.168.2.16	24.131.164.226
May 8, 2024 08:41:35.569871902 CEST	50459	21	192.168.2.16	125.120.130.52
May 8, 2024 08:41:35.569888115 CEST	50467	21	192.168.2.16	122.173.239.62
May 8, 2024 08:41:35.569890976 CEST	50461	21	192.168.2.16	86.30.180.122
May 8, 2024 08:41:35.569892883 CEST	50457	21	192.168.2.16	218.56.222.188
May 8, 2024 08:41:35.569895029 CEST	50469	2121	192.168.2.16	122.173.239.62
May 8, 2024 08:41:35.569895029 CEST	50476	21	192.168.2.16	78.101.135.91
May 8, 2024 08:41:35.569895983 CEST	50468	2121	192.168.2.16	134.238.198.128
May 8, 2024 08:41:35.569895029 CEST	50472	2121	192.168.2.16	188.83.164.192
May 8, 2024 08:41:35.569895983 CEST	50465	21	192.168.2.16	24.131.164.226
May 8, 2024 08:41:35.569895983 CEST	50471	21	192.168.2.16	188.83.164.192
May 8, 2024 08:41:35.569900036 CEST	50460	2121	192.168.2.16	125.120.130.52
May 8, 2024 08:41:35.569900036 CEST	50455	21	192.168.2.16	60.53.210.99
May 8, 2024 08:41:35.585836887 CEST	50489	2121	192.168.2.16	69.255.145.154
May 8, 2024 08:41:35.585858107 CEST	50482	2121	192.168.2.16	119.185.119.239
May 8, 2024 08:41:35.585860968 CEST	50480	2121	192.168.2.16	183.99.74.58
May 8, 2024 08:41:35.585861921 CEST	50496	2121	192.168.2.16	189.106.23.71
May 8, 2024 08:41:35.585860968 CEST	50479	21	192.168.2.16	183.99.74.58
May 8, 2024 08:41:35.585861921 CEST	50490	2121	192.168.2.16	210.131.155.110
May 8, 2024 08:41:35.585860968 CEST	50481	21	192.168.2.16	119.185.119.239
May 8, 2024 08:41:35.585879087 CEST	50484	2121	192.168.2.16	184.68.210.101
May 8, 2024 08:41:35.585880041 CEST	50478	2121	192.168.2.16	78.101.135.91
May 8, 2024 08:41:35.585880995 CEST	50485	21	192.168.2.16	217.238.127.243
May 8, 2024 08:41:35.585880995 CEST	50486	2121	192.168.2.16	217.238.127.243
May 8, 2024 08:41:35.585882902 CEST	50483	21	192.168.2.16	184.68.210.101
May 8, 2024 08:41:35.586092949 CEST	50487	21	192.168.2.16	69.255.145.154
May 8, 2024 08:41:35.586096048 CEST	50495	21	192.168.2.16	189.106.23.71
May 8, 2024 08:41:35.586097002 CEST	50499	21	192.168.2.16	81.154.91.122
May 8, 2024 08:41:35.586098909 CEST	50500	2121	192.168.2.16	81.154.91.122
May 8, 2024 08:41:35.601854086 CEST	50502	21	192.168.2.16	68.2.237.24
May 8, 2024 08:41:35.601870060 CEST	50505	21	192.168.2.16	47.196.20.197
May 8, 2024 08:41:35.601871014 CEST	50501	2121	192.168.2.16	68.2.237.24
May 8, 2024 08:41:35.601877928 CEST	50504	2121	192.168.2.16	181.208.58.40
May 8, 2024 08:41:35.602214098 CEST	50506	2121	192.168.2.16	47.196.20.197
May 8, 2024 08:41:35.602216959 CEST	50531	21	192.168.2.16	2.217.228.54
May 8, 2024 08:41:35.602216959 CEST	50503	21	192.168.2.16	181.208.58.40
May 8, 2024 08:41:35.617866993 CEST	50511	21	192.168.2.16	104.17.88.189
May 8, 2024 08:41:35.617868900 CEST	50329	21	192.168.2.16	165.227.135.59
May 8, 2024 08:41:35.617896080 CEST	50513	2121	192.168.2.16	104.17.88.189
May 8, 2024 08:41:35.617896080 CEST	50515	2121	192.168.2.16	154.81.34.141
May 8, 2024 08:41:35.618833065 CEST	21	50417	60.122.110.91	192.168.2.16
May 8, 2024 08:41:35.618995905 CEST	2121	50527	34.149.79.8	192.168.2.16
May 8, 2024 08:41:35.619060040 CEST	50527	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:35.619087934 CEST	50330	2121	192.168.2.16	165.227.135.59
May 8, 2024 08:41:35.619102001 CEST	50510	21	192.168.2.16	20.172.220.30
May 8, 2024 08:41:35.619198084 CEST	50527	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:35.619327068 CEST	2121	50421	60.122.110.91	192.168.2.16
May 8, 2024 08:41:35.619570017 CEST	50532	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:35.626136065 CEST	21	50528	34.149.79.8	192.168.2.16
May 8, 2024 08:41:35.626236916 CEST	50528	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:35.626339912 CEST	50528	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:35.626606941 CEST	50533	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:35.629820108 CEST	50512	2121	192.168.2.16	20.172.220.30
May 8, 2024 08:41:35.648893118 CEST	50518	21	192.168.2.16	60.137.5.118
May 8, 2024 08:41:35.651174068 CEST	21	50411	115.11.79.59	192.168.2.16
May 8, 2024 08:41:35.659432888 CEST	21	50463	27.117.127.209	192.168.2.16
May 8, 2024 08:41:35.662749052 CEST	2121	50464	27.117.127.209	192.168.2.16
May 8, 2024 08:41:35.664341927 CEST	21	50434	115.1.152.253	192.168.2.16
May 8, 2024 08:41:35.669038057 CEST	21	50430	14.61.202.134	192.168.2.16
May 8, 2024 08:41:35.670840979 CEST	2121	50431	14.61.202.134	192.168.2.16
May 8, 2024 08:41:35.673552036 CEST	2121	50408	115.11.79.59	192.168.2.16
May 8, 2024 08:41:35.676662922 CEST	2121	50451	23.27.21.247	192.168.2.16
May 8, 2024 08:41:35.679294109 CEST	21	50493	60.151.63.142	192.168.2.16
May 8, 2024 08:41:35.679352999 CEST	21	50449	23.27.21.247	192.168.2.16
May 8, 2024 08:41:35.680922031 CEST	50519	2121	192.168.2.16	60.137.5.118
May 8, 2024 08:41:35.681607962 CEST	2121	50494	60.151.63.142	192.168.2.16
May 8, 2024 08:41:35.682301044 CEST	21	50477	126.237.161.134	192.168.2.16
May 8, 2024 08:41:35.682313919 CEST	2121	50470	126.237.161.134	192.168.2.16
May 8, 2024 08:41:35.682945967 CEST	2121	50436	115.1.152.253	192.168.2.16
May 8, 2024 08:41:35.700985909 CEST	2121	50452	175.241.55.242	192.168.2.16
May 8, 2024 08:41:35.705157042 CEST	21	50447	175.241.55.242	192.168.2.16
May 8, 2024 08:41:35.706816912 CEST	21	50497	121.190.67.79	192.168.2.16
May 8, 2024 08:41:35.711946011 CEST	2121	50475	36.26.159.46	192.168.2.16
May 8, 2024 08:41:35.712181091 CEST	2121	50498	121.190.67.79	192.168.2.16
May 8, 2024 08:41:35.719062090 CEST	21	50507	118.46.121.98	192.168.2.16
May 8, 2024 08:41:35.722811937 CEST	2121	50508	118.46.121.98	192.168.2.16
May 8, 2024 08:41:35.727855921 CEST	50397	21	192.168.2.16	168.81.231.66
May 8, 2024 08:41:35.727870941 CEST	50521	21	192.168.2.16	220.95.156.86
May 8, 2024 08:41:35.727871895 CEST	50331	21	192.168.2.16	65.60.157.69
May 8, 2024 08:41:35.743375063 CEST	21	50473	36.26.159.46	192.168.2.16
May 8, 2024 08:41:35.743846893 CEST	50357	2121	192.168.2.16	181.170.184.192
May 8, 2024 08:41:35.743855000 CEST	50332	2121	192.168.2.16	65.60.157.69
May 8, 2024 08:41:35.744044065 CEST	50356	21	192.168.2.16	181.170.184.192
May 8, 2024 08:41:35.758645058 CEST	21	50488	210.131.155.110	192.168.2.16
May 8, 2024 08:41:35.766371012 CEST	21	50491	113.24.67.53	192.168.2.16
May 8, 2024 08:41:35.767333984 CEST	2121	50492	113.24.67.53	192.168.2.16
May 8, 2024 08:41:35.781563997 CEST	2121	50527	34.149.79.8	192.168.2.16
May 8, 2024 08:41:35.781970978 CEST	2121	50532	34.149.79.8	192.168.2.16
May 8, 2024 08:41:35.782031059 CEST	50532	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:35.785981894 CEST	21	50530	172.120.235.139	192.168.2.16
May 8, 2024 08:41:35.786117077 CEST	50530	21	192.168.2.16	172.120.235.139
May 8, 2024 08:41:35.788680077 CEST	21	50528	34.149.79.8	192.168.2.16
May 8, 2024 08:41:35.788692951 CEST	21	50533	34.149.79.8	192.168.2.16
May 8, 2024 08:41:35.788753986 CEST	50533	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:35.791841030 CEST	50378	21	192.168.2.16	126.1.45.71
May 8, 2024 08:41:35.800853968 CEST	2121	50318	58.121.190.195	192.168.2.16
May 8, 2024 08:41:35.807845116 CEST	50335	21	192.168.2.16	58.37.12.209
May 8, 2024 08:41:35.807863951 CEST	50525	2121	192.168.2.16	220.95.156.86
May 8, 2024 08:41:35.807864904 CEST	50379	2121	192.168.2.16	126.1.45.71
May 8, 2024 08:41:35.824148893 CEST	50534	2121	192.168.2.16	2.217.228.54
May 8, 2024 08:41:35.829463959 CEST	2121	50422	27.7.8.56	192.168.2.16
May 8, 2024 08:41:35.855863094 CEST	50336	2121	192.168.2.16	58.37.12.209
May 8, 2024 08:41:35.855865002 CEST	50349	2121	192.168.2.16	197.8.254.242
May 8, 2024 08:41:35.856009007 CEST	50348	21	192.168.2.16	197.8.254.242
May 8, 2024 08:41:35.871870041 CEST	50398	2121	192.168.2.16	168.81.231.66
May 8, 2024 08:41:35.872143030 CEST	50520	21	192.168.2.16	116.33.122.235
May 8, 2024 08:41:35.919881105 CEST	50522	2121	192.168.2.16	116.33.122.235
May 8, 2024 08:41:35.936837912 CEST	2121	50440	110.49.63.132	192.168.2.16
May 8, 2024 08:41:35.944591045 CEST	2121	50532	34.149.79.8	192.168.2.16
May 8, 2024 08:41:35.944679976 CEST	50532	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:35.944895029 CEST	50532	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:35.945321083 CEST	50535	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:35.951055050 CEST	21	50533	34.149.79.8	192.168.2.16
May 8, 2024 08:41:35.951157093 CEST	50533	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:35.951257944 CEST	50533	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:35.951495886 CEST	50536	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:35.951860905 CEST	50333	21	192.168.2.16	175.116.228.90
May 8, 2024 08:41:35.960568905 CEST	21	50518	60.137.5.118	192.168.2.16
May 8, 2024 08:41:35.967854977 CEST	21	50530	172.120.235.139	192.168.2.16
May 8, 2024 08:41:35.968245983 CEST	21	50530	172.120.235.139	192.168.2.16
May 8, 2024 08:41:35.968502998 CEST	50530	21	192.168.2.16	172.120.235.139
May 8, 2024 08:41:35.973900080 CEST	21	50331	65.60.157.69	192.168.2.16
May 8, 2024 08:41:35.974647045 CEST	50537	21	192.168.2.16	187.208.244.80
May 8, 2024 08:41:35.990251064 CEST	2121	50332	65.60.157.69	192.168.2.16
May 8, 2024 08:41:35.993781090 CEST	21	50339	196.210.0.111	192.168.2.16
May 8, 2024 08:41:35.993956089 CEST	50339	21	192.168.2.16	196.210.0.111
May 8, 2024 08:41:35.994194984 CEST	50538	21	192.168.2.16	196.210.0.111
May 8, 2024 08:41:35.994196892 CEST	2121	50519	60.137.5.118	192.168.2.16
May 8, 2024 08:41:36.014836073 CEST	50334	2121	192.168.2.16	175.116.228.90
May 8, 2024 08:41:36.014889002 CEST	50514	21	192.168.2.16	154.81.34.141
May 8, 2024 08:41:36.015145063 CEST	50539	2121	192.168.2.16	187.208.244.80
May 8, 2024 08:41:36.038672924 CEST	21	50521	220.95.156.86	192.168.2.16
May 8, 2024 08:41:36.069185019 CEST	21	50397	168.81.231.66	192.168.2.16
May 8, 2024 08:41:36.077841043 CEST	50363	2121	192.168.2.16	59.92.247.174
May 8, 2024 08:41:36.077857018 CEST	50344	21	192.168.2.16	68.144.255.196
May 8, 2024 08:41:36.078171015 CEST	50540	21	192.168.2.16	175.121.86.174
May 8, 2024 08:41:36.084692001 CEST	2121	50357	181.170.184.192	192.168.2.16
May 8, 2024 08:41:36.089556932 CEST	21	50356	181.170.184.192	192.168.2.16
May 8, 2024 08:41:36.090766907 CEST	21	50378	126.1.45.71	192.168.2.16
May 8, 2024 08:41:36.093815088 CEST	50345	2121	192.168.2.16	68.144.255.196
May 8, 2024 08:41:36.093816042 CEST	50346	21	192.168.2.16	219.249.223.42
May 8, 2024 08:41:36.107290030 CEST	2121	50532	34.149.79.8	192.168.2.16
May 8, 2024 08:41:36.107414961 CEST	2121	50379	126.1.45.71	192.168.2.16
May 8, 2024 08:41:36.107718945 CEST	2121	50535	34.149.79.8	192.168.2.16
May 8, 2024 08:41:36.107779980 CEST	50535	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:36.109824896 CEST	50347	2121	192.168.2.16	219.249.223.42
May 8, 2024 08:41:36.110249043 CEST	50541	2121	192.168.2.16	175.121.86.174
May 8, 2024 08:41:36.113348007 CEST	21	50533	34.149.79.8	192.168.2.16
May 8, 2024 08:41:36.113599062 CEST	21	50536	34.149.79.8	192.168.2.16
May 8, 2024 08:41:36.113665104 CEST	50536	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:36.125025034 CEST	2121	50525	220.95.156.86	192.168.2.16
May 8, 2024 08:41:36.125818014 CEST	50417	21	192.168.2.16	60.122.110.91
May 8, 2024 08:41:36.125838995 CEST	50421	2121	192.168.2.16	60.122.110.91
May 8, 2024 08:41:36.141829967 CEST	50352	21	192.168.2.16	23.1.29.50
May 8, 2024 08:41:36.141829967 CEST	50351	2121	192.168.2.16	174.79.38.52
May 8, 2024 08:41:36.141908884 CEST	50350	21	192.168.2.16	174.79.38.52
May 8, 2024 08:41:36.157836914 CEST	50354	21	192.168.2.16	141.156.239.196
May 8, 2024 08:41:36.157839060 CEST	50411	21	192.168.2.16	115.11.79.59
May 8, 2024 08:41:36.157911062 CEST	50353	2121	192.168.2.16	23.1.29.50
May 8, 2024 08:41:36.173841000 CEST	50434	21	192.168.2.16	115.1.152.253
May 8, 2024 08:41:36.173856020 CEST	50464	2121	192.168.2.16	27.117.127.209
May 8, 2024 08:41:36.173861027 CEST	50463	21	192.168.2.16	27.117.127.209
May 8, 2024 08:41:36.173862934 CEST	50431	2121	192.168.2.16	14.61.202.134
May 8, 2024 08:41:36.173862934 CEST	50408	2121	192.168.2.16	115.11.79.59
May 8, 2024 08:41:36.174016953 CEST	50526	21	192.168.2.16	85.167.167.80
May 8, 2024 08:41:36.174016953 CEST	50430	21	192.168.2.16	14.61.202.134
May 8, 2024 08:41:36.178586006 CEST	21	50530	172.120.235.139	192.168.2.16
May 8, 2024 08:41:36.178738117 CEST	50530	21	192.168.2.16	172.120.235.139
May 8, 2024 08:41:36.179040909 CEST	50542	21	192.168.2.16	172.120.235.139
May 8, 2024 08:41:36.189825058 CEST	50493	21	192.168.2.16	60.151.63.142
May 8, 2024 08:41:36.189826965 CEST	50451	2121	192.168.2.16	23.27.21.247
May 8, 2024 08:41:36.189837933 CEST	50436	2121	192.168.2.16	115.1.152.253
May 8, 2024 08:41:36.189841032 CEST	50477	21	192.168.2.16	126.237.161.134
May 8, 2024 08:41:36.189841032 CEST	50449	21	192.168.2.16	23.27.21.247
May 8, 2024 08:41:36.189841032 CEST	50494	2121	192.168.2.16	60.151.63.142
May 8, 2024 08:41:36.190342903 CEST	50470	2121	192.168.2.16	126.237.161.134
May 8, 2024 08:41:36.205853939 CEST	50452	2121	192.168.2.16	175.241.55.242
May 8, 2024 08:41:36.205858946 CEST	50355	2121	192.168.2.16	141.156.239.196
May 8, 2024 08:41:36.205899954 CEST	50447	21	192.168.2.16	175.241.55.242
May 8, 2024 08:41:36.206110954 CEST	50358	21	192.168.2.16	109.136.157.146
May 8, 2024 08:41:36.208544970 CEST	21	50514	154.81.34.141	192.168.2.16
May 8, 2024 08:41:36.211981058 CEST	2121	50398	168.81.231.66	192.168.2.16
May 8, 2024 08:41:36.221848011 CEST	50497	21	192.168.2.16	121.190.67.79
May 8, 2024 08:41:36.221848011 CEST	50498	2121	192.168.2.16	121.190.67.79
May 8, 2024 08:41:36.221848011 CEST	50507	21	192.168.2.16	118.46.121.98
May 8, 2024 08:41:36.221856117 CEST	50475	2121	192.168.2.16	36.26.159.46
May 8, 2024 08:41:36.235393047 CEST	21	50333	175.116.228.90	192.168.2.16
May 8, 2024 08:41:36.235749960 CEST	50543	21	192.168.2.16	188.172.30.125
May 8, 2024 08:41:36.237835884 CEST	50508	2121	192.168.2.16	118.46.121.98
May 8, 2024 08:41:36.237838984 CEST	50360	21	192.168.2.16	27.18.69.179
May 8, 2024 08:41:36.237848043 CEST	50359	2121	192.168.2.16	109.136.157.146
May 8, 2024 08:41:36.252178907 CEST	50366	2121	192.168.2.16	117.147.255.88
May 8, 2024 08:41:36.253827095 CEST	50361	2121	192.168.2.16	27.18.69.179
May 8, 2024 08:41:36.253828049 CEST	50365	21	192.168.2.16	66.57.225.25
May 8, 2024 08:41:36.253937960 CEST	50473	21	192.168.2.16	36.26.159.46
May 8, 2024 08:41:36.254026890 CEST	50362	21	192.168.2.16	59.92.247.174
May 8, 2024 08:41:36.254026890 CEST	50364	21	192.168.2.16	117.147.255.88
May 8, 2024 08:41:36.254064083 CEST	50368	21	192.168.2.16	70.173.246.183
May 8, 2024 08:41:36.257563114 CEST	2121	50539	187.208.244.80	192.168.2.16
May 8, 2024 08:41:36.269829988 CEST	50367	2121	192.168.2.16	66.57.225.25
May 8, 2024 08:41:36.269834995 CEST	50488	21	192.168.2.16	210.131.155.110
May 8, 2024 08:41:36.269994974 CEST	50491	21	192.168.2.16	113.24.67.53
May 8, 2024 08:41:36.269995928 CEST	50492	2121	192.168.2.16	113.24.67.53
May 8, 2024 08:41:36.270339966 CEST	2121	50535	34.149.79.8	192.168.2.16
May 8, 2024 08:41:36.270392895 CEST	50535	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:36.270504951 CEST	50535	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:36.270760059 CEST	50544	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:36.275976896 CEST	21	50536	34.149.79.8	192.168.2.16
May 8, 2024 08:41:36.276026011 CEST	50536	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:36.276081085 CEST	50536	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:36.276233912 CEST	50545	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:36.301815987 CEST	50369	2121	192.168.2.16	70.173.246.183
May 8, 2024 08:41:36.301845074 CEST	50529	2121	192.168.2.16	85.167.167.80
May 8, 2024 08:41:36.301846981 CEST	50370	21	192.168.2.16	104.83.35.248
May 8, 2024 08:41:36.309164047 CEST	2121	50349	197.8.254.242	192.168.2.16
May 8, 2024 08:41:36.309353113 CEST	21	50348	197.8.254.242	192.168.2.16
May 8, 2024 08:41:36.313998938 CEST	2121	50334	175.116.228.90	192.168.2.16
May 8, 2024 08:41:36.333852053 CEST	50371	2121	192.168.2.16	104.83.35.248
May 8, 2024 08:41:36.333996058 CEST	50373	2121	192.168.2.16	73.68.146.88
May 8, 2024 08:41:36.334038973 CEST	50422	2121	192.168.2.16	27.7.8.56
May 8, 2024 08:41:36.334500074 CEST	50546	2121	192.168.2.16	188.172.30.125
May 8, 2024 08:41:36.349818945 CEST	50374	21	192.168.2.16	82.180.72.40
May 8, 2024 08:41:36.349838018 CEST	50372	21	192.168.2.16	73.68.146.88
May 8, 2024 08:41:36.350184917 CEST	50547	21	192.168.2.16	108.15.160.47
May 8, 2024 08:41:36.360567093 CEST	21	50530	172.120.235.139	192.168.2.16
May 8, 2024 08:41:36.360631943 CEST	50530	21	192.168.2.16	172.120.235.139
May 8, 2024 08:41:36.360666990 CEST	21	50542	172.120.235.139	192.168.2.16
May 8, 2024 08:41:36.360734940 CEST	50542	21	192.168.2.16	172.120.235.139
May 8, 2024 08:41:36.367999077 CEST	21	50540	175.121.86.174	192.168.2.16
May 8, 2024 08:41:36.381851912 CEST	50377	2121	192.168.2.16	82.180.72.40
May 8, 2024 08:41:36.382005930 CEST	50381	21	192.168.2.16	75.238.200.198
May 8, 2024 08:41:36.397844076 CEST	50380	2121	192.168.2.16	75.238.200.198
May 8, 2024 08:41:36.417548895 CEST	2121	50541	175.121.86.174	192.168.2.16
May 8, 2024 08:41:36.428644896 CEST	2121	50421	60.122.110.91	192.168.2.16
May 8, 2024 08:41:36.428658962 CEST	21	50417	60.122.110.91	192.168.2.16
May 8, 2024 08:41:36.432893991 CEST	2121	50535	34.149.79.8	192.168.2.16
May 8, 2024 08:41:36.433140993 CEST	2121	50544	34.149.79.8	192.168.2.16
May 8, 2024 08:41:36.433212042 CEST	50544	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:36.438241959 CEST	21	50536	34.149.79.8	192.168.2.16
May 8, 2024 08:41:36.438483953 CEST	21	50545	34.149.79.8	192.168.2.16
May 8, 2024 08:41:36.438541889 CEST	50545	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:36.445859909 CEST	50440	2121	192.168.2.16	110.49.63.132
May 8, 2024 08:41:36.445861101 CEST	50382	21	192.168.2.16	219.68.211.98
May 8, 2024 08:41:36.460880041 CEST	50518	21	192.168.2.16	60.137.5.118
May 8, 2024 08:41:36.469506979 CEST	21	50463	27.117.127.209	192.168.2.16
May 8, 2024 08:41:36.472829103 CEST	2121	50464	27.117.127.209	192.168.2.16
May 8, 2024 08:41:36.472939968 CEST	21	50339	196.210.0.111	192.168.2.16
May 8, 2024 08:41:36.472990036 CEST	50339	21	192.168.2.16	196.210.0.111
May 8, 2024 08:41:36.475867987 CEST	21	50538	196.210.0.111	192.168.2.16
May 8, 2024 08:41:36.475927114 CEST	50538	21	192.168.2.16	196.210.0.111
May 8, 2024 08:41:36.476841927 CEST	50383	2121	192.168.2.16	219.68.211.98
May 8, 2024 08:41:36.477353096 CEST	21	50411	115.11.79.59	192.168.2.16
May 8, 2024 08:41:36.491080046 CEST	21	50434	115.1.152.253	192.168.2.16
May 8, 2024 08:41:36.492130995 CEST	21	50493	60.151.63.142	192.168.2.16
May 8, 2024 08:41:36.492614031 CEST	21	50477	126.237.161.134	192.168.2.16
May 8, 2024 08:41:36.493273973 CEST	2121	50470	126.237.161.134	192.168.2.16
May 8, 2024 08:41:36.494501114 CEST	2121	50494	60.151.63.142	192.168.2.16
May 8, 2024 08:41:36.495341063 CEST	21	50430	14.61.202.134	192.168.2.16
May 8, 2024 08:41:36.495687962 CEST	2121	50431	14.61.202.134	192.168.2.16
May 8, 2024 08:41:36.499766111 CEST	2121	50408	115.11.79.59	192.168.2.16
May 8, 2024 08:41:36.501631021 CEST	2121	50451	23.27.21.247	192.168.2.16
May 8, 2024 08:41:36.505543947 CEST	21	50449	23.27.21.247	192.168.2.16
May 8, 2024 08:41:36.506632090 CEST	2121	50436	115.1.152.253	192.168.2.16
May 8, 2024 08:41:36.508843899 CEST	50519	2121	192.168.2.16	60.137.5.118
May 8, 2024 08:41:36.516825914 CEST	2121	50363	59.92.247.174	192.168.2.16
May 8, 2024 08:41:36.526546955 CEST	2121	50452	175.241.55.242	192.168.2.16
May 8, 2024 08:41:36.529278994 CEST	21	50507	118.46.121.98	192.168.2.16
May 8, 2024 08:41:36.530710936 CEST	21	50447	175.241.55.242	192.168.2.16
May 8, 2024 08:41:36.532762051 CEST	21	50497	121.190.67.79	192.168.2.16
May 8, 2024 08:41:36.537168980 CEST	2121	50498	121.190.67.79	192.168.2.16
May 8, 2024 08:41:36.538455009 CEST	2121	50475	36.26.159.46	192.168.2.16
May 8, 2024 08:41:36.540863991 CEST	50521	21	192.168.2.16	220.95.156.86
May 8, 2024 08:41:36.540898085 CEST	50385	2121	192.168.2.16	218.228.65.115
May 8, 2024 08:41:36.540920973 CEST	50384	21	192.168.2.16	218.228.65.115
May 8, 2024 08:41:36.548552990 CEST	2121	50508	118.46.121.98	192.168.2.16
May 8, 2024 08:41:36.556843996 CEST	50386	21	192.168.2.16	83.57.150.95
May 8, 2024 08:41:36.571837902 CEST	50397	21	192.168.2.16	168.81.231.66
May 8, 2024 08:41:36.583831072 CEST	50387	2121	192.168.2.16	83.57.150.95
May 8, 2024 08:41:36.587315083 CEST	21	50542	172.120.235.139	192.168.2.16
May 8, 2024 08:41:36.587519884 CEST	50542	21	192.168.2.16	172.120.235.139
May 8, 2024 08:41:36.588743925 CEST	21	50473	36.26.159.46	192.168.2.16
May 8, 2024 08:41:36.589828014 CEST	50357	2121	192.168.2.16	181.170.184.192
May 8, 2024 08:41:36.598195076 CEST	2121	50544	34.149.79.8	192.168.2.16
May 8, 2024 08:41:36.598253965 CEST	50544	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:36.598364115 CEST	50544	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:36.598674059 CEST	50548	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:36.601134062 CEST	21	50545	34.149.79.8	192.168.2.16
May 8, 2024 08:41:36.601191998 CEST	50545	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:36.601289034 CEST	50545	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:36.601531982 CEST	50549	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:36.603827953 CEST	50378	21	192.168.2.16	126.1.45.71
May 8, 2024 08:41:36.604111910 CEST	50531	21	192.168.2.16	2.217.228.54
May 8, 2024 08:41:36.604115963 CEST	50356	21	192.168.2.16	181.170.184.192
May 8, 2024 08:41:36.606750965 CEST	21	50491	113.24.67.53	192.168.2.16
May 8, 2024 08:41:36.609725952 CEST	2121	50492	113.24.67.53	192.168.2.16
May 8, 2024 08:41:36.619004965 CEST	21	50488	210.131.155.110	192.168.2.16
May 8, 2024 08:41:36.619822025 CEST	50379	2121	192.168.2.16	126.1.45.71
May 8, 2024 08:41:36.634841919 CEST	50525	2121	192.168.2.16	220.95.156.86
May 8, 2024 08:41:36.713869095 CEST	50514	21	192.168.2.16	154.81.34.141
May 8, 2024 08:41:36.715982914 CEST	50398	2121	192.168.2.16	168.81.231.66
May 8, 2024 08:41:36.733464003 CEST	2121	50422	27.7.8.56	192.168.2.16
May 8, 2024 08:41:36.760791063 CEST	2121	50544	34.149.79.8	192.168.2.16
May 8, 2024 08:41:36.760829926 CEST	50390	21	192.168.2.16	76.89.108.36
May 8, 2024 08:41:36.760934114 CEST	50539	2121	192.168.2.16	187.208.244.80
May 8, 2024 08:41:36.761004925 CEST	2121	50548	34.149.79.8	192.168.2.16
May 8, 2024 08:41:36.761071920 CEST	50548	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:36.763463020 CEST	21	50545	34.149.79.8	192.168.2.16
May 8, 2024 08:41:36.764110088 CEST	21	50549	34.149.79.8	192.168.2.16
May 8, 2024 08:41:36.764174938 CEST	50549	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:36.769220114 CEST	21	50542	172.120.235.139	192.168.2.16
May 8, 2024 08:41:36.769507885 CEST	21	50542	172.120.235.139	192.168.2.16
May 8, 2024 08:41:36.769634008 CEST	50542	21	192.168.2.16	172.120.235.139
May 8, 2024 08:41:36.771430969 CEST	21	50518	60.137.5.118	192.168.2.16
May 8, 2024 08:41:36.776829958 CEST	50391	21	192.168.2.16	189.70.118.127
May 8, 2024 08:41:36.776845932 CEST	50392	2121	192.168.2.16	76.89.108.36
May 8, 2024 08:41:36.792864084 CEST	50393	2121	192.168.2.16	189.70.118.127
May 8, 2024 08:41:36.809039116 CEST	50349	2121	192.168.2.16	197.8.254.242
May 8, 2024 08:41:36.820034027 CEST	2121	50519	60.137.5.118	192.168.2.16
May 8, 2024 08:41:36.824826002 CEST	50348	21	192.168.2.16	197.8.254.242
May 8, 2024 08:41:36.824837923 CEST	50534	2121	192.168.2.16	2.217.228.54
May 8, 2024 08:41:36.851150990 CEST	21	50521	220.95.156.86	192.168.2.16
May 8, 2024 08:41:36.873298883 CEST	50540	21	192.168.2.16	175.121.86.174
May 8, 2024 08:41:36.890739918 CEST	2121	50440	110.49.63.132	192.168.2.16
May 8, 2024 08:41:36.902509928 CEST	21	50378	126.1.45.71	192.168.2.16
May 8, 2024 08:41:36.903006077 CEST	50550	2121	192.168.2.16	108.15.160.47
May 8, 2024 08:41:36.909193039 CEST	21	50514	154.81.34.141	192.168.2.16
May 8, 2024 08:41:36.913172007 CEST	21	50397	168.81.231.66	192.168.2.16
May 8, 2024 08:41:36.919081926 CEST	2121	50379	126.1.45.71	192.168.2.16
May 8, 2024 08:41:36.920847893 CEST	50541	2121	192.168.2.16	175.121.86.174
May 8, 2024 08:41:36.923760891 CEST	2121	50548	34.149.79.8	192.168.2.16
May 8, 2024 08:41:36.923825979 CEST	50548	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:36.923949957 CEST	50548	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:36.924273014 CEST	50551	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:36.926649094 CEST	21	50549	34.149.79.8	192.168.2.16
May 8, 2024 08:41:36.926709890 CEST	50549	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:36.926775932 CEST	50549	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:36.926965952 CEST	50552	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:36.934370041 CEST	2121	50357	181.170.184.192	192.168.2.16
May 8, 2024 08:41:36.934762955 CEST	50553	21	192.168.2.16	101.80.45.13
May 8, 2024 08:41:36.936839104 CEST	50421	2121	192.168.2.16	60.122.110.91
May 8, 2024 08:41:36.936839104 CEST	50417	21	192.168.2.16	60.122.110.91
May 8, 2024 08:41:36.937087059 CEST	50554	2121	192.168.2.16	101.80.45.13
May 8, 2024 08:41:36.949455023 CEST	21	50356	181.170.184.192	192.168.2.16
May 8, 2024 08:41:36.951096058 CEST	2121	50525	220.95.156.86	192.168.2.16
May 8, 2024 08:41:36.969090939 CEST	50555	21	192.168.2.16	173.176.244.243
May 8, 2024 08:41:36.976242065 CEST	50463	21	192.168.2.16	27.117.127.209
May 8, 2024 08:41:36.977783918 CEST	21	50542	172.120.235.139	192.168.2.16
May 8, 2024 08:41:36.977941990 CEST	50542	21	192.168.2.16	172.120.235.139
May 8, 2024 08:41:36.978153944 CEST	50556	21	192.168.2.16	172.120.235.139
May 8, 2024 08:41:36.984842062 CEST	50537	21	192.168.2.16	187.208.244.80
May 8, 2024 08:41:36.984848022 CEST	50411	21	192.168.2.16	115.11.79.59
May 8, 2024 08:41:36.984849930 CEST	50464	2121	192.168.2.16	27.117.127.209
May 8, 2024 08:41:36.991012096 CEST	21	50538	196.210.0.111	192.168.2.16
May 8, 2024 08:41:36.991194010 CEST	50538	21	192.168.2.16	196.210.0.111
May 8, 2024 08:41:37.000833035 CEST	50434	21	192.168.2.16	115.1.152.253
May 8, 2024 08:41:37.000847101 CEST	50470	2121	192.168.2.16	126.237.161.134
May 8, 2024 08:41:37.000848055 CEST	50494	2121	192.168.2.16	60.151.63.142
May 8, 2024 08:41:37.000849009 CEST	50408	2121	192.168.2.16	115.11.79.59
May 8, 2024 08:41:37.001924038 CEST	50431	2121	192.168.2.16	14.61.202.134
May 8, 2024 08:41:37.004213095 CEST	2121	50539	187.208.244.80	192.168.2.16
May 8, 2024 08:41:37.005819082 CEST	50493	21	192.168.2.16	60.151.63.142
May 8, 2024 08:41:37.005819082 CEST	50477	21	192.168.2.16	126.237.161.134
May 8, 2024 08:41:37.005826950 CEST	50430	21	192.168.2.16	14.61.202.134
May 8, 2024 08:41:37.016843081 CEST	50451	2121	192.168.2.16	23.27.21.247
May 8, 2024 08:41:37.016855001 CEST	50436	2121	192.168.2.16	115.1.152.253
May 8, 2024 08:41:37.016920090 CEST	50449	21	192.168.2.16	23.27.21.247
May 8, 2024 08:41:37.032860994 CEST	50452	2121	192.168.2.16	175.241.55.242
May 8, 2024 08:41:37.032881975 CEST	50507	21	192.168.2.16	118.46.121.98
May 8, 2024 08:41:37.032883883 CEST	50447	21	192.168.2.16	175.241.55.242
May 8, 2024 08:41:37.032890081 CEST	50363	2121	192.168.2.16	59.92.247.174
May 8, 2024 08:41:37.032890081 CEST	50497	21	192.168.2.16	121.190.67.79
May 8, 2024 08:41:37.048876047 CEST	50498	2121	192.168.2.16	121.190.67.79
May 8, 2024 08:41:37.048877954 CEST	50508	2121	192.168.2.16	118.46.121.98
May 8, 2024 08:41:37.048880100 CEST	50475	2121	192.168.2.16	36.26.159.46
May 8, 2024 08:41:37.057849884 CEST	2121	50398	168.81.231.66	192.168.2.16
May 8, 2024 08:41:37.086272955 CEST	2121	50548	34.149.79.8	192.168.2.16
May 8, 2024 08:41:37.086648941 CEST	2121	50551	34.149.79.8	192.168.2.16
May 8, 2024 08:41:37.086735964 CEST	50551	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:37.089131117 CEST	21	50549	34.149.79.8	192.168.2.16
May 8, 2024 08:41:37.089143991 CEST	21	50552	34.149.79.8	192.168.2.16
May 8, 2024 08:41:37.089206934 CEST	50552	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:37.096831083 CEST	50473	21	192.168.2.16	36.26.159.46
May 8, 2024 08:41:37.112864971 CEST	50491	21	192.168.2.16	113.24.67.53
May 8, 2024 08:41:37.112867117 CEST	50492	2121	192.168.2.16	113.24.67.53
May 8, 2024 08:41:37.114288092 CEST	21	50543	188.172.30.125	192.168.2.16
May 8, 2024 08:41:37.128880978 CEST	50488	21	192.168.2.16	210.131.155.110
May 8, 2024 08:41:37.156991005 CEST	2121	50546	188.172.30.125	192.168.2.16
May 8, 2024 08:41:37.159754038 CEST	21	50542	172.120.235.139	192.168.2.16
May 8, 2024 08:41:37.159831047 CEST	21	50556	172.120.235.139	192.168.2.16
May 8, 2024 08:41:37.159836054 CEST	50542	21	192.168.2.16	172.120.235.139
May 8, 2024 08:41:37.159892082 CEST	50556	21	192.168.2.16	172.120.235.139
May 8, 2024 08:41:37.161936045 CEST	21	50540	175.121.86.174	192.168.2.16
May 8, 2024 08:41:37.208969116 CEST	50399	21	192.168.2.16	47.236.184.40
May 8, 2024 08:41:37.225342989 CEST	50557	2121	192.168.2.16	173.176.244.243
May 8, 2024 08:41:37.227525949 CEST	2121	50541	175.121.86.174	192.168.2.16
May 8, 2024 08:41:37.239187002 CEST	21	50417	60.122.110.91	192.168.2.16
May 8, 2024 08:41:37.239649057 CEST	2121	50421	60.122.110.91	192.168.2.16
May 8, 2024 08:41:37.240073919 CEST	2121	50349	197.8.254.242	192.168.2.16
May 8, 2024 08:41:37.240303040 CEST	21	50348	197.8.254.242	192.168.2.16
May 8, 2024 08:41:37.240685940 CEST	50558	21	192.168.2.16	209.183.141.21
May 8, 2024 08:41:37.240720987 CEST	50559	2121	192.168.2.16	209.183.141.21
May 8, 2024 08:41:37.240838051 CEST	50422	2121	192.168.2.16	27.7.8.56
May 8, 2024 08:41:37.249377966 CEST	2121	50551	34.149.79.8	192.168.2.16
May 8, 2024 08:41:37.249439955 CEST	50551	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:37.249551058 CEST	50551	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:37.249809027 CEST	50560	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:37.251405001 CEST	21	50552	34.149.79.8	192.168.2.16
May 8, 2024 08:41:37.251466990 CEST	50552	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:37.251532078 CEST	50552	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:37.251694918 CEST	50561	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:37.270864010 CEST	21	50463	27.117.127.209	192.168.2.16
May 8, 2024 08:41:37.272881985 CEST	50518	21	192.168.2.16	60.137.5.118
May 8, 2024 08:41:37.282216072 CEST	2121	50464	27.117.127.209	192.168.2.16
May 8, 2024 08:41:37.302674055 CEST	2121	50494	60.151.63.142	192.168.2.16
May 8, 2024 08:41:37.303550005 CEST	21	50411	115.11.79.59	192.168.2.16
May 8, 2024 08:41:37.303646088 CEST	2121	50470	126.237.161.134	192.168.2.16
May 8, 2024 08:41:37.304475069 CEST	50562	21	192.168.2.16	117.122.241.177
May 8, 2024 08:41:37.304989100 CEST	21	50493	60.151.63.142	192.168.2.16
May 8, 2024 08:41:37.308331013 CEST	21	50477	126.237.161.134	192.168.2.16
May 8, 2024 08:41:37.317058086 CEST	21	50434	115.1.152.253	192.168.2.16
May 8, 2024 08:41:37.320166111 CEST	50563	2121	192.168.2.16	117.122.241.177
May 8, 2024 08:41:37.322143078 CEST	2121	50431	14.61.202.134	192.168.2.16
May 8, 2024 08:41:37.325995922 CEST	2121	50408	115.11.79.59	192.168.2.16
May 8, 2024 08:41:37.326194048 CEST	21	50430	14.61.202.134	192.168.2.16
May 8, 2024 08:41:37.328716993 CEST	2121	50451	23.27.21.247	192.168.2.16
May 8, 2024 08:41:37.332444906 CEST	21	50449	23.27.21.247	192.168.2.16
May 8, 2024 08:41:37.333585024 CEST	2121	50436	115.1.152.253	192.168.2.16
May 8, 2024 08:41:37.335874081 CEST	50519	2121	192.168.2.16	60.137.5.118
May 8, 2024 08:41:37.336316109 CEST	50564	21	192.168.2.16	83.76.172.75
May 8, 2024 08:41:37.340202093 CEST	21	50507	118.46.121.98	192.168.2.16
May 8, 2024 08:41:37.343384027 CEST	21	50497	121.190.67.79	192.168.2.16
May 8, 2024 08:41:37.351831913 CEST	50547	21	192.168.2.16	108.15.160.47
May 8, 2024 08:41:37.351861000 CEST	50521	21	192.168.2.16	220.95.156.86
May 8, 2024 08:41:37.354280949 CEST	2121	50452	175.241.55.242	192.168.2.16
May 8, 2024 08:41:37.358498096 CEST	21	50447	175.241.55.242	192.168.2.16
May 8, 2024 08:41:37.359662056 CEST	2121	50508	118.46.121.98	192.168.2.16
May 8, 2024 08:41:37.363799095 CEST	2121	50475	36.26.159.46	192.168.2.16
May 8, 2024 08:41:37.364200115 CEST	2121	50498	121.190.67.79	192.168.2.16
May 8, 2024 08:41:37.368385077 CEST	50565	2121	192.168.2.16	83.76.172.75
May 8, 2024 08:41:37.383284092 CEST	21	50556	172.120.235.139	192.168.2.16
May 8, 2024 08:41:37.383490086 CEST	50556	21	192.168.2.16	172.120.235.139
May 8, 2024 08:41:37.384453058 CEST	50566	2121	192.168.2.16	165.169.125.137
May 8, 2024 08:41:37.384490967 CEST	50567	21	192.168.2.16	74.215.88.154
May 8, 2024 08:41:37.384537935 CEST	50568	21	192.168.2.16	165.169.125.137
May 8, 2024 08:41:37.399868965 CEST	50440	2121	192.168.2.16	110.49.63.132
May 8, 2024 08:41:37.411885977 CEST	2121	50551	34.149.79.8	192.168.2.16
May 8, 2024 08:41:37.412237883 CEST	2121	50560	34.149.79.8	192.168.2.16
May 8, 2024 08:41:37.412311077 CEST	50560	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:37.413934946 CEST	21	50552	34.149.79.8	192.168.2.16
May 8, 2024 08:41:37.414515018 CEST	21	50561	34.149.79.8	192.168.2.16
May 8, 2024 08:41:37.414572954 CEST	50561	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:37.415849924 CEST	50397	21	192.168.2.16	168.81.231.66
May 8, 2024 08:41:37.415849924 CEST	50514	21	192.168.2.16	154.81.34.141
May 8, 2024 08:41:37.416124105 CEST	50569	2121	192.168.2.16	74.215.88.154
May 8, 2024 08:41:37.425515890 CEST	21	50343	77.75.121.3	192.168.2.16
May 8, 2024 08:41:37.425640106 CEST	50343	21	192.168.2.16	77.75.121.3
May 8, 2024 08:41:37.425801992 CEST	50570	21	192.168.2.16	77.75.121.3
May 8, 2024 08:41:37.427889109 CEST	21	50473	36.26.159.46	192.168.2.16
May 8, 2024 08:41:37.451543093 CEST	2121	50492	113.24.67.53	192.168.2.16
May 8, 2024 08:41:37.451984882 CEST	21	50491	113.24.67.53	192.168.2.16
May 8, 2024 08:41:37.463829041 CEST	50525	2121	192.168.2.16	220.95.156.86
May 8, 2024 08:41:37.472116947 CEST	2121	50363	59.92.247.174	192.168.2.16
May 8, 2024 08:41:37.472536087 CEST	21	50538	196.210.0.111	192.168.2.16
May 8, 2024 08:41:37.472560883 CEST	21	50538	196.210.0.111	192.168.2.16
May 8, 2024 08:41:37.472727060 CEST	50538	21	192.168.2.16	196.210.0.111
May 8, 2024 08:41:37.479863882 CEST	50402	2121	192.168.2.16	47.236.184.40
May 8, 2024 08:41:37.480040073 CEST	21	50488	210.131.155.110	192.168.2.16
May 8, 2024 08:41:37.496330023 CEST	50571	2121	192.168.2.16	168.100.203.193
May 8, 2024 08:41:37.496388912 CEST	50572	21	192.168.2.16	168.100.203.193
May 8, 2024 08:41:37.511848927 CEST	50539	2121	192.168.2.16	187.208.244.80
May 8, 2024 08:41:37.527831078 CEST	50403	21	192.168.2.16	104.121.16.7
May 8, 2024 08:41:37.527833939 CEST	50405	2121	192.168.2.16	220.71.176.141
May 8, 2024 08:41:37.527842045 CEST	50419	2121	192.168.2.16	84.26.50.147
May 8, 2024 08:41:37.527847052 CEST	50407	21	192.168.2.16	112.147.13.3
May 8, 2024 08:41:37.527847052 CEST	50409	2121	192.168.2.16	112.147.13.3
May 8, 2024 08:41:37.527848959 CEST	50406	2121	192.168.2.16	104.121.16.7
May 8, 2024 08:41:37.527848959 CEST	50413	21	192.168.2.16	178.192.70.16
May 8, 2024 08:41:37.527848959 CEST	50415	21	192.168.2.16	108.21.188.121
May 8, 2024 08:41:37.527853966 CEST	50404	21	192.168.2.16	220.71.176.141
May 8, 2024 08:41:37.527863979 CEST	50412	2121	192.168.2.16	79.147.28.191
May 8, 2024 08:41:37.527867079 CEST	50410	21	192.168.2.16	79.147.28.191
May 8, 2024 08:41:37.527869940 CEST	50414	2121	192.168.2.16	178.192.70.16
May 8, 2024 08:41:37.527869940 CEST	50420	21	192.168.2.16	27.7.8.56
May 8, 2024 08:41:37.527869940 CEST	50416	2121	192.168.2.16	108.21.188.121
May 8, 2024 08:41:37.530008078 CEST	50418	21	192.168.2.16	84.26.50.147
May 8, 2024 08:41:37.543839931 CEST	50424	21	192.168.2.16	46.89.57.220
May 8, 2024 08:41:37.543843031 CEST	50429	2121	192.168.2.16	71.192.97.248
May 8, 2024 08:41:37.543843985 CEST	50426	21	192.168.2.16	192.173.15.13
May 8, 2024 08:41:37.543844938 CEST	50423	2121	192.168.2.16	39.65.232.109
May 8, 2024 08:41:37.543859005 CEST	50427	2121	192.168.2.16	46.89.57.220
May 8, 2024 08:41:37.543859959 CEST	50425	2121	192.168.2.16	192.173.15.13
May 8, 2024 08:41:37.543859959 CEST	50428	21	192.168.2.16	71.192.97.248
May 8, 2024 08:41:37.543860912 CEST	50435	21	192.168.2.16	39.65.232.109
May 8, 2024 08:41:37.543863058 CEST	50433	2121	192.168.2.16	24.86.223.52
May 8, 2024 08:41:37.544425011 CEST	50432	21	192.168.2.16	24.86.223.52
May 8, 2024 08:41:37.559828997 CEST	50438	2121	192.168.2.16	151.224.102.22
May 8, 2024 08:41:37.559828997 CEST	50439	21	192.168.2.16	110.49.63.132
May 8, 2024 08:41:37.559838057 CEST	50437	21	192.168.2.16	151.224.102.22
May 8, 2024 08:41:37.559844017 CEST	50448	21	192.168.2.16	174.27.167.255
May 8, 2024 08:41:37.559844017 CEST	50446	2121	192.168.2.16	110.246.88.180
May 8, 2024 08:41:37.559845924 CEST	50442	2121	192.168.2.16	93.224.25.244
May 8, 2024 08:41:37.559847116 CEST	50444	2121	192.168.2.16	67.162.131.234
May 8, 2024 08:41:37.559847116 CEST	50441	21	192.168.2.16	93.224.25.244
May 8, 2024 08:41:37.560018063 CEST	50450	2121	192.168.2.16	174.27.167.255
May 8, 2024 08:41:37.560018063 CEST	50443	21	192.168.2.16	67.162.131.234
May 8, 2024 08:41:37.560018063 CEST	50398	2121	192.168.2.16	168.81.231.66
May 8, 2024 08:41:37.560020924 CEST	50445	21	192.168.2.16	110.246.88.180
May 8, 2024 08:41:37.565895081 CEST	21	50556	172.120.235.139	192.168.2.16
May 8, 2024 08:41:37.566230059 CEST	21	50556	172.120.235.139	192.168.2.16
May 8, 2024 08:41:37.566418886 CEST	50556	21	192.168.2.16	172.120.235.139
May 8, 2024 08:41:37.574805021 CEST	2121	50560	34.149.79.8	192.168.2.16
May 8, 2024 08:41:37.574892998 CEST	50560	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:37.575010061 CEST	50560	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:37.575300932 CEST	50573	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:37.575841904 CEST	50458	2121	192.168.2.16	218.56.222.188
May 8, 2024 08:41:37.575845957 CEST	50462	2121	192.168.2.16	86.30.180.122
May 8, 2024 08:41:37.575855970 CEST	50474	2121	192.168.2.16	24.131.164.226
May 8, 2024 08:41:37.575860023 CEST	50457	21	192.168.2.16	218.56.222.188
May 8, 2024 08:41:37.575860977 CEST	50453	21	192.168.2.16	73.25.54.119
May 8, 2024 08:41:37.575860023 CEST	50454	2121	192.168.2.16	73.25.54.119
May 8, 2024 08:41:37.575870991 CEST	50456	2121	192.168.2.16	60.53.210.99
May 8, 2024 08:41:37.575872898 CEST	50465	21	192.168.2.16	24.131.164.226
May 8, 2024 08:41:37.575875044 CEST	50461	21	192.168.2.16	86.30.180.122
May 8, 2024 08:41:37.575876951 CEST	50460	2121	192.168.2.16	125.120.130.52
May 8, 2024 08:41:37.575876951 CEST	50455	21	192.168.2.16	60.53.210.99
May 8, 2024 08:41:37.575891972 CEST	50467	21	192.168.2.16	122.173.239.62
May 8, 2024 08:41:37.575894117 CEST	50459	21	192.168.2.16	125.120.130.52
May 8, 2024 08:41:37.575894117 CEST	50466	21	192.168.2.16	134.238.198.128
May 8, 2024 08:41:37.575896025 CEST	50468	2121	192.168.2.16	134.238.198.128
May 8, 2024 08:41:37.575896025 CEST	50471	21	192.168.2.16	188.83.164.192
May 8, 2024 08:41:37.575898886 CEST	50476	21	192.168.2.16	78.101.135.91
May 8, 2024 08:41:37.575903893 CEST	50469	2121	192.168.2.16	122.173.239.62
May 8, 2024 08:41:37.576889992 CEST	50472	2121	192.168.2.16	188.83.164.192
May 8, 2024 08:41:37.577045918 CEST	21	50561	34.149.79.8	192.168.2.16
May 8, 2024 08:41:37.577095985 CEST	50561	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:37.577141047 CEST	50561	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:37.577277899 CEST	50574	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:37.583410025 CEST	21	50518	60.137.5.118	192.168.2.16
May 8, 2024 08:41:37.591824055 CEST	50479	21	192.168.2.16	183.99.74.58
May 8, 2024 08:41:37.591830969 CEST	50480	2121	192.168.2.16	183.99.74.58
May 8, 2024 08:41:37.591833115 CEST	50490	2121	192.168.2.16	210.131.155.110
May 8, 2024 08:41:37.591844082 CEST	50489	2121	192.168.2.16	69.255.145.154
May 8, 2024 08:41:37.591844082 CEST	50482	2121	192.168.2.16	119.185.119.239
May 8, 2024 08:41:37.591847897 CEST	50496	2121	192.168.2.16	189.106.23.71
May 8, 2024 08:41:37.591849089 CEST	50485	21	192.168.2.16	217.238.127.243
May 8, 2024 08:41:37.591850996 CEST	50481	21	192.168.2.16	119.185.119.239
May 8, 2024 08:41:37.591851950 CEST	50486	2121	192.168.2.16	217.238.127.243
May 8, 2024 08:41:37.591869116 CEST	50487	21	192.168.2.16	69.255.145.154
May 8, 2024 08:41:37.591876984 CEST	50500	2121	192.168.2.16	81.154.91.122
May 8, 2024 08:41:37.591876984 CEST	50478	2121	192.168.2.16	78.101.135.91
May 8, 2024 08:41:37.591876984 CEST	50499	21	192.168.2.16	81.154.91.122
May 8, 2024 08:41:37.591880083 CEST	50483	21	192.168.2.16	184.68.210.101
May 8, 2024 08:41:37.591880083 CEST	50484	2121	192.168.2.16	184.68.210.101
May 8, 2024 08:41:37.591880083 CEST	50495	21	192.168.2.16	189.106.23.71
May 8, 2024 08:41:37.592304945 CEST	50575	2121	192.168.2.16	217.121.103.26
May 8, 2024 08:41:37.592340946 CEST	50576	21	192.168.2.16	217.121.103.26
May 8, 2024 08:41:37.607866049 CEST	50501	2121	192.168.2.16	68.2.237.24
May 8, 2024 08:41:37.607867002 CEST	50503	21	192.168.2.16	181.208.58.40
May 8, 2024 08:41:37.607867956 CEST	50502	21	192.168.2.16	68.2.237.24
May 8, 2024 08:41:37.608489037 CEST	50504	2121	192.168.2.16	181.208.58.40
May 8, 2024 08:41:37.608491898 CEST	50506	2121	192.168.2.16	47.196.20.197
May 8, 2024 08:41:37.608498096 CEST	50505	21	192.168.2.16	47.196.20.197
May 8, 2024 08:41:37.609491110 CEST	21	50514	154.81.34.141	192.168.2.16
May 8, 2024 08:41:37.623840094 CEST	50510	21	192.168.2.16	20.172.220.30
May 8, 2024 08:41:37.623857975 CEST	50515	2121	192.168.2.16	154.81.34.141
May 8, 2024 08:41:37.623858929 CEST	50511	21	192.168.2.16	104.17.88.189
May 8, 2024 08:41:37.623858929 CEST	50513	2121	192.168.2.16	104.17.88.189
May 8, 2024 08:41:37.623859882 CEST	50543	21	192.168.2.16	188.172.30.125
May 8, 2024 08:41:37.624182940 CEST	50577	21	192.168.2.16	119.130.67.138
May 8, 2024 08:41:37.639849901 CEST	50512	2121	192.168.2.16	20.172.220.30
May 8, 2024 08:41:37.640275002 CEST	2121	50422	27.7.8.56	192.168.2.16
May 8, 2024 08:41:37.642846107 CEST	21	50562	117.122.241.177	192.168.2.16
May 8, 2024 08:41:37.647459984 CEST	2121	50519	60.137.5.118	192.168.2.16
May 8, 2024 08:41:37.650572062 CEST	2121	50563	117.122.241.177	192.168.2.16
May 8, 2024 08:41:37.662854910 CEST	21	50521	220.95.156.86	192.168.2.16
May 8, 2024 08:41:37.671847105 CEST	50546	2121	192.168.2.16	188.172.30.125
May 8, 2024 08:41:37.671848059 CEST	50540	21	192.168.2.16	175.121.86.174
May 8, 2024 08:41:37.733324051 CEST	21	50338	23.229.188.101	192.168.2.16
May 8, 2024 08:41:37.733530045 CEST	50338	21	192.168.2.16	23.229.188.101
May 8, 2024 08:41:37.733860016 CEST	50578	21	192.168.2.16	23.229.188.101
May 8, 2024 08:41:37.735857964 CEST	50541	2121	192.168.2.16	175.121.86.174
May 8, 2024 08:41:37.736156940 CEST	21	50570	77.75.121.3	192.168.2.16
May 8, 2024 08:41:37.736233950 CEST	50570	21	192.168.2.16	77.75.121.3
May 8, 2024 08:41:37.737345934 CEST	2121	50560	34.149.79.8	192.168.2.16
May 8, 2024 08:41:37.737711906 CEST	2121	50573	34.149.79.8	192.168.2.16
May 8, 2024 08:41:37.737765074 CEST	50573	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:37.739556074 CEST	21	50561	34.149.79.8	192.168.2.16
May 8, 2024 08:41:37.739626884 CEST	21	50574	34.149.79.8	192.168.2.16
May 8, 2024 08:41:37.739689112 CEST	50574	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:37.741143942 CEST	21	50343	77.75.121.3	192.168.2.16
May 8, 2024 08:41:37.741195917 CEST	50343	21	192.168.2.16	77.75.121.3
May 8, 2024 08:41:37.741493940 CEST	21	50343	77.75.121.3	192.168.2.16
May 8, 2024 08:41:37.741542101 CEST	50343	21	192.168.2.16	77.75.121.3
May 8, 2024 08:41:37.751858950 CEST	50421	2121	192.168.2.16	60.122.110.91
May 8, 2024 08:41:37.751892090 CEST	50417	21	192.168.2.16	60.122.110.91
May 8, 2024 08:41:37.757162094 CEST	21	50397	168.81.231.66	192.168.2.16
May 8, 2024 08:41:37.757985115 CEST	2121	50539	187.208.244.80	192.168.2.16
May 8, 2024 08:41:37.768204927 CEST	50579	2121	192.168.2.16	119.130.67.138
May 8, 2024 08:41:37.776108027 CEST	21	50556	172.120.235.139	192.168.2.16
May 8, 2024 08:41:37.776252031 CEST	50556	21	192.168.2.16	172.120.235.139
May 8, 2024 08:41:37.776475906 CEST	50580	21	192.168.2.16	172.120.235.139
May 8, 2024 08:41:37.780148983 CEST	2121	50525	220.95.156.86	192.168.2.16
May 8, 2024 08:41:37.783231974 CEST	50463	21	192.168.2.16	27.117.127.209
May 8, 2024 08:41:37.783235073 CEST	50581	21	192.168.2.16	99.245.238.42
May 8, 2024 08:41:37.797862053 CEST	50464	2121	192.168.2.16	27.117.127.209
May 8, 2024 08:41:37.813824892 CEST	50494	2121	192.168.2.16	60.151.63.142
May 8, 2024 08:41:37.813827038 CEST	50493	21	192.168.2.16	60.151.63.142
May 8, 2024 08:41:37.813982964 CEST	50477	21	192.168.2.16	126.237.161.134
May 8, 2024 08:41:37.814023972 CEST	50411	21	192.168.2.16	115.11.79.59
May 8, 2024 08:41:37.814116001 CEST	50470	2121	192.168.2.16	126.237.161.134
May 8, 2024 08:41:37.829839945 CEST	50434	21	192.168.2.16	115.1.152.253
May 8, 2024 08:41:37.829849958 CEST	50430	21	192.168.2.16	14.61.202.134
May 8, 2024 08:41:37.829855919 CEST	50431	2121	192.168.2.16	14.61.202.134
May 8, 2024 08:41:37.829855919 CEST	50451	2121	192.168.2.16	23.27.21.247
May 8, 2024 08:41:37.829855919 CEST	50408	2121	192.168.2.16	115.11.79.59
May 8, 2024 08:41:37.830148935 CEST	50582	2121	192.168.2.16	99.245.238.42
May 8, 2024 08:41:37.845823050 CEST	50436	2121	192.168.2.16	115.1.152.253
May 8, 2024 08:41:37.845839977 CEST	50497	21	192.168.2.16	121.190.67.79
May 8, 2024 08:41:37.845839977 CEST	50507	21	192.168.2.16	118.46.121.98
May 8, 2024 08:41:37.845839977 CEST	50449	21	192.168.2.16	23.27.21.247
May 8, 2024 08:41:37.846173048 CEST	2121	50440	110.49.63.132	192.168.2.16
May 8, 2024 08:41:37.861823082 CEST	50452	2121	192.168.2.16	175.241.55.242
May 8, 2024 08:41:37.861841917 CEST	50447	21	192.168.2.16	175.241.55.242
May 8, 2024 08:41:37.861844063 CEST	50508	2121	192.168.2.16	118.46.121.98
May 8, 2024 08:41:37.877823114 CEST	50520	21	192.168.2.16	116.33.122.235
May 8, 2024 08:41:37.877825022 CEST	50475	2121	192.168.2.16	36.26.159.46
May 8, 2024 08:41:37.877846956 CEST	50498	2121	192.168.2.16	121.190.67.79
May 8, 2024 08:41:37.900229931 CEST	2121	50573	34.149.79.8	192.168.2.16
May 8, 2024 08:41:37.900314093 CEST	50573	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:37.900445938 CEST	50573	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:37.900598049 CEST	2121	50398	168.81.231.66	192.168.2.16
May 8, 2024 08:41:37.900787115 CEST	50583	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:37.901014090 CEST	50584	21	192.168.2.16	122.117.36.51
May 8, 2024 08:41:37.902122974 CEST	21	50574	34.149.79.8	192.168.2.16
May 8, 2024 08:41:37.902184010 CEST	50574	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:37.902240992 CEST	50574	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:37.902401924 CEST	50585	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:37.909858942 CEST	50550	2121	192.168.2.16	108.15.160.47
May 8, 2024 08:41:37.924839973 CEST	50522	2121	192.168.2.16	116.33.122.235
May 8, 2024 08:41:37.929572105 CEST	21	50578	23.229.188.101	192.168.2.16
May 8, 2024 08:41:37.929646969 CEST	50578	21	192.168.2.16	23.229.188.101
May 8, 2024 08:41:37.939004898 CEST	21	50338	23.229.188.101	192.168.2.16
May 8, 2024 08:41:37.939062119 CEST	50338	21	192.168.2.16	23.229.188.101
May 8, 2024 08:41:37.940291882 CEST	21	50338	23.229.188.101	192.168.2.16
May 8, 2024 08:41:37.940341949 CEST	50338	21	192.168.2.16	23.229.188.101
May 8, 2024 08:41:37.940824032 CEST	50553	21	192.168.2.16	101.80.45.13
May 8, 2024 08:41:37.940824032 CEST	50473	21	192.168.2.16	36.26.159.46
May 8, 2024 08:41:37.940850973 CEST	50554	2121	192.168.2.16	101.80.45.13
May 8, 2024 08:41:37.946244955 CEST	21	50337	38.38.120.85	192.168.2.16
May 8, 2024 08:41:37.946393967 CEST	50337	21	192.168.2.16	38.38.120.85
May 8, 2024 08:41:37.946638107 CEST	50586	21	192.168.2.16	38.38.120.85
May 8, 2024 08:41:37.955842972 CEST	50492	2121	192.168.2.16	113.24.67.53
May 8, 2024 08:41:37.955842972 CEST	50491	21	192.168.2.16	113.24.67.53
May 8, 2024 08:41:37.958019018 CEST	21	50556	172.120.235.139	192.168.2.16
May 8, 2024 08:41:37.958071947 CEST	50556	21	192.168.2.16	172.120.235.139
May 8, 2024 08:41:37.958149910 CEST	21	50580	172.120.235.139	192.168.2.16
May 8, 2024 08:41:37.958205938 CEST	50580	21	192.168.2.16	172.120.235.139
May 8, 2024 08:41:37.961971045 CEST	21	50540	175.121.86.174	192.168.2.16
May 8, 2024 08:41:37.971847057 CEST	50555	21	192.168.2.16	173.176.244.243
May 8, 2024 08:41:37.987225056 CEST	50488	21	192.168.2.16	210.131.155.110
May 8, 2024 08:41:37.987569094 CEST	21	50538	196.210.0.111	192.168.2.16
May 8, 2024 08:41:38.043566942 CEST	2121	50541	175.121.86.174	192.168.2.16
May 8, 2024 08:41:38.049177885 CEST	21	50570	77.75.121.3	192.168.2.16
May 8, 2024 08:41:38.049421072 CEST	50570	21	192.168.2.16	77.75.121.3
May 8, 2024 08:41:38.051207066 CEST	50587	2121	192.168.2.16	122.117.36.51
May 8, 2024 08:41:38.054136992 CEST	21	50417	60.122.110.91	192.168.2.16
May 8, 2024 08:41:38.054595947 CEST	50588	21	192.168.2.16	18.238.193.209
May 8, 2024 08:41:38.054657936 CEST	2121	50421	60.122.110.91	192.168.2.16
May 8, 2024 08:41:38.055304050 CEST	50589	2121	192.168.2.16	18.238.193.209
May 8, 2024 08:41:38.062783003 CEST	2121	50573	34.149.79.8	192.168.2.16
May 8, 2024 08:41:38.063144922 CEST	2121	50583	34.149.79.8	192.168.2.16
May 8, 2024 08:41:38.063220978 CEST	50583	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:38.064660072 CEST	21	50574	34.149.79.8	192.168.2.16
May 8, 2024 08:41:38.064766884 CEST	21	50585	34.149.79.8	192.168.2.16
May 8, 2024 08:41:38.064836979 CEST	50585	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:38.067243099 CEST	50590	21	192.168.2.16	47.147.17.78
May 8, 2024 08:41:38.067300081 CEST	50591	2121	192.168.2.16	47.147.17.78
May 8, 2024 08:41:38.078316927 CEST	21	50463	27.117.127.209	192.168.2.16
May 8, 2024 08:41:38.095957994 CEST	2121	50464	27.117.127.209	192.168.2.16
May 8, 2024 08:41:38.097842932 CEST	50518	21	192.168.2.16	60.137.5.118
May 8, 2024 08:41:38.098320007 CEST	50592	21	192.168.2.16	105.98.9.48
May 8, 2024 08:41:38.098448038 CEST	50593	2121	192.168.2.16	105.98.9.48
May 8, 2024 08:41:38.113253117 CEST	21	50493	60.151.63.142	192.168.2.16
May 8, 2024 08:41:38.114370108 CEST	50594	21	192.168.2.16	31.167.145.83
May 8, 2024 08:41:38.115540981 CEST	2121	50494	60.151.63.142	192.168.2.16
May 8, 2024 08:41:38.116722107 CEST	21	50477	126.237.161.134	192.168.2.16
May 8, 2024 08:41:38.117222071 CEST	2121	50470	126.237.161.134	192.168.2.16
May 8, 2024 08:41:38.125874043 CEST	21	50578	23.229.188.101	192.168.2.16
May 8, 2024 08:41:38.126075983 CEST	50578	21	192.168.2.16	23.229.188.101
May 8, 2024 08:41:38.130610943 CEST	50595	2121	192.168.2.16	31.167.145.83
May 8, 2024 08:41:38.130738974 CEST	50596	21	192.168.2.16	98.53.167.176
May 8, 2024 08:41:38.130840063 CEST	50597	2121	192.168.2.16	98.53.167.176
May 8, 2024 08:41:38.130851984 CEST	50598	21	192.168.2.16	175.228.191.237
May 8, 2024 08:41:38.130994081 CEST	50599	2121	192.168.2.16	175.228.191.237
May 8, 2024 08:41:38.131048918 CEST	50600	21	192.168.2.16	87.56.22.23
May 8, 2024 08:41:38.131078959 CEST	50601	2121	192.168.2.16	87.56.22.23
May 8, 2024 08:41:38.133071899 CEST	21	50411	115.11.79.59	192.168.2.16
May 8, 2024 08:41:38.138549089 CEST	21	50337	38.38.120.85	192.168.2.16
May 8, 2024 08:41:38.138605118 CEST	50337	21	192.168.2.16	38.38.120.85
May 8, 2024 08:41:38.138771057 CEST	21	50586	38.38.120.85	192.168.2.16
May 8, 2024 08:41:38.138833046 CEST	50586	21	192.168.2.16	38.38.120.85
May 8, 2024 08:41:38.139271021 CEST	21	50337	38.38.120.85	192.168.2.16
May 8, 2024 08:41:38.139317036 CEST	50337	21	192.168.2.16	38.38.120.85
May 8, 2024 08:41:38.141774893 CEST	2121	50451	23.27.21.247	192.168.2.16
May 8, 2024 08:41:38.145836115 CEST	50562	21	192.168.2.16	117.122.241.177
May 8, 2024 08:41:38.145848989 CEST	50422	2121	192.168.2.16	27.7.8.56
May 8, 2024 08:41:38.146178007 CEST	21	50434	115.1.152.253	192.168.2.16
May 8, 2024 08:41:38.146311998 CEST	50602	21	192.168.2.16	80.184.105.246
May 8, 2024 08:41:38.146322966 CEST	50603	2121	192.168.2.16	80.184.105.246
May 8, 2024 08:41:38.146425962 CEST	50604	21	192.168.2.16	220.94.220.101
May 8, 2024 08:41:38.146527052 CEST	50605	2121	192.168.2.16	220.94.220.101
May 8, 2024 08:41:38.150237083 CEST	21	50430	14.61.202.134	192.168.2.16
May 8, 2024 08:41:38.150537014 CEST	2121	50431	14.61.202.134	192.168.2.16
May 8, 2024 08:41:38.152641058 CEST	21	50507	118.46.121.98	192.168.2.16
May 8, 2024 08:41:38.153234005 CEST	21	50543	188.172.30.125	192.168.2.16
May 8, 2024 08:41:38.155956984 CEST	2121	50408	115.11.79.59	192.168.2.16
May 8, 2024 08:41:38.156907082 CEST	21	50497	121.190.67.79	192.168.2.16
May 8, 2024 08:41:38.161431074 CEST	21	50449	23.27.21.247	192.168.2.16
May 8, 2024 08:41:38.161827087 CEST	50563	2121	192.168.2.16	117.122.241.177
May 8, 2024 08:41:38.161844015 CEST	50519	2121	192.168.2.16	60.137.5.118
May 8, 2024 08:41:38.162337065 CEST	50606	21	192.168.2.16	189.82.4.46
May 8, 2024 08:41:38.162400961 CEST	50607	21	192.168.2.16	93.211.90.41
May 8, 2024 08:41:38.162503958 CEST	50608	2121	192.168.2.16	189.82.4.46
May 8, 2024 08:41:38.162686110 CEST	2121	50436	115.1.152.253	192.168.2.16
May 8, 2024 08:41:38.172885895 CEST	2121	50508	118.46.121.98	192.168.2.16
May 8, 2024 08:41:38.173171997 CEST	50609	2121	192.168.2.16	93.211.90.41
May 8, 2024 08:41:38.176820040 CEST	50526	21	192.168.2.16	85.167.167.80
May 8, 2024 08:41:38.176877022 CEST	50521	21	192.168.2.16	220.95.156.86
May 8, 2024 08:41:38.177392006 CEST	50610	21	192.168.2.16	174.57.15.124
May 8, 2024 08:41:38.177531958 CEST	50611	2121	192.168.2.16	174.57.15.124
May 8, 2024 08:41:38.177638054 CEST	50612	21	192.168.2.16	201.50.159.167
May 8, 2024 08:41:38.177694082 CEST	50613	21	192.168.2.16	93.200.149.130
May 8, 2024 08:41:38.177759886 CEST	50615	2121	192.168.2.16	93.200.149.130
May 8, 2024 08:41:38.177813053 CEST	50614	2121	192.168.2.16	201.50.159.167
May 8, 2024 08:41:38.181229115 CEST	21	50580	172.120.235.139	192.168.2.16
May 8, 2024 08:41:38.181349993 CEST	50580	21	192.168.2.16	172.120.235.139
May 8, 2024 08:41:38.182585955 CEST	2121	50452	175.241.55.242	192.168.2.16
May 8, 2024 08:41:38.186965942 CEST	21	50447	175.241.55.242	192.168.2.16
May 8, 2024 08:41:38.193159103 CEST	2121	50498	121.190.67.79	192.168.2.16
May 8, 2024 08:41:38.193228960 CEST	50616	21	192.168.2.16	75.203.63.250
May 8, 2024 08:41:38.193434954 CEST	50617	2121	192.168.2.16	75.203.63.250
May 8, 2024 08:41:38.193496943 CEST	50618	21	192.168.2.16	24.240.231.180
May 8, 2024 08:41:38.194062948 CEST	2121	50475	36.26.159.46	192.168.2.16
May 8, 2024 08:41:38.209366083 CEST	50619	21	192.168.2.16	94.248.198.31
May 8, 2024 08:41:38.209403038 CEST	50620	2121	192.168.2.16	94.248.198.31
May 8, 2024 08:41:38.209578037 CEST	50621	2121	192.168.2.16	24.240.231.180
May 8, 2024 08:41:38.209642887 CEST	50622	21	192.168.2.16	121.188.219.78
May 8, 2024 08:41:38.212728977 CEST	2121	50546	188.172.30.125	192.168.2.16
May 8, 2024 08:41:38.216610909 CEST	21	50584	122.117.36.51	192.168.2.16
May 8, 2024 08:41:38.225755930 CEST	50623	2121	192.168.2.16	121.188.219.78
May 8, 2024 08:41:38.225842953 CEST	50624	21	192.168.2.16	182.210.166.181
May 8, 2024 08:41:38.225984097 CEST	50625	2121	192.168.2.16	182.210.166.181
May 8, 2024 08:41:38.226022005 CEST	50626	21	192.168.2.16	96.5.195.29
May 8, 2024 08:41:38.226175070 CEST	50627	2121	192.168.2.16	96.5.195.29
May 8, 2024 08:41:38.227345943 CEST	21	50585	34.149.79.8	192.168.2.16
May 8, 2024 08:41:38.227411985 CEST	50585	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:38.227453947 CEST	50585	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:38.227591991 CEST	50628	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:38.233402967 CEST	2121	50583	34.149.79.8	192.168.2.16
May 8, 2024 08:41:38.233453035 CEST	50583	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:38.233541012 CEST	50583	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:38.233756065 CEST	50629	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:38.240856886 CEST	50557	2121	192.168.2.16	173.176.244.243
May 8, 2024 08:41:38.240856886 CEST	50558	21	192.168.2.16	209.183.141.21
May 8, 2024 08:41:38.241252899 CEST	50630	21	192.168.2.16	222.134.112.234
May 8, 2024 08:41:38.241288900 CEST	50631	2121	192.168.2.16	222.134.112.234
May 8, 2024 08:41:38.255889893 CEST	50559	2121	192.168.2.16	209.183.141.21
May 8, 2024 08:41:38.271856070 CEST	50539	2121	192.168.2.16	187.208.244.80
May 8, 2024 08:41:38.272147894 CEST	21	50473	36.26.159.46	192.168.2.16
May 8, 2024 08:41:38.272524118 CEST	50632	21	192.168.2.16	118.241.147.202
May 8, 2024 08:41:38.272526026 CEST	50633	2121	192.168.2.16	118.241.147.202
May 8, 2024 08:41:38.272706032 CEST	50634	21	192.168.2.16	203.169.193.41
May 8, 2024 08:41:38.287827969 CEST	50525	2121	192.168.2.16	220.95.156.86
May 8, 2024 08:41:38.293698072 CEST	2121	50492	113.24.67.53	192.168.2.16
May 8, 2024 08:41:38.293744087 CEST	21	50491	113.24.67.53	192.168.2.16
May 8, 2024 08:41:38.294075966 CEST	50635	2121	192.168.2.16	203.169.193.41
May 8, 2024 08:41:38.304073095 CEST	50529	2121	192.168.2.16	85.167.167.80
May 8, 2024 08:41:38.304316998 CEST	50636	21	192.168.2.16	117.223.205.236
May 8, 2024 08:41:38.320167065 CEST	50637	2121	192.168.2.16	117.223.205.236
May 8, 2024 08:41:38.321069956 CEST	21	50578	23.229.188.101	192.168.2.16
May 8, 2024 08:41:38.321142912 CEST	21	50578	23.229.188.101	192.168.2.16
May 8, 2024 08:41:38.321332932 CEST	50578	21	192.168.2.16	23.229.188.101
May 8, 2024 08:41:38.323354959 CEST	21	50488	210.131.155.110	192.168.2.16
May 8, 2024 08:41:38.333132982 CEST	21	50586	38.38.120.85	192.168.2.16
May 8, 2024 08:41:38.333267927 CEST	50586	21	192.168.2.16	38.38.120.85
May 8, 2024 08:41:38.335642099 CEST	50638	21	192.168.2.16	196.185.118.50
May 8, 2024 08:41:38.335704088 CEST	50639	2121	192.168.2.16	196.185.118.50
May 8, 2024 08:41:38.335753918 CEST	50640	21	192.168.2.16	173.94.208.111
May 8, 2024 08:41:38.335897923 CEST	50641	2121	192.168.2.16	173.94.208.111
May 8, 2024 08:41:38.350867033 CEST	50564	21	192.168.2.16	83.76.172.75
May 8, 2024 08:41:38.351138115 CEST	50440	2121	192.168.2.16	110.49.63.132
May 8, 2024 08:41:38.359873056 CEST	21	50570	77.75.121.3	192.168.2.16
May 8, 2024 08:41:38.359922886 CEST	21	50570	77.75.121.3	192.168.2.16
May 8, 2024 08:41:38.360054970 CEST	50570	21	192.168.2.16	77.75.121.3
May 8, 2024 08:41:38.363076925 CEST	21	50580	172.120.235.139	192.168.2.16
May 8, 2024 08:41:38.363405943 CEST	21	50580	172.120.235.139	192.168.2.16
May 8, 2024 08:41:38.363535881 CEST	50580	21	192.168.2.16	172.120.235.139
May 8, 2024 08:41:38.367826939 CEST	2121	50587	122.117.36.51	192.168.2.16
May 8, 2024 08:41:38.382519960 CEST	50642	2121	192.168.2.16	71.28.130.111
May 8, 2024 08:41:38.382586956 CEST	50643	21	192.168.2.16	71.28.130.111
May 8, 2024 08:41:38.382900000 CEST	50565	2121	192.168.2.16	83.76.172.75
May 8, 2024 08:41:38.383163929 CEST	50644	21	192.168.2.16	118.201.139.137
May 8, 2024 08:41:38.389755964 CEST	21	50628	34.149.79.8	192.168.2.16
May 8, 2024 08:41:38.389847994 CEST	50628	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:38.389873028 CEST	21	50585	34.149.79.8	192.168.2.16
May 8, 2024 08:41:38.395966053 CEST	2121	50583	34.149.79.8	192.168.2.16
May 8, 2024 08:41:38.396153927 CEST	2121	50629	34.149.79.8	192.168.2.16
May 8, 2024 08:41:38.396207094 CEST	50629	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:38.397833109 CEST	50566	2121	192.168.2.16	165.169.125.137
May 8, 2024 08:41:38.397850037 CEST	50567	21	192.168.2.16	74.215.88.154
May 8, 2024 08:41:38.397866011 CEST	50568	21	192.168.2.16	165.169.125.137
May 8, 2024 08:41:38.408124924 CEST	21	50518	60.137.5.118	192.168.2.16
May 8, 2024 08:41:38.429843903 CEST	50569	2121	192.168.2.16	74.215.88.154
May 8, 2024 08:41:38.430258036 CEST	50645	2121	192.168.2.16	118.201.139.137
May 8, 2024 08:41:38.442817926 CEST	2121	50627	96.5.195.29	192.168.2.16
May 8, 2024 08:41:38.442835093 CEST	21	50626	96.5.195.29	192.168.2.16
May 8, 2024 08:41:38.446361065 CEST	50646	21	192.168.2.16	114.199.191.58
May 8, 2024 08:41:38.446446896 CEST	21	50598	175.228.191.237	192.168.2.16
May 8, 2024 08:41:38.446952105 CEST	2121	50599	175.228.191.237	192.168.2.16
May 8, 2024 08:41:38.458707094 CEST	21	50604	220.94.220.101	192.168.2.16
May 8, 2024 08:41:38.466169119 CEST	2121	50605	220.94.220.101	192.168.2.16
May 8, 2024 08:41:38.473377943 CEST	2121	50519	60.137.5.118	192.168.2.16
May 8, 2024 08:41:38.476975918 CEST	50540	21	192.168.2.16	175.121.86.174
May 8, 2024 08:41:38.477191925 CEST	50647	2121	192.168.2.16	114.199.191.58
May 8, 2024 08:41:38.480581045 CEST	21	50562	117.122.241.177	192.168.2.16
May 8, 2024 08:41:38.487484932 CEST	21	50521	220.95.156.86	192.168.2.16
May 8, 2024 08:41:38.493182898 CEST	50648	21	192.168.2.16	96.110.124.89
May 8, 2024 08:41:38.494414091 CEST	2121	50563	117.122.241.177	192.168.2.16
May 8, 2024 08:41:38.498646975 CEST	2121	50595	31.167.145.83	192.168.2.16
May 8, 2024 08:41:38.507836103 CEST	50571	2121	192.168.2.16	168.100.203.193
May 8, 2024 08:41:38.508132935 CEST	50572	21	192.168.2.16	168.100.203.193
May 8, 2024 08:41:38.508135080 CEST	50649	2121	192.168.2.16	96.110.124.89
May 8, 2024 08:41:38.518951893 CEST	2121	50539	187.208.244.80	192.168.2.16
May 8, 2024 08:41:38.522257090 CEST	21	50622	121.188.219.78	192.168.2.16
May 8, 2024 08:41:38.524255991 CEST	50650	21	192.168.2.16	149.165.129.10
May 8, 2024 08:41:38.525443077 CEST	21	50586	38.38.120.85	192.168.2.16
May 8, 2024 08:41:38.525499105 CEST	21	50586	38.38.120.85	192.168.2.16
May 8, 2024 08:41:38.525657892 CEST	50586	21	192.168.2.16	38.38.120.85
May 8, 2024 08:41:38.539060116 CEST	2121	50623	121.188.219.78	192.168.2.16
May 8, 2024 08:41:38.540349960 CEST	50651	2121	192.168.2.16	149.165.129.10
May 8, 2024 08:41:38.540385008 CEST	50652	21	192.168.2.16	117.55.191.68
May 8, 2024 08:41:38.545408964 CEST	2121	50422	27.7.8.56	192.168.2.16
May 8, 2024 08:41:38.552191019 CEST	21	50628	34.149.79.8	192.168.2.16
May 8, 2024 08:41:38.552251101 CEST	50628	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:38.552320004 CEST	50628	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:38.552481890 CEST	50653	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:38.555835962 CEST	50541	2121	192.168.2.16	175.121.86.174
May 8, 2024 08:41:38.556448936 CEST	50654	2121	192.168.2.16	117.55.191.68
May 8, 2024 08:41:38.556546926 CEST	50655	21	192.168.2.16	185.187.236.74
May 8, 2024 08:41:38.557277918 CEST	21	50578	23.229.188.101	192.168.2.16
May 8, 2024 08:41:38.558657885 CEST	2121	50629	34.149.79.8	192.168.2.16
May 8, 2024 08:41:38.558708906 CEST	50629	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:38.558784962 CEST	50629	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:38.558805943 CEST	2121	50633	118.241.147.202	192.168.2.16
May 8, 2024 08:41:38.559029102 CEST	50656	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:38.573841095 CEST	21	50580	172.120.235.139	192.168.2.16
May 8, 2024 08:41:38.573973894 CEST	50580	21	192.168.2.16	172.120.235.139
May 8, 2024 08:41:38.574162006 CEST	50657	21	192.168.2.16	172.120.235.139
May 8, 2024 08:41:38.603924036 CEST	50576	21	192.168.2.16	217.121.103.26
May 8, 2024 08:41:38.603926897 CEST	50531	21	192.168.2.16	2.217.228.54
May 8, 2024 08:41:38.603929043 CEST	50575	2121	192.168.2.16	217.121.103.26
May 8, 2024 08:41:38.604219913 CEST	2121	50525	220.95.156.86	192.168.2.16
May 8, 2024 08:41:38.604676008 CEST	50658	2121	192.168.2.16	185.187.236.74
May 8, 2024 08:41:38.635848999 CEST	50577	21	192.168.2.16	119.130.67.138
May 8, 2024 08:41:38.667833090 CEST	50543	21	192.168.2.16	188.172.30.125
May 8, 2024 08:41:38.700171947 CEST	2121	50639	196.185.118.50	192.168.2.16
May 8, 2024 08:41:38.701747894 CEST	21	50638	196.185.118.50	192.168.2.16
May 8, 2024 08:41:38.710045099 CEST	21	50570	77.75.121.3	192.168.2.16
May 8, 2024 08:41:38.714510918 CEST	21	50628	34.149.79.8	192.168.2.16
May 8, 2024 08:41:38.714907885 CEST	21	50653	34.149.79.8	192.168.2.16
May 8, 2024 08:41:38.714983940 CEST	50653	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:38.715853930 CEST	50546	2121	192.168.2.16	188.172.30.125
May 8, 2024 08:41:38.721221924 CEST	2121	50629	34.149.79.8	192.168.2.16
May 8, 2024 08:41:38.721354008 CEST	2121	50656	34.149.79.8	192.168.2.16
May 8, 2024 08:41:38.721421957 CEST	50656	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:38.731858969 CEST	50584	21	192.168.2.16	122.117.36.51
May 8, 2024 08:41:38.750418901 CEST	50659	21	192.168.2.16	150.249.78.235
May 8, 2024 08:41:38.755980015 CEST	21	50657	172.120.235.139	192.168.2.16
May 8, 2024 08:41:38.756037951 CEST	21	50580	172.120.235.139	192.168.2.16
May 8, 2024 08:41:38.756056070 CEST	50657	21	192.168.2.16	172.120.235.139
May 8, 2024 08:41:38.756088018 CEST	50580	21	192.168.2.16	172.120.235.139
May 8, 2024 08:41:38.757781029 CEST	21	50586	38.38.120.85	192.168.2.16
May 8, 2024 08:41:38.763302088 CEST	50660	2121	192.168.2.16	150.249.78.235
May 8, 2024 08:41:38.763328075 CEST	50661	21	192.168.2.16	23.199.47.76
May 8, 2024 08:41:38.765958071 CEST	21	50540	175.121.86.174	192.168.2.16
May 8, 2024 08:41:38.778872013 CEST	50579	2121	192.168.2.16	119.130.67.138
May 8, 2024 08:41:38.779280901 CEST	50662	2121	192.168.2.16	23.199.47.76
May 8, 2024 08:41:38.794856071 CEST	50581	21	192.168.2.16	99.245.238.42
May 8, 2024 08:41:38.798239946 CEST	2121	50440	110.49.63.132	192.168.2.16
May 8, 2024 08:41:38.811606884 CEST	50663	21	192.168.2.16	182.215.181.166
May 8, 2024 08:41:38.826848030 CEST	50534	2121	192.168.2.16	2.217.228.54
May 8, 2024 08:41:38.829483032 CEST	21	50636	117.223.205.236	192.168.2.16
May 8, 2024 08:41:38.829560041 CEST	50636	21	192.168.2.16	117.223.205.236
May 8, 2024 08:41:38.836826086 CEST	2121	50637	117.223.205.236	192.168.2.16
May 8, 2024 08:41:38.842849970 CEST	50582	2121	192.168.2.16	99.245.238.42
May 8, 2024 08:41:38.863606930 CEST	2121	50541	175.121.86.174	192.168.2.16
May 8, 2024 08:41:38.874869108 CEST	50587	2121	192.168.2.16	122.117.36.51
May 8, 2024 08:41:38.877471924 CEST	21	50653	34.149.79.8	192.168.2.16
May 8, 2024 08:41:38.877547026 CEST	50653	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:38.877634048 CEST	50653	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:38.877892971 CEST	50664	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:38.883877993 CEST	2121	50656	34.149.79.8	192.168.2.16
May 8, 2024 08:41:38.883955956 CEST	50656	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:38.884082079 CEST	50656	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:38.884381056 CEST	50665	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:38.954845905 CEST	50626	21	192.168.2.16	96.5.195.29
May 8, 2024 08:41:38.955441952 CEST	50599	2121	192.168.2.16	175.228.191.237
May 8, 2024 08:41:38.955446005 CEST	50627	2121	192.168.2.16	96.5.195.29
May 8, 2024 08:41:38.955446959 CEST	50598	21	192.168.2.16	175.228.191.237
May 8, 2024 08:41:38.958317041 CEST	21	50538	196.210.0.111	192.168.2.16
May 8, 2024 08:41:38.958513975 CEST	50538	21	192.168.2.16	196.210.0.111
May 8, 2024 08:41:38.958770037 CEST	50666	21	192.168.2.16	196.210.0.111
May 8, 2024 08:41:38.970859051 CEST	50605	2121	192.168.2.16	220.94.220.101
May 8, 2024 08:41:38.970863104 CEST	50604	21	192.168.2.16	220.94.220.101
May 8, 2024 08:41:38.979882002 CEST	21	50657	172.120.235.139	192.168.2.16
May 8, 2024 08:41:38.980026960 CEST	50657	21	192.168.2.16	172.120.235.139
May 8, 2024 08:41:38.986828089 CEST	50537	21	192.168.2.16	187.208.244.80
May 8, 2024 08:41:38.986826897 CEST	50562	21	192.168.2.16	117.122.241.177
May 8, 2024 08:41:39.005825043 CEST	50563	2121	192.168.2.16	117.122.241.177
May 8, 2024 08:41:39.005995989 CEST	50595	2121	192.168.2.16	31.167.145.83
May 8, 2024 08:41:39.033829927 CEST	50622	21	192.168.2.16	121.188.219.78
May 8, 2024 08:41:39.033855915 CEST	50539	2121	192.168.2.16	187.208.244.80
May 8, 2024 08:41:39.042267084 CEST	21	50653	34.149.79.8	192.168.2.16
May 8, 2024 08:41:39.042572975 CEST	21	50664	34.149.79.8	192.168.2.16
May 8, 2024 08:41:39.042639017 CEST	50664	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:39.046648026 CEST	21	50584	122.117.36.51	192.168.2.16
May 8, 2024 08:41:39.049268007 CEST	2121	50665	34.149.79.8	192.168.2.16
May 8, 2024 08:41:39.049280882 CEST	2121	50656	34.149.79.8	192.168.2.16
May 8, 2024 08:41:39.049331903 CEST	50665	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:39.049860001 CEST	50623	2121	192.168.2.16	121.188.219.78
May 8, 2024 08:41:39.059039116 CEST	2121	50660	150.249.78.235	192.168.2.16
May 8, 2024 08:41:39.065860987 CEST	50588	21	192.168.2.16	18.238.193.209
May 8, 2024 08:41:39.065864086 CEST	50633	2121	192.168.2.16	118.241.147.202
May 8, 2024 08:41:39.065864086 CEST	50589	2121	192.168.2.16	18.238.193.209
May 8, 2024 08:41:39.081852913 CEST	50590	21	192.168.2.16	47.147.17.78
May 8, 2024 08:41:39.082001925 CEST	50591	2121	192.168.2.16	47.147.17.78
May 8, 2024 08:41:39.112831116 CEST	50593	2121	192.168.2.16	105.98.9.48
May 8, 2024 08:41:39.112834930 CEST	50592	21	192.168.2.16	105.98.9.48
May 8, 2024 08:41:39.128856897 CEST	50594	21	192.168.2.16	31.167.145.83
May 8, 2024 08:41:39.144835949 CEST	50597	2121	192.168.2.16	98.53.167.176
May 8, 2024 08:41:39.144835949 CEST	50596	21	192.168.2.16	98.53.167.176
May 8, 2024 08:41:39.144994020 CEST	50600	21	192.168.2.16	87.56.22.23
May 8, 2024 08:41:39.144998074 CEST	50601	2121	192.168.2.16	87.56.22.23
May 8, 2024 08:41:39.160826921 CEST	50603	2121	192.168.2.16	80.184.105.246
May 8, 2024 08:41:39.160830021 CEST	50602	21	192.168.2.16	80.184.105.246
May 8, 2024 08:41:39.162466049 CEST	21	50657	172.120.235.139	192.168.2.16
May 8, 2024 08:41:39.162775040 CEST	21	50657	172.120.235.139	192.168.2.16
May 8, 2024 08:41:39.162957907 CEST	50657	21	192.168.2.16	172.120.235.139
May 8, 2024 08:41:39.174751043 CEST	21	50626	96.5.195.29	192.168.2.16
May 8, 2024 08:41:39.175071955 CEST	2121	50627	96.5.195.29	192.168.2.16
May 8, 2024 08:41:39.176826954 CEST	50613	21	192.168.2.16	93.200.149.130
May 8, 2024 08:41:39.176830053 CEST	50607	21	192.168.2.16	93.211.90.41
May 8, 2024 08:41:39.176830053 CEST	50606	21	192.168.2.16	189.82.4.46
May 8, 2024 08:41:39.176841021 CEST	50608	2121	192.168.2.16	189.82.4.46
May 8, 2024 08:41:39.176841021 CEST	50609	2121	192.168.2.16	93.211.90.41
May 8, 2024 08:41:39.176850080 CEST	50611	2121	192.168.2.16	174.57.15.124
May 8, 2024 08:41:39.176850080 CEST	50614	2121	192.168.2.16	201.50.159.167
May 8, 2024 08:41:39.176850080 CEST	50612	21	192.168.2.16	201.50.159.167
May 8, 2024 08:41:39.176855087 CEST	50610	21	192.168.2.16	174.57.15.124
May 8, 2024 08:41:39.176863909 CEST	50615	2121	192.168.2.16	93.200.149.130
May 8, 2024 08:41:39.192661047 CEST	2121	50587	122.117.36.51	192.168.2.16
May 8, 2024 08:41:39.192857027 CEST	50616	21	192.168.2.16	75.203.63.250
May 8, 2024 08:41:39.192878008 CEST	50617	2121	192.168.2.16	75.203.63.250
May 8, 2024 08:41:39.193346024 CEST	50667	2121	192.168.2.16	182.215.181.166
May 8, 2024 08:41:39.205100060 CEST	21	50664	34.149.79.8	192.168.2.16
May 8, 2024 08:41:39.205159903 CEST	50664	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:39.205233097 CEST	50664	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:39.205441952 CEST	50668	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:39.208826065 CEST	50618	21	192.168.2.16	24.240.231.180
May 8, 2024 08:41:39.208837032 CEST	50619	21	192.168.2.16	94.248.198.31
May 8, 2024 08:41:39.208838940 CEST	50639	2121	192.168.2.16	196.185.118.50
May 8, 2024 08:41:39.208852053 CEST	50638	21	192.168.2.16	196.185.118.50
May 8, 2024 08:41:39.208865881 CEST	50620	2121	192.168.2.16	94.248.198.31
May 8, 2024 08:41:39.208868027 CEST	50621	2121	192.168.2.16	24.240.231.180
May 8, 2024 08:41:39.211936951 CEST	2121	50665	34.149.79.8	192.168.2.16
May 8, 2024 08:41:39.211998940 CEST	50665	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:39.212081909 CEST	50665	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:39.212311029 CEST	50669	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:39.214420080 CEST	21	50543	188.172.30.125	192.168.2.16
May 8, 2024 08:41:39.240848064 CEST	50625	2121	192.168.2.16	182.210.166.181
May 8, 2024 08:41:39.240866899 CEST	50631	2121	192.168.2.16	222.134.112.234
May 8, 2024 08:41:39.240866899 CEST	50624	21	192.168.2.16	182.210.166.181
May 8, 2024 08:41:39.240871906 CEST	50630	21	192.168.2.16	222.134.112.234
May 8, 2024 08:41:39.272453070 CEST	21	50598	175.228.191.237	192.168.2.16
May 8, 2024 08:41:39.272833109 CEST	50540	21	192.168.2.16	175.121.86.174
May 8, 2024 08:41:39.272849083 CEST	50632	21	192.168.2.16	118.241.147.202
May 8, 2024 08:41:39.272922993 CEST	50634	21	192.168.2.16	203.169.193.41
May 8, 2024 08:41:39.276057005 CEST	2121	50599	175.228.191.237	192.168.2.16
May 8, 2024 08:41:39.276596069 CEST	2121	50546	188.172.30.125	192.168.2.16
May 8, 2024 08:41:39.279803038 CEST	2121	50539	187.208.244.80	192.168.2.16
May 8, 2024 08:41:39.282736063 CEST	21	50604	220.94.220.101	192.168.2.16
May 8, 2024 08:41:39.290477037 CEST	2121	50605	220.94.220.101	192.168.2.16
May 8, 2024 08:41:39.304857016 CEST	50635	2121	192.168.2.16	203.169.193.41
May 8, 2024 08:41:39.305484056 CEST	50670	21	192.168.2.16	124.171.67.161
May 8, 2024 08:41:39.320633888 CEST	21	50636	117.223.205.236	192.168.2.16
May 8, 2024 08:41:39.320759058 CEST	50636	21	192.168.2.16	117.223.205.236
May 8, 2024 08:41:39.321049929 CEST	50671	2121	192.168.2.16	124.171.67.161
May 8, 2024 08:41:39.331557035 CEST	21	50562	117.122.241.177	192.168.2.16
May 8, 2024 08:41:39.336827993 CEST	50640	21	192.168.2.16	173.94.208.111
May 8, 2024 08:41:39.337706089 CEST	2121	50563	117.122.241.177	192.168.2.16
May 8, 2024 08:41:39.347517014 CEST	21	50622	121.188.219.78	192.168.2.16
May 8, 2024 08:41:39.350826025 CEST	50637	2121	192.168.2.16	117.223.205.236
May 8, 2024 08:41:39.351078033 CEST	50641	2121	192.168.2.16	173.94.208.111
May 8, 2024 08:41:39.352861881 CEST	2121	50633	118.241.147.202	192.168.2.16
May 8, 2024 08:41:39.363467932 CEST	2121	50623	121.188.219.78	192.168.2.16
May 8, 2024 08:41:39.366827011 CEST	50541	2121	192.168.2.16	175.121.86.174
May 8, 2024 08:41:39.366831064 CEST	50547	21	192.168.2.16	108.15.160.47
May 8, 2024 08:41:39.369559050 CEST	21	50664	34.149.79.8	192.168.2.16
May 8, 2024 08:41:39.369909048 CEST	21	50668	34.149.79.8	192.168.2.16
May 8, 2024 08:41:39.369982004 CEST	50668	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:39.373461962 CEST	2121	50595	31.167.145.83	192.168.2.16
May 8, 2024 08:41:39.373475075 CEST	21	50657	172.120.235.139	192.168.2.16
May 8, 2024 08:41:39.373594046 CEST	50657	21	192.168.2.16	172.120.235.139
May 8, 2024 08:41:39.373816013 CEST	50672	21	192.168.2.16	172.120.235.139
May 8, 2024 08:41:39.376045942 CEST	2121	50665	34.149.79.8	192.168.2.16
May 8, 2024 08:41:39.376132965 CEST	2121	50669	34.149.79.8	192.168.2.16
May 8, 2024 08:41:39.376189947 CEST	50669	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:39.382950068 CEST	50642	2121	192.168.2.16	71.28.130.111
May 8, 2024 08:41:39.397871017 CEST	50643	21	192.168.2.16	71.28.130.111
May 8, 2024 08:41:39.397999048 CEST	50644	21	192.168.2.16	118.201.139.137
May 8, 2024 08:41:39.444953918 CEST	21	50538	196.210.0.111	192.168.2.16
May 8, 2024 08:41:39.445009947 CEST	50538	21	192.168.2.16	196.210.0.111
May 8, 2024 08:41:39.445182085 CEST	21	50666	196.210.0.111	192.168.2.16
May 8, 2024 08:41:39.445249081 CEST	50666	21	192.168.2.16	196.210.0.111
May 8, 2024 08:41:39.445841074 CEST	50645	2121	192.168.2.16	118.201.139.137
May 8, 2024 08:41:39.460840940 CEST	50646	21	192.168.2.16	114.199.191.58
May 8, 2024 08:41:39.477308035 CEST	50673	21	192.168.2.16	114.253.195.224
May 8, 2024 08:41:39.491827011 CEST	50647	2121	192.168.2.16	114.199.191.58
May 8, 2024 08:41:39.507841110 CEST	50648	21	192.168.2.16	96.110.124.89
May 8, 2024 08:41:39.523885012 CEST	50649	2121	192.168.2.16	96.110.124.89
May 8, 2024 08:41:39.525455952 CEST	50674	2121	192.168.2.16	114.253.195.224
May 8, 2024 08:41:39.525778055 CEST	50675	21	192.168.2.16	41.249.84.185
May 8, 2024 08:41:39.526087046 CEST	50676	2121	192.168.2.16	41.249.84.185
May 8, 2024 08:41:39.526200056 CEST	50677	21	192.168.2.16	62.194.129.219
May 8, 2024 08:41:39.526335955 CEST	50678	2121	192.168.2.16	62.194.129.219
May 8, 2024 08:41:39.526423931 CEST	50679	21	192.168.2.16	187.93.61.109
May 8, 2024 08:41:39.526573896 CEST	50680	2121	192.168.2.16	187.93.61.109
May 8, 2024 08:41:39.526695967 CEST	50681	21	192.168.2.16	20.82.244.57
May 8, 2024 08:41:39.526792049 CEST	50682	2121	192.168.2.16	20.82.244.57
May 8, 2024 08:41:39.526897907 CEST	50683	21	192.168.2.16	91.124.109.201
May 8, 2024 08:41:39.526987076 CEST	50684	2121	192.168.2.16	91.124.109.201
May 8, 2024 08:41:39.527132988 CEST	50686	2121	192.168.2.16	89.146.194.41
May 8, 2024 08:41:39.527131081 CEST	50685	21	192.168.2.16	89.146.194.41
May 8, 2024 08:41:39.527286053 CEST	50687	21	192.168.2.16	74.199.143.226
May 8, 2024 08:41:39.527313948 CEST	50688	2121	192.168.2.16	74.199.143.226
May 8, 2024 08:41:39.537705898 CEST	21	50668	34.149.79.8	192.168.2.16
May 8, 2024 08:41:39.537769079 CEST	50668	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:39.537868023 CEST	50668	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:39.538080931 CEST	50689	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:39.539273977 CEST	50690	21	192.168.2.16	188.83.33.111
May 8, 2024 08:41:39.539498091 CEST	50691	2121	192.168.2.16	188.83.33.111
May 8, 2024 08:41:39.539706945 CEST	50692	21	192.168.2.16	5.157.128.113
May 8, 2024 08:41:39.539915085 CEST	50693	2121	192.168.2.16	5.157.128.113
May 8, 2024 08:41:39.539978981 CEST	50651	2121	192.168.2.16	149.165.129.10
May 8, 2024 08:41:39.540127993 CEST	50694	21	192.168.2.16	88.203.169.112
May 8, 2024 08:41:39.540303946 CEST	50695	2121	192.168.2.16	88.203.169.112
May 8, 2024 08:41:39.540498018 CEST	50696	21	192.168.2.16	153.166.130.220
May 8, 2024 08:41:39.540693998 CEST	50697	2121	192.168.2.16	153.166.130.220
May 8, 2024 08:41:39.540921926 CEST	50698	21	192.168.2.16	220.71.50.238
May 8, 2024 08:41:39.541114092 CEST	50699	2121	192.168.2.16	220.71.50.238
May 8, 2024 08:41:39.541753054 CEST	2121	50669	34.149.79.8	192.168.2.16
May 8, 2024 08:41:39.541817904 CEST	50669	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:39.542371988 CEST	50669	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:39.542579889 CEST	50700	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:39.543812037 CEST	50650	21	192.168.2.16	149.165.129.10
May 8, 2024 08:41:39.553867102 CEST	50652	21	192.168.2.16	117.55.191.68
May 8, 2024 08:41:39.553997993 CEST	50584	21	192.168.2.16	122.117.36.51
May 8, 2024 08:41:39.555161953 CEST	50701	21	192.168.2.16	148.255.21.179
May 8, 2024 08:41:39.555222988 CEST	50702	2121	192.168.2.16	148.255.21.179
May 8, 2024 08:41:39.555411100 CEST	50703	21	192.168.2.16	104.19.117.184
May 8, 2024 08:41:39.555552006 CEST	50704	2121	192.168.2.16	104.19.117.184
May 8, 2024 08:41:39.555660009 CEST	50705	21	192.168.2.16	5.161.14.111
May 8, 2024 08:41:39.555716991 CEST	50706	2121	192.168.2.16	5.161.14.111
May 8, 2024 08:41:39.555834055 CEST	50707	21	192.168.2.16	125.161.237.221
May 8, 2024 08:41:39.555965900 CEST	50708	2121	192.168.2.16	125.161.237.221
May 8, 2024 08:41:39.556080103 CEST	50709	21	192.168.2.16	13.114.86.103
May 8, 2024 08:41:39.556210995 CEST	50710	21	192.168.2.16	113.211.46.82
May 8, 2024 08:41:39.556263924 CEST	50711	2121	192.168.2.16	13.114.86.103
May 8, 2024 08:41:39.558768988 CEST	21	50672	172.120.235.139	192.168.2.16
May 8, 2024 08:41:39.558862925 CEST	21	50657	172.120.235.139	192.168.2.16
May 8, 2024 08:41:39.558922052 CEST	50672	21	192.168.2.16	172.120.235.139
May 8, 2024 08:41:39.558965921 CEST	50657	21	192.168.2.16	172.120.235.139
May 8, 2024 08:41:39.562036991 CEST	21	50540	175.121.86.174	192.168.2.16
May 8, 2024 08:41:39.562381029 CEST	50712	2121	192.168.2.16	113.211.46.82
May 8, 2024 08:41:39.569829941 CEST	50654	2121	192.168.2.16	117.55.191.68
May 8, 2024 08:41:39.569832087 CEST	50660	2121	192.168.2.16	150.249.78.235
May 8, 2024 08:41:39.569993973 CEST	50655	21	192.168.2.16	185.187.236.74
May 8, 2024 08:41:39.577384949 CEST	50713	21	192.168.2.16	73.188.101.101
May 8, 2024 08:41:39.577496052 CEST	50714	2121	192.168.2.16	73.188.101.101
May 8, 2024 08:41:39.577585936 CEST	50715	21	192.168.2.16	124.162.52.179
May 8, 2024 08:41:39.577775955 CEST	50716	21	192.168.2.16	89.217.82.219
May 8, 2024 08:41:39.579166889 CEST	50717	2121	192.168.2.16	89.217.82.219
May 8, 2024 08:41:39.579242945 CEST	50718	21	192.168.2.16	100.25.239.63
May 8, 2024 08:41:39.579448938 CEST	50719	2121	192.168.2.16	100.25.239.63
May 8, 2024 08:41:39.579463959 CEST	50720	21	192.168.2.16	139.193.23.42
May 8, 2024 08:41:39.580238104 CEST	2121	50639	196.185.118.50	192.168.2.16
May 8, 2024 08:41:39.581047058 CEST	50722	21	192.168.2.16	125.132.248.234
May 8, 2024 08:41:39.581093073 CEST	50723	2121	192.168.2.16	125.132.248.234
May 8, 2024 08:41:39.581094980 CEST	50721	2121	192.168.2.16	139.193.23.42
May 8, 2024 08:41:39.581285954 CEST	50724	21	192.168.2.16	222.97.72.53
May 8, 2024 08:41:39.581862926 CEST	21	50638	196.185.118.50	192.168.2.16
May 8, 2024 08:41:39.582869053 CEST	50725	21	192.168.2.16	37.209.172.36
May 8, 2024 08:41:39.582880020 CEST	50726	2121	192.168.2.16	37.209.172.36
May 8, 2024 08:41:39.582963943 CEST	50727	21	192.168.2.16	14.95.143.135
May 8, 2024 08:41:39.583034992 CEST	50728	2121	192.168.2.16	124.162.52.179
May 8, 2024 08:41:39.583120108 CEST	50729	2121	192.168.2.16	14.95.143.135
May 8, 2024 08:41:39.583132029 CEST	50730	2121	192.168.2.16	222.97.72.53
May 8, 2024 08:41:39.584631920 CEST	50731	21	192.168.2.16	146.112.45.212
May 8, 2024 08:41:39.591993093 CEST	50732	2121	192.168.2.16	146.112.45.212
May 8, 2024 08:41:39.592087984 CEST	50733	21	192.168.2.16	82.14.81.130
May 8, 2024 08:41:39.592159033 CEST	50734	2121	192.168.2.16	82.14.81.130
May 8, 2024 08:41:39.592267990 CEST	50735	21	192.168.2.16	5.146.116.46
May 8, 2024 08:41:39.593786955 CEST	50736	2121	192.168.2.16	5.146.116.46
May 8, 2024 08:41:39.593944073 CEST	50737	21	192.168.2.16	91.148.140.11
May 8, 2024 08:41:39.593980074 CEST	50738	2121	192.168.2.16	91.148.140.11
May 8, 2024 08:41:39.594032049 CEST	50739	21	192.168.2.16	103.221.228.41
May 8, 2024 08:41:39.595597982 CEST	50740	2121	192.168.2.16	103.221.228.41
May 8, 2024 08:41:39.595772028 CEST	50741	21	192.168.2.16	179.24.77.182
May 8, 2024 08:41:39.595823050 CEST	50742	2121	192.168.2.16	179.24.77.182
May 8, 2024 08:41:39.595879078 CEST	50743	21	192.168.2.16	216.212.41.244
May 8, 2024 08:41:39.595911026 CEST	50744	2121	192.168.2.16	216.212.41.244
May 8, 2024 08:41:39.595995903 CEST	50745	21	192.168.2.16	121.173.245.205
May 8, 2024 08:41:39.596040010 CEST	50746	21	192.168.2.16	107.180.163.199
May 8, 2024 08:41:39.597548962 CEST	50747	2121	192.168.2.16	121.173.245.205
May 8, 2024 08:41:39.604047060 CEST	50748	21	192.168.2.16	174.84.63.229
May 8, 2024 08:41:39.604120016 CEST	50749	2121	192.168.2.16	107.180.163.199
May 8, 2024 08:41:39.604160070 CEST	50750	2121	192.168.2.16	174.84.63.229
May 8, 2024 08:41:39.604202032 CEST	50751	21	192.168.2.16	187.224.87.250
May 8, 2024 08:41:39.605663061 CEST	50752	2121	192.168.2.16	187.224.87.250
May 8, 2024 08:41:39.605729103 CEST	50753	21	192.168.2.16	191.6.221.165
May 8, 2024 08:41:39.617866039 CEST	50658	2121	192.168.2.16	185.187.236.74
May 8, 2024 08:41:39.622406960 CEST	50754	2121	192.168.2.16	191.6.221.165
May 8, 2024 08:41:39.622948885 CEST	50755	21	192.168.2.16	58.226.219.111
May 8, 2024 08:41:39.622960091 CEST	50756	2121	192.168.2.16	58.226.219.111
May 8, 2024 08:41:39.623084068 CEST	50758	2121	192.168.2.16	185.108.141.19
May 8, 2024 08:41:39.623089075 CEST	50757	21	192.168.2.16	185.108.141.19
May 8, 2024 08:41:39.677592993 CEST	2121	50541	175.121.86.174	192.168.2.16
May 8, 2024 08:41:39.681859016 CEST	50627	2121	192.168.2.16	96.5.195.29
May 8, 2024 08:41:39.681989908 CEST	50626	21	192.168.2.16	96.5.195.29
May 8, 2024 08:41:39.697916031 CEST	50587	2121	192.168.2.16	122.117.36.51
May 8, 2024 08:41:39.698177099 CEST	50759	21	192.168.2.16	50.103.197.66
May 8, 2024 08:41:39.700021029 CEST	21	50668	34.149.79.8	192.168.2.16
May 8, 2024 08:41:39.700388908 CEST	21	50689	34.149.79.8	192.168.2.16
May 8, 2024 08:41:39.700462103 CEST	50689	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:39.704761028 CEST	2121	50700	34.149.79.8	192.168.2.16
May 8, 2024 08:41:39.704777956 CEST	2121	50669	34.149.79.8	192.168.2.16
May 8, 2024 08:41:39.704833984 CEST	50700	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:39.728858948 CEST	50543	21	192.168.2.16	188.172.30.125
May 8, 2024 08:41:39.760884047 CEST	50659	21	192.168.2.16	150.249.78.235
May 8, 2024 08:41:39.776860952 CEST	50599	2121	192.168.2.16	175.228.191.237
May 8, 2024 08:41:39.777993917 CEST	50546	2121	192.168.2.16	188.172.30.125
May 8, 2024 08:41:39.780823946 CEST	50661	21	192.168.2.16	23.199.47.76
May 8, 2024 08:41:39.782000065 CEST	50598	21	192.168.2.16	175.228.191.237
May 8, 2024 08:41:39.783399105 CEST	21	50672	172.120.235.139	192.168.2.16
May 8, 2024 08:41:39.783556938 CEST	50672	21	192.168.2.16	172.120.235.139
May 8, 2024 08:41:39.792824984 CEST	50604	21	192.168.2.16	220.94.220.101
May 8, 2024 08:41:39.792836905 CEST	50605	2121	192.168.2.16	220.94.220.101
May 8, 2024 08:41:39.792860985 CEST	50662	2121	192.168.2.16	23.199.47.76
May 8, 2024 08:41:39.822009087 CEST	21	50696	153.166.130.220	192.168.2.16
May 8, 2024 08:41:39.822154999 CEST	21	50746	107.180.163.199	192.168.2.16
May 8, 2024 08:41:39.824847937 CEST	50663	21	192.168.2.16	182.215.181.166
May 8, 2024 08:41:39.830389023 CEST	2121	50749	107.180.163.199	192.168.2.16
May 8, 2024 08:41:39.835385084 CEST	21	50685	89.146.194.41	192.168.2.16
May 8, 2024 08:41:39.838222027 CEST	2121	50686	89.146.194.41	192.168.2.16
May 8, 2024 08:41:39.840843916 CEST	50562	21	192.168.2.16	117.122.241.177
May 8, 2024 08:41:39.841754913 CEST	50563	2121	192.168.2.16	117.122.241.177
May 8, 2024 08:41:39.856852055 CEST	50622	21	192.168.2.16	121.188.219.78
May 8, 2024 08:41:39.857367039 CEST	50633	2121	192.168.2.16	118.241.147.202
May 8, 2024 08:41:39.862890005 CEST	21	50689	34.149.79.8	192.168.2.16
May 8, 2024 08:41:39.862956047 CEST	50689	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:39.863044977 CEST	50689	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:39.863275051 CEST	50760	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:39.863449097 CEST	2121	50660	150.249.78.235	192.168.2.16
May 8, 2024 08:41:39.867373943 CEST	21	50683	91.124.109.201	192.168.2.16
May 8, 2024 08:41:39.867388010 CEST	2121	50684	91.124.109.201	192.168.2.16
May 8, 2024 08:41:39.867952108 CEST	2121	50700	34.149.79.8	192.168.2.16
May 8, 2024 08:41:39.868030071 CEST	50700	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:39.868129969 CEST	50700	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:39.868418932 CEST	50761	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:39.868522882 CEST	21	50584	122.117.36.51	192.168.2.16
May 8, 2024 08:41:39.871078968 CEST	2121	50637	117.223.205.236	192.168.2.16
May 8, 2024 08:41:39.871849060 CEST	50623	2121	192.168.2.16	121.188.219.78
May 8, 2024 08:41:39.872278929 CEST	50762	2121	192.168.2.16	50.103.197.66
May 8, 2024 08:41:39.882095098 CEST	2121	50680	187.93.61.109	192.168.2.16
May 8, 2024 08:41:39.885287046 CEST	21	50679	187.93.61.109	192.168.2.16
May 8, 2024 08:41:39.887826920 CEST	50595	2121	192.168.2.16	31.167.145.83
May 8, 2024 08:41:39.898607016 CEST	2121	50627	96.5.195.29	192.168.2.16
May 8, 2024 08:41:39.898618937 CEST	21	50626	96.5.195.29	192.168.2.16
May 8, 2024 08:41:39.919842958 CEST	50550	2121	192.168.2.16	108.15.160.47
May 8, 2024 08:41:39.920170069 CEST	50763	21	192.168.2.16	138.248.244.221
May 8, 2024 08:41:39.947320938 CEST	21	50737	91.148.140.11	192.168.2.16
May 8, 2024 08:41:39.951854944 CEST	50554	2121	192.168.2.16	101.80.45.13
May 8, 2024 08:41:39.954046965 CEST	2121	50738	91.148.140.11	192.168.2.16
May 8, 2024 08:41:39.958823919 CEST	50553	21	192.168.2.16	101.80.45.13
May 8, 2024 08:41:39.958913088 CEST	21	50666	196.210.0.111	192.168.2.16
May 8, 2024 08:41:39.959086895 CEST	50666	21	192.168.2.16	196.210.0.111
May 8, 2024 08:41:39.961596012 CEST	2121	50721	139.193.23.42	192.168.2.16
May 8, 2024 08:41:39.965320110 CEST	21	50672	172.120.235.139	192.168.2.16
May 8, 2024 08:41:39.965533018 CEST	21	50672	172.120.235.139	192.168.2.16
May 8, 2024 08:41:39.965703011 CEST	50672	21	192.168.2.16	172.120.235.139
May 8, 2024 08:41:39.979981899 CEST	2121	50758	185.108.141.19	192.168.2.16
May 8, 2024 08:41:39.980813026 CEST	21	50757	185.108.141.19	192.168.2.16
May 8, 2024 08:41:39.986000061 CEST	50555	21	192.168.2.16	173.176.244.243
May 8, 2024 08:41:40.015830040 CEST	2121	50587	122.117.36.51	192.168.2.16
May 8, 2024 08:41:40.025453091 CEST	21	50689	34.149.79.8	192.168.2.16
May 8, 2024 08:41:40.025763035 CEST	21	50760	34.149.79.8	192.168.2.16
May 8, 2024 08:41:40.025844097 CEST	50760	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:40.030262947 CEST	2121	50700	34.149.79.8	192.168.2.16
May 8, 2024 08:41:40.030807972 CEST	2121	50761	34.149.79.8	192.168.2.16
May 8, 2024 08:41:40.030862093 CEST	50761	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:40.094559908 CEST	2121	50599	175.228.191.237	192.168.2.16
May 8, 2024 08:41:40.094841003 CEST	50639	2121	192.168.2.16	196.185.118.50
May 8, 2024 08:41:40.094872952 CEST	50638	21	192.168.2.16	196.185.118.50
May 8, 2024 08:41:40.097246885 CEST	21	50598	175.228.191.237	192.168.2.16
May 8, 2024 08:41:40.105091095 CEST	21	50604	220.94.220.101	192.168.2.16
May 8, 2024 08:41:40.111835957 CEST	2121	50605	220.94.220.101	192.168.2.16
May 8, 2024 08:41:40.143721104 CEST	2121	50633	118.241.147.202	192.168.2.16
May 8, 2024 08:41:40.169209003 CEST	21	50622	121.188.219.78	192.168.2.16
May 8, 2024 08:41:40.173775911 CEST	21	50672	172.120.235.139	192.168.2.16
May 8, 2024 08:41:40.173964977 CEST	50672	21	192.168.2.16	172.120.235.139
May 8, 2024 08:41:40.174238920 CEST	50764	21	192.168.2.16	172.120.235.139
May 8, 2024 08:41:40.174947023 CEST	21	50562	117.122.241.177	192.168.2.16
May 8, 2024 08:41:40.175272942 CEST	50765	2121	192.168.2.16	138.248.244.221
May 8, 2024 08:41:40.185197115 CEST	2121	50623	121.188.219.78	192.168.2.16
May 8, 2024 08:41:40.185674906 CEST	2121	50563	117.122.241.177	192.168.2.16
May 8, 2024 08:41:40.188258886 CEST	21	50760	34.149.79.8	192.168.2.16
May 8, 2024 08:41:40.188318014 CEST	50760	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:40.188380003 CEST	50760	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:40.188630104 CEST	50766	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:40.193325043 CEST	2121	50761	34.149.79.8	192.168.2.16
May 8, 2024 08:41:40.193377972 CEST	50761	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:40.193470955 CEST	50761	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:40.193706036 CEST	50767	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:40.206847906 CEST	50667	2121	192.168.2.16	182.215.181.166
May 8, 2024 08:41:40.232716084 CEST	21	50763	138.248.244.221	192.168.2.16
May 8, 2024 08:41:40.254786015 CEST	2121	50595	31.167.145.83	192.168.2.16
May 8, 2024 08:41:40.254848003 CEST	50558	21	192.168.2.16	209.183.141.21
May 8, 2024 08:41:40.254878044 CEST	50557	2121	192.168.2.16	173.176.244.243
May 8, 2024 08:41:40.270862103 CEST	50559	2121	192.168.2.16	209.183.141.21
May 8, 2024 08:41:40.277115107 CEST	21	50543	188.172.30.125	192.168.2.16
May 8, 2024 08:41:40.303232908 CEST	50768	21	192.168.2.16	81.8.54.42
May 8, 2024 08:41:40.318885088 CEST	50670	21	192.168.2.16	124.171.67.161
May 8, 2024 08:41:40.334836960 CEST	50696	21	192.168.2.16	153.166.130.220
May 8, 2024 08:41:40.334845066 CEST	50746	21	192.168.2.16	107.180.163.199
May 8, 2024 08:41:40.334857941 CEST	50671	2121	192.168.2.16	124.171.67.161
May 8, 2024 08:41:40.334857941 CEST	50749	2121	192.168.2.16	107.180.163.199
May 8, 2024 08:41:40.335944891 CEST	2121	50546	188.172.30.125	192.168.2.16
May 8, 2024 08:41:40.350719929 CEST	21	50760	34.149.79.8	192.168.2.16
May 8, 2024 08:41:40.350826025 CEST	50686	2121	192.168.2.16	89.146.194.41
May 8, 2024 08:41:40.350852966 CEST	50685	21	192.168.2.16	89.146.194.41
May 8, 2024 08:41:40.350864887 CEST	50564	21	192.168.2.16	83.76.172.75
May 8, 2024 08:41:40.351063967 CEST	21	50766	34.149.79.8	192.168.2.16
May 8, 2024 08:41:40.351128101 CEST	50766	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:40.355806112 CEST	21	50672	172.120.235.139	192.168.2.16
May 8, 2024 08:41:40.355854988 CEST	50672	21	192.168.2.16	172.120.235.139
May 8, 2024 08:41:40.355875015 CEST	21	50764	172.120.235.139	192.168.2.16
May 8, 2024 08:41:40.355911970 CEST	2121	50761	34.149.79.8	192.168.2.16
May 8, 2024 08:41:40.355931044 CEST	50764	21	192.168.2.16	172.120.235.139
May 8, 2024 08:41:40.356143951 CEST	2121	50767	34.149.79.8	192.168.2.16
May 8, 2024 08:41:40.356200933 CEST	50767	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:40.366856098 CEST	50660	2121	192.168.2.16	150.249.78.235
May 8, 2024 08:41:40.382827997 CEST	50683	21	192.168.2.16	91.124.109.201
May 8, 2024 08:41:40.382842064 CEST	50584	21	192.168.2.16	122.117.36.51
May 8, 2024 08:41:40.382843018 CEST	50637	2121	192.168.2.16	117.223.205.236
May 8, 2024 08:41:40.382857084 CEST	50684	2121	192.168.2.16	91.124.109.201
May 8, 2024 08:41:40.382977962 CEST	50680	2121	192.168.2.16	187.93.61.109
May 8, 2024 08:41:40.398827076 CEST	50565	2121	192.168.2.16	83.76.172.75
May 8, 2024 08:41:40.398849964 CEST	50626	21	192.168.2.16	96.5.195.29
May 8, 2024 08:41:40.398849964 CEST	50627	2121	192.168.2.16	96.5.195.29
May 8, 2024 08:41:40.398849964 CEST	50567	21	192.168.2.16	74.215.88.154
May 8, 2024 08:41:40.398849964 CEST	50679	21	192.168.2.16	187.93.61.109
May 8, 2024 08:41:40.398853064 CEST	50566	2121	192.168.2.16	165.169.125.137
May 8, 2024 08:41:40.398853064 CEST	50568	21	192.168.2.16	165.169.125.137
May 8, 2024 08:41:40.431353092 CEST	50569	2121	192.168.2.16	74.215.88.154
May 8, 2024 08:41:40.438848019 CEST	21	50666	196.210.0.111	192.168.2.16
May 8, 2024 08:41:40.438860893 CEST	21	50666	196.210.0.111	192.168.2.16
May 8, 2024 08:41:40.439038038 CEST	50666	21	192.168.2.16	196.210.0.111
May 8, 2024 08:41:40.458151102 CEST	2121	50639	196.185.118.50	192.168.2.16
May 8, 2024 08:41:40.459789991 CEST	21	50638	196.185.118.50	192.168.2.16
May 8, 2024 08:41:40.461827040 CEST	50737	21	192.168.2.16	91.148.140.11
May 8, 2024 08:41:40.461862087 CEST	50738	2121	192.168.2.16	91.148.140.11
May 8, 2024 08:41:40.461939096 CEST	50721	2121	192.168.2.16	139.193.23.42
May 8, 2024 08:41:40.477899075 CEST	50673	21	192.168.2.16	114.253.195.224
May 8, 2024 08:41:40.490957022 CEST	2121	50765	138.248.244.221	192.168.2.16
May 8, 2024 08:41:40.493827105 CEST	50757	21	192.168.2.16	185.108.141.19
May 8, 2024 08:41:40.493846893 CEST	50758	2121	192.168.2.16	185.108.141.19
May 8, 2024 08:41:40.509841919 CEST	50571	2121	192.168.2.16	168.100.203.193
May 8, 2024 08:41:40.509865999 CEST	50572	21	192.168.2.16	168.100.203.193
May 8, 2024 08:41:40.513562918 CEST	21	50766	34.149.79.8	192.168.2.16
May 8, 2024 08:41:40.513618946 CEST	50766	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:40.513703108 CEST	50766	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:40.513948917 CEST	50769	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:40.518570900 CEST	2121	50767	34.149.79.8	192.168.2.16
May 8, 2024 08:41:40.518621922 CEST	50767	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:40.518760920 CEST	50767	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:40.519081116 CEST	50770	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:40.525825024 CEST	50587	2121	192.168.2.16	122.117.36.51
May 8, 2024 08:41:40.525855064 CEST	50675	21	192.168.2.16	41.249.84.185
May 8, 2024 08:41:40.525893927 CEST	50674	2121	192.168.2.16	114.253.195.224
May 8, 2024 08:41:40.541831017 CEST	50682	2121	192.168.2.16	20.82.244.57
May 8, 2024 08:41:40.541831970 CEST	50676	2121	192.168.2.16	41.249.84.185
May 8, 2024 08:41:40.541832924 CEST	50678	2121	192.168.2.16	62.194.129.219
May 8, 2024 08:41:40.541845083 CEST	50681	21	192.168.2.16	20.82.244.57
May 8, 2024 08:41:40.541846037 CEST	50677	21	192.168.2.16	62.194.129.219
May 8, 2024 08:41:40.541843891 CEST	50693	2121	192.168.2.16	5.157.128.113
May 8, 2024 08:41:40.541846037 CEST	50695	2121	192.168.2.16	88.203.169.112
May 8, 2024 08:41:40.541848898 CEST	50691	2121	192.168.2.16	188.83.33.111
May 8, 2024 08:41:40.541858912 CEST	50697	2121	192.168.2.16	153.166.130.220
May 8, 2024 08:41:40.541860104 CEST	50699	2121	192.168.2.16	220.71.50.238
May 8, 2024 08:41:40.541860104 CEST	50688	2121	192.168.2.16	74.199.143.226
May 8, 2024 08:41:40.541863918 CEST	50690	21	192.168.2.16	188.83.33.111
May 8, 2024 08:41:40.541863918 CEST	50687	21	192.168.2.16	74.199.143.226
May 8, 2024 08:41:40.541871071 CEST	50698	21	192.168.2.16	220.71.50.238
May 8, 2024 08:41:40.541872025 CEST	50694	21	192.168.2.16	88.203.169.112
May 8, 2024 08:41:40.541872025 CEST	50692	21	192.168.2.16	5.157.128.113
May 8, 2024 08:41:40.549788952 CEST	21	50636	117.223.205.236	192.168.2.16
May 8, 2024 08:41:40.549837112 CEST	50636	21	192.168.2.16	117.223.205.236
May 8, 2024 08:41:40.557852983 CEST	50702	2121	192.168.2.16	148.255.21.179
May 8, 2024 08:41:40.557859898 CEST	50701	21	192.168.2.16	148.255.21.179
May 8, 2024 08:41:40.557862997 CEST	50707	21	192.168.2.16	125.161.237.221
May 8, 2024 08:41:40.557862997 CEST	50710	21	192.168.2.16	113.211.46.82
May 8, 2024 08:41:40.557868004 CEST	50704	2121	192.168.2.16	104.19.117.184
May 8, 2024 08:41:40.557868004 CEST	50706	2121	192.168.2.16	5.161.14.111
May 8, 2024 08:41:40.557869911 CEST	50711	2121	192.168.2.16	13.114.86.103
May 8, 2024 08:41:40.557871103 CEST	50703	21	192.168.2.16	104.19.117.184
May 8, 2024 08:41:40.557998896 CEST	50709	21	192.168.2.16	13.114.86.103
May 8, 2024 08:41:40.558000088 CEST	50705	21	192.168.2.16	5.161.14.111
May 8, 2024 08:41:40.558001995 CEST	50708	2121	192.168.2.16	125.161.237.221
May 8, 2024 08:41:40.561703920 CEST	21	50746	107.180.163.199	192.168.2.16
May 8, 2024 08:41:40.561793089 CEST	2121	50749	107.180.163.199	192.168.2.16
May 8, 2024 08:41:40.573827028 CEST	50712	2121	192.168.2.16	113.211.46.82
May 8, 2024 08:41:40.579272985 CEST	21	50764	172.120.235.139	192.168.2.16
May 8, 2024 08:41:40.579411030 CEST	50764	21	192.168.2.16	172.120.235.139
May 8, 2024 08:41:40.589831114 CEST	50714	2121	192.168.2.16	73.188.101.101
May 8, 2024 08:41:40.589840889 CEST	50713	21	192.168.2.16	73.188.101.101
May 8, 2024 08:41:40.589854002 CEST	50726	2121	192.168.2.16	37.209.172.36
May 8, 2024 08:41:40.589854956 CEST	50723	2121	192.168.2.16	125.132.248.234
May 8, 2024 08:41:40.589854002 CEST	50715	21	192.168.2.16	124.162.52.179
May 8, 2024 08:41:40.589854956 CEST	50716	21	192.168.2.16	89.217.82.219
May 8, 2024 08:41:40.589858055 CEST	50718	21	192.168.2.16	100.25.239.63
May 8, 2024 08:41:40.589855909 CEST	50719	2121	192.168.2.16	100.25.239.63
May 8, 2024 08:41:40.589855909 CEST	50717	2121	192.168.2.16	89.217.82.219
May 8, 2024 08:41:40.590001106 CEST	50730	2121	192.168.2.16	222.97.72.53
May 8, 2024 08:41:40.590002060 CEST	50731	21	192.168.2.16	146.112.45.212
May 8, 2024 08:41:40.590001106 CEST	50724	21	192.168.2.16	222.97.72.53
May 8, 2024 08:41:40.590003014 CEST	50725	21	192.168.2.16	37.209.172.36
May 8, 2024 08:41:40.590001106 CEST	50722	21	192.168.2.16	125.132.248.234
May 8, 2024 08:41:40.590008020 CEST	50729	2121	192.168.2.16	14.95.143.135
May 8, 2024 08:41:40.590008020 CEST	50720	21	192.168.2.16	139.193.23.42
May 8, 2024 08:41:40.590008020 CEST	50727	21	192.168.2.16	14.95.143.135
May 8, 2024 08:41:40.590008020 CEST	50728	2121	192.168.2.16	124.162.52.179
May 8, 2024 08:41:40.605833054 CEST	50735	21	192.168.2.16	5.146.116.46
May 8, 2024 08:41:40.605833054 CEST	50732	2121	192.168.2.16	146.112.45.212
May 8, 2024 08:41:40.605834961 CEST	50743	21	192.168.2.16	216.212.41.244
May 8, 2024 08:41:40.605850935 CEST	50739	21	192.168.2.16	103.221.228.41
May 8, 2024 08:41:40.605853081 CEST	50736	2121	192.168.2.16	5.146.116.46
May 8, 2024 08:41:40.605853081 CEST	50599	2121	192.168.2.16	175.228.191.237
May 8, 2024 08:41:40.605855942 CEST	50734	2121	192.168.2.16	82.14.81.130
May 8, 2024 08:41:40.605859041 CEST	50740	2121	192.168.2.16	103.221.228.41
May 8, 2024 08:41:40.605859041 CEST	50744	2121	192.168.2.16	216.212.41.244
May 8, 2024 08:41:40.605861902 CEST	50748	21	192.168.2.16	174.84.63.229
May 8, 2024 08:41:40.605868101 CEST	50576	21	192.168.2.16	217.121.103.26
May 8, 2024 08:41:40.605868101 CEST	50750	2121	192.168.2.16	174.84.63.229
May 8, 2024 08:41:40.605874062 CEST	50741	21	192.168.2.16	179.24.77.182
May 8, 2024 08:41:40.605875015 CEST	50733	21	192.168.2.16	82.14.81.130
May 8, 2024 08:41:40.605875015 CEST	50745	21	192.168.2.16	121.173.245.205
May 8, 2024 08:41:40.605874062 CEST	50747	2121	192.168.2.16	121.173.245.205
May 8, 2024 08:41:40.605875969 CEST	50598	21	192.168.2.16	175.228.191.237
May 8, 2024 08:41:40.605880976 CEST	50575	2121	192.168.2.16	217.121.103.26
May 8, 2024 08:41:40.605901003 CEST	50742	2121	192.168.2.16	179.24.77.182
May 8, 2024 08:41:40.605901003 CEST	50752	2121	192.168.2.16	187.224.87.250
May 8, 2024 08:41:40.605995893 CEST	50751	21	192.168.2.16	187.224.87.250
May 8, 2024 08:41:40.605998039 CEST	50753	21	192.168.2.16	191.6.221.165
May 8, 2024 08:41:40.605999947 CEST	50604	21	192.168.2.16	220.94.220.101
May 8, 2024 08:41:40.606293917 CEST	50771	2121	192.168.2.16	81.8.54.42
May 8, 2024 08:41:40.615566969 CEST	21	50626	96.5.195.29	192.168.2.16
May 8, 2024 08:41:40.615580082 CEST	2121	50627	96.5.195.29	192.168.2.16
May 8, 2024 08:41:40.619226933 CEST	21	50696	153.166.130.220	192.168.2.16
May 8, 2024 08:41:40.621826887 CEST	50605	2121	192.168.2.16	220.94.220.101
May 8, 2024 08:41:40.637829065 CEST	50756	2121	192.168.2.16	58.226.219.111
May 8, 2024 08:41:40.637830973 CEST	50754	2121	192.168.2.16	191.6.221.165
May 8, 2024 08:41:40.637840033 CEST	50577	21	192.168.2.16	119.130.67.138
May 8, 2024 08:41:40.637841940 CEST	50755	21	192.168.2.16	58.226.219.111
May 8, 2024 08:41:40.653835058 CEST	50633	2121	192.168.2.16	118.241.147.202
May 8, 2024 08:41:40.659113884 CEST	21	50685	89.146.194.41	192.168.2.16
May 8, 2024 08:41:40.659749031 CEST	2121	50660	150.249.78.235	192.168.2.16
May 8, 2024 08:41:40.661900043 CEST	2121	50686	89.146.194.41	192.168.2.16
May 8, 2024 08:41:40.669867039 CEST	50622	21	192.168.2.16	121.188.219.78
May 8, 2024 08:41:40.676068068 CEST	21	50766	34.149.79.8	192.168.2.16
May 8, 2024 08:41:40.676274061 CEST	21	50769	34.149.79.8	192.168.2.16
May 8, 2024 08:41:40.676352024 CEST	50769	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:40.681135893 CEST	2121	50767	34.149.79.8	192.168.2.16
May 8, 2024 08:41:40.681448936 CEST	2121	50770	34.149.79.8	192.168.2.16
May 8, 2024 08:41:40.681509972 CEST	50770	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:40.685849905 CEST	50562	21	192.168.2.16	117.122.241.177
May 8, 2024 08:41:40.696542025 CEST	21	50584	122.117.36.51	192.168.2.16
May 8, 2024 08:41:40.700850964 CEST	50623	2121	192.168.2.16	121.188.219.78
May 8, 2024 08:41:40.700850010 CEST	50759	21	192.168.2.16	50.103.197.66
May 8, 2024 08:41:40.708828926 CEST	50563	2121	192.168.2.16	117.122.241.177
May 8, 2024 08:41:40.725020885 CEST	2121	50684	91.124.109.201	192.168.2.16
May 8, 2024 08:41:40.725490093 CEST	21	50683	91.124.109.201	192.168.2.16
May 8, 2024 08:41:40.732853889 CEST	50763	21	192.168.2.16	138.248.244.221
May 8, 2024 08:41:40.743850946 CEST	2121	50680	187.93.61.109	192.168.2.16
May 8, 2024 08:41:40.761080980 CEST	21	50764	172.120.235.139	192.168.2.16
May 8, 2024 08:41:40.761373043 CEST	21	50764	172.120.235.139	192.168.2.16
May 8, 2024 08:41:40.761553049 CEST	50764	21	192.168.2.16	172.120.235.139
May 8, 2024 08:41:40.764852047 CEST	50595	2121	192.168.2.16	31.167.145.83
May 8, 2024 08:41:40.779825926 CEST	50543	21	192.168.2.16	188.172.30.125
May 8, 2024 08:41:40.780626059 CEST	21	50679	187.93.61.109	192.168.2.16
May 8, 2024 08:41:40.794861078 CEST	50579	2121	192.168.2.16	119.130.67.138
May 8, 2024 08:41:40.809880018 CEST	50581	21	192.168.2.16	99.245.238.42
May 8, 2024 08:41:40.815231085 CEST	21	50737	91.148.140.11	192.168.2.16
May 8, 2024 08:41:40.821935892 CEST	2121	50738	91.148.140.11	192.168.2.16
May 8, 2024 08:41:40.826206923 CEST	50772	21	192.168.2.16	88.201.125.24
May 8, 2024 08:41:40.839181900 CEST	21	50769	34.149.79.8	192.168.2.16
May 8, 2024 08:41:40.839251041 CEST	50769	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:40.839360952 CEST	50769	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:40.839644909 CEST	50773	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:40.840553045 CEST	2121	50721	139.193.23.42	192.168.2.16
May 8, 2024 08:41:40.841850996 CEST	50546	2121	192.168.2.16	188.172.30.125
May 8, 2024 08:41:40.843807936 CEST	2121	50587	122.117.36.51	192.168.2.16
May 8, 2024 08:41:40.843914986 CEST	2121	50770	34.149.79.8	192.168.2.16
May 8, 2024 08:41:40.843966961 CEST	50770	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:40.844063044 CEST	50770	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:40.844306946 CEST	50774	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:40.850920916 CEST	2121	50758	185.108.141.19	192.168.2.16
May 8, 2024 08:41:40.851531029 CEST	21	50757	185.108.141.19	192.168.2.16
May 8, 2024 08:41:40.857841969 CEST	50582	2121	192.168.2.16	99.245.238.42
May 8, 2024 08:41:40.873836040 CEST	50636	21	192.168.2.16	117.223.205.236
May 8, 2024 08:41:40.873861074 CEST	50762	2121	192.168.2.16	50.103.197.66
May 8, 2024 08:41:40.918838024 CEST	21	50604	220.94.220.101	192.168.2.16
May 8, 2024 08:41:40.920901060 CEST	21	50598	175.228.191.237	192.168.2.16
May 8, 2024 08:41:40.922164917 CEST	2121	50599	175.228.191.237	192.168.2.16
May 8, 2024 08:41:40.941379070 CEST	2121	50633	118.241.147.202	192.168.2.16
May 8, 2024 08:41:40.942306042 CEST	2121	50605	220.94.220.101	192.168.2.16
May 8, 2024 08:41:40.956423998 CEST	21	50666	196.210.0.111	192.168.2.16
May 8, 2024 08:41:40.964200020 CEST	2121	50771	81.8.54.42	192.168.2.16
May 8, 2024 08:41:40.969847918 CEST	50639	2121	192.168.2.16	196.185.118.50
May 8, 2024 08:41:40.969851971 CEST	50638	21	192.168.2.16	196.185.118.50
May 8, 2024 08:41:40.971445084 CEST	21	50764	172.120.235.139	192.168.2.16
May 8, 2024 08:41:40.971609116 CEST	50764	21	192.168.2.16	172.120.235.139
May 8, 2024 08:41:40.971836090 CEST	50775	21	192.168.2.16	172.120.235.139
May 8, 2024 08:41:40.982527971 CEST	21	50622	121.188.219.78	192.168.2.16
May 8, 2024 08:41:40.986164093 CEST	50776	2121	192.168.2.16	88.201.125.24
May 8, 2024 08:41:41.001761913 CEST	21	50769	34.149.79.8	192.168.2.16
May 8, 2024 08:41:41.001849890 CEST	50765	2121	192.168.2.16	138.248.244.221
May 8, 2024 08:41:41.002027035 CEST	21	50773	34.149.79.8	192.168.2.16
May 8, 2024 08:41:41.002088070 CEST	50773	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:41.006479025 CEST	2121	50770	34.149.79.8	192.168.2.16
May 8, 2024 08:41:41.006674051 CEST	2121	50774	34.149.79.8	192.168.2.16
May 8, 2024 08:41:41.006764889 CEST	50774	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:41.014338017 CEST	2121	50623	121.188.219.78	192.168.2.16
May 8, 2024 08:41:41.045700073 CEST	21	50763	138.248.244.221	192.168.2.16
May 8, 2024 08:41:41.065860033 CEST	50749	2121	192.168.2.16	107.180.163.199
May 8, 2024 08:41:41.065886021 CEST	50589	2121	192.168.2.16	18.238.193.209
May 8, 2024 08:41:41.065888882 CEST	50746	21	192.168.2.16	107.180.163.199
May 8, 2024 08:41:41.065974951 CEST	50588	21	192.168.2.16	18.238.193.209
May 8, 2024 08:41:41.081846952 CEST	50590	21	192.168.2.16	47.147.17.78
May 8, 2024 08:41:41.081851959 CEST	50591	2121	192.168.2.16	47.147.17.78
May 8, 2024 08:41:41.082457066 CEST	21	50562	117.122.241.177	192.168.2.16
May 8, 2024 08:41:41.082897902 CEST	50777	21	192.168.2.16	220.75.162.147
May 8, 2024 08:41:41.083233118 CEST	2121	50563	117.122.241.177	192.168.2.16
May 8, 2024 08:41:41.083744049 CEST	50778	2121	192.168.2.16	220.75.162.147
May 8, 2024 08:41:41.113838911 CEST	50592	21	192.168.2.16	105.98.9.48
May 8, 2024 08:41:41.113851070 CEST	50593	2121	192.168.2.16	105.98.9.48
May 8, 2024 08:41:41.129862070 CEST	50627	2121	192.168.2.16	96.5.195.29
May 8, 2024 08:41:41.129863024 CEST	50626	21	192.168.2.16	96.5.195.29
May 8, 2024 08:41:41.129894972 CEST	50594	21	192.168.2.16	31.167.145.83
May 8, 2024 08:41:41.129894972 CEST	50696	21	192.168.2.16	153.166.130.220
May 8, 2024 08:41:41.131376028 CEST	2121	50595	31.167.145.83	192.168.2.16
May 8, 2024 08:41:41.145842075 CEST	50601	2121	192.168.2.16	87.56.22.23
May 8, 2024 08:41:41.145843983 CEST	50597	2121	192.168.2.16	98.53.167.176
May 8, 2024 08:41:41.145858049 CEST	50596	21	192.168.2.16	98.53.167.176
May 8, 2024 08:41:41.145972967 CEST	50600	21	192.168.2.16	87.56.22.23
May 8, 2024 08:41:41.153317928 CEST	21	50764	172.120.235.139	192.168.2.16
May 8, 2024 08:41:41.153369904 CEST	50764	21	192.168.2.16	172.120.235.139
May 8, 2024 08:41:41.153517008 CEST	21	50775	172.120.235.139	192.168.2.16
May 8, 2024 08:41:41.153577089 CEST	50775	21	192.168.2.16	172.120.235.139
May 8, 2024 08:41:41.160854101 CEST	50602	21	192.168.2.16	80.184.105.246
May 8, 2024 08:41:41.160855055 CEST	50603	2121	192.168.2.16	80.184.105.246
May 8, 2024 08:41:41.160854101 CEST	50660	2121	192.168.2.16	150.249.78.235
May 8, 2024 08:41:41.160950899 CEST	50685	21	192.168.2.16	89.146.194.41
May 8, 2024 08:41:41.165441990 CEST	21	50773	34.149.79.8	192.168.2.16
May 8, 2024 08:41:41.165528059 CEST	50773	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:41.165605068 CEST	50773	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:41.165813923 CEST	50779	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:41.169209957 CEST	2121	50774	34.149.79.8	192.168.2.16
May 8, 2024 08:41:41.169262886 CEST	50774	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:41.169399023 CEST	50774	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:41.169693947 CEST	50780	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:41.176830053 CEST	50686	2121	192.168.2.16	89.146.194.41
May 8, 2024 08:41:41.176842928 CEST	50608	2121	192.168.2.16	189.82.4.46
May 8, 2024 08:41:41.176842928 CEST	50612	21	192.168.2.16	201.50.159.167
May 8, 2024 08:41:41.176855087 CEST	50609	2121	192.168.2.16	93.211.90.41
May 8, 2024 08:41:41.176856041 CEST	50613	21	192.168.2.16	93.200.149.130
May 8, 2024 08:41:41.176860094 CEST	50607	21	192.168.2.16	93.211.90.41
May 8, 2024 08:41:41.176860094 CEST	50611	2121	192.168.2.16	174.57.15.124
May 8, 2024 08:41:41.176860094 CEST	50606	21	192.168.2.16	189.82.4.46
May 8, 2024 08:41:41.176860094 CEST	50614	2121	192.168.2.16	201.50.159.167
May 8, 2024 08:41:41.176867008 CEST	50610	21	192.168.2.16	174.57.15.124
May 8, 2024 08:41:41.176867962 CEST	50615	2121	192.168.2.16	93.200.149.130
May 8, 2024 08:41:41.192843914 CEST	50616	21	192.168.2.16	75.203.63.250
May 8, 2024 08:41:41.208831072 CEST	50584	21	192.168.2.16	122.117.36.51
May 8, 2024 08:41:41.208846092 CEST	50618	21	192.168.2.16	24.240.231.180
May 8, 2024 08:41:41.209844112 CEST	50619	21	192.168.2.16	94.248.198.31
May 8, 2024 08:41:41.209844112 CEST	50617	2121	192.168.2.16	75.203.63.250
May 8, 2024 08:41:41.209846973 CEST	50620	2121	192.168.2.16	94.248.198.31
May 8, 2024 08:41:41.209849119 CEST	50621	2121	192.168.2.16	24.240.231.180
May 8, 2024 08:41:41.240833044 CEST	50683	21	192.168.2.16	91.124.109.201
May 8, 2024 08:41:41.240842104 CEST	50624	21	192.168.2.16	182.210.166.181
May 8, 2024 08:41:41.240843058 CEST	50630	21	192.168.2.16	222.134.112.234
May 8, 2024 08:41:41.240849972 CEST	50684	2121	192.168.2.16	91.124.109.201
May 8, 2024 08:41:41.240855932 CEST	50625	2121	192.168.2.16	182.210.166.181
May 8, 2024 08:41:41.240860939 CEST	50631	2121	192.168.2.16	222.134.112.234
May 8, 2024 08:41:41.241157055 CEST	50781	21	192.168.2.16	160.121.125.199
May 8, 2024 08:41:41.256860018 CEST	50680	2121	192.168.2.16	187.93.61.109
May 8, 2024 08:41:41.272852898 CEST	50632	21	192.168.2.16	118.241.147.202
May 8, 2024 08:41:41.287833929 CEST	50634	21	192.168.2.16	203.169.193.41
May 8, 2024 08:41:41.288810015 CEST	50679	21	192.168.2.16	187.93.61.109
May 8, 2024 08:41:41.292046070 CEST	21	50746	107.180.163.199	192.168.2.16
May 8, 2024 08:41:41.292191029 CEST	2121	50749	107.180.163.199	192.168.2.16
May 8, 2024 08:41:41.303847075 CEST	50768	21	192.168.2.16	81.8.54.42
May 8, 2024 08:41:41.316378117 CEST	2121	50765	138.248.244.221	192.168.2.16
May 8, 2024 08:41:41.319838047 CEST	50635	2121	192.168.2.16	203.169.193.41
May 8, 2024 08:41:41.320044994 CEST	50737	21	192.168.2.16	91.148.140.11
May 8, 2024 08:41:41.328906059 CEST	21	50773	34.149.79.8	192.168.2.16
May 8, 2024 08:41:41.328953028 CEST	21	50779	34.149.79.8	192.168.2.16
May 8, 2024 08:41:41.329020023 CEST	50779	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:41.332750082 CEST	2121	50774	34.149.79.8	192.168.2.16
May 8, 2024 08:41:41.333178043 CEST	21	50543	188.172.30.125	192.168.2.16
May 8, 2024 08:41:41.333241940 CEST	2121	50780	34.149.79.8	192.168.2.16
May 8, 2024 08:41:41.333296061 CEST	50780	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:41.335829973 CEST	50738	2121	192.168.2.16	91.148.140.11
May 8, 2024 08:41:41.336361885 CEST	50782	2121	192.168.2.16	160.121.125.199
May 8, 2024 08:41:41.346609116 CEST	2121	50627	96.5.195.29	192.168.2.16
May 8, 2024 08:41:41.346654892 CEST	21	50626	96.5.195.29	192.168.2.16
May 8, 2024 08:41:41.347155094 CEST	50783	2121	192.168.2.16	68.87.13.200
May 8, 2024 08:41:41.347206116 CEST	50784	21	192.168.2.16	68.87.13.200
May 8, 2024 08:41:41.348067999 CEST	2121	50639	196.185.118.50	192.168.2.16
May 8, 2024 08:41:41.349690914 CEST	21	50638	196.185.118.50	192.168.2.16
May 8, 2024 08:41:41.351840973 CEST	50721	2121	192.168.2.16	139.193.23.42
May 8, 2024 08:41:41.351855040 CEST	50640	21	192.168.2.16	173.94.208.111
May 8, 2024 08:41:41.351870060 CEST	50587	2121	192.168.2.16	122.117.36.51
May 8, 2024 08:41:41.351875067 CEST	50758	2121	192.168.2.16	185.108.141.19
May 8, 2024 08:41:41.352102995 CEST	50757	21	192.168.2.16	185.108.141.19
May 8, 2024 08:41:41.352102995 CEST	50641	2121	192.168.2.16	173.94.208.111
May 8, 2024 08:41:41.352119923 CEST	50785	21	192.168.2.16	213.126.46.116
May 8, 2024 08:41:41.372694016 CEST	21	50636	117.223.205.236	192.168.2.16
May 8, 2024 08:41:41.372745991 CEST	50636	21	192.168.2.16	117.223.205.236
May 8, 2024 08:41:41.376944065 CEST	21	50775	172.120.235.139	192.168.2.16
May 8, 2024 08:41:41.377075911 CEST	50775	21	192.168.2.16	172.120.235.139
May 8, 2024 08:41:41.392410040 CEST	2121	50546	188.172.30.125	192.168.2.16
May 8, 2024 08:41:41.397414923 CEST	2121	50778	220.75.162.147	192.168.2.16
May 8, 2024 08:41:41.398833990 CEST	50642	2121	192.168.2.16	71.28.130.111
May 8, 2024 08:41:41.398861885 CEST	50643	21	192.168.2.16	71.28.130.111
May 8, 2024 08:41:41.399486065 CEST	21	50777	220.75.162.147	192.168.2.16
May 8, 2024 08:41:41.399516106 CEST	50644	21	192.168.2.16	118.201.139.137
May 8, 2024 08:41:41.411375999 CEST	21	50696	153.166.130.220	192.168.2.16
May 8, 2024 08:41:41.428854942 CEST	50599	2121	192.168.2.16	175.228.191.237
May 8, 2024 08:41:41.428873062 CEST	50604	21	192.168.2.16	220.94.220.101
May 8, 2024 08:41:41.428886890 CEST	50598	21	192.168.2.16	175.228.191.237
May 8, 2024 08:41:41.440886974 CEST	21	50616	75.203.63.250	192.168.2.16
May 8, 2024 08:41:41.444849014 CEST	50633	2121	192.168.2.16	118.241.147.202
May 8, 2024 08:41:41.444849968 CEST	50605	2121	192.168.2.16	220.94.220.101
May 8, 2024 08:41:41.445499897 CEST	2121	50617	75.203.63.250	192.168.2.16
May 8, 2024 08:41:41.453706026 CEST	2121	50660	150.249.78.235	192.168.2.16
May 8, 2024 08:41:41.460838079 CEST	50645	2121	192.168.2.16	118.201.139.137
May 8, 2024 08:41:41.460880041 CEST	50646	21	192.168.2.16	114.199.191.58
May 8, 2024 08:41:41.469295025 CEST	21	50685	89.146.194.41	192.168.2.16
May 8, 2024 08:41:41.476910114 CEST	50771	2121	192.168.2.16	81.8.54.42
May 8, 2024 08:41:41.487891912 CEST	2121	50686	89.146.194.41	192.168.2.16
May 8, 2024 08:41:41.491543055 CEST	21	50779	34.149.79.8	192.168.2.16
May 8, 2024 08:41:41.491619110 CEST	50779	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:41.491720915 CEST	50779	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:41.492003918 CEST	50786	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:41.492827892 CEST	50622	21	192.168.2.16	121.188.219.78
May 8, 2024 08:41:41.492856026 CEST	50647	2121	192.168.2.16	114.199.191.58
May 8, 2024 08:41:41.495722055 CEST	2121	50780	34.149.79.8	192.168.2.16
May 8, 2024 08:41:41.495773077 CEST	50780	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:41.495929956 CEST	50780	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:41.496309996 CEST	50787	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:41.508856058 CEST	50648	21	192.168.2.16	96.110.124.89
May 8, 2024 08:41:41.524578094 CEST	21	50584	122.117.36.51	192.168.2.16
May 8, 2024 08:41:41.524849892 CEST	50623	2121	192.168.2.16	121.188.219.78
May 8, 2024 08:41:41.524854898 CEST	50649	2121	192.168.2.16	96.110.124.89
May 8, 2024 08:41:41.540261030 CEST	50788	2121	192.168.2.16	213.126.46.116
May 8, 2024 08:41:41.554826975 CEST	50651	2121	192.168.2.16	149.165.129.10
May 8, 2024 08:41:41.555036068 CEST	50652	21	192.168.2.16	117.55.191.68
May 8, 2024 08:41:41.555037022 CEST	50763	21	192.168.2.16	138.248.244.221
May 8, 2024 08:41:41.555182934 CEST	50650	21	192.168.2.16	149.165.129.10
May 8, 2024 08:41:41.558701992 CEST	21	50775	172.120.235.139	192.168.2.16
May 8, 2024 08:41:41.559086084 CEST	21	50775	172.120.235.139	192.168.2.16
May 8, 2024 08:41:41.559233904 CEST	50775	21	192.168.2.16	172.120.235.139
May 8, 2024 08:41:41.565946102 CEST	21	50781	160.121.125.199	192.168.2.16
May 8, 2024 08:41:41.570857048 CEST	50654	2121	192.168.2.16	117.55.191.68
May 8, 2024 08:41:41.570981026 CEST	50655	21	192.168.2.16	185.187.236.74
May 8, 2024 08:41:41.581445932 CEST	21	50683	91.124.109.201	192.168.2.16
May 8, 2024 08:41:41.584027052 CEST	2121	50684	91.124.109.201	192.168.2.16
May 8, 2024 08:41:41.612341881 CEST	2121	50680	187.93.61.109	192.168.2.16
May 8, 2024 08:41:41.617850065 CEST	50658	2121	192.168.2.16	185.187.236.74
May 8, 2024 08:41:41.633855104 CEST	50595	2121	192.168.2.16	31.167.145.83
May 8, 2024 08:41:41.654119015 CEST	21	50786	34.149.79.8	192.168.2.16
May 8, 2024 08:41:41.654133081 CEST	21	50779	34.149.79.8	192.168.2.16
May 8, 2024 08:41:41.654192924 CEST	50786	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:41.658237934 CEST	2121	50780	34.149.79.8	192.168.2.16
May 8, 2024 08:41:41.658710003 CEST	2121	50787	34.149.79.8	192.168.2.16
May 8, 2024 08:41:41.658766985 CEST	50787	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:41.667829990 CEST	2121	50587	122.117.36.51	192.168.2.16
May 8, 2024 08:41:41.669300079 CEST	2121	50782	160.121.125.199	192.168.2.16
May 8, 2024 08:41:41.673614979 CEST	21	50737	91.148.140.11	192.168.2.16
May 8, 2024 08:41:41.682182074 CEST	50789	21	192.168.2.16	134.236.56.191
May 8, 2024 08:41:41.695667028 CEST	2121	50738	91.148.140.11	192.168.2.16
May 8, 2024 08:41:41.698501110 CEST	21	50679	187.93.61.109	192.168.2.16
May 8, 2024 08:41:41.708842993 CEST	2121	50758	185.108.141.19	192.168.2.16
May 8, 2024 08:41:41.709897041 CEST	21	50757	185.108.141.19	192.168.2.16
May 8, 2024 08:41:41.726586103 CEST	2121	50721	139.193.23.42	192.168.2.16
May 8, 2024 08:41:41.731091022 CEST	2121	50633	118.241.147.202	192.168.2.16
May 8, 2024 08:41:41.731507063 CEST	50790	2121	192.168.2.16	134.236.56.191
May 8, 2024 08:41:41.741494894 CEST	21	50604	220.94.220.101	192.168.2.16
May 8, 2024 08:41:41.743828058 CEST	21	50598	175.228.191.237	192.168.2.16
May 8, 2024 08:41:41.744931936 CEST	2121	50599	175.228.191.237	192.168.2.16
May 8, 2024 08:41:41.745472908 CEST	50791	21	192.168.2.16	88.70.150.113
May 8, 2024 08:41:41.760355949 CEST	21	50775	172.120.235.139	192.168.2.16
May 8, 2024 08:41:41.760535002 CEST	50775	21	192.168.2.16	172.120.235.139
May 8, 2024 08:41:41.760768890 CEST	50792	21	192.168.2.16	172.120.235.139
May 8, 2024 08:41:41.762206078 CEST	50793	2121	192.168.2.16	88.70.150.113
May 8, 2024 08:41:41.762257099 CEST	50794	21	192.168.2.16	221.160.134.94
May 8, 2024 08:41:41.764219046 CEST	2121	50605	220.94.220.101	192.168.2.16
May 8, 2024 08:41:41.764544964 CEST	50795	2121	192.168.2.16	221.160.134.94
May 8, 2024 08:41:41.776874065 CEST	50659	21	192.168.2.16	150.249.78.235
May 8, 2024 08:41:41.793997049 CEST	50746	21	192.168.2.16	107.180.163.199
May 8, 2024 08:41:41.794047117 CEST	50661	21	192.168.2.16	23.199.47.76
May 8, 2024 08:41:41.794790983 CEST	50749	2121	192.168.2.16	107.180.163.199
May 8, 2024 08:41:41.794792891 CEST	50662	2121	192.168.2.16	23.199.47.76
May 8, 2024 08:41:41.805839062 CEST	21	50622	121.188.219.78	192.168.2.16
May 8, 2024 08:41:41.806350946 CEST	50796	21	192.168.2.16	98.63.16.46
May 8, 2024 08:41:41.816401005 CEST	21	50786	34.149.79.8	192.168.2.16
May 8, 2024 08:41:41.816467047 CEST	50786	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:41.816596031 CEST	50786	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:41.816809893 CEST	50797	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:41.821202993 CEST	2121	50787	34.149.79.8	192.168.2.16
May 8, 2024 08:41:41.821264029 CEST	50787	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:41.821367979 CEST	50787	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:41.822549105 CEST	50798	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:41.823863029 CEST	50765	2121	192.168.2.16	138.248.244.221
May 8, 2024 08:41:41.835244894 CEST	2121	50771	81.8.54.42	192.168.2.16
May 8, 2024 08:41:41.837054968 CEST	2121	50623	121.188.219.78	192.168.2.16
May 8, 2024 08:41:41.838386059 CEST	50799	2121	192.168.2.16	98.63.16.46
May 8, 2024 08:41:41.839855909 CEST	50663	21	192.168.2.16	182.215.181.166
May 8, 2024 08:41:41.842006922 CEST	50772	21	192.168.2.16	88.201.125.24
May 8, 2024 08:41:41.855855942 CEST	50638	21	192.168.2.16	196.185.118.50
May 8, 2024 08:41:41.856575012 CEST	50639	2121	192.168.2.16	196.185.118.50
May 8, 2024 08:41:41.867652893 CEST	21	50763	138.248.244.221	192.168.2.16
May 8, 2024 08:41:41.903891087 CEST	50777	21	192.168.2.16	220.75.162.147
May 8, 2024 08:41:41.903901100 CEST	50778	2121	192.168.2.16	220.75.162.147
May 8, 2024 08:41:41.904267073 CEST	50800	21	192.168.2.16	87.52.4.149
May 8, 2024 08:41:41.911828041 CEST	21	50570	77.75.121.3	192.168.2.16
May 8, 2024 08:41:41.911979914 CEST	50570	21	192.168.2.16	77.75.121.3
May 8, 2024 08:41:41.912158012 CEST	50801	21	192.168.2.16	77.75.121.3
May 8, 2024 08:41:41.919836044 CEST	50696	21	192.168.2.16	153.166.130.220
May 8, 2024 08:41:41.923563957 CEST	21	50666	196.210.0.111	192.168.2.16
May 8, 2024 08:41:41.923708916 CEST	50666	21	192.168.2.16	196.210.0.111
May 8, 2024 08:41:41.923943043 CEST	50802	21	192.168.2.16	196.210.0.111
May 8, 2024 08:41:41.936184883 CEST	50803	2121	192.168.2.16	87.52.4.149
May 8, 2024 08:41:41.942389011 CEST	21	50775	172.120.235.139	192.168.2.16
May 8, 2024 08:41:41.942439079 CEST	21	50792	172.120.235.139	192.168.2.16
May 8, 2024 08:41:41.942445040 CEST	50775	21	192.168.2.16	172.120.235.139
May 8, 2024 08:41:41.942501068 CEST	50792	21	192.168.2.16	172.120.235.139
May 8, 2024 08:41:41.951831102 CEST	50617	2121	192.168.2.16	75.203.63.250
May 8, 2024 08:41:41.951853991 CEST	50616	21	192.168.2.16	75.203.63.250
May 8, 2024 08:41:41.952131987 CEST	50804	21	192.168.2.16	188.119.99.201
May 8, 2024 08:41:41.967828989 CEST	50660	2121	192.168.2.16	150.249.78.235
May 8, 2024 08:41:41.978652000 CEST	21	50786	34.149.79.8	192.168.2.16
May 8, 2024 08:41:41.979190111 CEST	21	50797	34.149.79.8	192.168.2.16
May 8, 2024 08:41:41.979259014 CEST	50797	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:41.983674049 CEST	2121	50787	34.149.79.8	192.168.2.16
May 8, 2024 08:41:41.983851910 CEST	50685	21	192.168.2.16	89.146.194.41
May 8, 2024 08:41:41.984075069 CEST	50805	2121	192.168.2.16	188.119.99.201
May 8, 2024 08:41:41.984970093 CEST	2121	50798	34.149.79.8	192.168.2.16
May 8, 2024 08:41:41.985033035 CEST	50798	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:41.999831915 CEST	50686	2121	192.168.2.16	89.146.194.41
May 8, 2024 08:41:42.001991034 CEST	2121	50595	31.167.145.83	192.168.2.16
May 8, 2024 08:41:42.005824089 CEST	50776	2121	192.168.2.16	88.201.125.24
May 8, 2024 08:41:42.016068935 CEST	50806	21	192.168.2.16	105.157.164.183
May 8, 2024 08:41:42.023086071 CEST	21	50746	107.180.163.199	192.168.2.16
May 8, 2024 08:41:42.023114920 CEST	2121	50749	107.180.163.199	192.168.2.16
May 8, 2024 08:41:42.076678038 CEST	21	50794	221.160.134.94	192.168.2.16
May 8, 2024 08:41:42.079336882 CEST	2121	50795	221.160.134.94	192.168.2.16
May 8, 2024 08:41:42.079862118 CEST	50781	21	192.168.2.16	160.121.125.199
May 8, 2024 08:41:42.089649916 CEST	50684	2121	192.168.2.16	91.124.109.201
May 8, 2024 08:41:42.095839024 CEST	50683	21	192.168.2.16	91.124.109.201
May 8, 2024 08:41:42.126883030 CEST	50680	2121	192.168.2.16	187.93.61.109
May 8, 2024 08:41:42.138355970 CEST	2121	50765	138.248.244.221	192.168.2.16
May 8, 2024 08:41:42.141710997 CEST	21	50797	34.149.79.8	192.168.2.16
May 8, 2024 08:41:42.141777992 CEST	50797	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:42.141881943 CEST	50797	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:42.142132044 CEST	50807	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:42.147496939 CEST	2121	50798	34.149.79.8	192.168.2.16
May 8, 2024 08:41:42.147542000 CEST	50798	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:42.147686005 CEST	50798	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:42.147986889 CEST	50808	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:42.159975052 CEST	21	50792	172.120.235.139	192.168.2.16
May 8, 2024 08:41:42.160197020 CEST	50792	21	192.168.2.16	172.120.235.139
May 8, 2024 08:41:42.174873114 CEST	50782	2121	192.168.2.16	160.121.125.199
May 8, 2024 08:41:42.177824974 CEST	50737	21	192.168.2.16	91.148.140.11
May 8, 2024 08:41:42.201639891 CEST	21	50696	153.166.130.220	192.168.2.16
May 8, 2024 08:41:42.206835032 CEST	50679	21	192.168.2.16	187.93.61.109
May 8, 2024 08:41:42.206856012 CEST	50738	2121	192.168.2.16	91.148.140.11
May 8, 2024 08:41:42.216828108 CEST	2121	50778	220.75.162.147	192.168.2.16
May 8, 2024 08:41:42.219909906 CEST	21	50777	220.75.162.147	192.168.2.16
May 8, 2024 08:41:42.220570087 CEST	2121	50639	196.185.118.50	192.168.2.16
May 8, 2024 08:41:42.220983982 CEST	50809	2121	192.168.2.16	105.157.164.183
May 8, 2024 08:41:42.221834898 CEST	50757	21	192.168.2.16	185.108.141.19
May 8, 2024 08:41:42.221848011 CEST	50667	2121	192.168.2.16	182.215.181.166
May 8, 2024 08:41:42.221997023 CEST	50758	2121	192.168.2.16	185.108.141.19
May 8, 2024 08:41:42.222210884 CEST	21	50638	196.185.118.50	192.168.2.16
May 8, 2024 08:41:42.222408056 CEST	21	50570	77.75.121.3	192.168.2.16
May 8, 2024 08:41:42.222464085 CEST	50570	21	192.168.2.16	77.75.121.3
May 8, 2024 08:41:42.222481012 CEST	21	50801	77.75.121.3	192.168.2.16
May 8, 2024 08:41:42.222544909 CEST	50801	21	192.168.2.16	77.75.121.3
May 8, 2024 08:41:42.222630024 CEST	50810	21	192.168.2.16	118.220.95.143
May 8, 2024 08:41:42.222824097 CEST	21	50570	77.75.121.3	192.168.2.16
May 8, 2024 08:41:42.222867012 CEST	50570	21	192.168.2.16	77.75.121.3
May 8, 2024 08:41:42.237828970 CEST	50721	2121	192.168.2.16	139.193.23.42
May 8, 2024 08:41:42.238141060 CEST	50811	2121	192.168.2.16	118.220.95.143
May 8, 2024 08:41:42.254189968 CEST	50812	21	192.168.2.16	96.85.20.90
May 8, 2024 08:41:42.254334927 CEST	50813	2121	192.168.2.16	96.85.20.90
May 8, 2024 08:41:42.260699034 CEST	2121	50660	150.249.78.235	192.168.2.16
May 8, 2024 08:41:42.270071983 CEST	50814	21	192.168.2.16	212.164.173.133
May 8, 2024 08:41:42.292121887 CEST	21	50685	89.146.194.41	192.168.2.16
May 8, 2024 08:41:42.305421114 CEST	21	50797	34.149.79.8	192.168.2.16
May 8, 2024 08:41:42.305435896 CEST	21	50807	34.149.79.8	192.168.2.16
May 8, 2024 08:41:42.305505037 CEST	50807	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:42.310425043 CEST	2121	50798	34.149.79.8	192.168.2.16
May 8, 2024 08:41:42.311047077 CEST	2121	50686	89.146.194.41	192.168.2.16
May 8, 2024 08:41:42.311482906 CEST	2121	50808	34.149.79.8	192.168.2.16
May 8, 2024 08:41:42.311542988 CEST	50808	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:42.333843946 CEST	50670	21	192.168.2.16	124.171.67.161
May 8, 2024 08:41:42.344177008 CEST	21	50792	172.120.235.139	192.168.2.16
May 8, 2024 08:41:42.344497919 CEST	21	50792	172.120.235.139	192.168.2.16
May 8, 2024 08:41:42.344635010 CEST	50792	21	192.168.2.16	172.120.235.139
May 8, 2024 08:41:42.349841118 CEST	50671	2121	192.168.2.16	124.171.67.161
May 8, 2024 08:41:42.349852085 CEST	50771	2121	192.168.2.16	81.8.54.42
May 8, 2024 08:41:42.349853039 CEST	50783	2121	192.168.2.16	68.87.13.200
May 8, 2024 08:41:42.349853992 CEST	50784	21	192.168.2.16	68.87.13.200
May 8, 2024 08:41:42.350224018 CEST	50815	2121	192.168.2.16	212.164.173.133
May 8, 2024 08:41:42.365833044 CEST	50785	21	192.168.2.16	213.126.46.116
May 8, 2024 08:41:42.381860971 CEST	50763	21	192.168.2.16	138.248.244.221
May 8, 2024 08:41:42.382210970 CEST	50816	21	192.168.2.16	70.189.164.125
May 8, 2024 08:41:42.398397923 CEST	50817	2121	192.168.2.16	70.189.164.125
May 8, 2024 08:41:42.398468018 CEST	50818	2121	192.168.2.16	186.35.168.1
May 8, 2024 08:41:42.399620056 CEST	50819	21	192.168.2.16	186.35.168.1
May 8, 2024 08:41:42.404769897 CEST	21	50781	160.121.125.199	192.168.2.16
May 8, 2024 08:41:42.406023979 CEST	21	50666	196.210.0.111	192.168.2.16
May 8, 2024 08:41:42.406081915 CEST	50666	21	192.168.2.16	196.210.0.111
May 8, 2024 08:41:42.409245014 CEST	21	50802	196.210.0.111	192.168.2.16
May 8, 2024 08:41:42.409316063 CEST	50802	21	192.168.2.16	196.210.0.111
May 8, 2024 08:41:42.430129051 CEST	50820	21	192.168.2.16	123.182.56.87
May 8, 2024 08:41:42.436414003 CEST	2121	50684	91.124.109.201	192.168.2.16
May 8, 2024 08:41:42.440179110 CEST	21	50683	91.124.109.201	192.168.2.16
May 8, 2024 08:41:42.467894077 CEST	21	50807	34.149.79.8	192.168.2.16
May 8, 2024 08:41:42.467962027 CEST	50807	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:42.468039989 CEST	50807	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:42.468255997 CEST	50821	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:42.473983049 CEST	2121	50808	34.149.79.8	192.168.2.16
May 8, 2024 08:41:42.474034071 CEST	50808	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:42.474143028 CEST	50808	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:42.474426985 CEST	50822	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:42.483131886 CEST	2121	50680	187.93.61.109	192.168.2.16
May 8, 2024 08:41:42.493840933 CEST	50673	21	192.168.2.16	114.253.195.224
May 8, 2024 08:41:42.507179976 CEST	2121	50782	160.121.125.199	192.168.2.16
May 8, 2024 08:41:42.510494947 CEST	50824	21	192.168.2.16	5.74.101.111
May 8, 2024 08:41:42.510494947 CEST	50823	2121	192.168.2.16	123.182.56.87
May 8, 2024 08:41:42.525832891 CEST	50746	21	192.168.2.16	107.180.163.199
May 8, 2024 08:41:42.525901079 CEST	50749	2121	192.168.2.16	107.180.163.199
May 8, 2024 08:41:42.531614065 CEST	21	50737	91.148.140.11	192.168.2.16
May 8, 2024 08:41:42.533756971 CEST	21	50801	77.75.121.3	192.168.2.16
May 8, 2024 08:41:42.533962011 CEST	50801	21	192.168.2.16	77.75.121.3
May 8, 2024 08:41:42.540833950 CEST	50788	2121	192.168.2.16	213.126.46.116
May 8, 2024 08:41:42.540848970 CEST	50675	21	192.168.2.16	41.249.84.185
May 8, 2024 08:41:42.540848970 CEST	50674	2121	192.168.2.16	114.253.195.224
May 8, 2024 08:41:42.545582056 CEST	21	50792	172.120.235.139	192.168.2.16
May 8, 2024 08:41:42.545711994 CEST	50792	21	192.168.2.16	172.120.235.139
May 8, 2024 08:41:42.545911074 CEST	50825	21	192.168.2.16	172.120.235.139
May 8, 2024 08:41:42.556830883 CEST	50687	21	192.168.2.16	74.199.143.226
May 8, 2024 08:41:42.556844950 CEST	50682	2121	192.168.2.16	20.82.244.57
May 8, 2024 08:41:42.556845903 CEST	50688	2121	192.168.2.16	74.199.143.226
May 8, 2024 08:41:42.556848049 CEST	50692	21	192.168.2.16	5.157.128.113
May 8, 2024 08:41:42.556848049 CEST	50678	2121	192.168.2.16	62.194.129.219
May 8, 2024 08:41:42.556860924 CEST	50698	21	192.168.2.16	220.71.50.238
May 8, 2024 08:41:42.556863070 CEST	50693	2121	192.168.2.16	5.157.128.113
May 8, 2024 08:41:42.556865931 CEST	50697	2121	192.168.2.16	153.166.130.220
May 8, 2024 08:41:42.556866884 CEST	50691	2121	192.168.2.16	188.83.33.111
May 8, 2024 08:41:42.556865931 CEST	50694	21	192.168.2.16	88.203.169.112
May 8, 2024 08:41:42.556865931 CEST	50676	2121	192.168.2.16	41.249.84.185
May 8, 2024 08:41:42.556884050 CEST	50699	2121	192.168.2.16	220.71.50.238
May 8, 2024 08:41:42.556889057 CEST	50690	21	192.168.2.16	188.83.33.111
May 8, 2024 08:41:42.556890011 CEST	50677	21	192.168.2.16	62.194.129.219
May 8, 2024 08:41:42.556890011 CEST	50681	21	192.168.2.16	20.82.244.57
May 8, 2024 08:41:42.556890011 CEST	50695	2121	192.168.2.16	88.203.169.112
May 8, 2024 08:41:42.561577082 CEST	21	50679	187.93.61.109	192.168.2.16
May 8, 2024 08:41:42.567148924 CEST	2121	50738	91.148.140.11	192.168.2.16
May 8, 2024 08:41:42.572835922 CEST	50707	21	192.168.2.16	125.161.237.221
May 8, 2024 08:41:42.572844028 CEST	50702	2121	192.168.2.16	148.255.21.179
May 8, 2024 08:41:42.572846889 CEST	50711	2121	192.168.2.16	13.114.86.103
May 8, 2024 08:41:42.572846889 CEST	50701	21	192.168.2.16	148.255.21.179
May 8, 2024 08:41:42.572855949 CEST	50710	21	192.168.2.16	113.211.46.82
May 8, 2024 08:41:42.572855949 CEST	50703	21	192.168.2.16	104.19.117.184
May 8, 2024 08:41:42.572865963 CEST	50706	2121	192.168.2.16	5.161.14.111
May 8, 2024 08:41:42.572865963 CEST	50705	21	192.168.2.16	5.161.14.111
May 8, 2024 08:41:42.572865963 CEST	50704	2121	192.168.2.16	104.19.117.184
May 8, 2024 08:41:42.572870970 CEST	50708	2121	192.168.2.16	125.161.237.221
May 8, 2024 08:41:42.573014021 CEST	50709	21	192.168.2.16	13.114.86.103
May 8, 2024 08:41:42.578969955 CEST	2121	50758	185.108.141.19	192.168.2.16
May 8, 2024 08:41:42.579637051 CEST	21	50757	185.108.141.19	192.168.2.16
May 8, 2024 08:41:42.588830948 CEST	50712	2121	192.168.2.16	113.211.46.82
May 8, 2024 08:41:42.588831902 CEST	50795	2121	192.168.2.16	221.160.134.94
May 8, 2024 08:41:42.588849068 CEST	50794	21	192.168.2.16	221.160.134.94
May 8, 2024 08:41:42.604831934 CEST	50714	2121	192.168.2.16	73.188.101.101
May 8, 2024 08:41:42.604835987 CEST	50716	21	192.168.2.16	89.217.82.219
May 8, 2024 08:41:42.604837894 CEST	50713	21	192.168.2.16	73.188.101.101
May 8, 2024 08:41:42.604862928 CEST	50726	2121	192.168.2.16	37.209.172.36
May 8, 2024 08:41:42.604862928 CEST	50722	21	192.168.2.16	125.132.248.234
May 8, 2024 08:41:42.604863882 CEST	50717	2121	192.168.2.16	89.217.82.219
May 8, 2024 08:41:42.604862928 CEST	50715	21	192.168.2.16	124.162.52.179
May 8, 2024 08:41:42.604862928 CEST	50724	21	192.168.2.16	222.97.72.53
May 8, 2024 08:41:42.604865074 CEST	50723	2121	192.168.2.16	125.132.248.234
May 8, 2024 08:41:42.604866028 CEST	50718	21	192.168.2.16	100.25.239.63
May 8, 2024 08:41:42.604866028 CEST	50720	21	192.168.2.16	139.193.23.42
May 8, 2024 08:41:42.604866028 CEST	50728	2121	192.168.2.16	124.162.52.179
May 8, 2024 08:41:42.604867935 CEST	50719	2121	192.168.2.16	100.25.239.63
May 8, 2024 08:41:42.604868889 CEST	50729	2121	192.168.2.16	14.95.143.135
May 8, 2024 08:41:42.604868889 CEST	50727	21	192.168.2.16	14.95.143.135
May 8, 2024 08:41:42.604971886 CEST	50730	2121	192.168.2.16	222.97.72.53
May 8, 2024 08:41:42.604974985 CEST	50731	21	192.168.2.16	146.112.45.212
May 8, 2024 08:41:42.604976892 CEST	50725	21	192.168.2.16	37.209.172.36
May 8, 2024 08:41:42.605402946 CEST	50826	21	192.168.2.16	27.212.221.89
May 8, 2024 08:41:42.605432987 CEST	50827	2121	192.168.2.16	5.74.101.111
May 8, 2024 08:41:42.612643003 CEST	2121	50721	139.193.23.42	192.168.2.16
May 8, 2024 08:41:42.620829105 CEST	50743	21	192.168.2.16	216.212.41.244
May 8, 2024 08:41:42.620832920 CEST	50732	2121	192.168.2.16	146.112.45.212
May 8, 2024 08:41:42.620834112 CEST	50735	21	192.168.2.16	5.146.116.46
May 8, 2024 08:41:42.620847940 CEST	50740	2121	192.168.2.16	103.221.228.41
May 8, 2024 08:41:42.620847940 CEST	50739	21	192.168.2.16	103.221.228.41
May 8, 2024 08:41:42.620847940 CEST	50736	2121	192.168.2.16	5.146.116.46
May 8, 2024 08:41:42.620847940 CEST	50744	2121	192.168.2.16	216.212.41.244
May 8, 2024 08:41:42.620848894 CEST	50734	2121	192.168.2.16	82.14.81.130
May 8, 2024 08:41:42.620847940 CEST	50742	2121	192.168.2.16	179.24.77.182
May 8, 2024 08:41:42.620861053 CEST	50741	21	192.168.2.16	179.24.77.182
May 8, 2024 08:41:42.620861053 CEST	50747	2121	192.168.2.16	121.173.245.205
May 8, 2024 08:41:42.620862961 CEST	50748	21	192.168.2.16	174.84.63.229
May 8, 2024 08:41:42.620863914 CEST	50750	2121	192.168.2.16	174.84.63.229
May 8, 2024 08:41:42.620865107 CEST	50745	21	192.168.2.16	121.173.245.205
May 8, 2024 08:41:42.620865107 CEST	50733	21	192.168.2.16	82.14.81.130
May 8, 2024 08:41:42.620866060 CEST	50752	2121	192.168.2.16	187.224.87.250
May 8, 2024 08:41:42.620887041 CEST	50751	21	192.168.2.16	187.224.87.250
May 8, 2024 08:41:42.620903969 CEST	50753	21	192.168.2.16	191.6.221.165
May 8, 2024 08:41:42.630386114 CEST	21	50807	34.149.79.8	192.168.2.16
May 8, 2024 08:41:42.630630016 CEST	21	50821	34.149.79.8	192.168.2.16
May 8, 2024 08:41:42.630692005 CEST	50821	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:42.636478901 CEST	2121	50808	34.149.79.8	192.168.2.16
May 8, 2024 08:41:42.636545897 CEST	2121	50822	34.149.79.8	192.168.2.16
May 8, 2024 08:41:42.636600971 CEST	50822	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:42.637075901 CEST	50828	2121	192.168.2.16	27.212.221.89
May 8, 2024 08:41:42.652836084 CEST	50754	2121	192.168.2.16	191.6.221.165
May 8, 2024 08:41:42.652837038 CEST	50756	2121	192.168.2.16	58.226.219.111
May 8, 2024 08:41:42.652851105 CEST	50755	21	192.168.2.16	58.226.219.111
May 8, 2024 08:41:42.652852058 CEST	50765	2121	192.168.2.16	138.248.244.221
May 8, 2024 08:41:42.684926987 CEST	50789	21	192.168.2.16	134.236.56.191
May 8, 2024 08:41:42.694521904 CEST	21	50763	138.248.244.221	192.168.2.16
May 8, 2024 08:41:42.700855017 CEST	50759	21	192.168.2.16	50.103.197.66
May 8, 2024 08:41:42.705044031 CEST	2121	50771	81.8.54.42	192.168.2.16
May 8, 2024 08:41:42.716835022 CEST	50696	21	192.168.2.16	153.166.130.220
May 8, 2024 08:41:42.727514982 CEST	21	50792	172.120.235.139	192.168.2.16
May 8, 2024 08:41:42.727591038 CEST	21	50825	172.120.235.139	192.168.2.16
May 8, 2024 08:41:42.727606058 CEST	50792	21	192.168.2.16	172.120.235.139
May 8, 2024 08:41:42.727673054 CEST	50825	21	192.168.2.16	172.120.235.139
May 8, 2024 08:41:42.732866049 CEST	50778	2121	192.168.2.16	220.75.162.147
May 8, 2024 08:41:42.732871056 CEST	50777	21	192.168.2.16	220.75.162.147
May 8, 2024 08:41:42.733022928 CEST	50790	2121	192.168.2.16	134.236.56.191
May 8, 2024 08:41:42.749663115 CEST	50791	21	192.168.2.16	88.70.150.113
May 8, 2024 08:41:42.752022982 CEST	21	50746	107.180.163.199	192.168.2.16
May 8, 2024 08:41:42.752152920 CEST	2121	50749	107.180.163.199	192.168.2.16
May 8, 2024 08:41:42.752660990 CEST	50829	2121	192.168.2.16	73.242.1.186
May 8, 2024 08:41:42.752676964 CEST	50830	21	192.168.2.16	73.242.1.186
May 8, 2024 08:41:42.764853001 CEST	50793	2121	192.168.2.16	88.70.150.113
May 8, 2024 08:41:42.781163931 CEST	50831	21	192.168.2.16	78.150.131.82
May 8, 2024 08:41:42.793140888 CEST	21	50821	34.149.79.8	192.168.2.16
May 8, 2024 08:41:42.793205023 CEST	50821	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:42.793272018 CEST	50821	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:42.793464899 CEST	50832	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:42.796860933 CEST	50685	21	192.168.2.16	89.146.194.41
May 8, 2024 08:41:42.797152042 CEST	50833	2121	192.168.2.16	78.150.131.82
May 8, 2024 08:41:42.798840046 CEST	2121	50822	34.149.79.8	192.168.2.16
May 8, 2024 08:41:42.798902988 CEST	50822	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:42.798995972 CEST	50822	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:42.799228907 CEST	50834	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:42.812875986 CEST	50796	21	192.168.2.16	98.63.16.46
May 8, 2024 08:41:42.812875986 CEST	50686	2121	192.168.2.16	89.146.194.41
May 8, 2024 08:41:42.844263077 CEST	21	50801	77.75.121.3	192.168.2.16
May 8, 2024 08:41:42.844355106 CEST	21	50801	77.75.121.3	192.168.2.16
May 8, 2024 08:41:42.844511032 CEST	50801	21	192.168.2.16	77.75.121.3
May 8, 2024 08:41:42.844850063 CEST	50799	2121	192.168.2.16	98.63.16.46
May 8, 2024 08:41:42.845204115 CEST	50835	21	192.168.2.16	196.221.170.61
May 8, 2024 08:41:42.876858950 CEST	50762	2121	192.168.2.16	50.103.197.66
May 8, 2024 08:41:42.903424025 CEST	21	50794	221.160.134.94	192.168.2.16
May 8, 2024 08:41:42.904072046 CEST	2121	50795	221.160.134.94	192.168.2.16
May 8, 2024 08:41:42.908858061 CEST	50781	21	192.168.2.16	160.121.125.199
May 8, 2024 08:41:42.908878088 CEST	50800	21	192.168.2.16	87.52.4.149
May 8, 2024 08:41:42.930179119 CEST	21	50802	196.210.0.111	192.168.2.16
May 8, 2024 08:41:42.930346966 CEST	50802	21	192.168.2.16	196.210.0.111
May 8, 2024 08:41:42.940853119 CEST	50684	2121	192.168.2.16	91.124.109.201
May 8, 2024 08:41:42.940853119 CEST	50803	2121	192.168.2.16	87.52.4.149
May 8, 2024 08:41:42.941998959 CEST	50683	21	192.168.2.16	91.124.109.201
May 8, 2024 08:41:42.942167044 CEST	21	50826	27.212.221.89	192.168.2.16
May 8, 2024 08:41:42.946634054 CEST	21	50825	172.120.235.139	192.168.2.16
May 8, 2024 08:41:42.946757078 CEST	50825	21	192.168.2.16	172.120.235.139
May 8, 2024 08:41:42.955677986 CEST	21	50821	34.149.79.8	192.168.2.16
May 8, 2024 08:41:42.955792904 CEST	21	50832	34.149.79.8	192.168.2.16
May 8, 2024 08:41:42.955856085 CEST	50832	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:42.956855059 CEST	50804	21	192.168.2.16	188.119.99.201
May 8, 2024 08:41:42.961241961 CEST	2121	50822	34.149.79.8	192.168.2.16
May 8, 2024 08:41:42.961616039 CEST	2121	50834	34.149.79.8	192.168.2.16
May 8, 2024 08:41:42.961672068 CEST	50834	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:42.967386007 CEST	2121	50765	138.248.244.221	192.168.2.16
May 8, 2024 08:41:42.976761103 CEST	2121	50828	27.212.221.89	192.168.2.16
May 8, 2024 08:41:42.988848925 CEST	50680	2121	192.168.2.16	187.93.61.109
May 8, 2024 08:41:42.988902092 CEST	50805	2121	192.168.2.16	188.119.99.201
May 8, 2024 08:41:42.998212099 CEST	21	50696	153.166.130.220	192.168.2.16
May 8, 2024 08:41:43.020862103 CEST	50782	2121	192.168.2.16	160.121.125.199
May 8, 2024 08:41:43.021205902 CEST	50836	2121	192.168.2.16	196.221.170.61
May 8, 2024 08:41:43.021207094 CEST	50806	21	192.168.2.16	105.157.164.183
May 8, 2024 08:41:43.036869049 CEST	50737	21	192.168.2.16	91.148.140.11
May 8, 2024 08:41:43.046557903 CEST	2121	50778	220.75.162.147	192.168.2.16
May 8, 2024 08:41:43.049642086 CEST	21	50777	220.75.162.147	192.168.2.16
May 8, 2024 08:41:43.068872929 CEST	50738	2121	192.168.2.16	91.148.140.11
May 8, 2024 08:41:43.068875074 CEST	50679	21	192.168.2.16	187.93.61.109
May 8, 2024 08:41:43.070009947 CEST	50838	2121	192.168.2.16	194.106.247.204
May 8, 2024 08:41:43.070012093 CEST	50837	21	192.168.2.16	194.106.247.204
May 8, 2024 08:41:43.070146084 CEST	50839	21	192.168.2.16	49.160.65.205
May 8, 2024 08:41:43.070213079 CEST	50840	2121	192.168.2.16	49.160.65.205
May 8, 2024 08:41:43.083848000 CEST	50758	2121	192.168.2.16	185.108.141.19
May 8, 2024 08:41:43.083853006 CEST	50757	21	192.168.2.16	185.108.141.19
May 8, 2024 08:41:43.100342989 CEST	50841	21	192.168.2.16	83.38.110.136
May 8, 2024 08:41:43.100370884 CEST	50842	2121	192.168.2.16	83.38.110.136
May 8, 2024 08:41:43.105118036 CEST	21	50685	89.146.194.41	192.168.2.16
May 8, 2024 08:41:43.110907078 CEST	21	50578	23.229.188.101	192.168.2.16
May 8, 2024 08:41:43.111089945 CEST	50578	21	192.168.2.16	23.229.188.101
May 8, 2024 08:41:43.111397982 CEST	50843	21	192.168.2.16	23.229.188.101
May 8, 2024 08:41:43.115845919 CEST	50721	2121	192.168.2.16	139.193.23.42
May 8, 2024 08:41:43.116424084 CEST	50844	21	192.168.2.16	186.249.29.73
May 8, 2024 08:41:43.116563082 CEST	50845	2121	192.168.2.16	186.249.29.73
May 8, 2024 08:41:43.118319035 CEST	21	50832	34.149.79.8	192.168.2.16
May 8, 2024 08:41:43.118371964 CEST	50832	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:43.119626999 CEST	50832	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:43.119834900 CEST	50846	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:43.123933077 CEST	2121	50686	89.146.194.41	192.168.2.16
May 8, 2024 08:41:43.124056101 CEST	2121	50834	34.149.79.8	192.168.2.16
May 8, 2024 08:41:43.124111891 CEST	50834	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:43.124195099 CEST	50834	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:43.124416113 CEST	50847	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:43.128539085 CEST	21	50825	172.120.235.139	192.168.2.16
May 8, 2024 08:41:43.128799915 CEST	21	50825	172.120.235.139	192.168.2.16
May 8, 2024 08:41:43.128948927 CEST	50825	21	192.168.2.16	172.120.235.139
May 8, 2024 08:41:43.132474899 CEST	50848	21	192.168.2.16	1.222.95.228
May 8, 2024 08:41:43.132543087 CEST	50849	2121	192.168.2.16	1.222.95.228
May 8, 2024 08:41:43.132580042 CEST	50850	21	192.168.2.16	73.43.146.204
May 8, 2024 08:41:43.132636070 CEST	50851	2121	192.168.2.16	73.43.146.204
May 8, 2024 08:41:43.148308992 CEST	50852	21	192.168.2.16	99.254.103.133
May 8, 2024 08:41:43.148387909 CEST	50853	2121	192.168.2.16	99.254.103.133
May 8, 2024 08:41:43.148423910 CEST	50854	21	192.168.2.16	156.248.94.29
May 8, 2024 08:41:43.164427042 CEST	50855	2121	192.168.2.16	156.248.94.29
May 8, 2024 08:41:43.164443970 CEST	50856	21	192.168.2.16	141.94.36.78
May 8, 2024 08:41:43.164525032 CEST	50857	2121	192.168.2.16	141.94.36.78
May 8, 2024 08:41:43.180563927 CEST	50858	21	192.168.2.16	181.118.173.28
May 8, 2024 08:41:43.180613995 CEST	50859	2121	192.168.2.16	181.118.173.28
May 8, 2024 08:41:43.180722952 CEST	50860	21	192.168.2.16	78.193.204.75
May 8, 2024 08:41:43.180785894 CEST	50861	2121	192.168.2.16	78.193.204.75
May 8, 2024 08:41:43.180854082 CEST	50862	21	192.168.2.16	81.36.175.43
May 8, 2024 08:41:43.180891991 CEST	50863	2121	192.168.2.16	81.36.175.43
May 8, 2024 08:41:43.180963039 CEST	50864	21	192.168.2.16	114.96.100.230
May 8, 2024 08:41:43.193979025 CEST	21	50801	77.75.121.3	192.168.2.16
May 8, 2024 08:41:43.195866108 CEST	50763	21	192.168.2.16	138.248.244.221
May 8, 2024 08:41:43.196480036 CEST	50865	2121	192.168.2.16	114.96.100.230
May 8, 2024 08:41:43.196485996 CEST	50866	2121	192.168.2.16	177.55.34.22
May 8, 2024 08:41:43.196557045 CEST	50867	21	192.168.2.16	177.55.34.22
May 8, 2024 08:41:43.211865902 CEST	50771	2121	192.168.2.16	81.8.54.42
May 8, 2024 08:41:43.212476015 CEST	50869	21	192.168.2.16	20.223.215.21
May 8, 2024 08:41:43.212519884 CEST	50870	21	192.168.2.16	96.126.118.190
May 8, 2024 08:41:43.212687016 CEST	50868	2121	192.168.2.16	20.223.215.21
May 8, 2024 08:41:43.227855921 CEST	50810	21	192.168.2.16	118.220.95.143
May 8, 2024 08:41:43.227866888 CEST	50809	2121	192.168.2.16	105.157.164.183
May 8, 2024 08:41:43.228641987 CEST	50871	2121	192.168.2.16	96.126.118.190
May 8, 2024 08:41:43.228728056 CEST	50872	21	192.168.2.16	106.75.34.15
May 8, 2024 08:41:43.233695030 CEST	21	50781	160.121.125.199	192.168.2.16
May 8, 2024 08:41:43.243866920 CEST	50811	2121	192.168.2.16	118.220.95.143
May 8, 2024 08:41:43.244251966 CEST	50873	2121	192.168.2.16	106.75.34.15
May 8, 2024 08:41:43.244286060 CEST	50874	21	192.168.2.16	171.244.37.116
May 8, 2024 08:41:43.259839058 CEST	50812	21	192.168.2.16	96.85.20.90
May 8, 2024 08:41:43.259855986 CEST	50813	2121	192.168.2.16	96.85.20.90
May 8, 2024 08:41:43.275835991 CEST	50814	21	192.168.2.16	212.164.173.133
May 8, 2024 08:41:43.276381969 CEST	50875	2121	192.168.2.16	171.244.37.116
May 8, 2024 08:41:43.276599884 CEST	50876	21	192.168.2.16	190.220.47.218
May 8, 2024 08:41:43.281655073 CEST	2121	50684	91.124.109.201	192.168.2.16
May 8, 2024 08:41:43.282018900 CEST	21	50832	34.149.79.8	192.168.2.16
May 8, 2024 08:41:43.282068968 CEST	50877	2121	192.168.2.16	190.220.47.218
May 8, 2024 08:41:43.282226086 CEST	21	50846	34.149.79.8	192.168.2.16
May 8, 2024 08:41:43.282301903 CEST	50846	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:43.283212900 CEST	21	50683	91.124.109.201	192.168.2.16
May 8, 2024 08:41:43.283601046 CEST	50878	21	192.168.2.16	162.191.48.246
May 8, 2024 08:41:43.286616087 CEST	2121	50847	34.149.79.8	192.168.2.16
May 8, 2024 08:41:43.286665916 CEST	50847	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:43.306397915 CEST	21	50578	23.229.188.101	192.168.2.16
May 8, 2024 08:41:43.306461096 CEST	50578	21	192.168.2.16	23.229.188.101
May 8, 2024 08:41:43.307321072 CEST	21	50578	23.229.188.101	192.168.2.16
May 8, 2024 08:41:43.307369947 CEST	50578	21	192.168.2.16	23.229.188.101
May 8, 2024 08:41:43.307868004 CEST	50768	21	192.168.2.16	81.8.54.42
May 8, 2024 08:41:43.308129072 CEST	50880	2121	192.168.2.16	162.191.48.246
May 8, 2024 08:41:43.312571049 CEST	21	50843	23.229.188.101	192.168.2.16
May 8, 2024 08:41:43.312642097 CEST	50843	21	192.168.2.16	23.229.188.101
May 8, 2024 08:41:43.324176073 CEST	50881	21	192.168.2.16	107.182.190.130
May 8, 2024 08:41:43.329879045 CEST	21	50825	172.120.235.139	192.168.2.16
May 8, 2024 08:41:43.330038071 CEST	50825	21	192.168.2.16	172.120.235.139
May 8, 2024 08:41:43.330213070 CEST	50882	21	192.168.2.16	172.120.235.139
May 8, 2024 08:41:43.340423107 CEST	50883	2121	192.168.2.16	107.182.190.130
May 8, 2024 08:41:43.340615034 CEST	50884	21	192.168.2.16	116.203.56.124
May 8, 2024 08:41:43.351208925 CEST	2121	50680	187.93.61.109	192.168.2.16
May 8, 2024 08:41:43.353833914 CEST	2121	50782	160.121.125.199	192.168.2.16
May 8, 2024 08:41:43.355866909 CEST	50815	2121	192.168.2.16	212.164.173.133
May 8, 2024 08:41:43.372163057 CEST	50885	2121	192.168.2.16	116.203.56.124
May 8, 2024 08:41:43.374877930 CEST	21	50854	156.248.94.29	192.168.2.16
May 8, 2024 08:41:43.388117075 CEST	50816	21	192.168.2.16	70.189.164.125
May 8, 2024 08:41:43.388473988 CEST	50886	21	192.168.2.16	160.176.169.174
May 8, 2024 08:41:43.388576031 CEST	50887	2121	192.168.2.16	160.176.169.174
May 8, 2024 08:41:43.388613939 CEST	50888	21	192.168.2.16	208.118.221.110
May 8, 2024 08:41:43.390830040 CEST	21	50737	91.148.140.11	192.168.2.16
May 8, 2024 08:41:43.390969992 CEST	2121	50855	156.248.94.29	192.168.2.16
May 8, 2024 08:41:43.403862953 CEST	50794	21	192.168.2.16	221.160.134.94
May 8, 2024 08:41:43.403866053 CEST	50819	21	192.168.2.16	186.35.168.1
May 8, 2024 08:41:43.403872013 CEST	50818	2121	192.168.2.16	186.35.168.1
May 8, 2024 08:41:43.403949022 CEST	50817	2121	192.168.2.16	70.189.164.125
May 8, 2024 08:41:43.404234886 CEST	50889	2121	192.168.2.16	208.118.221.110
May 8, 2024 08:41:43.404601097 CEST	50795	2121	192.168.2.16	221.160.134.94
May 8, 2024 08:41:43.407007933 CEST	2121	50840	49.160.65.205	192.168.2.16
May 8, 2024 08:41:43.418057919 CEST	21	50802	196.210.0.111	192.168.2.16
May 8, 2024 08:41:43.418072939 CEST	21	50802	196.210.0.111	192.168.2.16
May 8, 2024 08:41:43.418240070 CEST	50802	21	192.168.2.16	196.210.0.111
May 8, 2024 08:41:43.418680906 CEST	21	50870	96.126.118.190	192.168.2.16
May 8, 2024 08:41:43.418745041 CEST	50870	21	192.168.2.16	96.126.118.190
May 8, 2024 08:41:43.424489975 CEST	21	50679	187.93.61.109	192.168.2.16
May 8, 2024 08:41:43.430206060 CEST	2121	50738	91.148.140.11	192.168.2.16
May 8, 2024 08:41:43.434824944 CEST	2121	50871	96.126.118.190	192.168.2.16
May 8, 2024 08:41:43.434904099 CEST	50871	2121	192.168.2.16	96.126.118.190
May 8, 2024 08:41:43.435857058 CEST	50820	21	192.168.2.16	123.182.56.87
May 8, 2024 08:41:43.437309027 CEST	50891	2121	192.168.2.16	69.143.236.170
May 8, 2024 08:41:43.437774897 CEST	50890	21	192.168.2.16	69.143.236.170
May 8, 2024 08:41:43.440817118 CEST	2121	50758	185.108.141.19	192.168.2.16
May 8, 2024 08:41:43.441545010 CEST	21	50757	185.108.141.19	192.168.2.16
May 8, 2024 08:41:43.447513103 CEST	21	50846	34.149.79.8	192.168.2.16
May 8, 2024 08:41:43.447576046 CEST	50846	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:43.447681904 CEST	50846	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:43.447890043 CEST	50892	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:43.451273918 CEST	2121	50847	34.149.79.8	192.168.2.16
May 8, 2024 08:41:43.451334953 CEST	50847	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:43.451425076 CEST	50847	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:43.451644897 CEST	50893	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:43.452842951 CEST	50894	21	192.168.2.16	104.208.119.138
May 8, 2024 08:41:43.452858925 CEST	50826	21	192.168.2.16	27.212.221.89
May 8, 2024 08:41:43.452936888 CEST	50895	21	192.168.2.16	98.38.38.197
May 8, 2024 08:41:43.453013897 CEST	50897	2121	192.168.2.16	104.208.119.138
May 8, 2024 08:41:43.453018904 CEST	50896	2121	192.168.2.16	98.38.38.197
May 8, 2024 08:41:43.467834949 CEST	50765	2121	192.168.2.16	138.248.244.221
May 8, 2024 08:41:43.481596947 CEST	21	50844	186.249.29.73	192.168.2.16
May 8, 2024 08:41:43.481908083 CEST	2121	50845	186.249.29.73	192.168.2.16
May 8, 2024 08:41:43.483155012 CEST	21	50856	141.94.36.78	192.168.2.16
May 8, 2024 08:41:43.483167887 CEST	2121	50857	141.94.36.78	192.168.2.16
May 8, 2024 08:41:43.483841896 CEST	50828	2121	192.168.2.16	27.212.221.89
May 8, 2024 08:41:43.484136105 CEST	50898	21	192.168.2.16	139.227.244.36
May 8, 2024 08:41:43.499104977 CEST	2121	50721	139.193.23.42	192.168.2.16
May 8, 2024 08:41:43.500191927 CEST	50899	2121	192.168.2.16	139.227.244.36
May 8, 2024 08:41:43.508301973 CEST	21	50763	138.248.244.221	192.168.2.16
May 8, 2024 08:41:43.508661032 CEST	50900	21	192.168.2.16	180.230.0.67
May 8, 2024 08:41:43.511871099 CEST	21	50825	172.120.235.139	192.168.2.16
May 8, 2024 08:41:43.511924028 CEST	50825	21	192.168.2.16	172.120.235.139
May 8, 2024 08:41:43.511970997 CEST	21	50882	172.120.235.139	192.168.2.16
May 8, 2024 08:41:43.512032032 CEST	50882	21	192.168.2.16	172.120.235.139
May 8, 2024 08:41:43.514710903 CEST	21	50881	107.182.190.130	192.168.2.16
May 8, 2024 08:41:43.514998913 CEST	21	50843	23.229.188.101	192.168.2.16
May 8, 2024 08:41:43.515225887 CEST	50843	21	192.168.2.16	23.229.188.101
May 8, 2024 08:41:43.515851974 CEST	50823	2121	192.168.2.16	123.182.56.87
May 8, 2024 08:41:43.515851974 CEST	50824	21	192.168.2.16	5.74.101.111
May 8, 2024 08:41:43.516329050 CEST	50901	2121	192.168.2.16	180.230.0.67
May 8, 2024 08:41:43.516400099 CEST	50902	21	192.168.2.16	83.221.69.134
May 8, 2024 08:41:43.531398058 CEST	2121	50883	107.182.190.130	192.168.2.16
May 8, 2024 08:41:43.531979084 CEST	50586	21	192.168.2.16	38.38.120.85
May 8, 2024 08:41:43.532208920 CEST	50903	21	192.168.2.16	38.38.120.85
May 8, 2024 08:41:43.532299042 CEST	50904	2121	192.168.2.16	83.221.69.134
May 8, 2024 08:41:43.547867060 CEST	50778	2121	192.168.2.16	220.75.162.147
May 8, 2024 08:41:43.548424006 CEST	50905	21	192.168.2.16	23.197.37.61
May 8, 2024 08:41:43.548552036 CEST	50906	2121	192.168.2.16	23.197.37.61
May 8, 2024 08:41:43.563875914 CEST	50777	21	192.168.2.16	220.75.162.147
May 8, 2024 08:41:43.564316034 CEST	50907	2121	192.168.2.16	188.231.60.19
May 8, 2024 08:41:43.564373016 CEST	50908	21	192.168.2.16	188.231.60.19
May 8, 2024 08:41:43.566838980 CEST	2121	50771	81.8.54.42	192.168.2.16
May 8, 2024 08:41:43.584597111 CEST	21	50586	38.38.120.85	192.168.2.16
May 8, 2024 08:41:43.584641933 CEST	50586	21	192.168.2.16	38.38.120.85
May 8, 2024 08:41:43.609992027 CEST	21	50846	34.149.79.8	192.168.2.16
May 8, 2024 08:41:43.610244036 CEST	21	50892	34.149.79.8	192.168.2.16
May 8, 2024 08:41:43.610310078 CEST	50892	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:43.611845970 CEST	50827	2121	192.168.2.16	5.74.101.111
May 8, 2024 08:41:43.612150908 CEST	50909	21	192.168.2.16	190.137.88.196
May 8, 2024 08:41:43.613539934 CEST	2121	50847	34.149.79.8	192.168.2.16
May 8, 2024 08:41:43.614006042 CEST	21	50874	171.244.37.116	192.168.2.16
May 8, 2024 08:41:43.614039898 CEST	2121	50893	34.149.79.8	192.168.2.16
May 8, 2024 08:41:43.614063978 CEST	50874	21	192.168.2.16	171.244.37.116
May 8, 2024 08:41:43.614092112 CEST	50893	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:43.614825010 CEST	50834	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:43.665019035 CEST	21	50884	116.203.56.124	192.168.2.16
May 8, 2024 08:41:43.697401047 CEST	2121	50885	116.203.56.124	192.168.2.16
May 8, 2024 08:41:43.699671984 CEST	2121	50880	162.191.48.246	192.168.2.16
May 8, 2024 08:41:43.699814081 CEST	21	50878	162.191.48.246	192.168.2.16
May 8, 2024 08:41:43.717956066 CEST	21	50843	23.229.188.101	192.168.2.16
May 8, 2024 08:41:43.718105078 CEST	50843	21	192.168.2.16	23.229.188.101
May 8, 2024 08:41:43.718137026 CEST	21	50843	23.229.188.101	192.168.2.16
May 8, 2024 08:41:43.718182087 CEST	50843	21	192.168.2.16	23.229.188.101
May 8, 2024 08:41:43.719203949 CEST	21	50794	221.160.134.94	192.168.2.16
May 8, 2024 08:41:43.720995903 CEST	2121	50795	221.160.134.94	192.168.2.16
May 8, 2024 08:41:43.722896099 CEST	21	50903	38.38.120.85	192.168.2.16
May 8, 2024 08:41:43.723001957 CEST	50903	21	192.168.2.16	38.38.120.85
May 8, 2024 08:41:43.725456953 CEST	21	50586	38.38.120.85	192.168.2.16
May 8, 2024 08:41:43.725528955 CEST	50586	21	192.168.2.16	38.38.120.85
May 8, 2024 08:41:43.725861073 CEST	21	50586	38.38.120.85	192.168.2.16
May 8, 2024 08:41:43.725900888 CEST	50586	21	192.168.2.16	38.38.120.85
May 8, 2024 08:41:43.730056047 CEST	21	50882	172.120.235.139	192.168.2.16
May 8, 2024 08:41:43.730180025 CEST	50882	21	192.168.2.16	172.120.235.139
May 8, 2024 08:41:43.737859011 CEST	50781	21	192.168.2.16	160.121.125.199
May 8, 2024 08:41:43.753878117 CEST	50829	2121	192.168.2.16	73.242.1.186
May 8, 2024 08:41:43.753902912 CEST	50830	21	192.168.2.16	73.242.1.186
May 8, 2024 08:41:43.754347086 CEST	50910	2121	192.168.2.16	190.137.88.196
May 8, 2024 08:41:43.770277977 CEST	50911	21	192.168.2.16	24.12.3.159
May 8, 2024 08:41:43.774149895 CEST	21	50892	34.149.79.8	192.168.2.16
May 8, 2024 08:41:43.774205923 CEST	50892	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:43.774635077 CEST	50892	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:43.774899006 CEST	50912	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:43.776566029 CEST	2121	50893	34.149.79.8	192.168.2.16
May 8, 2024 08:41:43.776618958 CEST	50893	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:43.776699066 CEST	50893	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:43.776973963 CEST	50913	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:43.778064013 CEST	2121	50834	34.149.79.8	192.168.2.16
May 8, 2024 08:41:43.782521009 CEST	2121	50765	138.248.244.221	192.168.2.16
May 8, 2024 08:41:43.782922029 CEST	50914	2121	192.168.2.16	24.12.3.159
May 8, 2024 08:41:43.785859108 CEST	50831	21	192.168.2.16	78.150.131.82
May 8, 2024 08:41:43.786129951 CEST	50915	21	192.168.2.16	98.39.159.210
May 8, 2024 08:41:43.789110899 CEST	21	50826	27.212.221.89	192.168.2.16
May 8, 2024 08:41:43.801985979 CEST	50833	2121	192.168.2.16	78.150.131.82
May 8, 2024 08:41:43.818198919 CEST	50916	2121	192.168.2.16	98.39.159.210
May 8, 2024 08:41:43.823829889 CEST	2121	50828	27.212.221.89	192.168.2.16
May 8, 2024 08:41:43.849839926 CEST	50772	21	192.168.2.16	88.201.125.24
May 8, 2024 08:41:43.849864006 CEST	50835	21	192.168.2.16	196.221.170.61
May 8, 2024 08:41:43.861764908 CEST	2121	50778	220.75.162.147	192.168.2.16
May 8, 2024 08:41:43.865854979 CEST	50782	2121	192.168.2.16	160.121.125.199
May 8, 2024 08:41:43.880616903 CEST	21	50777	220.75.162.147	192.168.2.16
May 8, 2024 08:41:43.881895065 CEST	50854	21	192.168.2.16	156.248.94.29
May 8, 2024 08:41:43.897869110 CEST	50855	2121	192.168.2.16	156.248.94.29
May 8, 2024 08:41:43.907881975 CEST	21	50908	188.231.60.19	192.168.2.16
May 8, 2024 08:41:43.908119917 CEST	2121	50907	188.231.60.19	192.168.2.16
May 8, 2024 08:41:43.911973000 CEST	21	50882	172.120.235.139	192.168.2.16
May 8, 2024 08:41:43.912353992 CEST	21	50882	172.120.235.139	192.168.2.16
May 8, 2024 08:41:43.912487030 CEST	50882	21	192.168.2.16	172.120.235.139
May 8, 2024 08:41:43.913872957 CEST	50840	2121	192.168.2.16	49.160.65.205
May 8, 2024 08:41:43.914478064 CEST	21	50903	38.38.120.85	192.168.2.16
May 8, 2024 08:41:43.914634943 CEST	50903	21	192.168.2.16	38.38.120.85
May 8, 2024 08:41:43.936064005 CEST	21	50802	196.210.0.111	192.168.2.16
May 8, 2024 08:41:43.936964035 CEST	21	50892	34.149.79.8	192.168.2.16
May 8, 2024 08:41:43.937309027 CEST	21	50912	34.149.79.8	192.168.2.16
May 8, 2024 08:41:43.937374115 CEST	50912	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:43.939102888 CEST	2121	50893	34.149.79.8	192.168.2.16
May 8, 2024 08:41:43.939529896 CEST	2121	50913	34.149.79.8	192.168.2.16
May 8, 2024 08:41:43.939635038 CEST	50913	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:43.961304903 CEST	21	50843	23.229.188.101	192.168.2.16
May 8, 2024 08:41:43.984764099 CEST	21	50874	171.244.37.116	192.168.2.16
May 8, 2024 08:41:43.984888077 CEST	50874	21	192.168.2.16	171.244.37.116
May 8, 2024 08:41:43.985244989 CEST	50917	21	192.168.2.16	50.108.78.189
May 8, 2024 08:41:43.993879080 CEST	50857	2121	192.168.2.16	141.94.36.78
May 8, 2024 08:41:43.993880033 CEST	50856	21	192.168.2.16	141.94.36.78
May 8, 2024 08:41:43.993880987 CEST	50845	2121	192.168.2.16	186.249.29.73
May 8, 2024 08:41:43.993897915 CEST	50844	21	192.168.2.16	186.249.29.73
May 8, 2024 08:41:44.009839058 CEST	50776	2121	192.168.2.16	88.201.125.24
May 8, 2024 08:41:44.025862932 CEST	50881	21	192.168.2.16	107.182.190.130
May 8, 2024 08:41:44.029855967 CEST	50836	2121	192.168.2.16	196.221.170.61
May 8, 2024 08:41:44.040867090 CEST	50883	2121	192.168.2.16	107.182.190.130
May 8, 2024 08:41:44.062618017 CEST	21	50781	160.121.125.199	192.168.2.16
May 8, 2024 08:41:44.072873116 CEST	50771	2121	192.168.2.16	81.8.54.42
May 8, 2024 08:41:44.072873116 CEST	50837	21	192.168.2.16	194.106.247.204
May 8, 2024 08:41:44.072880030 CEST	50838	2121	192.168.2.16	194.106.247.204
May 8, 2024 08:41:44.073458910 CEST	50839	21	192.168.2.16	49.160.65.205
May 8, 2024 08:41:44.102122068 CEST	21	50912	34.149.79.8	192.168.2.16
May 8, 2024 08:41:44.102226019 CEST	50912	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:44.102345943 CEST	50912	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:44.102552891 CEST	2121	50913	34.149.79.8	192.168.2.16
May 8, 2024 08:41:44.102932930 CEST	50913	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:44.103125095 CEST	50918	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:44.103128910 CEST	50913	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:44.103477955 CEST	50919	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:44.104198933 CEST	21	50903	38.38.120.85	192.168.2.16
May 8, 2024 08:41:44.104320049 CEST	21	50903	38.38.120.85	192.168.2.16
May 8, 2024 08:41:44.104878902 CEST	50842	2121	192.168.2.16	83.38.110.136
May 8, 2024 08:41:44.104880095 CEST	50841	21	192.168.2.16	83.38.110.136
May 8, 2024 08:41:44.105884075 CEST	50903	21	192.168.2.16	38.38.120.85
May 8, 2024 08:41:44.111397028 CEST	21	50854	156.248.94.29	192.168.2.16
May 8, 2024 08:41:44.114258051 CEST	21	50882	172.120.235.139	192.168.2.16
May 8, 2024 08:41:44.114613056 CEST	50882	21	192.168.2.16	172.120.235.139
May 8, 2024 08:41:44.114886045 CEST	50920	21	192.168.2.16	172.120.235.139
May 8, 2024 08:41:44.126974106 CEST	2121	50855	156.248.94.29	192.168.2.16
May 8, 2024 08:41:44.136873007 CEST	50849	2121	192.168.2.16	1.222.95.228
May 8, 2024 08:41:44.136878967 CEST	50848	21	192.168.2.16	1.222.95.228
May 8, 2024 08:41:44.136945963 CEST	50851	2121	192.168.2.16	73.43.146.204
May 8, 2024 08:41:44.136951923 CEST	50850	21	192.168.2.16	73.43.146.204
May 8, 2024 08:41:44.152857065 CEST	50853	2121	192.168.2.16	99.254.103.133
May 8, 2024 08:41:44.152862072 CEST	50852	21	192.168.2.16	99.254.103.133
May 8, 2024 08:41:44.170022011 CEST	50884	21	192.168.2.16	116.203.56.124
May 8, 2024 08:41:44.184871912 CEST	50858	21	192.168.2.16	181.118.173.28
May 8, 2024 08:41:44.184875011 CEST	50860	21	192.168.2.16	78.193.204.75
May 8, 2024 08:41:44.184967995 CEST	50863	2121	192.168.2.16	81.36.175.43
May 8, 2024 08:41:44.192836046 CEST	50859	2121	192.168.2.16	181.118.173.28
May 8, 2024 08:41:44.192848921 CEST	50862	21	192.168.2.16	81.36.175.43
May 8, 2024 08:41:44.192850113 CEST	50864	21	192.168.2.16	114.96.100.230
May 8, 2024 08:41:44.192851067 CEST	50861	2121	192.168.2.16	78.193.204.75
May 8, 2024 08:41:44.199201107 CEST	2121	50782	160.121.125.199	192.168.2.16
May 8, 2024 08:41:44.200865030 CEST	50885	2121	192.168.2.16	116.203.56.124
May 8, 2024 08:41:44.200865030 CEST	50867	21	192.168.2.16	177.55.34.22
May 8, 2024 08:41:44.200865030 CEST	50865	2121	192.168.2.16	114.96.100.230
May 8, 2024 08:41:44.200874090 CEST	50866	2121	192.168.2.16	177.55.34.22
May 8, 2024 08:41:44.200874090 CEST	50880	2121	192.168.2.16	162.191.48.246
May 8, 2024 08:41:44.200942993 CEST	50878	21	192.168.2.16	162.191.48.246
May 8, 2024 08:41:44.201384068 CEST	50921	2121	192.168.2.16	50.108.78.189
May 8, 2024 08:41:44.215859890 CEST	50869	21	192.168.2.16	20.223.215.21
May 8, 2024 08:41:44.215920925 CEST	50868	2121	192.168.2.16	20.223.215.21
May 8, 2024 08:41:44.221391916 CEST	21	50881	107.182.190.130	192.168.2.16
May 8, 2024 08:41:44.231594086 CEST	2121	50883	107.182.190.130	192.168.2.16
May 8, 2024 08:41:44.231842995 CEST	50794	21	192.168.2.16	221.160.134.94
May 8, 2024 08:41:44.231914997 CEST	50872	21	192.168.2.16	106.75.34.15
May 8, 2024 08:41:44.239849091 CEST	50795	2121	192.168.2.16	221.160.134.94
May 8, 2024 08:41:44.247973919 CEST	50873	2121	192.168.2.16	106.75.34.15
May 8, 2024 08:41:44.248847961 CEST	2121	50840	49.160.65.205	192.168.2.16
May 8, 2024 08:41:44.264784098 CEST	21	50912	34.149.79.8	192.168.2.16
May 8, 2024 08:41:44.265256882 CEST	2121	50913	34.149.79.8	192.168.2.16
May 8, 2024 08:41:44.265510082 CEST	21	50918	34.149.79.8	192.168.2.16
May 8, 2024 08:41:44.265618086 CEST	50918	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:44.265893936 CEST	2121	50919	34.149.79.8	192.168.2.16
May 8, 2024 08:41:44.265985966 CEST	50919	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:44.279861927 CEST	50876	21	192.168.2.16	190.220.47.218
May 8, 2024 08:41:44.279972076 CEST	50875	2121	192.168.2.16	171.244.37.116
May 8, 2024 08:41:44.295835018 CEST	50877	2121	192.168.2.16	190.220.47.218
May 8, 2024 08:41:44.295839071 CEST	50826	21	192.168.2.16	27.212.221.89
May 8, 2024 08:41:44.296401024 CEST	21	50882	172.120.235.139	192.168.2.16
May 8, 2024 08:41:44.296525955 CEST	50882	21	192.168.2.16	172.120.235.139
May 8, 2024 08:41:44.296546936 CEST	21	50920	172.120.235.139	192.168.2.16
May 8, 2024 08:41:44.297867060 CEST	50920	21	192.168.2.16	172.120.235.139
May 8, 2024 08:41:44.311431885 CEST	21	50856	141.94.36.78	192.168.2.16
May 8, 2024 08:41:44.311456919 CEST	50922	21	192.168.2.16	90.202.57.207
May 8, 2024 08:41:44.313721895 CEST	2121	50857	141.94.36.78	192.168.2.16
May 8, 2024 08:41:44.325864077 CEST	50828	2121	192.168.2.16	27.212.221.89
May 8, 2024 08:41:44.326256990 CEST	50923	2121	192.168.2.16	90.202.57.207
May 8, 2024 08:41:44.334831953 CEST	21	50903	38.38.120.85	192.168.2.16
May 8, 2024 08:41:44.355655909 CEST	21	50874	171.244.37.116	192.168.2.16
May 8, 2024 08:41:44.355668068 CEST	21	50874	171.244.37.116	192.168.2.16
May 8, 2024 08:41:44.355794907 CEST	50874	21	192.168.2.16	171.244.37.116
May 8, 2024 08:41:44.356839895 CEST	50784	21	192.168.2.16	68.87.13.200
May 8, 2024 08:41:44.356841087 CEST	50783	2121	192.168.2.16	68.87.13.200
May 8, 2024 08:41:44.358349085 CEST	21	50844	186.249.29.73	192.168.2.16
May 8, 2024 08:41:44.358417034 CEST	2121	50845	186.249.29.73	192.168.2.16
May 8, 2024 08:41:44.371845007 CEST	50785	21	192.168.2.16	213.126.46.116
May 8, 2024 08:41:44.371920109 CEST	50778	2121	192.168.2.16	220.75.162.147
May 8, 2024 08:41:44.387860060 CEST	50888	21	192.168.2.16	208.118.221.110
May 8, 2024 08:41:44.387945890 CEST	50777	21	192.168.2.16	220.75.162.147
May 8, 2024 08:41:44.403840065 CEST	50886	21	192.168.2.16	160.176.169.174
May 8, 2024 08:41:44.403928995 CEST	50887	2121	192.168.2.16	160.176.169.174
May 8, 2024 08:41:44.419857979 CEST	50889	2121	192.168.2.16	208.118.221.110
May 8, 2024 08:41:44.419866085 CEST	50908	21	192.168.2.16	188.231.60.19
May 8, 2024 08:41:44.419954062 CEST	50907	2121	192.168.2.16	188.231.60.19
May 8, 2024 08:41:44.428122044 CEST	21	50918	34.149.79.8	192.168.2.16
May 8, 2024 08:41:44.428287029 CEST	50918	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:44.428287029 CEST	50918	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:44.429342985 CEST	2121	50919	34.149.79.8	192.168.2.16
May 8, 2024 08:41:44.429378033 CEST	50924	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:44.429524899 CEST	50919	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:44.429605007 CEST	50919	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:44.429693937 CEST	2121	50771	81.8.54.42	192.168.2.16
May 8, 2024 08:41:44.430097103 CEST	50925	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:44.430155993 CEST	50926	21	192.168.2.16	98.199.233.159
May 8, 2024 08:41:44.436141968 CEST	21	50616	75.203.63.250	192.168.2.16
May 8, 2024 08:41:44.441354990 CEST	2121	50617	75.203.63.250	192.168.2.16
May 8, 2024 08:41:44.451886892 CEST	50891	2121	192.168.2.16	69.143.236.170
May 8, 2024 08:41:44.451884985 CEST	50890	21	192.168.2.16	69.143.236.170
May 8, 2024 08:41:44.467881918 CEST	50894	21	192.168.2.16	104.208.119.138
May 8, 2024 08:41:44.467892885 CEST	50895	21	192.168.2.16	98.38.38.197
May 8, 2024 08:41:44.467895985 CEST	50896	2121	192.168.2.16	98.38.38.197
May 8, 2024 08:41:44.467896938 CEST	50897	2121	192.168.2.16	104.208.119.138
May 8, 2024 08:41:44.483867884 CEST	50898	21	192.168.2.16	139.227.244.36
May 8, 2024 08:41:44.484304905 CEST	50927	2121	192.168.2.16	98.199.233.159
May 8, 2024 08:41:44.494298935 CEST	21	50884	116.203.56.124	192.168.2.16
May 8, 2024 08:41:44.499866009 CEST	50899	2121	192.168.2.16	139.227.244.36
May 8, 2024 08:41:44.513919115 CEST	21	50920	172.120.235.139	192.168.2.16
May 8, 2024 08:41:44.514070034 CEST	50920	21	192.168.2.16	172.120.235.139
May 8, 2024 08:41:44.515870094 CEST	50901	2121	192.168.2.16	180.230.0.67
May 8, 2024 08:41:44.515873909 CEST	50900	21	192.168.2.16	180.230.0.67
May 8, 2024 08:41:44.515875101 CEST	50902	21	192.168.2.16	83.221.69.134
May 8, 2024 08:41:44.525003910 CEST	2121	50885	116.203.56.124	192.168.2.16
May 8, 2024 08:41:44.532929897 CEST	50928	21	192.168.2.16	3.139.67.62
May 8, 2024 08:41:44.532931089 CEST	50929	2121	192.168.2.16	3.139.67.62
May 8, 2024 08:41:44.533025980 CEST	50930	2121	192.168.2.16	178.198.26.164
May 8, 2024 08:41:44.533158064 CEST	50932	21	192.168.2.16	1.237.215.90
May 8, 2024 08:41:44.533268929 CEST	50934	2121	192.168.2.16	68.103.85.240
May 8, 2024 08:41:44.533288002 CEST	50935	21	192.168.2.16	68.103.85.240
May 8, 2024 08:41:44.533289909 CEST	50933	2121	192.168.2.16	1.237.215.90
May 8, 2024 08:41:44.533423901 CEST	50931	21	192.168.2.16	178.198.26.164
May 8, 2024 08:41:44.533683062 CEST	50936	21	192.168.2.16	91.146.97.65
May 8, 2024 08:41:44.546205997 CEST	21	50794	221.160.134.94	192.168.2.16
May 8, 2024 08:41:44.546852112 CEST	50904	2121	192.168.2.16	83.221.69.134
May 8, 2024 08:41:44.546852112 CEST	50788	2121	192.168.2.16	213.126.46.116
May 8, 2024 08:41:44.548156977 CEST	50937	2121	192.168.2.16	91.146.97.65
May 8, 2024 08:41:44.548157930 CEST	50938	21	192.168.2.16	171.101.231.72
May 8, 2024 08:41:44.548258066 CEST	50939	2121	192.168.2.16	171.101.231.72
May 8, 2024 08:41:44.548491001 CEST	50940	21	192.168.2.16	123.4.16.127
May 8, 2024 08:41:44.548497915 CEST	50942	2121	192.168.2.16	123.4.16.127
May 8, 2024 08:41:44.548579931 CEST	50941	21	192.168.2.16	158.197.185.49
May 8, 2024 08:41:44.548579931 CEST	50943	2121	192.168.2.16	158.197.185.49
May 8, 2024 08:41:44.548693895 CEST	50944	21	192.168.2.16	70.127.87.48
May 8, 2024 08:41:44.548949003 CEST	50945	2121	192.168.2.16	70.127.87.48
May 8, 2024 08:41:44.554233074 CEST	2121	50795	221.160.134.94	192.168.2.16
May 8, 2024 08:41:44.557833910 CEST	50905	21	192.168.2.16	23.197.37.61
May 8, 2024 08:41:44.562860012 CEST	50906	2121	192.168.2.16	23.197.37.61
May 8, 2024 08:41:44.562964916 CEST	50781	21	192.168.2.16	160.121.125.199
May 8, 2024 08:41:44.564189911 CEST	50946	21	192.168.2.16	91.176.181.139
May 8, 2024 08:41:44.564197063 CEST	50947	2121	192.168.2.16	91.176.181.139
May 8, 2024 08:41:44.564357996 CEST	50948	21	192.168.2.16	8.243.24.22
May 8, 2024 08:41:44.564363003 CEST	50949	2121	192.168.2.16	8.243.24.22
May 8, 2024 08:41:44.564457893 CEST	50950	21	192.168.2.16	145.40.24.245
May 8, 2024 08:41:44.564589024 CEST	50951	2121	192.168.2.16	145.40.24.245
May 8, 2024 08:41:44.564589024 CEST	50952	21	192.168.2.16	98.17.134.56
May 8, 2024 08:41:44.564770937 CEST	50953	2121	192.168.2.16	98.17.134.56
May 8, 2024 08:41:44.564795017 CEST	50954	21	192.168.2.16	68.196.163.2
May 8, 2024 08:41:44.564800978 CEST	50955	21	192.168.2.16	94.241.8.215
May 8, 2024 08:41:44.564934969 CEST	50956	2121	192.168.2.16	68.196.163.2
May 8, 2024 08:41:44.564935923 CEST	50957	2121	192.168.2.16	94.241.8.215
May 8, 2024 08:41:44.579806089 CEST	50959	2121	192.168.2.16	68.9.127.183
May 8, 2024 08:41:44.579807043 CEST	50958	21	192.168.2.16	68.9.127.183
May 8, 2024 08:41:44.579915047 CEST	50961	2121	192.168.2.16	72.135.103.56
May 8, 2024 08:41:44.579917908 CEST	50960	21	192.168.2.16	72.135.103.56
May 8, 2024 08:41:44.580014944 CEST	50963	2121	192.168.2.16	104.100.168.169
May 8, 2024 08:41:44.580038071 CEST	50962	21	192.168.2.16	104.100.168.169
May 8, 2024 08:41:44.580121994 CEST	50964	21	192.168.2.16	187.200.10.176
May 8, 2024 08:41:44.590683937 CEST	21	50918	34.149.79.8	192.168.2.16
May 8, 2024 08:41:44.591793060 CEST	21	50924	34.149.79.8	192.168.2.16
May 8, 2024 08:41:44.591881990 CEST	50924	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:44.593108892 CEST	2121	50919	34.149.79.8	192.168.2.16
May 8, 2024 08:41:44.593144894 CEST	2121	50925	34.149.79.8	192.168.2.16
May 8, 2024 08:41:44.593305111 CEST	50925	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:44.596668005 CEST	50965	2121	192.168.2.16	187.200.10.176
May 8, 2024 08:41:44.596785069 CEST	50967	21	192.168.2.16	73.170.17.51
May 8, 2024 08:41:44.596786022 CEST	50966	2121	192.168.2.16	73.170.17.51
May 8, 2024 08:41:44.596894026 CEST	50969	2121	192.168.2.16	115.133.110.2
May 8, 2024 08:41:44.596895933 CEST	50968	21	192.168.2.16	115.133.110.2
May 8, 2024 08:41:44.597001076 CEST	50971	2121	192.168.2.16	171.235.67.13
May 8, 2024 08:41:44.597017050 CEST	50970	21	192.168.2.16	171.235.67.13
May 8, 2024 08:41:44.597090006 CEST	50972	2121	192.168.2.16	126.79.98.218
May 8, 2024 08:41:44.597096920 CEST	50973	2121	192.168.2.16	84.44.255.254
May 8, 2024 08:41:44.597189903 CEST	50974	21	192.168.2.16	84.44.255.254
May 8, 2024 08:41:44.597192049 CEST	50975	21	192.168.2.16	126.79.98.218
May 8, 2024 08:41:44.597352028 CEST	50976	21	192.168.2.16	222.82.119.34
May 8, 2024 08:41:44.597433090 CEST	50977	21	192.168.2.16	95.54.152.162
May 8, 2024 08:41:44.597477913 CEST	50978	2121	192.168.2.16	95.54.152.162
May 8, 2024 08:41:44.597479105 CEST	50979	2121	192.168.2.16	100.12.133.236
May 8, 2024 08:41:44.597536087 CEST	50980	21	192.168.2.16	100.12.133.236
May 8, 2024 08:41:44.597589970 CEST	50981	21	192.168.2.16	78.68.122.29
May 8, 2024 08:41:44.597652912 CEST	50982	2121	192.168.2.16	78.68.122.29
May 8, 2024 08:41:44.597683907 CEST	50983	2121	192.168.2.16	222.82.119.34
May 8, 2024 08:41:44.611864090 CEST	50984	21	192.168.2.16	177.240.12.174
May 8, 2024 08:41:44.612000942 CEST	50985	2121	192.168.2.16	177.240.12.174
May 8, 2024 08:41:44.612056971 CEST	50986	2121	192.168.2.16	122.143.122.134
May 8, 2024 08:41:44.612159967 CEST	50988	21	192.168.2.16	23.51.42.111
May 8, 2024 08:41:44.612162113 CEST	50987	21	192.168.2.16	122.143.122.134
May 8, 2024 08:41:44.612302065 CEST	50989	21	192.168.2.16	72.21.25.18
May 8, 2024 08:41:44.612341881 CEST	50991	2121	192.168.2.16	72.21.25.18
May 8, 2024 08:41:44.612344980 CEST	50990	2121	192.168.2.16	23.51.42.111
May 8, 2024 08:41:44.612464905 CEST	50992	21	192.168.2.16	67.249.54.64
May 8, 2024 08:41:44.612469912 CEST	50993	2121	192.168.2.16	67.249.54.64
May 8, 2024 08:41:44.626842022 CEST	50909	21	192.168.2.16	190.137.88.196
May 8, 2024 08:41:44.626873970 CEST	50854	21	192.168.2.16	156.248.94.29
May 8, 2024 08:41:44.627424955 CEST	50995	2121	192.168.2.16	100.15.183.214
May 8, 2024 08:41:44.627427101 CEST	50994	21	192.168.2.16	100.15.183.214
May 8, 2024 08:41:44.627489090 CEST	50996	21	192.168.2.16	61.84.251.6
May 8, 2024 08:41:44.634587049 CEST	21	50826	27.212.221.89	192.168.2.16
May 8, 2024 08:41:44.645879984 CEST	50855	2121	192.168.2.16	156.248.94.29
May 8, 2024 08:41:44.658760071 CEST	2121	50880	162.191.48.246	192.168.2.16
May 8, 2024 08:41:44.658771992 CEST	21	50878	162.191.48.246	192.168.2.16
May 8, 2024 08:41:44.669663906 CEST	2121	50828	27.212.221.89	192.168.2.16
May 8, 2024 08:41:44.684746027 CEST	2121	50778	220.75.162.147	192.168.2.16
May 8, 2024 08:41:44.690926075 CEST	50789	21	192.168.2.16	134.236.56.191
May 8, 2024 08:41:44.695725918 CEST	21	50920	172.120.235.139	192.168.2.16
May 8, 2024 08:41:44.696070910 CEST	21	50920	172.120.235.139	192.168.2.16
May 8, 2024 08:41:44.696238995 CEST	50920	21	192.168.2.16	172.120.235.139
May 8, 2024 08:41:44.704509974 CEST	21	50777	220.75.162.147	192.168.2.16
May 8, 2024 08:41:44.706969023 CEST	50782	2121	192.168.2.16	160.121.125.199
May 8, 2024 08:41:44.707272053 CEST	50997	21	192.168.2.16	24.45.193.33
May 8, 2024 08:41:44.707345963 CEST	50998	2121	192.168.2.16	61.84.251.6
May 8, 2024 08:41:44.722857952 CEST	50881	21	192.168.2.16	107.182.190.130
May 8, 2024 08:41:44.723129034 CEST	50999	2121	192.168.2.16	24.45.193.33
May 8, 2024 08:41:44.738848925 CEST	50790	2121	192.168.2.16	134.236.56.191
May 8, 2024 08:41:44.738924026 CEST	50883	2121	192.168.2.16	107.182.190.130
May 8, 2024 08:41:44.754861116 CEST	50910	2121	192.168.2.16	190.137.88.196
May 8, 2024 08:41:44.754861116 CEST	50791	21	192.168.2.16	88.70.150.113
May 8, 2024 08:41:44.754926920 CEST	50840	2121	192.168.2.16	49.160.65.205
May 8, 2024 08:41:44.755601883 CEST	21	50924	34.149.79.8	192.168.2.16
May 8, 2024 08:41:44.755707979 CEST	50924	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:44.755795956 CEST	50924	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:44.756567955 CEST	2121	50925	34.149.79.8	192.168.2.16
May 8, 2024 08:41:44.756598949 CEST	51000	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:44.756686926 CEST	50925	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:44.756805897 CEST	50925	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:44.757035971 CEST	51001	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:44.761214018 CEST	21	50908	188.231.60.19	192.168.2.16
May 8, 2024 08:41:44.770065069 CEST	2121	50907	188.231.60.19	192.168.2.16
May 8, 2024 08:41:44.770874977 CEST	50911	21	192.168.2.16	24.12.3.159
May 8, 2024 08:41:44.770878077 CEST	50793	2121	192.168.2.16	88.70.150.113
May 8, 2024 08:41:44.786880970 CEST	50914	2121	192.168.2.16	24.12.3.159
May 8, 2024 08:41:44.786947012 CEST	50915	21	192.168.2.16	98.39.159.210
May 8, 2024 08:41:44.805520058 CEST	21	50989	72.21.25.18	192.168.2.16
May 8, 2024 08:41:44.811579943 CEST	2121	50991	72.21.25.18	192.168.2.16
May 8, 2024 08:41:44.817734957 CEST	2121	50956	68.196.163.2	192.168.2.16
May 8, 2024 08:41:44.818886042 CEST	50857	2121	192.168.2.16	141.94.36.78
May 8, 2024 08:41:44.818887949 CEST	50856	21	192.168.2.16	141.94.36.78
May 8, 2024 08:41:44.818888903 CEST	50796	21	192.168.2.16	98.63.16.46
May 8, 2024 08:41:44.818955898 CEST	50916	2121	192.168.2.16	98.39.159.210
May 8, 2024 08:41:44.821230888 CEST	21	50954	68.196.163.2	192.168.2.16
May 8, 2024 08:41:44.850853920 CEST	50799	2121	192.168.2.16	98.63.16.46
May 8, 2024 08:41:44.854549885 CEST	21	50854	156.248.94.29	192.168.2.16
May 8, 2024 08:41:44.866951942 CEST	50845	2121	192.168.2.16	186.249.29.73
May 8, 2024 08:41:44.867037058 CEST	50844	21	192.168.2.16	186.249.29.73
May 8, 2024 08:41:44.873274088 CEST	21	50936	91.146.97.65	192.168.2.16
May 8, 2024 08:41:44.873349905 CEST	50936	21	192.168.2.16	91.146.97.65
May 8, 2024 08:41:44.874411106 CEST	2121	50855	156.248.94.29	192.168.2.16
May 8, 2024 08:41:44.883869886 CEST	51002	21	192.168.2.16	72.191.218.237
May 8, 2024 08:41:44.887681961 CEST	21	50781	160.121.125.199	192.168.2.16
May 8, 2024 08:41:44.888114929 CEST	51003	2121	192.168.2.16	72.191.218.237
May 8, 2024 08:41:44.891547918 CEST	2121	50972	126.79.98.218	192.168.2.16
May 8, 2024 08:41:44.892131090 CEST	21	50975	126.79.98.218	192.168.2.16
May 8, 2024 08:41:44.897699118 CEST	21	50920	172.120.235.139	192.168.2.16
May 8, 2024 08:41:44.897931099 CEST	50920	21	192.168.2.16	172.120.235.139
May 8, 2024 08:41:44.898525000 CEST	51004	21	192.168.2.16	172.120.235.139
May 8, 2024 08:41:44.907238960 CEST	21	50950	145.40.24.245	192.168.2.16
May 8, 2024 08:41:44.912992954 CEST	2121	50951	145.40.24.245	192.168.2.16
May 8, 2024 08:41:44.913304090 CEST	21	50881	107.182.190.130	192.168.2.16
May 8, 2024 08:41:44.914879084 CEST	50800	21	192.168.2.16	87.52.4.149
May 8, 2024 08:41:44.917712927 CEST	2121	50973	84.44.255.254	192.168.2.16
May 8, 2024 08:41:44.917814970 CEST	21	50974	84.44.255.254	192.168.2.16
May 8, 2024 08:41:44.917927027 CEST	50974	21	192.168.2.16	84.44.255.254
May 8, 2024 08:41:44.918168068 CEST	21	50924	34.149.79.8	192.168.2.16
May 8, 2024 08:41:44.918855906 CEST	21	50802	196.210.0.111	192.168.2.16
May 8, 2024 08:41:44.918977976 CEST	21	51000	34.149.79.8	192.168.2.16
May 8, 2024 08:41:44.919066906 CEST	50802	21	192.168.2.16	196.210.0.111
May 8, 2024 08:41:44.919066906 CEST	51000	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:44.919107914 CEST	2121	50925	34.149.79.8	192.168.2.16
May 8, 2024 08:41:44.919199944 CEST	2121	51001	34.149.79.8	192.168.2.16
May 8, 2024 08:41:44.919301987 CEST	51001	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:44.919487000 CEST	51005	21	192.168.2.16	196.210.0.111
May 8, 2024 08:41:44.929507017 CEST	2121	50883	107.182.190.130	192.168.2.16
May 8, 2024 08:41:44.946896076 CEST	50803	2121	192.168.2.16	87.52.4.149
May 8, 2024 08:41:44.953500986 CEST	21	50997	24.45.193.33	192.168.2.16
May 8, 2024 08:41:44.962933064 CEST	50804	21	192.168.2.16	188.119.99.201
May 8, 2024 08:41:44.975189924 CEST	2121	50999	24.45.193.33	192.168.2.16
May 8, 2024 08:41:44.994890928 CEST	50917	21	192.168.2.16	50.108.78.189
May 8, 2024 08:41:44.994891882 CEST	50805	2121	192.168.2.16	188.119.99.201
May 8, 2024 08:41:45.009881973 CEST	50884	21	192.168.2.16	116.203.56.124
May 8, 2024 08:41:45.025880098 CEST	50806	21	192.168.2.16	105.157.164.183
May 8, 2024 08:41:45.025882959 CEST	50885	2121	192.168.2.16	116.203.56.124
May 8, 2024 08:41:45.040822983 CEST	2121	50782	160.121.125.199	192.168.2.16
May 8, 2024 08:41:45.057878971 CEST	50795	2121	192.168.2.16	221.160.134.94
May 8, 2024 08:41:45.057883978 CEST	50794	21	192.168.2.16	221.160.134.94
May 8, 2024 08:41:45.058269978 CEST	51006	21	192.168.2.16	108.6.199.81
May 8, 2024 08:41:45.074665070 CEST	21	50938	171.101.231.72	192.168.2.16
May 8, 2024 08:41:45.081428051 CEST	21	50920	172.120.235.139	192.168.2.16
May 8, 2024 08:41:45.081492901 CEST	50920	21	192.168.2.16	172.120.235.139
May 8, 2024 08:41:45.081934929 CEST	21	50976	222.82.119.34	192.168.2.16
May 8, 2024 08:41:45.081953049 CEST	21	51004	172.120.235.139	192.168.2.16
May 8, 2024 08:41:45.082114935 CEST	51004	21	192.168.2.16	172.120.235.139
May 8, 2024 08:41:45.082300901 CEST	2121	51001	34.149.79.8	192.168.2.16
May 8, 2024 08:41:45.082315922 CEST	21	51000	34.149.79.8	192.168.2.16
May 8, 2024 08:41:45.082355022 CEST	51001	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:45.082386971 CEST	51000	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:45.082473040 CEST	51000	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:45.082636118 CEST	51001	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:45.082777023 CEST	51007	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:45.083081961 CEST	51008	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:45.091501951 CEST	2121	50840	49.160.65.205	192.168.2.16
May 8, 2024 08:41:45.094850063 CEST	2121	50983	222.82.119.34	192.168.2.16
May 8, 2024 08:41:45.117819071 CEST	2121	50939	171.101.231.72	192.168.2.16
May 8, 2024 08:41:45.135147095 CEST	21	50856	141.94.36.78	192.168.2.16
May 8, 2024 08:41:45.136884928 CEST	50826	21	192.168.2.16	27.212.221.89
May 8, 2024 08:41:45.137403011 CEST	2121	50857	141.94.36.78	192.168.2.16
May 8, 2024 08:41:45.168863058 CEST	50880	2121	192.168.2.16	162.191.48.246
May 8, 2024 08:41:45.169851065 CEST	50878	21	192.168.2.16	162.191.48.246
May 8, 2024 08:41:45.169969082 CEST	50828	2121	192.168.2.16	27.212.221.89
May 8, 2024 08:41:45.215878010 CEST	50921	2121	192.168.2.16	50.108.78.189
May 8, 2024 08:41:45.229137897 CEST	2121	50845	186.249.29.73	192.168.2.16
May 8, 2024 08:41:45.229182959 CEST	21	50844	186.249.29.73	192.168.2.16
May 8, 2024 08:41:45.231865883 CEST	50809	2121	192.168.2.16	105.157.164.183
May 8, 2024 08:41:45.231868029 CEST	50810	21	192.168.2.16	118.220.95.143
May 8, 2024 08:41:45.235980034 CEST	21	50936	91.146.97.65	192.168.2.16
May 8, 2024 08:41:45.236186028 CEST	50936	21	192.168.2.16	91.146.97.65
May 8, 2024 08:41:45.236762047 CEST	51009	2121	192.168.2.16	108.6.199.81
May 8, 2024 08:41:45.237646103 CEST	21	50974	84.44.255.254	192.168.2.16
May 8, 2024 08:41:45.237716913 CEST	50974	21	192.168.2.16	84.44.255.254
May 8, 2024 08:41:45.237793922 CEST	50974	21	192.168.2.16	84.44.255.254
May 8, 2024 08:41:45.237833977 CEST	50974	21	192.168.2.16	84.44.255.254
May 8, 2024 08:41:45.238023043 CEST	51010	21	192.168.2.16	174.130.17.74
May 8, 2024 08:41:45.244792938 CEST	2121	51001	34.149.79.8	192.168.2.16
May 8, 2024 08:41:45.244947910 CEST	21	51000	34.149.79.8	192.168.2.16
May 8, 2024 08:41:45.245117903 CEST	21	51007	34.149.79.8	192.168.2.16
May 8, 2024 08:41:45.245193958 CEST	51007	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:45.245538950 CEST	2121	51008	34.149.79.8	192.168.2.16
May 8, 2024 08:41:45.245598078 CEST	51008	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:45.246875048 CEST	50811	2121	192.168.2.16	118.220.95.143
May 8, 2024 08:41:45.261878967 CEST	50812	21	192.168.2.16	96.85.20.90
May 8, 2024 08:41:45.261883020 CEST	50813	2121	192.168.2.16	96.85.20.90
May 8, 2024 08:41:45.261959076 CEST	50908	21	192.168.2.16	188.231.60.19
May 8, 2024 08:41:45.276861906 CEST	50907	2121	192.168.2.16	188.231.60.19
May 8, 2024 08:41:45.286834002 CEST	50814	21	192.168.2.16	212.164.173.133
May 8, 2024 08:41:45.303535938 CEST	21	51004	172.120.235.139	192.168.2.16
May 8, 2024 08:41:45.303755045 CEST	51004	21	192.168.2.16	172.120.235.139
May 8, 2024 08:41:45.308120966 CEST	50989	21	192.168.2.16	72.21.25.18
May 8, 2024 08:41:45.308326960 CEST	51011	2121	192.168.2.16	174.130.17.74
May 8, 2024 08:41:45.323831081 CEST	50956	2121	192.168.2.16	68.196.163.2
May 8, 2024 08:41:45.323846102 CEST	50922	21	192.168.2.16	90.202.57.207
May 8, 2024 08:41:45.323847055 CEST	50954	21	192.168.2.16	68.196.163.2
May 8, 2024 08:41:45.325355053 CEST	50991	2121	192.168.2.16	72.21.25.18
May 8, 2024 08:41:45.334156990 CEST	21	50884	116.203.56.124	192.168.2.16
May 8, 2024 08:41:45.339838028 CEST	50923	2121	192.168.2.16	90.202.57.207
May 8, 2024 08:41:45.350022078 CEST	2121	50885	116.203.56.124	192.168.2.16
May 8, 2024 08:41:45.355835915 CEST	50815	2121	192.168.2.16	212.164.173.133
May 8, 2024 08:41:45.355860949 CEST	50854	21	192.168.2.16	156.248.94.29
May 8, 2024 08:41:45.372481108 CEST	21	50794	221.160.134.94	192.168.2.16
May 8, 2024 08:41:45.373064041 CEST	2121	50795	221.160.134.94	192.168.2.16
May 8, 2024 08:41:45.373771906 CEST	51013	2121	192.168.2.16	86.31.131.84
May 8, 2024 08:41:45.373771906 CEST	51012	21	192.168.2.16	86.31.131.84
May 8, 2024 08:41:45.387912035 CEST	50855	2121	192.168.2.16	156.248.94.29
May 8, 2024 08:41:45.403877020 CEST	50975	21	192.168.2.16	126.79.98.218
May 8, 2024 08:41:45.403877974 CEST	50818	2121	192.168.2.16	186.35.168.1
May 8, 2024 08:41:45.403882027 CEST	50816	21	192.168.2.16	70.189.164.125
May 8, 2024 08:41:45.404009104 CEST	50819	21	192.168.2.16	186.35.168.1
May 8, 2024 08:41:45.404011965 CEST	50817	2121	192.168.2.16	70.189.164.125
May 8, 2024 08:41:45.404011965 CEST	50972	2121	192.168.2.16	126.79.98.218
May 8, 2024 08:41:45.407707930 CEST	21	51007	34.149.79.8	192.168.2.16
May 8, 2024 08:41:45.407773018 CEST	51007	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:45.407849073 CEST	51007	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:45.408044100 CEST	51014	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:45.408066988 CEST	2121	51008	34.149.79.8	192.168.2.16
May 8, 2024 08:41:45.408121109 CEST	51008	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:45.408241987 CEST	51008	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:45.408303022 CEST	21	51005	196.210.0.111	192.168.2.16
May 8, 2024 08:41:45.408377886 CEST	51005	21	192.168.2.16	196.210.0.111
May 8, 2024 08:41:45.408595085 CEST	51015	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:45.415909052 CEST	21	50802	196.210.0.111	192.168.2.16
May 8, 2024 08:41:45.417512894 CEST	50802	21	192.168.2.16	196.210.0.111
May 8, 2024 08:41:45.419882059 CEST	50951	2121	192.168.2.16	145.40.24.245
May 8, 2024 08:41:45.420809031 CEST	50973	2121	192.168.2.16	84.44.255.254
May 8, 2024 08:41:45.424832106 CEST	50950	21	192.168.2.16	145.40.24.245
May 8, 2024 08:41:45.425998926 CEST	50881	21	192.168.2.16	107.182.190.130
May 8, 2024 08:41:45.435839891 CEST	50820	21	192.168.2.16	123.182.56.87
May 8, 2024 08:41:45.435851097 CEST	50883	2121	192.168.2.16	107.182.190.130
May 8, 2024 08:41:45.437472105 CEST	50926	21	192.168.2.16	98.199.233.159
May 8, 2024 08:41:45.456832886 CEST	50997	21	192.168.2.16	24.45.193.33
May 8, 2024 08:41:45.474823952 CEST	21	50826	27.212.221.89	192.168.2.16
May 8, 2024 08:41:45.483880997 CEST	50999	2121	192.168.2.16	24.45.193.33
May 8, 2024 08:41:45.485519886 CEST	21	51004	172.120.235.139	192.168.2.16
May 8, 2024 08:41:45.485867023 CEST	21	51004	172.120.235.139	192.168.2.16
May 8, 2024 08:41:45.486186028 CEST	51004	21	192.168.2.16	172.120.235.139
May 8, 2024 08:41:45.499897957 CEST	50927	2121	192.168.2.16	98.199.233.159
May 8, 2024 08:41:45.501410961 CEST	21	50989	72.21.25.18	192.168.2.16
May 8, 2024 08:41:45.512340069 CEST	2121	50828	27.212.221.89	192.168.2.16
May 8, 2024 08:41:45.515866995 CEST	50823	2121	192.168.2.16	123.182.56.87
May 8, 2024 08:41:45.524714947 CEST	2121	50991	72.21.25.18	192.168.2.16
May 8, 2024 08:41:45.530853033 CEST	50824	21	192.168.2.16	5.74.101.111
May 8, 2024 08:41:45.546845913 CEST	50930	2121	192.168.2.16	178.198.26.164
May 8, 2024 08:41:45.546855927 CEST	50929	2121	192.168.2.16	3.139.67.62
May 8, 2024 08:41:45.546861887 CEST	50933	2121	192.168.2.16	1.237.215.90
May 8, 2024 08:41:45.546863079 CEST	50935	21	192.168.2.16	68.103.85.240
May 8, 2024 08:41:45.546880007 CEST	50928	21	192.168.2.16	3.139.67.62
May 8, 2024 08:41:45.546880007 CEST	50932	21	192.168.2.16	1.237.215.90
May 8, 2024 08:41:45.546880007 CEST	50931	21	192.168.2.16	178.198.26.164
May 8, 2024 08:41:45.548351049 CEST	50934	2121	192.168.2.16	68.103.85.240
May 8, 2024 08:41:45.557324886 CEST	21	50974	84.44.255.254	192.168.2.16
May 8, 2024 08:41:45.557337046 CEST	21	50974	84.44.255.254	192.168.2.16
May 8, 2024 08:41:45.562848091 CEST	50940	21	192.168.2.16	123.4.16.127
May 8, 2024 08:41:45.562849998 CEST	50942	2121	192.168.2.16	123.4.16.127
May 8, 2024 08:41:45.564335108 CEST	50945	2121	192.168.2.16	70.127.87.48
May 8, 2024 08:41:45.564337015 CEST	50944	21	192.168.2.16	70.127.87.48
May 8, 2024 08:41:45.564338923 CEST	50941	21	192.168.2.16	158.197.185.49
May 8, 2024 08:41:45.567837954 CEST	50937	2121	192.168.2.16	91.146.97.65
May 8, 2024 08:41:45.567853928 CEST	50947	2121	192.168.2.16	91.176.181.139
May 8, 2024 08:41:45.567854881 CEST	50952	21	192.168.2.16	98.17.134.56
May 8, 2024 08:41:45.567856073 CEST	50943	2121	192.168.2.16	158.197.185.49
May 8, 2024 08:41:45.570173979 CEST	21	51007	34.149.79.8	192.168.2.16
May 8, 2024 08:41:45.570394039 CEST	21	51014	34.149.79.8	192.168.2.16
May 8, 2024 08:41:45.570463896 CEST	51014	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:45.570552111 CEST	2121	51008	34.149.79.8	192.168.2.16
May 8, 2024 08:41:45.570725918 CEST	2121	51015	34.149.79.8	192.168.2.16
May 8, 2024 08:41:45.570774078 CEST	51015	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:45.576843023 CEST	21	50936	91.146.97.65	192.168.2.16
May 8, 2024 08:41:45.576910973 CEST	50936	21	192.168.2.16	91.146.97.65
May 8, 2024 08:41:45.577285051 CEST	2121	50956	68.196.163.2	192.168.2.16
May 8, 2024 08:41:45.577316046 CEST	21	50954	68.196.163.2	192.168.2.16
May 8, 2024 08:41:45.578840017 CEST	50949	2121	192.168.2.16	8.243.24.22
May 8, 2024 08:41:45.578840017 CEST	50938	21	192.168.2.16	171.101.231.72
May 8, 2024 08:41:45.578856945 CEST	50946	21	192.168.2.16	91.176.181.139
May 8, 2024 08:41:45.578860998 CEST	50959	2121	192.168.2.16	68.9.127.183
May 8, 2024 08:41:45.578875065 CEST	50948	21	192.168.2.16	8.243.24.22
May 8, 2024 08:41:45.578876972 CEST	50953	2121	192.168.2.16	98.17.134.56
May 8, 2024 08:41:45.578876019 CEST	50955	21	192.168.2.16	94.241.8.215
May 8, 2024 08:41:45.578876972 CEST	50957	2121	192.168.2.16	94.241.8.215
May 8, 2024 08:41:45.578999043 CEST	50958	21	192.168.2.16	68.9.127.183
May 8, 2024 08:41:45.578999043 CEST	50960	21	192.168.2.16	72.135.103.56
May 8, 2024 08:41:45.582345963 CEST	21	50854	156.248.94.29	192.168.2.16
May 8, 2024 08:41:45.594855070 CEST	50962	21	192.168.2.16	104.100.168.169
May 8, 2024 08:41:45.594873905 CEST	50976	21	192.168.2.16	222.82.119.34
May 8, 2024 08:41:45.594873905 CEST	50840	2121	192.168.2.16	49.160.65.205
May 8, 2024 08:41:45.594880104 CEST	50963	2121	192.168.2.16	104.100.168.169
May 8, 2024 08:41:45.594880104 CEST	50964	21	192.168.2.16	187.200.10.176
May 8, 2024 08:41:45.594880104 CEST	50961	2121	192.168.2.16	72.135.103.56
May 8, 2024 08:41:45.604618073 CEST	21	50908	188.231.60.19	192.168.2.16
May 8, 2024 08:41:45.610846043 CEST	50968	21	192.168.2.16	115.133.110.2
May 8, 2024 08:41:45.610846043 CEST	50980	21	192.168.2.16	100.12.133.236
May 8, 2024 08:41:45.610846043 CEST	50967	21	192.168.2.16	73.170.17.51
May 8, 2024 08:41:45.610867023 CEST	50979	2121	192.168.2.16	100.12.133.236
May 8, 2024 08:41:45.610867023 CEST	50978	2121	192.168.2.16	95.54.152.162
May 8, 2024 08:41:45.610867977 CEST	50965	2121	192.168.2.16	187.200.10.176
May 8, 2024 08:41:45.610868931 CEST	50977	21	192.168.2.16	95.54.152.162
May 8, 2024 08:41:45.610867023 CEST	50966	2121	192.168.2.16	73.170.17.51
May 8, 2024 08:41:45.610872030 CEST	50983	2121	192.168.2.16	222.82.119.34
May 8, 2024 08:41:45.610874891 CEST	50971	2121	192.168.2.16	171.235.67.13
May 8, 2024 08:41:45.610937119 CEST	50969	2121	192.168.2.16	115.133.110.2
May 8, 2024 08:41:45.610938072 CEST	50981	21	192.168.2.16	78.68.122.29
May 8, 2024 08:41:45.610939026 CEST	50970	21	192.168.2.16	171.235.67.13
May 8, 2024 08:41:45.610939026 CEST	50982	2121	192.168.2.16	78.68.122.29
May 8, 2024 08:41:45.614556074 CEST	2121	50855	156.248.94.29	192.168.2.16
May 8, 2024 08:41:45.618827105 CEST	2121	50880	162.191.48.246	192.168.2.16
May 8, 2024 08:41:45.618844032 CEST	21	50878	162.191.48.246	192.168.2.16
May 8, 2024 08:41:45.621953011 CEST	21	50881	107.182.190.130	192.168.2.16
May 8, 2024 08:41:45.625072002 CEST	2121	50907	188.231.60.19	192.168.2.16
May 8, 2024 08:41:45.625488043 CEST	21	50870	96.126.118.190	192.168.2.16
May 8, 2024 08:41:45.625684023 CEST	50870	21	192.168.2.16	96.126.118.190
May 8, 2024 08:41:45.626190901 CEST	51016	21	192.168.2.16	35.223.218.230
May 8, 2024 08:41:45.626221895 CEST	2121	50883	107.182.190.130	192.168.2.16
May 8, 2024 08:41:45.626879930 CEST	50985	2121	192.168.2.16	177.240.12.174
May 8, 2024 08:41:45.626882076 CEST	50984	21	192.168.2.16	177.240.12.174
May 8, 2024 08:41:45.626893044 CEST	50939	2121	192.168.2.16	171.101.231.72
May 8, 2024 08:41:45.626894951 CEST	50827	2121	192.168.2.16	5.74.101.111
May 8, 2024 08:41:45.626894951 CEST	50992	21	192.168.2.16	67.249.54.64
May 8, 2024 08:41:45.626894951 CEST	50987	21	192.168.2.16	122.143.122.134
May 8, 2024 08:41:45.626894951 CEST	50986	2121	192.168.2.16	122.143.122.134
May 8, 2024 08:41:45.626894951 CEST	50990	2121	192.168.2.16	23.51.42.111
May 8, 2024 08:41:45.627069950 CEST	50995	2121	192.168.2.16	100.15.183.214
May 8, 2024 08:41:45.627070904 CEST	50988	21	192.168.2.16	23.51.42.111
May 8, 2024 08:41:45.627070904 CEST	50996	21	192.168.2.16	61.84.251.6
May 8, 2024 08:41:45.630847931 CEST	50993	2121	192.168.2.16	67.249.54.64
May 8, 2024 08:41:45.642052889 CEST	2121	50871	96.126.118.190	192.168.2.16
May 8, 2024 08:41:45.642158031 CEST	50871	2121	192.168.2.16	96.126.118.190
May 8, 2024 08:41:45.642465115 CEST	51017	2121	192.168.2.16	35.223.218.230
May 8, 2024 08:41:45.642843008 CEST	50994	21	192.168.2.16	100.15.183.214
May 8, 2024 08:41:45.642865896 CEST	50856	21	192.168.2.16	141.94.36.78
May 8, 2024 08:41:45.642867088 CEST	50857	2121	192.168.2.16	141.94.36.78
May 8, 2024 08:41:45.696424961 CEST	21	51004	172.120.235.139	192.168.2.16
May 8, 2024 08:41:45.696599007 CEST	51004	21	192.168.2.16	172.120.235.139
May 8, 2024 08:41:45.696875095 CEST	51018	21	192.168.2.16	172.120.235.139
May 8, 2024 08:41:45.697459936 CEST	21	50975	126.79.98.218	192.168.2.16
May 8, 2024 08:41:45.697500944 CEST	2121	50972	126.79.98.218	192.168.2.16
May 8, 2024 08:41:45.703386068 CEST	21	50997	24.45.193.33	192.168.2.16
May 8, 2024 08:41:45.721843004 CEST	50998	2121	192.168.2.16	61.84.251.6
May 8, 2024 08:41:45.732717991 CEST	2121	50999	24.45.193.33	192.168.2.16
May 8, 2024 08:41:45.732897043 CEST	21	51014	34.149.79.8	192.168.2.16
May 8, 2024 08:41:45.733058929 CEST	51014	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:45.733091116 CEST	2121	51015	34.149.79.8	192.168.2.16
May 8, 2024 08:41:45.733150005 CEST	51014	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:45.733175993 CEST	51015	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:45.733300924 CEST	51015	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:45.733478069 CEST	51019	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:45.733592987 CEST	51020	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:45.737860918 CEST	50845	2121	192.168.2.16	186.249.29.73
May 8, 2024 08:41:45.739839077 CEST	50844	21	192.168.2.16	186.249.29.73
May 8, 2024 08:41:45.740382910 CEST	2121	50973	84.44.255.254	192.168.2.16
May 8, 2024 08:41:45.753911018 CEST	50829	2121	192.168.2.16	73.242.1.186
May 8, 2024 08:41:45.755840063 CEST	50830	21	192.168.2.16	73.242.1.186
May 8, 2024 08:41:45.767625093 CEST	21	50950	145.40.24.245	192.168.2.16
May 8, 2024 08:41:45.768294096 CEST	2121	50951	145.40.24.245	192.168.2.16
May 8, 2024 08:41:45.785861015 CEST	50831	21	192.168.2.16	78.150.131.82
May 8, 2024 08:41:45.817107916 CEST	50833	2121	192.168.2.16	78.150.131.82
May 8, 2024 08:41:45.833332062 CEST	51021	21	192.168.2.16	211.227.4.20
May 8, 2024 08:41:45.834511995 CEST	21	50870	96.126.118.190	192.168.2.16
May 8, 2024 08:41:45.848882914 CEST	50884	21	192.168.2.16	116.203.56.124
May 8, 2024 08:41:45.851193905 CEST	2121	50871	96.126.118.190	192.168.2.16
May 8, 2024 08:41:45.864880085 CEST	50885	2121	192.168.2.16	116.203.56.124
May 8, 2024 08:41:45.864892960 CEST	50835	21	192.168.2.16	196.221.170.61
May 8, 2024 08:41:45.878333092 CEST	21	51004	172.120.235.139	192.168.2.16
May 8, 2024 08:41:45.878601074 CEST	21	51018	172.120.235.139	192.168.2.16
May 8, 2024 08:41:45.878670931 CEST	51004	21	192.168.2.16	172.120.235.139
May 8, 2024 08:41:45.878712893 CEST	51018	21	192.168.2.16	172.120.235.139
May 8, 2024 08:41:45.895400047 CEST	2121	51015	34.149.79.8	192.168.2.16
May 8, 2024 08:41:45.895757914 CEST	21	51014	34.149.79.8	192.168.2.16
May 8, 2024 08:41:45.895863056 CEST	21	51019	34.149.79.8	192.168.2.16
May 8, 2024 08:41:45.895951033 CEST	51019	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:45.895997047 CEST	2121	51020	34.149.79.8	192.168.2.16
May 8, 2024 08:41:45.896871090 CEST	51003	2121	192.168.2.16	72.191.218.237
May 8, 2024 08:41:45.896908045 CEST	51020	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:45.896917105 CEST	51002	21	192.168.2.16	72.191.218.237
May 8, 2024 08:41:45.923378944 CEST	21	51005	196.210.0.111	192.168.2.16
May 8, 2024 08:41:45.923557997 CEST	51005	21	192.168.2.16	196.210.0.111
May 8, 2024 08:41:45.929936886 CEST	2121	50840	49.160.65.205	192.168.2.16
May 8, 2024 08:41:45.959039927 CEST	21	50856	141.94.36.78	192.168.2.16
May 8, 2024 08:41:45.961452961 CEST	2121	50857	141.94.36.78	192.168.2.16
May 8, 2024 08:41:45.979557991 CEST	21	50870	96.126.118.190	192.168.2.16
May 8, 2024 08:41:45.979789972 CEST	50870	21	192.168.2.16	96.126.118.190
May 8, 2024 08:41:45.992319107 CEST	50826	21	192.168.2.16	27.212.221.89
May 8, 2024 08:41:45.992549896 CEST	51022	2121	192.168.2.16	211.227.4.20
May 8, 2024 08:41:45.997636080 CEST	2121	50871	96.126.118.190	192.168.2.16
May 8, 2024 08:41:45.998030901 CEST	50871	2121	192.168.2.16	96.126.118.190
May 8, 2024 08:41:46.002687931 CEST	21	50976	222.82.119.34	192.168.2.16
May 8, 2024 08:41:46.007872105 CEST	50989	21	192.168.2.16	72.21.25.18
May 8, 2024 08:41:46.017709017 CEST	2121	50983	222.82.119.34	192.168.2.16
May 8, 2024 08:41:46.023849010 CEST	50828	2121	192.168.2.16	27.212.221.89
May 8, 2024 08:41:46.039841890 CEST	50836	2121	192.168.2.16	196.221.170.61
May 8, 2024 08:41:46.039870977 CEST	50991	2121	192.168.2.16	72.21.25.18
May 8, 2024 08:41:46.058423996 CEST	21	51019	34.149.79.8	192.168.2.16
May 8, 2024 08:41:46.058485031 CEST	51019	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:46.058581114 CEST	51019	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:46.058830976 CEST	51023	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:46.059344053 CEST	2121	51020	34.149.79.8	192.168.2.16
May 8, 2024 08:41:46.059392929 CEST	51020	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:46.059537888 CEST	51020	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:46.059886932 CEST	51024	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:46.071871996 CEST	51006	21	192.168.2.16	108.6.199.81
May 8, 2024 08:41:46.087867975 CEST	50838	2121	192.168.2.16	194.106.247.204
May 8, 2024 08:41:46.087887049 CEST	50837	21	192.168.2.16	194.106.247.204
May 8, 2024 08:41:46.087887049 CEST	50839	21	192.168.2.16	49.160.65.205
May 8, 2024 08:41:46.087994099 CEST	50956	2121	192.168.2.16	68.196.163.2
May 8, 2024 08:41:46.088005066 CEST	50854	21	192.168.2.16	156.248.94.29
May 8, 2024 08:41:46.088006973 CEST	50954	21	192.168.2.16	68.196.163.2
May 8, 2024 08:41:46.100286961 CEST	2121	50845	186.249.29.73	192.168.2.16
May 8, 2024 08:41:46.100555897 CEST	21	51018	172.120.235.139	192.168.2.16
May 8, 2024 08:41:46.100759983 CEST	51018	21	192.168.2.16	172.120.235.139
May 8, 2024 08:41:46.101478100 CEST	21	50938	171.101.231.72	192.168.2.16
May 8, 2024 08:41:46.101813078 CEST	21	50844	186.249.29.73	192.168.2.16
May 8, 2024 08:41:46.119839907 CEST	50908	21	192.168.2.16	188.231.60.19
May 8, 2024 08:41:46.119872093 CEST	50842	2121	192.168.2.16	83.38.110.136
May 8, 2024 08:41:46.119884014 CEST	50841	21	192.168.2.16	83.38.110.136
May 8, 2024 08:41:46.119899035 CEST	50855	2121	192.168.2.16	156.248.94.29
May 8, 2024 08:41:46.119899035 CEST	50880	2121	192.168.2.16	162.191.48.246
May 8, 2024 08:41:46.134891987 CEST	50907	2121	192.168.2.16	188.231.60.19
May 8, 2024 08:41:46.135046005 CEST	50883	2121	192.168.2.16	107.182.190.130
May 8, 2024 08:41:46.135046005 CEST	50878	21	192.168.2.16	162.191.48.246
May 8, 2024 08:41:46.135354996 CEST	50881	21	192.168.2.16	107.182.190.130
May 8, 2024 08:41:46.143861055 CEST	21	51021	211.227.4.20	192.168.2.16
May 8, 2024 08:41:46.150855064 CEST	50849	2121	192.168.2.16	1.222.95.228
May 8, 2024 08:41:46.150891066 CEST	50850	21	192.168.2.16	73.43.146.204
May 8, 2024 08:41:46.150891066 CEST	50848	21	192.168.2.16	1.222.95.228
May 8, 2024 08:41:46.154005051 CEST	50851	2121	192.168.2.16	73.43.146.204
May 8, 2024 08:41:46.166887045 CEST	50852	21	192.168.2.16	99.254.103.133
May 8, 2024 08:41:46.169533968 CEST	50853	2121	192.168.2.16	99.254.103.133
May 8, 2024 08:41:46.172959089 CEST	21	50884	116.203.56.124	192.168.2.16
May 8, 2024 08:41:46.189029932 CEST	2121	50885	116.203.56.124	192.168.2.16
May 8, 2024 08:41:46.193914890 CEST	2121	50939	171.101.231.72	192.168.2.16
May 8, 2024 08:41:46.198874950 CEST	50858	21	192.168.2.16	181.118.173.28
May 8, 2024 08:41:46.198875904 CEST	50859	2121	192.168.2.16	181.118.173.28
May 8, 2024 08:41:46.198877096 CEST	50975	21	192.168.2.16	126.79.98.218
May 8, 2024 08:41:46.198889017 CEST	50860	21	192.168.2.16	78.193.204.75
May 8, 2024 08:41:46.198892117 CEST	50862	21	192.168.2.16	81.36.175.43
May 8, 2024 08:41:46.198892117 CEST	50864	21	192.168.2.16	114.96.100.230
May 8, 2024 08:41:46.198903084 CEST	50861	2121	192.168.2.16	78.193.204.75
May 8, 2024 08:41:46.199269056 CEST	50863	2121	192.168.2.16	81.36.175.43
May 8, 2024 08:41:46.199269056 CEST	50972	2121	192.168.2.16	126.79.98.218
May 8, 2024 08:41:46.201143980 CEST	21	50989	72.21.25.18	192.168.2.16
May 8, 2024 08:41:46.214874983 CEST	50865	2121	192.168.2.16	114.96.100.230
May 8, 2024 08:41:46.214874983 CEST	50867	21	192.168.2.16	177.55.34.22
May 8, 2024 08:41:46.215109110 CEST	50866	2121	192.168.2.16	177.55.34.22
May 8, 2024 08:41:46.219844103 CEST	50997	21	192.168.2.16	24.45.193.33
May 8, 2024 08:41:46.220915079 CEST	21	51019	34.149.79.8	192.168.2.16
May 8, 2024 08:41:46.221277952 CEST	21	51023	34.149.79.8	192.168.2.16
May 8, 2024 08:41:46.221345901 CEST	51023	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:46.221865892 CEST	2121	51020	34.149.79.8	192.168.2.16
May 8, 2024 08:41:46.222002983 CEST	2121	51024	34.149.79.8	192.168.2.16
May 8, 2024 08:41:46.222059011 CEST	51024	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:46.230866909 CEST	50868	2121	192.168.2.16	20.223.215.21
May 8, 2024 08:41:46.230868101 CEST	50869	21	192.168.2.16	20.223.215.21
May 8, 2024 08:41:46.239212990 CEST	2121	50991	72.21.25.18	192.168.2.16
May 8, 2024 08:41:46.246870041 CEST	50872	21	192.168.2.16	106.75.34.15
May 8, 2024 08:41:46.249690056 CEST	50999	2121	192.168.2.16	24.45.193.33
May 8, 2024 08:41:46.249852896 CEST	51009	2121	192.168.2.16	108.6.199.81
May 8, 2024 08:41:46.249867916 CEST	51010	21	192.168.2.16	174.130.17.74
May 8, 2024 08:41:46.250000000 CEST	50973	2121	192.168.2.16	84.44.255.254
May 8, 2024 08:41:46.271853924 CEST	50873	2121	192.168.2.16	106.75.34.15
May 8, 2024 08:41:46.278878927 CEST	50950	21	192.168.2.16	145.40.24.245
May 8, 2024 08:41:46.278911114 CEST	50951	2121	192.168.2.16	145.40.24.245
May 8, 2024 08:41:46.279174089 CEST	50875	2121	192.168.2.16	171.244.37.116
May 8, 2024 08:41:46.283932924 CEST	21	51018	172.120.235.139	192.168.2.16
May 8, 2024 08:41:46.284378052 CEST	21	51018	172.120.235.139	192.168.2.16
May 8, 2024 08:41:46.284560919 CEST	51018	21	192.168.2.16	172.120.235.139
May 8, 2024 08:41:46.294883966 CEST	50876	21	192.168.2.16	190.220.47.218
May 8, 2024 08:41:46.294918060 CEST	50877	2121	192.168.2.16	190.220.47.218
May 8, 2024 08:41:46.310431957 CEST	2121	51022	211.227.4.20	192.168.2.16
May 8, 2024 08:41:46.312136889 CEST	51011	2121	192.168.2.16	174.130.17.74
May 8, 2024 08:41:46.314429998 CEST	21	50854	156.248.94.29	192.168.2.16
May 8, 2024 08:41:46.317151070 CEST	51025	21	192.168.2.16	126.55.78.106
May 8, 2024 08:41:46.325751066 CEST	2121	50883	107.182.190.130	192.168.2.16
May 8, 2024 08:41:46.325781107 CEST	21	50881	107.182.190.130	192.168.2.16
May 8, 2024 08:41:46.328375101 CEST	51026	2121	192.168.2.16	126.55.78.106
May 8, 2024 08:41:46.328375101 CEST	51027	21	192.168.2.16	190.182.171.153
May 8, 2024 08:41:46.328960896 CEST	21	50826	27.212.221.89	192.168.2.16
May 8, 2024 08:41:46.329581022 CEST	51028	2121	192.168.2.16	190.182.171.153
May 8, 2024 08:41:46.339143991 CEST	21	50954	68.196.163.2	192.168.2.16
May 8, 2024 08:41:46.339171886 CEST	2121	50956	68.196.163.2	192.168.2.16
May 8, 2024 08:41:46.346417904 CEST	2121	50855	156.248.94.29	192.168.2.16
May 8, 2024 08:41:46.346779108 CEST	51029	21	192.168.2.16	223.70.202.42
May 8, 2024 08:41:46.359384060 CEST	51030	2121	192.168.2.16	223.70.202.42
May 8, 2024 08:41:46.359396935 CEST	51031	2121	192.168.2.16	151.227.254.168
May 8, 2024 08:41:46.359483957 CEST	51032	21	192.168.2.16	151.227.254.168
May 8, 2024 08:41:46.363423109 CEST	2121	50828	27.212.221.89	192.168.2.16
May 8, 2024 08:41:46.374876976 CEST	51013	2121	192.168.2.16	86.31.131.84
May 8, 2024 08:41:46.374880075 CEST	51012	21	192.168.2.16	86.31.131.84
May 8, 2024 08:41:46.375072002 CEST	51033	21	192.168.2.16	182.85.216.105
May 8, 2024 08:41:46.385597944 CEST	21	51023	34.149.79.8	192.168.2.16
May 8, 2024 08:41:46.385654926 CEST	51023	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:46.385739088 CEST	51023	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:46.385931015 CEST	51034	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:46.386045933 CEST	2121	51024	34.149.79.8	192.168.2.16
May 8, 2024 08:41:46.386101007 CEST	51024	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:46.386169910 CEST	51024	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:46.386358023 CEST	51035	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:46.390866041 CEST	50888	21	192.168.2.16	208.118.221.110
May 8, 2024 08:41:46.406833887 CEST	50886	21	192.168.2.16	160.176.169.174
May 8, 2024 08:41:46.406857967 CEST	50887	2121	192.168.2.16	160.176.169.174
May 8, 2024 08:41:46.413944006 CEST	21	51005	196.210.0.111	192.168.2.16
May 8, 2024 08:41:46.414087057 CEST	21	51005	196.210.0.111	192.168.2.16
May 8, 2024 08:41:46.414218903 CEST	51005	21	192.168.2.16	196.210.0.111
May 8, 2024 08:41:46.422868013 CEST	50889	2121	192.168.2.16	208.118.221.110
May 8, 2024 08:41:46.438865900 CEST	50840	2121	192.168.2.16	49.160.65.205
May 8, 2024 08:41:46.454878092 CEST	50890	21	192.168.2.16	69.143.236.170
May 8, 2024 08:41:46.454879999 CEST	50891	2121	192.168.2.16	69.143.236.170
May 8, 2024 08:41:46.464245081 CEST	21	50908	188.231.60.19	192.168.2.16
May 8, 2024 08:41:46.469425917 CEST	21	50997	24.45.193.33	192.168.2.16
May 8, 2024 08:41:46.469844103 CEST	50856	21	192.168.2.16	141.94.36.78
May 8, 2024 08:41:46.469878912 CEST	50894	21	192.168.2.16	104.208.119.138
May 8, 2024 08:41:46.469878912 CEST	50857	2121	192.168.2.16	141.94.36.78
May 8, 2024 08:41:46.469883919 CEST	50895	21	192.168.2.16	98.38.38.197
May 8, 2024 08:41:46.469887972 CEST	50896	2121	192.168.2.16	98.38.38.197
May 8, 2024 08:41:46.470004082 CEST	50897	2121	192.168.2.16	104.208.119.138
May 8, 2024 08:41:46.482930899 CEST	2121	50907	188.231.60.19	192.168.2.16
May 8, 2024 08:41:46.485873938 CEST	50898	21	192.168.2.16	139.227.244.36
May 8, 2024 08:41:46.494185925 CEST	21	50975	126.79.98.218	192.168.2.16
May 8, 2024 08:41:46.494755030 CEST	2121	50972	126.79.98.218	192.168.2.16
May 8, 2024 08:41:46.496958971 CEST	21	51018	172.120.235.139	192.168.2.16
May 8, 2024 08:41:46.497191906 CEST	51018	21	192.168.2.16	172.120.235.139
May 8, 2024 08:41:46.497555971 CEST	51036	21	192.168.2.16	172.120.235.139
May 8, 2024 08:41:46.498806953 CEST	2121	50999	24.45.193.33	192.168.2.16
May 8, 2024 08:41:46.501897097 CEST	50899	2121	192.168.2.16	139.227.244.36
May 8, 2024 08:41:46.517868042 CEST	50901	2121	192.168.2.16	180.230.0.67
May 8, 2024 08:41:46.517891884 CEST	50900	21	192.168.2.16	180.230.0.67
May 8, 2024 08:41:46.517895937 CEST	50976	21	192.168.2.16	222.82.119.34
May 8, 2024 08:41:46.522005081 CEST	50902	21	192.168.2.16	83.221.69.134
May 8, 2024 08:41:46.532856941 CEST	50983	2121	192.168.2.16	222.82.119.34
May 8, 2024 08:41:46.548871040 CEST	50904	2121	192.168.2.16	83.221.69.134
May 8, 2024 08:41:46.549401999 CEST	51037	2121	192.168.2.16	182.85.216.105
May 8, 2024 08:41:46.549705982 CEST	21	51034	34.149.79.8	192.168.2.16
May 8, 2024 08:41:46.549717903 CEST	21	51023	34.149.79.8	192.168.2.16
May 8, 2024 08:41:46.549768925 CEST	51034	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:46.549952030 CEST	2121	51024	34.149.79.8	192.168.2.16
May 8, 2024 08:41:46.550297022 CEST	2121	51035	34.149.79.8	192.168.2.16
May 8, 2024 08:41:46.550353050 CEST	51035	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:46.564874887 CEST	50906	2121	192.168.2.16	23.197.37.61
May 8, 2024 08:41:46.564878941 CEST	50905	21	192.168.2.16	23.197.37.61
May 8, 2024 08:41:46.569572926 CEST	2121	50973	84.44.255.254	192.168.2.16
May 8, 2024 08:41:46.596235991 CEST	2121	50880	162.191.48.246	192.168.2.16
May 8, 2024 08:41:46.596247911 CEST	21	50878	162.191.48.246	192.168.2.16
May 8, 2024 08:41:46.612864017 CEST	50845	2121	192.168.2.16	186.249.29.73
May 8, 2024 08:41:46.612864971 CEST	50938	21	192.168.2.16	171.101.231.72
May 8, 2024 08:41:46.613492012 CEST	50844	21	192.168.2.16	186.249.29.73
May 8, 2024 08:41:46.620296001 CEST	21	51025	126.55.78.106	192.168.2.16
May 8, 2024 08:41:46.621750116 CEST	21	50950	145.40.24.245	192.168.2.16
May 8, 2024 08:41:46.627325058 CEST	2121	50951	145.40.24.245	192.168.2.16
May 8, 2024 08:41:46.628859043 CEST	50909	21	192.168.2.16	190.137.88.196
May 8, 2024 08:41:46.629298925 CEST	51016	21	192.168.2.16	35.223.218.230
May 8, 2024 08:41:46.631262064 CEST	2121	51026	126.55.78.106	192.168.2.16
May 8, 2024 08:41:46.644913912 CEST	51017	2121	192.168.2.16	35.223.218.230
May 8, 2024 08:41:46.644913912 CEST	51021	21	192.168.2.16	211.227.4.20
May 8, 2024 08:41:46.676872015 CEST	50884	21	192.168.2.16	116.203.56.124
May 8, 2024 08:41:46.678997993 CEST	21	51018	172.120.235.139	192.168.2.16
May 8, 2024 08:41:46.679076910 CEST	51018	21	192.168.2.16	172.120.235.139
May 8, 2024 08:41:46.679227114 CEST	21	51036	172.120.235.139	192.168.2.16
May 8, 2024 08:41:46.679297924 CEST	51036	21	192.168.2.16	172.120.235.139
May 8, 2024 08:41:46.692881107 CEST	50885	2121	192.168.2.16	116.203.56.124
May 8, 2024 08:41:46.693166018 CEST	51038	21	192.168.2.16	89.99.154.153
May 8, 2024 08:41:46.708844900 CEST	50939	2121	192.168.2.16	171.101.231.72
May 8, 2024 08:41:46.708873987 CEST	50989	21	192.168.2.16	72.21.25.18
May 8, 2024 08:41:46.712182045 CEST	21	51034	34.149.79.8	192.168.2.16
May 8, 2024 08:41:46.712248087 CEST	51034	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:46.712341070 CEST	51034	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:46.712541103 CEST	51039	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:46.712995052 CEST	2121	51035	34.149.79.8	192.168.2.16
May 8, 2024 08:41:46.713047028 CEST	51035	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:46.713114977 CEST	51035	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:46.713279009 CEST	51040	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:46.740890026 CEST	50991	2121	192.168.2.16	72.21.25.18
May 8, 2024 08:41:46.741235018 CEST	51041	2121	192.168.2.16	89.99.154.153
May 8, 2024 08:41:46.754575968 CEST	2121	51030	223.70.202.42	192.168.2.16
May 8, 2024 08:41:46.755862951 CEST	50910	2121	192.168.2.16	190.137.88.196
May 8, 2024 08:41:46.756299973 CEST	51042	21	192.168.2.16	20.72.193.177
May 8, 2024 08:41:46.771884918 CEST	50911	21	192.168.2.16	24.12.3.159
May 8, 2024 08:41:46.772305012 CEST	51043	2121	192.168.2.16	20.72.193.177
May 8, 2024 08:41:46.773885965 CEST	2121	50840	49.160.65.205	192.168.2.16
May 8, 2024 08:41:46.786072016 CEST	21	50856	141.94.36.78	192.168.2.16
May 8, 2024 08:41:46.787867069 CEST	50914	2121	192.168.2.16	24.12.3.159
May 8, 2024 08:41:46.788203001 CEST	51044	21	192.168.2.16	36.57.161.108
May 8, 2024 08:41:46.788389921 CEST	2121	50857	141.94.36.78	192.168.2.16
May 8, 2024 08:41:46.802850962 CEST	50915	21	192.168.2.16	98.39.159.210
May 8, 2024 08:41:46.803379059 CEST	51045	2121	192.168.2.16	36.57.161.108
May 8, 2024 08:41:46.803390980 CEST	51046	21	192.168.2.16	38.11.126.207
May 8, 2024 08:41:46.818887949 CEST	51022	2121	192.168.2.16	211.227.4.20
May 8, 2024 08:41:46.818897963 CEST	50916	2121	192.168.2.16	98.39.159.210
May 8, 2024 08:41:46.819367886 CEST	51047	2121	192.168.2.16	38.11.126.207
May 8, 2024 08:41:46.848854065 CEST	50954	21	192.168.2.16	68.196.163.2
May 8, 2024 08:41:46.849284887 CEST	51048	21	192.168.2.16	90.218.110.249
May 8, 2024 08:41:46.849283934 CEST	50956	2121	192.168.2.16	68.196.163.2
May 8, 2024 08:41:46.874773979 CEST	21	51034	34.149.79.8	192.168.2.16
May 8, 2024 08:41:46.874880075 CEST	21	51039	34.149.79.8	192.168.2.16
May 8, 2024 08:41:46.874963999 CEST	51039	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:46.875426054 CEST	2121	51035	34.149.79.8	192.168.2.16
May 8, 2024 08:41:46.875616074 CEST	2121	51040	34.149.79.8	192.168.2.16
May 8, 2024 08:41:46.875674009 CEST	51040	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:46.880273104 CEST	21	51029	223.70.202.42	192.168.2.16
May 8, 2024 08:41:46.898242950 CEST	21	51036	172.120.235.139	192.168.2.16
May 8, 2024 08:41:46.898400068 CEST	51036	21	192.168.2.16	172.120.235.139
May 8, 2024 08:41:46.902051926 CEST	21	50989	72.21.25.18	192.168.2.16
May 8, 2024 08:41:46.912245989 CEST	51049	2121	192.168.2.16	90.218.110.249
May 8, 2024 08:41:46.925091028 CEST	21	50976	222.82.119.34	192.168.2.16
May 8, 2024 08:41:46.938760042 CEST	21	51005	196.210.0.111	192.168.2.16
May 8, 2024 08:41:46.939730883 CEST	2121	50983	222.82.119.34	192.168.2.16
May 8, 2024 08:41:46.940150976 CEST	2121	50991	72.21.25.18	192.168.2.16
May 8, 2024 08:41:46.944228888 CEST	51050	21	192.168.2.16	52.154.218.62
May 8, 2024 08:41:46.956121922 CEST	21	51021	211.227.4.20	192.168.2.16
May 8, 2024 08:41:46.960148096 CEST	51051	2121	192.168.2.16	52.154.218.62
May 8, 2024 08:41:46.975894928 CEST	50997	21	192.168.2.16	24.45.193.33
May 8, 2024 08:41:46.975893974 CEST	50908	21	192.168.2.16	188.231.60.19
May 8, 2024 08:41:46.976454020 CEST	2121	50845	186.249.29.73	192.168.2.16
May 8, 2024 08:41:46.976692915 CEST	21	50844	186.249.29.73	192.168.2.16
May 8, 2024 08:41:46.988637924 CEST	21	51046	38.11.126.207	192.168.2.16
May 8, 2024 08:41:46.991900921 CEST	50907	2121	192.168.2.16	188.231.60.19
May 8, 2024 08:41:46.992809057 CEST	51052	21	192.168.2.16	156.253.134.40
May 8, 2024 08:41:46.992845058 CEST	51053	2121	192.168.2.16	156.253.134.40
May 8, 2024 08:41:46.992942095 CEST	51054	21	192.168.2.16	36.159.115.27
May 8, 2024 08:41:47.001074076 CEST	21	50884	116.203.56.124	192.168.2.16
May 8, 2024 08:41:47.001971006 CEST	2121	51047	38.11.126.207	192.168.2.16
May 8, 2024 08:41:47.007858992 CEST	50917	21	192.168.2.16	50.108.78.189
May 8, 2024 08:41:47.007872105 CEST	50975	21	192.168.2.16	126.79.98.218
May 8, 2024 08:41:47.007920027 CEST	50999	2121	192.168.2.16	24.45.193.33
May 8, 2024 08:41:47.007920027 CEST	50972	2121	192.168.2.16	126.79.98.218
May 8, 2024 08:41:47.016936064 CEST	2121	50885	116.203.56.124	192.168.2.16
May 8, 2024 08:41:47.024342060 CEST	51055	21	192.168.2.16	95.229.68.24
May 8, 2024 08:41:47.024394989 CEST	51056	2121	192.168.2.16	36.159.115.27
May 8, 2024 08:41:47.037396908 CEST	21	51039	34.149.79.8	192.168.2.16
May 8, 2024 08:41:47.037462950 CEST	51039	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:47.037543058 CEST	51039	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:47.037735939 CEST	51057	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:47.038125992 CEST	2121	51040	34.149.79.8	192.168.2.16
May 8, 2024 08:41:47.038172007 CEST	51040	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:47.038261890 CEST	51040	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:47.038455009 CEST	51058	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:47.040088892 CEST	51059	2121	192.168.2.16	95.229.68.24
May 8, 2024 08:41:47.072710991 CEST	50973	2121	192.168.2.16	84.44.255.254
May 8, 2024 08:41:47.082576036 CEST	21	51036	172.120.235.139	192.168.2.16
May 8, 2024 08:41:47.083020926 CEST	21	51036	172.120.235.139	192.168.2.16
May 8, 2024 08:41:47.083163977 CEST	51036	21	192.168.2.16	172.120.235.139
May 8, 2024 08:41:47.102849007 CEST	50878	21	192.168.2.16	162.191.48.246
May 8, 2024 08:41:47.102869034 CEST	50880	2121	192.168.2.16	162.191.48.246
May 8, 2024 08:41:47.103602886 CEST	2121	50956	68.196.163.2	192.168.2.16
May 8, 2024 08:41:47.105194092 CEST	21	50954	68.196.163.2	192.168.2.16
May 8, 2024 08:41:47.134850025 CEST	50950	21	192.168.2.16	145.40.24.245
May 8, 2024 08:41:47.134850025 CEST	51025	21	192.168.2.16	126.55.78.106
May 8, 2024 08:41:47.134865046 CEST	51026	2121	192.168.2.16	126.55.78.106
May 8, 2024 08:41:47.134871006 CEST	50951	2121	192.168.2.16	145.40.24.245
May 8, 2024 08:41:47.136166096 CEST	2121	51022	211.227.4.20	192.168.2.16
May 8, 2024 08:41:47.136867046 CEST	21	50938	171.101.231.72	192.168.2.16
May 8, 2024 08:41:47.199887037 CEST	21	51039	34.149.79.8	192.168.2.16
May 8, 2024 08:41:47.200141907 CEST	21	51057	34.149.79.8	192.168.2.16
May 8, 2024 08:41:47.200237036 CEST	51057	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:47.200581074 CEST	2121	51058	34.149.79.8	192.168.2.16
May 8, 2024 08:41:47.200594902 CEST	2121	51040	34.149.79.8	192.168.2.16
May 8, 2024 08:41:47.200648069 CEST	51058	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:47.214986086 CEST	21	50801	77.75.121.3	192.168.2.16
May 8, 2024 08:41:47.215181112 CEST	50801	21	192.168.2.16	77.75.121.3
May 8, 2024 08:41:47.215471029 CEST	51060	21	192.168.2.16	77.75.121.3
May 8, 2024 08:41:47.223606110 CEST	21	50997	24.45.193.33	192.168.2.16
May 8, 2024 08:41:47.230863094 CEST	50921	2121	192.168.2.16	50.108.78.189
May 8, 2024 08:41:47.231478930 CEST	51061	21	192.168.2.16	210.223.76.199
May 8, 2024 08:41:47.231568098 CEST	51062	2121	192.168.2.16	210.223.76.199
May 8, 2024 08:41:47.247172117 CEST	51063	21	192.168.2.16	101.114.64.62
May 8, 2024 08:41:47.257262945 CEST	2121	50999	24.45.193.33	192.168.2.16
May 8, 2024 08:41:47.262898922 CEST	51030	2121	192.168.2.16	223.70.202.42
May 8, 2024 08:41:47.263328075 CEST	51064	2121	192.168.2.16	101.114.64.62
May 8, 2024 08:41:47.263362885 CEST	51065	21	192.168.2.16	105.72.45.95
May 8, 2024 08:41:47.279113054 CEST	51066	2121	192.168.2.16	105.72.45.95
May 8, 2024 08:41:47.279645920 CEST	2121	50939	171.101.231.72	192.168.2.16
May 8, 2024 08:41:47.291487932 CEST	21	51052	156.253.134.40	192.168.2.16
May 8, 2024 08:41:47.291522980 CEST	2121	51053	156.253.134.40	192.168.2.16
May 8, 2024 08:41:47.291980028 CEST	21	51036	172.120.235.139	192.168.2.16
May 8, 2024 08:41:47.292140961 CEST	51036	21	192.168.2.16	172.120.235.139
May 8, 2024 08:41:47.292361975 CEST	51067	21	192.168.2.16	172.120.235.139
May 8, 2024 08:41:47.301426888 CEST	2121	50972	126.79.98.218	192.168.2.16
May 8, 2024 08:41:47.301474094 CEST	21	50975	126.79.98.218	192.168.2.16
May 8, 2024 08:41:47.311686993 CEST	21	50908	188.231.60.19	192.168.2.16
May 8, 2024 08:41:47.312094927 CEST	51068	21	192.168.2.16	222.248.7.195
May 8, 2024 08:41:47.326879978 CEST	50922	21	192.168.2.16	90.202.57.207
May 8, 2024 08:41:47.341646910 CEST	2121	50907	188.231.60.19	192.168.2.16
May 8, 2024 08:41:47.342104912 CEST	51069	2121	192.168.2.16	222.248.7.195
May 8, 2024 08:41:47.342844009 CEST	51028	2121	192.168.2.16	190.182.171.153
May 8, 2024 08:41:47.342875957 CEST	51027	21	192.168.2.16	190.182.171.153
May 8, 2024 08:41:47.342891932 CEST	50923	2121	192.168.2.16	90.202.57.207
May 8, 2024 08:41:47.358942986 CEST	51031	2121	192.168.2.16	151.227.254.168
May 8, 2024 08:41:47.359334946 CEST	51070	21	192.168.2.16	18.67.79.85
May 8, 2024 08:41:47.362967014 CEST	2121	51058	34.149.79.8	192.168.2.16
May 8, 2024 08:41:47.362979889 CEST	21	51057	34.149.79.8	192.168.2.16
May 8, 2024 08:41:47.363025904 CEST	51058	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:47.363055944 CEST	51057	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:47.363121033 CEST	51058	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:47.363255024 CEST	51057	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:47.363420963 CEST	51071	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:47.363511086 CEST	51072	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:47.374870062 CEST	51033	21	192.168.2.16	182.85.216.105
May 8, 2024 08:41:47.374871969 CEST	51032	21	192.168.2.16	151.227.254.168
May 8, 2024 08:41:47.390836954 CEST	51029	21	192.168.2.16	223.70.202.42
May 8, 2024 08:41:47.391062021 CEST	51073	2121	192.168.2.16	18.67.79.85
May 8, 2024 08:41:47.392328978 CEST	2121	50973	84.44.255.254	192.168.2.16
May 8, 2024 08:41:47.406864882 CEST	50989	21	192.168.2.16	72.21.25.18
May 8, 2024 08:41:47.407288074 CEST	51074	21	192.168.2.16	78.17.146.253
May 8, 2024 08:41:47.407352924 CEST	51075	2121	192.168.2.16	78.17.146.253
May 8, 2024 08:41:47.408801079 CEST	51076	21	192.168.2.16	23.207.91.110
May 8, 2024 08:41:47.438026905 CEST	2121	51026	126.55.78.106	192.168.2.16
May 8, 2024 08:41:47.438040018 CEST	21	51025	126.55.78.106	192.168.2.16
May 8, 2024 08:41:47.438863993 CEST	50976	21	192.168.2.16	222.82.119.34
May 8, 2024 08:41:47.439124107 CEST	50926	21	192.168.2.16	98.199.233.159
May 8, 2024 08:41:47.439124107 CEST	51077	2121	192.168.2.16	23.207.91.110
May 8, 2024 08:41:47.454849005 CEST	50991	2121	192.168.2.16	72.21.25.18
May 8, 2024 08:41:47.454854012 CEST	50983	2121	192.168.2.16	222.82.119.34
May 8, 2024 08:41:47.470838070 CEST	51021	21	192.168.2.16	211.227.4.20
May 8, 2024 08:41:47.473882914 CEST	21	51036	172.120.235.139	192.168.2.16
May 8, 2024 08:41:47.473934889 CEST	51036	21	192.168.2.16	172.120.235.139
May 8, 2024 08:41:47.473994970 CEST	21	51067	172.120.235.139	192.168.2.16
May 8, 2024 08:41:47.474056005 CEST	51067	21	192.168.2.16	172.120.235.139
May 8, 2024 08:41:47.477597952 CEST	21	50950	145.40.24.245	192.168.2.16
May 8, 2024 08:41:47.483319998 CEST	2121	50951	145.40.24.245	192.168.2.16
May 8, 2024 08:41:47.502855062 CEST	51046	21	192.168.2.16	38.11.126.207
May 8, 2024 08:41:47.502857924 CEST	51047	2121	192.168.2.16	38.11.126.207
May 8, 2024 08:41:47.502861023 CEST	50927	2121	192.168.2.16	98.199.233.159
May 8, 2024 08:41:47.519355059 CEST	51078	2121	192.168.2.16	68.134.194.220
May 8, 2024 08:41:47.519469976 CEST	51079	21	192.168.2.16	68.134.194.220
May 8, 2024 08:41:47.525214911 CEST	2121	51058	34.149.79.8	192.168.2.16
May 8, 2024 08:41:47.525603056 CEST	21	51057	34.149.79.8	192.168.2.16
May 8, 2024 08:41:47.525751114 CEST	21	51071	34.149.79.8	192.168.2.16
May 8, 2024 08:41:47.525834084 CEST	51071	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:47.525861979 CEST	2121	51072	34.149.79.8	192.168.2.16
May 8, 2024 08:41:47.525914907 CEST	51072	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:47.526513100 CEST	21	50801	77.75.121.3	192.168.2.16
May 8, 2024 08:41:47.526566029 CEST	50801	21	192.168.2.16	77.75.121.3
May 8, 2024 08:41:47.526911974 CEST	21	50801	77.75.121.3	192.168.2.16
May 8, 2024 08:41:47.526957035 CEST	50801	21	192.168.2.16	77.75.121.3
May 8, 2024 08:41:47.527111053 CEST	21	51060	77.75.121.3	192.168.2.16
May 8, 2024 08:41:47.527168036 CEST	51060	21	192.168.2.16	77.75.121.3
May 8, 2024 08:41:47.538959026 CEST	21	50878	162.191.48.246	192.168.2.16
May 8, 2024 08:41:47.538978100 CEST	2121	50880	162.191.48.246	192.168.2.16
May 8, 2024 08:41:47.539345980 CEST	51080	21	192.168.2.16	79.114.76.238
May 8, 2024 08:41:47.550889969 CEST	50928	21	192.168.2.16	3.139.67.62
May 8, 2024 08:41:47.550889015 CEST	50930	2121	192.168.2.16	178.198.26.164
May 8, 2024 08:41:47.550908089 CEST	50934	2121	192.168.2.16	68.103.85.240
May 8, 2024 08:41:47.550909042 CEST	50933	2121	192.168.2.16	1.237.215.90
May 8, 2024 08:41:47.550909996 CEST	50931	21	192.168.2.16	178.198.26.164
May 8, 2024 08:41:47.550909996 CEST	50932	21	192.168.2.16	1.237.215.90
May 8, 2024 08:41:47.550909996 CEST	50935	21	192.168.2.16	68.103.85.240
May 8, 2024 08:41:47.550919056 CEST	50929	2121	192.168.2.16	3.139.67.62
May 8, 2024 08:41:47.551266909 CEST	51081	2121	192.168.2.16	79.114.76.238
May 8, 2024 08:41:47.551271915 CEST	51037	2121	192.168.2.16	182.85.216.105
May 8, 2024 08:41:47.566843987 CEST	50942	2121	192.168.2.16	123.4.16.127
May 8, 2024 08:41:47.566867113 CEST	50945	2121	192.168.2.16	70.127.87.48
May 8, 2024 08:41:47.566868067 CEST	50941	21	192.168.2.16	158.197.185.49
May 8, 2024 08:41:47.566868067 CEST	50940	21	192.168.2.16	123.4.16.127
May 8, 2024 08:41:47.567008972 CEST	50944	21	192.168.2.16	70.127.87.48
May 8, 2024 08:41:47.582869053 CEST	50937	2121	192.168.2.16	91.146.97.65
May 8, 2024 08:41:47.582880020 CEST	50948	21	192.168.2.16	8.243.24.22
May 8, 2024 08:41:47.582881927 CEST	50943	2121	192.168.2.16	158.197.185.49
May 8, 2024 08:41:47.582881927 CEST	50949	2121	192.168.2.16	8.243.24.22
May 8, 2024 08:41:47.582885027 CEST	50947	2121	192.168.2.16	91.176.181.139
May 8, 2024 08:41:47.582894087 CEST	50952	21	192.168.2.16	98.17.134.56
May 8, 2024 08:41:47.582895994 CEST	50946	21	192.168.2.16	91.176.181.139
May 8, 2024 08:41:47.582897902 CEST	50953	2121	192.168.2.16	98.17.134.56
May 8, 2024 08:41:47.582897902 CEST	50957	2121	192.168.2.16	94.241.8.215
May 8, 2024 08:41:47.582905054 CEST	50959	2121	192.168.2.16	68.9.127.183
May 8, 2024 08:41:47.582907915 CEST	50955	21	192.168.2.16	94.241.8.215
May 8, 2024 08:41:47.584126949 CEST	50960	21	192.168.2.16	72.135.103.56
May 8, 2024 08:41:47.584129095 CEST	50958	21	192.168.2.16	68.9.127.183
May 8, 2024 08:41:47.598848104 CEST	50962	21	192.168.2.16	104.100.168.169
May 8, 2024 08:41:47.598861933 CEST	50963	2121	192.168.2.16	104.100.168.169
May 8, 2024 08:41:47.598864079 CEST	50961	2121	192.168.2.16	72.135.103.56
May 8, 2024 08:41:47.599937916 CEST	50964	21	192.168.2.16	187.200.10.176
May 8, 2024 08:41:47.600151062 CEST	21	50989	72.21.25.18	192.168.2.16
May 8, 2024 08:41:47.614841938 CEST	50956	2121	192.168.2.16	68.196.163.2
May 8, 2024 08:41:47.614855051 CEST	50954	21	192.168.2.16	68.196.163.2
May 8, 2024 08:41:47.614866018 CEST	50980	21	192.168.2.16	100.12.133.236
May 8, 2024 08:41:47.614866972 CEST	50971	2121	192.168.2.16	171.235.67.13
May 8, 2024 08:41:47.614866972 CEST	50968	21	192.168.2.16	115.133.110.2
May 8, 2024 08:41:47.614866972 CEST	50967	21	192.168.2.16	73.170.17.51
May 8, 2024 08:41:47.614871979 CEST	50978	2121	192.168.2.16	95.54.152.162
May 8, 2024 08:41:47.614880085 CEST	50970	21	192.168.2.16	171.235.67.13
May 8, 2024 08:41:47.614880085 CEST	50965	2121	192.168.2.16	187.200.10.176
May 8, 2024 08:41:47.614881992 CEST	50969	2121	192.168.2.16	115.133.110.2
May 8, 2024 08:41:47.614881992 CEST	50966	2121	192.168.2.16	73.170.17.51
May 8, 2024 08:41:47.614886999 CEST	50977	21	192.168.2.16	95.54.152.162
May 8, 2024 08:41:47.614887953 CEST	50981	21	192.168.2.16	78.68.122.29
May 8, 2024 08:41:47.614898920 CEST	50982	2121	192.168.2.16	78.68.122.29
May 8, 2024 08:41:47.614900112 CEST	50979	2121	192.168.2.16	100.12.133.236
May 8, 2024 08:41:47.615326881 CEST	51082	2121	192.168.2.16	39.118.206.166
May 8, 2024 08:41:47.615382910 CEST	51083	21	192.168.2.16	39.118.206.166
May 8, 2024 08:41:47.630865097 CEST	50993	2121	192.168.2.16	67.249.54.64
May 8, 2024 08:41:47.630866051 CEST	50984	21	192.168.2.16	177.240.12.174
May 8, 2024 08:41:47.630867958 CEST	50985	2121	192.168.2.16	177.240.12.174
May 8, 2024 08:41:47.630866051 CEST	50992	21	192.168.2.16	67.249.54.64
May 8, 2024 08:41:47.630866051 CEST	50986	2121	192.168.2.16	122.143.122.134
May 8, 2024 08:41:47.630878925 CEST	50995	2121	192.168.2.16	100.15.183.214
May 8, 2024 08:41:47.630880117 CEST	50987	21	192.168.2.16	122.143.122.134
May 8, 2024 08:41:47.630888939 CEST	50990	2121	192.168.2.16	23.51.42.111
May 8, 2024 08:41:47.630894899 CEST	50988	21	192.168.2.16	23.51.42.111
May 8, 2024 08:41:47.630923033 CEST	50996	21	192.168.2.16	61.84.251.6
May 8, 2024 08:41:47.646859884 CEST	50938	21	192.168.2.16	171.101.231.72
May 8, 2024 08:41:47.646883965 CEST	51022	2121	192.168.2.16	211.227.4.20
May 8, 2024 08:41:47.646892071 CEST	50994	21	192.168.2.16	100.15.183.214
May 8, 2024 08:41:47.654258013 CEST	2121	50991	72.21.25.18	192.168.2.16
May 8, 2024 08:41:47.656816959 CEST	2121	51030	223.70.202.42	192.168.2.16
May 8, 2024 08:41:47.679410934 CEST	51084	21	192.168.2.16	154.221.211.247
May 8, 2024 08:41:47.685491085 CEST	2121	51047	38.11.126.207	192.168.2.16
May 8, 2024 08:41:47.687987089 CEST	21	51046	38.11.126.207	192.168.2.16
May 8, 2024 08:41:47.688294888 CEST	21	51071	34.149.79.8	192.168.2.16
May 8, 2024 08:41:47.688364029 CEST	51071	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:47.688467979 CEST	51071	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:47.688747883 CEST	51085	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:47.694873095 CEST	51038	21	192.168.2.16	89.99.154.153
May 8, 2024 08:41:47.696248055 CEST	2121	51072	34.149.79.8	192.168.2.16
May 8, 2024 08:41:47.696300983 CEST	51072	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:47.696405888 CEST	51072	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:47.696660042 CEST	51086	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:47.698345900 CEST	21	51067	172.120.235.139	192.168.2.16
May 8, 2024 08:41:47.698467970 CEST	51067	21	192.168.2.16	172.120.235.139
May 8, 2024 08:41:47.725847960 CEST	50998	2121	192.168.2.16	61.84.251.6
May 8, 2024 08:41:47.725872993 CEST	50997	21	192.168.2.16	24.45.193.33
May 8, 2024 08:41:47.740859985 CEST	51041	2121	192.168.2.16	89.99.154.153
May 8, 2024 08:41:47.756880999 CEST	51042	21	192.168.2.16	20.72.193.177
May 8, 2024 08:41:47.757354021 CEST	51087	2121	192.168.2.16	154.221.211.247
May 8, 2024 08:41:47.757389069 CEST	51088	21	192.168.2.16	175.214.50.248
May 8, 2024 08:41:47.772881985 CEST	50999	2121	192.168.2.16	24.45.193.33
May 8, 2024 08:41:47.772881985 CEST	51043	2121	192.168.2.16	20.72.193.177
May 8, 2024 08:41:47.783603907 CEST	21	51021	211.227.4.20	192.168.2.16
May 8, 2024 08:41:47.788885117 CEST	51044	21	192.168.2.16	36.57.161.108
May 8, 2024 08:41:47.788885117 CEST	50939	2121	192.168.2.16	171.101.231.72
May 8, 2024 08:41:47.789311886 CEST	51089	2121	192.168.2.16	175.214.50.248
May 8, 2024 08:41:47.804850101 CEST	51052	21	192.168.2.16	156.253.134.40
May 8, 2024 08:41:47.804860115 CEST	50972	2121	192.168.2.16	126.79.98.218
May 8, 2024 08:41:47.804990053 CEST	51045	2121	192.168.2.16	36.57.161.108
May 8, 2024 08:41:47.804995060 CEST	50975	21	192.168.2.16	126.79.98.218
May 8, 2024 08:41:47.805015087 CEST	51053	2121	192.168.2.16	156.253.134.40
May 8, 2024 08:41:47.805263042 CEST	51090	21	192.168.2.16	87.128.72.231
May 8, 2024 08:41:47.838390112 CEST	21	51060	77.75.121.3	192.168.2.16
May 8, 2024 08:41:47.838679075 CEST	51060	21	192.168.2.16	77.75.121.3
May 8, 2024 08:41:47.846508980 CEST	21	50976	222.82.119.34	192.168.2.16
May 8, 2024 08:41:47.850749016 CEST	21	51071	34.149.79.8	192.168.2.16
May 8, 2024 08:41:47.851083994 CEST	21	51085	34.149.79.8	192.168.2.16
May 8, 2024 08:41:47.851159096 CEST	51085	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:47.852881908 CEST	51048	21	192.168.2.16	90.218.110.249
May 8, 2024 08:41:47.853209019 CEST	51091	2121	192.168.2.16	87.128.72.231
May 8, 2024 08:41:47.858859062 CEST	2121	51072	34.149.79.8	192.168.2.16
May 8, 2024 08:41:47.859004974 CEST	2121	51086	34.149.79.8	192.168.2.16
May 8, 2024 08:41:47.859076977 CEST	51086	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:47.861015081 CEST	2121	50983	222.82.119.34	192.168.2.16
May 8, 2024 08:41:47.868388891 CEST	2121	50956	68.196.163.2	192.168.2.16
May 8, 2024 08:41:47.868870020 CEST	51092	21	192.168.2.16	24.56.47.44
May 8, 2024 08:41:47.869456053 CEST	21	50954	68.196.163.2	192.168.2.16
May 8, 2024 08:41:47.880191088 CEST	21	51067	172.120.235.139	192.168.2.16
May 8, 2024 08:41:47.880465031 CEST	21	51067	172.120.235.139	192.168.2.16
May 8, 2024 08:41:47.880655050 CEST	51067	21	192.168.2.16	172.120.235.139
May 8, 2024 08:41:47.885416985 CEST	51093	2121	192.168.2.16	24.56.47.44
May 8, 2024 08:41:47.887365103 CEST	2121	51081	79.114.76.238	192.168.2.16
May 8, 2024 08:41:47.900855064 CEST	50973	2121	192.168.2.16	84.44.255.254
May 8, 2024 08:41:47.900861025 CEST	51002	21	192.168.2.16	72.191.218.237
May 8, 2024 08:41:47.900868893 CEST	51003	2121	192.168.2.16	72.191.218.237
May 8, 2024 08:41:47.906028986 CEST	21	51005	196.210.0.111	192.168.2.16
May 8, 2024 08:41:47.906186104 CEST	51005	21	192.168.2.16	196.210.0.111
May 8, 2024 08:41:47.906399012 CEST	51094	21	192.168.2.16	196.210.0.111
May 8, 2024 08:41:47.916899920 CEST	51049	2121	192.168.2.16	90.218.110.249
May 8, 2024 08:41:47.928716898 CEST	21	51029	223.70.202.42	192.168.2.16
May 8, 2024 08:41:47.942783117 CEST	21	50843	23.229.188.101	192.168.2.16
May 8, 2024 08:41:47.943072081 CEST	50843	21	192.168.2.16	23.229.188.101
May 8, 2024 08:41:47.943253994 CEST	51095	21	192.168.2.16	23.229.188.101
May 8, 2024 08:41:47.948865891 CEST	51026	2121	192.168.2.16	126.55.78.106
May 8, 2024 08:41:47.948865891 CEST	51025	21	192.168.2.16	126.55.78.106
May 8, 2024 08:41:47.948888063 CEST	51050	21	192.168.2.16	52.154.218.62
May 8, 2024 08:41:47.963543892 CEST	2121	51022	211.227.4.20	192.168.2.16
May 8, 2024 08:41:47.964936972 CEST	51051	2121	192.168.2.16	52.154.218.62
May 8, 2024 08:41:47.971772909 CEST	21	50997	24.45.193.33	192.168.2.16
May 8, 2024 08:41:47.980863094 CEST	50950	21	192.168.2.16	145.40.24.245
May 8, 2024 08:41:47.996864080 CEST	50951	2121	192.168.2.16	145.40.24.245
May 8, 2024 08:41:47.996864080 CEST	51054	21	192.168.2.16	36.159.115.27
May 8, 2024 08:41:47.997185946 CEST	51096	21	192.168.2.16	87.4.213.60
May 8, 2024 08:41:48.005583048 CEST	21	51084	154.221.211.247	192.168.2.16
May 8, 2024 08:41:48.017184973 CEST	21	51085	34.149.79.8	192.168.2.16
May 8, 2024 08:41:48.017255068 CEST	51085	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:48.017323017 CEST	51085	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:48.017544031 CEST	51097	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:48.018809080 CEST	2121	50999	24.45.193.33	192.168.2.16
May 8, 2024 08:41:48.022464991 CEST	21	50903	38.38.120.85	192.168.2.16
May 8, 2024 08:41:48.022649050 CEST	50903	21	192.168.2.16	38.38.120.85
May 8, 2024 08:41:48.022917032 CEST	51098	21	192.168.2.16	38.38.120.85
May 8, 2024 08:41:48.024060965 CEST	2121	51086	34.149.79.8	192.168.2.16
May 8, 2024 08:41:48.024116039 CEST	51086	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:48.024245977 CEST	51086	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:48.024498940 CEST	51099	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:48.028872967 CEST	51055	21	192.168.2.16	95.229.68.24
May 8, 2024 08:41:48.029285908 CEST	51100	2121	192.168.2.16	87.4.213.60
May 8, 2024 08:41:48.029288054 CEST	51056	2121	192.168.2.16	36.159.115.27
May 8, 2024 08:41:48.029315948 CEST	51101	21	192.168.2.16	182.91.23.226
May 8, 2024 08:41:48.044883013 CEST	51059	2121	192.168.2.16	95.229.68.24
May 8, 2024 08:41:48.076893091 CEST	51006	21	192.168.2.16	108.6.199.81
May 8, 2024 08:41:48.077550888 CEST	51102	2121	192.168.2.16	182.91.23.226
May 8, 2024 08:41:48.077625990 CEST	51103	21	192.168.2.16	173.62.166.227
May 8, 2024 08:41:48.077668905 CEST	51104	2121	192.168.2.16	173.62.166.227
May 8, 2024 08:41:48.086941957 CEST	2121	51087	154.221.211.247	192.168.2.16
May 8, 2024 08:41:48.093022108 CEST	21	51067	172.120.235.139	192.168.2.16
May 8, 2024 08:41:48.093157053 CEST	51067	21	192.168.2.16	172.120.235.139
May 8, 2024 08:41:48.093333006 CEST	51105	21	192.168.2.16	172.120.235.139
May 8, 2024 08:41:48.098342896 CEST	2121	50972	126.79.98.218	192.168.2.16
May 8, 2024 08:41:48.098411083 CEST	21	50975	126.79.98.218	192.168.2.16
May 8, 2024 08:41:48.103616953 CEST	21	51052	156.253.134.40	192.168.2.16
May 8, 2024 08:41:48.103634119 CEST	2121	51053	156.253.134.40	192.168.2.16
May 8, 2024 08:41:48.109371901 CEST	51106	21	192.168.2.16	171.244.62.79
May 8, 2024 08:41:48.109437943 CEST	51107	2121	192.168.2.16	171.244.62.79
May 8, 2024 08:41:48.109544992 CEST	51108	21	192.168.2.16	175.192.125.189
May 8, 2024 08:41:48.109603882 CEST	51109	2121	192.168.2.16	175.192.125.189
May 8, 2024 08:41:48.141443968 CEST	51110	21	192.168.2.16	67.170.33.55
May 8, 2024 08:41:48.141469002 CEST	51111	2121	192.168.2.16	67.170.33.55
May 8, 2024 08:41:48.141638041 CEST	51112	2121	192.168.2.16	185.237.214.83
May 8, 2024 08:41:48.141765118 CEST	51113	21	192.168.2.16	185.237.214.83
May 8, 2024 08:41:48.144690037 CEST	21	51095	23.229.188.101	192.168.2.16
May 8, 2024 08:41:48.144761086 CEST	51095	21	192.168.2.16	23.229.188.101
May 8, 2024 08:41:48.146691084 CEST	21	50843	23.229.188.101	192.168.2.16
May 8, 2024 08:41:48.146744967 CEST	50843	21	192.168.2.16	23.229.188.101
May 8, 2024 08:41:48.147659063 CEST	21	50843	23.229.188.101	192.168.2.16
May 8, 2024 08:41:48.147700071 CEST	50843	21	192.168.2.16	23.229.188.101
May 8, 2024 08:41:48.151947975 CEST	21	51060	77.75.121.3	192.168.2.16
May 8, 2024 08:41:48.152111053 CEST	21	51060	77.75.121.3	192.168.2.16
May 8, 2024 08:41:48.152241945 CEST	51060	21	192.168.2.16	77.75.121.3
May 8, 2024 08:41:48.156879902 CEST	51030	2121	192.168.2.16	223.70.202.42
May 8, 2024 08:41:48.157188892 CEST	51114	21	192.168.2.16	210.179.125.116
May 8, 2024 08:41:48.157373905 CEST	51115	2121	192.168.2.16	210.179.125.116
May 8, 2024 08:41:48.172221899 CEST	21	50938	171.101.231.72	192.168.2.16
May 8, 2024 08:41:48.180304050 CEST	21	51085	34.149.79.8	192.168.2.16
May 8, 2024 08:41:48.180318117 CEST	21	51097	34.149.79.8	192.168.2.16
May 8, 2024 08:41:48.180388927 CEST	51097	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:48.186542034 CEST	2121	51086	34.149.79.8	192.168.2.16
May 8, 2024 08:41:48.186671972 CEST	2121	51099	34.149.79.8	192.168.2.16
May 8, 2024 08:41:48.186726093 CEST	51099	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:48.188862085 CEST	51046	21	192.168.2.16	38.11.126.207
May 8, 2024 08:41:48.188880920 CEST	51047	2121	192.168.2.16	38.11.126.207
May 8, 2024 08:41:48.189719915 CEST	51116	21	192.168.2.16	119.113.86.28
May 8, 2024 08:41:48.189788103 CEST	51117	2121	192.168.2.16	119.113.86.28
May 8, 2024 08:41:48.189929962 CEST	51118	21	192.168.2.16	81.32.73.103
May 8, 2024 08:41:48.189984083 CEST	51119	2121	192.168.2.16	81.32.73.103
May 8, 2024 08:41:48.190013885 CEST	51120	2121	192.168.2.16	20.159.153.189
May 8, 2024 08:41:48.190057039 CEST	51121	21	192.168.2.16	20.159.153.189
May 8, 2024 08:41:48.190143108 CEST	51122	21	192.168.2.16	46.206.172.28
May 8, 2024 08:41:48.205276012 CEST	51123	21	192.168.2.16	8.210.19.105
May 8, 2024 08:41:48.205367088 CEST	51124	2121	192.168.2.16	46.206.172.28
May 8, 2024 08:41:48.205384970 CEST	51125	2121	192.168.2.16	8.210.19.105
May 8, 2024 08:41:48.217044115 CEST	21	50903	38.38.120.85	192.168.2.16
May 8, 2024 08:41:48.217097998 CEST	50903	21	192.168.2.16	38.38.120.85
May 8, 2024 08:41:48.217202902 CEST	21	51098	38.38.120.85	192.168.2.16
May 8, 2024 08:41:48.217262030 CEST	51098	21	192.168.2.16	38.38.120.85
May 8, 2024 08:41:48.217791080 CEST	21	50903	38.38.120.85	192.168.2.16
May 8, 2024 08:41:48.217833996 CEST	50903	21	192.168.2.16	38.38.120.85
May 8, 2024 08:41:48.221262932 CEST	51126	21	192.168.2.16	189.73.161.99
May 8, 2024 08:41:48.221301079 CEST	51127	2121	192.168.2.16	189.73.161.99
May 8, 2024 08:41:48.225337982 CEST	2121	50973	84.44.255.254	192.168.2.16
May 8, 2024 08:41:48.236888885 CEST	51061	21	192.168.2.16	210.223.76.199
May 8, 2024 08:41:48.236895084 CEST	51062	2121	192.168.2.16	210.223.76.199
May 8, 2024 08:41:48.237540960 CEST	51128	21	192.168.2.16	71.227.226.201
May 8, 2024 08:41:48.237577915 CEST	51129	2121	192.168.2.16	71.227.226.201
May 8, 2024 08:41:48.252873898 CEST	51063	21	192.168.2.16	101.114.64.62
May 8, 2024 08:41:48.253247976 CEST	51130	21	192.168.2.16	117.223.205.236
May 8, 2024 08:41:48.253285885 CEST	51009	2121	192.168.2.16	108.6.199.81
May 8, 2024 08:41:48.254940033 CEST	2121	51026	126.55.78.106	192.168.2.16
May 8, 2024 08:41:48.254951954 CEST	51010	21	192.168.2.16	174.130.17.74
May 8, 2024 08:41:48.256942034 CEST	21	51025	126.55.78.106	192.168.2.16
May 8, 2024 08:41:48.268847942 CEST	51064	2121	192.168.2.16	101.114.64.62
May 8, 2024 08:41:48.268868923 CEST	51065	21	192.168.2.16	105.72.45.95
May 8, 2024 08:41:48.274991035 CEST	21	51105	172.120.235.139	192.168.2.16
May 8, 2024 08:41:48.275053024 CEST	21	51067	172.120.235.139	192.168.2.16
May 8, 2024 08:41:48.275053978 CEST	51105	21	192.168.2.16	172.120.235.139
May 8, 2024 08:41:48.275099993 CEST	51067	21	192.168.2.16	172.120.235.139
May 8, 2024 08:41:48.284883976 CEST	51066	2121	192.168.2.16	105.72.45.95
May 8, 2024 08:41:48.285468102 CEST	51021	21	192.168.2.16	211.227.4.20
May 8, 2024 08:41:48.285552979 CEST	51131	21	192.168.2.16	171.244.37.116
May 8, 2024 08:41:48.285612106 CEST	51132	21	192.168.2.16	91.146.97.65
May 8, 2024 08:41:48.285722971 CEST	51133	21	192.168.2.16	84.44.255.254
May 8, 2024 08:41:48.316999912 CEST	51011	2121	192.168.2.16	174.130.17.74
May 8, 2024 08:41:48.317102909 CEST	51068	21	192.168.2.16	222.248.7.195
May 8, 2024 08:41:48.324350119 CEST	21	50950	145.40.24.245	192.168.2.16
May 8, 2024 08:41:48.347429037 CEST	21	51097	34.149.79.8	192.168.2.16
May 8, 2024 08:41:48.347513914 CEST	51097	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:48.347609997 CEST	51097	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:48.347861052 CEST	51134	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:48.348871946 CEST	51069	2121	192.168.2.16	222.248.7.195
May 8, 2024 08:41:48.348871946 CEST	50976	21	192.168.2.16	222.82.119.34
May 8, 2024 08:41:48.348905087 CEST	21	51095	23.229.188.101	192.168.2.16
May 8, 2024 08:41:48.349262953 CEST	2121	50951	145.40.24.245	192.168.2.16
May 8, 2024 08:41:48.349415064 CEST	51095	21	192.168.2.16	23.229.188.101
May 8, 2024 08:41:48.349571943 CEST	51135	21	192.168.2.16	96.126.118.190
May 8, 2024 08:41:48.352827072 CEST	2121	51099	34.149.79.8	192.168.2.16
May 8, 2024 08:41:48.352880955 CEST	51099	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:48.352966070 CEST	51099	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:48.353204012 CEST	51136	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:48.361140966 CEST	2121	50939	171.101.231.72	192.168.2.16
May 8, 2024 08:41:48.365247965 CEST	51137	2121	192.168.2.16	96.126.118.190
May 8, 2024 08:41:48.365849018 CEST	51070	21	192.168.2.16	18.67.79.85
May 8, 2024 08:41:48.366003990 CEST	50983	2121	192.168.2.16	222.82.119.34
May 8, 2024 08:41:48.371587038 CEST	2121	51047	38.11.126.207	192.168.2.16
May 8, 2024 08:41:48.374170065 CEST	21	51046	38.11.126.207	192.168.2.16
May 8, 2024 08:41:48.379870892 CEST	51012	21	192.168.2.16	86.31.131.84
May 8, 2024 08:41:48.379873037 CEST	51013	2121	192.168.2.16	86.31.131.84
May 8, 2024 08:41:48.391578913 CEST	21	51094	196.210.0.111	192.168.2.16
May 8, 2024 08:41:48.391647100 CEST	51094	21	192.168.2.16	196.210.0.111
May 8, 2024 08:41:48.394774914 CEST	21	51005	196.210.0.111	192.168.2.16
May 8, 2024 08:41:48.394831896 CEST	51005	21	192.168.2.16	196.210.0.111
May 8, 2024 08:41:48.395865917 CEST	51081	2121	192.168.2.16	79.114.76.238
May 8, 2024 08:41:48.396001101 CEST	51073	2121	192.168.2.16	18.67.79.85
May 8, 2024 08:41:48.396362066 CEST	51139	21	192.168.2.16	110.66.7.129
May 8, 2024 08:41:48.396378994 CEST	51138	21	192.168.2.16	106.32.191.166
May 8, 2024 08:41:48.396404982 CEST	51140	2121	192.168.2.16	106.32.191.166
May 8, 2024 08:41:48.408771038 CEST	21	51098	38.38.120.85	192.168.2.16
May 8, 2024 08:41:48.408952951 CEST	51098	21	192.168.2.16	38.38.120.85
May 8, 2024 08:41:48.411848068 CEST	51074	21	192.168.2.16	78.17.146.253
May 8, 2024 08:41:48.411889076 CEST	51075	2121	192.168.2.16	78.17.146.253
May 8, 2024 08:41:48.412172079 CEST	51076	21	192.168.2.16	23.207.91.110
May 8, 2024 08:41:48.412173033 CEST	51141	2121	192.168.2.16	110.66.7.129
May 8, 2024 08:41:48.422256947 CEST	21	51108	175.192.125.189	192.168.2.16
May 8, 2024 08:41:48.423111916 CEST	2121	51109	175.192.125.189	192.168.2.16
May 8, 2024 08:41:48.443850040 CEST	51077	2121	192.168.2.16	23.207.91.110
May 8, 2024 08:41:48.443850994 CEST	51029	21	192.168.2.16	223.70.202.42
May 8, 2024 08:41:48.444289923 CEST	51142	2121	192.168.2.16	84.0.119.169
May 8, 2024 08:41:48.444327116 CEST	51143	21	192.168.2.16	84.0.119.169
May 8, 2024 08:41:48.460144997 CEST	51144	21	192.168.2.16	62.140.135.146
May 8, 2024 08:41:48.460426092 CEST	51145	2121	192.168.2.16	62.140.135.146
May 8, 2024 08:41:48.460609913 CEST	51146	21	192.168.2.16	136.52.110.227
May 8, 2024 08:41:48.460829020 CEST	51147	2121	192.168.2.16	136.52.110.227
May 8, 2024 08:41:48.475874901 CEST	51022	2121	192.168.2.16	211.227.4.20
May 8, 2024 08:41:48.492244005 CEST	51148	21	192.168.2.16	39.123.200.22
May 8, 2024 08:41:48.499691963 CEST	21	51105	172.120.235.139	192.168.2.16
May 8, 2024 08:41:48.499887943 CEST	51105	21	192.168.2.16	172.120.235.139
May 8, 2024 08:41:48.503050089 CEST	21	51060	77.75.121.3	192.168.2.16
May 8, 2024 08:41:48.507886887 CEST	51084	21	192.168.2.16	154.221.211.247
May 8, 2024 08:41:48.508564949 CEST	51150	2121	192.168.2.16	39.123.200.22
May 8, 2024 08:41:48.508565903 CEST	51149	21	192.168.2.16	207.181.250.221
May 8, 2024 08:41:48.511094093 CEST	21	51097	34.149.79.8	192.168.2.16
May 8, 2024 08:41:48.511109114 CEST	21	51134	34.149.79.8	192.168.2.16
May 8, 2024 08:41:48.511202097 CEST	51134	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:48.516211033 CEST	2121	51099	34.149.79.8	192.168.2.16
May 8, 2024 08:41:48.516506910 CEST	2121	51136	34.149.79.8	192.168.2.16
May 8, 2024 08:41:48.516567945 CEST	51136	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:48.522887945 CEST	51079	21	192.168.2.16	68.134.194.220
May 8, 2024 08:41:48.522922039 CEST	51078	2121	192.168.2.16	68.134.194.220
May 8, 2024 08:41:48.523793936 CEST	51151	2121	192.168.2.16	207.181.250.221
May 8, 2024 08:41:48.523907900 CEST	51152	21	192.168.2.16	130.149.110.200
May 8, 2024 08:41:48.539522886 CEST	51153	2121	192.168.2.16	130.149.110.200
May 8, 2024 08:41:48.550775051 CEST	21	51095	23.229.188.101	192.168.2.16
May 8, 2024 08:41:48.550947905 CEST	2121	51030	223.70.202.42	192.168.2.16
May 8, 2024 08:41:48.551013947 CEST	21	51095	23.229.188.101	192.168.2.16
May 8, 2024 08:41:48.551220894 CEST	51095	21	192.168.2.16	23.229.188.101
May 8, 2024 08:41:48.554327965 CEST	51154	21	192.168.2.16	195.201.94.23
May 8, 2024 08:41:48.554362059 CEST	51155	2121	192.168.2.16	195.201.94.23
May 8, 2024 08:41:48.555444002 CEST	21	51135	96.126.118.190	192.168.2.16
May 8, 2024 08:41:48.555510044 CEST	51135	21	192.168.2.16	96.126.118.190
May 8, 2024 08:41:48.559866905 CEST	51080	21	192.168.2.16	79.114.76.238
May 8, 2024 08:41:48.573692083 CEST	2121	51137	96.126.118.190	192.168.2.16
May 8, 2024 08:41:48.573769093 CEST	51137	2121	192.168.2.16	96.126.118.190
May 8, 2024 08:41:48.596543074 CEST	21	51021	211.227.4.20	192.168.2.16
May 8, 2024 08:41:48.599364996 CEST	21	51098	38.38.120.85	192.168.2.16
May 8, 2024 08:41:48.599431038 CEST	21	51098	38.38.120.85	192.168.2.16
May 8, 2024 08:41:48.599590063 CEST	51098	21	192.168.2.16	38.38.120.85
May 8, 2024 08:41:48.601881027 CEST	51087	2121	192.168.2.16	154.221.211.247
May 8, 2024 08:41:48.602840900 CEST	21	51133	84.44.255.254	192.168.2.16
May 8, 2024 08:41:48.602916002 CEST	51133	21	192.168.2.16	84.44.255.254
May 8, 2024 08:41:48.617883921 CEST	51052	21	192.168.2.16	156.253.134.40
May 8, 2024 08:41:48.617883921 CEST	51082	2121	192.168.2.16	39.118.206.166
May 8, 2024 08:41:48.617887020 CEST	51053	2121	192.168.2.16	156.253.134.40
May 8, 2024 08:41:48.617887020 CEST	51083	21	192.168.2.16	39.118.206.166
May 8, 2024 08:41:48.620218039 CEST	51156	21	192.168.2.16	38.44.32.116
May 8, 2024 08:41:48.624614000 CEST	21	51132	91.146.97.65	192.168.2.16
May 8, 2024 08:41:48.624676943 CEST	51132	21	192.168.2.16	91.146.97.65
May 8, 2024 08:41:48.633867025 CEST	51016	21	192.168.2.16	35.223.218.230
May 8, 2024 08:41:48.649908066 CEST	51017	2121	192.168.2.16	35.223.218.230
May 8, 2024 08:41:48.656847000 CEST	21	51131	171.244.37.116	192.168.2.16
May 8, 2024 08:41:48.656913042 CEST	51131	21	192.168.2.16	171.244.37.116
May 8, 2024 08:41:48.673521042 CEST	21	51134	34.149.79.8	192.168.2.16
May 8, 2024 08:41:48.673579931 CEST	51134	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:48.673650980 CEST	51134	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:48.673866034 CEST	51157	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:48.678735971 CEST	2121	51136	34.149.79.8	192.168.2.16
May 8, 2024 08:41:48.678783894 CEST	51136	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:48.678895950 CEST	51136	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:48.679210901 CEST	51158	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:48.681528091 CEST	21	51105	172.120.235.139	192.168.2.16
May 8, 2024 08:41:48.681930065 CEST	21	51105	172.120.235.139	192.168.2.16
May 8, 2024 08:41:48.682070971 CEST	51105	21	192.168.2.16	172.120.235.139
May 8, 2024 08:41:48.682847977 CEST	50938	21	192.168.2.16	171.101.231.72
May 8, 2024 08:41:48.718585968 CEST	21	51130	117.223.205.236	192.168.2.16
May 8, 2024 08:41:48.718662977 CEST	51130	21	192.168.2.16	117.223.205.236
May 8, 2024 08:41:48.732158899 CEST	2121	51081	79.114.76.238	192.168.2.16
May 8, 2024 08:41:48.761883974 CEST	51026	2121	192.168.2.16	126.55.78.106
May 8, 2024 08:41:48.761982918 CEST	51088	21	192.168.2.16	175.214.50.248
May 8, 2024 08:41:48.762320995 CEST	51159	2121	192.168.2.16	38.44.32.116
May 8, 2024 08:41:48.762351990 CEST	51025	21	192.168.2.16	126.55.78.106
May 8, 2024 08:41:48.768250942 CEST	21	50976	222.82.119.34	192.168.2.16
May 8, 2024 08:41:48.768574953 CEST	51160	21	192.168.2.16	104.87.220.107
May 8, 2024 08:41:48.778151035 CEST	51161	2121	192.168.2.16	104.87.220.107
May 8, 2024 08:41:48.782790899 CEST	2121	50983	222.82.119.34	192.168.2.16
May 8, 2024 08:41:48.785581112 CEST	21	51144	62.140.135.146	192.168.2.16
May 8, 2024 08:41:48.785650015 CEST	51144	21	192.168.2.16	62.140.135.146
May 8, 2024 08:41:48.785732985 CEST	2121	51145	62.140.135.146	192.168.2.16
May 8, 2024 08:41:48.785792112 CEST	51145	2121	192.168.2.16	62.140.135.146
May 8, 2024 08:41:48.790410042 CEST	21	51095	23.229.188.101	192.168.2.16
May 8, 2024 08:41:48.792399883 CEST	2121	51022	211.227.4.20	192.168.2.16
May 8, 2024 08:41:48.793881893 CEST	51089	2121	192.168.2.16	175.214.50.248
May 8, 2024 08:41:48.794569016 CEST	51162	21	192.168.2.16	184.67.80.145
May 8, 2024 08:41:48.794614077 CEST	51163	2121	192.168.2.16	184.67.80.145
May 8, 2024 08:41:48.794620037 CEST	51164	21	192.168.2.16	73.75.96.175
May 8, 2024 08:41:48.805402040 CEST	21	51148	39.123.200.22	192.168.2.16
May 8, 2024 08:41:48.809890985 CEST	51090	21	192.168.2.16	87.128.72.231
May 8, 2024 08:41:48.814694881 CEST	2121	51150	39.123.200.22	192.168.2.16
May 8, 2024 08:41:48.826261044 CEST	51165	2121	192.168.2.16	73.75.96.175
May 8, 2024 08:41:48.828784943 CEST	21	51098	38.38.120.85	192.168.2.16
May 8, 2024 08:41:48.834161043 CEST	21	51084	154.221.211.247	192.168.2.16
May 8, 2024 08:41:48.836427927 CEST	21	51134	34.149.79.8	192.168.2.16
May 8, 2024 08:41:48.836673021 CEST	21	51157	34.149.79.8	192.168.2.16
May 8, 2024 08:41:48.836746931 CEST	51157	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:48.841816902 CEST	2121	51136	34.149.79.8	192.168.2.16
May 8, 2024 08:41:48.842605114 CEST	2121	51158	34.149.79.8	192.168.2.16
May 8, 2024 08:41:48.842685938 CEST	51158	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:48.853950977 CEST	2121	51102	182.91.23.226	192.168.2.16
May 8, 2024 08:41:48.857868910 CEST	51091	2121	192.168.2.16	87.128.72.231
May 8, 2024 08:41:48.870461941 CEST	21	51101	182.91.23.226	192.168.2.16
May 8, 2024 08:41:48.873850107 CEST	50939	2121	192.168.2.16	171.101.231.72
May 8, 2024 08:41:48.873866081 CEST	51047	2121	192.168.2.16	38.11.126.207
May 8, 2024 08:41:48.878844976 CEST	51092	21	192.168.2.16	24.56.47.44
May 8, 2024 08:41:48.889848948 CEST	51046	21	192.168.2.16	38.11.126.207
May 8, 2024 08:41:48.889864922 CEST	51093	2121	192.168.2.16	24.56.47.44
May 8, 2024 08:41:48.893284082 CEST	21	51105	172.120.235.139	192.168.2.16
May 8, 2024 08:41:48.893452883 CEST	51105	21	192.168.2.16	172.120.235.139
May 8, 2024 08:41:48.893688917 CEST	51166	21	192.168.2.16	172.120.235.139
May 8, 2024 08:41:48.908790112 CEST	21	51094	196.210.0.111	192.168.2.16
May 8, 2024 08:41:48.908977985 CEST	51094	21	192.168.2.16	196.210.0.111
May 8, 2024 08:41:48.917315960 CEST	21	51052	156.253.134.40	192.168.2.16
May 8, 2024 08:41:48.917345047 CEST	2121	51053	156.253.134.40	192.168.2.16
May 8, 2024 08:41:48.918971062 CEST	21	51133	84.44.255.254	192.168.2.16
May 8, 2024 08:41:48.919042110 CEST	51133	21	192.168.2.16	84.44.255.254
May 8, 2024 08:41:48.919135094 CEST	51133	21	192.168.2.16	84.44.255.254
May 8, 2024 08:41:48.919373989 CEST	51167	21	192.168.2.16	84.44.255.254
May 8, 2024 08:41:48.931370020 CEST	2121	51087	154.221.211.247	192.168.2.16
May 8, 2024 08:41:48.937875032 CEST	51108	21	192.168.2.16	175.192.125.189
May 8, 2024 08:41:48.937880039 CEST	51109	2121	192.168.2.16	175.192.125.189
May 8, 2024 08:41:48.986269951 CEST	51168	21	192.168.2.16	217.105.64.87
May 8, 2024 08:41:48.986367941 CEST	21	51029	223.70.202.42	192.168.2.16
May 8, 2024 08:41:48.992945910 CEST	21	51132	91.146.97.65	192.168.2.16
May 8, 2024 08:41:48.993158102 CEST	51132	21	192.168.2.16	91.146.97.65
May 8, 2024 08:41:48.999195099 CEST	21	51157	34.149.79.8	192.168.2.16
May 8, 2024 08:41:48.999269962 CEST	51157	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:48.999321938 CEST	51157	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:48.999468088 CEST	51169	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:49.001909018 CEST	51096	21	192.168.2.16	87.4.213.60
May 8, 2024 08:41:49.005187035 CEST	2121	51158	34.149.79.8	192.168.2.16
May 8, 2024 08:41:49.005256891 CEST	51158	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:49.005398035 CEST	51158	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:49.005727053 CEST	51170	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:49.029186010 CEST	21	51131	171.244.37.116	192.168.2.16
May 8, 2024 08:41:49.029380083 CEST	51131	21	192.168.2.16	171.244.37.116
May 8, 2024 08:41:49.033896923 CEST	51100	2121	192.168.2.16	87.4.213.60
May 8, 2024 08:41:49.034256935 CEST	2121	51159	38.44.32.116	192.168.2.16
May 8, 2024 08:41:49.056539059 CEST	2121	51047	38.11.126.207	192.168.2.16
May 8, 2024 08:41:49.064924002 CEST	2121	51026	126.55.78.106	192.168.2.16
May 8, 2024 08:41:49.065531015 CEST	21	51025	126.55.78.106	192.168.2.16
May 8, 2024 08:41:49.065850019 CEST	51030	2121	192.168.2.16	223.70.202.42
May 8, 2024 08:41:49.074930906 CEST	21	51046	38.11.126.207	192.168.2.16
May 8, 2024 08:41:49.075187922 CEST	21	51105	172.120.235.139	192.168.2.16
May 8, 2024 08:41:49.075253963 CEST	51105	21	192.168.2.16	172.120.235.139
May 8, 2024 08:41:49.075335979 CEST	21	51166	172.120.235.139	192.168.2.16
May 8, 2024 08:41:49.075407982 CEST	51166	21	192.168.2.16	172.120.235.139
May 8, 2024 08:41:49.081868887 CEST	51103	21	192.168.2.16	173.62.166.227
May 8, 2024 08:41:49.083838940 CEST	51104	2121	192.168.2.16	173.62.166.227
May 8, 2024 08:41:49.097877979 CEST	51021	21	192.168.2.16	211.227.4.20
May 8, 2024 08:41:49.113872051 CEST	51106	21	192.168.2.16	171.244.62.79
May 8, 2024 08:41:49.113873959 CEST	51107	2121	192.168.2.16	171.244.62.79
May 8, 2024 08:41:49.145879984 CEST	51110	21	192.168.2.16	67.170.33.55
May 8, 2024 08:41:49.145884037 CEST	51111	2121	192.168.2.16	67.170.33.55
May 8, 2024 08:41:49.145884991 CEST	51112	2121	192.168.2.16	185.237.214.83
May 8, 2024 08:41:49.145901918 CEST	51113	21	192.168.2.16	185.237.214.83
May 8, 2024 08:41:49.161580086 CEST	21	51169	34.149.79.8	192.168.2.16
May 8, 2024 08:41:49.161647081 CEST	51169	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:49.161674023 CEST	21	51157	34.149.79.8	192.168.2.16
May 8, 2024 08:41:49.161870003 CEST	51115	2121	192.168.2.16	210.179.125.116
May 8, 2024 08:41:49.161999941 CEST	51114	21	192.168.2.16	210.179.125.116
May 8, 2024 08:41:49.168078899 CEST	2121	51158	34.149.79.8	192.168.2.16
May 8, 2024 08:41:49.168093920 CEST	2121	51170	34.149.79.8	192.168.2.16
May 8, 2024 08:41:49.168174028 CEST	51170	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:49.193876982 CEST	51118	21	192.168.2.16	81.32.73.103
May 8, 2024 08:41:49.193897009 CEST	51120	2121	192.168.2.16	20.159.153.189
May 8, 2024 08:41:49.193897963 CEST	51121	21	192.168.2.16	20.159.153.189
May 8, 2024 08:41:49.193900108 CEST	51122	21	192.168.2.16	46.206.172.28
May 8, 2024 08:41:49.193902969 CEST	51119	2121	192.168.2.16	81.32.73.103
May 8, 2024 08:41:49.193902969 CEST	51116	21	192.168.2.16	119.113.86.28
May 8, 2024 08:41:49.193914890 CEST	51117	2121	192.168.2.16	119.113.86.28
May 8, 2024 08:41:49.206690073 CEST	21	50938	171.101.231.72	192.168.2.16
May 8, 2024 08:41:49.209846973 CEST	51123	21	192.168.2.16	8.210.19.105
May 8, 2024 08:41:49.209853888 CEST	51125	2121	192.168.2.16	8.210.19.105
May 8, 2024 08:41:49.209958076 CEST	51124	2121	192.168.2.16	46.206.172.28
May 8, 2024 08:41:49.210347891 CEST	51171	2121	192.168.2.16	217.105.64.87
May 8, 2024 08:41:49.225856066 CEST	51126	21	192.168.2.16	189.73.161.99
May 8, 2024 08:41:49.225872040 CEST	51127	2121	192.168.2.16	189.73.161.99
May 8, 2024 08:41:49.226183891 CEST	51172	21	192.168.2.16	76.149.206.244
May 8, 2024 08:41:49.235070944 CEST	21	51133	84.44.255.254	192.168.2.16
May 8, 2024 08:41:49.238786936 CEST	21	51167	84.44.255.254	192.168.2.16
May 8, 2024 08:41:49.238858938 CEST	51167	21	192.168.2.16	84.44.255.254
May 8, 2024 08:41:49.241877079 CEST	51081	2121	192.168.2.16	79.114.76.238
May 8, 2024 08:41:49.241877079 CEST	51129	2121	192.168.2.16	71.227.226.201
May 8, 2024 08:41:49.242006063 CEST	51128	21	192.168.2.16	71.227.226.201
May 8, 2024 08:41:49.243916035 CEST	21	51130	117.223.205.236	192.168.2.16
May 8, 2024 08:41:49.244086027 CEST	51130	21	192.168.2.16	117.223.205.236
May 8, 2024 08:41:49.249690056 CEST	21	51108	175.192.125.189	192.168.2.16
May 8, 2024 08:41:49.251068115 CEST	2121	51109	175.192.125.189	192.168.2.16
May 8, 2024 08:41:49.297910929 CEST	21	51166	172.120.235.139	192.168.2.16
May 8, 2024 08:41:49.298083067 CEST	51166	21	192.168.2.16	172.120.235.139
May 8, 2024 08:41:49.305871964 CEST	51022	2121	192.168.2.16	211.227.4.20
May 8, 2024 08:41:49.306005955 CEST	51148	21	192.168.2.16	39.123.200.22
May 8, 2024 08:41:49.322031021 CEST	51150	2121	192.168.2.16	39.123.200.22
May 8, 2024 08:41:49.322309017 CEST	51173	2121	192.168.2.16	76.149.206.244
May 8, 2024 08:41:49.323800087 CEST	21	51169	34.149.79.8	192.168.2.16
May 8, 2024 08:41:49.323879004 CEST	51169	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:49.323952913 CEST	51169	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:49.324120045 CEST	51174	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:49.330705881 CEST	2121	51170	34.149.79.8	192.168.2.16
May 8, 2024 08:41:49.330763102 CEST	51170	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:49.330988884 CEST	51170	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:49.331314087 CEST	51175	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:49.332110882 CEST	21	51132	91.146.97.65	192.168.2.16
May 8, 2024 08:41:49.332678080 CEST	21	51132	91.146.97.65	192.168.2.16
May 8, 2024 08:41:49.332833052 CEST	51132	21	192.168.2.16	91.146.97.65
May 8, 2024 08:41:49.337899923 CEST	51084	21	192.168.2.16	154.221.211.247
May 8, 2024 08:41:49.338140011 CEST	51176	21	192.168.2.16	58.224.17.46
May 8, 2024 08:41:49.353883982 CEST	51028	2121	192.168.2.16	190.182.171.153
May 8, 2024 08:41:49.353913069 CEST	51027	21	192.168.2.16	190.182.171.153
May 8, 2024 08:41:49.369852066 CEST	51031	2121	192.168.2.16	151.227.254.168
May 8, 2024 08:41:49.369885921 CEST	51102	2121	192.168.2.16	182.91.23.226
May 8, 2024 08:41:49.385854959 CEST	51101	21	192.168.2.16	182.91.23.226
May 8, 2024 08:41:49.385876894 CEST	51032	21	192.168.2.16	151.227.254.168
May 8, 2024 08:41:49.385881901 CEST	51033	21	192.168.2.16	182.85.216.105
May 8, 2024 08:41:49.394784927 CEST	21	51094	196.210.0.111	192.168.2.16
May 8, 2024 08:41:49.400621891 CEST	21	51131	171.244.37.116	192.168.2.16
May 8, 2024 08:41:49.400857925 CEST	51131	21	192.168.2.16	171.244.37.116
May 8, 2024 08:41:49.401874065 CEST	51138	21	192.168.2.16	106.32.191.166
May 8, 2024 08:41:49.401905060 CEST	51140	2121	192.168.2.16	106.32.191.166
May 8, 2024 08:41:49.401905060 CEST	51139	21	192.168.2.16	110.66.7.129
May 8, 2024 08:41:49.406661987 CEST	21	51094	196.210.0.111	192.168.2.16
May 8, 2024 08:41:49.406853914 CEST	51094	21	192.168.2.16	196.210.0.111
May 8, 2024 08:41:49.408536911 CEST	21	51021	211.227.4.20	192.168.2.16
May 8, 2024 08:41:49.417879105 CEST	51141	2121	192.168.2.16	110.66.7.129
May 8, 2024 08:41:49.418006897 CEST	51052	21	192.168.2.16	156.253.134.40
May 8, 2024 08:41:49.432893991 CEST	51053	2121	192.168.2.16	156.253.134.40
May 8, 2024 08:41:49.433005095 CEST	51087	2121	192.168.2.16	154.221.211.247
May 8, 2024 08:41:49.433459044 CEST	51177	2121	192.168.2.16	58.224.17.46
May 8, 2024 08:41:49.433504105 CEST	51178	21	192.168.2.16	51.211.40.188
May 8, 2024 08:41:49.444067001 CEST	2121	50939	171.101.231.72	192.168.2.16
May 8, 2024 08:41:49.447882891 CEST	51142	2121	192.168.2.16	84.0.119.169
May 8, 2024 08:41:49.447889090 CEST	51143	21	192.168.2.16	84.0.119.169
May 8, 2024 08:41:49.459794044 CEST	2121	51030	223.70.202.42	192.168.2.16
May 8, 2024 08:41:49.463846922 CEST	51147	2121	192.168.2.16	136.52.110.227
May 8, 2024 08:41:49.463870049 CEST	51146	21	192.168.2.16	136.52.110.227
May 8, 2024 08:41:49.464381933 CEST	51179	2121	192.168.2.16	51.211.40.188
May 8, 2024 08:41:49.479887009 CEST	21	51166	172.120.235.139	192.168.2.16
May 8, 2024 08:41:49.480192900 CEST	21	51166	172.120.235.139	192.168.2.16
May 8, 2024 08:41:49.480357885 CEST	51166	21	192.168.2.16	172.120.235.139
May 8, 2024 08:41:49.485497952 CEST	2121	51124	46.206.172.28	192.168.2.16
May 8, 2024 08:41:49.486098051 CEST	21	51169	34.149.79.8	192.168.2.16
May 8, 2024 08:41:49.486289024 CEST	21	51174	34.149.79.8	192.168.2.16
May 8, 2024 08:41:49.486366034 CEST	51174	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:49.493386030 CEST	2121	51170	34.149.79.8	192.168.2.16
May 8, 2024 08:41:49.493757010 CEST	2121	51175	34.149.79.8	192.168.2.16
May 8, 2024 08:41:49.493818998 CEST	51175	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:49.495850086 CEST	51029	21	192.168.2.16	223.70.202.42
May 8, 2024 08:41:49.496182919 CEST	51180	21	192.168.2.16	80.235.152.252
May 8, 2024 08:41:49.511878967 CEST	51149	21	192.168.2.16	207.181.250.221
May 8, 2024 08:41:49.527870893 CEST	51151	2121	192.168.2.16	207.181.250.221
May 8, 2024 08:41:49.536870003 CEST	51152	21	192.168.2.16	130.149.110.200
May 8, 2024 08:41:49.543905020 CEST	51153	2121	192.168.2.16	130.149.110.200
May 8, 2024 08:41:49.543905020 CEST	51159	2121	192.168.2.16	38.44.32.116
May 8, 2024 08:41:49.544996023 CEST	51181	2121	192.168.2.16	80.235.152.252
May 8, 2024 08:41:49.545006037 CEST	51182	21	192.168.2.16	96.7.39.144
May 8, 2024 08:41:49.545092106 CEST	51183	2121	192.168.2.16	96.7.39.144
May 8, 2024 08:41:49.545125008 CEST	51184	21	192.168.2.16	71.240.203.49
May 8, 2024 08:41:49.545295000 CEST	51185	2121	192.168.2.16	71.240.203.49
May 8, 2024 08:41:49.545393944 CEST	51186	21	192.168.2.16	122.183.172.200
May 8, 2024 08:41:49.545406103 CEST	51187	2121	192.168.2.16	122.183.172.200
May 8, 2024 08:41:49.545406103 CEST	51188	21	192.168.2.16	94.5.216.180
May 8, 2024 08:41:49.558305979 CEST	21	51167	84.44.255.254	192.168.2.16
May 8, 2024 08:41:49.558398008 CEST	51167	21	192.168.2.16	84.44.255.254
May 8, 2024 08:41:49.558456898 CEST	51167	21	192.168.2.16	84.44.255.254
May 8, 2024 08:41:49.558687925 CEST	51189	21	192.168.2.16	84.44.255.254
May 8, 2024 08:41:49.559894085 CEST	51037	2121	192.168.2.16	182.85.216.105
May 8, 2024 08:41:49.559905052 CEST	51155	2121	192.168.2.16	195.201.94.23
May 8, 2024 08:41:49.559917927 CEST	51154	21	192.168.2.16	195.201.94.23
May 8, 2024 08:41:49.560177088 CEST	51047	2121	192.168.2.16	38.11.126.207
May 8, 2024 08:41:49.560705900 CEST	51190	2121	192.168.2.16	104.81.109.177
May 8, 2024 08:41:49.560762882 CEST	51191	2121	192.168.2.16	94.5.216.180
May 8, 2024 08:41:49.560818911 CEST	51192	21	192.168.2.16	38.86.75.247
May 8, 2024 08:41:49.560884953 CEST	51193	2121	192.168.2.16	38.86.75.247
May 8, 2024 08:41:49.560910940 CEST	51194	21	192.168.2.16	104.81.109.177
May 8, 2024 08:41:49.561085939 CEST	51195	21	192.168.2.16	70.72.201.17
May 8, 2024 08:41:49.561110973 CEST	51196	2121	192.168.2.16	70.72.201.17
May 8, 2024 08:41:49.575895071 CEST	51046	21	192.168.2.16	38.11.126.207
May 8, 2024 08:41:49.575917959 CEST	51025	21	192.168.2.16	126.55.78.106
May 8, 2024 08:41:49.575918913 CEST	51026	2121	192.168.2.16	126.55.78.106
May 8, 2024 08:41:49.577157974 CEST	51197	21	192.168.2.16	79.82.134.13
May 8, 2024 08:41:49.577171087 CEST	51198	2121	192.168.2.16	79.82.134.13
May 8, 2024 08:41:49.577306032 CEST	51199	21	192.168.2.16	93.42.72.190
May 8, 2024 08:41:49.577485085 CEST	51200	2121	192.168.2.16	93.42.72.190
May 8, 2024 08:41:49.577523947 CEST	51201	21	192.168.2.16	77.81.30.198
May 8, 2024 08:41:49.577605009 CEST	51202	2121	192.168.2.16	77.81.30.198
May 8, 2024 08:41:49.577694893 CEST	51203	21	192.168.2.16	47.161.35.149
May 8, 2024 08:41:49.577817917 CEST	51204	2121	192.168.2.16	47.161.35.149
May 8, 2024 08:41:49.578121901 CEST	2121	51081	79.114.76.238	192.168.2.16
May 8, 2024 08:41:49.592624903 CEST	51205	21	192.168.2.16	207.178.68.216
May 8, 2024 08:41:49.592679977 CEST	51206	2121	192.168.2.16	207.178.68.216
May 8, 2024 08:41:49.592694044 CEST	51207	21	192.168.2.16	178.184.188.200
May 8, 2024 08:41:49.592797041 CEST	51208	2121	192.168.2.16	178.184.188.200
May 8, 2024 08:41:49.592901945 CEST	51210	2121	192.168.2.16	59.28.241.113
May 8, 2024 08:41:49.592905998 CEST	51209	21	192.168.2.16	59.28.241.113
May 8, 2024 08:41:49.592962027 CEST	51211	21	192.168.2.16	161.81.19.198
May 8, 2024 08:41:49.609105110 CEST	51212	2121	192.168.2.16	161.81.19.198
May 8, 2024 08:41:49.609236956 CEST	51214	2121	192.168.2.16	79.11.173.175
May 8, 2024 08:41:49.609247923 CEST	51213	21	192.168.2.16	79.11.173.175
May 8, 2024 08:41:49.609262943 CEST	51215	21	192.168.2.16	189.250.118.186
May 8, 2024 08:41:49.609317064 CEST	51216	21	192.168.2.16	118.221.226.56
May 8, 2024 08:41:49.609390974 CEST	51218	2121	192.168.2.16	118.221.226.56
May 8, 2024 08:41:49.609467983 CEST	51217	2121	192.168.2.16	189.250.118.186
May 8, 2024 08:41:49.609472990 CEST	51219	21	192.168.2.16	87.200.130.103
May 8, 2024 08:41:49.609550953 CEST	51220	21	192.168.2.16	129.247.240.147
May 8, 2024 08:41:49.609615088 CEST	51222	2121	192.168.2.16	129.247.240.147
May 8, 2024 08:41:49.609632969 CEST	51221	2121	192.168.2.16	87.200.130.103
May 8, 2024 08:41:49.609725952 CEST	51223	21	192.168.2.16	188.81.130.104
May 8, 2024 08:41:49.609744072 CEST	51224	2121	192.168.2.16	188.81.130.104
May 8, 2024 08:41:49.615240097 CEST	21	51148	39.123.200.22	192.168.2.16
May 8, 2024 08:41:49.623187065 CEST	2121	51022	211.227.4.20	192.168.2.16
May 8, 2024 08:41:49.623559952 CEST	51225	21	192.168.2.16	106.54.232.65
May 8, 2024 08:41:49.623893023 CEST	51156	21	192.168.2.16	38.44.32.116
May 8, 2024 08:41:49.624636889 CEST	51226	21	192.168.2.16	172.89.73.92
May 8, 2024 08:41:49.624687910 CEST	51227	2121	192.168.2.16	172.89.73.92
May 8, 2024 08:41:49.624784946 CEST	51228	21	192.168.2.16	201.138.118.97
May 8, 2024 08:41:49.624818087 CEST	51230	2121	192.168.2.16	201.138.118.97
May 8, 2024 08:41:49.624859095 CEST	51229	2121	192.168.2.16	106.54.232.65
May 8, 2024 08:41:49.624881983 CEST	51231	21	192.168.2.16	94.7.190.193
May 8, 2024 08:41:49.624955893 CEST	51233	21	192.168.2.16	118.35.206.171
May 8, 2024 08:41:49.624958992 CEST	51232	2121	192.168.2.16	94.7.190.193
May 8, 2024 08:41:49.627751112 CEST	2121	51150	39.123.200.22	192.168.2.16
May 8, 2024 08:41:49.640265942 CEST	51234	2121	192.168.2.16	118.35.206.171
May 8, 2024 08:41:49.640309095 CEST	51235	21	192.168.2.16	27.219.156.111
May 8, 2024 08:41:49.640403032 CEST	51236	2121	192.168.2.16	27.219.156.111
May 8, 2024 08:41:49.648644924 CEST	21	51174	34.149.79.8	192.168.2.16
May 8, 2024 08:41:49.648719072 CEST	51174	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:49.648819923 CEST	51174	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:49.648999929 CEST	51237	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:49.656296968 CEST	2121	51175	34.149.79.8	192.168.2.16
May 8, 2024 08:41:49.656359911 CEST	51175	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:49.656435966 CEST	51175	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:49.656655073 CEST	51238	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:49.664025068 CEST	21	51084	154.221.211.247	192.168.2.16
May 8, 2024 08:41:49.679316044 CEST	21	51132	91.146.97.65	192.168.2.16
May 8, 2024 08:41:49.679465055 CEST	51132	21	192.168.2.16	91.146.97.65
May 8, 2024 08:41:49.679701090 CEST	51239	21	192.168.2.16	91.146.97.65
May 8, 2024 08:41:49.690990925 CEST	21	51166	172.120.235.139	192.168.2.16
May 8, 2024 08:41:49.691132069 CEST	51166	21	192.168.2.16	172.120.235.139
May 8, 2024 08:41:49.691418886 CEST	51240	21	192.168.2.16	172.120.235.139
May 8, 2024 08:41:49.703871012 CEST	51038	21	192.168.2.16	89.99.154.153
May 8, 2024 08:41:49.717164993 CEST	21	51052	156.253.134.40	192.168.2.16
May 8, 2024 08:41:49.720252991 CEST	51241	21	192.168.2.16	50.193.20.246
May 8, 2024 08:41:49.723412991 CEST	21	51130	117.223.205.236	192.168.2.16
May 8, 2024 08:41:49.723506927 CEST	21	51130	117.223.205.236	192.168.2.16
May 8, 2024 08:41:49.723678112 CEST	51130	21	192.168.2.16	117.223.205.236
May 8, 2024 08:41:49.731719017 CEST	2121	51053	156.253.134.40	192.168.2.16
May 8, 2024 08:41:49.744210005 CEST	2121	51047	38.11.126.207	192.168.2.16
May 8, 2024 08:41:49.744848967 CEST	51242	2121	192.168.2.16	50.193.20.246
May 8, 2024 08:41:49.751883984 CEST	51108	21	192.168.2.16	175.192.125.189
May 8, 2024 08:41:49.751883984 CEST	51041	2121	192.168.2.16	89.99.154.153
May 8, 2024 08:41:49.752301931 CEST	51109	2121	192.168.2.16	175.192.125.189
May 8, 2024 08:41:49.762728930 CEST	2121	51087	154.221.211.247	192.168.2.16
May 8, 2024 08:41:49.763138056 CEST	21	51046	38.11.126.207	192.168.2.16
May 8, 2024 08:41:49.763631105 CEST	51243	21	192.168.2.16	27.9.54.22
May 8, 2024 08:41:49.767865896 CEST	51042	21	192.168.2.16	20.72.193.177
May 8, 2024 08:41:49.773374081 CEST	21	51131	171.244.37.116	192.168.2.16
May 8, 2024 08:41:49.773519039 CEST	51131	21	192.168.2.16	171.244.37.116
May 8, 2024 08:41:49.773760080 CEST	51244	21	192.168.2.16	171.244.37.116
May 8, 2024 08:41:49.782258987 CEST	2121	51193	38.86.75.247	192.168.2.16
May 8, 2024 08:41:49.782471895 CEST	21	51192	38.86.75.247	192.168.2.16
May 8, 2024 08:41:49.783847094 CEST	51160	21	192.168.2.16	104.87.220.107
May 8, 2024 08:41:49.783904076 CEST	51161	2121	192.168.2.16	104.87.220.107
May 8, 2024 08:41:49.786839008 CEST	51043	2121	192.168.2.16	20.72.193.177
May 8, 2024 08:41:49.799851894 CEST	51164	21	192.168.2.16	73.75.96.175
May 8, 2024 08:41:49.799868107 CEST	51044	21	192.168.2.16	36.57.161.108
May 8, 2024 08:41:49.799880981 CEST	51163	2121	192.168.2.16	184.67.80.145
May 8, 2024 08:41:49.802841902 CEST	51162	21	192.168.2.16	184.67.80.145
May 8, 2024 08:41:49.811928988 CEST	21	51174	34.149.79.8	192.168.2.16
May 8, 2024 08:41:49.811942101 CEST	21	51237	34.149.79.8	192.168.2.16
May 8, 2024 08:41:49.812057018 CEST	51237	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:49.815849066 CEST	51045	2121	192.168.2.16	36.57.161.108
May 8, 2024 08:41:49.817137003 CEST	2121	51159	38.44.32.116	192.168.2.16
May 8, 2024 08:41:49.818882942 CEST	2121	51175	34.149.79.8	192.168.2.16
May 8, 2024 08:41:49.818967104 CEST	2121	51238	34.149.79.8	192.168.2.16
May 8, 2024 08:41:49.819031954 CEST	51238	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:49.831878901 CEST	51165	2121	192.168.2.16	73.75.96.175
May 8, 2024 08:41:49.841222048 CEST	21	51122	46.206.172.28	192.168.2.16
May 8, 2024 08:41:49.863671064 CEST	2121	51179	51.211.40.188	192.168.2.16
May 8, 2024 08:41:49.863914013 CEST	51048	21	192.168.2.16	90.218.110.249
May 8, 2024 08:41:49.872914076 CEST	21	51166	172.120.235.139	192.168.2.16
May 8, 2024 08:41:49.872972965 CEST	51166	21	192.168.2.16	172.120.235.139
May 8, 2024 08:41:49.873095989 CEST	21	51240	172.120.235.139	192.168.2.16
May 8, 2024 08:41:49.873159885 CEST	51240	21	192.168.2.16	172.120.235.139
May 8, 2024 08:41:49.878668070 CEST	21	51167	84.44.255.254	192.168.2.16
May 8, 2024 08:41:49.878873110 CEST	21	51189	84.44.255.254	192.168.2.16
May 8, 2024 08:41:49.878942966 CEST	51189	21	192.168.2.16	84.44.255.254
May 8, 2024 08:41:49.881069899 CEST	21	51025	126.55.78.106	192.168.2.16
May 8, 2024 08:41:49.881083012 CEST	2121	51026	126.55.78.106	192.168.2.16
May 8, 2024 08:41:49.881628036 CEST	51245	21	192.168.2.16	73.44.53.187
May 8, 2024 08:41:49.881690979 CEST	51246	2121	192.168.2.16	27.9.54.22
May 8, 2024 08:41:49.896337032 CEST	51247	21	192.168.2.16	170.79.73.98
May 8, 2024 08:41:49.896357059 CEST	51248	2121	192.168.2.16	73.44.53.187
May 8, 2024 08:41:49.904975891 CEST	2121	51210	59.28.241.113	192.168.2.16
May 8, 2024 08:41:49.909184933 CEST	21	51209	59.28.241.113	192.168.2.16
May 8, 2024 08:41:49.924071074 CEST	21	51094	196.210.0.111	192.168.2.16
May 8, 2024 08:41:49.926675081 CEST	21	51201	77.81.30.198	192.168.2.16
May 8, 2024 08:41:49.926709890 CEST	2121	51202	77.81.30.198	192.168.2.16
May 8, 2024 08:41:49.926883936 CEST	51049	2121	192.168.2.16	90.218.110.249
May 8, 2024 08:41:49.939093113 CEST	21	51233	118.35.206.171	192.168.2.16
May 8, 2024 08:41:49.949467897 CEST	21	51213	79.11.173.175	192.168.2.16
May 8, 2024 08:41:49.953248024 CEST	2121	51214	79.11.173.175	192.168.2.16
May 8, 2024 08:41:49.958910942 CEST	51050	21	192.168.2.16	52.154.218.62
May 8, 2024 08:41:49.958966017 CEST	2121	51234	118.35.206.171	192.168.2.16
May 8, 2024 08:41:49.973862886 CEST	51030	2121	192.168.2.16	223.70.202.42
May 8, 2024 08:41:49.974210024 CEST	21	51237	34.149.79.8	192.168.2.16
May 8, 2024 08:41:49.974397898 CEST	51237	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:49.974431992 CEST	51237	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:49.974724054 CEST	51249	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:49.974853039 CEST	51051	2121	192.168.2.16	52.154.218.62
May 8, 2024 08:41:49.981549978 CEST	2121	51238	34.149.79.8	192.168.2.16
May 8, 2024 08:41:49.981606007 CEST	51238	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:49.981781006 CEST	51238	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:49.982094049 CEST	51250	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:49.989872932 CEST	51124	2121	192.168.2.16	46.206.172.28
May 8, 2024 08:41:49.989878893 CEST	51168	21	192.168.2.16	217.105.64.87
May 8, 2024 08:41:50.005883932 CEST	51054	21	192.168.2.16	36.159.115.27
May 8, 2024 08:41:50.014939070 CEST	21	51239	91.146.97.65	192.168.2.16
May 8, 2024 08:41:50.015029907 CEST	51239	21	192.168.2.16	91.146.97.65
May 8, 2024 08:41:50.020365000 CEST	21	51132	91.146.97.65	192.168.2.16
May 8, 2024 08:41:50.020422935 CEST	51132	21	192.168.2.16	91.146.97.65
May 8, 2024 08:41:50.032800913 CEST	21	51029	223.70.202.42	192.168.2.16
May 8, 2024 08:41:50.037870884 CEST	51056	2121	192.168.2.16	36.159.115.27
May 8, 2024 08:41:50.037893057 CEST	51055	21	192.168.2.16	95.229.68.24
May 8, 2024 08:41:50.053864956 CEST	51059	2121	192.168.2.16	95.229.68.24
May 8, 2024 08:41:50.063730955 CEST	21	51108	175.192.125.189	192.168.2.16
May 8, 2024 08:41:50.066118002 CEST	2121	51109	175.192.125.189	192.168.2.16
May 8, 2024 08:41:50.070317030 CEST	51251	2121	192.168.2.16	170.79.73.98
May 8, 2024 08:41:50.085918903 CEST	51081	2121	192.168.2.16	79.114.76.238
May 8, 2024 08:41:50.097735882 CEST	21	51240	172.120.235.139	192.168.2.16
May 8, 2024 08:41:50.097943068 CEST	51240	21	192.168.2.16	172.120.235.139
May 8, 2024 08:41:50.117899895 CEST	51148	21	192.168.2.16	39.123.200.22
May 8, 2024 08:41:50.120560884 CEST	21	51244	171.244.37.116	192.168.2.16
May 8, 2024 08:41:50.120632887 CEST	51244	21	192.168.2.16	171.244.37.116
May 8, 2024 08:41:50.133867979 CEST	51150	2121	192.168.2.16	39.123.200.22
May 8, 2024 08:41:50.137029886 CEST	21	51249	34.149.79.8	192.168.2.16
May 8, 2024 08:41:50.137139082 CEST	51249	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:50.144104004 CEST	2121	51238	34.149.79.8	192.168.2.16
May 8, 2024 08:41:50.144292116 CEST	21	51131	171.244.37.116	192.168.2.16
May 8, 2024 08:41:50.144304037 CEST	21	51131	171.244.37.116	192.168.2.16
May 8, 2024 08:41:50.144340038 CEST	51131	21	192.168.2.16	171.244.37.116
May 8, 2024 08:41:50.144496918 CEST	2121	51250	34.149.79.8	192.168.2.16
May 8, 2024 08:41:50.144555092 CEST	51250	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:50.165854931 CEST	51084	21	192.168.2.16	154.221.211.247
May 8, 2024 08:41:50.180088043 CEST	2121	51102	182.91.23.226	192.168.2.16
May 8, 2024 08:41:50.196585894 CEST	21	51101	182.91.23.226	192.168.2.16
May 8, 2024 08:41:50.198569059 CEST	21	51189	84.44.255.254	192.168.2.16
May 8, 2024 08:41:50.198637962 CEST	51189	21	192.168.2.16	84.44.255.254
May 8, 2024 08:41:50.198779106 CEST	51189	21	192.168.2.16	84.44.255.254
May 8, 2024 08:41:50.199100018 CEST	51252	21	192.168.2.16	84.44.255.254
May 8, 2024 08:41:50.212872028 CEST	51171	2121	192.168.2.16	217.105.64.87
May 8, 2024 08:41:50.220951080 CEST	21	51130	117.223.205.236	192.168.2.16
May 8, 2024 08:41:50.228856087 CEST	51052	21	192.168.2.16	156.253.134.40
May 8, 2024 08:41:50.228873968 CEST	51172	21	192.168.2.16	76.149.206.244
May 8, 2024 08:41:50.244858027 CEST	51062	2121	192.168.2.16	210.223.76.199
May 8, 2024 08:41:50.244889975 CEST	51053	2121	192.168.2.16	156.253.134.40
May 8, 2024 08:41:50.244900942 CEST	51061	21	192.168.2.16	210.223.76.199
May 8, 2024 08:41:50.245556116 CEST	51253	21	192.168.2.16	34.160.4.184
May 8, 2024 08:41:50.245779991 CEST	51254	2121	192.168.2.16	34.160.4.184
May 8, 2024 08:41:50.260874987 CEST	51063	21	192.168.2.16	101.114.64.62
May 8, 2024 08:41:50.276887894 CEST	51087	2121	192.168.2.16	154.221.211.247
May 8, 2024 08:41:50.276889086 CEST	51064	2121	192.168.2.16	101.114.64.62
May 8, 2024 08:41:50.276889086 CEST	51065	21	192.168.2.16	105.72.45.95
May 8, 2024 08:41:50.279654980 CEST	21	51240	172.120.235.139	192.168.2.16
May 8, 2024 08:41:50.279934883 CEST	21	51240	172.120.235.139	192.168.2.16
May 8, 2024 08:41:50.280129910 CEST	51240	21	192.168.2.16	172.120.235.139
May 8, 2024 08:41:50.292872906 CEST	51193	2121	192.168.2.16	38.86.75.247
May 8, 2024 08:41:50.292906046 CEST	51192	21	192.168.2.16	38.86.75.247
May 8, 2024 08:41:50.293463945 CEST	51066	2121	192.168.2.16	105.72.45.95
May 8, 2024 08:41:50.299443960 CEST	21	51249	34.149.79.8	192.168.2.16
May 8, 2024 08:41:50.299508095 CEST	51249	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:50.299595118 CEST	51249	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:50.299834013 CEST	51255	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:50.307060003 CEST	2121	51250	34.149.79.8	192.168.2.16
May 8, 2024 08:41:50.307115078 CEST	51250	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:50.307267904 CEST	51250	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:50.307964087 CEST	51256	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:50.309102058 CEST	51257	21	192.168.2.16	120.24.160.35
May 8, 2024 08:41:50.324856043 CEST	51068	21	192.168.2.16	222.248.7.195
May 8, 2024 08:41:50.324879885 CEST	51159	2121	192.168.2.16	38.44.32.116
May 8, 2024 08:41:50.324888945 CEST	51173	2121	192.168.2.16	76.149.206.244
May 8, 2024 08:41:50.340872049 CEST	51176	21	192.168.2.16	58.224.17.46
May 8, 2024 08:41:50.356863022 CEST	51069	2121	192.168.2.16	222.248.7.195
May 8, 2024 08:41:50.356882095 CEST	51122	21	192.168.2.16	46.206.172.28
May 8, 2024 08:41:50.368571997 CEST	2121	51030	223.70.202.42	192.168.2.16
May 8, 2024 08:41:50.372845888 CEST	51179	2121	192.168.2.16	51.211.40.188
May 8, 2024 08:41:50.372873068 CEST	51070	21	192.168.2.16	18.67.79.85
May 8, 2024 08:41:50.373152018 CEST	21	51239	91.146.97.65	192.168.2.16
May 8, 2024 08:41:50.373368979 CEST	51239	21	192.168.2.16	91.146.97.65
May 8, 2024 08:41:50.388497114 CEST	51258	2121	192.168.2.16	120.24.160.35
May 8, 2024 08:41:50.388566971 CEST	51259	2121	192.168.2.16	223.239.97.194
May 8, 2024 08:41:50.388612032 CEST	51260	21	192.168.2.16	223.239.97.194
May 8, 2024 08:41:50.403876066 CEST	51073	2121	192.168.2.16	18.67.79.85
May 8, 2024 08:41:50.419857979 CEST	51074	21	192.168.2.16	78.17.146.253
May 8, 2024 08:41:50.419872999 CEST	51209	21	192.168.2.16	59.28.241.113
May 8, 2024 08:41:50.419897079 CEST	51210	2121	192.168.2.16	59.28.241.113
May 8, 2024 08:41:50.419902086 CEST	51076	21	192.168.2.16	23.207.91.110
May 8, 2024 08:41:50.419918060 CEST	51075	2121	192.168.2.16	78.17.146.253
May 8, 2024 08:41:50.422552109 CEST	2121	51081	79.114.76.238	192.168.2.16
May 8, 2024 08:41:50.427211046 CEST	21	51148	39.123.200.22	192.168.2.16
May 8, 2024 08:41:50.435848951 CEST	51202	2121	192.168.2.16	77.81.30.198
May 8, 2024 08:41:50.435882092 CEST	51178	21	192.168.2.16	51.211.40.188
May 8, 2024 08:41:50.435882092 CEST	51201	21	192.168.2.16	77.81.30.198
May 8, 2024 08:41:50.435904980 CEST	51177	2121	192.168.2.16	58.224.17.46
May 8, 2024 08:41:50.439709902 CEST	2121	51150	39.123.200.22	192.168.2.16
May 8, 2024 08:41:50.451848984 CEST	51077	2121	192.168.2.16	23.207.91.110
May 8, 2024 08:41:50.451853991 CEST	51233	21	192.168.2.16	118.35.206.171
May 8, 2024 08:41:50.451864004 CEST	51213	21	192.168.2.16	79.11.173.175
May 8, 2024 08:41:50.451864004 CEST	51237	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:50.461669922 CEST	21	51249	34.149.79.8	192.168.2.16
May 8, 2024 08:41:50.462137938 CEST	21	51255	34.149.79.8	192.168.2.16
May 8, 2024 08:41:50.462213993 CEST	51255	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:50.467237949 CEST	21	51244	171.244.37.116	192.168.2.16
May 8, 2024 08:41:50.467392921 CEST	51244	21	192.168.2.16	171.244.37.116
May 8, 2024 08:41:50.467853069 CEST	51214	2121	192.168.2.16	79.11.173.175
May 8, 2024 08:41:50.467854023 CEST	51234	2121	192.168.2.16	118.35.206.171
May 8, 2024 08:41:50.469638109 CEST	2121	51250	34.149.79.8	192.168.2.16
May 8, 2024 08:41:50.470330000 CEST	2121	51256	34.149.79.8	192.168.2.16
May 8, 2024 08:41:50.470386982 CEST	51256	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:50.488953114 CEST	21	51240	172.120.235.139	192.168.2.16
May 8, 2024 08:41:50.489063025 CEST	51240	21	192.168.2.16	172.120.235.139
May 8, 2024 08:41:50.489272118 CEST	51261	21	192.168.2.16	172.120.235.139
May 8, 2024 08:41:50.493997097 CEST	21	51084	154.221.211.247	192.168.2.16
May 8, 2024 08:41:50.498565912 CEST	2121	51124	46.206.172.28	192.168.2.16
May 8, 2024 08:41:50.499871016 CEST	51180	21	192.168.2.16	80.235.152.252
May 8, 2024 08:41:50.512801886 CEST	2121	51193	38.86.75.247	192.168.2.16
May 8, 2024 08:41:50.513178110 CEST	21	51192	38.86.75.247	192.168.2.16
May 8, 2024 08:41:50.515109062 CEST	21	51252	84.44.255.254	192.168.2.16
May 8, 2024 08:41:50.515176058 CEST	51252	21	192.168.2.16	84.44.255.254
May 8, 2024 08:41:50.518340111 CEST	21	51189	84.44.255.254	192.168.2.16
May 8, 2024 08:41:50.527719021 CEST	21	51052	156.253.134.40	192.168.2.16
May 8, 2024 08:41:50.530868053 CEST	51079	21	192.168.2.16	68.134.194.220
May 8, 2024 08:41:50.530870914 CEST	51078	2121	192.168.2.16	68.134.194.220
May 8, 2024 08:41:50.543553114 CEST	2121	51053	156.253.134.40	192.168.2.16
May 8, 2024 08:41:50.543984890 CEST	51262	21	192.168.2.16	72.201.18.23
May 8, 2024 08:41:50.545845985 CEST	51029	21	192.168.2.16	223.70.202.42
May 8, 2024 08:41:50.545870066 CEST	51182	21	192.168.2.16	96.7.39.144
May 8, 2024 08:41:50.545881987 CEST	51187	2121	192.168.2.16	122.183.172.200
May 8, 2024 08:41:50.545886040 CEST	51185	2121	192.168.2.16	71.240.203.49
May 8, 2024 08:41:50.545962095 CEST	51188	21	192.168.2.16	94.5.216.180
May 8, 2024 08:41:50.546225071 CEST	51263	2121	192.168.2.16	72.201.18.23
May 8, 2024 08:41:50.560873985 CEST	51181	2121	192.168.2.16	80.235.152.252
May 8, 2024 08:41:50.560873985 CEST	51191	2121	192.168.2.16	94.5.216.180
May 8, 2024 08:41:50.560888052 CEST	51186	21	192.168.2.16	122.183.172.200
May 8, 2024 08:41:50.560894012 CEST	51184	21	192.168.2.16	71.240.203.49
May 8, 2024 08:41:50.560899973 CEST	51183	2121	192.168.2.16	96.7.39.144
May 8, 2024 08:41:50.561206102 CEST	51080	21	192.168.2.16	79.114.76.238
May 8, 2024 08:41:50.561207056 CEST	51190	2121	192.168.2.16	104.81.109.177
May 8, 2024 08:41:50.575850010 CEST	51196	2121	192.168.2.16	70.72.201.17
May 8, 2024 08:41:50.575850010 CEST	51195	21	192.168.2.16	70.72.201.17
May 8, 2024 08:41:50.575851917 CEST	51194	21	192.168.2.16	104.81.109.177
May 8, 2024 08:41:50.575860977 CEST	51108	21	192.168.2.16	175.192.125.189
May 8, 2024 08:41:50.575860977 CEST	51109	2121	192.168.2.16	175.192.125.189
May 8, 2024 08:41:50.591846943 CEST	51197	21	192.168.2.16	79.82.134.13
May 8, 2024 08:41:50.591847897 CEST	51204	2121	192.168.2.16	47.161.35.149
May 8, 2024 08:41:50.591861963 CEST	51200	2121	192.168.2.16	93.42.72.190
May 8, 2024 08:41:50.591866016 CEST	51203	21	192.168.2.16	47.161.35.149
May 8, 2024 08:41:50.591866970 CEST	51205	21	192.168.2.16	207.178.68.216
May 8, 2024 08:41:50.591866970 CEST	51207	21	192.168.2.16	178.184.188.200
May 8, 2024 08:41:50.596657991 CEST	2121	51159	38.44.32.116	192.168.2.16
May 8, 2024 08:41:50.598480940 CEST	51198	2121	192.168.2.16	79.82.134.13
May 8, 2024 08:41:50.598480940 CEST	51199	21	192.168.2.16	93.42.72.190
May 8, 2024 08:41:50.598500013 CEST	51208	2121	192.168.2.16	178.184.188.200
May 8, 2024 08:41:50.598504066 CEST	51206	2121	192.168.2.16	207.178.68.216
May 8, 2024 08:41:50.598525047 CEST	51211	21	192.168.2.16	161.81.19.198
May 8, 2024 08:41:50.606383085 CEST	2121	51087	154.221.211.247	192.168.2.16
May 8, 2024 08:41:50.614063025 CEST	21	51237	34.149.79.8	192.168.2.16
May 8, 2024 08:41:50.623859882 CEST	51215	21	192.168.2.16	189.250.118.186
May 8, 2024 08:41:50.623859882 CEST	51218	2121	192.168.2.16	118.221.226.56
May 8, 2024 08:41:50.623859882 CEST	51216	21	192.168.2.16	118.221.226.56
May 8, 2024 08:41:50.623859882 CEST	51212	2121	192.168.2.16	161.81.19.198
May 8, 2024 08:41:50.623882055 CEST	51230	2121	192.168.2.16	201.138.118.97
May 8, 2024 08:41:50.623883009 CEST	51225	21	192.168.2.16	106.54.232.65
May 8, 2024 08:41:50.623884916 CEST	51082	2121	192.168.2.16	39.118.206.166
May 8, 2024 08:41:50.623886108 CEST	51220	21	192.168.2.16	129.247.240.147
May 8, 2024 08:41:50.623887062 CEST	51222	2121	192.168.2.16	129.247.240.147
May 8, 2024 08:41:50.623887062 CEST	51223	21	192.168.2.16	188.81.130.104
May 8, 2024 08:41:50.623887062 CEST	51227	2121	192.168.2.16	172.89.73.92
May 8, 2024 08:41:50.623891115 CEST	51226	21	192.168.2.16	172.89.73.92
May 8, 2024 08:41:50.623891115 CEST	51217	2121	192.168.2.16	189.250.118.186
May 8, 2024 08:41:50.623891115 CEST	51219	21	192.168.2.16	87.200.130.103
May 8, 2024 08:41:50.623933077 CEST	51083	21	192.168.2.16	39.118.206.166
May 8, 2024 08:41:50.623934984 CEST	51228	21	192.168.2.16	201.138.118.97
May 8, 2024 08:41:50.623935938 CEST	51224	2121	192.168.2.16	188.81.130.104
May 8, 2024 08:41:50.623935938 CEST	51221	2121	192.168.2.16	87.200.130.103
May 8, 2024 08:41:50.624988079 CEST	21	51255	34.149.79.8	192.168.2.16
May 8, 2024 08:41:50.625049114 CEST	51255	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:50.625124931 CEST	51255	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:50.625332117 CEST	51264	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:50.632972002 CEST	2121	51256	34.149.79.8	192.168.2.16
May 8, 2024 08:41:50.633019924 CEST	51256	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:50.633153915 CEST	51256	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:50.633459091 CEST	51265	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:50.639862061 CEST	51232	2121	192.168.2.16	94.7.190.193
May 8, 2024 08:41:50.639885902 CEST	51229	2121	192.168.2.16	106.54.232.65
May 8, 2024 08:41:50.639887094 CEST	51231	21	192.168.2.16	94.7.190.193
May 8, 2024 08:41:50.639888048 CEST	51235	21	192.168.2.16	27.219.156.111
May 8, 2024 08:41:50.640402079 CEST	51266	21	192.168.2.16	5.141.181.221
May 8, 2024 08:41:50.655894041 CEST	51236	2121	192.168.2.16	27.219.156.111
May 8, 2024 08:41:50.655939102 CEST	21	51257	120.24.160.35	192.168.2.16
May 8, 2024 08:41:50.656002045 CEST	51257	21	192.168.2.16	120.24.160.35
May 8, 2024 08:41:50.656397104 CEST	51267	2121	192.168.2.16	5.141.181.221
May 8, 2024 08:41:50.670803070 CEST	21	51240	172.120.235.139	192.168.2.16
May 8, 2024 08:41:50.670866013 CEST	51240	21	192.168.2.16	172.120.235.139
May 8, 2024 08:41:50.670968056 CEST	21	51261	172.120.235.139	192.168.2.16
May 8, 2024 08:41:50.671030998 CEST	51261	21	192.168.2.16	172.120.235.139
May 8, 2024 08:41:50.689853907 CEST	51102	2121	192.168.2.16	182.91.23.226
May 8, 2024 08:41:50.703860998 CEST	51101	21	192.168.2.16	182.91.23.226
May 8, 2024 08:41:50.708163977 CEST	21	51239	91.146.97.65	192.168.2.16
May 8, 2024 08:41:50.708400011 CEST	21	51239	91.146.97.65	192.168.2.16
May 8, 2024 08:41:50.708622932 CEST	51239	21	192.168.2.16	91.146.97.65
May 8, 2024 08:41:50.726196051 CEST	2121	51258	120.24.160.35	192.168.2.16
May 8, 2024 08:41:50.731971979 CEST	2121	51210	59.28.241.113	192.168.2.16
May 8, 2024 08:41:50.734859943 CEST	51241	21	192.168.2.16	50.193.20.246
May 8, 2024 08:41:50.736402988 CEST	21	51209	59.28.241.113	192.168.2.16
May 8, 2024 08:41:50.750886917 CEST	51242	2121	192.168.2.16	50.193.20.246
May 8, 2024 08:41:50.763859034 CEST	21	51135	96.126.118.190	192.168.2.16
May 8, 2024 08:41:50.764048100 CEST	51135	21	192.168.2.16	96.126.118.190
May 8, 2024 08:41:50.765984058 CEST	21	51233	118.35.206.171	192.168.2.16
May 8, 2024 08:41:50.766880989 CEST	51088	21	192.168.2.16	175.214.50.248
May 8, 2024 08:41:50.766881943 CEST	51243	21	192.168.2.16	27.9.54.22
May 8, 2024 08:41:50.770952940 CEST	2121	51179	51.211.40.188	192.168.2.16
May 8, 2024 08:41:50.780970097 CEST	2121	51137	96.126.118.190	192.168.2.16
May 8, 2024 08:41:50.781178951 CEST	51137	2121	192.168.2.16	96.126.118.190
May 8, 2024 08:41:50.783226013 CEST	21	51201	77.81.30.198	192.168.2.16
May 8, 2024 08:41:50.783236027 CEST	2121	51202	77.81.30.198	192.168.2.16
May 8, 2024 08:41:50.787190914 CEST	2121	51234	118.35.206.171	192.168.2.16
May 8, 2024 08:41:50.787417889 CEST	21	51255	34.149.79.8	192.168.2.16
May 8, 2024 08:41:50.787715912 CEST	21	51264	34.149.79.8	192.168.2.16
May 8, 2024 08:41:50.787787914 CEST	51264	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:50.791996002 CEST	21	51213	79.11.173.175	192.168.2.16
May 8, 2024 08:41:50.795569897 CEST	2121	51256	34.149.79.8	192.168.2.16
May 8, 2024 08:41:50.795878887 CEST	2121	51265	34.149.79.8	192.168.2.16
May 8, 2024 08:41:50.795934916 CEST	51265	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:50.798887014 CEST	51089	2121	192.168.2.16	175.214.50.248
May 8, 2024 08:41:50.812484026 CEST	2121	51214	79.11.173.175	192.168.2.16
May 8, 2024 08:41:50.814105034 CEST	21	51244	171.244.37.116	192.168.2.16
May 8, 2024 08:41:50.814217091 CEST	51244	21	192.168.2.16	171.244.37.116
May 8, 2024 08:41:50.814872980 CEST	51090	21	192.168.2.16	87.128.72.231
May 8, 2024 08:41:50.830954075 CEST	21	51252	84.44.255.254	192.168.2.16
May 8, 2024 08:41:50.831010103 CEST	51252	21	192.168.2.16	84.44.255.254
May 8, 2024 08:41:50.831115007 CEST	51252	21	192.168.2.16	84.44.255.254
May 8, 2024 08:41:50.831409931 CEST	51268	21	192.168.2.16	84.44.255.254
May 8, 2024 08:41:50.862890959 CEST	51091	2121	192.168.2.16	87.128.72.231
May 8, 2024 08:41:50.881309986 CEST	21	51122	46.206.172.28	192.168.2.16
May 8, 2024 08:41:50.888082027 CEST	21	51108	175.192.125.189	192.168.2.16
May 8, 2024 08:41:50.888717890 CEST	21	51261	172.120.235.139	192.168.2.16
May 8, 2024 08:41:50.888894081 CEST	51261	21	192.168.2.16	172.120.235.139
May 8, 2024 08:41:50.889327049 CEST	2121	51109	175.192.125.189	192.168.2.16
May 8, 2024 08:41:50.893861055 CEST	51245	21	192.168.2.16	73.44.53.187
May 8, 2024 08:41:50.893877029 CEST	51246	2121	192.168.2.16	27.9.54.22
May 8, 2024 08:41:50.893879890 CEST	51093	2121	192.168.2.16	24.56.47.44
May 8, 2024 08:41:50.896851063 CEST	51092	21	192.168.2.16	24.56.47.44
May 8, 2024 08:41:50.906562090 CEST	21	51094	196.210.0.111	192.168.2.16
May 8, 2024 08:41:50.906692982 CEST	51094	21	192.168.2.16	196.210.0.111
May 8, 2024 08:41:50.906918049 CEST	51269	21	192.168.2.16	196.210.0.111
May 8, 2024 08:41:50.909852982 CEST	51247	21	192.168.2.16	170.79.73.98
May 8, 2024 08:41:50.909852982 CEST	51248	2121	192.168.2.16	73.44.53.187
May 8, 2024 08:41:50.925868988 CEST	51081	2121	192.168.2.16	79.114.76.238
May 8, 2024 08:41:50.941859007 CEST	51150	2121	192.168.2.16	39.123.200.22
May 8, 2024 08:41:50.941874981 CEST	51148	21	192.168.2.16	39.123.200.22
May 8, 2024 08:41:50.953491926 CEST	21	51264	34.149.79.8	192.168.2.16
May 8, 2024 08:41:50.953552961 CEST	51264	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:50.953634977 CEST	51264	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:50.953838110 CEST	51270	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:50.958568096 CEST	2121	51265	34.149.79.8	192.168.2.16
May 8, 2024 08:41:50.958620071 CEST	51265	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:50.958703995 CEST	51265	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:50.958910942 CEST	51271	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:50.970132113 CEST	21	51135	96.126.118.190	192.168.2.16
May 8, 2024 08:41:50.970422029 CEST	21	51135	96.126.118.190	192.168.2.16
May 8, 2024 08:41:50.970654011 CEST	51135	21	192.168.2.16	96.126.118.190
May 8, 2024 08:41:50.987288952 CEST	2121	51137	96.126.118.190	192.168.2.16
May 8, 2024 08:41:50.987322092 CEST	2121	51137	96.126.118.190	192.168.2.16
May 8, 2024 08:41:50.987498045 CEST	51137	2121	192.168.2.16	96.126.118.190
May 8, 2024 08:41:51.002161980 CEST	21	51257	120.24.160.35	192.168.2.16
May 8, 2024 08:41:51.002274036 CEST	51257	21	192.168.2.16	120.24.160.35
May 8, 2024 08:41:51.002528906 CEST	51272	21	192.168.2.16	129.226.194.19
May 8, 2024 08:41:51.005867958 CEST	51124	2121	192.168.2.16	46.206.172.28
May 8, 2024 08:41:51.005877018 CEST	51084	21	192.168.2.16	154.221.211.247
May 8, 2024 08:41:51.005899906 CEST	51096	21	192.168.2.16	87.4.213.60
May 8, 2024 08:41:51.021862984 CEST	51193	2121	192.168.2.16	38.86.75.247
May 8, 2024 08:41:51.021883965 CEST	51192	21	192.168.2.16	38.86.75.247
May 8, 2024 08:41:51.037844896 CEST	51100	2121	192.168.2.16	87.4.213.60
May 8, 2024 08:41:51.047193050 CEST	21	51239	91.146.97.65	192.168.2.16
May 8, 2024 08:41:51.047353029 CEST	51239	21	192.168.2.16	91.146.97.65
May 8, 2024 08:41:51.047610998 CEST	51273	21	192.168.2.16	91.146.97.65
May 8, 2024 08:41:51.072701931 CEST	21	51261	172.120.235.139	192.168.2.16
May 8, 2024 08:41:51.073096991 CEST	21	51261	172.120.235.139	192.168.2.16
May 8, 2024 08:41:51.073250055 CEST	51261	21	192.168.2.16	172.120.235.139
May 8, 2024 08:41:51.082737923 CEST	21	51029	223.70.202.42	192.168.2.16
May 8, 2024 08:41:51.085870028 CEST	51251	2121	192.168.2.16	170.79.73.98
May 8, 2024 08:41:51.086009026 CEST	51104	2121	192.168.2.16	173.62.166.227
May 8, 2024 08:41:51.086010933 CEST	51103	21	192.168.2.16	173.62.166.227
May 8, 2024 08:41:51.102209091 CEST	51274	2121	192.168.2.16	129.226.194.19
May 8, 2024 08:41:51.108707905 CEST	51159	2121	192.168.2.16	38.44.32.116
May 8, 2024 08:41:51.115992069 CEST	21	51264	34.149.79.8	192.168.2.16
May 8, 2024 08:41:51.116214991 CEST	21	51270	34.149.79.8	192.168.2.16
May 8, 2024 08:41:51.116296053 CEST	51270	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:51.116868973 CEST	51087	2121	192.168.2.16	154.221.211.247
May 8, 2024 08:41:51.116894007 CEST	51106	21	192.168.2.16	171.244.62.79
May 8, 2024 08:41:51.116894960 CEST	51107	2121	192.168.2.16	171.244.62.79
May 8, 2024 08:41:51.121059895 CEST	2121	51265	34.149.79.8	192.168.2.16
May 8, 2024 08:41:51.121222019 CEST	2121	51271	34.149.79.8	192.168.2.16
May 8, 2024 08:41:51.121287107 CEST	51271	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:51.146718025 CEST	21	51252	84.44.255.254	192.168.2.16
May 8, 2024 08:41:51.148878098 CEST	51110	21	192.168.2.16	67.170.33.55
May 8, 2024 08:41:51.148878098 CEST	51113	21	192.168.2.16	185.237.214.83
May 8, 2024 08:41:51.148880959 CEST	51112	2121	192.168.2.16	185.237.214.83
May 8, 2024 08:41:51.150011063 CEST	51111	2121	192.168.2.16	67.170.33.55
May 8, 2024 08:41:51.151052952 CEST	21	51268	84.44.255.254	192.168.2.16
May 8, 2024 08:41:51.151129007 CEST	51268	21	192.168.2.16	84.44.255.254
May 8, 2024 08:41:51.162811995 CEST	21	51244	171.244.37.116	192.168.2.16
May 8, 2024 08:41:51.162971020 CEST	51244	21	192.168.2.16	171.244.37.116
May 8, 2024 08:41:51.163192987 CEST	51275	21	192.168.2.16	171.244.37.116
May 8, 2024 08:41:51.164875031 CEST	51115	2121	192.168.2.16	210.179.125.116
May 8, 2024 08:41:51.169853926 CEST	51114	21	192.168.2.16	210.179.125.116
May 8, 2024 08:41:51.176445961 CEST	21	51135	96.126.118.190	192.168.2.16
May 8, 2024 08:41:51.176604033 CEST	51135	21	192.168.2.16	96.126.118.190
May 8, 2024 08:41:51.193553925 CEST	2121	51137	96.126.118.190	192.168.2.16
May 8, 2024 08:41:51.193748951 CEST	51137	2121	192.168.2.16	96.126.118.190
May 8, 2024 08:41:51.196867943 CEST	51116	21	192.168.2.16	119.113.86.28
May 8, 2024 08:41:51.196882010 CEST	51119	2121	192.168.2.16	81.32.73.103
May 8, 2024 08:41:51.196887970 CEST	51121	21	192.168.2.16	20.159.153.189
May 8, 2024 08:41:51.196891069 CEST	51118	21	192.168.2.16	81.32.73.103
May 8, 2024 08:41:51.197793007 CEST	51117	2121	192.168.2.16	119.113.86.28
May 8, 2024 08:41:51.197796106 CEST	51120	2121	192.168.2.16	20.159.153.189
May 8, 2024 08:41:51.212866068 CEST	51123	21	192.168.2.16	8.210.19.105
May 8, 2024 08:41:51.212975979 CEST	51125	2121	192.168.2.16	8.210.19.105
May 8, 2024 08:41:51.218784094 CEST	21	51130	117.223.205.236	192.168.2.16
May 8, 2024 08:41:51.218977928 CEST	51130	21	192.168.2.16	117.223.205.236
May 8, 2024 08:41:51.219271898 CEST	51276	21	192.168.2.16	117.223.205.236
May 8, 2024 08:41:51.228864908 CEST	51126	21	192.168.2.16	189.73.161.99
May 8, 2024 08:41:51.228880882 CEST	51127	2121	192.168.2.16	189.73.161.99
May 8, 2024 08:41:51.228883028 CEST	51258	2121	192.168.2.16	120.24.160.35
May 8, 2024 08:41:51.241908073 CEST	2121	51193	38.86.75.247	192.168.2.16
May 8, 2024 08:41:51.242105961 CEST	21	51192	38.86.75.247	192.168.2.16
May 8, 2024 08:41:51.244873047 CEST	51129	2121	192.168.2.16	71.227.226.201
May 8, 2024 08:41:51.244877100 CEST	51210	2121	192.168.2.16	59.28.241.113
May 8, 2024 08:41:51.244889021 CEST	51128	21	192.168.2.16	71.227.226.201
May 8, 2024 08:41:51.244891882 CEST	51254	2121	192.168.2.16	34.160.4.184
May 8, 2024 08:41:51.247560024 CEST	2121	51150	39.123.200.22	192.168.2.16
May 8, 2024 08:41:51.251012087 CEST	21	51148	39.123.200.22	192.168.2.16
May 8, 2024 08:41:51.251512051 CEST	51209	21	192.168.2.16	59.28.241.113
May 8, 2024 08:41:51.251632929 CEST	51253	21	192.168.2.16	34.160.4.184
May 8, 2024 08:41:51.262092113 CEST	2121	51081	79.114.76.238	192.168.2.16
May 8, 2024 08:41:51.274152994 CEST	21	51261	172.120.235.139	192.168.2.16
May 8, 2024 08:41:51.274265051 CEST	51261	21	192.168.2.16	172.120.235.139
May 8, 2024 08:41:51.274434090 CEST	51277	21	192.168.2.16	172.120.235.139
May 8, 2024 08:41:51.276849985 CEST	51233	21	192.168.2.16	118.35.206.171
May 8, 2024 08:41:51.277103901 CEST	51278	21	192.168.2.16	34.148.107.109
May 8, 2024 08:41:51.277103901 CEST	51179	2121	192.168.2.16	51.211.40.188
May 8, 2024 08:41:51.278768063 CEST	21	51270	34.149.79.8	192.168.2.16
May 8, 2024 08:41:51.278835058 CEST	51270	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:51.278891087 CEST	51270	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:51.279093981 CEST	51279	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:51.283714056 CEST	2121	51271	34.149.79.8	192.168.2.16
May 8, 2024 08:41:51.283765078 CEST	51271	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:51.283849955 CEST	51271	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:51.284034967 CEST	51280	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:51.292867899 CEST	51201	21	192.168.2.16	77.81.30.198
May 8, 2024 08:41:51.292870045 CEST	51202	2121	192.168.2.16	77.81.30.198
May 8, 2024 08:41:51.302849054 CEST	51234	2121	192.168.2.16	118.35.206.171
May 8, 2024 08:41:51.303361893 CEST	51213	21	192.168.2.16	79.11.173.175
May 8, 2024 08:41:51.324876070 CEST	51214	2121	192.168.2.16	79.11.173.175
May 8, 2024 08:41:51.332137108 CEST	21	51084	154.221.211.247	192.168.2.16
May 8, 2024 08:41:51.341295004 CEST	51281	2121	192.168.2.16	34.148.107.109
May 8, 2024 08:41:51.341393948 CEST	51282	21	192.168.2.16	191.177.131.3
May 8, 2024 08:41:51.344114065 CEST	21	51257	120.24.160.35	192.168.2.16
May 8, 2024 08:41:51.344168901 CEST	51257	21	192.168.2.16	120.24.160.35
May 8, 2024 08:41:51.344494104 CEST	21	51257	120.24.160.35	192.168.2.16
May 8, 2024 08:41:51.344541073 CEST	51257	21	192.168.2.16	120.24.160.35
May 8, 2024 08:41:51.357172012 CEST	51283	2121	192.168.2.16	191.177.131.3
May 8, 2024 08:41:51.362854004 CEST	21	51272	129.226.194.19	192.168.2.16
May 8, 2024 08:41:51.373159885 CEST	51284	21	192.168.2.16	136.36.71.102
May 8, 2024 08:41:51.373241901 CEST	51285	2121	192.168.2.16	136.36.71.102
May 8, 2024 08:41:51.380548954 CEST	2121	51159	38.44.32.116	192.168.2.16
May 8, 2024 08:41:51.382997990 CEST	21	51135	96.126.118.190	192.168.2.16
May 8, 2024 08:41:51.383177042 CEST	21	51239	91.146.97.65	192.168.2.16
May 8, 2024 08:41:51.383197069 CEST	51135	21	192.168.2.16	96.126.118.190
May 8, 2024 08:41:51.383227110 CEST	51239	21	192.168.2.16	91.146.97.65
May 8, 2024 08:41:51.387051105 CEST	21	51269	196.210.0.111	192.168.2.16
May 8, 2024 08:41:51.387120962 CEST	51269	21	192.168.2.16	196.210.0.111
May 8, 2024 08:41:51.388880968 CEST	51122	21	192.168.2.16	46.206.172.28
May 8, 2024 08:41:51.388917923 CEST	51259	2121	192.168.2.16	223.239.97.194
May 8, 2024 08:41:51.388928890 CEST	51260	21	192.168.2.16	223.239.97.194
May 8, 2024 08:41:51.389067888 CEST	51286	21	192.168.2.16	82.31.188.244
May 8, 2024 08:41:51.392503023 CEST	21	51273	91.146.97.65	192.168.2.16
May 8, 2024 08:41:51.392561913 CEST	51273	21	192.168.2.16	91.146.97.65
May 8, 2024 08:41:51.394519091 CEST	21	51094	196.210.0.111	192.168.2.16
May 8, 2024 08:41:51.394576073 CEST	51094	21	192.168.2.16	196.210.0.111
May 8, 2024 08:41:51.403848886 CEST	51139	21	192.168.2.16	110.66.7.129
May 8, 2024 08:41:51.403876066 CEST	51138	21	192.168.2.16	106.32.191.166
May 8, 2024 08:41:51.403876066 CEST	51108	21	192.168.2.16	175.192.125.189
May 8, 2024 08:41:51.403883934 CEST	51140	2121	192.168.2.16	106.32.191.166
May 8, 2024 08:41:51.409863949 CEST	51109	2121	192.168.2.16	175.192.125.189
May 8, 2024 08:41:51.412004948 CEST	2121	51137	96.126.118.190	192.168.2.16
May 8, 2024 08:41:51.412192106 CEST	51137	2121	192.168.2.16	96.126.118.190
May 8, 2024 08:41:51.416604996 CEST	2121	51102	182.91.23.226	192.168.2.16
May 8, 2024 08:41:51.418876886 CEST	51141	2121	192.168.2.16	110.66.7.129
May 8, 2024 08:41:51.433078051 CEST	21	51101	182.91.23.226	192.168.2.16
May 8, 2024 08:41:51.441375971 CEST	21	51270	34.149.79.8	192.168.2.16
May 8, 2024 08:41:51.441389084 CEST	21	51279	34.149.79.8	192.168.2.16
May 8, 2024 08:41:51.441462994 CEST	51279	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:51.446243048 CEST	2121	51271	34.149.79.8	192.168.2.16
May 8, 2024 08:41:51.446324110 CEST	2121	51087	154.221.211.247	192.168.2.16
May 8, 2024 08:41:51.446414948 CEST	2121	51280	34.149.79.8	192.168.2.16
May 8, 2024 08:41:51.446471930 CEST	51280	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:51.449877977 CEST	51142	2121	192.168.2.16	84.0.119.169
May 8, 2024 08:41:51.449879885 CEST	51143	21	192.168.2.16	84.0.119.169
May 8, 2024 08:41:51.456137896 CEST	21	51277	172.120.235.139	192.168.2.16
May 8, 2024 08:41:51.456186056 CEST	21	51261	172.120.235.139	192.168.2.16
May 8, 2024 08:41:51.456204891 CEST	51277	21	192.168.2.16	172.120.235.139
May 8, 2024 08:41:51.456229925 CEST	51261	21	192.168.2.16	172.120.235.139
May 8, 2024 08:41:51.465903044 CEST	51147	2121	192.168.2.16	136.52.110.227
May 8, 2024 08:41:51.465960026 CEST	51146	21	192.168.2.16	136.52.110.227
May 8, 2024 08:41:51.466434002 CEST	51287	2121	192.168.2.16	82.31.188.244
May 8, 2024 08:41:51.470748901 CEST	21	51268	84.44.255.254	192.168.2.16
May 8, 2024 08:41:51.470808029 CEST	51268	21	192.168.2.16	84.44.255.254
May 8, 2024 08:41:51.470899105 CEST	51268	21	192.168.2.16	84.44.255.254
May 8, 2024 08:41:51.471165895 CEST	51288	21	192.168.2.16	84.44.255.254
May 8, 2024 08:41:51.471575022 CEST	2121	51274	129.226.194.19	192.168.2.16
May 8, 2024 08:41:51.509675980 CEST	21	51244	171.244.37.116	192.168.2.16
May 8, 2024 08:41:51.509687901 CEST	21	51244	171.244.37.116	192.168.2.16
May 8, 2024 08:41:51.509744883 CEST	51244	21	192.168.2.16	171.244.37.116
May 8, 2024 08:41:51.511877060 CEST	2121	51124	46.206.172.28	192.168.2.16
May 8, 2024 08:41:51.513881922 CEST	51149	21	192.168.2.16	207.181.250.221
May 8, 2024 08:41:51.529892921 CEST	51151	2121	192.168.2.16	207.181.250.221
May 8, 2024 08:41:51.534524918 CEST	21	51275	171.244.37.116	192.168.2.16
May 8, 2024 08:41:51.534590960 CEST	51275	21	192.168.2.16	171.244.37.116
May 8, 2024 08:41:51.545882940 CEST	51152	21	192.168.2.16	130.149.110.200
May 8, 2024 08:41:51.545900106 CEST	51153	2121	192.168.2.16	130.149.110.200
May 8, 2024 08:41:51.545902967 CEST	51262	21	192.168.2.16	72.201.18.23
May 8, 2024 08:41:51.558708906 CEST	2121	51210	59.28.241.113	192.168.2.16
May 8, 2024 08:41:51.561872005 CEST	51154	21	192.168.2.16	195.201.94.23
May 8, 2024 08:41:51.561886072 CEST	51263	2121	192.168.2.16	72.201.18.23
May 8, 2024 08:41:51.561887980 CEST	51155	2121	192.168.2.16	195.201.94.23
May 8, 2024 08:41:51.562247992 CEST	51289	21	192.168.2.16	107.165.225.20
May 8, 2024 08:41:51.564826965 CEST	2121	51258	120.24.160.35	192.168.2.16
May 8, 2024 08:41:51.569235086 CEST	21	51209	59.28.241.113	192.168.2.16
May 8, 2024 08:41:51.590481997 CEST	21	51135	96.126.118.190	192.168.2.16
May 8, 2024 08:41:51.590683937 CEST	51135	21	192.168.2.16	96.126.118.190
May 8, 2024 08:41:51.593960047 CEST	21	51233	118.35.206.171	192.168.2.16
May 8, 2024 08:41:51.605513096 CEST	21	51279	34.149.79.8	192.168.2.16
May 8, 2024 08:41:51.605571985 CEST	51279	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:51.605658054 CEST	51279	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:51.605875969 CEST	51290	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:51.610702038 CEST	2121	51280	34.149.79.8	192.168.2.16
May 8, 2024 08:41:51.610754013 CEST	51280	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:51.610871077 CEST	51280	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:51.611115932 CEST	51291	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:51.618371010 CEST	2121	51137	96.126.118.190	192.168.2.16
May 8, 2024 08:41:51.618535042 CEST	51137	2121	192.168.2.16	96.126.118.190
May 8, 2024 08:41:51.622622967 CEST	2121	51234	118.35.206.171	192.168.2.16
May 8, 2024 08:41:51.625874043 CEST	51156	21	192.168.2.16	38.44.32.116
May 8, 2024 08:41:51.639868975 CEST	21	51201	77.81.30.198	192.168.2.16
May 8, 2024 08:41:51.639960051 CEST	2121	51202	77.81.30.198	192.168.2.16
May 8, 2024 08:41:51.643457890 CEST	21	51213	79.11.173.175	192.168.2.16
May 8, 2024 08:41:51.645055056 CEST	51266	21	192.168.2.16	5.141.181.221
May 8, 2024 08:41:51.669523954 CEST	2121	51214	79.11.173.175	192.168.2.16
May 8, 2024 08:41:51.671911001 CEST	51267	2121	192.168.2.16	5.141.181.221
May 8, 2024 08:41:51.675507069 CEST	2121	51179	51.211.40.188	192.168.2.16
May 8, 2024 08:41:51.704266071 CEST	51292	2121	192.168.2.16	107.165.225.20
May 8, 2024 08:41:51.715866089 CEST	21	51108	175.192.125.189	192.168.2.16
May 8, 2024 08:41:51.722825050 CEST	2121	51109	175.192.125.189	192.168.2.16
May 8, 2024 08:41:51.735582113 CEST	21	51130	117.223.205.236	192.168.2.16
May 8, 2024 08:41:51.735656023 CEST	51130	21	192.168.2.16	117.223.205.236
May 8, 2024 08:41:51.736439943 CEST	51294	21	192.168.2.16	182.32.56.16
May 8, 2024 08:41:51.736465931 CEST	51293	2121	192.168.2.16	182.32.56.16
May 8, 2024 08:41:51.746520996 CEST	21	51276	117.223.205.236	192.168.2.16
May 8, 2024 08:41:51.747126102 CEST	51276	21	192.168.2.16	117.223.205.236
May 8, 2024 08:41:51.751878977 CEST	51192	21	192.168.2.16	38.86.75.247
May 8, 2024 08:41:51.751902103 CEST	51193	2121	192.168.2.16	38.86.75.247
May 8, 2024 08:41:51.751907110 CEST	51148	21	192.168.2.16	39.123.200.22
May 8, 2024 08:41:51.751921892 CEST	51150	2121	192.168.2.16	39.123.200.22
May 8, 2024 08:41:51.752274036 CEST	51295	21	192.168.2.16	98.35.179.149
May 8, 2024 08:41:51.756715059 CEST	21	51273	91.146.97.65	192.168.2.16
May 8, 2024 08:41:51.756901979 CEST	51273	21	192.168.2.16	91.146.97.65
May 8, 2024 08:41:51.767237902 CEST	51296	2121	192.168.2.16	98.35.179.149
May 8, 2024 08:41:51.767800093 CEST	21	51279	34.149.79.8	192.168.2.16
May 8, 2024 08:41:51.768219948 CEST	21	51290	34.149.79.8	192.168.2.16
May 8, 2024 08:41:51.768321991 CEST	51290	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:51.773139954 CEST	2121	51280	34.149.79.8	192.168.2.16
May 8, 2024 08:41:51.773489952 CEST	2121	51291	34.149.79.8	192.168.2.16
May 8, 2024 08:41:51.773547888 CEST	51291	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:51.783441067 CEST	51297	21	192.168.2.16	176.28.14.156
May 8, 2024 08:41:51.790275097 CEST	21	51288	84.44.255.254	192.168.2.16
May 8, 2024 08:41:51.790390015 CEST	51288	21	192.168.2.16	84.44.255.254
May 8, 2024 08:41:51.790429115 CEST	21	51268	84.44.255.254	192.168.2.16
May 8, 2024 08:41:51.797533989 CEST	21	51135	96.126.118.190	192.168.2.16
May 8, 2024 08:41:51.798399925 CEST	51135	21	192.168.2.16	96.126.118.190
May 8, 2024 08:41:51.798858881 CEST	51161	2121	192.168.2.16	104.87.220.107
May 8, 2024 08:41:51.798861027 CEST	51160	21	192.168.2.16	104.87.220.107
May 8, 2024 08:41:51.799221039 CEST	51299	2121	192.168.2.16	176.28.14.156
May 8, 2024 08:41:51.814893007 CEST	51163	2121	192.168.2.16	184.67.80.145
May 8, 2024 08:41:51.814891100 CEST	51162	21	192.168.2.16	184.67.80.145
May 8, 2024 08:41:51.814893961 CEST	51164	21	192.168.2.16	73.75.96.175
May 8, 2024 08:41:51.815278053 CEST	51300	21	192.168.2.16	78.31.232.246
May 8, 2024 08:41:51.824754000 CEST	2121	51137	96.126.118.190	192.168.2.16
May 8, 2024 08:41:51.825292110 CEST	51137	2121	192.168.2.16	96.126.118.190
May 8, 2024 08:41:51.845885038 CEST	51165	2121	192.168.2.16	73.75.96.175
May 8, 2024 08:41:51.862278938 CEST	51302	2121	192.168.2.16	78.31.232.246
May 8, 2024 08:41:51.879102945 CEST	51272	21	192.168.2.16	129.226.194.19
May 8, 2024 08:41:51.880819082 CEST	21	51277	172.120.235.139	192.168.2.16
May 8, 2024 08:41:51.881252050 CEST	51277	21	192.168.2.16	172.120.235.139
May 8, 2024 08:41:51.883579969 CEST	21	51269	196.210.0.111	192.168.2.16
May 8, 2024 08:41:51.883734941 CEST	51269	21	192.168.2.16	196.210.0.111
May 8, 2024 08:41:51.893889904 CEST	51159	2121	192.168.2.16	38.44.32.116
May 8, 2024 08:41:51.902595043 CEST	21	51122	46.206.172.28	192.168.2.16
May 8, 2024 08:41:51.906327009 CEST	21	51275	171.244.37.116	192.168.2.16
May 8, 2024 08:41:51.906455994 CEST	51275	21	192.168.2.16	171.244.37.116
May 8, 2024 08:41:51.925889015 CEST	51102	2121	192.168.2.16	182.91.23.226
May 8, 2024 08:41:51.926294088 CEST	51303	21	192.168.2.16	5.228.65.50
May 8, 2024 08:41:51.932049990 CEST	21	51290	34.149.79.8	192.168.2.16
May 8, 2024 08:41:51.932118893 CEST	51290	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:51.932180882 CEST	51290	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:51.932389975 CEST	51304	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:51.937233925 CEST	2121	51291	34.149.79.8	192.168.2.16
May 8, 2024 08:41:51.937308073 CEST	51291	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:51.937402010 CEST	51291	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:51.937645912 CEST	51305	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:51.941855907 CEST	51101	21	192.168.2.16	182.91.23.226
May 8, 2024 08:41:51.958169937 CEST	51306	2121	192.168.2.16	5.228.65.50
May 8, 2024 08:41:51.973893881 CEST	51274	2121	192.168.2.16	129.226.194.19
May 8, 2024 08:41:51.974174023 CEST	51307	21	192.168.2.16	184.101.185.9
May 8, 2024 08:41:51.975632906 CEST	2121	51193	38.86.75.247	192.168.2.16
May 8, 2024 08:41:51.975776911 CEST	21	51192	38.86.75.247	192.168.2.16
May 8, 2024 08:41:51.989888906 CEST	51168	21	192.168.2.16	217.105.64.87
May 8, 2024 08:41:52.005728960 CEST	21	51135	96.126.118.190	192.168.2.16
May 8, 2024 08:41:52.006503105 CEST	51308	2121	192.168.2.16	184.101.185.9
May 8, 2024 08:41:52.006891966 CEST	51135	21	192.168.2.16	96.126.118.190
May 8, 2024 08:41:52.021998882 CEST	51124	2121	192.168.2.16	46.206.172.28
May 8, 2024 08:41:52.031486988 CEST	2121	51137	96.126.118.190	192.168.2.16
May 8, 2024 08:41:52.031951904 CEST	51137	2121	192.168.2.16	96.126.118.190
May 8, 2024 08:41:52.038243055 CEST	51311	21	192.168.2.16	180.180.130.245
May 8, 2024 08:41:52.038352966 CEST	51312	2121	192.168.2.16	180.180.130.245
May 8, 2024 08:41:52.054150105 CEST	51313	21	192.168.2.16	5.38.137.244
May 8, 2024 08:41:52.059725046 CEST	2121	51150	39.123.200.22	192.168.2.16
May 8, 2024 08:41:52.062992096 CEST	21	51277	172.120.235.139	192.168.2.16
May 8, 2024 08:41:52.063260078 CEST	21	51148	39.123.200.22	192.168.2.16
May 8, 2024 08:41:52.063324928 CEST	21	51277	172.120.235.139	192.168.2.16
May 8, 2024 08:41:52.063446999 CEST	51277	21	192.168.2.16	172.120.235.139
May 8, 2024 08:41:52.069886923 CEST	51210	2121	192.168.2.16	59.28.241.113
May 8, 2024 08:41:52.069886923 CEST	51258	2121	192.168.2.16	120.24.160.35
May 8, 2024 08:41:52.070101023 CEST	51314	2121	192.168.2.16	5.38.137.244
May 8, 2024 08:41:52.084856033 CEST	51209	21	192.168.2.16	59.28.241.113
May 8, 2024 08:41:52.085026026 CEST	51315	21	192.168.2.16	121.24.207.37
May 8, 2024 08:41:52.093163967 CEST	21	51297	176.28.14.156	192.168.2.16
May 8, 2024 08:41:52.094508886 CEST	21	51290	34.149.79.8	192.168.2.16
May 8, 2024 08:41:52.094727039 CEST	21	51304	34.149.79.8	192.168.2.16
May 8, 2024 08:41:52.094800949 CEST	51304	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:52.099729061 CEST	2121	51291	34.149.79.8	192.168.2.16
May 8, 2024 08:41:52.099776030 CEST	2121	51305	34.149.79.8	192.168.2.16
May 8, 2024 08:41:52.099845886 CEST	51305	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:52.100869894 CEST	51233	21	192.168.2.16	118.35.206.171
May 8, 2024 08:41:52.102869987 CEST	21	51273	91.146.97.65	192.168.2.16
May 8, 2024 08:41:52.103116035 CEST	21	51273	91.146.97.65	192.168.2.16
May 8, 2024 08:41:52.103270054 CEST	51273	21	192.168.2.16	91.146.97.65
May 8, 2024 08:41:52.109570980 CEST	21	51288	84.44.255.254	192.168.2.16
May 8, 2024 08:41:52.109637022 CEST	51288	21	192.168.2.16	84.44.255.254
May 8, 2024 08:41:52.109702110 CEST	51288	21	192.168.2.16	84.44.255.254
May 8, 2024 08:41:52.109894991 CEST	51316	21	192.168.2.16	84.44.255.254
May 8, 2024 08:41:52.120753050 CEST	21	51095	23.229.188.101	192.168.2.16
May 8, 2024 08:41:52.120871067 CEST	51095	21	192.168.2.16	23.229.188.101
May 8, 2024 08:41:52.121031046 CEST	51317	21	192.168.2.16	23.229.188.101
May 8, 2024 08:41:52.135333061 CEST	51234	2121	192.168.2.16	118.35.206.171
May 8, 2024 08:41:52.147918940 CEST	51202	2121	192.168.2.16	77.81.30.198
May 8, 2024 08:41:52.148755074 CEST	51213	21	192.168.2.16	79.11.173.175
May 8, 2024 08:41:52.148755074 CEST	51201	21	192.168.2.16	77.81.30.198
May 8, 2024 08:41:52.165699005 CEST	2121	51159	38.44.32.116	192.168.2.16
May 8, 2024 08:41:52.166172981 CEST	51318	2121	192.168.2.16	121.24.207.37
May 8, 2024 08:41:52.180087090 CEST	51179	2121	192.168.2.16	51.211.40.188
May 8, 2024 08:41:52.180088997 CEST	51214	2121	192.168.2.16	79.11.173.175
May 8, 2024 08:41:52.213996887 CEST	21	51135	96.126.118.190	192.168.2.16
May 8, 2024 08:41:52.216339111 CEST	51135	21	192.168.2.16	96.126.118.190
May 8, 2024 08:41:52.227890968 CEST	51171	2121	192.168.2.16	217.105.64.87
May 8, 2024 08:41:52.232773066 CEST	21	51300	78.31.232.246	192.168.2.16
May 8, 2024 08:41:52.238415956 CEST	2121	51137	96.126.118.190	192.168.2.16
May 8, 2024 08:41:52.238861084 CEST	51137	2121	192.168.2.16	96.126.118.190
May 8, 2024 08:41:52.239530087 CEST	21	51272	129.226.194.19	192.168.2.16
May 8, 2024 08:41:52.243864059 CEST	51172	21	192.168.2.16	76.149.206.244
May 8, 2024 08:41:52.244292021 CEST	21	51276	117.223.205.236	192.168.2.16
May 8, 2024 08:41:52.244452000 CEST	51321	21	192.168.2.16	149.81.82.210
May 8, 2024 08:41:52.244489908 CEST	51276	21	192.168.2.16	117.223.205.236
May 8, 2024 08:41:52.244642019 CEST	51322	2121	192.168.2.16	149.81.82.210
May 8, 2024 08:41:52.257230043 CEST	21	51304	34.149.79.8	192.168.2.16
May 8, 2024 08:41:52.257296085 CEST	51304	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:52.257358074 CEST	51304	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:52.257505894 CEST	51323	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:52.260241985 CEST	51324	21	192.168.2.16	65.21.181.166
May 8, 2024 08:41:52.262082100 CEST	2121	51305	34.149.79.8	192.168.2.16
May 8, 2024 08:41:52.262140989 CEST	51305	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:52.262218952 CEST	51305	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:52.262422085 CEST	51325	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:52.272833109 CEST	2121	51302	78.31.232.246	192.168.2.16
May 8, 2024 08:41:52.273546934 CEST	21	51277	172.120.235.139	192.168.2.16
May 8, 2024 08:41:52.273663044 CEST	51277	21	192.168.2.16	172.120.235.139
May 8, 2024 08:41:52.273804903 CEST	51326	21	192.168.2.16	172.120.235.139
May 8, 2024 08:41:52.276204109 CEST	51327	21	192.168.2.16	150.200.46.130
May 8, 2024 08:41:52.276237011 CEST	51328	2121	192.168.2.16	65.21.181.166
May 8, 2024 08:41:52.278054953 CEST	21	51275	171.244.37.116	192.168.2.16
May 8, 2024 08:41:52.278219938 CEST	51275	21	192.168.2.16	171.244.37.116
May 8, 2024 08:41:52.291858912 CEST	51278	21	192.168.2.16	34.148.107.109
May 8, 2024 08:41:52.292053938 CEST	51329	2121	192.168.2.16	150.200.46.130
May 8, 2024 08:41:52.316469908 CEST	21	51317	23.229.188.101	192.168.2.16
May 8, 2024 08:41:52.316576004 CEST	51317	21	192.168.2.16	23.229.188.101
May 8, 2024 08:41:52.319000959 CEST	21	51095	23.229.188.101	192.168.2.16
May 8, 2024 08:41:52.319057941 CEST	51095	21	192.168.2.16	23.229.188.101
May 8, 2024 08:41:52.319643021 CEST	21	51095	23.229.188.101	192.168.2.16
May 8, 2024 08:41:52.319691896 CEST	51095	21	192.168.2.16	23.229.188.101
May 8, 2024 08:41:52.324145079 CEST	51330	21	192.168.2.16	111.194.232.122
May 8, 2024 08:41:52.339904070 CEST	51173	2121	192.168.2.16	76.149.206.244
May 8, 2024 08:41:52.343254089 CEST	2121	51274	129.226.194.19	192.168.2.16
May 8, 2024 08:41:52.355890036 CEST	51282	21	192.168.2.16	191.177.131.3
May 8, 2024 08:41:52.355891943 CEST	51281	2121	192.168.2.16	34.148.107.109
May 8, 2024 08:41:52.356450081 CEST	51331	2121	192.168.2.16	111.194.232.122
May 8, 2024 08:41:52.356452942 CEST	51176	21	192.168.2.16	58.224.17.46
May 8, 2024 08:41:52.360702991 CEST	21	51269	196.210.0.111	192.168.2.16
May 8, 2024 08:41:52.360718966 CEST	21	51269	196.210.0.111	192.168.2.16
May 8, 2024 08:41:52.360852003 CEST	51269	21	192.168.2.16	196.210.0.111
May 8, 2024 08:41:52.371860981 CEST	51283	2121	192.168.2.16	191.177.131.3
May 8, 2024 08:41:52.372203112 CEST	51332	21	192.168.2.16	125.146.231.136
May 8, 2024 08:41:52.385469913 CEST	2121	51210	59.28.241.113	192.168.2.16
May 8, 2024 08:41:52.387866974 CEST	51284	21	192.168.2.16	136.36.71.102
May 8, 2024 08:41:52.388982058 CEST	51285	2121	192.168.2.16	136.36.71.102
May 8, 2024 08:41:52.403567076 CEST	21	51209	59.28.241.113	192.168.2.16
May 8, 2024 08:41:52.403893948 CEST	51286	21	192.168.2.16	82.31.188.244
May 8, 2024 08:41:52.404159069 CEST	51333	2121	192.168.2.16	125.146.231.136
May 8, 2024 08:41:52.404184103 CEST	51122	21	192.168.2.16	46.206.172.28
May 8, 2024 08:41:52.409081936 CEST	2121	51258	120.24.160.35	192.168.2.16
May 8, 2024 08:41:52.409209967 CEST	2121	51312	180.180.130.245	192.168.2.16
May 8, 2024 08:41:52.414693117 CEST	21	51060	77.75.121.3	192.168.2.16
May 8, 2024 08:41:52.414809942 CEST	51060	21	192.168.2.16	77.75.121.3
May 8, 2024 08:41:52.414961100 CEST	51334	21	192.168.2.16	77.75.121.3
May 8, 2024 08:41:52.417332888 CEST	21	51233	118.35.206.171	192.168.2.16
May 8, 2024 08:41:52.420291901 CEST	51335	21	192.168.2.16	181.205.168.30
May 8, 2024 08:41:52.420337915 CEST	51336	2121	192.168.2.16	181.205.168.30
May 8, 2024 08:41:52.420363903 CEST	51337	21	192.168.2.16	145.109.20.146
May 8, 2024 08:41:52.421144962 CEST	21	51304	34.149.79.8	192.168.2.16
May 8, 2024 08:41:52.421155930 CEST	21	51323	34.149.79.8	192.168.2.16
May 8, 2024 08:41:52.421227932 CEST	51323	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:52.423504114 CEST	21	51135	96.126.118.190	192.168.2.16
May 8, 2024 08:41:52.423902035 CEST	51135	21	192.168.2.16	96.126.118.190
May 8, 2024 08:41:52.424365997 CEST	2121	51305	34.149.79.8	192.168.2.16
May 8, 2024 08:41:52.424532890 CEST	2121	51325	34.149.79.8	192.168.2.16
May 8, 2024 08:41:52.424595118 CEST	51325	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:52.429774046 CEST	21	51288	84.44.255.254	192.168.2.16
May 8, 2024 08:41:52.430134058 CEST	21	51316	84.44.255.254	192.168.2.16
May 8, 2024 08:41:52.430197001 CEST	51316	21	192.168.2.16	84.44.255.254
May 8, 2024 08:41:52.435887098 CEST	51178	21	192.168.2.16	51.211.40.188
May 8, 2024 08:41:52.435897112 CEST	51177	2121	192.168.2.16	58.224.17.46
May 8, 2024 08:41:52.447529078 CEST	2121	51137	96.126.118.190	192.168.2.16
May 8, 2024 08:41:52.447979927 CEST	51137	2121	192.168.2.16	96.126.118.190
May 8, 2024 08:41:52.452133894 CEST	51340	2121	192.168.2.16	145.109.20.146
May 8, 2024 08:41:52.454138041 CEST	21	51273	91.146.97.65	192.168.2.16
May 8, 2024 08:41:52.454277039 CEST	51273	21	192.168.2.16	91.146.97.65
May 8, 2024 08:41:52.454488993 CEST	51341	21	192.168.2.16	91.146.97.65
May 8, 2024 08:41:52.458101988 CEST	21	51326	172.120.235.139	192.168.2.16
May 8, 2024 08:41:52.458116055 CEST	21	51277	172.120.235.139	192.168.2.16
May 8, 2024 08:41:52.458165884 CEST	51326	21	192.168.2.16	172.120.235.139
May 8, 2024 08:41:52.458189964 CEST	51277	21	192.168.2.16	172.120.235.139
May 8, 2024 08:41:52.458271980 CEST	2121	51234	118.35.206.171	192.168.2.16
May 8, 2024 08:41:52.467885017 CEST	51287	2121	192.168.2.16	82.31.188.244
May 8, 2024 08:41:52.483890057 CEST	51193	2121	192.168.2.16	38.86.75.247
May 8, 2024 08:41:52.484424114 CEST	51192	21	192.168.2.16	38.86.75.247
May 8, 2024 08:41:52.488495111 CEST	21	51213	79.11.173.175	192.168.2.16
May 8, 2024 08:41:52.494337082 CEST	21	51327	150.200.46.130	192.168.2.16
May 8, 2024 08:41:52.495006084 CEST	2121	51202	77.81.30.198	192.168.2.16
May 8, 2024 08:41:52.495764017 CEST	21	51201	77.81.30.198	192.168.2.16
May 8, 2024 08:41:52.499891043 CEST	51180	21	192.168.2.16	80.235.152.252
May 8, 2024 08:41:52.512625933 CEST	2121	51329	150.200.46.130	192.168.2.16
May 8, 2024 08:41:52.512897968 CEST	21	51317	23.229.188.101	192.168.2.16
May 8, 2024 08:41:52.513171911 CEST	51317	21	192.168.2.16	23.229.188.101
May 8, 2024 08:41:52.524754047 CEST	2121	51214	79.11.173.175	192.168.2.16
May 8, 2024 08:41:52.532299042 CEST	51342	2121	192.168.2.16	133.110.114.120
May 8, 2024 08:41:52.532330036 CEST	51343	21	192.168.2.16	133.110.114.120
May 8, 2024 08:41:52.542596102 CEST	2121	51124	46.206.172.28	192.168.2.16
May 8, 2024 08:41:52.547905922 CEST	51182	21	192.168.2.16	96.7.39.144
May 8, 2024 08:41:52.547924995 CEST	51187	2121	192.168.2.16	122.183.172.200
May 8, 2024 08:41:52.547925949 CEST	51185	2121	192.168.2.16	71.240.203.49
May 8, 2024 08:41:52.547924995 CEST	51188	21	192.168.2.16	94.5.216.180
May 8, 2024 08:41:52.548224926 CEST	51344	21	192.168.2.16	174.166.103.50
May 8, 2024 08:41:52.563893080 CEST	51191	2121	192.168.2.16	94.5.216.180
May 8, 2024 08:41:52.563916922 CEST	51181	2121	192.168.2.16	80.235.152.252
May 8, 2024 08:41:52.563916922 CEST	51186	21	192.168.2.16	122.183.172.200
May 8, 2024 08:41:52.563921928 CEST	51289	21	192.168.2.16	107.165.225.20
May 8, 2024 08:41:52.563921928 CEST	51184	21	192.168.2.16	71.240.203.49
May 8, 2024 08:41:52.563924074 CEST	51183	2121	192.168.2.16	96.7.39.144
May 8, 2024 08:41:52.564287901 CEST	51345	2121	192.168.2.16	174.166.103.50
May 8, 2024 08:41:52.564289093 CEST	51190	2121	192.168.2.16	104.81.109.177
May 8, 2024 08:41:52.578773975 CEST	2121	51179	51.211.40.188	192.168.2.16
May 8, 2024 08:41:52.579890966 CEST	51196	2121	192.168.2.16	70.72.201.17
May 8, 2024 08:41:52.579894066 CEST	51195	21	192.168.2.16	70.72.201.17
May 8, 2024 08:41:52.579895973 CEST	51194	21	192.168.2.16	104.81.109.177
May 8, 2024 08:41:52.583739042 CEST	21	51323	34.149.79.8	192.168.2.16
May 8, 2024 08:41:52.583806992 CEST	51323	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:52.583884954 CEST	51323	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:52.584089041 CEST	51346	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:52.586790085 CEST	2121	51325	34.149.79.8	192.168.2.16
May 8, 2024 08:41:52.586864948 CEST	51325	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:52.586981058 CEST	51325	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:52.587285995 CEST	51347	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:52.595882893 CEST	51197	21	192.168.2.16	79.82.134.13
May 8, 2024 08:41:52.595885038 CEST	51204	2121	192.168.2.16	47.161.35.149
May 8, 2024 08:41:52.595902920 CEST	51203	21	192.168.2.16	47.161.35.149
May 8, 2024 08:41:52.595902920 CEST	51207	21	192.168.2.16	178.184.188.200
May 8, 2024 08:41:52.595906973 CEST	51297	21	192.168.2.16	176.28.14.156
May 8, 2024 08:41:52.595910072 CEST	51205	21	192.168.2.16	207.178.68.216
May 8, 2024 08:41:52.595910072 CEST	51200	2121	192.168.2.16	93.42.72.190
May 8, 2024 08:41:52.611876011 CEST	51198	2121	192.168.2.16	79.82.134.13
May 8, 2024 08:41:52.611876011 CEST	51199	21	192.168.2.16	93.42.72.190
May 8, 2024 08:41:52.611901045 CEST	51206	2121	192.168.2.16	207.178.68.216
May 8, 2024 08:41:52.611902952 CEST	51208	2121	192.168.2.16	178.184.188.200
May 8, 2024 08:41:52.611903906 CEST	51211	21	192.168.2.16	161.81.19.198
May 8, 2024 08:41:52.627904892 CEST	51222	2121	192.168.2.16	129.247.240.147
May 8, 2024 08:41:52.627906084 CEST	51230	2121	192.168.2.16	201.138.118.97
May 8, 2024 08:41:52.627907038 CEST	51216	21	192.168.2.16	118.221.226.56
May 8, 2024 08:41:52.627907991 CEST	51215	21	192.168.2.16	189.250.118.186
May 8, 2024 08:41:52.627907991 CEST	51225	21	192.168.2.16	106.54.232.65
May 8, 2024 08:41:52.627908945 CEST	51212	2121	192.168.2.16	161.81.19.198
May 8, 2024 08:41:52.627933025 CEST	51220	21	192.168.2.16	129.247.240.147
May 8, 2024 08:41:52.627934933 CEST	51226	21	192.168.2.16	172.89.73.92
May 8, 2024 08:41:52.627934933 CEST	51219	21	192.168.2.16	87.200.130.103
May 8, 2024 08:41:52.627937078 CEST	51228	21	192.168.2.16	201.138.118.97
May 8, 2024 08:41:52.627937078 CEST	51223	21	192.168.2.16	188.81.130.104
May 8, 2024 08:41:52.627937078 CEST	51227	2121	192.168.2.16	172.89.73.92
May 8, 2024 08:41:52.627937078 CEST	51218	2121	192.168.2.16	118.221.226.56
May 8, 2024 08:41:52.627938986 CEST	51217	2121	192.168.2.16	189.250.118.186
May 8, 2024 08:41:52.628371954 CEST	51224	2121	192.168.2.16	188.81.130.104
May 8, 2024 08:41:52.628375053 CEST	51221	2121	192.168.2.16	87.200.130.103
May 8, 2024 08:41:52.628463030 CEST	51348	2121	192.168.2.16	80.137.127.179
May 8, 2024 08:41:52.628542900 CEST	51349	21	192.168.2.16	80.137.127.179
May 8, 2024 08:41:52.629730940 CEST	21	51135	96.126.118.190	192.168.2.16
May 8, 2024 08:41:52.630203962 CEST	51135	21	192.168.2.16	96.126.118.190
May 8, 2024 08:41:52.643892050 CEST	51235	21	192.168.2.16	27.219.156.111
May 8, 2024 08:41:52.643892050 CEST	51232	2121	192.168.2.16	94.7.190.193
May 8, 2024 08:41:52.643896103 CEST	51231	21	192.168.2.16	94.7.190.193
May 8, 2024 08:41:52.643918991 CEST	51229	2121	192.168.2.16	106.54.232.65
May 8, 2024 08:41:52.650917053 CEST	21	51275	171.244.37.116	192.168.2.16
May 8, 2024 08:41:52.651070118 CEST	51275	21	192.168.2.16	171.244.37.116
May 8, 2024 08:41:52.651318073 CEST	51351	21	192.168.2.16	171.244.37.116
May 8, 2024 08:41:52.654337883 CEST	2121	51137	96.126.118.190	192.168.2.16
May 8, 2024 08:41:52.654756069 CEST	51137	2121	192.168.2.16	96.126.118.190
May 8, 2024 08:41:52.660027027 CEST	51236	2121	192.168.2.16	27.219.156.111
May 8, 2024 08:41:52.677855968 CEST	21	51326	172.120.235.139	192.168.2.16
May 8, 2024 08:41:52.678044081 CEST	51326	21	192.168.2.16	172.120.235.139
May 8, 2024 08:41:52.689722061 CEST	21	51332	125.146.231.136	192.168.2.16
May 8, 2024 08:41:52.703892946 CEST	2121	51193	38.86.75.247	192.168.2.16
May 8, 2024 08:41:52.704415083 CEST	51353	21	192.168.2.16	86.124.233.164
May 8, 2024 08:41:52.704668045 CEST	21	51192	38.86.75.247	192.168.2.16
May 8, 2024 08:41:52.706882954 CEST	51292	2121	192.168.2.16	107.165.225.20
May 8, 2024 08:41:52.708551884 CEST	21	51317	23.229.188.101	192.168.2.16
May 8, 2024 08:41:52.708635092 CEST	21	51317	23.229.188.101	192.168.2.16
May 8, 2024 08:41:52.708807945 CEST	51317	21	192.168.2.16	23.229.188.101
May 8, 2024 08:41:52.719461918 CEST	2121	51333	125.146.231.136	192.168.2.16
May 8, 2024 08:41:52.723253965 CEST	51354	2121	192.168.2.16	86.124.233.164
May 8, 2024 08:41:52.725158930 CEST	21	51060	77.75.121.3	192.168.2.16
May 8, 2024 08:41:52.725254059 CEST	51060	21	192.168.2.16	77.75.121.3
May 8, 2024 08:41:52.725521088 CEST	21	51060	77.75.121.3	192.168.2.16
May 8, 2024 08:41:52.725584030 CEST	51060	21	192.168.2.16	77.75.121.3
May 8, 2024 08:41:52.730906963 CEST	21	51334	77.75.121.3	192.168.2.16
May 8, 2024 08:41:52.731005907 CEST	51334	21	192.168.2.16	77.75.121.3
May 8, 2024 08:41:52.738910913 CEST	51300	21	192.168.2.16	78.31.232.246
May 8, 2024 08:41:52.739356995 CEST	2121	51102	182.91.23.226	192.168.2.16
May 8, 2024 08:41:52.739398003 CEST	51241	21	192.168.2.16	50.193.20.246
May 8, 2024 08:41:52.739398003 CEST	51294	21	192.168.2.16	182.32.56.16
May 8, 2024 08:41:52.739865065 CEST	51293	2121	192.168.2.16	182.32.56.16
May 8, 2024 08:41:52.740180016 CEST	51272	21	192.168.2.16	129.226.194.19
May 8, 2024 08:41:52.749172926 CEST	21	51323	34.149.79.8	192.168.2.16
May 8, 2024 08:41:52.749660015 CEST	21	51346	34.149.79.8	192.168.2.16
May 8, 2024 08:41:52.749727964 CEST	21	51316	84.44.255.254	192.168.2.16
May 8, 2024 08:41:52.752026081 CEST	51346	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:52.752029896 CEST	51316	21	192.168.2.16	84.44.255.254
May 8, 2024 08:41:52.752161026 CEST	51316	21	192.168.2.16	84.44.255.254
May 8, 2024 08:41:52.752216101 CEST	2121	51325	34.149.79.8	192.168.2.16
May 8, 2024 08:41:52.752588987 CEST	51355	21	192.168.2.16	84.44.255.254
May 8, 2024 08:41:52.752722025 CEST	2121	51347	34.149.79.8	192.168.2.16
May 8, 2024 08:41:52.752795935 CEST	51347	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:52.754913092 CEST	51242	2121	192.168.2.16	50.193.20.246
May 8, 2024 08:41:52.755800962 CEST	21	51101	182.91.23.226	192.168.2.16
May 8, 2024 08:41:52.755865097 CEST	51295	21	192.168.2.16	98.35.179.149
May 8, 2024 08:41:52.758846998 CEST	21	51276	117.223.205.236	192.168.2.16
May 8, 2024 08:41:52.763396025 CEST	21	51276	117.223.205.236	192.168.2.16
May 8, 2024 08:41:52.763611078 CEST	51276	21	192.168.2.16	117.223.205.236
May 8, 2024 08:41:52.770898104 CEST	51243	21	192.168.2.16	27.9.54.22
May 8, 2024 08:41:52.771008968 CEST	51296	2121	192.168.2.16	98.35.179.149
May 8, 2024 08:41:52.771280050 CEST	51356	21	192.168.2.16	221.147.142.243
May 8, 2024 08:41:52.786894083 CEST	51302	2121	192.168.2.16	78.31.232.246
May 8, 2024 08:41:52.795233011 CEST	21	51341	91.146.97.65	192.168.2.16
May 8, 2024 08:41:52.795327902 CEST	51341	21	192.168.2.16	91.146.97.65
May 8, 2024 08:41:52.800522089 CEST	21	51273	91.146.97.65	192.168.2.16
May 8, 2024 08:41:52.800585032 CEST	51273	21	192.168.2.16	91.146.97.65
May 8, 2024 08:41:52.802947998 CEST	51299	2121	192.168.2.16	176.28.14.156
May 8, 2024 08:41:52.803410053 CEST	51357	2121	192.168.2.16	221.147.142.243
May 8, 2024 08:41:52.819224119 CEST	51358	21	192.168.2.16	105.157.100.252
May 8, 2024 08:41:52.836038113 CEST	21	51135	96.126.118.190	192.168.2.16
May 8, 2024 08:41:52.836626053 CEST	51135	21	192.168.2.16	96.126.118.190
May 8, 2024 08:41:52.851548910 CEST	51274	2121	192.168.2.16	129.226.194.19
May 8, 2024 08:41:52.859833956 CEST	21	51326	172.120.235.139	192.168.2.16
May 8, 2024 08:41:52.860093117 CEST	21	51326	172.120.235.139	192.168.2.16
May 8, 2024 08:41:52.860244989 CEST	51326	21	192.168.2.16	172.120.235.139
May 8, 2024 08:41:52.860913038 CEST	2121	51137	96.126.118.190	192.168.2.16
May 8, 2024 08:41:52.861345053 CEST	51137	2121	192.168.2.16	96.126.118.190
May 8, 2024 08:41:52.867141008 CEST	51361	2121	192.168.2.16	105.157.100.252
May 8, 2024 08:41:52.872786045 CEST	21	51269	196.210.0.111	192.168.2.16
May 8, 2024 08:41:52.883361101 CEST	51362	21	192.168.2.16	212.20.99.207
May 8, 2024 08:41:52.898897886 CEST	51245	21	192.168.2.16	73.44.53.187
May 8, 2024 08:41:52.898900986 CEST	51210	2121	192.168.2.16	59.28.241.113
May 8, 2024 08:41:52.899204969 CEST	51246	2121	192.168.2.16	27.9.54.22
May 8, 2024 08:41:52.899205923 CEST	51363	2121	192.168.2.16	212.20.99.207
May 8, 2024 08:41:52.904411077 CEST	21	51297	176.28.14.156	192.168.2.16
May 8, 2024 08:41:52.913955927 CEST	2121	51342	133.110.114.120	192.168.2.16
May 8, 2024 08:41:52.913994074 CEST	21	51343	133.110.114.120	192.168.2.16
May 8, 2024 08:41:52.914597988 CEST	21	51346	34.149.79.8	192.168.2.16
May 8, 2024 08:41:52.914673090 CEST	51346	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:52.914741993 CEST	51346	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:52.914850950 CEST	51209	21	192.168.2.16	59.28.241.113
May 8, 2024 08:41:52.914871931 CEST	51247	21	192.168.2.16	170.79.73.98
May 8, 2024 08:41:52.914875031 CEST	51312	2121	192.168.2.16	180.180.130.245
May 8, 2024 08:41:52.914974928 CEST	51248	2121	192.168.2.16	73.44.53.187
May 8, 2024 08:41:52.914974928 CEST	51364	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:52.914975882 CEST	51258	2121	192.168.2.16	120.24.160.35
May 8, 2024 08:41:52.915039062 CEST	2121	51347	34.149.79.8	192.168.2.16
May 8, 2024 08:41:52.915088892 CEST	51347	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:52.915205956 CEST	51347	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:52.915503025 CEST	51365	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:52.930659056 CEST	21	51122	46.206.172.28	192.168.2.16
May 8, 2024 08:41:52.939862967 CEST	51233	21	192.168.2.16	118.35.206.171
May 8, 2024 08:41:52.939963102 CEST	51303	21	192.168.2.16	5.228.65.50
May 8, 2024 08:41:52.944622040 CEST	21	51317	23.229.188.101	192.168.2.16
May 8, 2024 08:41:52.947155952 CEST	51366	21	192.168.2.16	45.137.53.127
May 8, 2024 08:41:52.962882996 CEST	51306	2121	192.168.2.16	5.228.65.50
May 8, 2024 08:41:52.962884903 CEST	51234	2121	192.168.2.16	118.35.206.171
May 8, 2024 08:41:52.978883028 CEST	51307	21	192.168.2.16	184.101.185.9
May 8, 2024 08:41:52.994862080 CEST	51213	21	192.168.2.16	79.11.173.175
May 8, 2024 08:41:52.994962931 CEST	51327	21	192.168.2.16	150.200.46.130
May 8, 2024 08:41:53.006874084 CEST	21	51351	171.244.37.116	192.168.2.16
May 8, 2024 08:41:53.006942987 CEST	51351	21	192.168.2.16	171.244.37.116
May 8, 2024 08:41:53.010886908 CEST	51201	21	192.168.2.16	77.81.30.198
May 8, 2024 08:41:53.010889053 CEST	51308	2121	192.168.2.16	184.101.185.9
May 8, 2024 08:41:53.010890961 CEST	51202	2121	192.168.2.16	77.81.30.198
May 8, 2024 08:41:53.011104107 CEST	51367	2121	192.168.2.16	45.137.53.127
May 8, 2024 08:41:53.023343086 CEST	21	51275	171.244.37.116	192.168.2.16
May 8, 2024 08:41:53.023354053 CEST	21	51275	171.244.37.116	192.168.2.16
May 8, 2024 08:41:53.023416996 CEST	51275	21	192.168.2.16	171.244.37.116
May 8, 2024 08:41:53.025852919 CEST	51329	2121	192.168.2.16	150.200.46.130
May 8, 2024 08:41:53.025876045 CEST	51214	2121	192.168.2.16	79.11.173.175
May 8, 2024 08:41:53.040903091 CEST	51311	21	192.168.2.16	180.180.130.245
May 8, 2024 08:41:53.041331053 CEST	51368	21	192.168.2.16	73.52.228.122
May 8, 2024 08:41:53.041388988 CEST	51369	2121	192.168.2.16	73.52.228.122
May 8, 2024 08:41:53.042433977 CEST	21	51135	96.126.118.190	192.168.2.16
May 8, 2024 08:41:53.042610884 CEST	51135	21	192.168.2.16	96.126.118.190
May 8, 2024 08:41:53.047853947 CEST	21	51334	77.75.121.3	192.168.2.16
May 8, 2024 08:41:53.048027039 CEST	51334	21	192.168.2.16	77.75.121.3
May 8, 2024 08:41:53.055911064 CEST	51313	21	192.168.2.16	5.38.137.244
May 8, 2024 08:41:53.067394018 CEST	2121	51137	96.126.118.190	192.168.2.16
May 8, 2024 08:41:53.067640066 CEST	51137	2121	192.168.2.16	96.126.118.190
May 8, 2024 08:41:53.069899082 CEST	21	51326	172.120.235.139	192.168.2.16
May 8, 2024 08:41:53.070054054 CEST	51326	21	192.168.2.16	172.120.235.139
May 8, 2024 08:41:53.070297003 CEST	51370	21	192.168.2.16	172.120.235.139
May 8, 2024 08:41:53.071513891 CEST	21	51316	84.44.255.254	192.168.2.16
May 8, 2024 08:41:53.071661949 CEST	21	51355	84.44.255.254	192.168.2.16
May 8, 2024 08:41:53.071731091 CEST	51355	21	192.168.2.16	84.44.255.254
May 8, 2024 08:41:53.071877003 CEST	51314	2121	192.168.2.16	5.38.137.244
May 8, 2024 08:41:53.077090025 CEST	21	51346	34.149.79.8	192.168.2.16
May 8, 2024 08:41:53.077299118 CEST	2121	51347	34.149.79.8	192.168.2.16
May 8, 2024 08:41:53.077338934 CEST	21	51364	34.149.79.8	192.168.2.16
May 8, 2024 08:41:53.077404976 CEST	51364	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:53.077600002 CEST	2121	51365	34.149.79.8	192.168.2.16
May 8, 2024 08:41:53.077656984 CEST	51365	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:53.087892056 CEST	51251	2121	192.168.2.16	170.79.73.98
May 8, 2024 08:41:53.087892056 CEST	51315	21	192.168.2.16	121.24.207.37
May 8, 2024 08:41:53.087893009 CEST	51179	2121	192.168.2.16	51.211.40.188
May 8, 2024 08:41:53.088340998 CEST	51371	2121	192.168.2.16	113.60.190.93
May 8, 2024 08:41:53.088413000 CEST	51372	21	192.168.2.16	113.60.190.93
May 8, 2024 08:41:53.088440895 CEST	51373	21	192.168.2.16	115.215.136.173
May 8, 2024 08:41:53.100584030 CEST	21	51272	129.226.194.19	192.168.2.16
May 8, 2024 08:41:53.120309114 CEST	51374	2121	192.168.2.16	115.215.136.173
May 8, 2024 08:41:53.120398045 CEST	51375	21	192.168.2.16	85.193.161.88
May 8, 2024 08:41:53.152407885 CEST	51376	2121	192.168.2.16	85.193.161.88
May 8, 2024 08:41:53.152441978 CEST	51377	21	192.168.2.16	110.249.97.179
May 8, 2024 08:41:53.152513027 CEST	51378	2121	192.168.2.16	110.249.97.179
May 8, 2024 08:41:53.152651072 CEST	51379	21	192.168.2.16	178.49.104.150
May 8, 2024 08:41:53.155858040 CEST	21	51341	91.146.97.65	192.168.2.16
May 8, 2024 08:41:53.155870914 CEST	21	51300	78.31.232.246	192.168.2.16
May 8, 2024 08:41:53.156044006 CEST	51341	21	192.168.2.16	91.146.97.65
May 8, 2024 08:41:53.167924881 CEST	51318	2121	192.168.2.16	121.24.207.37
May 8, 2024 08:41:53.168447971 CEST	51380	2121	192.168.2.16	178.49.104.150
May 8, 2024 08:41:53.168473959 CEST	51381	21	192.168.2.16	39.86.125.77
May 8, 2024 08:41:53.197772026 CEST	2121	51302	78.31.232.246	192.168.2.16
May 8, 2024 08:41:53.199889898 CEST	51332	21	192.168.2.16	125.146.231.136
May 8, 2024 08:41:53.200508118 CEST	51382	21	192.168.2.16	111.74.121.214
May 8, 2024 08:41:53.200562000 CEST	51383	2121	192.168.2.16	39.86.125.77
May 8, 2024 08:41:53.200659037 CEST	51384	2121	192.168.2.16	111.74.121.214
May 8, 2024 08:41:53.200779915 CEST	51386	2121	192.168.2.16	203.81.154.1
May 8, 2024 08:41:53.200779915 CEST	51385	21	192.168.2.16	203.81.154.1
May 8, 2024 08:41:53.200800896 CEST	51387	21	192.168.2.16	117.1.181.3
May 8, 2024 08:41:53.210788012 CEST	2121	51210	59.28.241.113	192.168.2.16
May 8, 2024 08:41:53.216316938 CEST	51388	2121	192.168.2.16	117.1.181.3
May 8, 2024 08:41:53.216408968 CEST	51389	21	192.168.2.16	88.23.224.156
May 8, 2024 08:41:53.221000910 CEST	2121	51274	129.226.194.19	192.168.2.16
May 8, 2024 08:41:53.231201887 CEST	21	51209	59.28.241.113	192.168.2.16
May 8, 2024 08:41:53.231880903 CEST	51333	2121	192.168.2.16	125.146.231.136
May 8, 2024 08:41:53.232429981 CEST	51390	21	192.168.2.16	211.238.76.67
May 8, 2024 08:41:53.232454062 CEST	51391	2121	192.168.2.16	211.238.76.67
May 8, 2024 08:41:53.232562065 CEST	51392	2121	192.168.2.16	88.23.224.156
May 8, 2024 08:41:53.239787102 CEST	21	51364	34.149.79.8	192.168.2.16
May 8, 2024 08:41:53.239855051 CEST	2121	51365	34.149.79.8	192.168.2.16
May 8, 2024 08:41:53.239878893 CEST	51364	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:53.239902973 CEST	51365	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:53.239936113 CEST	51364	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:53.240062952 CEST	51365	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:53.240217924 CEST	51393	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:53.240310907 CEST	51394	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:53.247889042 CEST	51322	2121	192.168.2.16	149.81.82.210
May 8, 2024 08:41:53.247889042 CEST	51254	2121	192.168.2.16	34.160.4.184
May 8, 2024 08:41:53.248507023 CEST	2121	51258	120.24.160.35	192.168.2.16
May 8, 2024 08:41:53.248519897 CEST	21	51135	96.126.118.190	192.168.2.16
May 8, 2024 08:41:53.248523951 CEST	51321	21	192.168.2.16	149.81.82.210
May 8, 2024 08:41:53.248749018 CEST	51395	21	192.168.2.16	108.238.40.177
May 8, 2024 08:41:53.248862028 CEST	51396	2121	192.168.2.16	108.238.40.177
May 8, 2024 08:41:53.248923063 CEST	51397	21	192.168.2.16	102.117.3.196
May 8, 2024 08:41:53.249176025 CEST	51135	21	192.168.2.16	96.126.118.190
May 8, 2024 08:41:53.249356985 CEST	51399	21	192.168.2.16	96.126.118.190
May 8, 2024 08:41:53.251862049 CEST	21	51326	172.120.235.139	192.168.2.16
May 8, 2024 08:41:53.251919031 CEST	51326	21	192.168.2.16	172.120.235.139
May 8, 2024 08:41:53.251986027 CEST	21	51370	172.120.235.139	192.168.2.16
May 8, 2024 08:41:53.252047062 CEST	51370	21	192.168.2.16	172.120.235.139
May 8, 2024 08:41:53.253350973 CEST	21	51233	118.35.206.171	192.168.2.16
May 8, 2024 08:41:53.259452105 CEST	21	51366	45.137.53.127	192.168.2.16
May 8, 2024 08:41:53.263859034 CEST	51324	21	192.168.2.16	65.21.181.166
May 8, 2024 08:41:53.263891935 CEST	51253	21	192.168.2.16	34.160.4.184
May 8, 2024 08:41:53.263894081 CEST	21	51276	117.223.205.236	192.168.2.16
May 8, 2024 08:41:53.264054060 CEST	51400	2121	192.168.2.16	102.117.3.196
May 8, 2024 08:41:53.273909092 CEST	2121	51137	96.126.118.190	192.168.2.16
May 8, 2024 08:41:53.274200916 CEST	51137	2121	192.168.2.16	96.126.118.190
May 8, 2024 08:41:53.274328947 CEST	51402	2121	192.168.2.16	96.126.118.190
May 8, 2024 08:41:53.279876947 CEST	51328	2121	192.168.2.16	65.21.181.166
May 8, 2024 08:41:53.282211065 CEST	2121	51234	118.35.206.171	192.168.2.16
May 8, 2024 08:41:53.282996893 CEST	2121	51312	180.180.130.245	192.168.2.16
May 8, 2024 08:41:53.295088053 CEST	51403	21	192.168.2.16	187.192.56.78
May 8, 2024 08:41:53.326873064 CEST	51330	21	192.168.2.16	111.194.232.122
May 8, 2024 08:41:53.327172995 CEST	2121	51367	45.137.53.127	192.168.2.16
May 8, 2024 08:41:53.334718943 CEST	21	51213	79.11.173.175	192.168.2.16
May 8, 2024 08:41:53.357887030 CEST	51331	2121	192.168.2.16	111.194.232.122
May 8, 2024 08:41:53.358468056 CEST	51404	2121	192.168.2.16	187.192.56.78
May 8, 2024 08:41:53.358485937 CEST	21	51201	77.81.30.198	192.168.2.16
May 8, 2024 08:41:53.358499050 CEST	2121	51202	77.81.30.198	192.168.2.16
May 8, 2024 08:41:53.358949900 CEST	51405	21	192.168.2.16	216.58.210.149
May 8, 2024 08:41:53.365276098 CEST	21	51351	171.244.37.116	192.168.2.16
May 8, 2024 08:41:53.365286112 CEST	21	51334	77.75.121.3	192.168.2.16
May 8, 2024 08:41:53.365295887 CEST	21	51334	77.75.121.3	192.168.2.16
May 8, 2024 08:41:53.365447998 CEST	51334	21	192.168.2.16	77.75.121.3
May 8, 2024 08:41:53.365523100 CEST	51351	21	192.168.2.16	171.244.37.116
May 8, 2024 08:41:53.372582912 CEST	2121	51214	79.11.173.175	192.168.2.16
May 8, 2024 08:41:53.374138117 CEST	51406	2121	192.168.2.16	216.58.210.149
May 8, 2024 08:41:53.389863968 CEST	51259	2121	192.168.2.16	223.239.97.194
May 8, 2024 08:41:53.389878035 CEST	51260	21	192.168.2.16	223.239.97.194
May 8, 2024 08:41:53.390152931 CEST	51407	21	192.168.2.16	23.6.177.110
May 8, 2024 08:41:53.392069101 CEST	21	51355	84.44.255.254	192.168.2.16
May 8, 2024 08:41:53.392142057 CEST	51355	21	192.168.2.16	84.44.255.254
May 8, 2024 08:41:53.392210007 CEST	51355	21	192.168.2.16	84.44.255.254
May 8, 2024 08:41:53.392415047 CEST	51408	21	192.168.2.16	84.44.255.254
May 8, 2024 08:41:53.402968884 CEST	2121	51365	34.149.79.8	192.168.2.16
May 8, 2024 08:41:53.402978897 CEST	21	51364	34.149.79.8	192.168.2.16
May 8, 2024 08:41:53.402991056 CEST	2121	51394	34.149.79.8	192.168.2.16
May 8, 2024 08:41:53.403013945 CEST	21	51393	34.149.79.8	192.168.2.16
May 8, 2024 08:41:53.403093100 CEST	51394	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:53.403107882 CEST	51393	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:53.405929089 CEST	51297	21	192.168.2.16	176.28.14.156
May 8, 2024 08:41:53.406532049 CEST	51410	2121	192.168.2.16	174.81.191.5
May 8, 2024 08:41:53.406533003 CEST	51409	2121	192.168.2.16	23.6.177.110
May 8, 2024 08:41:53.406562090 CEST	51411	21	192.168.2.16	174.81.191.5
May 8, 2024 08:41:53.421880007 CEST	51343	21	192.168.2.16	133.110.114.120
May 8, 2024 08:41:53.421881914 CEST	51342	2121	192.168.2.16	133.110.114.120
May 8, 2024 08:41:53.422010899 CEST	51336	2121	192.168.2.16	181.205.168.30
May 8, 2024 08:41:53.422013044 CEST	51335	21	192.168.2.16	181.205.168.30
May 8, 2024 08:41:53.422018051 CEST	51337	21	192.168.2.16	145.109.20.146
May 8, 2024 08:41:53.422189951 CEST	51412	21	192.168.2.16	20.201.1.215
May 8, 2024 08:41:53.453891993 CEST	51340	2121	192.168.2.16	145.109.20.146
May 8, 2024 08:41:53.454313040 CEST	51413	21	192.168.2.16	98.176.20.188
May 8, 2024 08:41:53.454415083 CEST	51414	2121	192.168.2.16	20.201.1.215
May 8, 2024 08:41:53.455553055 CEST	21	51399	96.126.118.190	192.168.2.16
May 8, 2024 08:41:53.455665112 CEST	51399	21	192.168.2.16	96.126.118.190
May 8, 2024 08:41:53.470484018 CEST	51415	2121	192.168.2.16	98.176.20.188
May 8, 2024 08:41:53.470691919 CEST	51416	21	192.168.2.16	90.195.126.22
May 8, 2024 08:41:53.475403070 CEST	21	51370	172.120.235.139	192.168.2.16
May 8, 2024 08:41:53.475531101 CEST	51370	21	192.168.2.16	172.120.235.139
May 8, 2024 08:41:53.480365038 CEST	2121	51402	96.126.118.190	192.168.2.16
May 8, 2024 08:41:53.480429888 CEST	51402	2121	192.168.2.16	96.126.118.190
May 8, 2024 08:41:53.486221075 CEST	2121	51179	51.211.40.188	192.168.2.16
May 8, 2024 08:41:53.486613035 CEST	51417	2121	192.168.2.16	90.195.126.22
May 8, 2024 08:41:53.496875048 CEST	21	51341	91.146.97.65	192.168.2.16
May 8, 2024 08:41:53.497109890 CEST	21	51341	91.146.97.65	192.168.2.16
May 8, 2024 08:41:53.497304916 CEST	51341	21	192.168.2.16	91.146.97.65
May 8, 2024 08:41:53.497806072 CEST	21	51135	96.126.118.190	192.168.2.16
May 8, 2024 08:41:53.516937017 CEST	21	51332	125.146.231.136	192.168.2.16
May 8, 2024 08:41:53.518349886 CEST	51418	21	192.168.2.16	84.193.152.151
May 8, 2024 08:41:53.521164894 CEST	2121	51137	96.126.118.190	192.168.2.16
May 8, 2024 08:41:53.526316881 CEST	21	51377	110.249.97.179	192.168.2.16
May 8, 2024 08:41:53.528984070 CEST	2121	51378	110.249.97.179	192.168.2.16
May 8, 2024 08:41:53.532321930 CEST	21	51379	178.49.104.150	192.168.2.16
May 8, 2024 08:41:53.534415007 CEST	51419	2121	192.168.2.16	84.193.152.151
May 8, 2024 08:41:53.534893036 CEST	51420	21	192.168.2.16	123.121.72.14
May 8, 2024 08:41:53.538008928 CEST	2121	51380	178.49.104.150	192.168.2.16
May 8, 2024 08:41:53.538175106 CEST	2121	51386	203.81.154.1	192.168.2.16
May 8, 2024 08:41:53.541796923 CEST	21	51385	203.81.154.1	192.168.2.16
May 8, 2024 08:41:53.547795057 CEST	2121	51333	125.146.231.136	192.168.2.16
May 8, 2024 08:41:53.549875975 CEST	51262	21	192.168.2.16	72.201.18.23
May 8, 2024 08:41:53.550240040 CEST	51421	2121	192.168.2.16	123.121.72.14
May 8, 2024 08:41:53.551525116 CEST	51344	21	192.168.2.16	174.166.103.50
May 8, 2024 08:41:53.565640926 CEST	21	51393	34.149.79.8	192.168.2.16
May 8, 2024 08:41:53.565706015 CEST	51393	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:53.565737009 CEST	2121	51394	34.149.79.8	192.168.2.16
May 8, 2024 08:41:53.565790892 CEST	51393	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:53.565792084 CEST	51394	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:53.565885067 CEST	51263	2121	192.168.2.16	72.201.18.23
May 8, 2024 08:41:53.565886974 CEST	51345	2121	192.168.2.16	174.166.103.50
May 8, 2024 08:41:53.566080093 CEST	51394	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:53.566325903 CEST	51422	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:53.566409111 CEST	51423	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:53.566494942 CEST	51424	21	192.168.2.16	89.146.188.50
May 8, 2024 08:41:53.566517115 CEST	51425	2121	192.168.2.16	89.146.188.50
May 8, 2024 08:41:53.613889933 CEST	51272	21	192.168.2.16	129.226.194.19
May 8, 2024 08:41:53.613908052 CEST	51098	21	192.168.2.16	38.38.120.85
May 8, 2024 08:41:53.614084005 CEST	51426	21	192.168.2.16	38.38.120.85
May 8, 2024 08:41:53.629864931 CEST	51348	2121	192.168.2.16	80.137.127.179
May 8, 2024 08:41:53.629884005 CEST	51349	21	192.168.2.16	80.137.127.179
May 8, 2024 08:41:53.630166054 CEST	51427	21	192.168.2.16	153.34.181.233
May 8, 2024 08:41:53.645859957 CEST	51266	21	192.168.2.16	5.141.181.221
May 8, 2024 08:41:53.657300949 CEST	21	51370	172.120.235.139	192.168.2.16
May 8, 2024 08:41:53.657634974 CEST	21	51370	172.120.235.139	192.168.2.16
May 8, 2024 08:41:53.657783985 CEST	51370	21	192.168.2.16	172.120.235.139
May 8, 2024 08:41:53.661897898 CEST	51300	21	192.168.2.16	78.31.232.246
May 8, 2024 08:41:53.677865982 CEST	51267	2121	192.168.2.16	5.141.181.221
May 8, 2024 08:41:53.709871054 CEST	51353	21	192.168.2.16	86.124.233.164
May 8, 2024 08:41:53.709883928 CEST	51302	2121	192.168.2.16	78.31.232.246
May 8, 2024 08:41:53.711358070 CEST	21	51355	84.44.255.254	192.168.2.16
May 8, 2024 08:41:53.711983919 CEST	21	51408	84.44.255.254	192.168.2.16
May 8, 2024 08:41:53.712047100 CEST	51408	21	192.168.2.16	84.44.255.254
May 8, 2024 08:41:53.713042021 CEST	21	51297	176.28.14.156	192.168.2.16
May 8, 2024 08:41:53.720602989 CEST	21	51351	171.244.37.116	192.168.2.16
May 8, 2024 08:41:53.720716000 CEST	51351	21	192.168.2.16	171.244.37.116
May 8, 2024 08:41:53.720935106 CEST	21	51334	77.75.121.3	192.168.2.16
May 8, 2024 08:41:53.725872993 CEST	51274	2121	192.168.2.16	129.226.194.19
May 8, 2024 08:41:53.726007938 CEST	51354	2121	192.168.2.16	86.124.233.164
May 8, 2024 08:41:53.728085995 CEST	21	51393	34.149.79.8	192.168.2.16
May 8, 2024 08:41:53.728260040 CEST	2121	51394	34.149.79.8	192.168.2.16
May 8, 2024 08:41:53.728708029 CEST	21	51422	34.149.79.8	192.168.2.16
May 8, 2024 08:41:53.728768110 CEST	51422	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:53.728827000 CEST	2121	51423	34.149.79.8	192.168.2.16
May 8, 2024 08:41:53.728879929 CEST	51423	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:53.771867037 CEST	51258	2121	192.168.2.16	120.24.160.35
May 8, 2024 08:41:53.771874905 CEST	51366	21	192.168.2.16	45.137.53.127
May 8, 2024 08:41:53.772929907 CEST	51356	21	192.168.2.16	221.147.142.243
May 8, 2024 08:41:53.773369074 CEST	51428	2121	192.168.2.16	153.34.181.233
May 8, 2024 08:41:53.787889957 CEST	51312	2121	192.168.2.16	180.180.130.245
May 8, 2024 08:41:53.787909031 CEST	51145	2121	192.168.2.16	62.140.135.146
May 8, 2024 08:41:53.787975073 CEST	51144	21	192.168.2.16	62.140.135.146
May 8, 2024 08:41:53.788465977 CEST	51429	21	192.168.2.16	68.48.137.180
May 8, 2024 08:41:53.788471937 CEST	51430	21	192.168.2.16	117.200.110.191
May 8, 2024 08:41:53.788515091 CEST	51431	2121	192.168.2.16	68.48.137.180
May 8, 2024 08:41:53.791734934 CEST	2121	51342	133.110.114.120	192.168.2.16
May 8, 2024 08:41:53.791806936 CEST	21	51343	133.110.114.120	192.168.2.16
May 8, 2024 08:41:53.803404093 CEST	51432	2121	192.168.2.16	117.200.110.191
May 8, 2024 08:41:53.803440094 CEST	51433	21	192.168.2.16	193.77.90.44
May 8, 2024 08:41:53.803515911 CEST	51434	2121	192.168.2.16	193.77.90.44
May 8, 2024 08:41:53.806205988 CEST	21	51426	38.38.120.85	192.168.2.16
May 8, 2024 08:41:53.806272030 CEST	51426	21	192.168.2.16	38.38.120.85
May 8, 2024 08:41:53.818872929 CEST	51357	2121	192.168.2.16	221.147.142.243
May 8, 2024 08:41:53.818892956 CEST	51358	21	192.168.2.16	105.157.100.252
May 8, 2024 08:41:53.834887981 CEST	51367	2121	192.168.2.16	45.137.53.127
May 8, 2024 08:41:53.835220098 CEST	51435	21	192.168.2.16	92.236.244.44
May 8, 2024 08:41:53.842494965 CEST	21	51269	196.210.0.111	192.168.2.16
May 8, 2024 08:41:53.842659950 CEST	51269	21	192.168.2.16	196.210.0.111
May 8, 2024 08:41:53.842729092 CEST	21	51098	38.38.120.85	192.168.2.16
May 8, 2024 08:41:53.842850924 CEST	51436	21	192.168.2.16	196.210.0.111
May 8, 2024 08:41:53.843862057 CEST	21	51341	91.146.97.65	192.168.2.16
May 8, 2024 08:41:53.844000101 CEST	51341	21	192.168.2.16	91.146.97.65
May 8, 2024 08:41:53.844221115 CEST	51437	21	192.168.2.16	91.146.97.65
May 8, 2024 08:41:53.845170975 CEST	21	51098	38.38.120.85	192.168.2.16
May 8, 2024 08:41:53.845218897 CEST	51098	21	192.168.2.16	38.38.120.85
May 8, 2024 08:41:53.845220089 CEST	21	51098	38.38.120.85	192.168.2.16
May 8, 2024 08:41:53.845264912 CEST	51098	21	192.168.2.16	38.38.120.85
May 8, 2024 08:41:53.845710993 CEST	21	51098	38.38.120.85	192.168.2.16
May 8, 2024 08:41:53.845757008 CEST	51098	21	192.168.2.16	38.38.120.85
May 8, 2024 08:41:53.866893053 CEST	21	51370	172.120.235.139	192.168.2.16
May 8, 2024 08:41:53.866991997 CEST	51370	21	192.168.2.16	172.120.235.139
May 8, 2024 08:41:53.867131948 CEST	51438	21	192.168.2.16	172.120.235.139
May 8, 2024 08:41:53.882947922 CEST	51361	2121	192.168.2.16	105.157.100.252
May 8, 2024 08:41:53.891201019 CEST	21	51422	34.149.79.8	192.168.2.16
May 8, 2024 08:41:53.891266108 CEST	51422	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:53.891324997 CEST	2121	51423	34.149.79.8	192.168.2.16
May 8, 2024 08:41:53.891383886 CEST	51422	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:53.891386032 CEST	51423	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:53.891518116 CEST	51423	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:53.891711950 CEST	51439	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:53.891913891 CEST	51440	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:53.898885965 CEST	51362	21	192.168.2.16	212.20.99.207
May 8, 2024 08:41:53.913891077 CEST	51363	2121	192.168.2.16	212.20.99.207
May 8, 2024 08:41:53.975518942 CEST	21	51272	129.226.194.19	192.168.2.16
May 8, 2024 08:41:53.994245052 CEST	51441	2121	192.168.2.16	92.236.244.44
May 8, 2024 08:41:54.000610113 CEST	21	51426	38.38.120.85	192.168.2.16
May 8, 2024 08:41:54.000799894 CEST	51426	21	192.168.2.16	38.38.120.85
May 8, 2024 08:41:54.025890112 CEST	51332	21	192.168.2.16	125.146.231.136
May 8, 2024 08:41:54.031903028 CEST	21	51408	84.44.255.254	192.168.2.16
May 8, 2024 08:41:54.032006979 CEST	51408	21	192.168.2.16	84.44.255.254
May 8, 2024 08:41:54.032047987 CEST	51408	21	192.168.2.16	84.44.255.254
May 8, 2024 08:41:54.032298088 CEST	51442	21	192.168.2.16	84.44.255.254
May 8, 2024 08:41:54.041858912 CEST	51377	21	192.168.2.16	110.249.97.179
May 8, 2024 08:41:54.041861057 CEST	51378	2121	192.168.2.16	110.249.97.179
May 8, 2024 08:41:54.041879892 CEST	51386	2121	192.168.2.16	203.81.154.1
May 8, 2024 08:41:54.041881084 CEST	51380	2121	192.168.2.16	178.49.104.150
May 8, 2024 08:41:54.041887045 CEST	51379	21	192.168.2.16	178.49.104.150
May 8, 2024 08:41:54.042004108 CEST	51385	21	192.168.2.16	203.81.154.1
May 8, 2024 08:41:54.042006969 CEST	51369	2121	192.168.2.16	73.52.228.122
May 8, 2024 08:41:54.042007923 CEST	51368	21	192.168.2.16	73.52.228.122
May 8, 2024 08:41:54.050024986 CEST	21	51438	172.120.235.139	192.168.2.16
May 8, 2024 08:41:54.050035954 CEST	21	51370	172.120.235.139	192.168.2.16
May 8, 2024 08:41:54.050091982 CEST	51370	21	192.168.2.16	172.120.235.139
May 8, 2024 08:41:54.050112009 CEST	51438	21	192.168.2.16	172.120.235.139
May 8, 2024 08:41:54.054025888 CEST	21	51422	34.149.79.8	192.168.2.16
May 8, 2024 08:41:54.054037094 CEST	2121	51423	34.149.79.8	192.168.2.16
May 8, 2024 08:41:54.054193974 CEST	21	51439	34.149.79.8	192.168.2.16
May 8, 2024 08:41:54.054204941 CEST	2121	51440	34.149.79.8	192.168.2.16
May 8, 2024 08:41:54.054260969 CEST	51439	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:54.054336071 CEST	51440	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:54.057852983 CEST	51333	2121	192.168.2.16	125.146.231.136
May 8, 2024 08:41:54.078326941 CEST	21	51351	171.244.37.116	192.168.2.16
May 8, 2024 08:41:54.078464031 CEST	51351	21	192.168.2.16	171.244.37.116
May 8, 2024 08:41:54.078655958 CEST	51443	21	192.168.2.16	171.244.37.116
May 8, 2024 08:41:54.078860998 CEST	21	51300	78.31.232.246	192.168.2.16
May 8, 2024 08:41:54.084425926 CEST	21	51366	45.137.53.127	192.168.2.16
May 8, 2024 08:41:54.089863062 CEST	51372	21	192.168.2.16	113.60.190.93
May 8, 2024 08:41:54.089883089 CEST	51373	21	192.168.2.16	115.215.136.173
May 8, 2024 08:41:54.089925051 CEST	51371	2121	192.168.2.16	113.60.190.93
May 8, 2024 08:41:54.095362902 CEST	2121	51274	129.226.194.19	192.168.2.16
May 8, 2024 08:41:54.105298996 CEST	2121	51258	120.24.160.35	192.168.2.16
May 8, 2024 08:41:54.105827093 CEST	51444	21	192.168.2.16	110.231.228.49
May 8, 2024 08:41:54.121902943 CEST	51375	21	192.168.2.16	85.193.161.88
May 8, 2024 08:41:54.121902943 CEST	51374	2121	192.168.2.16	115.215.136.173
May 8, 2024 08:41:54.121923923 CEST	2121	51302	78.31.232.246	192.168.2.16
May 8, 2024 08:41:54.151436090 CEST	2121	51367	45.137.53.127	192.168.2.16
May 8, 2024 08:41:54.153879881 CEST	51376	2121	192.168.2.16	85.193.161.88
May 8, 2024 08:41:54.156970024 CEST	2121	51312	180.180.130.245	192.168.2.16
May 8, 2024 08:41:54.168886900 CEST	51381	21	192.168.2.16	39.86.125.77
May 8, 2024 08:41:54.192334890 CEST	21	51341	91.146.97.65	192.168.2.16
May 8, 2024 08:41:54.192388058 CEST	51341	21	192.168.2.16	91.146.97.65
May 8, 2024 08:41:54.193413973 CEST	21	51426	38.38.120.85	192.168.2.16
May 8, 2024 08:41:54.193562031 CEST	21	51426	38.38.120.85	192.168.2.16
May 8, 2024 08:41:54.193727016 CEST	51426	21	192.168.2.16	38.38.120.85
May 8, 2024 08:41:54.194453001 CEST	21	51437	91.146.97.65	192.168.2.16
May 8, 2024 08:41:54.194519997 CEST	51437	21	192.168.2.16	91.146.97.65
May 8, 2024 08:41:54.200876951 CEST	51383	2121	192.168.2.16	39.86.125.77
May 8, 2024 08:41:54.200890064 CEST	51382	21	192.168.2.16	111.74.121.214
May 8, 2024 08:41:54.200890064 CEST	51384	2121	192.168.2.16	111.74.121.214
May 8, 2024 08:41:54.200921059 CEST	51387	21	192.168.2.16	117.1.181.3
May 8, 2024 08:41:54.216095924 CEST	51297	21	192.168.2.16	176.28.14.156
May 8, 2024 08:41:54.216285944 CEST	51445	2121	192.168.2.16	110.231.228.49
May 8, 2024 08:41:54.217220068 CEST	2121	51440	34.149.79.8	192.168.2.16
May 8, 2024 08:41:54.217276096 CEST	51440	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:54.217370033 CEST	21	51439	34.149.79.8	192.168.2.16
May 8, 2024 08:41:54.217389107 CEST	51440	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:54.217433929 CEST	51439	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:54.217586040 CEST	51439	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:54.217783928 CEST	51447	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:54.217786074 CEST	51446	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:54.229825974 CEST	21	51430	117.200.110.191	192.168.2.16
May 8, 2024 08:41:54.230900049 CEST	51389	21	192.168.2.16	88.23.224.156
May 8, 2024 08:41:54.230902910 CEST	51388	2121	192.168.2.16	117.1.181.3
May 8, 2024 08:41:54.231319904 CEST	51448	21	192.168.2.16	58.38.224.136
May 8, 2024 08:41:54.239648104 CEST	2121	51432	117.200.110.191	192.168.2.16
May 8, 2024 08:41:54.246876001 CEST	51391	2121	192.168.2.16	211.238.76.67
May 8, 2024 08:41:54.246877909 CEST	51392	2121	192.168.2.16	88.23.224.156
May 8, 2024 08:41:54.246889114 CEST	51390	21	192.168.2.16	211.238.76.67
May 8, 2024 08:41:54.262857914 CEST	51397	21	192.168.2.16	102.117.3.196
May 8, 2024 08:41:54.262865067 CEST	51395	21	192.168.2.16	108.238.40.177
May 8, 2024 08:41:54.262886047 CEST	51396	2121	192.168.2.16	108.238.40.177
May 8, 2024 08:41:54.273279905 CEST	21	51438	172.120.235.139	192.168.2.16
May 8, 2024 08:41:54.273471117 CEST	51438	21	192.168.2.16	172.120.235.139
May 8, 2024 08:41:54.274365902 CEST	21	51276	117.223.205.236	192.168.2.16
May 8, 2024 08:41:54.274487972 CEST	51276	21	192.168.2.16	117.223.205.236
May 8, 2024 08:41:54.274857998 CEST	51449	21	192.168.2.16	117.223.205.236
May 8, 2024 08:41:54.278867006 CEST	51400	2121	192.168.2.16	102.117.3.196
May 8, 2024 08:41:54.294872046 CEST	51342	2121	192.168.2.16	133.110.114.120
May 8, 2024 08:41:54.294934034 CEST	51343	21	192.168.2.16	133.110.114.120
May 8, 2024 08:41:54.294939995 CEST	51403	21	192.168.2.16	187.192.56.78
May 8, 2024 08:41:54.294940948 CEST	51278	21	192.168.2.16	34.148.107.109
May 8, 2024 08:41:54.324850082 CEST	21	51269	196.210.0.111	192.168.2.16
May 8, 2024 08:41:54.324923992 CEST	51269	21	192.168.2.16	196.210.0.111
May 8, 2024 08:41:54.327277899 CEST	51450	2121	192.168.2.16	58.38.224.136
May 8, 2024 08:41:54.336249113 CEST	21	51436	196.210.0.111	192.168.2.16
May 8, 2024 08:41:54.336322069 CEST	51436	21	192.168.2.16	196.210.0.111
May 8, 2024 08:41:54.343075991 CEST	21	51332	125.146.231.136	192.168.2.16
May 8, 2024 08:41:54.343106985 CEST	51451	21	192.168.2.16	79.150.203.72
May 8, 2024 08:41:54.351670027 CEST	21	51408	84.44.255.254	192.168.2.16
May 8, 2024 08:41:54.351716995 CEST	21	51442	84.44.255.254	192.168.2.16
May 8, 2024 08:41:54.351777077 CEST	51442	21	192.168.2.16	84.44.255.254
May 8, 2024 08:41:54.358850956 CEST	51282	21	192.168.2.16	191.177.131.3
May 8, 2024 08:41:54.358884096 CEST	51281	2121	192.168.2.16	34.148.107.109
May 8, 2024 08:41:54.359033108 CEST	51404	2121	192.168.2.16	187.192.56.78
May 8, 2024 08:41:54.373619080 CEST	2121	51333	125.146.231.136	192.168.2.16
May 8, 2024 08:41:54.374875069 CEST	51405	21	192.168.2.16	216.58.210.149
May 8, 2024 08:41:54.374876022 CEST	51283	2121	192.168.2.16	191.177.131.3
May 8, 2024 08:41:54.379538059 CEST	2121	51440	34.149.79.8	192.168.2.16
May 8, 2024 08:41:54.379920006 CEST	21	51439	34.149.79.8	192.168.2.16
May 8, 2024 08:41:54.379949093 CEST	51406	2121	192.168.2.16	216.58.210.149
May 8, 2024 08:41:54.379981995 CEST	21	51447	34.149.79.8	192.168.2.16
May 8, 2024 08:41:54.380044937 CEST	51447	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:54.380218983 CEST	2121	51446	34.149.79.8	192.168.2.16
May 8, 2024 08:41:54.380270004 CEST	51446	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:54.390873909 CEST	51284	21	192.168.2.16	136.36.71.102
May 8, 2024 08:41:54.390876055 CEST	51285	2121	192.168.2.16	136.36.71.102
May 8, 2024 08:41:54.391562939 CEST	51407	21	192.168.2.16	23.6.177.110
May 8, 2024 08:41:54.402894020 CEST	2121	51386	203.81.154.1	192.168.2.16
May 8, 2024 08:41:54.406900883 CEST	51286	21	192.168.2.16	82.31.188.244
May 8, 2024 08:41:54.406974077 CEST	21	51385	203.81.154.1	192.168.2.16
May 8, 2024 08:41:54.406999111 CEST	51411	21	192.168.2.16	174.81.191.5
May 8, 2024 08:41:54.411257982 CEST	2121	51380	178.49.104.150	192.168.2.16
May 8, 2024 08:41:54.421732903 CEST	21	51379	178.49.104.150	192.168.2.16
May 8, 2024 08:41:54.421858072 CEST	51409	2121	192.168.2.16	23.6.177.110
May 8, 2024 08:41:54.421888113 CEST	51410	2121	192.168.2.16	174.81.191.5
May 8, 2024 08:41:54.422003031 CEST	51412	21	192.168.2.16	20.201.1.215
May 8, 2024 08:41:54.425764084 CEST	21	51426	38.38.120.85	192.168.2.16
May 8, 2024 08:41:54.430136919 CEST	21	51443	171.244.37.116	192.168.2.16
May 8, 2024 08:41:54.430234909 CEST	51443	21	192.168.2.16	171.244.37.116
May 8, 2024 08:41:54.433296919 CEST	21	51351	171.244.37.116	192.168.2.16
May 8, 2024 08:41:54.433305979 CEST	21	51351	171.244.37.116	192.168.2.16
May 8, 2024 08:41:54.433361053 CEST	51351	21	192.168.2.16	171.244.37.116
May 8, 2024 08:41:54.438268900 CEST	51452	2121	192.168.2.16	79.150.203.72
May 8, 2024 08:41:54.438307047 CEST	51453	21	192.168.2.16	75.91.41.85
May 8, 2024 08:41:54.451970100 CEST	21	51377	110.249.97.179	192.168.2.16
May 8, 2024 08:41:54.454658031 CEST	2121	51378	110.249.97.179	192.168.2.16
May 8, 2024 08:41:54.455199003 CEST	21	51438	172.120.235.139	192.168.2.16
May 8, 2024 08:41:54.455574989 CEST	21	51438	172.120.235.139	192.168.2.16
May 8, 2024 08:41:54.455715895 CEST	51438	21	192.168.2.16	172.120.235.139
May 8, 2024 08:41:54.469867945 CEST	51413	21	192.168.2.16	98.176.20.188
May 8, 2024 08:41:54.469885111 CEST	51414	2121	192.168.2.16	20.201.1.215
May 8, 2024 08:41:54.469891071 CEST	51287	2121	192.168.2.16	82.31.188.244
May 8, 2024 08:41:54.470006943 CEST	51415	2121	192.168.2.16	98.176.20.188
May 8, 2024 08:41:54.485871077 CEST	51416	21	192.168.2.16	90.195.126.22
May 8, 2024 08:41:54.485872030 CEST	51272	21	192.168.2.16	129.226.194.19
May 8, 2024 08:41:54.501857042 CEST	51417	2121	192.168.2.16	90.195.126.22
May 8, 2024 08:41:54.502182961 CEST	51454	2121	192.168.2.16	75.91.41.85
May 8, 2024 08:41:54.523252964 CEST	21	51297	176.28.14.156	192.168.2.16
May 8, 2024 08:41:54.533860922 CEST	51418	21	192.168.2.16	84.193.152.151
May 8, 2024 08:41:54.543159962 CEST	21	51447	34.149.79.8	192.168.2.16
May 8, 2024 08:41:54.543219090 CEST	51447	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:54.543318033 CEST	51447	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:54.543507099 CEST	2121	51446	34.149.79.8	192.168.2.16
May 8, 2024 08:41:54.543555021 CEST	51446	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:54.543555021 CEST	51455	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:54.543651104 CEST	51446	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:54.543904066 CEST	51456	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:54.549885988 CEST	51419	2121	192.168.2.16	84.193.152.151
May 8, 2024 08:41:54.550003052 CEST	51420	21	192.168.2.16	123.121.72.14
May 8, 2024 08:41:54.551153898 CEST	51458	2121	192.168.2.16	175.171.0.181
May 8, 2024 08:41:54.551157951 CEST	51457	21	192.168.2.16	175.171.0.181
May 8, 2024 08:41:54.551338911 CEST	51459	21	192.168.2.16	90.187.207.90
May 8, 2024 08:41:54.551466942 CEST	51461	21	192.168.2.16	222.142.108.89
May 8, 2024 08:41:54.551923037 CEST	51462	2121	192.168.2.16	222.142.108.89
May 8, 2024 08:41:54.552036047 CEST	51464	2121	192.168.2.16	72.28.6.124
May 8, 2024 08:41:54.552037001 CEST	51463	21	192.168.2.16	72.28.6.124
May 8, 2024 08:41:54.552216053 CEST	51460	2121	192.168.2.16	90.187.207.90
May 8, 2024 08:41:54.559582949 CEST	21	51437	91.146.97.65	192.168.2.16
May 8, 2024 08:41:54.559787989 CEST	51437	21	192.168.2.16	91.146.97.65
May 8, 2024 08:41:54.564894915 CEST	51421	2121	192.168.2.16	123.121.72.14
May 8, 2024 08:41:54.564924955 CEST	51289	21	192.168.2.16	107.165.225.20
May 8, 2024 08:41:54.564973116 CEST	51424	21	192.168.2.16	89.146.188.50
May 8, 2024 08:41:54.565709114 CEST	51465	21	192.168.2.16	117.86.201.8
May 8, 2024 08:41:54.565752029 CEST	51466	21	192.168.2.16	220.210.2.249
May 8, 2024 08:41:54.565856934 CEST	51468	2121	192.168.2.16	117.86.201.8
May 8, 2024 08:41:54.565866947 CEST	51467	21	192.168.2.16	73.207.58.202
May 8, 2024 08:41:54.565941095 CEST	51469	2121	192.168.2.16	73.207.58.202
May 8, 2024 08:41:54.580884933 CEST	51425	2121	192.168.2.16	89.146.188.50
May 8, 2024 08:41:54.581149101 CEST	51300	21	192.168.2.16	78.31.232.246
May 8, 2024 08:41:54.581873894 CEST	51470	2121	192.168.2.16	220.210.2.249
May 8, 2024 08:41:54.581971884 CEST	51471	21	192.168.2.16	138.43.166.189
May 8, 2024 08:41:54.582072973 CEST	51472	2121	192.168.2.16	138.43.166.189
May 8, 2024 08:41:54.582118988 CEST	51473	21	192.168.2.16	201.9.182.232
May 8, 2024 08:41:54.582187891 CEST	51474	21	192.168.2.16	122.41.25.57
May 8, 2024 08:41:54.582259893 CEST	51475	2121	192.168.2.16	201.9.182.232
May 8, 2024 08:41:54.596878052 CEST	51366	21	192.168.2.16	45.137.53.127
May 8, 2024 08:41:54.596919060 CEST	51274	2121	192.168.2.16	129.226.194.19
May 8, 2024 08:41:54.597558022 CEST	51476	2121	192.168.2.16	122.41.25.57
May 8, 2024 08:41:54.597661972 CEST	51477	21	192.168.2.16	96.70.160.94
May 8, 2024 08:41:54.597698927 CEST	51479	2121	192.168.2.16	52.157.216.168
May 8, 2024 08:41:54.597697973 CEST	51478	2121	192.168.2.16	96.70.160.94
May 8, 2024 08:41:54.597784996 CEST	51480	21	192.168.2.16	52.157.216.168
May 8, 2024 08:41:54.613909960 CEST	51481	21	192.168.2.16	219.240.69.196
May 8, 2024 08:41:54.613934994 CEST	51482	2121	192.168.2.16	219.240.69.196
May 8, 2024 08:41:54.614020109 CEST	51484	21	192.168.2.16	52.237.30.249
May 8, 2024 08:41:54.614073992 CEST	51483	2121	192.168.2.16	52.237.30.249
May 8, 2024 08:41:54.614149094 CEST	51485	21	192.168.2.16	93.206.203.71
May 8, 2024 08:41:54.614207029 CEST	51486	2121	192.168.2.16	93.206.203.71
May 8, 2024 08:41:54.614322901 CEST	51488	2121	192.168.2.16	139.18.115.218
May 8, 2024 08:41:54.614415884 CEST	51489	2121	192.168.2.16	163.172.12.108
May 8, 2024 08:41:54.614447117 CEST	51490	21	192.168.2.16	163.172.12.108
May 8, 2024 08:41:54.614469051 CEST	51487	21	192.168.2.16	139.18.115.218
May 8, 2024 08:41:54.616286039 CEST	51491	21	192.168.2.16	181.34.188.85
May 8, 2024 08:41:54.628865004 CEST	51302	2121	192.168.2.16	78.31.232.246
May 8, 2024 08:41:54.629692078 CEST	51492	2121	192.168.2.16	181.34.188.85
May 8, 2024 08:41:54.629759073 CEST	51493	21	192.168.2.16	154.195.180.206
May 8, 2024 08:41:54.629816055 CEST	51494	2121	192.168.2.16	154.195.180.206
May 8, 2024 08:41:54.629877090 CEST	51495	21	192.168.2.16	72.135.200.14
May 8, 2024 08:41:54.629933119 CEST	51496	2121	192.168.2.16	72.135.200.14
May 8, 2024 08:41:54.630003929 CEST	51498	2121	192.168.2.16	38.207.205.17
May 8, 2024 08:41:54.630095005 CEST	51499	21	192.168.2.16	212.97.89.61
May 8, 2024 08:41:54.630095005 CEST	51497	21	192.168.2.16	38.207.205.17
May 8, 2024 08:41:54.644884109 CEST	51427	21	192.168.2.16	153.34.181.233
May 8, 2024 08:41:54.645165920 CEST	51500	21	192.168.2.16	180.64.192.17
May 8, 2024 08:41:54.645211935 CEST	51501	2121	192.168.2.16	212.97.89.61
May 8, 2024 08:41:54.660887957 CEST	51367	2121	192.168.2.16	45.137.53.127
May 8, 2024 08:41:54.661022902 CEST	51312	2121	192.168.2.16	180.180.130.245
May 8, 2024 08:41:54.666316986 CEST	21	51438	172.120.235.139	192.168.2.16
May 8, 2024 08:41:54.666485071 CEST	51438	21	192.168.2.16	172.120.235.139
May 8, 2024 08:41:54.666686058 CEST	51502	21	192.168.2.16	172.120.235.139
May 8, 2024 08:41:54.671195984 CEST	21	51442	84.44.255.254	192.168.2.16
May 8, 2024 08:41:54.671262980 CEST	51442	21	192.168.2.16	84.44.255.254
May 8, 2024 08:41:54.671349049 CEST	51442	21	192.168.2.16	84.44.255.254
May 8, 2024 08:41:54.671555996 CEST	51503	21	192.168.2.16	84.44.255.254
May 8, 2024 08:41:54.671844006 CEST	2121	51342	133.110.114.120	192.168.2.16
May 8, 2024 08:41:54.671861887 CEST	21	51343	133.110.114.120	192.168.2.16
May 8, 2024 08:41:54.705379009 CEST	21	51447	34.149.79.8	192.168.2.16
May 8, 2024 08:41:54.705916882 CEST	21	51455	34.149.79.8	192.168.2.16
May 8, 2024 08:41:54.705991983 CEST	2121	51446	34.149.79.8	192.168.2.16
May 8, 2024 08:41:54.706010103 CEST	51455	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:54.706048965 CEST	2121	51456	34.149.79.8	192.168.2.16
May 8, 2024 08:41:54.706099033 CEST	51456	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:54.721867085 CEST	51292	2121	192.168.2.16	107.165.225.20
May 8, 2024 08:41:54.722162962 CEST	51504	2121	192.168.2.16	180.64.192.17
May 8, 2024 08:41:54.737852097 CEST	51430	21	192.168.2.16	117.200.110.191
May 8, 2024 08:41:54.753874063 CEST	51294	21	192.168.2.16	182.32.56.16
May 8, 2024 08:41:54.753885984 CEST	51144	21	192.168.2.16	62.140.135.146
May 8, 2024 08:41:54.753886938 CEST	51293	2121	192.168.2.16	182.32.56.16
May 8, 2024 08:41:54.753901958 CEST	51432	2121	192.168.2.16	117.200.110.191
May 8, 2024 08:41:54.753987074 CEST	51145	2121	192.168.2.16	62.140.135.146
May 8, 2024 08:41:54.754461050 CEST	51505	21	192.168.2.16	106.251.156.245
May 8, 2024 08:41:54.769865036 CEST	51295	21	192.168.2.16	98.35.179.149
May 8, 2024 08:41:54.770206928 CEST	51506	2121	192.168.2.16	106.251.156.245
May 8, 2024 08:41:54.775536060 CEST	21	51276	117.223.205.236	192.168.2.16
May 8, 2024 08:41:54.775600910 CEST	51276	21	192.168.2.16	117.223.205.236
May 8, 2024 08:41:54.777925014 CEST	21	51449	117.223.205.236	192.168.2.16
May 8, 2024 08:41:54.777988911 CEST	51449	21	192.168.2.16	117.223.205.236
May 8, 2024 08:41:54.781779051 CEST	21	51443	171.244.37.116	192.168.2.16
May 8, 2024 08:41:54.781903982 CEST	51443	21	192.168.2.16	171.244.37.116
May 8, 2024 08:41:54.785885096 CEST	51296	2121	192.168.2.16	98.35.179.149
May 8, 2024 08:41:54.786006927 CEST	51428	2121	192.168.2.16	153.34.181.233
May 8, 2024 08:41:54.801898003 CEST	51429	21	192.168.2.16	68.48.137.180
May 8, 2024 08:41:54.801899910 CEST	51431	2121	192.168.2.16	68.48.137.180
May 8, 2024 08:41:54.817071915 CEST	51434	2121	192.168.2.16	193.77.90.44
May 8, 2024 08:41:54.817073107 CEST	51433	21	192.168.2.16	193.77.90.44
May 8, 2024 08:41:54.818006992 CEST	51299	2121	192.168.2.16	176.28.14.156
May 8, 2024 08:41:54.846221924 CEST	21	51272	129.226.194.19	192.168.2.16
May 8, 2024 08:41:54.848870993 CEST	51435	21	192.168.2.16	92.236.244.44
May 8, 2024 08:41:54.848881960 CEST	51332	21	192.168.2.16	125.146.231.136
May 8, 2024 08:41:54.849942923 CEST	21	51502	172.120.235.139	192.168.2.16
May 8, 2024 08:41:54.850018978 CEST	51502	21	192.168.2.16	172.120.235.139
May 8, 2024 08:41:54.850110054 CEST	21	51438	172.120.235.139	192.168.2.16
May 8, 2024 08:41:54.850162029 CEST	51438	21	192.168.2.16	172.120.235.139
May 8, 2024 08:41:54.853394985 CEST	21	51436	196.210.0.111	192.168.2.16
May 8, 2024 08:41:54.853575945 CEST	51436	21	192.168.2.16	196.210.0.111
May 8, 2024 08:41:54.865230083 CEST	51507	21	192.168.2.16	1.239.148.64
May 8, 2024 08:41:54.868330002 CEST	2121	51456	34.149.79.8	192.168.2.16
May 8, 2024 08:41:54.868421078 CEST	51456	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:54.868459940 CEST	21	51455	34.149.79.8	192.168.2.16
May 8, 2024 08:41:54.868509054 CEST	51455	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:54.868607998 CEST	51455	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:54.868804932 CEST	51456	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:54.869055033 CEST	51509	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:54.869057894 CEST	51508	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:54.871915102 CEST	2121	51460	90.187.207.90	192.168.2.16
May 8, 2024 08:41:54.873339891 CEST	2121	51496	72.135.200.14	192.168.2.16
May 8, 2024 08:41:54.873392105 CEST	21	51495	72.135.200.14	192.168.2.16
May 8, 2024 08:41:54.873739958 CEST	21	51459	90.187.207.90	192.168.2.16
May 8, 2024 08:41:54.880851030 CEST	51333	2121	192.168.2.16	125.146.231.136
May 8, 2024 08:41:54.896548986 CEST	51511	21	192.168.2.16	183.117.68.98
May 8, 2024 08:41:54.896552086 CEST	51510	2121	192.168.2.16	1.239.148.64
May 8, 2024 08:41:54.896552086 CEST	51512	21	192.168.2.16	209.191.212.129
May 8, 2024 08:41:54.896595001 CEST	51513	2121	192.168.2.16	183.117.68.98
May 8, 2024 08:41:54.904366970 CEST	21	51437	91.146.97.65	192.168.2.16
May 8, 2024 08:41:54.904638052 CEST	21	51437	91.146.97.65	192.168.2.16
May 8, 2024 08:41:54.904830933 CEST	51437	21	192.168.2.16	91.146.97.65
May 8, 2024 08:41:54.906558037 CEST	2121	51482	219.240.69.196	192.168.2.16
May 8, 2024 08:41:54.909136057 CEST	21	51366	45.137.53.127	192.168.2.16
May 8, 2024 08:41:54.909446001 CEST	21	51481	219.240.69.196	192.168.2.16
May 8, 2024 08:41:54.911891937 CEST	51386	2121	192.168.2.16	203.81.154.1
May 8, 2024 08:41:54.911891937 CEST	51385	21	192.168.2.16	203.81.154.1
May 8, 2024 08:41:54.912360907 CEST	51380	2121	192.168.2.16	178.49.104.150
May 8, 2024 08:41:54.916757107 CEST	2121	51489	163.172.12.108	192.168.2.16
May 8, 2024 08:41:54.916770935 CEST	21	51490	163.172.12.108	192.168.2.16
May 8, 2024 08:41:54.927861929 CEST	51379	21	192.168.2.16	178.49.104.150
May 8, 2024 08:41:54.934557915 CEST	21	51500	180.64.192.17	192.168.2.16
May 8, 2024 08:41:54.939132929 CEST	2121	51494	154.195.180.206	192.168.2.16
May 8, 2024 08:41:54.939204931 CEST	21	51493	154.195.180.206	192.168.2.16
May 8, 2024 08:41:54.943880081 CEST	51303	21	192.168.2.16	5.228.65.50
May 8, 2024 08:41:54.948482037 CEST	2121	51488	139.18.115.218	192.168.2.16
May 8, 2024 08:41:54.951025963 CEST	21	51487	139.18.115.218	192.168.2.16
May 8, 2024 08:41:54.951561928 CEST	21	51499	212.97.89.61	192.168.2.16
May 8, 2024 08:41:54.959856033 CEST	51378	2121	192.168.2.16	110.249.97.179
May 8, 2024 08:41:54.959856987 CEST	51377	21	192.168.2.16	110.249.97.179
May 8, 2024 08:41:54.966178894 CEST	2121	51501	212.97.89.61	192.168.2.16
May 8, 2024 08:41:54.966320038 CEST	2121	51274	129.226.194.19	192.168.2.16
May 8, 2024 08:41:54.974891901 CEST	51306	2121	192.168.2.16	5.228.65.50
May 8, 2024 08:41:54.977042913 CEST	2121	51367	45.137.53.127	192.168.2.16
May 8, 2024 08:41:54.990855932 CEST	51307	21	192.168.2.16	184.101.185.9
May 8, 2024 08:41:54.991146088 CEST	51514	2121	192.168.2.16	209.191.212.129
May 8, 2024 08:41:54.992633104 CEST	21	51442	84.44.255.254	192.168.2.16
May 8, 2024 08:41:54.993493080 CEST	21	51503	84.44.255.254	192.168.2.16
May 8, 2024 08:41:54.993565083 CEST	51503	21	192.168.2.16	84.44.255.254
May 8, 2024 08:41:54.997822046 CEST	21	51300	78.31.232.246	192.168.2.16
May 8, 2024 08:41:55.004221916 CEST	2121	51504	180.64.192.17	192.168.2.16
May 8, 2024 08:41:55.006871939 CEST	51441	2121	192.168.2.16	92.236.244.44
May 8, 2024 08:41:55.006871939 CEST	51327	21	192.168.2.16	150.200.46.130
May 8, 2024 08:41:55.022860050 CEST	51308	2121	192.168.2.16	184.101.185.9
May 8, 2024 08:41:55.029531956 CEST	2121	51312	180.180.130.245	192.168.2.16
May 8, 2024 08:41:55.030941010 CEST	2121	51456	34.149.79.8	192.168.2.16
May 8, 2024 08:41:55.031001091 CEST	21	51455	34.149.79.8	192.168.2.16
May 8, 2024 08:41:55.031435966 CEST	2121	51509	34.149.79.8	192.168.2.16
May 8, 2024 08:41:55.031446934 CEST	21	51508	34.149.79.8	192.168.2.16
May 8, 2024 08:41:55.031517982 CEST	51509	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:55.033091068 CEST	51508	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:55.038865089 CEST	51329	2121	192.168.2.16	150.200.46.130
May 8, 2024 08:41:55.039863110 CEST	51297	21	192.168.2.16	176.28.14.156
May 8, 2024 08:41:55.039907932 CEST	2121	51302	78.31.232.246	192.168.2.16
May 8, 2024 08:41:55.054882050 CEST	51311	21	192.168.2.16	180.180.130.245
May 8, 2024 08:41:55.070056915 CEST	21	51502	172.120.235.139	192.168.2.16
May 8, 2024 08:41:55.070219040 CEST	51502	21	192.168.2.16	172.120.235.139
May 8, 2024 08:41:55.070868969 CEST	51313	21	192.168.2.16	5.38.137.244
May 8, 2024 08:41:55.071223974 CEST	51515	21	192.168.2.16	111.59.191.151
May 8, 2024 08:41:55.086878061 CEST	51314	2121	192.168.2.16	5.38.137.244
May 8, 2024 08:41:55.096455097 CEST	21	51505	106.251.156.245	192.168.2.16
May 8, 2024 08:41:55.099977016 CEST	21	51512	209.191.212.129	192.168.2.16
May 8, 2024 08:41:55.102860928 CEST	51315	21	192.168.2.16	121.24.207.37
May 8, 2024 08:41:55.117455006 CEST	2121	51506	106.251.156.245	192.168.2.16
May 8, 2024 08:41:55.120853901 CEST	51444	21	192.168.2.16	110.231.228.49
May 8, 2024 08:41:55.133343935 CEST	21	51443	171.244.37.116	192.168.2.16
May 8, 2024 08:41:55.133460999 CEST	51443	21	192.168.2.16	171.244.37.116
May 8, 2024 08:41:55.166155100 CEST	21	51332	125.146.231.136	192.168.2.16
May 8, 2024 08:41:55.173043966 CEST	21	51430	117.200.110.191	192.168.2.16
May 8, 2024 08:41:55.182898045 CEST	51318	2121	192.168.2.16	121.24.207.37
May 8, 2024 08:41:55.182898045 CEST	51342	2121	192.168.2.16	133.110.114.120
May 8, 2024 08:41:55.184856892 CEST	51343	21	192.168.2.16	133.110.114.120
May 8, 2024 08:41:55.189075947 CEST	2121	51432	117.200.110.191	192.168.2.16
May 8, 2024 08:41:55.193902016 CEST	2121	51509	34.149.79.8	192.168.2.16
May 8, 2024 08:41:55.193960905 CEST	51509	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:55.194104910 CEST	51509	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:55.194427967 CEST	51516	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:55.195580006 CEST	21	51508	34.149.79.8	192.168.2.16
May 8, 2024 08:41:55.195643902 CEST	51508	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:55.195744991 CEST	51508	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:55.196010113 CEST	51517	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:55.196295023 CEST	2121	51333	125.146.231.136	192.168.2.16
May 8, 2024 08:41:55.209280014 CEST	21	51511	183.117.68.98	192.168.2.16
May 8, 2024 08:41:55.212035894 CEST	2121	51513	183.117.68.98	192.168.2.16
May 8, 2024 08:41:55.222069979 CEST	21	51466	220.210.2.249	192.168.2.16
May 8, 2024 08:41:55.230890036 CEST	51445	2121	192.168.2.16	110.231.228.49
May 8, 2024 08:41:55.230906010 CEST	51448	21	192.168.2.16	58.38.224.136
May 8, 2024 08:41:55.231056929 CEST	2121	51470	220.210.2.249	192.168.2.16
May 8, 2024 08:41:55.246922016 CEST	51321	21	192.168.2.16	149.81.82.210
May 8, 2024 08:41:55.247864008 CEST	51518	2121	192.168.2.16	111.59.191.151
May 8, 2024 08:41:55.247889996 CEST	51519	21	192.168.2.16	89.66.140.251
May 8, 2024 08:41:55.252402067 CEST	21	51502	172.120.235.139	192.168.2.16
May 8, 2024 08:41:55.252413034 CEST	21	51502	172.120.235.139	192.168.2.16
May 8, 2024 08:41:55.252567053 CEST	51502	21	192.168.2.16	172.120.235.139
May 8, 2024 08:41:55.253678083 CEST	21	51437	91.146.97.65	192.168.2.16
May 8, 2024 08:41:55.253827095 CEST	51437	21	192.168.2.16	91.146.97.65
May 8, 2024 08:41:55.254050016 CEST	51520	21	192.168.2.16	91.146.97.65
May 8, 2024 08:41:55.261936903 CEST	2121	51386	203.81.154.1	192.168.2.16
May 8, 2024 08:41:55.262878895 CEST	51322	2121	192.168.2.16	149.81.82.210
May 8, 2024 08:41:55.266048908 CEST	21	51385	203.81.154.1	192.168.2.16
May 8, 2024 08:41:55.277887106 CEST	51324	21	192.168.2.16	65.21.181.166
May 8, 2024 08:41:55.284071922 CEST	2121	51380	178.49.104.150	192.168.2.16
May 8, 2024 08:41:55.293891907 CEST	51328	2121	192.168.2.16	65.21.181.166
May 8, 2024 08:41:55.310574055 CEST	21	51379	178.49.104.150	192.168.2.16
May 8, 2024 08:41:55.316142082 CEST	21	51503	84.44.255.254	192.168.2.16
May 8, 2024 08:41:55.316210032 CEST	51503	21	192.168.2.16	84.44.255.254
May 8, 2024 08:41:55.316299915 CEST	51503	21	192.168.2.16	84.44.255.254
May 8, 2024 08:41:55.316549063 CEST	51521	21	192.168.2.16	84.44.255.254
May 8, 2024 08:41:55.331675053 CEST	21	51449	117.223.205.236	192.168.2.16
May 8, 2024 08:41:55.331911087 CEST	51449	21	192.168.2.16	117.223.205.236
May 8, 2024 08:41:55.341617107 CEST	21	51436	196.210.0.111	192.168.2.16
May 8, 2024 08:41:55.341628075 CEST	21	51436	196.210.0.111	192.168.2.16
May 8, 2024 08:41:55.341749907 CEST	51436	21	192.168.2.16	196.210.0.111
May 8, 2024 08:41:55.341856956 CEST	51450	2121	192.168.2.16	58.38.224.136
May 8, 2024 08:41:55.341862917 CEST	51330	21	192.168.2.16	111.194.232.122
May 8, 2024 08:41:55.346993923 CEST	21	51297	176.28.14.156	192.168.2.16
May 8, 2024 08:41:55.356417894 CEST	2121	51509	34.149.79.8	192.168.2.16
May 8, 2024 08:41:55.356606960 CEST	2121	51516	34.149.79.8	192.168.2.16
May 8, 2024 08:41:55.356671095 CEST	51516	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:55.357873917 CEST	51451	21	192.168.2.16	79.150.203.72
May 8, 2024 08:41:55.357896090 CEST	51331	2121	192.168.2.16	111.194.232.122
May 8, 2024 08:41:55.358103037 CEST	21	51508	34.149.79.8	192.168.2.16
May 8, 2024 08:41:55.358318090 CEST	51522	2121	192.168.2.16	89.66.140.251
May 8, 2024 08:41:55.358380079 CEST	21	51517	34.149.79.8	192.168.2.16
May 8, 2024 08:41:55.358448982 CEST	51517	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:55.371835947 CEST	21	51377	110.249.97.179	192.168.2.16
May 8, 2024 08:41:55.373892069 CEST	51460	2121	192.168.2.16	90.187.207.90
May 8, 2024 08:41:55.373893023 CEST	51495	21	192.168.2.16	72.135.200.14
May 8, 2024 08:41:55.373893023 CEST	51459	21	192.168.2.16	90.187.207.90
May 8, 2024 08:41:55.374013901 CEST	51496	2121	192.168.2.16	72.135.200.14
May 8, 2024 08:41:55.374483109 CEST	2121	51378	110.249.97.179	192.168.2.16
May 8, 2024 08:41:55.389375925 CEST	51523	2121	192.168.2.16	111.196.7.93
May 8, 2024 08:41:55.389401913 CEST	51524	21	192.168.2.16	111.196.7.93
May 8, 2024 08:41:55.420865059 CEST	51366	21	192.168.2.16	45.137.53.127
May 8, 2024 08:41:55.420867920 CEST	51482	2121	192.168.2.16	219.240.69.196
May 8, 2024 08:41:55.420876980 CEST	51481	21	192.168.2.16	219.240.69.196
May 8, 2024 08:41:55.420881987 CEST	51489	2121	192.168.2.16	163.172.12.108
May 8, 2024 08:41:55.420885086 CEST	51490	21	192.168.2.16	163.172.12.108
May 8, 2024 08:41:55.436881065 CEST	51500	21	192.168.2.16	180.64.192.17
May 8, 2024 08:41:55.436881065 CEST	51336	2121	192.168.2.16	181.205.168.30
May 8, 2024 08:41:55.436881065 CEST	51335	21	192.168.2.16	181.205.168.30
May 8, 2024 08:41:55.436887980 CEST	51337	21	192.168.2.16	145.109.20.146
May 8, 2024 08:41:55.452863932 CEST	51453	21	192.168.2.16	75.91.41.85
May 8, 2024 08:41:55.452866077 CEST	51494	2121	192.168.2.16	154.195.180.206
May 8, 2024 08:41:55.452867985 CEST	51452	2121	192.168.2.16	79.150.203.72
May 8, 2024 08:41:55.452883005 CEST	51488	2121	192.168.2.16	139.18.115.218
May 8, 2024 08:41:55.452883959 CEST	51499	21	192.168.2.16	212.97.89.61
May 8, 2024 08:41:55.452909946 CEST	51493	21	192.168.2.16	154.195.180.206
May 8, 2024 08:41:55.452915907 CEST	51340	2121	192.168.2.16	145.109.20.146
May 8, 2024 08:41:55.452927113 CEST	51487	21	192.168.2.16	139.18.115.218
May 8, 2024 08:41:55.460021973 CEST	21	51502	172.120.235.139	192.168.2.16
May 8, 2024 08:41:55.460177898 CEST	51502	21	192.168.2.16	172.120.235.139
May 8, 2024 08:41:55.460419893 CEST	51525	21	192.168.2.16	172.120.235.139
May 8, 2024 08:41:55.468883038 CEST	51501	2121	192.168.2.16	212.97.89.61
May 8, 2024 08:41:55.484886885 CEST	51367	2121	192.168.2.16	45.137.53.127
May 8, 2024 08:41:55.486012936 CEST	21	51443	171.244.37.116	192.168.2.16
May 8, 2024 08:41:55.486181021 CEST	51443	21	192.168.2.16	171.244.37.116
May 8, 2024 08:41:55.486464024 CEST	51526	21	192.168.2.16	171.244.37.116
May 8, 2024 08:41:55.500905991 CEST	51300	21	192.168.2.16	78.31.232.246
May 8, 2024 08:41:55.516911030 CEST	51504	2121	192.168.2.16	180.64.192.17
May 8, 2024 08:41:55.517374039 CEST	51454	2121	192.168.2.16	75.91.41.85
May 8, 2024 08:41:55.519524097 CEST	2121	51516	34.149.79.8	192.168.2.16
May 8, 2024 08:41:55.519606113 CEST	51516	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:55.519781113 CEST	51516	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:55.520091057 CEST	51527	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:55.520905972 CEST	21	51517	34.149.79.8	192.168.2.16
May 8, 2024 08:41:55.520977974 CEST	51517	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:55.521028042 CEST	51517	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:55.521141052 CEST	51528	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:55.532917976 CEST	51312	2121	192.168.2.16	180.180.130.245
May 8, 2024 08:41:55.548885107 CEST	51302	2121	192.168.2.16	78.31.232.246
May 8, 2024 08:41:55.549388885 CEST	51529	21	192.168.2.16	73.192.135.157
May 8, 2024 08:41:55.549467087 CEST	51530	2121	192.168.2.16	73.192.135.157
May 8, 2024 08:41:55.560343981 CEST	2121	51342	133.110.114.120	192.168.2.16
May 8, 2024 08:41:55.560359955 CEST	21	51343	133.110.114.120	192.168.2.16
May 8, 2024 08:41:55.564888000 CEST	51458	2121	192.168.2.16	175.171.0.181
May 8, 2024 08:41:55.564902067 CEST	51462	2121	192.168.2.16	222.142.108.89
May 8, 2024 08:41:55.564903975 CEST	51463	21	192.168.2.16	72.28.6.124
May 8, 2024 08:41:55.564903975 CEST	51344	21	192.168.2.16	174.166.103.50
May 8, 2024 08:41:55.564922094 CEST	51457	21	192.168.2.16	175.171.0.181
May 8, 2024 08:41:55.564922094 CEST	51464	2121	192.168.2.16	72.28.6.124
May 8, 2024 08:41:55.564923048 CEST	51461	21	192.168.2.16	222.142.108.89
May 8, 2024 08:41:55.565000057 CEST	51465	21	192.168.2.16	117.86.201.8
May 8, 2024 08:41:55.580890894 CEST	51468	2121	192.168.2.16	117.86.201.8
May 8, 2024 08:41:55.580900908 CEST	51469	2121	192.168.2.16	73.207.58.202
May 8, 2024 08:41:55.580904007 CEST	51467	21	192.168.2.16	73.207.58.202
May 8, 2024 08:41:55.580904007 CEST	51345	2121	192.168.2.16	174.166.103.50
May 8, 2024 08:41:55.594361067 CEST	21	51520	91.146.97.65	192.168.2.16
May 8, 2024 08:41:55.594458103 CEST	51520	21	192.168.2.16	91.146.97.65
May 8, 2024 08:41:55.596884012 CEST	51479	2121	192.168.2.16	52.157.216.168
May 8, 2024 08:41:55.596884012 CEST	51473	21	192.168.2.16	201.9.182.232
May 8, 2024 08:41:55.596904039 CEST	51471	21	192.168.2.16	138.43.166.189
May 8, 2024 08:41:55.596904993 CEST	51474	21	192.168.2.16	122.41.25.57
May 8, 2024 08:41:55.596904993 CEST	51505	21	192.168.2.16	106.251.156.245
May 8, 2024 08:41:55.596906900 CEST	51475	2121	192.168.2.16	201.9.182.232
May 8, 2024 08:41:55.596905947 CEST	51472	2121	192.168.2.16	138.43.166.189
May 8, 2024 08:41:55.599715948 CEST	21	51437	91.146.97.65	192.168.2.16
May 8, 2024 08:41:55.599770069 CEST	51437	21	192.168.2.16	91.146.97.65
May 8, 2024 08:41:55.612862110 CEST	51477	21	192.168.2.16	96.70.160.94
May 8, 2024 08:41:55.612880945 CEST	51476	2121	192.168.2.16	122.41.25.57
May 8, 2024 08:41:55.612998962 CEST	51478	2121	192.168.2.16	96.70.160.94
May 8, 2024 08:41:55.613009930 CEST	51480	21	192.168.2.16	52.157.216.168
May 8, 2024 08:41:55.613009930 CEST	51512	21	192.168.2.16	209.191.212.129
May 8, 2024 08:41:55.615437031 CEST	2121	51496	72.135.200.14	192.168.2.16
May 8, 2024 08:41:55.615494013 CEST	21	51495	72.135.200.14	192.168.2.16
May 8, 2024 08:41:55.628870010 CEST	51483	2121	192.168.2.16	52.237.30.249
May 8, 2024 08:41:55.628880978 CEST	51484	21	192.168.2.16	52.237.30.249
May 8, 2024 08:41:55.628885984 CEST	51492	2121	192.168.2.16	181.34.188.85
May 8, 2024 08:41:55.628894091 CEST	51486	2121	192.168.2.16	93.206.203.71
May 8, 2024 08:41:55.630011082 CEST	51491	21	192.168.2.16	181.34.188.85
May 8, 2024 08:41:55.630304098 CEST	51485	21	192.168.2.16	93.206.203.71
May 8, 2024 08:41:55.630310059 CEST	51497	21	192.168.2.16	38.207.205.17
May 8, 2024 08:41:55.630314112 CEST	51506	2121	192.168.2.16	106.251.156.245
May 8, 2024 08:41:55.635945082 CEST	21	51521	84.44.255.254	192.168.2.16
May 8, 2024 08:41:55.635968924 CEST	21	51503	84.44.255.254	192.168.2.16
May 8, 2024 08:41:55.636017084 CEST	51521	21	192.168.2.16	84.44.255.254
May 8, 2024 08:41:55.642316103 CEST	21	51525	172.120.235.139	192.168.2.16
May 8, 2024 08:41:55.642370939 CEST	51525	21	192.168.2.16	172.120.235.139
May 8, 2024 08:41:55.642446041 CEST	21	51502	172.120.235.139	192.168.2.16
May 8, 2024 08:41:55.642487049 CEST	51502	21	192.168.2.16	172.120.235.139
May 8, 2024 08:41:55.644867897 CEST	51348	2121	192.168.2.16	80.137.127.179
May 8, 2024 08:41:55.644882917 CEST	51498	2121	192.168.2.16	38.207.205.17
May 8, 2024 08:41:55.644897938 CEST	51349	21	192.168.2.16	80.137.127.179
May 8, 2024 08:41:55.645271063 CEST	51531	21	192.168.2.16	94.246.159.126
May 8, 2024 08:41:55.661294937 CEST	51532	2121	192.168.2.16	94.246.159.126
May 8, 2024 08:41:55.662954092 CEST	21	51399	96.126.118.190	192.168.2.16
May 8, 2024 08:41:55.663096905 CEST	51399	21	192.168.2.16	96.126.118.190
May 8, 2024 08:41:55.676887035 CEST	51430	21	192.168.2.16	117.200.110.191
May 8, 2024 08:41:55.676908016 CEST	51332	21	192.168.2.16	125.146.231.136
May 8, 2024 08:41:55.681907892 CEST	2121	51516	34.149.79.8	192.168.2.16
May 8, 2024 08:41:55.682446957 CEST	2121	51527	34.149.79.8	192.168.2.16
May 8, 2024 08:41:55.682534933 CEST	51527	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:55.683373928 CEST	21	51517	34.149.79.8	192.168.2.16
May 8, 2024 08:41:55.683597088 CEST	21	51528	34.149.79.8	192.168.2.16
May 8, 2024 08:41:55.683651924 CEST	51528	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:55.688450098 CEST	2121	51402	96.126.118.190	192.168.2.16
May 8, 2024 08:41:55.688596010 CEST	51402	2121	192.168.2.16	96.126.118.190
May 8, 2024 08:41:55.692877054 CEST	51432	2121	192.168.2.16	117.200.110.191
May 8, 2024 08:41:55.693689108 CEST	2121	51460	90.187.207.90	192.168.2.16
May 8, 2024 08:41:55.695832014 CEST	21	51459	90.187.207.90	192.168.2.16
May 8, 2024 08:41:55.708865881 CEST	51333	2121	192.168.2.16	125.146.231.136
May 8, 2024 08:41:55.717072964 CEST	2121	51482	219.240.69.196	192.168.2.16
May 8, 2024 08:41:55.719316006 CEST	21	51481	219.240.69.196	192.168.2.16
May 8, 2024 08:41:55.724867105 CEST	51513	2121	192.168.2.16	183.117.68.98
May 8, 2024 08:41:55.724904060 CEST	51353	21	192.168.2.16	86.124.233.164
May 8, 2024 08:41:55.724905014 CEST	51511	21	192.168.2.16	183.117.68.98
May 8, 2024 08:41:55.724916935 CEST	51466	21	192.168.2.16	220.210.2.249
May 8, 2024 08:41:55.725910902 CEST	2121	51489	163.172.12.108	192.168.2.16
May 8, 2024 08:41:55.725929976 CEST	21	51490	163.172.12.108	192.168.2.16
May 8, 2024 08:41:55.726130009 CEST	21	51500	180.64.192.17	192.168.2.16
May 8, 2024 08:41:55.735734940 CEST	21	51366	45.137.53.127	192.168.2.16
May 8, 2024 08:41:55.740880013 CEST	51470	2121	192.168.2.16	220.210.2.249
May 8, 2024 08:41:55.741102934 CEST	51354	2121	192.168.2.16	86.124.233.164
May 8, 2024 08:41:55.765078068 CEST	2121	51494	154.195.180.206	192.168.2.16
May 8, 2024 08:41:55.765158892 CEST	21	51493	154.195.180.206	192.168.2.16
May 8, 2024 08:41:55.772907972 CEST	51386	2121	192.168.2.16	203.81.154.1
May 8, 2024 08:41:55.772927999 CEST	51356	21	192.168.2.16	221.147.142.243
May 8, 2024 08:41:55.773010015 CEST	51385	21	192.168.2.16	203.81.154.1
May 8, 2024 08:41:55.778295994 CEST	21	51499	212.97.89.61	192.168.2.16
May 8, 2024 08:41:55.788891077 CEST	51380	2121	192.168.2.16	178.49.104.150
May 8, 2024 08:41:55.789726973 CEST	2121	51501	212.97.89.61	192.168.2.16
May 8, 2024 08:41:55.790312052 CEST	2121	51488	139.18.115.218	192.168.2.16
May 8, 2024 08:41:55.792870045 CEST	21	51487	139.18.115.218	192.168.2.16
May 8, 2024 08:41:55.799563885 CEST	2121	51504	180.64.192.17	192.168.2.16
May 8, 2024 08:41:55.800949097 CEST	2121	51367	45.137.53.127	192.168.2.16
May 8, 2024 08:41:55.811220884 CEST	21	51449	117.223.205.236	192.168.2.16
May 8, 2024 08:41:55.813283920 CEST	21	51449	117.223.205.236	192.168.2.16
May 8, 2024 08:41:55.813499928 CEST	51449	21	192.168.2.16	117.223.205.236
May 8, 2024 08:41:55.816219091 CEST	21	51512	209.191.212.129	192.168.2.16
May 8, 2024 08:41:55.819900036 CEST	51379	21	192.168.2.16	178.49.104.150
May 8, 2024 08:41:55.819900036 CEST	51357	2121	192.168.2.16	221.147.142.243
May 8, 2024 08:41:55.822024107 CEST	51358	21	192.168.2.16	105.157.100.252
May 8, 2024 08:41:55.837325096 CEST	21	51443	171.244.37.116	192.168.2.16
May 8, 2024 08:41:55.837549925 CEST	21	51443	171.244.37.116	192.168.2.16
May 8, 2024 08:41:55.837614059 CEST	51443	21	192.168.2.16	171.244.37.116
May 8, 2024 08:41:55.845000029 CEST	2121	51527	34.149.79.8	192.168.2.16
May 8, 2024 08:41:55.845063925 CEST	51527	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:55.845223904 CEST	51527	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:55.845541954 CEST	51533	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:55.846155882 CEST	21	51528	34.149.79.8	192.168.2.16
May 8, 2024 08:41:55.846251965 CEST	51528	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:55.846343040 CEST	51528	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:55.846580982 CEST	51534	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:55.853271008 CEST	21	51526	171.244.37.116	192.168.2.16
May 8, 2024 08:41:55.853344917 CEST	51526	21	192.168.2.16	171.244.37.116
May 8, 2024 08:41:55.866085052 CEST	21	51525	172.120.235.139	192.168.2.16
May 8, 2024 08:41:55.866210938 CEST	51525	21	192.168.2.16	172.120.235.139
May 8, 2024 08:41:55.867886066 CEST	51507	21	192.168.2.16	1.239.148.64
May 8, 2024 08:41:55.868458033 CEST	21	51436	196.210.0.111	192.168.2.16
May 8, 2024 08:41:55.869116068 CEST	21	51399	96.126.118.190	192.168.2.16
May 8, 2024 08:41:55.869827986 CEST	21	51399	96.126.118.190	192.168.2.16
May 8, 2024 08:41:55.869997025 CEST	51399	21	192.168.2.16	96.126.118.190
May 8, 2024 08:41:55.883872986 CEST	51377	21	192.168.2.16	110.249.97.179
May 8, 2024 08:41:55.883888960 CEST	51378	2121	192.168.2.16	110.249.97.179
May 8, 2024 08:41:55.883908033 CEST	51361	2121	192.168.2.16	105.157.100.252
May 8, 2024 08:41:55.894577026 CEST	2121	51402	96.126.118.190	192.168.2.16
May 8, 2024 08:41:55.894634962 CEST	2121	51402	96.126.118.190	192.168.2.16
May 8, 2024 08:41:55.894795895 CEST	51402	2121	192.168.2.16	96.126.118.190
May 8, 2024 08:41:55.899939060 CEST	51362	21	192.168.2.16	212.20.99.207
May 8, 2024 08:41:55.899943113 CEST	51510	2121	192.168.2.16	1.239.148.64
May 8, 2024 08:41:55.901506901 CEST	2121	51312	180.180.130.245	192.168.2.16
May 8, 2024 08:41:55.902328968 CEST	51535	21	192.168.2.16	107.172.133.110
May 8, 2024 08:41:55.915913105 CEST	51363	2121	192.168.2.16	212.20.99.207
May 8, 2024 08:41:55.916651011 CEST	21	51300	78.31.232.246	192.168.2.16
May 8, 2024 08:41:55.932240009 CEST	51536	2121	192.168.2.16	107.172.133.110
May 8, 2024 08:41:55.938956976 CEST	21	51505	106.251.156.245	192.168.2.16
May 8, 2024 08:41:55.952471972 CEST	21	51520	91.146.97.65	192.168.2.16
May 8, 2024 08:41:55.952632904 CEST	51520	21	192.168.2.16	91.146.97.65
May 8, 2024 08:41:55.955482960 CEST	21	51521	84.44.255.254	192.168.2.16
May 8, 2024 08:41:55.955545902 CEST	51521	21	192.168.2.16	84.44.255.254
May 8, 2024 08:41:55.955600023 CEST	51521	21	192.168.2.16	84.44.255.254
May 8, 2024 08:41:55.955790043 CEST	51537	21	192.168.2.16	84.44.255.254
May 8, 2024 08:41:55.959738970 CEST	2121	51302	78.31.232.246	192.168.2.16
May 8, 2024 08:41:55.977216959 CEST	2121	51506	106.251.156.245	192.168.2.16
May 8, 2024 08:41:55.980237961 CEST	51538	21	192.168.2.16	201.34.86.42
May 8, 2024 08:41:55.993905067 CEST	21	51276	117.223.205.236	192.168.2.16
May 8, 2024 08:41:55.993972063 CEST	51276	21	192.168.2.16	117.223.205.236
May 8, 2024 08:41:55.994430065 CEST	21	51332	125.146.231.136	192.168.2.16
May 8, 2024 08:41:55.995894909 CEST	51514	2121	192.168.2.16	209.191.212.129
May 8, 2024 08:41:56.007682085 CEST	2121	51527	34.149.79.8	192.168.2.16
May 8, 2024 08:41:56.007898092 CEST	2121	51533	34.149.79.8	192.168.2.16
May 8, 2024 08:41:56.007960081 CEST	51533	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:56.008717060 CEST	21	51528	34.149.79.8	192.168.2.16
May 8, 2024 08:41:56.008991957 CEST	21	51534	34.149.79.8	192.168.2.16
May 8, 2024 08:41:56.009051085 CEST	51534	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:56.012279987 CEST	51539	2121	192.168.2.16	201.34.86.42
May 8, 2024 08:41:56.024647951 CEST	2121	51333	125.146.231.136	192.168.2.16
May 8, 2024 08:41:56.025506973 CEST	21	51497	38.207.205.17	192.168.2.16
May 8, 2024 08:41:56.025568008 CEST	51497	21	192.168.2.16	38.207.205.17
May 8, 2024 08:41:56.037472963 CEST	21	51511	183.117.68.98	192.168.2.16
May 8, 2024 08:41:56.039978027 CEST	2121	51498	38.207.205.17	192.168.2.16
May 8, 2024 08:41:56.040029049 CEST	51498	2121	192.168.2.16	38.207.205.17
May 8, 2024 08:41:56.040247917 CEST	2121	51513	183.117.68.98	192.168.2.16
May 8, 2024 08:41:56.043893099 CEST	51368	21	192.168.2.16	73.52.228.122
May 8, 2024 08:41:56.043895006 CEST	51369	2121	192.168.2.16	73.52.228.122
May 8, 2024 08:41:56.044198036 CEST	51540	21	192.168.2.16	2.89.128.43
May 8, 2024 08:41:56.047905922 CEST	21	51525	172.120.235.139	192.168.2.16
May 8, 2024 08:41:56.048177958 CEST	21	51525	172.120.235.139	192.168.2.16
May 8, 2024 08:41:56.048304081 CEST	51525	21	192.168.2.16	172.120.235.139
May 8, 2024 08:41:56.062123060 CEST	21	51466	220.210.2.249	192.168.2.16
May 8, 2024 08:41:56.075864077 CEST	51343	21	192.168.2.16	133.110.114.120
May 8, 2024 08:41:56.075877905 CEST	51515	21	192.168.2.16	111.59.191.151
May 8, 2024 08:41:56.075880051 CEST	51342	2121	192.168.2.16	133.110.114.120
May 8, 2024 08:41:56.076184988 CEST	21	51399	96.126.118.190	192.168.2.16
May 8, 2024 08:41:56.076332092 CEST	51399	21	192.168.2.16	96.126.118.190
May 8, 2024 08:41:56.082096100 CEST	2121	51470	220.210.2.249	192.168.2.16
May 8, 2024 08:41:56.091881037 CEST	51373	21	192.168.2.16	115.215.136.173
May 8, 2024 08:41:56.091882944 CEST	51371	2121	192.168.2.16	113.60.190.93
May 8, 2024 08:41:56.099868059 CEST	51372	21	192.168.2.16	113.60.190.93
May 8, 2024 08:41:56.101228952 CEST	2121	51402	96.126.118.190	192.168.2.16
May 8, 2024 08:41:56.101350069 CEST	51402	2121	192.168.2.16	96.126.118.190
May 8, 2024 08:41:56.112137079 CEST	21	51430	117.200.110.191	192.168.2.16
May 8, 2024 08:41:56.120455980 CEST	2121	51386	203.81.154.1	192.168.2.16
May 8, 2024 08:41:56.123869896 CEST	51495	21	192.168.2.16	72.135.200.14
May 8, 2024 08:41:56.123881102 CEST	51374	2121	192.168.2.16	115.215.136.173
May 8, 2024 08:41:56.123893976 CEST	51496	2121	192.168.2.16	72.135.200.14
May 8, 2024 08:41:56.123897076 CEST	51375	21	192.168.2.16	85.193.161.88
May 8, 2024 08:41:56.124572039 CEST	21	51385	203.81.154.1	192.168.2.16
May 8, 2024 08:41:56.124972105 CEST	21	51535	107.172.133.110	192.168.2.16
May 8, 2024 08:41:56.127943993 CEST	2121	51432	117.200.110.191	192.168.2.16
May 8, 2024 08:41:56.154829979 CEST	2121	51536	107.172.133.110	192.168.2.16
May 8, 2024 08:41:56.155883074 CEST	51376	2121	192.168.2.16	85.193.161.88
May 8, 2024 08:41:56.158298969 CEST	2121	51380	178.49.104.150	192.168.2.16
May 8, 2024 08:41:56.170315027 CEST	2121	51533	34.149.79.8	192.168.2.16
May 8, 2024 08:41:56.170370102 CEST	51533	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:56.170512915 CEST	51533	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:56.170810938 CEST	51541	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:56.171606064 CEST	21	51534	34.149.79.8	192.168.2.16
May 8, 2024 08:41:56.171678066 CEST	51534	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:56.171797037 CEST	51534	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:56.171883106 CEST	51381	21	192.168.2.16	39.86.125.77
May 8, 2024 08:41:56.172009945 CEST	51542	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:56.200544119 CEST	2121	51514	209.191.212.129	192.168.2.16
May 8, 2024 08:41:56.201313019 CEST	21	51379	178.49.104.150	192.168.2.16
May 8, 2024 08:41:56.203865051 CEST	51383	2121	192.168.2.16	39.86.125.77
May 8, 2024 08:41:56.203890085 CEST	51459	21	192.168.2.16	90.187.207.90
May 8, 2024 08:41:56.203891039 CEST	51382	21	192.168.2.16	111.74.121.214
May 8, 2024 08:41:56.204376936 CEST	51387	21	192.168.2.16	117.1.181.3
May 8, 2024 08:41:56.204377890 CEST	51460	2121	192.168.2.16	90.187.207.90
May 8, 2024 08:41:56.204402924 CEST	51384	2121	192.168.2.16	111.74.121.214
May 8, 2024 08:41:56.219971895 CEST	51482	2121	192.168.2.16	219.240.69.196
May 8, 2024 08:41:56.219975948 CEST	51481	21	192.168.2.16	219.240.69.196
May 8, 2024 08:41:56.220884085 CEST	21	51526	171.244.37.116	192.168.2.16
May 8, 2024 08:41:56.221087933 CEST	51526	21	192.168.2.16	171.244.37.116
May 8, 2024 08:41:56.235882044 CEST	51500	21	192.168.2.16	180.64.192.17
May 8, 2024 08:41:56.236406088 CEST	51388	2121	192.168.2.16	117.1.181.3
May 8, 2024 08:41:56.236406088 CEST	51366	21	192.168.2.16	45.137.53.127
May 8, 2024 08:41:56.236406088 CEST	51490	21	192.168.2.16	163.172.12.108
May 8, 2024 08:41:56.236407995 CEST	51489	2121	192.168.2.16	163.172.12.108
May 8, 2024 08:41:56.236406088 CEST	51389	21	192.168.2.16	88.23.224.156
May 8, 2024 08:41:56.251899958 CEST	51391	2121	192.168.2.16	211.238.76.67
May 8, 2024 08:41:56.251916885 CEST	51519	21	192.168.2.16	89.66.140.251
May 8, 2024 08:41:56.251919031 CEST	51392	2121	192.168.2.16	88.23.224.156
May 8, 2024 08:41:56.251919985 CEST	51390	21	192.168.2.16	211.238.76.67
May 8, 2024 08:41:56.252126932 CEST	51518	2121	192.168.2.16	111.59.191.151
May 8, 2024 08:41:56.258440018 CEST	21	51525	172.120.235.139	192.168.2.16
May 8, 2024 08:41:56.258621931 CEST	51525	21	192.168.2.16	172.120.235.139
May 8, 2024 08:41:56.258924961 CEST	51543	21	192.168.2.16	172.120.235.139
May 8, 2024 08:41:56.267873049 CEST	51397	21	192.168.2.16	102.117.3.196
May 8, 2024 08:41:56.267878056 CEST	51395	21	192.168.2.16	108.238.40.177
May 8, 2024 08:41:56.267915010 CEST	51494	2121	192.168.2.16	154.195.180.206
May 8, 2024 08:41:56.267920017 CEST	51396	2121	192.168.2.16	108.238.40.177
May 8, 2024 08:41:56.267960072 CEST	51493	21	192.168.2.16	154.195.180.206
May 8, 2024 08:41:56.274928093 CEST	21	51521	84.44.255.254	192.168.2.16
May 8, 2024 08:41:56.275497913 CEST	21	51537	84.44.255.254	192.168.2.16
May 8, 2024 08:41:56.275568962 CEST	51537	21	192.168.2.16	84.44.255.254
May 8, 2024 08:41:56.283864975 CEST	51499	21	192.168.2.16	212.97.89.61
May 8, 2024 08:41:56.284300089 CEST	51544	2121	192.168.2.16	2.89.128.43
May 8, 2024 08:41:56.284327030 CEST	51400	2121	192.168.2.16	102.117.3.196
May 8, 2024 08:41:56.286417007 CEST	21	51399	96.126.118.190	192.168.2.16
May 8, 2024 08:41:56.286573887 CEST	51399	21	192.168.2.16	96.126.118.190
May 8, 2024 08:41:56.294919968 CEST	21	51377	110.249.97.179	192.168.2.16
May 8, 2024 08:41:56.295344114 CEST	21	51520	91.146.97.65	192.168.2.16
May 8, 2024 08:41:56.295495987 CEST	21	51520	91.146.97.65	192.168.2.16
May 8, 2024 08:41:56.295636892 CEST	51520	21	192.168.2.16	91.146.97.65
May 8, 2024 08:41:56.297568083 CEST	2121	51378	110.249.97.179	192.168.2.16
May 8, 2024 08:41:56.299880981 CEST	51501	2121	192.168.2.16	212.97.89.61
May 8, 2024 08:41:56.299895048 CEST	51488	2121	192.168.2.16	139.18.115.218
May 8, 2024 08:41:56.299901009 CEST	51487	21	192.168.2.16	139.18.115.218
May 8, 2024 08:41:56.299901009 CEST	51504	2121	192.168.2.16	180.64.192.17
May 8, 2024 08:41:56.302015066 CEST	51403	21	192.168.2.16	187.192.56.78
May 8, 2024 08:41:56.309993029 CEST	2121	51402	96.126.118.190	192.168.2.16
May 8, 2024 08:41:56.310231924 CEST	51402	2121	192.168.2.16	96.126.118.190
May 8, 2024 08:41:56.316112041 CEST	51367	2121	192.168.2.16	45.137.53.127
May 8, 2024 08:41:56.331871033 CEST	51512	21	192.168.2.16	209.191.212.129
May 8, 2024 08:41:56.333761930 CEST	2121	51533	34.149.79.8	192.168.2.16
May 8, 2024 08:41:56.333915949 CEST	2121	51541	34.149.79.8	192.168.2.16
May 8, 2024 08:41:56.333976030 CEST	51541	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:56.338185072 CEST	21	51534	34.149.79.8	192.168.2.16
May 8, 2024 08:41:56.338198900 CEST	21	51542	34.149.79.8	192.168.2.16
May 8, 2024 08:41:56.338260889 CEST	51542	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:56.341738939 CEST	21	51449	117.223.205.236	192.168.2.16
May 8, 2024 08:41:56.348367929 CEST	51546	2121	192.168.2.16	36.94.62.184
May 8, 2024 08:41:56.348370075 CEST	51545	21	192.168.2.16	36.94.62.184
May 8, 2024 08:41:56.363867044 CEST	51404	2121	192.168.2.16	187.192.56.78
May 8, 2024 08:41:56.363945007 CEST	51522	2121	192.168.2.16	89.66.140.251
May 8, 2024 08:41:56.364228010 CEST	51547	21	192.168.2.16	24.181.75.133
May 8, 2024 08:41:56.371648073 CEST	2121	51496	72.135.200.14	192.168.2.16
May 8, 2024 08:41:56.371666908 CEST	21	51495	72.135.200.14	192.168.2.16
May 8, 2024 08:41:56.379882097 CEST	51406	2121	192.168.2.16	216.58.210.149
May 8, 2024 08:41:56.379882097 CEST	51405	21	192.168.2.16	216.58.210.149
May 8, 2024 08:41:56.380251884 CEST	51548	21	192.168.2.16	81.97.26.213
May 8, 2024 08:41:56.380285978 CEST	51549	2121	192.168.2.16	24.181.75.133
May 8, 2024 08:41:56.395863056 CEST	51523	2121	192.168.2.16	111.196.7.93
May 8, 2024 08:41:56.395895004 CEST	51524	21	192.168.2.16	111.196.7.93
May 8, 2024 08:41:56.395895958 CEST	51407	21	192.168.2.16	23.6.177.110
May 8, 2024 08:41:56.396153927 CEST	51550	2121	192.168.2.16	81.97.26.213
May 8, 2024 08:41:56.411876917 CEST	51411	21	192.168.2.16	174.81.191.5
May 8, 2024 08:41:56.421132088 CEST	21	51497	38.207.205.17	192.168.2.16
May 8, 2024 08:41:56.421562910 CEST	51551	21	192.168.2.16	171.6.13.50
May 8, 2024 08:41:56.427862883 CEST	51409	2121	192.168.2.16	23.6.177.110
May 8, 2024 08:41:56.427875042 CEST	51412	21	192.168.2.16	20.201.1.215
May 8, 2024 08:41:56.427879095 CEST	51410	2121	192.168.2.16	174.81.191.5
May 8, 2024 08:41:56.440396070 CEST	21	51525	172.120.235.139	192.168.2.16
May 8, 2024 08:41:56.440448046 CEST	51525	21	192.168.2.16	172.120.235.139
May 8, 2024 08:41:56.440531969 CEST	21	51543	172.120.235.139	192.168.2.16
May 8, 2024 08:41:56.440598011 CEST	51543	21	192.168.2.16	172.120.235.139
May 8, 2024 08:41:56.449862003 CEST	51505	21	192.168.2.16	106.251.156.245
May 8, 2024 08:41:56.452105999 CEST	2121	51342	133.110.114.120	192.168.2.16
May 8, 2024 08:41:56.452120066 CEST	21	51343	133.110.114.120	192.168.2.16
May 8, 2024 08:41:56.452600956 CEST	51552	21	192.168.2.16	140.246.149.38
May 8, 2024 08:41:56.452637911 CEST	51553	2121	192.168.2.16	171.6.13.50
May 8, 2024 08:41:56.475893021 CEST	51415	2121	192.168.2.16	98.176.20.188
May 8, 2024 08:41:56.476011038 CEST	51413	21	192.168.2.16	98.176.20.188
May 8, 2024 08:41:56.476413965 CEST	51414	2121	192.168.2.16	20.201.1.215
May 8, 2024 08:41:56.476414919 CEST	51554	2121	192.168.2.16	140.246.149.38
May 8, 2024 08:41:56.491869926 CEST	51506	2121	192.168.2.16	106.251.156.245
May 8, 2024 08:41:56.491885900 CEST	51416	21	192.168.2.16	90.195.126.22
May 8, 2024 08:41:56.492767096 CEST	21	51399	96.126.118.190	192.168.2.16
May 8, 2024 08:41:56.493041992 CEST	51399	21	192.168.2.16	96.126.118.190
May 8, 2024 08:41:56.496299982 CEST	2121	51541	34.149.79.8	192.168.2.16
May 8, 2024 08:41:56.496355057 CEST	51541	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:56.496413946 CEST	51541	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:56.496633053 CEST	51555	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:56.500627995 CEST	21	51542	34.149.79.8	192.168.2.16
May 8, 2024 08:41:56.500682116 CEST	51542	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:56.500750065 CEST	51542	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:56.500941992 CEST	51556	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:56.507882118 CEST	51417	2121	192.168.2.16	90.195.126.22
May 8, 2024 08:41:56.512351990 CEST	2121	51482	219.240.69.196	192.168.2.16
May 8, 2024 08:41:56.515772104 CEST	21	51481	219.240.69.196	192.168.2.16
May 8, 2024 08:41:56.516159058 CEST	2121	51402	96.126.118.190	192.168.2.16
May 8, 2024 08:41:56.516386986 CEST	51402	2121	192.168.2.16	96.126.118.190
May 8, 2024 08:41:56.523643970 CEST	2121	51460	90.187.207.90	192.168.2.16
May 8, 2024 08:41:56.525433064 CEST	21	51500	180.64.192.17	192.168.2.16
May 8, 2024 08:41:56.525738955 CEST	21	51459	90.187.207.90	192.168.2.16
May 8, 2024 08:41:56.538727045 CEST	2121	51489	163.172.12.108	192.168.2.16
May 8, 2024 08:41:56.538762093 CEST	21	51490	163.172.12.108	192.168.2.16
May 8, 2024 08:41:56.539900064 CEST	51418	21	192.168.2.16	84.193.152.151
May 8, 2024 08:41:56.540201902 CEST	51511	21	192.168.2.16	183.117.68.98
May 8, 2024 08:41:56.548825979 CEST	21	51366	45.137.53.127	192.168.2.16
May 8, 2024 08:41:56.555877924 CEST	51530	2121	192.168.2.16	73.192.135.157
May 8, 2024 08:41:56.555881977 CEST	51513	2121	192.168.2.16	183.117.68.98
May 8, 2024 08:41:56.555895090 CEST	51529	21	192.168.2.16	73.192.135.157
May 8, 2024 08:41:56.555895090 CEST	51419	2121	192.168.2.16	84.193.152.151
May 8, 2024 08:41:56.556015968 CEST	51420	21	192.168.2.16	123.121.72.14
May 8, 2024 08:41:56.571907043 CEST	51424	21	192.168.2.16	89.146.188.50
May 8, 2024 08:41:56.571929932 CEST	51466	21	192.168.2.16	220.210.2.249
May 8, 2024 08:41:56.572324991 CEST	51421	2121	192.168.2.16	123.121.72.14
May 8, 2024 08:41:56.572523117 CEST	51558	21	192.168.2.16	166.82.122.173
May 8, 2024 08:41:56.572525978 CEST	51557	2121	192.168.2.16	166.82.122.173
May 8, 2024 08:41:56.576904058 CEST	2121	51494	154.195.180.206	192.168.2.16
May 8, 2024 08:41:56.576920033 CEST	21	51493	154.195.180.206	192.168.2.16
May 8, 2024 08:41:56.582242966 CEST	2121	51504	180.64.192.17	192.168.2.16
May 8, 2024 08:41:56.587909937 CEST	51470	2121	192.168.2.16	220.210.2.249
May 8, 2024 08:41:56.587912083 CEST	51425	2121	192.168.2.16	89.146.188.50
May 8, 2024 08:41:56.588059902 CEST	21	51526	171.244.37.116	192.168.2.16
May 8, 2024 08:41:56.588252068 CEST	51526	21	192.168.2.16	171.244.37.116
May 8, 2024 08:41:56.595405102 CEST	21	51537	84.44.255.254	192.168.2.16
May 8, 2024 08:41:56.595468044 CEST	51537	21	192.168.2.16	84.44.255.254
May 8, 2024 08:41:56.595561981 CEST	51537	21	192.168.2.16	84.44.255.254
May 8, 2024 08:41:56.595829010 CEST	51559	21	192.168.2.16	84.44.255.254
May 8, 2024 08:41:56.604715109 CEST	21	51499	212.97.89.61	192.168.2.16
May 8, 2024 08:41:56.619891882 CEST	51430	21	192.168.2.16	117.200.110.191
May 8, 2024 08:41:56.620837927 CEST	2121	51501	212.97.89.61	192.168.2.16
May 8, 2024 08:41:56.627031088 CEST	21	51547	24.181.75.133	192.168.2.16
May 8, 2024 08:41:56.632205963 CEST	2121	51367	45.137.53.127	192.168.2.16
May 8, 2024 08:41:56.634121895 CEST	2121	51488	139.18.115.218	192.168.2.16
May 8, 2024 08:41:56.635893106 CEST	51386	2121	192.168.2.16	203.81.154.1
May 8, 2024 08:41:56.635901928 CEST	51535	21	192.168.2.16	107.172.133.110
May 8, 2024 08:41:56.635901928 CEST	51432	2121	192.168.2.16	117.200.110.191
May 8, 2024 08:41:56.635922909 CEST	51385	21	192.168.2.16	203.81.154.1
May 8, 2024 08:41:56.636455059 CEST	21	51487	139.18.115.218	192.168.2.16
May 8, 2024 08:41:56.639508963 CEST	21	51520	91.146.97.65	192.168.2.16
May 8, 2024 08:41:56.639662027 CEST	51520	21	192.168.2.16	91.146.97.65
May 8, 2024 08:41:56.639905930 CEST	51560	21	192.168.2.16	91.146.97.65
May 8, 2024 08:41:56.643034935 CEST	2121	51549	24.181.75.133	192.168.2.16
May 8, 2024 08:41:56.651866913 CEST	51427	21	192.168.2.16	153.34.181.233
May 8, 2024 08:41:56.651885986 CEST	51531	21	192.168.2.16	94.246.159.126
May 8, 2024 08:41:56.652105093 CEST	51561	21	192.168.2.16	20.209.27.3
May 8, 2024 08:41:56.662271976 CEST	2121	51541	34.149.79.8	192.168.2.16
May 8, 2024 08:41:56.662461996 CEST	2121	51555	34.149.79.8	192.168.2.16
May 8, 2024 08:41:56.662523031 CEST	51555	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:56.662688017 CEST	21	51543	172.120.235.139	192.168.2.16
May 8, 2024 08:41:56.662787914 CEST	51543	21	192.168.2.16	172.120.235.139
May 8, 2024 08:41:56.666675091 CEST	21	51542	34.149.79.8	192.168.2.16
May 8, 2024 08:41:56.666687965 CEST	21	51556	34.149.79.8	192.168.2.16
May 8, 2024 08:41:56.666764021 CEST	51556	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:56.667870045 CEST	51145	2121	192.168.2.16	62.140.135.146
May 8, 2024 08:41:56.667870045 CEST	51532	2121	192.168.2.16	94.246.159.126
May 8, 2024 08:41:56.667871952 CEST	51536	2121	192.168.2.16	107.172.133.110
May 8, 2024 08:41:56.667882919 CEST	51380	2121	192.168.2.16	178.49.104.150
May 8, 2024 08:41:56.667882919 CEST	51144	21	192.168.2.16	62.140.135.146
May 8, 2024 08:41:56.702737093 CEST	21	51399	96.126.118.190	192.168.2.16
May 8, 2024 08:41:56.703219891 CEST	51399	21	192.168.2.16	96.126.118.190
May 8, 2024 08:41:56.715884924 CEST	51379	21	192.168.2.16	178.49.104.150
May 8, 2024 08:41:56.715898037 CEST	51514	2121	192.168.2.16	209.191.212.129
May 8, 2024 08:41:56.716175079 CEST	51563	2121	192.168.2.16	20.209.27.3
May 8, 2024 08:41:56.726526022 CEST	2121	51402	96.126.118.190	192.168.2.16
May 8, 2024 08:41:56.726919889 CEST	51402	2121	192.168.2.16	96.126.118.190
May 8, 2024 08:41:56.749459982 CEST	51565	21	192.168.2.16	61.176.85.7
May 8, 2024 08:41:56.749478102 CEST	51566	2121	192.168.2.16	61.176.85.7
May 8, 2024 08:41:56.763169050 CEST	51567	21	192.168.2.16	20.238.61.125
May 8, 2024 08:41:56.779124975 CEST	51568	2121	192.168.2.16	20.238.61.125
May 8, 2024 08:41:56.793886900 CEST	51428	2121	192.168.2.16	153.34.181.233
May 8, 2024 08:41:56.794358015 CEST	21	51505	106.251.156.245	192.168.2.16
May 8, 2024 08:41:56.809902906 CEST	51378	2121	192.168.2.16	110.249.97.179
May 8, 2024 08:41:56.809904099 CEST	51377	21	192.168.2.16	110.249.97.179
May 8, 2024 08:41:56.810096979 CEST	51429	21	192.168.2.16	68.48.137.180
May 8, 2024 08:41:56.810121059 CEST	51431	2121	192.168.2.16	68.48.137.180
May 8, 2024 08:41:56.810781002 CEST	51569	21	192.168.2.16	174.103.83.164
May 8, 2024 08:41:56.824879885 CEST	51433	21	192.168.2.16	193.77.90.44
May 8, 2024 08:41:56.824987888 CEST	2121	51555	34.149.79.8	192.168.2.16
May 8, 2024 08:41:56.824987888 CEST	51434	2121	192.168.2.16	193.77.90.44
May 8, 2024 08:41:56.825042009 CEST	51555	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:56.825150013 CEST	51555	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:56.825360060 CEST	51570	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:56.828975916 CEST	21	51556	34.149.79.8	192.168.2.16
May 8, 2024 08:41:56.829035044 CEST	51556	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:56.829109907 CEST	51556	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:56.829282999 CEST	51571	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:56.835792065 CEST	21	51436	196.210.0.111	192.168.2.16
May 8, 2024 08:41:56.835933924 CEST	51436	21	192.168.2.16	196.210.0.111
May 8, 2024 08:41:56.836126089 CEST	51572	21	192.168.2.16	196.210.0.111
May 8, 2024 08:41:56.842899084 CEST	2121	51506	106.251.156.245	192.168.2.16
May 8, 2024 08:41:56.844475985 CEST	21	51543	172.120.235.139	192.168.2.16
May 8, 2024 08:41:56.844804049 CEST	21	51543	172.120.235.139	192.168.2.16
May 8, 2024 08:41:56.844979048 CEST	51543	21	192.168.2.16	172.120.235.139
May 8, 2024 08:41:56.856869936 CEST	51435	21	192.168.2.16	92.236.244.44
May 8, 2024 08:41:56.857960939 CEST	21	51511	183.117.68.98	192.168.2.16
May 8, 2024 08:41:56.858510971 CEST	21	51535	107.172.133.110	192.168.2.16
May 8, 2024 08:41:56.871628046 CEST	2121	51513	183.117.68.98	192.168.2.16
May 8, 2024 08:41:56.873599052 CEST	51495	21	192.168.2.16	72.135.200.14
May 8, 2024 08:41:56.876353979 CEST	51496	2121	192.168.2.16	72.135.200.14
May 8, 2024 08:41:56.890378952 CEST	2121	51536	107.172.133.110	192.168.2.16
May 8, 2024 08:41:56.902143955 CEST	21	51466	220.210.2.249	192.168.2.16
May 8, 2024 08:41:56.909463882 CEST	21	51399	96.126.118.190	192.168.2.16
May 8, 2024 08:41:56.910087109 CEST	51399	21	192.168.2.16	96.126.118.190
May 8, 2024 08:41:56.911899090 CEST	21	51559	84.44.255.254	192.168.2.16
May 8, 2024 08:41:56.911969900 CEST	51559	21	192.168.2.16	84.44.255.254
May 8, 2024 08:41:56.914455891 CEST	21	51317	23.229.188.101	192.168.2.16
May 8, 2024 08:41:56.914594889 CEST	51317	21	192.168.2.16	23.229.188.101
May 8, 2024 08:41:56.914808989 CEST	51574	21	192.168.2.16	23.229.188.101
May 8, 2024 08:41:56.915246964 CEST	21	51537	84.44.255.254	192.168.2.16
May 8, 2024 08:41:56.936321020 CEST	51575	2121	192.168.2.16	174.103.83.164
May 8, 2024 08:41:56.941863060 CEST	2121	51402	96.126.118.190	192.168.2.16
May 8, 2024 08:41:56.942162037 CEST	2121	51470	220.210.2.249	192.168.2.16
May 8, 2024 08:41:56.942384005 CEST	51402	2121	192.168.2.16	96.126.118.190
May 8, 2024 08:41:56.950437069 CEST	2121	51386	203.81.154.1	192.168.2.16
May 8, 2024 08:41:56.950861931 CEST	51577	21	192.168.2.16	35.170.164.229
May 8, 2024 08:41:56.954052925 CEST	21	51385	203.81.154.1	192.168.2.16
May 8, 2024 08:41:56.954334021 CEST	51578	2121	192.168.2.16	35.170.164.229
May 8, 2024 08:41:56.957669020 CEST	21	51526	171.244.37.116	192.168.2.16
May 8, 2024 08:41:56.957806110 CEST	51526	21	192.168.2.16	171.244.37.116
May 8, 2024 08:41:56.958025932 CEST	51579	21	192.168.2.16	171.244.37.116
May 8, 2024 08:41:56.968127012 CEST	51580	21	192.168.2.16	38.191.174.28
May 8, 2024 08:41:56.980367899 CEST	21	51560	91.146.97.65	192.168.2.16
May 8, 2024 08:41:56.980438948 CEST	51560	21	192.168.2.16	91.146.97.65
May 8, 2024 08:41:56.981368065 CEST	21	51520	91.146.97.65	192.168.2.16
May 8, 2024 08:41:56.981424093 CEST	51520	21	192.168.2.16	91.146.97.65
May 8, 2024 08:41:56.983891010 CEST	51538	21	192.168.2.16	201.34.86.42
May 8, 2024 08:41:56.984236956 CEST	51581	2121	192.168.2.16	38.191.174.28
May 8, 2024 08:41:56.987494946 CEST	2121	51555	34.149.79.8	192.168.2.16
May 8, 2024 08:41:56.987844944 CEST	2121	51570	34.149.79.8	192.168.2.16
May 8, 2024 08:41:56.987905979 CEST	51570	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:56.991204023 CEST	21	51556	34.149.79.8	192.168.2.16
May 8, 2024 08:41:56.991370916 CEST	21	51571	34.149.79.8	192.168.2.16
May 8, 2024 08:41:56.991446018 CEST	51571	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:57.015882015 CEST	51441	2121	192.168.2.16	92.236.244.44
May 8, 2024 08:41:57.016005039 CEST	51539	2121	192.168.2.16	201.34.86.42
May 8, 2024 08:41:57.016010046 CEST	51481	21	192.168.2.16	219.240.69.196
May 8, 2024 08:41:57.016009092 CEST	51482	2121	192.168.2.16	219.240.69.196
May 8, 2024 08:41:57.016269922 CEST	51582	21	192.168.2.16	92.12.90.137
May 8, 2024 08:41:57.031868935 CEST	51500	21	192.168.2.16	180.64.192.17
May 8, 2024 08:41:57.031869888 CEST	51460	2121	192.168.2.16	90.187.207.90
May 8, 2024 08:41:57.031882048 CEST	51459	21	192.168.2.16	90.187.207.90
May 8, 2024 08:41:57.037322998 CEST	2121	51380	178.49.104.150	192.168.2.16
May 8, 2024 08:41:57.047864914 CEST	51490	21	192.168.2.16	163.172.12.108
May 8, 2024 08:41:57.047887087 CEST	51489	2121	192.168.2.16	163.172.12.108
May 8, 2024 08:41:57.048204899 CEST	51540	21	192.168.2.16	2.89.128.43
May 8, 2024 08:41:57.048204899 CEST	51583	2121	192.168.2.16	92.12.90.137
May 8, 2024 08:41:57.048311949 CEST	51584	21	192.168.2.16	73.166.18.123
May 8, 2024 08:41:57.054824114 CEST	21	51543	172.120.235.139	192.168.2.16
May 8, 2024 08:41:57.054939985 CEST	51543	21	192.168.2.16	172.120.235.139
May 8, 2024 08:41:57.055068016 CEST	21	51430	117.200.110.191	192.168.2.16
May 8, 2024 08:41:57.055093050 CEST	51585	21	192.168.2.16	172.120.235.139
May 8, 2024 08:41:57.064193010 CEST	51586	2121	192.168.2.16	73.166.18.123
May 8, 2024 08:41:57.071099997 CEST	2121	51432	117.200.110.191	192.168.2.16
May 8, 2024 08:41:57.079900026 CEST	51494	2121	192.168.2.16	154.195.180.206
May 8, 2024 08:41:57.079901934 CEST	51493	21	192.168.2.16	154.195.180.206
May 8, 2024 08:41:57.080179930 CEST	51587	21	192.168.2.16	115.93.215.205
May 8, 2024 08:41:57.095633030 CEST	21	51379	178.49.104.150	192.168.2.16
May 8, 2024 08:41:57.095869064 CEST	51504	2121	192.168.2.16	180.64.192.17
May 8, 2024 08:41:57.096030951 CEST	51588	2121	192.168.2.16	115.93.215.205
May 8, 2024 08:41:57.110656023 CEST	21	51317	23.229.188.101	192.168.2.16
May 8, 2024 08:41:57.110738993 CEST	51317	21	192.168.2.16	23.229.188.101
May 8, 2024 08:41:57.111005068 CEST	21	51317	23.229.188.101	192.168.2.16
May 8, 2024 08:41:57.111052990 CEST	51317	21	192.168.2.16	23.229.188.101
May 8, 2024 08:41:57.111867905 CEST	51499	21	192.168.2.16	212.97.89.61
May 8, 2024 08:41:57.112075090 CEST	51589	21	192.168.2.16	102.37.219.214
May 8, 2024 08:41:57.115971088 CEST	21	51574	23.229.188.101	192.168.2.16
May 8, 2024 08:41:57.116049051 CEST	51574	21	192.168.2.16	23.229.188.101
May 8, 2024 08:41:57.116230965 CEST	21	51399	96.126.118.190	192.168.2.16
May 8, 2024 08:41:57.116547108 CEST	21	51495	72.135.200.14	192.168.2.16
May 8, 2024 08:41:57.116566896 CEST	51399	21	192.168.2.16	96.126.118.190
May 8, 2024 08:41:57.126189947 CEST	2121	51496	72.135.200.14	192.168.2.16
May 8, 2024 08:41:57.127859116 CEST	51501	2121	192.168.2.16	212.97.89.61
May 8, 2024 08:41:57.127877951 CEST	51444	21	192.168.2.16	110.231.228.49
May 8, 2024 08:41:57.127888918 CEST	51547	21	192.168.2.16	24.181.75.133
May 8, 2024 08:41:57.143874884 CEST	51488	2121	192.168.2.16	139.18.115.218
May 8, 2024 08:41:57.143891096 CEST	51487	21	192.168.2.16	139.18.115.218
May 8, 2024 08:41:57.144918919 CEST	51549	2121	192.168.2.16	24.181.75.133
May 8, 2024 08:41:57.148473024 CEST	2121	51402	96.126.118.190	192.168.2.16
May 8, 2024 08:41:57.148866892 CEST	51402	2121	192.168.2.16	96.126.118.190
May 8, 2024 08:41:57.150573015 CEST	2121	51570	34.149.79.8	192.168.2.16
May 8, 2024 08:41:57.150629044 CEST	51570	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:57.150729895 CEST	51570	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:57.151000977 CEST	51592	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:57.153733015 CEST	21	51571	34.149.79.8	192.168.2.16
May 8, 2024 08:41:57.153794050 CEST	51571	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:57.153856039 CEST	51571	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:57.154030085 CEST	51593	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:57.158766985 CEST	21	51377	110.249.97.179	192.168.2.16
May 8, 2024 08:41:57.163393974 CEST	2121	51378	110.249.97.179	192.168.2.16
May 8, 2024 08:41:57.176309109 CEST	51594	2121	192.168.2.16	102.37.219.214
May 8, 2024 08:41:57.176366091 CEST	51595	21	192.168.2.16	194.50.173.58
May 8, 2024 08:41:57.178010941 CEST	51596	2121	192.168.2.16	194.50.173.58
May 8, 2024 08:41:57.228180885 CEST	21	51559	84.44.255.254	192.168.2.16
May 8, 2024 08:41:57.228260040 CEST	51559	21	192.168.2.16	84.44.255.254
May 8, 2024 08:41:57.228363037 CEST	51559	21	192.168.2.16	84.44.255.254
May 8, 2024 08:41:57.228605032 CEST	51597	21	192.168.2.16	84.44.255.254
May 8, 2024 08:41:57.236814976 CEST	21	51543	172.120.235.139	192.168.2.16
May 8, 2024 08:41:57.236870050 CEST	51543	21	192.168.2.16	172.120.235.139
May 8, 2024 08:41:57.236896992 CEST	21	51585	172.120.235.139	192.168.2.16
May 8, 2024 08:41:57.236963987 CEST	51585	21	192.168.2.16	172.120.235.139
May 8, 2024 08:41:57.238882065 CEST	51445	2121	192.168.2.16	110.231.228.49
May 8, 2024 08:41:57.238903999 CEST	51448	21	192.168.2.16	58.38.224.136
May 8, 2024 08:41:57.255543947 CEST	51598	21	192.168.2.16	161.106.93.255
May 8, 2024 08:41:57.255652905 CEST	51599	2121	192.168.2.16	161.106.93.255
May 8, 2024 08:41:57.271224022 CEST	51600	21	192.168.2.16	46.181.183.242
May 8, 2024 08:41:57.286922932 CEST	51544	2121	192.168.2.16	2.89.128.43
May 8, 2024 08:41:57.287349939 CEST	51601	2121	192.168.2.16	46.181.183.242
May 8, 2024 08:41:57.287451982 CEST	51602	21	192.168.2.16	71.73.217.147
May 8, 2024 08:41:57.302942991 CEST	51505	21	192.168.2.16	106.251.156.245
May 8, 2024 08:41:57.303111076 CEST	51603	2121	192.168.2.16	71.73.217.147
May 8, 2024 08:41:57.311074972 CEST	2121	51482	219.240.69.196	192.168.2.16
May 8, 2024 08:41:57.311609030 CEST	21	51481	219.240.69.196	192.168.2.16
May 8, 2024 08:41:57.313041925 CEST	2121	51570	34.149.79.8	192.168.2.16
May 8, 2024 08:41:57.313323021 CEST	2121	51592	34.149.79.8	192.168.2.16
May 8, 2024 08:41:57.313383102 CEST	51592	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:57.315980911 CEST	21	51571	34.149.79.8	192.168.2.16
May 8, 2024 08:41:57.316231012 CEST	21	51593	34.149.79.8	192.168.2.16
May 8, 2024 08:41:57.316292048 CEST	51593	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:57.318913937 CEST	21	51574	23.229.188.101	192.168.2.16
May 8, 2024 08:41:57.319103956 CEST	51574	21	192.168.2.16	23.229.188.101
May 8, 2024 08:41:57.321341038 CEST	21	51500	180.64.192.17	192.168.2.16
May 8, 2024 08:41:57.321763039 CEST	21	51572	196.210.0.111	192.168.2.16
May 8, 2024 08:41:57.321822882 CEST	51572	21	192.168.2.16	196.210.0.111
May 8, 2024 08:41:57.322807074 CEST	21	51399	96.126.118.190	192.168.2.16
May 8, 2024 08:41:57.323270082 CEST	51399	21	192.168.2.16	96.126.118.190
May 8, 2024 08:41:57.324476004 CEST	21	51436	196.210.0.111	192.168.2.16
May 8, 2024 08:41:57.324526072 CEST	51436	21	192.168.2.16	196.210.0.111
May 8, 2024 08:41:57.324729919 CEST	21	51526	171.244.37.116	192.168.2.16
May 8, 2024 08:41:57.324739933 CEST	21	51526	171.244.37.116	192.168.2.16
May 8, 2024 08:41:57.324780941 CEST	51526	21	192.168.2.16	171.244.37.116
May 8, 2024 08:41:57.329411983 CEST	21	51579	171.244.37.116	192.168.2.16
May 8, 2024 08:41:57.329467058 CEST	51579	21	192.168.2.16	171.244.37.116
May 8, 2024 08:41:57.335102081 CEST	51605	21	192.168.2.16	4.153.135.197
May 8, 2024 08:41:57.343692064 CEST	21	51560	91.146.97.65	192.168.2.16
May 8, 2024 08:41:57.343837023 CEST	51560	21	192.168.2.16	91.146.97.65
May 8, 2024 08:41:57.350225925 CEST	2121	51489	163.172.12.108	192.168.2.16
May 8, 2024 08:41:57.350294113 CEST	21	51490	163.172.12.108	192.168.2.16
May 8, 2024 08:41:57.350861073 CEST	51506	2121	192.168.2.16	106.251.156.245
May 8, 2024 08:41:57.350872993 CEST	51450	2121	192.168.2.16	58.38.224.136
May 8, 2024 08:41:57.350878000 CEST	51545	21	192.168.2.16	36.94.62.184
May 8, 2024 08:41:57.351027966 CEST	51546	2121	192.168.2.16	36.94.62.184
May 8, 2024 08:41:57.351687908 CEST	2121	51460	90.187.207.90	192.168.2.16
May 8, 2024 08:41:57.352714062 CEST	21	51449	117.223.205.236	192.168.2.16
May 8, 2024 08:41:57.352868080 CEST	51449	21	192.168.2.16	117.223.205.236
May 8, 2024 08:41:57.353101969 CEST	51606	21	192.168.2.16	117.223.205.236
May 8, 2024 08:41:57.353765965 CEST	21	51459	90.187.207.90	192.168.2.16
May 8, 2024 08:41:57.355202913 CEST	2121	51402	96.126.118.190	192.168.2.16
May 8, 2024 08:41:57.355601072 CEST	51402	2121	192.168.2.16	96.126.118.190
May 8, 2024 08:41:57.366859913 CEST	51451	21	192.168.2.16	79.150.203.72
May 8, 2024 08:41:57.366871119 CEST	51511	21	192.168.2.16	183.117.68.98
May 8, 2024 08:41:57.366938114 CEST	51535	21	192.168.2.16	107.172.133.110
May 8, 2024 08:41:57.367214918 CEST	51608	2121	192.168.2.16	4.153.135.197
May 8, 2024 08:41:57.378223896 CEST	2121	51504	180.64.192.17	192.168.2.16
May 8, 2024 08:41:57.388552904 CEST	2121	51494	154.195.180.206	192.168.2.16
May 8, 2024 08:41:57.388622999 CEST	21	51547	24.181.75.133	192.168.2.16
May 8, 2024 08:41:57.388708115 CEST	21	51493	154.195.180.206	192.168.2.16
May 8, 2024 08:41:57.391870975 CEST	51513	2121	192.168.2.16	183.117.68.98
May 8, 2024 08:41:57.391889095 CEST	51548	21	192.168.2.16	81.97.26.213
May 8, 2024 08:41:57.391890049 CEST	51536	2121	192.168.2.16	107.172.133.110
May 8, 2024 08:41:57.398884058 CEST	51550	2121	192.168.2.16	81.97.26.213
May 8, 2024 08:41:57.407999992 CEST	2121	51549	24.181.75.133	192.168.2.16
May 8, 2024 08:41:57.414866924 CEST	51466	21	192.168.2.16	220.210.2.249
May 8, 2024 08:41:57.423654079 CEST	21	51587	115.93.215.205	192.168.2.16
May 8, 2024 08:41:57.430921078 CEST	51551	21	192.168.2.16	171.6.13.50
May 8, 2024 08:41:57.431472063 CEST	51609	21	192.168.2.16	185.29.10.114
May 8, 2024 08:41:57.431499958 CEST	51610	2121	192.168.2.16	185.29.10.114
May 8, 2024 08:41:57.431524038 CEST	51611	21	192.168.2.16	173.248.1.216
May 8, 2024 08:41:57.435009956 CEST	21	51499	212.97.89.61	192.168.2.16
May 8, 2024 08:41:57.443351984 CEST	2121	51588	115.93.215.205	192.168.2.16
May 8, 2024 08:41:57.446914911 CEST	51470	2121	192.168.2.16	220.210.2.249
May 8, 2024 08:41:57.450431108 CEST	2121	51501	212.97.89.61	192.168.2.16
May 8, 2024 08:41:57.461283922 CEST	21	51585	172.120.235.139	192.168.2.16
May 8, 2024 08:41:57.461483002 CEST	51585	21	192.168.2.16	172.120.235.139
May 8, 2024 08:41:57.462882042 CEST	51452	2121	192.168.2.16	79.150.203.72
May 8, 2024 08:41:57.462891102 CEST	51453	21	192.168.2.16	75.91.41.85
May 8, 2024 08:41:57.462898970 CEST	51552	21	192.168.2.16	140.246.149.38
May 8, 2024 08:41:57.463046074 CEST	51553	2121	192.168.2.16	171.6.13.50
May 8, 2024 08:41:57.463207006 CEST	51612	2121	192.168.2.16	173.248.1.216
May 8, 2024 08:41:57.475830078 CEST	2121	51592	34.149.79.8	192.168.2.16
May 8, 2024 08:41:57.475898981 CEST	51592	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:57.476025105 CEST	51592	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:57.476303101 CEST	51613	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:57.478069067 CEST	2121	51488	139.18.115.218	192.168.2.16
May 8, 2024 08:41:57.478475094 CEST	21	51593	34.149.79.8	192.168.2.16
May 8, 2024 08:41:57.478533983 CEST	51593	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:57.478585005 CEST	51593	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:57.478741884 CEST	51614	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:57.478878975 CEST	51554	2121	192.168.2.16	140.246.149.38
May 8, 2024 08:41:57.480479956 CEST	21	51487	139.18.115.218	192.168.2.16
May 8, 2024 08:41:57.520139933 CEST	21	51574	23.229.188.101	192.168.2.16
May 8, 2024 08:41:57.520277023 CEST	21	51574	23.229.188.101	192.168.2.16
May 8, 2024 08:41:57.520461082 CEST	51574	21	192.168.2.16	23.229.188.101
May 8, 2024 08:41:57.526900053 CEST	51454	2121	192.168.2.16	75.91.41.85
May 8, 2024 08:41:57.529506922 CEST	21	51399	96.126.118.190	192.168.2.16
May 8, 2024 08:41:57.530105114 CEST	51399	21	192.168.2.16	96.126.118.190
May 8, 2024 08:41:57.544344902 CEST	21	51559	84.44.255.254	192.168.2.16
May 8, 2024 08:41:57.544517040 CEST	21	51597	84.44.255.254	192.168.2.16
May 8, 2024 08:41:57.544589996 CEST	51597	21	192.168.2.16	84.44.255.254
May 8, 2024 08:41:57.558911085 CEST	51430	21	192.168.2.16	117.200.110.191
May 8, 2024 08:41:57.559194088 CEST	51616	21	192.168.2.16	144.202.82.213
May 8, 2024 08:41:57.562035084 CEST	2121	51402	96.126.118.190	192.168.2.16
May 8, 2024 08:41:57.563332081 CEST	51402	2121	192.168.2.16	96.126.118.190
May 8, 2024 08:41:57.574892044 CEST	51458	2121	192.168.2.16	175.171.0.181
May 8, 2024 08:41:57.574914932 CEST	51457	21	192.168.2.16	175.171.0.181
May 8, 2024 08:41:57.574915886 CEST	51462	2121	192.168.2.16	222.142.108.89
May 8, 2024 08:41:57.574917078 CEST	51463	21	192.168.2.16	72.28.6.124
May 8, 2024 08:41:57.574937105 CEST	51465	21	192.168.2.16	117.86.201.8
May 8, 2024 08:41:57.574938059 CEST	51558	21	192.168.2.16	166.82.122.173
May 8, 2024 08:41:57.574938059 CEST	51464	2121	192.168.2.16	72.28.6.124
May 8, 2024 08:41:57.574939013 CEST	51461	21	192.168.2.16	222.142.108.89
May 8, 2024 08:41:57.574939966 CEST	51432	2121	192.168.2.16	117.200.110.191
May 8, 2024 08:41:57.574939966 CEST	51557	2121	192.168.2.16	166.82.122.173
May 8, 2024 08:41:57.575329065 CEST	51618	2121	192.168.2.16	144.202.82.213
May 8, 2024 08:41:57.576569080 CEST	21	51598	161.106.93.255	192.168.2.16
May 8, 2024 08:41:57.576898098 CEST	2121	51599	161.106.93.255	192.168.2.16
May 8, 2024 08:41:57.589395046 CEST	21	51535	107.172.133.110	192.168.2.16
May 8, 2024 08:41:57.590913057 CEST	51468	2121	192.168.2.16	117.86.201.8
May 8, 2024 08:41:57.590923071 CEST	51467	21	192.168.2.16	73.207.58.202
May 8, 2024 08:41:57.590924025 CEST	51469	2121	192.168.2.16	73.207.58.202
May 8, 2024 08:41:57.606901884 CEST	51471	21	192.168.2.16	138.43.166.189
May 8, 2024 08:41:57.606906891 CEST	51479	2121	192.168.2.16	52.157.216.168
May 8, 2024 08:41:57.606906891 CEST	51473	21	192.168.2.16	201.9.182.232
May 8, 2024 08:41:57.606926918 CEST	51472	2121	192.168.2.16	138.43.166.189
May 8, 2024 08:41:57.606931925 CEST	51475	2121	192.168.2.16	201.9.182.232
May 8, 2024 08:41:57.606950045 CEST	51474	21	192.168.2.16	122.41.25.57
May 8, 2024 08:41:57.614428997 CEST	2121	51536	107.172.133.110	192.168.2.16
May 8, 2024 08:41:57.622883081 CEST	51477	21	192.168.2.16	96.70.160.94
May 8, 2024 08:41:57.622894049 CEST	51480	21	192.168.2.16	52.157.216.168
May 8, 2024 08:41:57.622899055 CEST	51478	2121	192.168.2.16	96.70.160.94
May 8, 2024 08:41:57.622900963 CEST	51495	21	192.168.2.16	72.135.200.14
May 8, 2024 08:41:57.622977018 CEST	51476	2121	192.168.2.16	122.41.25.57
May 8, 2024 08:41:57.638381958 CEST	2121	51592	34.149.79.8	192.168.2.16
May 8, 2024 08:41:57.638463020 CEST	2121	51613	34.149.79.8	192.168.2.16
May 8, 2024 08:41:57.638530016 CEST	51613	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:57.638900995 CEST	51483	2121	192.168.2.16	52.237.30.249
May 8, 2024 08:41:57.638901949 CEST	51496	2121	192.168.2.16	72.135.200.14
May 8, 2024 08:41:57.638911963 CEST	51491	21	192.168.2.16	181.34.188.85
May 8, 2024 08:41:57.638915062 CEST	51485	21	192.168.2.16	93.206.203.71
May 8, 2024 08:41:57.638925076 CEST	51486	2121	192.168.2.16	93.206.203.71
May 8, 2024 08:41:57.638931036 CEST	51492	2121	192.168.2.16	181.34.188.85
May 8, 2024 08:41:57.638937950 CEST	51484	21	192.168.2.16	52.237.30.249
May 8, 2024 08:41:57.639306068 CEST	51619	21	192.168.2.16	222.94.83.70
May 8, 2024 08:41:57.639401913 CEST	51620	2121	192.168.2.16	222.94.83.70
May 8, 2024 08:41:57.640753031 CEST	21	51593	34.149.79.8	192.168.2.16
May 8, 2024 08:41:57.641130924 CEST	21	51614	34.149.79.8	192.168.2.16
May 8, 2024 08:41:57.641217947 CEST	51614	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:57.643243074 CEST	21	51585	172.120.235.139	192.168.2.16
May 8, 2024 08:41:57.643541098 CEST	21	51585	172.120.235.139	192.168.2.16
May 8, 2024 08:41:57.643685102 CEST	51585	21	192.168.2.16	172.120.235.139
May 8, 2024 08:41:57.644604921 CEST	21	51505	106.251.156.245	192.168.2.16
May 8, 2024 08:41:57.653294086 CEST	21	51334	77.75.121.3	192.168.2.16
May 8, 2024 08:41:57.653458118 CEST	51334	21	192.168.2.16	77.75.121.3
May 8, 2024 08:41:57.653713942 CEST	51621	21	192.168.2.16	77.75.121.3
May 8, 2024 08:41:57.654877901 CEST	51561	21	192.168.2.16	20.209.27.3
May 8, 2024 08:41:57.680243015 CEST	21	51511	183.117.68.98	192.168.2.16
May 8, 2024 08:41:57.684274912 CEST	21	51560	91.146.97.65	192.168.2.16
May 8, 2024 08:41:57.685623884 CEST	21	51560	91.146.97.65	192.168.2.16
May 8, 2024 08:41:57.685803890 CEST	51560	21	192.168.2.16	91.146.97.65
May 8, 2024 08:41:57.696871042 CEST	2121	51506	106.251.156.245	192.168.2.16
May 8, 2024 08:41:57.700949907 CEST	21	51579	171.244.37.116	192.168.2.16
May 8, 2024 08:41:57.701134920 CEST	51579	21	192.168.2.16	171.244.37.116
May 8, 2024 08:41:57.707956076 CEST	2121	51513	183.117.68.98	192.168.2.16
May 8, 2024 08:41:57.719240904 CEST	51622	21	192.168.2.16	111.176.24.3
May 8, 2024 08:41:57.719281912 CEST	51563	2121	192.168.2.16	20.209.27.3
May 8, 2024 08:41:57.724689960 CEST	21	51616	144.202.82.213	192.168.2.16
May 8, 2024 08:41:57.735270023 CEST	51623	2121	192.168.2.16	111.176.24.3
May 8, 2024 08:41:57.739131927 CEST	21	51399	96.126.118.190	192.168.2.16
May 8, 2024 08:41:57.739634991 CEST	51399	21	192.168.2.16	96.126.118.190
May 8, 2024 08:41:57.740314007 CEST	2121	51618	144.202.82.213	192.168.2.16
May 8, 2024 08:41:57.740786076 CEST	21	51609	185.29.10.114	192.168.2.16
May 8, 2024 08:41:57.741389036 CEST	2121	51610	185.29.10.114	192.168.2.16
May 8, 2024 08:41:57.750886917 CEST	51566	2121	192.168.2.16	61.176.85.7
May 8, 2024 08:41:57.751370907 CEST	21	51466	220.210.2.249	192.168.2.16
May 8, 2024 08:41:57.752727985 CEST	51565	21	192.168.2.16	61.176.85.7
May 8, 2024 08:41:57.762274981 CEST	21	51574	23.229.188.101	192.168.2.16
May 8, 2024 08:41:57.766880989 CEST	51567	21	192.168.2.16	20.238.61.125
May 8, 2024 08:41:57.771989107 CEST	2121	51402	96.126.118.190	192.168.2.16
May 8, 2024 08:41:57.772478104 CEST	51402	2121	192.168.2.16	96.126.118.190
May 8, 2024 08:41:57.782051086 CEST	2121	51470	220.210.2.249	192.168.2.16
May 8, 2024 08:41:57.782948017 CEST	51568	2121	192.168.2.16	20.238.61.125
May 8, 2024 08:41:57.783164978 CEST	51626	21	192.168.2.16	24.200.106.1
May 8, 2024 08:41:57.801920891 CEST	2121	51613	34.149.79.8	192.168.2.16
May 8, 2024 08:41:57.801989079 CEST	51613	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:57.802119970 CEST	51613	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:57.802409887 CEST	51627	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:57.807023048 CEST	21	51614	34.149.79.8	192.168.2.16
May 8, 2024 08:41:57.807106972 CEST	51614	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:57.807168961 CEST	51614	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:57.807327032 CEST	51628	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:57.814893007 CEST	51481	21	192.168.2.16	219.240.69.196
May 8, 2024 08:41:57.814985037 CEST	51569	21	192.168.2.16	174.103.83.164
May 8, 2024 08:41:57.815104008 CEST	51629	2121	192.168.2.16	24.200.106.1
May 8, 2024 08:41:57.815104008 CEST	51482	2121	192.168.2.16	219.240.69.196
May 8, 2024 08:41:57.830867052 CEST	51500	21	192.168.2.16	180.64.192.17
May 8, 2024 08:41:57.831110001 CEST	51630	21	192.168.2.16	46.34.34.117
May 8, 2024 08:41:57.835608006 CEST	21	51572	196.210.0.111	192.168.2.16
May 8, 2024 08:41:57.835732937 CEST	51572	21	192.168.2.16	196.210.0.111
May 8, 2024 08:41:57.849642038 CEST	21	51606	117.223.205.236	192.168.2.16
May 8, 2024 08:41:57.849718094 CEST	51606	21	192.168.2.16	117.223.205.236
May 8, 2024 08:41:57.854195118 CEST	21	51585	172.120.235.139	192.168.2.16
May 8, 2024 08:41:57.854329109 CEST	51585	21	192.168.2.16	172.120.235.139
May 8, 2024 08:41:57.854537964 CEST	51631	21	192.168.2.16	172.120.235.139
May 8, 2024 08:41:57.859880924 CEST	21	51449	117.223.205.236	192.168.2.16
May 8, 2024 08:41:57.859945059 CEST	51449	21	192.168.2.16	117.223.205.236
May 8, 2024 08:41:57.860640049 CEST	21	51597	84.44.255.254	192.168.2.16
May 8, 2024 08:41:57.860699892 CEST	51597	21	192.168.2.16	84.44.255.254
May 8, 2024 08:41:57.860796928 CEST	51597	21	192.168.2.16	84.44.255.254
May 8, 2024 08:41:57.861061096 CEST	51632	21	192.168.2.16	84.44.255.254
May 8, 2024 08:41:57.861867905 CEST	51460	2121	192.168.2.16	90.187.207.90
May 8, 2024 08:41:57.861888885 CEST	51490	21	192.168.2.16	163.172.12.108
May 8, 2024 08:41:57.861888885 CEST	51489	2121	192.168.2.16	163.172.12.108
May 8, 2024 08:41:57.863934040 CEST	51459	21	192.168.2.16	90.187.207.90
May 8, 2024 08:41:57.865905046 CEST	21	51495	72.135.200.14	192.168.2.16
May 8, 2024 08:41:57.877882004 CEST	51507	21	192.168.2.16	1.239.148.64
May 8, 2024 08:41:57.878302097 CEST	51633	2121	192.168.2.16	46.34.34.117
May 8, 2024 08:41:57.878314972 CEST	51634	21	192.168.2.16	23.46.114.5
May 8, 2024 08:41:57.881901979 CEST	2121	51496	72.135.200.14	192.168.2.16
May 8, 2024 08:41:57.893892050 CEST	51504	2121	192.168.2.16	180.64.192.17
May 8, 2024 08:41:57.893913984 CEST	51494	2121	192.168.2.16	154.195.180.206
May 8, 2024 08:41:57.893917084 CEST	51547	21	192.168.2.16	24.181.75.133
May 8, 2024 08:41:57.893922091 CEST	51493	21	192.168.2.16	154.195.180.206
May 8, 2024 08:41:57.894222021 CEST	51635	2121	192.168.2.16	23.46.114.5
May 8, 2024 08:41:57.894443035 CEST	51636	21	192.168.2.16	218.90.197.5
May 8, 2024 08:41:57.909946918 CEST	51510	2121	192.168.2.16	1.239.148.64
May 8, 2024 08:41:57.909959078 CEST	51549	2121	192.168.2.16	24.181.75.133
May 8, 2024 08:41:57.910311937 CEST	51637	2121	192.168.2.16	218.90.197.5
May 8, 2024 08:41:57.925931931 CEST	51587	21	192.168.2.16	115.93.215.205
May 8, 2024 08:41:57.941919088 CEST	51499	21	192.168.2.16	212.97.89.61
May 8, 2024 08:41:57.941920042 CEST	51575	2121	192.168.2.16	174.103.83.164
May 8, 2024 08:41:57.945735931 CEST	21	51399	96.126.118.190	192.168.2.16
May 8, 2024 08:41:57.946000099 CEST	51399	21	192.168.2.16	96.126.118.190
May 8, 2024 08:41:57.951380014 CEST	21	51619	222.94.83.70	192.168.2.16
May 8, 2024 08:41:57.954462051 CEST	2121	51620	222.94.83.70	192.168.2.16
May 8, 2024 08:41:57.957909107 CEST	51578	2121	192.168.2.16	35.170.164.229
May 8, 2024 08:41:57.957915068 CEST	51501	2121	192.168.2.16	212.97.89.61
May 8, 2024 08:41:57.957926035 CEST	51588	2121	192.168.2.16	115.93.215.205
May 8, 2024 08:41:57.957927942 CEST	51577	21	192.168.2.16	35.170.164.229
May 8, 2024 08:41:57.964097023 CEST	21	51621	77.75.121.3	192.168.2.16
May 8, 2024 08:41:57.964183092 CEST	51621	21	192.168.2.16	77.75.121.3
May 8, 2024 08:41:57.965181112 CEST	2121	51613	34.149.79.8	192.168.2.16
May 8, 2024 08:41:57.965215921 CEST	2121	51627	34.149.79.8	192.168.2.16
May 8, 2024 08:41:57.965306044 CEST	51627	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:57.969430923 CEST	21	51628	34.149.79.8	192.168.2.16
May 8, 2024 08:41:57.969445944 CEST	21	51334	77.75.121.3	192.168.2.16
May 8, 2024 08:41:57.969479084 CEST	21	51614	34.149.79.8	192.168.2.16
May 8, 2024 08:41:57.969537020 CEST	51334	21	192.168.2.16	77.75.121.3
May 8, 2024 08:41:57.969548941 CEST	51628	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:57.969842911 CEST	21	51334	77.75.121.3	192.168.2.16
May 8, 2024 08:41:57.969902039 CEST	51334	21	192.168.2.16	77.75.121.3
May 8, 2024 08:41:57.976799011 CEST	51580	21	192.168.2.16	38.191.174.28
May 8, 2024 08:41:57.978650093 CEST	2121	51402	96.126.118.190	192.168.2.16
May 8, 2024 08:41:57.978889942 CEST	51402	2121	192.168.2.16	96.126.118.190
May 8, 2024 08:41:57.989916086 CEST	51487	21	192.168.2.16	139.18.115.218
May 8, 2024 08:41:57.989922047 CEST	51581	2121	192.168.2.16	38.191.174.28
May 8, 2024 08:41:57.989985943 CEST	51488	2121	192.168.2.16	139.18.115.218
May 8, 2024 08:41:57.996582031 CEST	21	51430	117.200.110.191	192.168.2.16
May 8, 2024 08:41:58.010157108 CEST	2121	51432	117.200.110.191	192.168.2.16
May 8, 2024 08:41:58.020906925 CEST	51582	21	192.168.2.16	92.12.90.137
May 8, 2024 08:41:58.021356106 CEST	51638	21	192.168.2.16	178.153.63.96
May 8, 2024 08:41:58.021478891 CEST	51639	2121	192.168.2.16	178.153.63.96
May 8, 2024 08:41:58.030277967 CEST	21	51560	91.146.97.65	192.168.2.16
May 8, 2024 08:41:58.030471087 CEST	51560	21	192.168.2.16	91.146.97.65
May 8, 2024 08:41:58.030795097 CEST	51640	21	192.168.2.16	91.146.97.65
May 8, 2024 08:41:58.036173105 CEST	21	51585	172.120.235.139	192.168.2.16
May 8, 2024 08:41:58.036241055 CEST	51585	21	192.168.2.16	172.120.235.139
May 8, 2024 08:41:58.036313057 CEST	21	51631	172.120.235.139	192.168.2.16
May 8, 2024 08:41:58.036389112 CEST	51631	21	192.168.2.16	172.120.235.139
May 8, 2024 08:41:58.052998066 CEST	51583	2121	192.168.2.16	92.12.90.137
May 8, 2024 08:41:58.053004980 CEST	51584	21	192.168.2.16	73.166.18.123
May 8, 2024 08:41:58.053364992 CEST	51642	2121	192.168.2.16	176.109.167.187
May 8, 2024 08:41:58.053369999 CEST	51641	21	192.168.2.16	176.109.167.187
May 8, 2024 08:41:58.068924904 CEST	51586	2121	192.168.2.16	73.166.18.123
May 8, 2024 08:41:58.072246075 CEST	21	51579	171.244.37.116	192.168.2.16
May 8, 2024 08:41:58.072391987 CEST	51579	21	192.168.2.16	171.244.37.116
May 8, 2024 08:41:58.079085112 CEST	2121	51623	111.176.24.3	192.168.2.16
May 8, 2024 08:41:58.084872961 CEST	51515	21	192.168.2.16	111.59.191.151
May 8, 2024 08:41:58.084887028 CEST	51599	2121	192.168.2.16	161.106.93.255
May 8, 2024 08:41:58.084888935 CEST	51598	21	192.168.2.16	161.106.93.255
May 8, 2024 08:41:58.100914001 CEST	51535	21	192.168.2.16	107.172.133.110
May 8, 2024 08:41:58.101362944 CEST	51643	21	192.168.2.16	92.116.142.54
May 8, 2024 08:41:58.101445913 CEST	51644	2121	192.168.2.16	92.116.142.54
May 8, 2024 08:41:58.101473093 CEST	51645	21	192.168.2.16	110.12.247.33
May 8, 2024 08:41:58.111179113 CEST	2121	51482	219.240.69.196	192.168.2.16
May 8, 2024 08:41:58.111470938 CEST	21	51481	219.240.69.196	192.168.2.16
May 8, 2024 08:41:58.116892099 CEST	51536	2121	192.168.2.16	107.172.133.110
May 8, 2024 08:41:58.116894007 CEST	51589	21	192.168.2.16	102.37.219.214
May 8, 2024 08:41:58.121279955 CEST	21	51500	180.64.192.17	192.168.2.16
May 8, 2024 08:41:58.128832102 CEST	2121	51627	34.149.79.8	192.168.2.16
May 8, 2024 08:41:58.128892899 CEST	51627	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:58.128974915 CEST	51627	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:58.129196882 CEST	51646	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:58.132837057 CEST	21	51628	34.149.79.8	192.168.2.16
May 8, 2024 08:41:58.132911921 CEST	51628	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:58.133306026 CEST	51628	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:58.133688927 CEST	51647	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:58.133882999 CEST	51648	21	192.168.2.16	70.172.0.35
May 8, 2024 08:41:58.133883953 CEST	51649	2121	192.168.2.16	110.12.247.33
May 8, 2024 08:41:58.133965969 CEST	51650	2121	192.168.2.16	70.172.0.35
May 8, 2024 08:41:58.134057045 CEST	51652	21	192.168.2.16	2.33.15.110
May 8, 2024 08:41:58.134057999 CEST	51651	2121	192.168.2.16	2.33.15.110
May 8, 2024 08:41:58.148897886 CEST	51505	21	192.168.2.16	106.251.156.245
May 8, 2024 08:41:58.154901981 CEST	21	51399	96.126.118.190	192.168.2.16
May 8, 2024 08:41:58.155263901 CEST	51399	21	192.168.2.16	96.126.118.190
May 8, 2024 08:41:58.155405045 CEST	51654	21	192.168.2.16	96.126.118.190
May 8, 2024 08:41:58.156378031 CEST	21	51547	24.181.75.133	192.168.2.16
May 8, 2024 08:41:58.164328098 CEST	21	51490	163.172.12.108	192.168.2.16
May 8, 2024 08:41:58.164370060 CEST	2121	51489	163.172.12.108	192.168.2.16
May 8, 2024 08:41:58.165232897 CEST	51655	21	192.168.2.16	116.3.153.94
May 8, 2024 08:41:58.165254116 CEST	51657	2121	192.168.2.16	181.1.177.128
May 8, 2024 08:41:58.165316105 CEST	51656	21	192.168.2.16	181.1.177.128
May 8, 2024 08:41:58.173325062 CEST	2121	51549	24.181.75.133	192.168.2.16
May 8, 2024 08:41:58.174751997 CEST	21	51630	46.34.34.117	192.168.2.16
May 8, 2024 08:41:58.174834013 CEST	51630	21	192.168.2.16	46.34.34.117
May 8, 2024 08:41:58.176865101 CEST	21	51632	84.44.255.254	192.168.2.16
May 8, 2024 08:41:58.176947117 CEST	51632	21	192.168.2.16	84.44.255.254
May 8, 2024 08:41:58.177839994 CEST	2121	51504	180.64.192.17	192.168.2.16
May 8, 2024 08:41:58.177854061 CEST	21	51597	84.44.255.254	192.168.2.16
May 8, 2024 08:41:58.180897951 CEST	51596	2121	192.168.2.16	194.50.173.58
May 8, 2024 08:41:58.180902004 CEST	51594	2121	192.168.2.16	102.37.219.214
May 8, 2024 08:41:58.180902958 CEST	51511	21	192.168.2.16	183.117.68.98
May 8, 2024 08:41:58.181181908 CEST	51658	2121	192.168.2.16	116.3.153.94
May 8, 2024 08:41:58.181184053 CEST	51595	21	192.168.2.16	194.50.173.58
May 8, 2024 08:41:58.181659937 CEST	2121	51460	90.187.207.90	192.168.2.16
May 8, 2024 08:41:58.184979916 CEST	2121	51402	96.126.118.190	192.168.2.16
May 8, 2024 08:41:58.185456991 CEST	51402	2121	192.168.2.16	96.126.118.190
May 8, 2024 08:41:58.185554981 CEST	51660	2121	192.168.2.16	96.126.118.190
May 8, 2024 08:41:58.185755968 CEST	21	51459	90.187.207.90	192.168.2.16
May 8, 2024 08:41:58.186072111 CEST	51661	21	192.168.2.16	220.82.54.26
May 8, 2024 08:41:58.197303057 CEST	51662	2121	192.168.2.16	220.82.54.26
May 8, 2024 08:41:58.197355032 CEST	51663	21	192.168.2.16	58.35.54.196
May 8, 2024 08:41:58.202749968 CEST	2121	51494	154.195.180.206	192.168.2.16
May 8, 2024 08:41:58.202770948 CEST	21	51493	154.195.180.206	192.168.2.16
May 8, 2024 08:41:58.203289032 CEST	51664	2121	192.168.2.16	58.35.54.196
May 8, 2024 08:41:58.203344107 CEST	51665	21	192.168.2.16	110.9.185.177
May 8, 2024 08:41:58.211886883 CEST	51506	2121	192.168.2.16	106.251.156.245
May 8, 2024 08:41:58.211905003 CEST	51513	2121	192.168.2.16	183.117.68.98
May 8, 2024 08:41:58.212527037 CEST	51666	2121	192.168.2.16	69.251.164.110
May 8, 2024 08:41:58.212594032 CEST	51667	21	192.168.2.16	69.251.164.110
May 8, 2024 08:41:58.212636948 CEST	51669	2121	192.168.2.16	110.9.185.177
May 8, 2024 08:41:58.212666988 CEST	51668	21	192.168.2.16	82.84.152.3
May 8, 2024 08:41:58.224019051 CEST	2121	51633	46.34.34.117	192.168.2.16
May 8, 2024 08:41:58.226181984 CEST	21	51636	218.90.197.5	192.168.2.16
May 8, 2024 08:41:58.227909088 CEST	51616	21	192.168.2.16	144.202.82.213
May 8, 2024 08:41:58.228275061 CEST	51670	21	192.168.2.16	70.82.231.190
May 8, 2024 08:41:58.228377104 CEST	51671	2121	192.168.2.16	82.84.152.3
May 8, 2024 08:41:58.242079020 CEST	2121	51637	218.90.197.5	192.168.2.16
May 8, 2024 08:41:58.243937969 CEST	51618	2121	192.168.2.16	144.202.82.213
May 8, 2024 08:41:58.244096041 CEST	51609	21	192.168.2.16	185.29.10.114
May 8, 2024 08:41:58.244584084 CEST	51672	2121	192.168.2.16	70.82.231.190
May 8, 2024 08:41:58.244658947 CEST	51673	21	192.168.2.16	86.20.223.64
May 8, 2024 08:41:58.244761944 CEST	51674	2121	192.168.2.16	86.20.223.64
May 8, 2024 08:41:58.244792938 CEST	51610	2121	192.168.2.16	185.29.10.114
May 8, 2024 08:41:58.259479046 CEST	21	51631	172.120.235.139	192.168.2.16
May 8, 2024 08:41:58.259690046 CEST	51631	21	192.168.2.16	172.120.235.139
May 8, 2024 08:41:58.259881973 CEST	51466	21	192.168.2.16	220.210.2.249
May 8, 2024 08:41:58.259917974 CEST	51518	2121	192.168.2.16	111.59.191.151
May 8, 2024 08:41:58.259922028 CEST	51519	21	192.168.2.16	89.66.140.251
May 8, 2024 08:41:58.260812998 CEST	51675	21	192.168.2.16	24.98.55.117
May 8, 2024 08:41:58.260948896 CEST	51676	2121	192.168.2.16	24.98.55.117
May 8, 2024 08:41:58.260955095 CEST	51677	21	192.168.2.16	49.116.19.240
May 8, 2024 08:41:58.265336990 CEST	21	51499	212.97.89.61	192.168.2.16
May 8, 2024 08:41:58.269573927 CEST	21	51587	115.93.215.205	192.168.2.16
May 8, 2024 08:41:58.275892973 CEST	51600	21	192.168.2.16	46.181.183.242
May 8, 2024 08:41:58.276228905 CEST	51678	21	192.168.2.16	101.206.67.127
May 8, 2024 08:41:58.276272058 CEST	51679	2121	192.168.2.16	49.116.19.240
May 8, 2024 08:41:58.276421070 CEST	21	51621	77.75.121.3	192.168.2.16
May 8, 2024 08:41:58.276576042 CEST	51621	21	192.168.2.16	77.75.121.3
May 8, 2024 08:41:58.280514956 CEST	2121	51501	212.97.89.61	192.168.2.16
May 8, 2024 08:41:58.291068077 CEST	2121	51627	34.149.79.8	192.168.2.16
May 8, 2024 08:41:58.291645050 CEST	2121	51646	34.149.79.8	192.168.2.16
May 8, 2024 08:41:58.291703939 CEST	51646	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:58.291876078 CEST	51470	2121	192.168.2.16	220.210.2.249
May 8, 2024 08:41:58.291882992 CEST	51601	2121	192.168.2.16	46.181.183.242
May 8, 2024 08:41:58.291980028 CEST	51602	21	192.168.2.16	71.73.217.147
May 8, 2024 08:41:58.292058945 CEST	51680	2121	192.168.2.16	101.206.67.127
May 8, 2024 08:41:58.295428038 CEST	21	51628	34.149.79.8	192.168.2.16
May 8, 2024 08:41:58.295844078 CEST	21	51647	34.149.79.8	192.168.2.16
May 8, 2024 08:41:58.295901060 CEST	51647	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:58.305809021 CEST	2121	51588	115.93.215.205	192.168.2.16
May 8, 2024 08:41:58.307894945 CEST	51603	2121	192.168.2.16	71.73.217.147
May 8, 2024 08:41:58.308228016 CEST	51681	21	192.168.2.16	82.40.174.111
May 8, 2024 08:41:58.319089890 CEST	21	51572	196.210.0.111	192.168.2.16
May 8, 2024 08:41:58.321933031 CEST	21	51572	196.210.0.111	192.168.2.16
May 8, 2024 08:41:58.322098017 CEST	51572	21	192.168.2.16	196.210.0.111
May 8, 2024 08:41:58.323528051 CEST	21	51535	107.172.133.110	192.168.2.16
May 8, 2024 08:41:58.324127913 CEST	2121	51488	139.18.115.218	192.168.2.16
May 8, 2024 08:41:58.326467037 CEST	21	51487	139.18.115.218	192.168.2.16
May 8, 2024 08:41:58.338903904 CEST	51605	21	192.168.2.16	4.153.135.197
May 8, 2024 08:41:58.339381933 CEST	2121	51536	107.172.133.110	192.168.2.16
May 8, 2024 08:41:58.339524984 CEST	51682	2121	192.168.2.16	82.40.174.111
May 8, 2024 08:41:58.339616060 CEST	51683	21	192.168.2.16	38.239.154.176
May 8, 2024 08:41:58.361301899 CEST	21	51654	96.126.118.190	192.168.2.16
May 8, 2024 08:41:58.361421108 CEST	51654	21	192.168.2.16	96.126.118.190
May 8, 2024 08:41:58.362776995 CEST	21	51606	117.223.205.236	192.168.2.16
May 8, 2024 08:41:58.362957954 CEST	51606	21	192.168.2.16	117.223.205.236
May 8, 2024 08:41:58.370503902 CEST	21	51640	91.146.97.65	192.168.2.16
May 8, 2024 08:41:58.370599985 CEST	51640	21	192.168.2.16	91.146.97.65
May 8, 2024 08:41:58.370913029 CEST	51522	2121	192.168.2.16	89.66.140.251
May 8, 2024 08:41:58.371571064 CEST	51684	2121	192.168.2.16	38.239.154.176
May 8, 2024 08:41:58.371576071 CEST	51608	2121	192.168.2.16	4.153.135.197
May 8, 2024 08:41:58.371731043 CEST	51685	21	192.168.2.16	201.121.15.253
May 8, 2024 08:41:58.372411013 CEST	21	51560	91.146.97.65	192.168.2.16
May 8, 2024 08:41:58.372472048 CEST	51560	21	192.168.2.16	91.146.97.65
May 8, 2024 08:41:58.387173891 CEST	51686	2121	192.168.2.16	201.121.15.253
May 8, 2024 08:41:58.390620947 CEST	21	51616	144.202.82.213	192.168.2.16
May 8, 2024 08:41:58.391578913 CEST	2121	51660	96.126.118.190	192.168.2.16
May 8, 2024 08:41:58.391644001 CEST	51660	2121	192.168.2.16	96.126.118.190
May 8, 2024 08:41:58.402924061 CEST	51524	21	192.168.2.16	111.196.7.93
May 8, 2024 08:41:58.402924061 CEST	51523	2121	192.168.2.16	111.196.7.93
May 8, 2024 08:41:58.403120995 CEST	51687	21	192.168.2.16	104.221.50.132
May 8, 2024 08:41:58.404556990 CEST	21	51399	96.126.118.190	192.168.2.16
May 8, 2024 08:41:58.405966043 CEST	21	51598	161.106.93.255	192.168.2.16
May 8, 2024 08:41:58.406162024 CEST	2121	51599	161.106.93.255	192.168.2.16
May 8, 2024 08:41:58.406457901 CEST	2121	51618	144.202.82.213	192.168.2.16
May 8, 2024 08:41:58.419440031 CEST	51688	2121	192.168.2.16	70.15.235.5
May 8, 2024 08:41:58.419527054 CEST	51689	2121	192.168.2.16	104.221.50.132
May 8, 2024 08:41:58.419583082 CEST	51690	21	192.168.2.16	70.15.235.5
May 8, 2024 08:41:58.423855066 CEST	21	51426	38.38.120.85	192.168.2.16
May 8, 2024 08:41:58.424009085 CEST	51426	21	192.168.2.16	38.38.120.85
May 8, 2024 08:41:58.424151897 CEST	51691	21	192.168.2.16	38.38.120.85
May 8, 2024 08:41:58.434427023 CEST	2121	51402	96.126.118.190	192.168.2.16
May 8, 2024 08:41:58.434896946 CEST	51611	21	192.168.2.16	173.248.1.216
May 8, 2024 08:41:58.435103893 CEST	51692	21	192.168.2.16	171.105.188.71
May 8, 2024 08:41:58.443965912 CEST	21	51631	172.120.235.139	192.168.2.16
May 8, 2024 08:41:58.444222927 CEST	21	51631	172.120.235.139	192.168.2.16
May 8, 2024 08:41:58.444447994 CEST	51631	21	192.168.2.16	172.120.235.139
May 8, 2024 08:41:58.445749998 CEST	21	51579	171.244.37.116	192.168.2.16
May 8, 2024 08:41:58.445858002 CEST	51579	21	192.168.2.16	171.244.37.116
May 8, 2024 08:41:58.446038008 CEST	51693	21	192.168.2.16	171.244.37.116
May 8, 2024 08:41:58.454109907 CEST	2121	51646	34.149.79.8	192.168.2.16
May 8, 2024 08:41:58.454164982 CEST	51646	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:58.454262972 CEST	51646	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:58.454752922 CEST	51694	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:58.458111048 CEST	21	51647	34.149.79.8	192.168.2.16
May 8, 2024 08:41:58.458168030 CEST	51647	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:58.458225012 CEST	51647	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:58.458405018 CEST	51695	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:58.466862917 CEST	51619	21	192.168.2.16	222.94.83.70
May 8, 2024 08:41:58.466883898 CEST	51620	2121	192.168.2.16	222.94.83.70
May 8, 2024 08:41:58.466902018 CEST	51612	2121	192.168.2.16	173.248.1.216
May 8, 2024 08:41:58.467257977 CEST	51696	2121	192.168.2.16	171.105.188.71
May 8, 2024 08:41:58.467472076 CEST	51697	21	192.168.2.16	178.168.74.208
May 8, 2024 08:41:58.483536005 CEST	51698	2121	192.168.2.16	178.168.74.208
May 8, 2024 08:41:58.483593941 CEST	51699	21	192.168.2.16	40.65.234.134
May 8, 2024 08:41:58.490329027 CEST	21	51505	106.251.156.245	192.168.2.16
May 8, 2024 08:41:58.490761995 CEST	51700	2121	192.168.2.16	40.65.234.134
May 8, 2024 08:41:58.491677999 CEST	21	51632	84.44.255.254	192.168.2.16
May 8, 2024 08:41:58.491734028 CEST	51632	21	192.168.2.16	84.44.255.254
May 8, 2024 08:41:58.491832972 CEST	51632	21	192.168.2.16	84.44.255.254
May 8, 2024 08:41:58.492080927 CEST	51701	21	192.168.2.16	84.44.255.254
May 8, 2024 08:41:58.494529963 CEST	21	51511	183.117.68.98	192.168.2.16
May 8, 2024 08:41:58.499175072 CEST	51702	21	192.168.2.16	81.99.199.81
May 8, 2024 08:41:58.505944967 CEST	21	51661	220.82.54.26	192.168.2.16
May 8, 2024 08:41:58.513459921 CEST	21	51665	110.9.185.177	192.168.2.16
May 8, 2024 08:41:58.514038086 CEST	2121	51662	220.82.54.26	192.168.2.16
May 8, 2024 08:41:58.514101028 CEST	51703	2121	192.168.2.16	81.99.199.81
May 8, 2024 08:41:58.524285078 CEST	2121	51669	110.9.185.177	192.168.2.16
May 8, 2024 08:41:58.526402950 CEST	21	51656	181.1.177.128	192.168.2.16
May 8, 2024 08:41:58.528060913 CEST	2121	51513	183.117.68.98	192.168.2.16
May 8, 2024 08:41:58.530189037 CEST	51704	21	192.168.2.16	49.162.52.22
May 8, 2024 08:41:58.530210972 CEST	21	51630	46.34.34.117	192.168.2.16
May 8, 2024 08:41:58.530297041 CEST	51630	21	192.168.2.16	46.34.34.117
May 8, 2024 08:41:58.530488014 CEST	51705	2121	192.168.2.16	49.162.52.22
May 8, 2024 08:41:58.531635046 CEST	2121	51657	181.1.177.128	192.168.2.16
May 8, 2024 08:41:58.546467066 CEST	51706	21	192.168.2.16	71.104.39.238
May 8, 2024 08:41:58.546484947 CEST	51707	2121	192.168.2.16	71.104.39.238
May 8, 2024 08:41:58.546571970 CEST	51708	21	192.168.2.16	90.203.67.127
May 8, 2024 08:41:58.551647902 CEST	2121	51610	185.29.10.114	192.168.2.16
May 8, 2024 08:41:58.551759958 CEST	21	51609	185.29.10.114	192.168.2.16
May 8, 2024 08:41:58.557997942 CEST	2121	51506	106.251.156.245	192.168.2.16
May 8, 2024 08:41:58.558440924 CEST	51709	2121	192.168.2.16	90.203.67.127
May 8, 2024 08:41:58.561897993 CEST	51530	2121	192.168.2.16	73.192.135.157
May 8, 2024 08:41:58.562212944 CEST	51710	21	192.168.2.16	77.12.133.92
May 8, 2024 08:41:58.562217951 CEST	51529	21	192.168.2.16	73.192.135.157
May 8, 2024 08:41:58.578372002 CEST	51711	2121	192.168.2.16	77.12.133.92
May 8, 2024 08:41:58.580161095 CEST	51712	21	192.168.2.16	185.125.87.172
May 8, 2024 08:41:58.590943098 CEST	21	51621	77.75.121.3	192.168.2.16
May 8, 2024 08:41:58.590954065 CEST	21	51621	77.75.121.3	192.168.2.16
May 8, 2024 08:41:58.591130972 CEST	51621	21	192.168.2.16	77.75.121.3
May 8, 2024 08:41:58.593921900 CEST	51623	2121	192.168.2.16	111.176.24.3
May 8, 2024 08:41:58.602257013 CEST	21	51466	220.210.2.249	192.168.2.16
May 8, 2024 08:41:58.614201069 CEST	21	51691	38.38.120.85	192.168.2.16
May 8, 2024 08:41:58.614284039 CEST	51691	21	192.168.2.16	38.38.120.85
May 8, 2024 08:41:58.616220951 CEST	21	51426	38.38.120.85	192.168.2.16
May 8, 2024 08:41:58.616286039 CEST	51426	21	192.168.2.16	38.38.120.85
May 8, 2024 08:41:58.616564989 CEST	2121	51646	34.149.79.8	192.168.2.16
May 8, 2024 08:41:58.616887093 CEST	2121	51694	34.149.79.8	192.168.2.16
May 8, 2024 08:41:58.616961002 CEST	21	51426	38.38.120.85	192.168.2.16
May 8, 2024 08:41:58.616966963 CEST	51694	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:58.617003918 CEST	51426	21	192.168.2.16	38.38.120.85
May 8, 2024 08:41:58.620357990 CEST	21	51647	34.149.79.8	192.168.2.16
May 8, 2024 08:41:58.620835066 CEST	21	51695	34.149.79.8	192.168.2.16
May 8, 2024 08:41:58.620897055 CEST	51695	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:58.626224041 CEST	51713	2121	192.168.2.16	185.125.87.172
May 8, 2024 08:41:58.639522076 CEST	21	51683	38.239.154.176	192.168.2.16
May 8, 2024 08:41:58.639590025 CEST	51683	21	192.168.2.16	38.239.154.176
May 8, 2024 08:41:58.642151117 CEST	51714	21	192.168.2.16	112.230.106.237
May 8, 2024 08:41:58.642157078 CEST	2121	51470	220.210.2.249	192.168.2.16
May 8, 2024 08:41:58.645389080 CEST	21	51631	172.120.235.139	192.168.2.16
May 8, 2024 08:41:58.645524025 CEST	51631	21	192.168.2.16	172.120.235.139
May 8, 2024 08:41:58.645724058 CEST	51715	21	192.168.2.16	172.120.235.139
May 8, 2024 08:41:58.657943964 CEST	51531	21	192.168.2.16	94.246.159.126
May 8, 2024 08:41:58.657944918 CEST	51547	21	192.168.2.16	24.181.75.133
May 8, 2024 08:41:58.658412933 CEST	51716	2121	192.168.2.16	112.230.106.237
May 8, 2024 08:41:58.673933983 CEST	51532	2121	192.168.2.16	94.246.159.126
May 8, 2024 08:41:58.673937082 CEST	51549	2121	192.168.2.16	24.181.75.133
May 8, 2024 08:41:58.720902920 CEST	51622	21	192.168.2.16	111.176.24.3
May 8, 2024 08:41:58.733604908 CEST	21	51640	91.146.97.65	192.168.2.16
May 8, 2024 08:41:58.733850956 CEST	51640	21	192.168.2.16	91.146.97.65
May 8, 2024 08:41:58.735877037 CEST	51633	2121	192.168.2.16	46.34.34.117
May 8, 2024 08:41:58.735887051 CEST	51636	21	192.168.2.16	218.90.197.5
May 8, 2024 08:41:58.751934052 CEST	51637	2121	192.168.2.16	218.90.197.5
May 8, 2024 08:41:58.779258966 CEST	21	51619	222.94.83.70	192.168.2.16
May 8, 2024 08:41:58.779453039 CEST	2121	51694	34.149.79.8	192.168.2.16
May 8, 2024 08:41:58.779572010 CEST	51694	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:58.779669046 CEST	51694	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:58.779948950 CEST	51717	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:58.780603886 CEST	2121	51620	222.94.83.70	192.168.2.16
May 8, 2024 08:41:58.783420086 CEST	21	51695	34.149.79.8	192.168.2.16
May 8, 2024 08:41:58.783469915 CEST	51695	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:58.783590078 CEST	51695	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:58.783858061 CEST	51718	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:58.783870935 CEST	51587	21	192.168.2.16	115.93.215.205
May 8, 2024 08:41:58.783916950 CEST	51626	21	192.168.2.16	24.200.106.1
May 8, 2024 08:41:58.784142017 CEST	51719	21	192.168.2.16	79.226.2.81
May 8, 2024 08:41:58.797394037 CEST	21	51693	171.244.37.116	192.168.2.16
May 8, 2024 08:41:58.797468901 CEST	51693	21	192.168.2.16	171.244.37.116
May 8, 2024 08:41:58.799251080 CEST	51720	2121	192.168.2.16	79.226.2.81
May 8, 2024 08:41:58.799350977 CEST	51721	21	192.168.2.16	207.55.237.38
May 8, 2024 08:41:58.806060076 CEST	21	51691	38.38.120.85	192.168.2.16
May 8, 2024 08:41:58.806216002 CEST	51691	21	192.168.2.16	38.38.120.85
May 8, 2024 08:41:58.806437969 CEST	21	51632	84.44.255.254	192.168.2.16
May 8, 2024 08:41:58.811501980 CEST	21	51701	84.44.255.254	192.168.2.16
May 8, 2024 08:41:58.811564922 CEST	51701	21	192.168.2.16	84.44.255.254
May 8, 2024 08:41:58.814899921 CEST	51588	2121	192.168.2.16	115.93.215.205
May 8, 2024 08:41:58.814902067 CEST	51629	2121	192.168.2.16	24.200.106.1
May 8, 2024 08:41:58.815326929 CEST	51722	2121	192.168.2.16	207.55.237.38
May 8, 2024 08:41:58.815457106 CEST	51723	21	192.168.2.16	104.91.72.140
May 8, 2024 08:41:58.816660881 CEST	21	51579	171.244.37.116	192.168.2.16
May 8, 2024 08:41:58.816679001 CEST	21	51579	171.244.37.116	192.168.2.16
May 8, 2024 08:41:58.816735983 CEST	51579	21	192.168.2.16	171.244.37.116
May 8, 2024 08:41:58.827327967 CEST	21	51715	172.120.235.139	192.168.2.16
May 8, 2024 08:41:58.827383995 CEST	51715	21	192.168.2.16	172.120.235.139
May 8, 2024 08:41:58.827385902 CEST	21	51631	172.120.235.139	192.168.2.16
May 8, 2024 08:41:58.827454090 CEST	51631	21	192.168.2.16	172.120.235.139
May 8, 2024 08:41:58.830871105 CEST	51535	21	192.168.2.16	107.172.133.110
May 8, 2024 08:41:58.839397907 CEST	21	51572	196.210.0.111	192.168.2.16
May 8, 2024 08:41:58.846956015 CEST	51536	2121	192.168.2.16	107.172.133.110
May 8, 2024 08:41:58.847201109 CEST	51724	2121	192.168.2.16	104.91.72.140
May 8, 2024 08:41:58.874257088 CEST	21	51630	46.34.34.117	192.168.2.16
May 8, 2024 08:41:58.877897978 CEST	51634	21	192.168.2.16	23.46.114.5
May 8, 2024 08:41:58.878731012 CEST	21	51630	46.34.34.117	192.168.2.16
May 8, 2024 08:41:58.878787994 CEST	51630	21	192.168.2.16	46.34.34.117
May 8, 2024 08:41:58.881383896 CEST	21	51606	117.223.205.236	192.168.2.16
May 8, 2024 08:41:58.882175922 CEST	21	51606	117.223.205.236	192.168.2.16
May 8, 2024 08:41:58.882356882 CEST	51606	21	192.168.2.16	117.223.205.236
May 8, 2024 08:41:58.893892050 CEST	51616	21	192.168.2.16	144.202.82.213
May 8, 2024 08:41:58.908888102 CEST	51635	2121	192.168.2.16	23.46.114.5
May 8, 2024 08:41:58.908896923 CEST	51598	21	192.168.2.16	161.106.93.255
May 8, 2024 08:41:58.908900976 CEST	51618	2121	192.168.2.16	144.202.82.213
May 8, 2024 08:41:58.909032106 CEST	51599	2121	192.168.2.16	161.106.93.255
May 8, 2024 08:41:58.921591997 CEST	21	51547	24.181.75.133	192.168.2.16
May 8, 2024 08:41:58.935168028 CEST	2121	51549	24.181.75.133	192.168.2.16
May 8, 2024 08:41:58.940793991 CEST	21	51621	77.75.121.3	192.168.2.16
May 8, 2024 08:41:58.940826893 CEST	21	51683	38.239.154.176	192.168.2.16
May 8, 2024 08:41:58.940979958 CEST	51683	21	192.168.2.16	38.239.154.176
May 8, 2024 08:41:58.941330910 CEST	51725	21	192.168.2.16	187.53.165.205
May 8, 2024 08:41:58.941780090 CEST	2121	51694	34.149.79.8	192.168.2.16
May 8, 2024 08:41:58.942369938 CEST	2121	51717	34.149.79.8	192.168.2.16
May 8, 2024 08:41:58.942435026 CEST	51717	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:58.942497015 CEST	2121	51623	111.176.24.3	192.168.2.16
May 8, 2024 08:41:58.945935965 CEST	21	51695	34.149.79.8	192.168.2.16
May 8, 2024 08:41:58.946191072 CEST	21	51718	34.149.79.8	192.168.2.16
May 8, 2024 08:41:58.946264029 CEST	51718	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:58.986895084 CEST	51538	21	192.168.2.16	201.34.86.42
May 8, 2024 08:41:58.996244907 CEST	21	51691	38.38.120.85	192.168.2.16
May 8, 2024 08:41:58.996328115 CEST	21	51691	38.38.120.85	192.168.2.16
May 8, 2024 08:41:58.996510983 CEST	51691	21	192.168.2.16	38.38.120.85
May 8, 2024 08:41:59.003285885 CEST	51726	2121	192.168.2.16	187.53.165.205
May 8, 2024 08:41:59.018908978 CEST	51665	21	192.168.2.16	110.9.185.177
May 8, 2024 08:41:59.018909931 CEST	51662	2121	192.168.2.16	220.82.54.26
May 8, 2024 08:41:59.018923998 CEST	51661	21	192.168.2.16	220.82.54.26
May 8, 2024 08:41:59.019083977 CEST	51539	2121	192.168.2.16	201.34.86.42
May 8, 2024 08:41:59.034873962 CEST	51639	2121	192.168.2.16	178.153.63.96
May 8, 2024 08:41:59.034874916 CEST	51638	21	192.168.2.16	178.153.63.96
May 8, 2024 08:41:59.034884930 CEST	51669	2121	192.168.2.16	110.9.185.177
May 8, 2024 08:41:59.034884930 CEST	51657	2121	192.168.2.16	181.1.177.128
May 8, 2024 08:41:59.034889936 CEST	51656	21	192.168.2.16	181.1.177.128
May 8, 2024 08:41:59.044787884 CEST	21	51715	172.120.235.139	192.168.2.16
May 8, 2024 08:41:59.044970036 CEST	51715	21	192.168.2.16	172.120.235.139
May 8, 2024 08:41:59.050889015 CEST	51540	21	192.168.2.16	2.89.128.43
May 8, 2024 08:41:59.053380966 CEST	21	51535	107.172.133.110	192.168.2.16
May 8, 2024 08:41:59.056617022 CEST	21	51616	144.202.82.213	192.168.2.16
May 8, 2024 08:41:59.066870928 CEST	51610	2121	192.168.2.16	185.29.10.114
May 8, 2024 08:41:59.066873074 CEST	51641	21	192.168.2.16	176.109.167.187
May 8, 2024 08:41:59.066889048 CEST	51609	21	192.168.2.16	185.29.10.114
May 8, 2024 08:41:59.066900969 CEST	51642	2121	192.168.2.16	176.109.167.187
May 8, 2024 08:41:59.067244053 CEST	51727	21	192.168.2.16	35.187.10.121
May 8, 2024 08:41:59.069562912 CEST	2121	51536	107.172.133.110	192.168.2.16
May 8, 2024 08:41:59.071407080 CEST	2121	51618	144.202.82.213	192.168.2.16
May 8, 2024 08:41:59.071988106 CEST	21	51636	218.90.197.5	192.168.2.16
May 8, 2024 08:41:59.073637009 CEST	21	51640	91.146.97.65	192.168.2.16
May 8, 2024 08:41:59.073841095 CEST	21	51640	91.146.97.65	192.168.2.16
May 8, 2024 08:41:59.073997021 CEST	51640	21	192.168.2.16	91.146.97.65
May 8, 2024 08:41:59.077266932 CEST	2121	51633	46.34.34.117	192.168.2.16
May 8, 2024 08:41:59.083168030 CEST	51728	2121	192.168.2.16	35.187.10.121
May 8, 2024 08:41:59.085421085 CEST	2121	51637	218.90.197.5	192.168.2.16
May 8, 2024 08:41:59.104809999 CEST	2121	51717	34.149.79.8	192.168.2.16
May 8, 2024 08:41:59.104872942 CEST	51717	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:59.104975939 CEST	51717	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:59.105238914 CEST	51729	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:59.108761072 CEST	21	51718	34.149.79.8	192.168.2.16
May 8, 2024 08:41:59.108823061 CEST	51718	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:59.108877897 CEST	51718	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:59.109029055 CEST	51730	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:59.114871979 CEST	51645	21	192.168.2.16	110.12.247.33
May 8, 2024 08:41:59.114875078 CEST	51643	21	192.168.2.16	92.116.142.54
May 8, 2024 08:41:59.114887953 CEST	51644	2121	192.168.2.16	92.116.142.54
May 8, 2024 08:41:59.115200043 CEST	51731	21	192.168.2.16	75.191.9.101
May 8, 2024 08:41:59.122941017 CEST	21	51587	115.93.215.205	192.168.2.16
May 8, 2024 08:41:59.131089926 CEST	21	51701	84.44.255.254	192.168.2.16
May 8, 2024 08:41:59.131156921 CEST	51701	21	192.168.2.16	84.44.255.254
May 8, 2024 08:41:59.131232977 CEST	51701	21	192.168.2.16	84.44.255.254
May 8, 2024 08:41:59.131516933 CEST	51732	21	192.168.2.16	84.44.255.254
May 8, 2024 08:41:59.146872044 CEST	51648	21	192.168.2.16	70.172.0.35
May 8, 2024 08:41:59.146872997 CEST	51649	2121	192.168.2.16	110.12.247.33
May 8, 2024 08:41:59.146883965 CEST	51652	21	192.168.2.16	2.33.15.110
May 8, 2024 08:41:59.146883965 CEST	51650	2121	192.168.2.16	70.172.0.35
May 8, 2024 08:41:59.148127079 CEST	51651	2121	192.168.2.16	2.33.15.110
May 8, 2024 08:41:59.148874998 CEST	21	51693	171.244.37.116	192.168.2.16
May 8, 2024 08:41:59.148994923 CEST	51693	21	192.168.2.16	171.244.37.116
May 8, 2024 08:41:59.158715010 CEST	2121	51588	115.93.215.205	192.168.2.16
May 8, 2024 08:41:59.178879976 CEST	51655	21	192.168.2.16	116.3.153.94
May 8, 2024 08:41:59.194868088 CEST	51658	2121	192.168.2.16	116.3.153.94
May 8, 2024 08:41:59.210897923 CEST	51663	21	192.168.2.16	58.35.54.196
May 8, 2024 08:41:59.213018894 CEST	51664	2121	192.168.2.16	58.35.54.196
May 8, 2024 08:41:59.225764990 CEST	21	51691	38.38.120.85	192.168.2.16
May 8, 2024 08:41:59.226605892 CEST	21	51715	172.120.235.139	192.168.2.16
May 8, 2024 08:41:59.226871014 CEST	51668	21	192.168.2.16	82.84.152.3
May 8, 2024 08:41:59.226880074 CEST	51666	2121	192.168.2.16	69.251.164.110
May 8, 2024 08:41:59.227103949 CEST	21	51715	172.120.235.139	192.168.2.16
May 8, 2024 08:41:59.227250099 CEST	51715	21	192.168.2.16	172.120.235.139
May 8, 2024 08:41:59.227441072 CEST	51733	2121	192.168.2.16	75.191.9.101
May 8, 2024 08:41:59.230036974 CEST	21	51598	161.106.93.255	192.168.2.16
May 8, 2024 08:41:59.230216980 CEST	2121	51599	161.106.93.255	192.168.2.16
May 8, 2024 08:41:59.239862919 CEST	51667	21	192.168.2.16	69.251.164.110
May 8, 2024 08:41:59.240938902 CEST	21	51683	38.239.154.176	192.168.2.16
May 8, 2024 08:41:59.240997076 CEST	51683	21	192.168.2.16	38.239.154.176
May 8, 2024 08:41:59.241655111 CEST	21	51683	38.239.154.176	192.168.2.16
May 8, 2024 08:41:59.241698027 CEST	51683	21	192.168.2.16	38.239.154.176
May 8, 2024 08:41:59.242894888 CEST	51670	21	192.168.2.16	70.82.231.190
May 8, 2024 08:41:59.242894888 CEST	51671	2121	192.168.2.16	82.84.152.3
May 8, 2024 08:41:59.243217945 CEST	51734	21	192.168.2.16	39.118.4.87
May 8, 2024 08:41:59.258909941 CEST	51673	21	192.168.2.16	86.20.223.64
May 8, 2024 08:41:59.258936882 CEST	51674	2121	192.168.2.16	86.20.223.64
May 8, 2024 08:41:59.258955956 CEST	51672	2121	192.168.2.16	70.82.231.190
May 8, 2024 08:41:59.267308950 CEST	2121	51717	34.149.79.8	192.168.2.16
May 8, 2024 08:41:59.267626047 CEST	2121	51729	34.149.79.8	192.168.2.16
May 8, 2024 08:41:59.267692089 CEST	51729	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:59.271292925 CEST	21	51718	34.149.79.8	192.168.2.16
May 8, 2024 08:41:59.271397114 CEST	21	51730	34.149.79.8	192.168.2.16
May 8, 2024 08:41:59.271460056 CEST	51730	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:59.274871111 CEST	51677	21	192.168.2.16	49.116.19.240
May 8, 2024 08:41:59.274897099 CEST	51676	2121	192.168.2.16	24.98.55.117
May 8, 2024 08:41:59.274898052 CEST	51675	21	192.168.2.16	24.98.55.117
May 8, 2024 08:41:59.290888071 CEST	51620	2121	192.168.2.16	222.94.83.70
May 8, 2024 08:41:59.290889025 CEST	51678	21	192.168.2.16	101.206.67.127
May 8, 2024 08:41:59.292085886 CEST	51679	2121	192.168.2.16	49.116.19.240
May 8, 2024 08:41:59.292085886 CEST	51619	21	192.168.2.16	222.94.83.70
May 8, 2024 08:41:59.292088985 CEST	51544	2121	192.168.2.16	2.89.128.43
May 8, 2024 08:41:59.306868076 CEST	51680	2121	192.168.2.16	101.206.67.127
May 8, 2024 08:41:59.322880030 CEST	51681	21	192.168.2.16	82.40.174.111
May 8, 2024 08:41:59.327460051 CEST	21	51665	110.9.185.177	192.168.2.16
May 8, 2024 08:41:59.335321903 CEST	2121	51662	220.82.54.26	192.168.2.16
May 8, 2024 08:41:59.338661909 CEST	21	51661	220.82.54.26	192.168.2.16
May 8, 2024 08:41:59.338898897 CEST	51682	2121	192.168.2.16	82.40.174.111
May 8, 2024 08:41:59.339340925 CEST	51735	2121	192.168.2.16	39.118.4.87
May 8, 2024 08:41:59.346066952 CEST	21	51606	117.223.205.236	192.168.2.16
May 8, 2024 08:41:59.348237991 CEST	2121	51669	110.9.185.177	192.168.2.16
May 8, 2024 08:41:59.354902983 CEST	51545	21	192.168.2.16	36.94.62.184
May 8, 2024 08:41:59.354912996 CEST	51546	2121	192.168.2.16	36.94.62.184
May 8, 2024 08:41:59.355315924 CEST	51736	21	192.168.2.16	104.81.200.21
May 8, 2024 08:41:59.373769999 CEST	2121	51610	185.29.10.114	192.168.2.16
May 8, 2024 08:41:59.373881102 CEST	21	51609	185.29.10.114	192.168.2.16
May 8, 2024 08:41:59.386899948 CEST	51684	2121	192.168.2.16	38.239.154.176
May 8, 2024 08:41:59.386899948 CEST	51685	21	192.168.2.16	201.121.15.253
May 8, 2024 08:41:59.400238037 CEST	21	51656	181.1.177.128	192.168.2.16
May 8, 2024 08:41:59.400502920 CEST	2121	51657	181.1.177.128	192.168.2.16
May 8, 2024 08:41:59.401870966 CEST	51548	21	192.168.2.16	81.97.26.213
May 8, 2024 08:41:59.401917934 CEST	51550	2121	192.168.2.16	81.97.26.213
May 8, 2024 08:41:59.402879953 CEST	51686	2121	192.168.2.16	201.121.15.253
May 8, 2024 08:41:59.417267084 CEST	21	51640	91.146.97.65	192.168.2.16
May 8, 2024 08:41:59.417443037 CEST	51640	21	192.168.2.16	91.146.97.65
May 8, 2024 08:41:59.417720079 CEST	51737	21	192.168.2.16	91.146.97.65
May 8, 2024 08:41:59.419868946 CEST	51687	21	192.168.2.16	104.221.50.132
May 8, 2024 08:41:59.431292057 CEST	2121	51729	34.149.79.8	192.168.2.16
May 8, 2024 08:41:59.431361914 CEST	51729	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:59.431499958 CEST	51729	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:59.431812048 CEST	51738	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:59.433865070 CEST	51690	21	192.168.2.16	70.15.235.5
May 8, 2024 08:41:59.433870077 CEST	51688	2121	192.168.2.16	70.15.235.5
May 8, 2024 08:41:59.433916092 CEST	51551	21	192.168.2.16	171.6.13.50
May 8, 2024 08:41:59.433916092 CEST	51689	2121	192.168.2.16	104.221.50.132
May 8, 2024 08:41:59.433917999 CEST	51547	21	192.168.2.16	24.181.75.133
May 8, 2024 08:41:59.436248064 CEST	21	51730	34.149.79.8	192.168.2.16
May 8, 2024 08:41:59.436315060 CEST	51730	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:59.436381102 CEST	51730	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:59.436564922 CEST	51739	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:59.439165115 CEST	21	51715	172.120.235.139	192.168.2.16
May 8, 2024 08:41:59.439292908 CEST	51715	21	192.168.2.16	172.120.235.139
May 8, 2024 08:41:59.439471960 CEST	51740	21	192.168.2.16	172.120.235.139
May 8, 2024 08:41:59.449892044 CEST	51692	21	192.168.2.16	171.105.188.71
May 8, 2024 08:41:59.449928045 CEST	51623	2121	192.168.2.16	111.176.24.3
May 8, 2024 08:41:59.450248003 CEST	51549	2121	192.168.2.16	24.181.75.133
May 8, 2024 08:41:59.450248957 CEST	51741	2121	192.168.2.16	104.81.200.21
May 8, 2024 08:41:59.450275898 CEST	51742	21	192.168.2.16	189.191.138.135
May 8, 2024 08:41:59.455621958 CEST	21	51701	84.44.255.254	192.168.2.16
May 8, 2024 08:41:59.455866098 CEST	21	51732	84.44.255.254	192.168.2.16
May 8, 2024 08:41:59.455935001 CEST	51732	21	192.168.2.16	84.44.255.254
May 8, 2024 08:41:59.465898991 CEST	51552	21	192.168.2.16	140.246.149.38
May 8, 2024 08:41:59.466017008 CEST	51553	2121	192.168.2.16	171.6.13.50
May 8, 2024 08:41:59.481873035 CEST	51697	21	192.168.2.16	178.168.74.208
May 8, 2024 08:41:59.481935024 CEST	51696	2121	192.168.2.16	171.105.188.71
May 8, 2024 08:41:59.489900112 CEST	51554	2121	192.168.2.16	140.246.149.38
May 8, 2024 08:41:59.497881889 CEST	51700	2121	192.168.2.16	40.65.234.134
May 8, 2024 08:41:59.497895002 CEST	51698	2121	192.168.2.16	178.168.74.208
May 8, 2024 08:41:59.497912884 CEST	51699	21	192.168.2.16	40.65.234.134
May 8, 2024 08:41:59.502446890 CEST	21	51693	171.244.37.116	192.168.2.16
May 8, 2024 08:41:59.502633095 CEST	51693	21	192.168.2.16	171.244.37.116
May 8, 2024 08:41:59.513911009 CEST	51702	21	192.168.2.16	81.99.199.81
May 8, 2024 08:41:59.514259100 CEST	51743	2121	192.168.2.16	189.191.138.135
May 8, 2024 08:41:59.529900074 CEST	51703	2121	192.168.2.16	81.99.199.81
May 8, 2024 08:41:59.530256987 CEST	51705	2121	192.168.2.16	49.162.52.22
May 8, 2024 08:41:59.545907974 CEST	51706	21	192.168.2.16	71.104.39.238
May 8, 2024 08:41:59.545912027 CEST	51704	21	192.168.2.16	49.162.52.22
May 8, 2024 08:41:59.560905933 CEST	51708	21	192.168.2.16	90.203.67.127
May 8, 2024 08:41:59.560908079 CEST	51707	2121	192.168.2.16	71.104.39.238
May 8, 2024 08:41:59.560939074 CEST	51709	2121	192.168.2.16	90.203.67.127
May 8, 2024 08:41:59.561009884 CEST	51616	21	192.168.2.16	144.202.82.213
May 8, 2024 08:41:59.561764002 CEST	51744	21	192.168.2.16	121.162.79.53
May 8, 2024 08:41:59.561840057 CEST	51746	2121	192.168.2.16	121.162.79.53
May 8, 2024 08:41:59.561842918 CEST	51745	21	192.168.2.16	86.17.40.125
May 8, 2024 08:41:59.561940908 CEST	51747	2121	192.168.2.16	86.17.40.125
May 8, 2024 08:41:59.561965942 CEST	51748	21	192.168.2.16	75.145.238.34
May 8, 2024 08:41:59.561980009 CEST	51749	2121	192.168.2.16	75.145.238.34
May 8, 2024 08:41:59.576921940 CEST	51557	2121	192.168.2.16	166.82.122.173
May 8, 2024 08:41:59.576941967 CEST	51633	2121	192.168.2.16	46.34.34.117
May 8, 2024 08:41:59.576942921 CEST	51710	21	192.168.2.16	77.12.133.92
May 8, 2024 08:41:59.576946020 CEST	51618	2121	192.168.2.16	144.202.82.213
May 8, 2024 08:41:59.576953888 CEST	51636	21	192.168.2.16	218.90.197.5
May 8, 2024 08:41:59.576957941 CEST	51558	21	192.168.2.16	166.82.122.173
May 8, 2024 08:41:59.577066898 CEST	51712	21	192.168.2.16	185.125.87.172
May 8, 2024 08:41:59.577564955 CEST	51751	21	192.168.2.16	54.230.170.170
May 8, 2024 08:41:59.577565908 CEST	51750	2121	192.168.2.16	54.230.170.170
May 8, 2024 08:41:59.577594995 CEST	51752	21	192.168.2.16	76.148.136.69
May 8, 2024 08:41:59.577800035 CEST	51753	2121	192.168.2.16	76.148.136.69
May 8, 2024 08:41:59.591939926 CEST	51637	2121	192.168.2.16	218.90.197.5
May 8, 2024 08:41:59.592710018 CEST	51754	21	192.168.2.16	201.153.177.143
May 8, 2024 08:41:59.592801094 CEST	51755	2121	192.168.2.16	201.153.177.143
May 8, 2024 08:41:59.592899084 CEST	51757	2121	192.168.2.16	73.168.122.223
May 8, 2024 08:41:59.593056917 CEST	51756	21	192.168.2.16	73.168.122.223
May 8, 2024 08:41:59.593056917 CEST	51758	21	192.168.2.16	61.69.129.118
May 8, 2024 08:41:59.594270945 CEST	51711	2121	192.168.2.16	77.12.133.92
May 8, 2024 08:41:59.595458984 CEST	2121	51729	34.149.79.8	192.168.2.16
May 8, 2024 08:41:59.595478058 CEST	2121	51738	34.149.79.8	192.168.2.16
May 8, 2024 08:41:59.595558882 CEST	51738	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:59.600183964 CEST	21	51730	34.149.79.8	192.168.2.16
May 8, 2024 08:41:59.600323915 CEST	21	51739	34.149.79.8	192.168.2.16
May 8, 2024 08:41:59.600392103 CEST	51739	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:59.604589939 CEST	21	51619	222.94.83.70	192.168.2.16
May 8, 2024 08:41:59.607537985 CEST	2121	51620	222.94.83.70	192.168.2.16
May 8, 2024 08:41:59.608892918 CEST	51759	2121	192.168.2.16	61.69.129.118
May 8, 2024 08:41:59.608937025 CEST	51760	21	192.168.2.16	13.225.244.13
May 8, 2024 08:41:59.609072924 CEST	51761	2121	192.168.2.16	13.225.244.13
May 8, 2024 08:41:59.609072924 CEST	51762	21	192.168.2.16	39.37.186.200
May 8, 2024 08:41:59.609195948 CEST	51763	2121	192.168.2.16	39.37.186.200
May 8, 2024 08:41:59.621886969 CEST	21	51715	172.120.235.139	192.168.2.16
May 8, 2024 08:41:59.621898890 CEST	21	51740	172.120.235.139	192.168.2.16
May 8, 2024 08:41:59.621942043 CEST	51715	21	192.168.2.16	172.120.235.139
May 8, 2024 08:41:59.621997118 CEST	51740	21	192.168.2.16	172.120.235.139
May 8, 2024 08:41:59.623900890 CEST	51587	21	192.168.2.16	115.93.215.205
May 8, 2024 08:41:59.624620914 CEST	51764	21	192.168.2.16	44.4.44.152
May 8, 2024 08:41:59.624895096 CEST	51765	21	192.168.2.16	222.234.203.15
May 8, 2024 08:41:59.624975920 CEST	51767	2121	192.168.2.16	222.234.203.15
May 8, 2024 08:41:59.624989033 CEST	51766	2121	192.168.2.16	44.4.44.152
May 8, 2024 08:41:59.625021935 CEST	51768	21	192.168.2.16	177.201.12.61
May 8, 2024 08:41:59.639904022 CEST	51713	2121	192.168.2.16	185.125.87.172
May 8, 2024 08:41:59.640080929 CEST	51769	2121	192.168.2.16	177.201.12.61
May 8, 2024 08:41:59.655869961 CEST	51714	21	192.168.2.16	112.230.106.237
May 8, 2024 08:41:59.655872107 CEST	51561	21	192.168.2.16	20.209.27.3
May 8, 2024 08:41:59.671866894 CEST	51716	2121	192.168.2.16	112.230.106.237
May 8, 2024 08:41:59.671900034 CEST	51588	2121	192.168.2.16	115.93.215.205
May 8, 2024 08:41:59.695940971 CEST	21	51547	24.181.75.133	192.168.2.16
May 8, 2024 08:41:59.696439028 CEST	51770	21	192.168.2.16	156.233.130.116
May 8, 2024 08:41:59.711896896 CEST	2121	51549	24.181.75.133	192.168.2.16
May 8, 2024 08:41:59.712356091 CEST	51771	2121	192.168.2.16	156.233.130.116
May 8, 2024 08:41:59.719908953 CEST	51563	2121	192.168.2.16	20.209.27.3
May 8, 2024 08:41:59.723648071 CEST	21	51616	144.202.82.213	192.168.2.16
May 8, 2024 08:41:59.735905886 CEST	51598	21	192.168.2.16	161.106.93.255
May 8, 2024 08:41:59.735965014 CEST	51599	2121	192.168.2.16	161.106.93.255
May 8, 2024 08:41:59.739532948 CEST	2121	51618	144.202.82.213	192.168.2.16
May 8, 2024 08:41:59.751914978 CEST	51566	2121	192.168.2.16	61.176.85.7
May 8, 2024 08:41:59.757778883 CEST	2121	51738	34.149.79.8	192.168.2.16
May 8, 2024 08:41:59.757893085 CEST	51738	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:59.758057117 CEST	51738	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:59.758167982 CEST	21	51640	91.146.97.65	192.168.2.16
May 8, 2024 08:41:59.758224010 CEST	21	51737	91.146.97.65	192.168.2.16
May 8, 2024 08:41:59.758284092 CEST	51640	21	192.168.2.16	91.146.97.65
May 8, 2024 08:41:59.758353949 CEST	51737	21	192.168.2.16	91.146.97.65
May 8, 2024 08:41:59.758694887 CEST	51772	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:59.763660908 CEST	21	51739	34.149.79.8	192.168.2.16
May 8, 2024 08:41:59.763741970 CEST	51739	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:59.763782978 CEST	51739	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:59.763971090 CEST	51773	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:59.767879963 CEST	51565	21	192.168.2.16	61.176.85.7
May 8, 2024 08:41:59.767920017 CEST	51567	21	192.168.2.16	20.238.61.125
May 8, 2024 08:41:59.775703907 CEST	21	51732	84.44.255.254	192.168.2.16
May 8, 2024 08:41:59.775784016 CEST	51732	21	192.168.2.16	84.44.255.254
May 8, 2024 08:41:59.775861025 CEST	51732	21	192.168.2.16	84.44.255.254
May 8, 2024 08:41:59.776104927 CEST	51774	21	192.168.2.16	84.44.255.254
May 8, 2024 08:41:59.783869028 CEST	51568	2121	192.168.2.16	20.238.61.125
May 8, 2024 08:41:59.783890009 CEST	51719	21	192.168.2.16	79.226.2.81
May 8, 2024 08:41:59.793730021 CEST	2121	51623	111.176.24.3	192.168.2.16
May 8, 2024 08:41:59.798902035 CEST	51720	2121	192.168.2.16	79.226.2.81
May 8, 2024 08:41:59.814898014 CEST	51569	21	192.168.2.16	174.103.83.164
May 8, 2024 08:41:59.814908981 CEST	51721	21	192.168.2.16	207.55.237.38
May 8, 2024 08:41:59.816018105 CEST	51723	21	192.168.2.16	104.91.72.140
May 8, 2024 08:41:59.816020012 CEST	51722	2121	192.168.2.16	207.55.237.38
May 8, 2024 08:41:59.822577953 CEST	21	51572	196.210.0.111	192.168.2.16
May 8, 2024 08:41:59.822737932 CEST	51572	21	192.168.2.16	196.210.0.111
May 8, 2024 08:41:59.822959900 CEST	51775	21	192.168.2.16	196.210.0.111
May 8, 2024 08:41:59.830893040 CEST	51665	21	192.168.2.16	110.9.185.177
May 8, 2024 08:41:59.841259956 CEST	21	51740	172.120.235.139	192.168.2.16
May 8, 2024 08:41:59.841444016 CEST	51740	21	192.168.2.16	172.120.235.139
May 8, 2024 08:41:59.846884012 CEST	51662	2121	192.168.2.16	220.82.54.26
May 8, 2024 08:41:59.846909046 CEST	51724	2121	192.168.2.16	104.91.72.140
May 8, 2024 08:41:59.846910954 CEST	51661	21	192.168.2.16	220.82.54.26
May 8, 2024 08:41:59.857212067 CEST	21	51693	171.244.37.116	192.168.2.16
May 8, 2024 08:41:59.857372046 CEST	51693	21	192.168.2.16	171.244.37.116
May 8, 2024 08:41:59.857580900 CEST	51776	21	192.168.2.16	171.244.37.116
May 8, 2024 08:41:59.862895966 CEST	51669	2121	192.168.2.16	110.9.185.177
May 8, 2024 08:41:59.873946905 CEST	21	51744	121.162.79.53	192.168.2.16
May 8, 2024 08:41:59.875605106 CEST	2121	51746	121.162.79.53	192.168.2.16
May 8, 2024 08:41:59.878895998 CEST	51610	2121	192.168.2.16	185.29.10.114
May 8, 2024 08:41:59.878896952 CEST	51609	21	192.168.2.16	185.29.10.114
May 8, 2024 08:41:59.879256010 CEST	51777	21	192.168.2.16	84.21.172.237
May 8, 2024 08:41:59.909404039 CEST	21	51636	218.90.197.5	192.168.2.16
May 8, 2024 08:41:59.910912991 CEST	51657	2121	192.168.2.16	181.1.177.128
May 8, 2024 08:41:59.910927057 CEST	51656	21	192.168.2.16	181.1.177.128
May 8, 2024 08:41:59.911303043 CEST	51778	2121	192.168.2.16	84.21.172.237
May 8, 2024 08:41:59.911401987 CEST	51779	21	192.168.2.16	115.140.24.177
May 8, 2024 08:41:59.916635990 CEST	2121	51633	46.34.34.117	192.168.2.16
May 8, 2024 08:41:59.921619892 CEST	2121	51738	34.149.79.8	192.168.2.16
May 8, 2024 08:41:59.921648979 CEST	2121	51772	34.149.79.8	192.168.2.16
May 8, 2024 08:41:59.921724081 CEST	51772	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:41:59.925586939 CEST	2121	51637	218.90.197.5	192.168.2.16
May 8, 2024 08:41:59.927032948 CEST	21	51739	34.149.79.8	192.168.2.16
May 8, 2024 08:41:59.927587032 CEST	21	51773	34.149.79.8	192.168.2.16
May 8, 2024 08:41:59.927649021 CEST	51773	21	192.168.2.16	34.149.79.8
May 8, 2024 08:41:59.942908049 CEST	51725	21	192.168.2.16	187.53.165.205
May 8, 2024 08:41:59.946022034 CEST	51575	2121	192.168.2.16	174.103.83.164
May 8, 2024 08:41:59.958935976 CEST	51578	2121	192.168.2.16	35.170.164.229
May 8, 2024 08:41:59.973150015 CEST	21	51587	115.93.215.205	192.168.2.16
May 8, 2024 08:41:59.973937988 CEST	51577	21	192.168.2.16	35.170.164.229
May 8, 2024 08:41:59.974863052 CEST	51580	21	192.168.2.16	38.191.174.28
May 8, 2024 08:41:59.989921093 CEST	51581	2121	192.168.2.16	38.191.174.28
May 8, 2024 08:42:00.005901098 CEST	51726	2121	192.168.2.16	187.53.165.205
May 8, 2024 08:42:00.006364107 CEST	51780	2121	192.168.2.16	115.140.24.177
May 8, 2024 08:42:00.013741016 CEST	21	51770	156.233.130.116	192.168.2.16
May 8, 2024 08:42:00.021897078 CEST	51582	21	192.168.2.16	92.12.90.137
May 8, 2024 08:42:00.024046898 CEST	21	51740	172.120.235.139	192.168.2.16
May 8, 2024 08:42:00.024255037 CEST	21	51740	172.120.235.139	192.168.2.16
May 8, 2024 08:42:00.024434090 CEST	51740	21	192.168.2.16	172.120.235.139
May 8, 2024 08:42:00.026104927 CEST	2121	51588	115.93.215.205	192.168.2.16
May 8, 2024 08:42:00.062694073 CEST	21	51598	161.106.93.255	192.168.2.16
May 8, 2024 08:42:00.062705994 CEST	2121	51599	161.106.93.255	192.168.2.16
May 8, 2024 08:42:00.068893909 CEST	51584	21	192.168.2.16	73.166.18.123
May 8, 2024 08:42:00.068896055 CEST	51583	2121	192.168.2.16	92.12.90.137
May 8, 2024 08:42:00.068918943 CEST	51727	21	192.168.2.16	35.187.10.121
May 8, 2024 08:42:00.072129965 CEST	51586	2121	192.168.2.16	73.166.18.123
May 8, 2024 08:42:00.084892035 CEST	51728	2121	192.168.2.16	35.187.10.121
May 8, 2024 08:42:00.085326910 CEST	51781	21	192.168.2.16	83.171.235.211
May 8, 2024 08:42:00.087471962 CEST	2121	51772	34.149.79.8	192.168.2.16
May 8, 2024 08:42:00.087532043 CEST	51772	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:00.087616920 CEST	51772	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:00.087924004 CEST	51782	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:00.091938972 CEST	21	51773	34.149.79.8	192.168.2.16
May 8, 2024 08:42:00.091995001 CEST	51773	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:00.092035055 CEST	51773	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:00.092164993 CEST	51783	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:00.094281912 CEST	21	51774	84.44.255.254	192.168.2.16
May 8, 2024 08:42:00.094345093 CEST	51774	21	192.168.2.16	84.44.255.254
May 8, 2024 08:42:00.098177910 CEST	21	51732	84.44.255.254	192.168.2.16
May 8, 2024 08:42:00.116905928 CEST	51620	2121	192.168.2.16	222.94.83.70
May 8, 2024 08:42:00.116911888 CEST	51619	21	192.168.2.16	222.94.83.70
May 8, 2024 08:42:00.116931915 CEST	51731	21	192.168.2.16	75.191.9.101
May 8, 2024 08:42:00.116940022 CEST	51589	21	192.168.2.16	102.37.219.214
May 8, 2024 08:42:00.121592999 CEST	21	51737	91.146.97.65	192.168.2.16
May 8, 2024 08:42:00.121728897 CEST	51737	21	192.168.2.16	91.146.97.65
May 8, 2024 08:42:00.143906116 CEST	21	51665	110.9.185.177	192.168.2.16
May 8, 2024 08:42:00.166687965 CEST	2121	51662	220.82.54.26	192.168.2.16
May 8, 2024 08:42:00.169924021 CEST	21	51661	220.82.54.26	192.168.2.16
May 8, 2024 08:42:00.175570011 CEST	2121	51669	110.9.185.177	192.168.2.16
May 8, 2024 08:42:00.189358950 CEST	2121	51610	185.29.10.114	192.168.2.16
May 8, 2024 08:42:00.189506054 CEST	21	51609	185.29.10.114	192.168.2.16
May 8, 2024 08:42:00.189932108 CEST	21	51777	84.21.172.237	192.168.2.16
May 8, 2024 08:42:00.192883968 CEST	51595	21	192.168.2.16	194.50.173.58
May 8, 2024 08:42:00.192887068 CEST	51594	2121	192.168.2.16	102.37.219.214
May 8, 2024 08:42:00.195960045 CEST	51596	2121	192.168.2.16	194.50.173.58
May 8, 2024 08:42:00.208458900 CEST	21	51693	171.244.37.116	192.168.2.16
May 8, 2024 08:42:00.208473921 CEST	21	51693	171.244.37.116	192.168.2.16
May 8, 2024 08:42:00.208484888 CEST	21	51776	171.244.37.116	192.168.2.16
May 8, 2024 08:42:00.208523989 CEST	51693	21	192.168.2.16	171.244.37.116
May 8, 2024 08:42:00.208574057 CEST	51776	21	192.168.2.16	171.244.37.116
May 8, 2024 08:42:00.227904081 CEST	51616	21	192.168.2.16	144.202.82.213
May 8, 2024 08:42:00.228482008 CEST	51733	2121	192.168.2.16	75.191.9.101
May 8, 2024 08:42:00.229299068 CEST	2121	51778	84.21.172.237	192.168.2.16
May 8, 2024 08:42:00.229432106 CEST	21	51740	172.120.235.139	192.168.2.16
May 8, 2024 08:42:00.229588032 CEST	51740	21	192.168.2.16	172.120.235.139
May 8, 2024 08:42:00.230000973 CEST	51784	21	192.168.2.16	172.120.235.139
May 8, 2024 08:42:00.243905067 CEST	51734	21	192.168.2.16	39.118.4.87
May 8, 2024 08:42:00.243905067 CEST	51618	2121	192.168.2.16	144.202.82.213
May 8, 2024 08:42:00.251272917 CEST	2121	51782	34.149.79.8	192.168.2.16
May 8, 2024 08:42:00.251288891 CEST	2121	51772	34.149.79.8	192.168.2.16
May 8, 2024 08:42:00.251355886 CEST	51782	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:00.254507065 CEST	21	51773	34.149.79.8	192.168.2.16
May 8, 2024 08:42:00.254539967 CEST	21	51783	34.149.79.8	192.168.2.16
May 8, 2024 08:42:00.254601955 CEST	51783	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:00.260534048 CEST	51785	2121	192.168.2.16	83.171.235.211
May 8, 2024 08:42:00.260598898 CEST	51786	21	192.168.2.16	171.95.102.10
May 8, 2024 08:42:00.275944948 CEST	2121	51657	181.1.177.128	192.168.2.16
May 8, 2024 08:42:00.275949001 CEST	51600	21	192.168.2.16	46.181.183.242
May 8, 2024 08:42:00.276376009 CEST	21	51656	181.1.177.128	192.168.2.16
May 8, 2024 08:42:00.291899920 CEST	51601	2121	192.168.2.16	46.181.183.242
May 8, 2024 08:42:00.291901112 CEST	51602	21	192.168.2.16	71.73.217.147
May 8, 2024 08:42:00.301791906 CEST	21	51775	196.210.0.111	192.168.2.16
May 8, 2024 08:42:00.301882982 CEST	51775	21	192.168.2.16	196.210.0.111
May 8, 2024 08:42:00.307090044 CEST	21	51572	196.210.0.111	192.168.2.16
May 8, 2024 08:42:00.307147980 CEST	51572	21	192.168.2.16	196.210.0.111
May 8, 2024 08:42:00.307904959 CEST	51603	2121	192.168.2.16	71.73.217.147
May 8, 2024 08:42:00.307909966 CEST	51623	2121	192.168.2.16	111.176.24.3
May 8, 2024 08:42:00.339899063 CEST	51605	21	192.168.2.16	4.153.135.197
May 8, 2024 08:42:00.341918945 CEST	51735	2121	192.168.2.16	39.118.4.87
May 8, 2024 08:42:00.370914936 CEST	51736	21	192.168.2.16	104.81.200.21
May 8, 2024 08:42:00.371237040 CEST	51787	2121	192.168.2.16	171.95.102.10
May 8, 2024 08:42:00.386903048 CEST	51608	2121	192.168.2.16	4.153.135.197
May 8, 2024 08:42:00.386934996 CEST	51744	21	192.168.2.16	121.162.79.53
May 8, 2024 08:42:00.386945009 CEST	51746	2121	192.168.2.16	121.162.79.53
May 8, 2024 08:42:00.390407085 CEST	21	51606	117.223.205.236	192.168.2.16
May 8, 2024 08:42:00.390636921 CEST	51606	21	192.168.2.16	117.223.205.236
May 8, 2024 08:42:00.390995026 CEST	51788	21	192.168.2.16	117.223.205.236
May 8, 2024 08:42:00.393985033 CEST	21	51616	144.202.82.213	192.168.2.16
May 8, 2024 08:42:00.394351959 CEST	21	51781	83.171.235.211	192.168.2.16
May 8, 2024 08:42:00.403383017 CEST	51789	21	192.168.2.16	18.154.135.191
May 8, 2024 08:42:00.403526068 CEST	51790	2121	192.168.2.16	18.154.135.191
May 8, 2024 08:42:00.408941984 CEST	2121	51618	144.202.82.213	192.168.2.16
May 8, 2024 08:42:00.409310102 CEST	51791	21	192.168.2.16	200.219.95.134
May 8, 2024 08:42:00.410484076 CEST	21	51774	84.44.255.254	192.168.2.16
May 8, 2024 08:42:00.410550117 CEST	51774	21	192.168.2.16	84.44.255.254
May 8, 2024 08:42:00.410681963 CEST	51774	21	192.168.2.16	84.44.255.254
May 8, 2024 08:42:00.410932064 CEST	51792	21	192.168.2.16	84.44.255.254
May 8, 2024 08:42:00.414657116 CEST	21	51784	172.120.235.139	192.168.2.16
May 8, 2024 08:42:00.414738894 CEST	51784	21	192.168.2.16	172.120.235.139
May 8, 2024 08:42:00.414763927 CEST	21	51740	172.120.235.139	192.168.2.16
May 8, 2024 08:42:00.414813995 CEST	51740	21	192.168.2.16	172.120.235.139
May 8, 2024 08:42:00.415889025 CEST	2121	51782	34.149.79.8	192.168.2.16
May 8, 2024 08:42:00.415956020 CEST	51782	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:00.416018963 CEST	51782	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:00.416210890 CEST	51793	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:00.418848991 CEST	21	51783	34.149.79.8	192.168.2.16
May 8, 2024 08:42:00.418898106 CEST	51636	21	192.168.2.16	218.90.197.5
May 8, 2024 08:42:00.418914080 CEST	51633	2121	192.168.2.16	46.34.34.117
May 8, 2024 08:42:00.419003010 CEST	51783	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:00.419003010 CEST	51783	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:00.419140100 CEST	51794	2121	192.168.2.16	200.219.95.134
May 8, 2024 08:42:00.419238091 CEST	51795	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:00.430526018 CEST	21	51619	222.94.83.70	192.168.2.16
May 8, 2024 08:42:00.431885958 CEST	2121	51620	222.94.83.70	192.168.2.16
May 8, 2024 08:42:00.434897900 CEST	51611	21	192.168.2.16	173.248.1.216
May 8, 2024 08:42:00.434902906 CEST	51637	2121	192.168.2.16	218.90.197.5
May 8, 2024 08:42:00.450901985 CEST	51741	2121	192.168.2.16	104.81.200.21
May 8, 2024 08:42:00.458882093 CEST	51742	21	192.168.2.16	189.191.138.135
May 8, 2024 08:42:00.460629940 CEST	21	51491	181.34.188.85	192.168.2.16
May 8, 2024 08:42:00.463411093 CEST	21	51737	91.146.97.65	192.168.2.16
May 8, 2024 08:42:00.463789940 CEST	21	51737	91.146.97.65	192.168.2.16
May 8, 2024 08:42:00.463939905 CEST	51737	21	192.168.2.16	91.146.97.65
May 8, 2024 08:42:00.481873989 CEST	51587	21	192.168.2.16	115.93.215.205
May 8, 2024 08:42:00.481901884 CEST	51612	2121	192.168.2.16	173.248.1.216
May 8, 2024 08:42:00.497894049 CEST	51145	2121	192.168.2.16	62.140.135.146
May 8, 2024 08:42:00.497936964 CEST	51144	21	192.168.2.16	62.140.135.146
May 8, 2024 08:42:00.514015913 CEST	51770	21	192.168.2.16	156.233.130.116
May 8, 2024 08:42:00.515052080 CEST	2121	51492	181.34.188.85	192.168.2.16
May 8, 2024 08:42:00.529930115 CEST	51743	2121	192.168.2.16	189.191.138.135
May 8, 2024 08:42:00.530010939 CEST	51588	2121	192.168.2.16	115.93.215.205
May 8, 2024 08:42:00.562460899 CEST	51796	21	192.168.2.16	115.19.136.196
May 8, 2024 08:42:00.562553883 CEST	21	51776	171.244.37.116	192.168.2.16
May 8, 2024 08:42:00.562592030 CEST	51797	2121	192.168.2.16	115.19.136.196
May 8, 2024 08:42:00.562748909 CEST	51776	21	192.168.2.16	171.244.37.116
May 8, 2024 08:42:00.565551996 CEST	2121	51785	83.171.235.211	192.168.2.16
May 8, 2024 08:42:00.568051100 CEST	21	51654	96.126.118.190	192.168.2.16
May 8, 2024 08:42:00.568224907 CEST	51654	21	192.168.2.16	96.126.118.190
May 8, 2024 08:42:00.576873064 CEST	51747	2121	192.168.2.16	86.17.40.125
May 8, 2024 08:42:00.576884985 CEST	51749	2121	192.168.2.16	75.145.238.34
May 8, 2024 08:42:00.576906919 CEST	51745	21	192.168.2.16	86.17.40.125
May 8, 2024 08:42:00.576909065 CEST	51598	21	192.168.2.16	161.106.93.255
May 8, 2024 08:42:00.576910973 CEST	51748	21	192.168.2.16	75.145.238.34
May 8, 2024 08:42:00.577006102 CEST	51599	2121	192.168.2.16	161.106.93.255
May 8, 2024 08:42:00.579737902 CEST	2121	51793	34.149.79.8	192.168.2.16
May 8, 2024 08:42:00.579794884 CEST	2121	51782	34.149.79.8	192.168.2.16
May 8, 2024 08:42:00.579792976 CEST	51793	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:00.582763910 CEST	21	51783	34.149.79.8	192.168.2.16
May 8, 2024 08:42:00.583262920 CEST	21	51795	34.149.79.8	192.168.2.16
May 8, 2024 08:42:00.583322048 CEST	51795	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:00.591873884 CEST	51751	21	192.168.2.16	54.230.170.170
May 8, 2024 08:42:00.591886997 CEST	51752	21	192.168.2.16	76.148.136.69
May 8, 2024 08:42:00.591897964 CEST	51755	2121	192.168.2.16	201.153.177.143
May 8, 2024 08:42:00.591922998 CEST	51750	2121	192.168.2.16	54.230.170.170
May 8, 2024 08:42:00.592021942 CEST	51753	2121	192.168.2.16	76.148.136.69
May 8, 2024 08:42:00.598200083 CEST	2121	51660	96.126.118.190	192.168.2.16
May 8, 2024 08:42:00.598485947 CEST	51660	2121	192.168.2.16	96.126.118.190
May 8, 2024 08:42:00.606906891 CEST	51754	21	192.168.2.16	201.153.177.143
May 8, 2024 08:42:00.606908083 CEST	51757	2121	192.168.2.16	73.168.122.223
May 8, 2024 08:42:00.606918097 CEST	51756	21	192.168.2.16	73.168.122.223
May 8, 2024 08:42:00.606918097 CEST	51758	21	192.168.2.16	61.69.129.118
May 8, 2024 08:42:00.621886015 CEST	51762	21	192.168.2.16	39.37.186.200
May 8, 2024 08:42:00.621889114 CEST	51759	2121	192.168.2.16	61.69.129.118
May 8, 2024 08:42:00.621910095 CEST	51763	2121	192.168.2.16	39.37.186.200
May 8, 2024 08:42:00.621913910 CEST	51760	21	192.168.2.16	13.225.244.13
May 8, 2024 08:42:00.621933937 CEST	51761	2121	192.168.2.16	13.225.244.13
May 8, 2024 08:42:00.631988049 CEST	21	51784	172.120.235.139	192.168.2.16
May 8, 2024 08:42:00.632143974 CEST	51784	21	192.168.2.16	172.120.235.139
May 8, 2024 08:42:00.637861013 CEST	51766	2121	192.168.2.16	44.4.44.152
May 8, 2024 08:42:00.637876987 CEST	51765	21	192.168.2.16	222.234.203.15
May 8, 2024 08:42:00.637892962 CEST	51764	21	192.168.2.16	44.4.44.152
May 8, 2024 08:42:00.637895107 CEST	51767	2121	192.168.2.16	222.234.203.15
May 8, 2024 08:42:00.637994051 CEST	51768	21	192.168.2.16	177.201.12.61
May 8, 2024 08:42:00.652491093 CEST	2121	51623	111.176.24.3	192.168.2.16
May 8, 2024 08:42:00.654230118 CEST	51769	2121	192.168.2.16	177.201.12.61
May 8, 2024 08:42:00.654277086 CEST	51665	21	192.168.2.16	110.9.185.177
May 8, 2024 08:42:00.654356003 CEST	51798	21	192.168.2.16	184.162.18.206
May 8, 2024 08:42:00.669987917 CEST	51662	2121	192.168.2.16	220.82.54.26
May 8, 2024 08:42:00.670311928 CEST	51799	2121	192.168.2.16	184.162.18.206
May 8, 2024 08:42:00.684886932 CEST	51661	21	192.168.2.16	220.82.54.26
May 8, 2024 08:42:00.684894085 CEST	51669	2121	192.168.2.16	110.9.185.177
May 8, 2024 08:42:00.698246956 CEST	21	51744	121.162.79.53	192.168.2.16
May 8, 2024 08:42:00.699783087 CEST	2121	51746	121.162.79.53	192.168.2.16
May 8, 2024 08:42:00.700898886 CEST	51609	21	192.168.2.16	185.29.10.114
May 8, 2024 08:42:00.701155901 CEST	51610	2121	192.168.2.16	185.29.10.114
May 8, 2024 08:42:00.701200008 CEST	51777	21	192.168.2.16	84.21.172.237
May 8, 2024 08:42:00.716975927 CEST	51771	2121	192.168.2.16	156.233.130.116
May 8, 2024 08:42:00.723315954 CEST	51622	21	192.168.2.16	111.176.24.3
May 8, 2024 08:42:00.726952076 CEST	21	51774	84.44.255.254	192.168.2.16
May 8, 2024 08:42:00.730707884 CEST	21	51792	84.44.255.254	192.168.2.16
May 8, 2024 08:42:00.730767012 CEST	51792	21	192.168.2.16	84.44.255.254
May 8, 2024 08:42:00.732925892 CEST	51778	2121	192.168.2.16	84.21.172.237
May 8, 2024 08:42:00.742162943 CEST	2121	51793	34.149.79.8	192.168.2.16
May 8, 2024 08:42:00.742213011 CEST	51793	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:00.742319107 CEST	51793	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:00.742630959 CEST	51800	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:00.745753050 CEST	21	51795	34.149.79.8	192.168.2.16
May 8, 2024 08:42:00.745804071 CEST	51795	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:00.745898962 CEST	51795	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:00.746087074 CEST	51801	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:00.756032944 CEST	21	51636	218.90.197.5	192.168.2.16
May 8, 2024 08:42:00.762161016 CEST	2121	51633	46.34.34.117	192.168.2.16
May 8, 2024 08:42:00.773116112 CEST	2121	51637	218.90.197.5	192.168.2.16
May 8, 2024 08:42:00.773931026 CEST	21	51654	96.126.118.190	192.168.2.16
May 8, 2024 08:42:00.774215937 CEST	21	51654	96.126.118.190	192.168.2.16
May 8, 2024 08:42:00.774350882 CEST	51654	21	192.168.2.16	96.126.118.190
May 8, 2024 08:42:00.780880928 CEST	51656	21	192.168.2.16	181.1.177.128
May 8, 2024 08:42:00.780893087 CEST	51657	2121	192.168.2.16	181.1.177.128
May 8, 2024 08:42:00.796900034 CEST	51626	21	192.168.2.16	24.200.106.1
May 8, 2024 08:42:00.804549932 CEST	2121	51660	96.126.118.190	192.168.2.16
May 8, 2024 08:42:00.805512905 CEST	2121	51660	96.126.118.190	192.168.2.16
May 8, 2024 08:42:00.805639982 CEST	51660	2121	192.168.2.16	96.126.118.190
May 8, 2024 08:42:00.808562994 CEST	21	51737	91.146.97.65	192.168.2.16
May 8, 2024 08:42:00.808681011 CEST	51737	21	192.168.2.16	91.146.97.65
May 8, 2024 08:42:00.808913946 CEST	51802	21	192.168.2.16	91.146.97.65
May 8, 2024 08:42:00.810762882 CEST	21	51775	196.210.0.111	192.168.2.16
May 8, 2024 08:42:00.810888052 CEST	51775	21	192.168.2.16	196.210.0.111
May 8, 2024 08:42:00.813777924 CEST	21	51784	172.120.235.139	192.168.2.16
May 8, 2024 08:42:00.814023972 CEST	21	51784	172.120.235.139	192.168.2.16
May 8, 2024 08:42:00.814151049 CEST	51784	21	192.168.2.16	172.120.235.139
May 8, 2024 08:42:00.828022957 CEST	21	51770	156.233.130.116	192.168.2.16
May 8, 2024 08:42:00.828866005 CEST	51629	2121	192.168.2.16	24.200.106.1
May 8, 2024 08:42:00.830799103 CEST	21	51587	115.93.215.205	192.168.2.16
May 8, 2024 08:42:00.845243931 CEST	51803	21	192.168.2.16	3.161.59.120
May 8, 2024 08:42:00.867017031 CEST	2121	51588	115.93.215.205	192.168.2.16
May 8, 2024 08:42:00.877305984 CEST	51804	2121	192.168.2.16	3.161.59.120
May 8, 2024 08:42:00.886004925 CEST	21	51796	115.19.136.196	192.168.2.16
May 8, 2024 08:42:00.887187958 CEST	2121	51797	115.19.136.196	192.168.2.16
May 8, 2024 08:42:00.892878056 CEST	51634	21	192.168.2.16	23.46.114.5
May 8, 2024 08:42:00.898283005 CEST	21	51598	161.106.93.255	192.168.2.16
May 8, 2024 08:42:00.898338079 CEST	2121	51599	161.106.93.255	192.168.2.16
May 8, 2024 08:42:00.898797035 CEST	51805	21	192.168.2.16	129.26.88.198
May 8, 2024 08:42:00.902441978 CEST	21	51606	117.223.205.236	192.168.2.16
May 8, 2024 08:42:00.902508974 CEST	51606	21	192.168.2.16	117.223.205.236
May 8, 2024 08:42:00.905424118 CEST	2121	51793	34.149.79.8	192.168.2.16
May 8, 2024 08:42:00.905448914 CEST	2121	51800	34.149.79.8	192.168.2.16
May 8, 2024 08:42:00.905534029 CEST	51800	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:00.908871889 CEST	21	51795	34.149.79.8	192.168.2.16
May 8, 2024 08:42:00.908896923 CEST	51781	21	192.168.2.16	83.171.235.211
May 8, 2024 08:42:00.908915043 CEST	51635	2121	192.168.2.16	23.46.114.5
May 8, 2024 08:42:00.909193993 CEST	51806	2121	192.168.2.16	129.26.88.198
May 8, 2024 08:42:00.909199953 CEST	21	51801	34.149.79.8	192.168.2.16
May 8, 2024 08:42:00.909260988 CEST	51801	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:00.913788080 CEST	21	51776	171.244.37.116	192.168.2.16
May 8, 2024 08:42:00.913909912 CEST	51776	21	192.168.2.16	171.244.37.116
May 8, 2024 08:42:00.924905062 CEST	51779	21	192.168.2.16	115.140.24.177
May 8, 2024 08:42:00.940886974 CEST	51619	21	192.168.2.16	222.94.83.70
May 8, 2024 08:42:00.940912962 CEST	51620	2121	192.168.2.16	222.94.83.70
May 8, 2024 08:42:00.948244095 CEST	21	51788	117.223.205.236	192.168.2.16
May 8, 2024 08:42:00.948303938 CEST	51788	21	192.168.2.16	117.223.205.236
May 8, 2024 08:42:00.961508989 CEST	21	51665	110.9.185.177	192.168.2.16
May 8, 2024 08:42:00.980443954 CEST	21	51654	96.126.118.190	192.168.2.16
May 8, 2024 08:42:00.980587959 CEST	51654	21	192.168.2.16	96.126.118.190
May 8, 2024 08:42:00.987668991 CEST	2121	51662	220.82.54.26	192.168.2.16
May 8, 2024 08:42:00.989228010 CEST	51807	21	192.168.2.16	76.110.236.78
May 8, 2024 08:42:00.996557951 CEST	2121	51669	110.9.185.177	192.168.2.16
May 8, 2024 08:42:01.004740000 CEST	21	51661	220.82.54.26	192.168.2.16
May 8, 2024 08:42:01.008025885 CEST	21	51609	185.29.10.114	192.168.2.16
May 8, 2024 08:42:01.008521080 CEST	51808	2121	192.168.2.16	76.110.236.78
May 8, 2024 08:42:01.008625031 CEST	2121	51610	185.29.10.114	192.168.2.16
May 8, 2024 08:42:01.009035110 CEST	51809	21	192.168.2.16	119.123.63.70
May 8, 2024 08:42:01.011148930 CEST	21	51777	84.21.172.237	192.168.2.16
May 8, 2024 08:42:01.011617899 CEST	2121	51660	96.126.118.190	192.168.2.16
May 8, 2024 08:42:01.011758089 CEST	51660	2121	192.168.2.16	96.126.118.190
May 8, 2024 08:42:01.016885042 CEST	21	51784	172.120.235.139	192.168.2.16
May 8, 2024 08:42:01.017044067 CEST	51784	21	192.168.2.16	172.120.235.139
May 8, 2024 08:42:01.017184973 CEST	51810	21	192.168.2.16	172.120.235.139
May 8, 2024 08:42:01.020896912 CEST	51780	2121	192.168.2.16	115.140.24.177
May 8, 2024 08:42:01.021203041 CEST	51811	2121	192.168.2.16	119.123.63.70
May 8, 2024 08:42:01.036874056 CEST	51638	21	192.168.2.16	178.153.63.96
May 8, 2024 08:42:01.036895990 CEST	51639	2121	192.168.2.16	178.153.63.96
May 8, 2024 08:42:01.038979053 CEST	2121	51771	156.233.130.116	192.168.2.16
May 8, 2024 08:42:01.050110102 CEST	2121	51778	84.21.172.237	192.168.2.16
May 8, 2024 08:42:01.050525904 CEST	21	51792	84.44.255.254	192.168.2.16
May 8, 2024 08:42:01.050708055 CEST	51792	21	192.168.2.16	84.44.255.254
May 8, 2024 08:42:01.050780058 CEST	51792	21	192.168.2.16	84.44.255.254
May 8, 2024 08:42:01.051009893 CEST	51812	21	192.168.2.16	84.44.255.254
May 8, 2024 08:42:01.053009987 CEST	51498	2121	192.168.2.16	38.207.205.17
May 8, 2024 08:42:01.053294897 CEST	51813	2121	192.168.2.16	104.76.76.237
May 8, 2024 08:42:01.053411007 CEST	51814	21	192.168.2.16	104.76.76.237
May 8, 2024 08:42:01.067819118 CEST	2121	51800	34.149.79.8	192.168.2.16
May 8, 2024 08:42:01.067878962 CEST	51800	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:01.067974091 CEST	51800	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:01.068239927 CEST	51815	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:01.068898916 CEST	51641	21	192.168.2.16	176.109.167.187
May 8, 2024 08:42:01.069900036 CEST	51785	2121	192.168.2.16	83.171.235.211
May 8, 2024 08:42:01.069900036 CEST	51642	2121	192.168.2.16	176.109.167.187
May 8, 2024 08:42:01.071609020 CEST	21	51801	34.149.79.8	192.168.2.16
May 8, 2024 08:42:01.071670055 CEST	51801	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:01.071723938 CEST	51801	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:01.071880102 CEST	51816	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:01.116875887 CEST	51644	2121	192.168.2.16	92.116.142.54
May 8, 2024 08:42:01.116889954 CEST	51645	21	192.168.2.16	110.12.247.33
May 8, 2024 08:42:01.116889954 CEST	51643	21	192.168.2.16	92.116.142.54
May 8, 2024 08:42:01.146243095 CEST	21	51656	181.1.177.128	192.168.2.16
May 8, 2024 08:42:01.146776915 CEST	2121	51657	181.1.177.128	192.168.2.16
May 8, 2024 08:42:01.148910046 CEST	51649	2121	192.168.2.16	110.12.247.33
May 8, 2024 08:42:01.148910046 CEST	51648	21	192.168.2.16	70.172.0.35
May 8, 2024 08:42:01.148915052 CEST	51652	21	192.168.2.16	2.33.15.110
May 8, 2024 08:42:01.148915052 CEST	51650	2121	192.168.2.16	70.172.0.35
May 8, 2024 08:42:01.149883032 CEST	21	51802	91.146.97.65	192.168.2.16
May 8, 2024 08:42:01.149915934 CEST	51651	2121	192.168.2.16	2.33.15.110
May 8, 2024 08:42:01.150415897 CEST	21	51737	91.146.97.65	192.168.2.16
May 8, 2024 08:42:01.150445938 CEST	51802	21	192.168.2.16	91.146.97.65
May 8, 2024 08:42:01.150599003 CEST	51737	21	192.168.2.16	91.146.97.65
May 8, 2024 08:42:01.165816069 CEST	51623	2121	192.168.2.16	111.176.24.3
May 8, 2024 08:42:01.180906057 CEST	51655	21	192.168.2.16	116.3.153.94
May 8, 2024 08:42:01.186614990 CEST	21	51654	96.126.118.190	192.168.2.16
May 8, 2024 08:42:01.186939955 CEST	51654	21	192.168.2.16	96.126.118.190
May 8, 2024 08:42:01.198004007 CEST	51658	2121	192.168.2.16	116.3.153.94
May 8, 2024 08:42:01.199004889 CEST	21	51784	172.120.235.139	192.168.2.16
May 8, 2024 08:42:01.199512959 CEST	21	51810	172.120.235.139	192.168.2.16
May 8, 2024 08:42:01.199604034 CEST	51810	21	192.168.2.16	172.120.235.139
May 8, 2024 08:42:01.199623108 CEST	51784	21	192.168.2.16	172.120.235.139
May 8, 2024 08:42:01.212904930 CEST	51746	2121	192.168.2.16	121.162.79.53
May 8, 2024 08:42:01.212912083 CEST	51744	21	192.168.2.16	121.162.79.53
May 8, 2024 08:42:01.212922096 CEST	51663	21	192.168.2.16	58.35.54.196
May 8, 2024 08:42:01.212929964 CEST	51664	2121	192.168.2.16	58.35.54.196
May 8, 2024 08:42:01.217231989 CEST	21	51781	83.171.235.211	192.168.2.16
May 8, 2024 08:42:01.218746901 CEST	2121	51660	96.126.118.190	192.168.2.16
May 8, 2024 08:42:01.221750975 CEST	51660	2121	192.168.2.16	96.126.118.190
May 8, 2024 08:42:01.228908062 CEST	51666	2121	192.168.2.16	69.251.164.110
May 8, 2024 08:42:01.228909969 CEST	51668	21	192.168.2.16	82.84.152.3
May 8, 2024 08:42:01.230114937 CEST	2121	51800	34.149.79.8	192.168.2.16
May 8, 2024 08:42:01.230601072 CEST	2121	51815	34.149.79.8	192.168.2.16
May 8, 2024 08:42:01.233699083 CEST	51815	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:01.234020948 CEST	21	51801	34.149.79.8	192.168.2.16
May 8, 2024 08:42:01.234317064 CEST	21	51816	34.149.79.8	192.168.2.16
May 8, 2024 08:42:01.237579107 CEST	51816	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:01.244899035 CEST	51667	21	192.168.2.16	69.251.164.110
May 8, 2024 08:42:01.244899988 CEST	51670	21	192.168.2.16	70.82.231.190
May 8, 2024 08:42:01.244899988 CEST	51671	2121	192.168.2.16	82.84.152.3
May 8, 2024 08:42:01.255805969 CEST	21	51619	222.94.83.70	192.168.2.16
May 8, 2024 08:42:01.257158995 CEST	2121	51620	222.94.83.70	192.168.2.16
May 8, 2024 08:42:01.260899067 CEST	51674	2121	192.168.2.16	86.20.223.64
May 8, 2024 08:42:01.260904074 CEST	51673	21	192.168.2.16	86.20.223.64
May 8, 2024 08:42:01.260905981 CEST	51636	21	192.168.2.16	218.90.197.5
May 8, 2024 08:42:01.261183977 CEST	51786	21	192.168.2.16	171.95.102.10
May 8, 2024 08:42:01.261193991 CEST	51672	2121	192.168.2.16	70.82.231.190
May 8, 2024 08:42:01.267427921 CEST	21	51776	171.244.37.116	192.168.2.16
May 8, 2024 08:42:01.268537045 CEST	51776	21	192.168.2.16	171.244.37.116
May 8, 2024 08:42:01.268537045 CEST	51817	21	192.168.2.16	171.244.37.116
May 8, 2024 08:42:01.275907040 CEST	51675	21	192.168.2.16	24.98.55.117
May 8, 2024 08:42:01.275930882 CEST	51637	2121	192.168.2.16	218.90.197.5
May 8, 2024 08:42:01.276118040 CEST	51676	2121	192.168.2.16	24.98.55.117
May 8, 2024 08:42:01.276346922 CEST	51819	21	192.168.2.16	38.31.161.189
May 8, 2024 08:42:01.276350975 CEST	51818	2121	192.168.2.16	38.31.161.189
May 8, 2024 08:42:01.276407003 CEST	51677	21	192.168.2.16	49.116.19.240
May 8, 2024 08:42:01.276423931 CEST	51633	2121	192.168.2.16	46.34.34.117
May 8, 2024 08:42:01.290422916 CEST	21	51775	196.210.0.111	192.168.2.16
May 8, 2024 08:42:01.290447950 CEST	21	51775	196.210.0.111	192.168.2.16
May 8, 2024 08:42:01.290884972 CEST	51678	21	192.168.2.16	101.206.67.127
May 8, 2024 08:42:01.290896893 CEST	51775	21	192.168.2.16	196.210.0.111
May 8, 2024 08:42:01.291239977 CEST	51679	2121	192.168.2.16	49.116.19.240
May 8, 2024 08:42:01.291241884 CEST	51820	21	192.168.2.16	45.49.192.14
May 8, 2024 08:42:01.310014963 CEST	51680	2121	192.168.2.16	101.206.67.127
May 8, 2024 08:42:01.323379993 CEST	51681	21	192.168.2.16	82.40.174.111
May 8, 2024 08:42:01.338918924 CEST	51682	2121	192.168.2.16	82.40.174.111
May 8, 2024 08:42:01.338921070 CEST	51770	21	192.168.2.16	156.233.130.116
May 8, 2024 08:42:01.355456114 CEST	51821	2121	192.168.2.16	45.49.192.14
May 8, 2024 08:42:01.355555058 CEST	51822	21	192.168.2.16	125.46.97.201
May 8, 2024 08:42:01.370547056 CEST	21	51792	84.44.255.254	192.168.2.16
May 8, 2024 08:42:01.370637894 CEST	21	51812	84.44.255.254	192.168.2.16
May 8, 2024 08:42:01.373265028 CEST	51812	21	192.168.2.16	84.44.255.254
May 8, 2024 08:42:01.374913931 CEST	2121	51785	83.171.235.211	192.168.2.16
May 8, 2024 08:42:01.386893988 CEST	51685	21	192.168.2.16	201.121.15.253
May 8, 2024 08:42:01.386894941 CEST	51787	2121	192.168.2.16	171.95.102.10
May 8, 2024 08:42:01.387095928 CEST	51796	21	192.168.2.16	115.19.136.196
May 8, 2024 08:42:01.387099981 CEST	51823	2121	192.168.2.16	125.46.97.201
May 8, 2024 08:42:01.392812967 CEST	21	51654	96.126.118.190	192.168.2.16
May 8, 2024 08:42:01.393960953 CEST	51654	21	192.168.2.16	96.126.118.190
May 8, 2024 08:42:01.396564960 CEST	2121	51815	34.149.79.8	192.168.2.16
May 8, 2024 08:42:01.400037050 CEST	21	51816	34.149.79.8	192.168.2.16
May 8, 2024 08:42:01.400058985 CEST	51815	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:01.400114059 CEST	51816	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:01.400116920 CEST	51815	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:01.400378942 CEST	51824	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:01.400379896 CEST	51816	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:01.401812077 CEST	51825	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:01.401890039 CEST	51684	2121	192.168.2.16	38.239.154.176
May 8, 2024 08:42:01.401894093 CEST	51797	2121	192.168.2.16	115.19.136.196
May 8, 2024 08:42:01.404320002 CEST	51826	21	192.168.2.16	211.192.239.54
May 8, 2024 08:42:01.417881012 CEST	51790	2121	192.168.2.16	18.154.135.191
May 8, 2024 08:42:01.417886019 CEST	51686	2121	192.168.2.16	201.121.15.253
May 8, 2024 08:42:01.418889999 CEST	51789	21	192.168.2.16	18.154.135.191
May 8, 2024 08:42:01.418894053 CEST	51791	21	192.168.2.16	200.219.95.134
May 8, 2024 08:42:01.421250105 CEST	21	51810	172.120.235.139	192.168.2.16
May 8, 2024 08:42:01.422985077 CEST	51810	21	192.168.2.16	172.120.235.139
May 8, 2024 08:42:01.427972078 CEST	2121	51660	96.126.118.190	192.168.2.16
May 8, 2024 08:42:01.428575993 CEST	51660	2121	192.168.2.16	96.126.118.190
May 8, 2024 08:42:01.433900118 CEST	51687	21	192.168.2.16	104.221.50.132
May 8, 2024 08:42:01.433902979 CEST	51688	2121	192.168.2.16	70.15.235.5
May 8, 2024 08:42:01.433904886 CEST	51690	21	192.168.2.16	70.15.235.5
May 8, 2024 08:42:01.434334040 CEST	51689	2121	192.168.2.16	104.221.50.132
May 8, 2024 08:42:01.434336901 CEST	51827	2121	192.168.2.16	211.192.239.54
May 8, 2024 08:42:01.434339046 CEST	51794	2121	192.168.2.16	200.219.95.134
May 8, 2024 08:42:01.449908018 CEST	51692	21	192.168.2.16	171.105.188.71
May 8, 2024 08:42:01.464570999 CEST	2121	51818	38.31.161.189	192.168.2.16
May 8, 2024 08:42:01.465909958 CEST	51665	21	192.168.2.16	110.9.185.177
May 8, 2024 08:42:01.466274977 CEST	51828	2121	192.168.2.16	94.56.108.73
May 8, 2024 08:42:01.466411114 CEST	51829	21	192.168.2.16	94.56.108.73
May 8, 2024 08:42:01.469636917 CEST	21	51819	38.31.161.189	192.168.2.16
May 8, 2024 08:42:01.479522943 CEST	21	51788	117.223.205.236	192.168.2.16
May 8, 2024 08:42:01.480180979 CEST	51788	21	192.168.2.16	117.223.205.236
May 8, 2024 08:42:01.482677937 CEST	51830	21	192.168.2.16	121.229.221.64
May 8, 2024 08:42:01.496891022 CEST	51697	21	192.168.2.16	178.168.74.208
May 8, 2024 08:42:01.496891022 CEST	51662	2121	192.168.2.16	220.82.54.26
May 8, 2024 08:42:01.496906042 CEST	51696	2121	192.168.2.16	171.105.188.71
May 8, 2024 08:42:01.496921062 CEST	51669	2121	192.168.2.16	110.9.185.177
May 8, 2024 08:42:01.508687019 CEST	2121	51623	111.176.24.3	192.168.2.16
May 8, 2024 08:42:01.510385990 CEST	51831	2121	192.168.2.16	121.229.221.64
May 8, 2024 08:42:01.512649059 CEST	21	51802	91.146.97.65	192.168.2.16
May 8, 2024 08:42:01.512878895 CEST	51698	2121	192.168.2.16	178.168.74.208
May 8, 2024 08:42:01.512900114 CEST	51700	2121	192.168.2.16	40.65.234.134
May 8, 2024 08:42:01.512916088 CEST	51661	21	192.168.2.16	220.82.54.26
May 8, 2024 08:42:01.512917995 CEST	51699	21	192.168.2.16	40.65.234.134
May 8, 2024 08:42:01.512921095 CEST	51777	21	192.168.2.16	84.21.172.237
May 8, 2024 08:42:01.515573978 CEST	51802	21	192.168.2.16	91.146.97.65
May 8, 2024 08:42:01.524539948 CEST	21	51744	121.162.79.53	192.168.2.16
May 8, 2024 08:42:01.526070118 CEST	2121	51746	121.162.79.53	192.168.2.16
May 8, 2024 08:42:01.531168938 CEST	51702	21	192.168.2.16	81.99.199.81
May 8, 2024 08:42:01.544902086 CEST	51771	2121	192.168.2.16	156.233.130.116
May 8, 2024 08:42:01.544970989 CEST	51703	2121	192.168.2.16	81.99.199.81
May 8, 2024 08:42:01.545123100 CEST	51705	2121	192.168.2.16	49.162.52.22
May 8, 2024 08:42:01.560897112 CEST	51706	21	192.168.2.16	71.104.39.238
May 8, 2024 08:42:01.560904026 CEST	51707	2121	192.168.2.16	71.104.39.238
May 8, 2024 08:42:01.560904980 CEST	51704	21	192.168.2.16	49.162.52.22
May 8, 2024 08:42:01.560906887 CEST	51778	2121	192.168.2.16	84.21.172.237
May 8, 2024 08:42:01.562014103 CEST	51708	21	192.168.2.16	90.203.67.127
May 8, 2024 08:42:01.562490940 CEST	2121	51815	34.149.79.8	192.168.2.16
May 8, 2024 08:42:01.562747002 CEST	21	51816	34.149.79.8	192.168.2.16
May 8, 2024 08:42:01.562840939 CEST	21	51824	34.149.79.8	192.168.2.16
May 8, 2024 08:42:01.563913107 CEST	51824	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:01.564201117 CEST	2121	51825	34.149.79.8	192.168.2.16
May 8, 2024 08:42:01.566991091 CEST	51825	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:01.577011108 CEST	51709	2121	192.168.2.16	90.203.67.127
May 8, 2024 08:42:01.577402115 CEST	51832	2121	192.168.2.16	75.176.24.187
May 8, 2024 08:42:01.577411890 CEST	51833	21	192.168.2.16	75.176.24.187
May 8, 2024 08:42:01.592902899 CEST	51710	21	192.168.2.16	77.12.133.92
May 8, 2024 08:42:01.592905045 CEST	51712	21	192.168.2.16	185.125.87.172
May 8, 2024 08:42:01.594594002 CEST	21	51636	218.90.197.5	192.168.2.16
May 8, 2024 08:42:01.599951982 CEST	21	51654	96.126.118.190	192.168.2.16
May 8, 2024 08:42:01.600466013 CEST	51654	21	192.168.2.16	96.126.118.190
May 8, 2024 08:42:01.604650974 CEST	21	51810	172.120.235.139	192.168.2.16
May 8, 2024 08:42:01.605017900 CEST	21	51810	172.120.235.139	192.168.2.16
May 8, 2024 08:42:01.605308056 CEST	51810	21	192.168.2.16	172.120.235.139
May 8, 2024 08:42:01.607753038 CEST	2121	51637	218.90.197.5	192.168.2.16
May 8, 2024 08:42:01.609183073 CEST	51711	2121	192.168.2.16	77.12.133.92
May 8, 2024 08:42:01.609185934 CEST	51835	21	192.168.2.16	67.183.186.201
May 8, 2024 08:42:01.610018969 CEST	51836	2121	192.168.2.16	67.183.186.201
May 8, 2024 08:42:01.616358042 CEST	2121	51633	46.34.34.117	192.168.2.16
May 8, 2024 08:42:01.619537115 CEST	21	51776	171.244.37.116	192.168.2.16
May 8, 2024 08:42:01.619710922 CEST	21	51776	171.244.37.116	192.168.2.16
May 8, 2024 08:42:01.620345116 CEST	51776	21	192.168.2.16	171.244.37.116
May 8, 2024 08:42:01.624177933 CEST	21	51817	171.244.37.116	192.168.2.16
May 8, 2024 08:42:01.629911900 CEST	51817	21	192.168.2.16	171.244.37.116
May 8, 2024 08:42:01.634676933 CEST	2121	51660	96.126.118.190	192.168.2.16
May 8, 2024 08:42:01.638017893 CEST	51660	2121	192.168.2.16	96.126.118.190
May 8, 2024 08:42:01.641171932 CEST	51713	2121	192.168.2.16	185.125.87.172
May 8, 2024 08:42:01.641172886 CEST	51838	21	192.168.2.16	91.126.155.116
May 8, 2024 08:42:01.653996944 CEST	21	51770	156.233.130.116	192.168.2.16
May 8, 2024 08:42:01.656904936 CEST	51798	21	192.168.2.16	184.162.18.206
May 8, 2024 08:42:01.656908035 CEST	51657	2121	192.168.2.16	181.1.177.128
May 8, 2024 08:42:01.656908989 CEST	51656	21	192.168.2.16	181.1.177.128
May 8, 2024 08:42:01.657164097 CEST	51714	21	192.168.2.16	112.230.106.237
May 8, 2024 08:42:01.657165051 CEST	51839	2121	192.168.2.16	91.126.155.116
May 8, 2024 08:42:01.672919989 CEST	51716	2121	192.168.2.16	112.230.106.237
May 8, 2024 08:42:01.672930002 CEST	51799	2121	192.168.2.16	184.162.18.206
May 8, 2024 08:42:01.692888021 CEST	21	51812	84.44.255.254	192.168.2.16
May 8, 2024 08:42:01.692984104 CEST	51812	21	192.168.2.16	84.44.255.254
May 8, 2024 08:42:01.693062067 CEST	51812	21	192.168.2.16	84.44.255.254
May 8, 2024 08:42:01.693310976 CEST	51840	21	192.168.2.16	84.44.255.254
May 8, 2024 08:42:01.710516930 CEST	21	51796	115.19.136.196	192.168.2.16
May 8, 2024 08:42:01.716628075 CEST	21	51826	211.192.239.54	192.168.2.16
May 8, 2024 08:42:01.720972061 CEST	51781	21	192.168.2.16	83.171.235.211
May 8, 2024 08:42:01.722012043 CEST	51841	21	192.168.2.16	122.36.240.79
May 8, 2024 08:42:01.726011038 CEST	2121	51797	115.19.136.196	192.168.2.16
May 8, 2024 08:42:01.726296902 CEST	21	51824	34.149.79.8	192.168.2.16
May 8, 2024 08:42:01.726457119 CEST	51824	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:01.726457119 CEST	51824	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:01.726627111 CEST	51842	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:01.731952906 CEST	2121	51825	34.149.79.8	192.168.2.16
May 8, 2024 08:42:01.732070923 CEST	51825	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:01.732157946 CEST	51825	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:01.732428074 CEST	51843	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:01.752615929 CEST	51844	2121	192.168.2.16	122.36.240.79
May 8, 2024 08:42:01.752615929 CEST	51845	21	192.168.2.16	176.114.196.43
May 8, 2024 08:42:01.755173922 CEST	2121	51827	211.192.239.54	192.168.2.16
May 8, 2024 08:42:01.768141985 CEST	51846	2121	192.168.2.16	176.114.196.43
May 8, 2024 08:42:01.773478985 CEST	21	51665	110.9.185.177	192.168.2.16
May 8, 2024 08:42:01.784270048 CEST	51847	21	192.168.2.16	148.66.8.13
May 8, 2024 08:42:01.784274101 CEST	51719	21	192.168.2.16	79.226.2.81
May 8, 2024 08:42:01.784446955 CEST	51848	2121	192.168.2.16	148.66.8.13
May 8, 2024 08:42:01.799884081 CEST	51720	2121	192.168.2.16	79.226.2.81
May 8, 2024 08:42:01.805538893 CEST	21	51775	196.210.0.111	192.168.2.16
May 8, 2024 08:42:01.806545973 CEST	21	51654	96.126.118.190	192.168.2.16
May 8, 2024 08:42:01.810246944 CEST	2121	51669	110.9.185.177	192.168.2.16
May 8, 2024 08:42:01.810277939 CEST	51654	21	192.168.2.16	96.126.118.190
May 8, 2024 08:42:01.810547113 CEST	21	51810	172.120.235.139	192.168.2.16
May 8, 2024 08:42:01.812638998 CEST	51810	21	192.168.2.16	172.120.235.139
May 8, 2024 08:42:01.812644005 CEST	51850	21	192.168.2.16	172.120.235.139
May 8, 2024 08:42:01.813461065 CEST	2121	51662	220.82.54.26	192.168.2.16
May 8, 2024 08:42:01.816051006 CEST	51722	2121	192.168.2.16	207.55.237.38
May 8, 2024 08:42:01.816051006 CEST	51721	21	192.168.2.16	207.55.237.38
May 8, 2024 08:42:01.816051960 CEST	51723	21	192.168.2.16	104.91.72.140
May 8, 2024 08:42:01.818015099 CEST	51851	21	192.168.2.16	178.232.116.12
May 8, 2024 08:42:01.824516058 CEST	21	51777	84.21.172.237	192.168.2.16
May 8, 2024 08:42:01.831408024 CEST	51852	2121	192.168.2.16	178.232.116.12
May 8, 2024 08:42:01.831414938 CEST	51853	21	192.168.2.16	175.136.119.90
May 8, 2024 08:42:01.832766056 CEST	21	51661	220.82.54.26	192.168.2.16
May 8, 2024 08:42:01.844379902 CEST	2121	51660	96.126.118.190	192.168.2.16
May 8, 2024 08:42:01.845896959 CEST	51660	2121	192.168.2.16	96.126.118.190
May 8, 2024 08:42:01.846935034 CEST	51803	21	192.168.2.16	3.161.59.120
May 8, 2024 08:42:01.846935987 CEST	51724	2121	192.168.2.16	104.91.72.140
May 8, 2024 08:42:01.847865105 CEST	51855	2121	192.168.2.16	175.136.119.90
May 8, 2024 08:42:01.856786013 CEST	21	51802	91.146.97.65	192.168.2.16
May 8, 2024 08:42:01.857356071 CEST	21	51802	91.146.97.65	192.168.2.16
May 8, 2024 08:42:01.858021975 CEST	51802	21	192.168.2.16	91.146.97.65
May 8, 2024 08:42:01.862142086 CEST	2121	51771	156.233.130.116	192.168.2.16
May 8, 2024 08:42:01.878909111 CEST	51804	2121	192.168.2.16	3.161.59.120
May 8, 2024 08:42:01.878911018 CEST	51785	2121	192.168.2.16	83.171.235.211
May 8, 2024 08:42:01.879005909 CEST	2121	51778	84.21.172.237	192.168.2.16
May 8, 2024 08:42:01.886195898 CEST	2121	51828	94.56.108.73	192.168.2.16
May 8, 2024 08:42:01.888912916 CEST	21	51824	34.149.79.8	192.168.2.16
May 8, 2024 08:42:01.888994932 CEST	21	51842	34.149.79.8	192.168.2.16
May 8, 2024 08:42:01.889866114 CEST	51842	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:01.894490957 CEST	2121	51825	34.149.79.8	192.168.2.16
May 8, 2024 08:42:01.894745111 CEST	2121	51843	34.149.79.8	192.168.2.16
May 8, 2024 08:42:01.898015022 CEST	51843	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:01.907855034 CEST	21	51829	94.56.108.73	192.168.2.16
May 8, 2024 08:42:01.909912109 CEST	51805	21	192.168.2.16	129.26.88.198
May 8, 2024 08:42:01.909913063 CEST	51806	2121	192.168.2.16	129.26.88.198
May 8, 2024 08:42:01.943788052 CEST	51856	21	192.168.2.16	80.39.203.17
May 8, 2024 08:42:01.957932949 CEST	51725	21	192.168.2.16	187.53.165.205
May 8, 2024 08:42:01.958404064 CEST	51857	2121	192.168.2.16	80.39.203.17
May 8, 2024 08:42:01.958405972 CEST	51858	21	192.168.2.16	135.148.177.63
May 8, 2024 08:42:01.961980104 CEST	21	51788	117.223.205.236	192.168.2.16
May 8, 2024 08:42:01.970601082 CEST	21	51788	117.223.205.236	192.168.2.16
May 8, 2024 08:42:01.973908901 CEST	51788	21	192.168.2.16	117.223.205.236
May 8, 2024 08:42:01.973911047 CEST	51819	21	192.168.2.16	38.31.161.189
May 8, 2024 08:42:01.974014997 CEST	51818	2121	192.168.2.16	38.31.161.189
May 8, 2024 08:42:01.975421906 CEST	21	51838	91.126.155.116	192.168.2.16
May 8, 2024 08:42:01.975452900 CEST	51859	2121	192.168.2.16	135.148.177.63
May 8, 2024 08:42:01.979887009 CEST	2121	51839	91.126.155.116	192.168.2.16
May 8, 2024 08:42:01.985419035 CEST	21	51817	171.244.37.116	192.168.2.16
May 8, 2024 08:42:01.989705086 CEST	51817	21	192.168.2.16	171.244.37.116
May 8, 2024 08:42:01.990010023 CEST	51807	21	192.168.2.16	76.110.236.78
May 8, 2024 08:42:01.991424084 CEST	51860	21	192.168.2.16	73.110.154.93
May 8, 2024 08:42:01.994400978 CEST	21	51850	172.120.235.139	192.168.2.16
May 8, 2024 08:42:01.994513035 CEST	21	51810	172.120.235.139	192.168.2.16
May 8, 2024 08:42:01.994544029 CEST	51850	21	192.168.2.16	172.120.235.139
May 8, 2024 08:42:01.997212887 CEST	51810	21	192.168.2.16	172.120.235.139
May 8, 2024 08:42:02.005904913 CEST	51726	2121	192.168.2.16	187.53.165.205
May 8, 2024 08:42:02.009418964 CEST	21	51840	84.44.255.254	192.168.2.16
May 8, 2024 08:42:02.010776997 CEST	51840	21	192.168.2.16	84.44.255.254
May 8, 2024 08:42:02.012629986 CEST	21	51812	84.44.255.254	192.168.2.16
May 8, 2024 08:42:02.017194986 CEST	21	51654	96.126.118.190	192.168.2.16
May 8, 2024 08:42:02.017716885 CEST	21	51656	181.1.177.128	192.168.2.16
May 8, 2024 08:42:02.017796993 CEST	51654	21	192.168.2.16	96.126.118.190
May 8, 2024 08:42:02.020885944 CEST	51809	21	192.168.2.16	119.123.63.70
May 8, 2024 08:42:02.020885944 CEST	51808	2121	192.168.2.16	76.110.236.78
May 8, 2024 08:42:02.021013021 CEST	51811	2121	192.168.2.16	119.123.63.70
May 8, 2024 08:42:02.021256924 CEST	51862	2121	192.168.2.16	73.110.154.93
May 8, 2024 08:42:02.022947073 CEST	2121	51657	181.1.177.128	192.168.2.16
May 8, 2024 08:42:02.029314041 CEST	21	51781	83.171.235.211	192.168.2.16
May 8, 2024 08:42:02.036876917 CEST	51744	21	192.168.2.16	121.162.79.53
May 8, 2024 08:42:02.036948919 CEST	51746	2121	192.168.2.16	121.162.79.53
May 8, 2024 08:42:02.037328959 CEST	51864	2121	192.168.2.16	31.150.22.103
May 8, 2024 08:42:02.037333012 CEST	51863	21	192.168.2.16	31.150.22.103
May 8, 2024 08:42:02.052073956 CEST	2121	51660	96.126.118.190	192.168.2.16
May 8, 2024 08:42:02.052323103 CEST	21	51842	34.149.79.8	192.168.2.16
May 8, 2024 08:42:02.053137064 CEST	51660	2121	192.168.2.16	96.126.118.190
May 8, 2024 08:42:02.053204060 CEST	51842	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:02.053208113 CEST	51866	21	192.168.2.16	73.81.203.75
May 8, 2024 08:42:02.053374052 CEST	51842	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:02.053457975 CEST	51868	2121	192.168.2.16	73.81.203.75
May 8, 2024 08:42:02.053473949 CEST	51867	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:02.060512066 CEST	2121	51843	34.149.79.8	192.168.2.16
May 8, 2024 08:42:02.060637951 CEST	51843	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:02.060736895 CEST	51843	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:02.061134100 CEST	51869	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:02.067897081 CEST	51813	2121	192.168.2.16	104.76.76.237
May 8, 2024 08:42:02.067898989 CEST	51814	21	192.168.2.16	104.76.76.237
May 8, 2024 08:42:02.068861961 CEST	51870	21	192.168.2.16	184.66.15.203
May 8, 2024 08:42:02.083873987 CEST	51727	21	192.168.2.16	35.187.10.121
May 8, 2024 08:42:02.099905014 CEST	51728	2121	192.168.2.16	35.187.10.121
May 8, 2024 08:42:02.116214037 CEST	51871	2121	192.168.2.16	184.66.15.203
May 8, 2024 08:42:02.130891085 CEST	51731	21	192.168.2.16	75.191.9.101
May 8, 2024 08:42:02.162170887 CEST	2121	51818	38.31.161.189	192.168.2.16
May 8, 2024 08:42:02.162873983 CEST	51770	21	192.168.2.16	156.233.130.116
May 8, 2024 08:42:02.167243958 CEST	21	51819	38.31.161.189	192.168.2.16
May 8, 2024 08:42:02.179512978 CEST	51872	21	192.168.2.16	78.19.78.115
May 8, 2024 08:42:02.179539919 CEST	51873	2121	192.168.2.16	78.19.78.115
May 8, 2024 08:42:02.179569960 CEST	51874	21	192.168.2.16	92.234.39.72
May 8, 2024 08:42:02.184303045 CEST	2121	51785	83.171.235.211	192.168.2.16
May 8, 2024 08:42:02.190685987 CEST	21	51858	135.148.177.63	192.168.2.16
May 8, 2024 08:42:02.202661991 CEST	21	51802	91.146.97.65	192.168.2.16
May 8, 2024 08:42:02.202805996 CEST	51802	21	192.168.2.16	91.146.97.65
May 8, 2024 08:42:02.203016996 CEST	51875	21	192.168.2.16	91.146.97.65
May 8, 2024 08:42:02.215714931 CEST	21	51842	34.149.79.8	192.168.2.16
May 8, 2024 08:42:02.215868950 CEST	51796	21	192.168.2.16	115.19.136.196
May 8, 2024 08:42:02.215954065 CEST	21	51867	34.149.79.8	192.168.2.16
May 8, 2024 08:42:02.216020107 CEST	51867	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:02.216455936 CEST	2121	51859	135.148.177.63	192.168.2.16
May 8, 2024 08:42:02.219023943 CEST	21	51850	172.120.235.139	192.168.2.16
May 8, 2024 08:42:02.219124079 CEST	51850	21	192.168.2.16	172.120.235.139
May 8, 2024 08:42:02.223074913 CEST	2121	51843	34.149.79.8	192.168.2.16
May 8, 2024 08:42:02.223517895 CEST	2121	51869	34.149.79.8	192.168.2.16
May 8, 2024 08:42:02.223629951 CEST	51869	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:02.223731041 CEST	21	51654	96.126.118.190	192.168.2.16
May 8, 2024 08:42:02.224121094 CEST	51654	21	192.168.2.16	96.126.118.190
May 8, 2024 08:42:02.226895094 CEST	51826	21	192.168.2.16	211.192.239.54
May 8, 2024 08:42:02.226895094 CEST	51797	2121	192.168.2.16	115.19.136.196
May 8, 2024 08:42:02.242953062 CEST	51733	2121	192.168.2.16	75.191.9.101
May 8, 2024 08:42:02.258877039 CEST	51734	21	192.168.2.16	39.118.4.87
May 8, 2024 08:42:02.259507895 CEST	2121	51660	96.126.118.190	192.168.2.16
May 8, 2024 08:42:02.269875050 CEST	51827	2121	192.168.2.16	211.192.239.54
May 8, 2024 08:42:02.276036024 CEST	51878	2121	192.168.2.16	92.234.39.72
May 8, 2024 08:42:02.276038885 CEST	51660	2121	192.168.2.16	96.126.118.190
May 8, 2024 08:42:02.290903091 CEST	51820	21	192.168.2.16	45.49.192.14
May 8, 2024 08:42:02.291336060 CEST	51879	2121	192.168.2.16	101.114.75.186
May 8, 2024 08:42:02.291383982 CEST	51880	21	192.168.2.16	101.114.75.186
May 8, 2024 08:42:02.307297945 CEST	51881	21	192.168.2.16	105.68.251.211
May 8, 2024 08:42:02.326870918 CEST	21	51840	84.44.255.254	192.168.2.16
May 8, 2024 08:42:02.326946020 CEST	51840	21	192.168.2.16	84.44.255.254
May 8, 2024 08:42:02.327020884 CEST	51840	21	192.168.2.16	84.44.255.254
May 8, 2024 08:42:02.327214003 CEST	51882	21	192.168.2.16	84.44.255.254
May 8, 2024 08:42:02.338876009 CEST	51777	21	192.168.2.16	84.21.172.237
May 8, 2024 08:42:02.339108944 CEST	51883	2121	192.168.2.16	105.68.251.211
May 8, 2024 08:42:02.345128059 CEST	21	51817	171.244.37.116	192.168.2.16
May 8, 2024 08:42:02.345251083 CEST	51817	21	192.168.2.16	171.244.37.116
May 8, 2024 08:42:02.348037958 CEST	21	51744	121.162.79.53	192.168.2.16
May 8, 2024 08:42:02.351109028 CEST	2121	51746	121.162.79.53	192.168.2.16
May 8, 2024 08:42:02.354882002 CEST	51822	21	192.168.2.16	125.46.97.201
May 8, 2024 08:42:02.354918003 CEST	51735	2121	192.168.2.16	39.118.4.87
May 8, 2024 08:42:02.370897055 CEST	51821	2121	192.168.2.16	45.49.192.14
May 8, 2024 08:42:02.370903015 CEST	51736	21	192.168.2.16	104.81.200.21
May 8, 2024 08:42:02.370907068 CEST	51771	2121	192.168.2.16	156.233.130.116
May 8, 2024 08:42:02.371184111 CEST	51884	21	192.168.2.16	201.130.140.23
May 8, 2024 08:42:02.378417015 CEST	21	51867	34.149.79.8	192.168.2.16
May 8, 2024 08:42:02.378474951 CEST	51867	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:02.378568888 CEST	51867	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:02.378704071 CEST	51885	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:02.386096001 CEST	2121	51869	34.149.79.8	192.168.2.16
May 8, 2024 08:42:02.386193991 CEST	51869	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:02.386320114 CEST	51869	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:02.386534929 CEST	51886	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:02.386909008 CEST	51778	2121	192.168.2.16	84.21.172.237
May 8, 2024 08:42:02.400918007 CEST	21	51850	172.120.235.139	192.168.2.16
May 8, 2024 08:42:02.401066065 CEST	21	51850	172.120.235.139	192.168.2.16
May 8, 2024 08:42:02.401184082 CEST	51850	21	192.168.2.16	172.120.235.139
May 8, 2024 08:42:02.402873993 CEST	51828	2121	192.168.2.16	94.56.108.73
May 8, 2024 08:42:02.402899981 CEST	51823	2121	192.168.2.16	125.46.97.201
May 8, 2024 08:42:02.418890953 CEST	51829	21	192.168.2.16	94.56.108.73
May 8, 2024 08:42:02.430155039 CEST	21	51654	96.126.118.190	192.168.2.16
May 8, 2024 08:42:02.430546999 CEST	51654	21	192.168.2.16	96.126.118.190
May 8, 2024 08:42:02.435070992 CEST	51888	2121	192.168.2.16	201.130.140.23
May 8, 2024 08:42:02.465889931 CEST	51742	21	192.168.2.16	189.191.138.135
May 8, 2024 08:42:02.465904951 CEST	51741	2121	192.168.2.16	104.81.200.21
May 8, 2024 08:42:02.466085911 CEST	51889	21	192.168.2.16	218.158.89.232
May 8, 2024 08:42:02.480829000 CEST	21	51770	156.233.130.116	192.168.2.16
May 8, 2024 08:42:02.481895924 CEST	51839	2121	192.168.2.16	91.126.155.116
May 8, 2024 08:42:02.481940985 CEST	51838	21	192.168.2.16	91.126.155.116
May 8, 2024 08:42:02.483136892 CEST	2121	51660	96.126.118.190	192.168.2.16
May 8, 2024 08:42:02.483176947 CEST	51830	21	192.168.2.16	121.229.221.64
May 8, 2024 08:42:02.483553886 CEST	51660	2121	192.168.2.16	96.126.118.190
May 8, 2024 08:42:02.500422955 CEST	21	51788	117.223.205.236	192.168.2.16
May 8, 2024 08:42:02.513670921 CEST	51831	2121	192.168.2.16	121.229.221.64
May 8, 2024 08:42:02.528942108 CEST	51574	21	192.168.2.16	23.229.188.101
May 8, 2024 08:42:02.528960943 CEST	51781	21	192.168.2.16	83.171.235.211
May 8, 2024 08:42:02.529231071 CEST	51891	21	192.168.2.16	23.229.188.101
May 8, 2024 08:42:02.539999008 CEST	21	51796	115.19.136.196	192.168.2.16
May 8, 2024 08:42:02.540391922 CEST	21	51826	211.192.239.54	192.168.2.16
May 8, 2024 08:42:02.542277098 CEST	21	51867	34.149.79.8	192.168.2.16
May 8, 2024 08:42:02.542392015 CEST	21	51885	34.149.79.8	192.168.2.16
May 8, 2024 08:42:02.542458057 CEST	51885	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:02.544908047 CEST	51743	2121	192.168.2.16	189.191.138.135
May 8, 2024 08:42:02.550652981 CEST	2121	51869	34.149.79.8	192.168.2.16
May 8, 2024 08:42:02.550776958 CEST	2121	51886	34.149.79.8	192.168.2.16
May 8, 2024 08:42:02.550834894 CEST	51886	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:02.552186966 CEST	2121	51797	115.19.136.196	192.168.2.16
May 8, 2024 08:42:02.576891899 CEST	51748	21	192.168.2.16	75.145.238.34
May 8, 2024 08:42:02.576905012 CEST	51749	2121	192.168.2.16	75.145.238.34
May 8, 2024 08:42:02.576908112 CEST	51745	21	192.168.2.16	86.17.40.125
May 8, 2024 08:42:02.587991953 CEST	2121	51827	211.192.239.54	192.168.2.16
May 8, 2024 08:42:02.589461088 CEST	21	51574	23.229.188.101	192.168.2.16
May 8, 2024 08:42:02.589517117 CEST	51574	21	192.168.2.16	23.229.188.101
May 8, 2024 08:42:02.591881037 CEST	51833	21	192.168.2.16	75.176.24.187
May 8, 2024 08:42:02.591882944 CEST	51832	2121	192.168.2.16	75.176.24.187
May 8, 2024 08:42:02.591900110 CEST	51755	2121	192.168.2.16	201.153.177.143
May 8, 2024 08:42:02.591903925 CEST	51751	21	192.168.2.16	54.230.170.170
May 8, 2024 08:42:02.591905117 CEST	51752	21	192.168.2.16	76.148.136.69
May 8, 2024 08:42:02.599867105 CEST	51747	2121	192.168.2.16	86.17.40.125
May 8, 2024 08:42:02.606877089 CEST	51754	21	192.168.2.16	201.153.177.143
May 8, 2024 08:42:02.606879950 CEST	51750	2121	192.168.2.16	54.230.170.170
May 8, 2024 08:42:02.608120918 CEST	51753	2121	192.168.2.16	76.148.136.69
May 8, 2024 08:42:02.609816074 CEST	21	51850	172.120.235.139	192.168.2.16
May 8, 2024 08:42:02.610675097 CEST	51850	21	192.168.2.16	172.120.235.139
May 8, 2024 08:42:02.610888004 CEST	51892	21	192.168.2.16	172.120.235.139
May 8, 2024 08:42:02.621881008 CEST	51756	21	192.168.2.16	73.168.122.223
May 8, 2024 08:42:02.621902943 CEST	51758	21	192.168.2.16	61.69.129.118
May 8, 2024 08:42:02.621902943 CEST	51836	2121	192.168.2.16	67.183.186.201
May 8, 2024 08:42:02.621906042 CEST	51761	2121	192.168.2.16	13.225.244.13
May 8, 2024 08:42:02.621916056 CEST	51835	21	192.168.2.16	67.183.186.201
May 8, 2024 08:42:02.621922016 CEST	51757	2121	192.168.2.16	73.168.122.223
May 8, 2024 08:42:02.621922016 CEST	51759	2121	192.168.2.16	61.69.129.118
May 8, 2024 08:42:02.622416019 CEST	51762	21	192.168.2.16	39.37.186.200
May 8, 2024 08:42:02.636883020 CEST	51763	2121	192.168.2.16	39.37.186.200
May 8, 2024 08:42:02.636908054 CEST	51760	21	192.168.2.16	13.225.244.13
May 8, 2024 08:42:02.637206078 CEST	21	51654	96.126.118.190	192.168.2.16
May 8, 2024 08:42:02.637702942 CEST	51654	21	192.168.2.16	96.126.118.190
May 8, 2024 08:42:02.643001080 CEST	21	51840	84.44.255.254	192.168.2.16
May 8, 2024 08:42:02.646977901 CEST	21	51882	84.44.255.254	192.168.2.16
May 8, 2024 08:42:02.647051096 CEST	51882	21	192.168.2.16	84.44.255.254
May 8, 2024 08:42:02.649569035 CEST	21	51777	84.21.172.237	192.168.2.16
May 8, 2024 08:42:02.652880907 CEST	51765	21	192.168.2.16	222.234.203.15
May 8, 2024 08:42:02.652887106 CEST	51766	2121	192.168.2.16	44.4.44.152
May 8, 2024 08:42:02.652899981 CEST	51764	21	192.168.2.16	44.4.44.152
May 8, 2024 08:42:02.652899981 CEST	51767	2121	192.168.2.16	222.234.203.15
May 8, 2024 08:42:02.653927088 CEST	51768	21	192.168.2.16	177.201.12.61
May 8, 2024 08:42:02.660732985 CEST	21	51881	105.68.251.211	192.168.2.16
May 8, 2024 08:42:02.668874979 CEST	51769	2121	192.168.2.16	177.201.12.61
May 8, 2024 08:42:02.668884039 CEST	51819	21	192.168.2.16	38.31.161.189
May 8, 2024 08:42:02.669259071 CEST	51818	2121	192.168.2.16	38.31.161.189
May 8, 2024 08:42:02.684947014 CEST	51785	2121	192.168.2.16	83.171.235.211
May 8, 2024 08:42:02.688594103 CEST	2121	51771	156.233.130.116	192.168.2.16
May 8, 2024 08:42:02.689095020 CEST	2121	51883	105.68.251.211	192.168.2.16
May 8, 2024 08:42:02.689805984 CEST	2121	51660	96.126.118.190	192.168.2.16
May 8, 2024 08:42:02.690239906 CEST	51660	2121	192.168.2.16	96.126.118.190
May 8, 2024 08:42:02.700892925 CEST	51858	21	192.168.2.16	135.148.177.63
May 8, 2024 08:42:02.701411963 CEST	21	51817	171.244.37.116	192.168.2.16
May 8, 2024 08:42:02.701541901 CEST	51817	21	192.168.2.16	171.244.37.116
May 8, 2024 08:42:02.701740980 CEST	51895	21	192.168.2.16	171.244.37.116
May 8, 2024 08:42:02.704157114 CEST	2121	51778	84.21.172.237	192.168.2.16
May 8, 2024 08:42:02.704917908 CEST	21	51885	34.149.79.8	192.168.2.16
May 8, 2024 08:42:02.704967022 CEST	51885	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:02.705017090 CEST	51885	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:02.705138922 CEST	51896	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:02.713501930 CEST	2121	51886	34.149.79.8	192.168.2.16
May 8, 2024 08:42:02.713562012 CEST	51886	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:02.713650942 CEST	51886	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:02.713815928 CEST	51897	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:02.730149984 CEST	21	51891	23.229.188.101	192.168.2.16
May 8, 2024 08:42:02.730218887 CEST	51891	21	192.168.2.16	23.229.188.101
May 8, 2024 08:42:02.731874943 CEST	51859	2121	192.168.2.16	135.148.177.63
May 8, 2024 08:42:02.731884003 CEST	21	51574	23.229.188.101	192.168.2.16
May 8, 2024 08:42:02.731909037 CEST	51841	21	192.168.2.16	122.36.240.79
May 8, 2024 08:42:02.731930017 CEST	51574	21	192.168.2.16	23.229.188.101
May 8, 2024 08:42:02.732191086 CEST	51898	2121	192.168.2.16	218.158.89.232
May 8, 2024 08:42:02.732280970 CEST	21	51574	23.229.188.101	192.168.2.16
May 8, 2024 08:42:02.732326031 CEST	51574	21	192.168.2.16	23.229.188.101
May 8, 2024 08:42:02.765892982 CEST	51845	21	192.168.2.16	176.114.196.43
May 8, 2024 08:42:02.766022921 CEST	51844	2121	192.168.2.16	122.36.240.79
May 8, 2024 08:42:02.773228884 CEST	21	51775	196.210.0.111	192.168.2.16
May 8, 2024 08:42:02.773390055 CEST	51775	21	192.168.2.16	196.210.0.111
May 8, 2024 08:42:02.773587942 CEST	51899	21	192.168.2.16	196.210.0.111
May 8, 2024 08:42:02.778884888 CEST	51846	2121	192.168.2.16	176.114.196.43
May 8, 2024 08:42:02.781269073 CEST	21	51889	218.158.89.232	192.168.2.16
May 8, 2024 08:42:02.792465925 CEST	21	51850	172.120.235.139	192.168.2.16
May 8, 2024 08:42:02.792531013 CEST	51850	21	192.168.2.16	172.120.235.139
May 8, 2024 08:42:02.792550087 CEST	21	51892	172.120.235.139	192.168.2.16
May 8, 2024 08:42:02.792610884 CEST	51892	21	192.168.2.16	172.120.235.139
May 8, 2024 08:42:02.794908047 CEST	51847	21	192.168.2.16	148.66.8.13
May 8, 2024 08:42:02.794919014 CEST	51848	2121	192.168.2.16	148.66.8.13
May 8, 2024 08:42:02.795145988 CEST	51900	21	192.168.2.16	71.79.3.251
May 8, 2024 08:42:02.806444883 CEST	2121	51839	91.126.155.116	192.168.2.16
May 8, 2024 08:42:02.813725948 CEST	21	51838	91.126.155.116	192.168.2.16
May 8, 2024 08:42:02.821748018 CEST	2121	51828	94.56.108.73	192.168.2.16
May 8, 2024 08:42:02.826905012 CEST	51851	21	192.168.2.16	178.232.116.12
May 8, 2024 08:42:02.827162981 CEST	51901	2121	192.168.2.16	71.79.3.251
May 8, 2024 08:42:02.837202072 CEST	21	51781	83.171.235.211	192.168.2.16
May 8, 2024 08:42:02.842875004 CEST	51853	21	192.168.2.16	175.136.119.90
May 8, 2024 08:42:02.842905998 CEST	51852	2121	192.168.2.16	178.232.116.12
May 8, 2024 08:42:02.843468904 CEST	21	51654	96.126.118.190	192.168.2.16
May 8, 2024 08:42:02.843688965 CEST	51654	21	192.168.2.16	96.126.118.190
May 8, 2024 08:42:02.857477903 CEST	2121	51818	38.31.161.189	192.168.2.16
May 8, 2024 08:42:02.858875036 CEST	51855	2121	192.168.2.16	175.136.119.90
May 8, 2024 08:42:02.858899117 CEST	51746	2121	192.168.2.16	121.162.79.53
May 8, 2024 08:42:02.859164000 CEST	51744	21	192.168.2.16	121.162.79.53
May 8, 2024 08:42:02.860269070 CEST	21	51829	94.56.108.73	192.168.2.16
May 8, 2024 08:42:02.862175941 CEST	21	51819	38.31.161.189	192.168.2.16
May 8, 2024 08:42:02.867290020 CEST	21	51896	34.149.79.8	192.168.2.16
May 8, 2024 08:42:02.867367029 CEST	51896	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:02.867398977 CEST	21	51885	34.149.79.8	192.168.2.16
May 8, 2024 08:42:02.875931025 CEST	2121	51886	34.149.79.8	192.168.2.16
May 8, 2024 08:42:02.876279116 CEST	2121	51897	34.149.79.8	192.168.2.16
May 8, 2024 08:42:02.876349926 CEST	51897	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:02.891096115 CEST	51902	21	192.168.2.16	182.92.22.163
May 8, 2024 08:42:02.897257090 CEST	2121	51660	96.126.118.190	192.168.2.16
May 8, 2024 08:42:02.897378922 CEST	51660	2121	192.168.2.16	96.126.118.190
May 8, 2024 08:42:02.907188892 CEST	51903	2121	192.168.2.16	182.92.22.163
May 8, 2024 08:42:02.922916889 CEST	51802	21	192.168.2.16	91.146.97.65
May 8, 2024 08:42:02.932579994 CEST	21	51891	23.229.188.101	192.168.2.16
May 8, 2024 08:42:02.932801008 CEST	51891	21	192.168.2.16	23.229.188.101
May 8, 2024 08:42:02.933105946 CEST	21	51858	135.148.177.63	192.168.2.16
May 8, 2024 08:42:02.942879915 CEST	51779	21	192.168.2.16	115.140.24.177
May 8, 2024 08:42:02.954898119 CEST	51856	21	192.168.2.16	80.39.203.17
May 8, 2024 08:42:02.966850996 CEST	21	51882	84.44.255.254	192.168.2.16
May 8, 2024 08:42:02.966914892 CEST	51882	21	192.168.2.16	84.44.255.254
May 8, 2024 08:42:02.967020035 CEST	51882	21	192.168.2.16	84.44.255.254
May 8, 2024 08:42:02.967336893 CEST	51904	21	192.168.2.16	84.44.255.254
May 8, 2024 08:42:02.970899105 CEST	51857	2121	192.168.2.16	80.39.203.17
May 8, 2024 08:42:02.972840071 CEST	2121	51859	135.148.177.63	192.168.2.16
May 8, 2024 08:42:02.986959934 CEST	51770	21	192.168.2.16	156.233.130.116
May 8, 2024 08:42:02.989871979 CEST	51860	21	192.168.2.16	73.110.154.93
May 8, 2024 08:42:02.990037918 CEST	2121	51785	83.171.235.211	192.168.2.16
May 8, 2024 08:42:03.014090061 CEST	21	51892	172.120.235.139	192.168.2.16
May 8, 2024 08:42:03.014276981 CEST	51892	21	192.168.2.16	172.120.235.139
May 8, 2024 08:42:03.029606104 CEST	21	51896	34.149.79.8	192.168.2.16
May 8, 2024 08:42:03.029668093 CEST	51896	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:03.029757977 CEST	51896	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:03.029992104 CEST	51905	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:03.034905910 CEST	51780	2121	192.168.2.16	115.140.24.177
May 8, 2024 08:42:03.035281897 CEST	51862	2121	192.168.2.16	73.110.154.93
May 8, 2024 08:42:03.035290956 CEST	51906	21	192.168.2.16	210.180.125.220
May 8, 2024 08:42:03.035521984 CEST	51907	2121	192.168.2.16	210.180.125.220
May 8, 2024 08:42:03.038770914 CEST	2121	51897	34.149.79.8	192.168.2.16
May 8, 2024 08:42:03.038841963 CEST	51897	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:03.038959980 CEST	51897	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:03.039247036 CEST	51908	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:03.047339916 CEST	2121	51898	218.158.89.232	192.168.2.16
May 8, 2024 08:42:03.047990084 CEST	21	51895	171.244.37.116	192.168.2.16
May 8, 2024 08:42:03.048069000 CEST	51895	21	192.168.2.16	171.244.37.116
May 8, 2024 08:42:03.049926996 CEST	21	51654	96.126.118.190	192.168.2.16
May 8, 2024 08:42:03.050358057 CEST	51654	21	192.168.2.16	96.126.118.190
May 8, 2024 08:42:03.050529003 CEST	51910	21	192.168.2.16	96.126.118.190
May 8, 2024 08:42:03.050884962 CEST	51864	2121	192.168.2.16	31.150.22.103
May 8, 2024 08:42:03.050884962 CEST	51863	21	192.168.2.16	31.150.22.103
May 8, 2024 08:42:03.050904989 CEST	51826	21	192.168.2.16	211.192.239.54
May 8, 2024 08:42:03.050908089 CEST	51796	21	192.168.2.16	115.19.136.196
May 8, 2024 08:42:03.056493044 CEST	21	51817	171.244.37.116	192.168.2.16
May 8, 2024 08:42:03.056674004 CEST	21	51817	171.244.37.116	192.168.2.16
May 8, 2024 08:42:03.056731939 CEST	51817	21	192.168.2.16	171.244.37.116
May 8, 2024 08:42:03.066927910 CEST	51866	21	192.168.2.16	73.81.203.75
May 8, 2024 08:42:03.066931009 CEST	51797	2121	192.168.2.16	115.19.136.196
May 8, 2024 08:42:03.066931009 CEST	51868	2121	192.168.2.16	73.81.203.75
May 8, 2024 08:42:03.067352057 CEST	51911	21	192.168.2.16	51.38.57.28
May 8, 2024 08:42:03.067430019 CEST	51912	2121	192.168.2.16	51.38.57.28
May 8, 2024 08:42:03.082907915 CEST	51870	21	192.168.2.16	184.66.15.203
May 8, 2024 08:42:03.098886013 CEST	51827	2121	192.168.2.16	211.192.239.54
May 8, 2024 08:42:03.103883028 CEST	2121	51660	96.126.118.190	192.168.2.16
May 8, 2024 08:42:03.104283094 CEST	51660	2121	192.168.2.16	96.126.118.190
May 8, 2024 08:42:03.104451895 CEST	51914	2121	192.168.2.16	96.126.118.190
May 8, 2024 08:42:03.115392923 CEST	51915	21	192.168.2.16	88.75.109.235
May 8, 2024 08:42:03.115446091 CEST	51916	2121	192.168.2.16	88.75.109.235
May 8, 2024 08:42:03.115561962 CEST	51917	21	192.168.2.16	24.124.110.138
May 8, 2024 08:42:03.125500917 CEST	21	51802	91.146.97.65	192.168.2.16
May 8, 2024 08:42:03.125550985 CEST	51802	21	192.168.2.16	91.146.97.65
May 8, 2024 08:42:03.129884958 CEST	51871	2121	192.168.2.16	184.66.15.203
May 8, 2024 08:42:03.133810043 CEST	21	51891	23.229.188.101	192.168.2.16
May 8, 2024 08:42:03.133990049 CEST	21	51891	23.229.188.101	192.168.2.16
May 8, 2024 08:42:03.134109974 CEST	51891	21	192.168.2.16	23.229.188.101
May 8, 2024 08:42:03.146596909 CEST	51918	21	192.168.2.16	119.71.5.164
May 8, 2024 08:42:03.146684885 CEST	51919	2121	192.168.2.16	119.71.5.164
May 8, 2024 08:42:03.146737099 CEST	51921	21	192.168.2.16	123.232.178.226
May 8, 2024 08:42:03.146737099 CEST	51920	2121	192.168.2.16	24.124.110.138
May 8, 2024 08:42:03.146780968 CEST	51922	2121	192.168.2.16	123.232.178.226
May 8, 2024 08:42:03.161891937 CEST	51881	21	192.168.2.16	105.68.251.211
May 8, 2024 08:42:03.161910057 CEST	51777	21	192.168.2.16	84.21.172.237
May 8, 2024 08:42:03.171323061 CEST	21	51744	121.162.79.53	192.168.2.16
May 8, 2024 08:42:03.171703100 CEST	51923	21	192.168.2.16	66.217.151.0
May 8, 2024 08:42:03.172249079 CEST	2121	51746	121.162.79.53	192.168.2.16
May 8, 2024 08:42:03.172564983 CEST	51924	2121	192.168.2.16	66.217.151.0
May 8, 2024 08:42:03.177232981 CEST	51925	21	192.168.2.16	60.139.52.99
May 8, 2024 08:42:03.191912889 CEST	21	51896	34.149.79.8	192.168.2.16
May 8, 2024 08:42:03.192112923 CEST	21	51905	34.149.79.8	192.168.2.16
May 8, 2024 08:42:03.192177057 CEST	51905	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:03.192888975 CEST	51872	21	192.168.2.16	78.19.78.115
May 8, 2024 08:42:03.192971945 CEST	51873	2121	192.168.2.16	78.19.78.115
May 8, 2024 08:42:03.192975998 CEST	51771	2121	192.168.2.16	156.233.130.116
May 8, 2024 08:42:03.192976952 CEST	51874	21	192.168.2.16	92.234.39.72
May 8, 2024 08:42:03.193039894 CEST	51883	2121	192.168.2.16	105.68.251.211
May 8, 2024 08:42:03.193424940 CEST	51926	2121	192.168.2.16	60.139.52.99
May 8, 2024 08:42:03.196018934 CEST	21	51892	172.120.235.139	192.168.2.16
May 8, 2024 08:42:03.196331978 CEST	21	51892	172.120.235.139	192.168.2.16
May 8, 2024 08:42:03.196436882 CEST	51892	21	192.168.2.16	172.120.235.139
May 8, 2024 08:42:03.203255892 CEST	2121	51897	34.149.79.8	192.168.2.16
May 8, 2024 08:42:03.203269005 CEST	2121	51908	34.149.79.8	192.168.2.16
May 8, 2024 08:42:03.203358889 CEST	51908	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:03.208878040 CEST	51875	21	192.168.2.16	91.146.97.65
May 8, 2024 08:42:03.208916903 CEST	51778	2121	192.168.2.16	84.21.172.237
May 8, 2024 08:42:03.209259987 CEST	51927	2121	192.168.2.16	223.10.255.186
May 8, 2024 08:42:03.209301949 CEST	51928	21	192.168.2.16	223.10.255.186
May 8, 2024 08:42:03.225332975 CEST	51929	21	192.168.2.16	24.58.45.63
May 8, 2024 08:42:03.225347996 CEST	51930	2121	192.168.2.16	24.58.45.63
May 8, 2024 08:42:03.225521088 CEST	51931	21	192.168.2.16	186.210.130.138
May 8, 2024 08:42:03.241264105 CEST	51932	21	192.168.2.16	183.151.2.47
May 8, 2024 08:42:03.241355896 CEST	51933	2121	192.168.2.16	186.210.130.138
May 8, 2024 08:42:03.252088070 CEST	21	51775	196.210.0.111	192.168.2.16
May 8, 2024 08:42:03.252206087 CEST	51775	21	192.168.2.16	196.210.0.111
May 8, 2024 08:42:03.255522966 CEST	21	51899	196.210.0.111	192.168.2.16
May 8, 2024 08:42:03.255599976 CEST	51899	21	192.168.2.16	196.210.0.111
May 8, 2024 08:42:03.256376028 CEST	21	51910	96.126.118.190	192.168.2.16
May 8, 2024 08:42:03.256437063 CEST	51910	21	192.168.2.16	96.126.118.190
May 8, 2024 08:42:03.257453918 CEST	51935	21	192.168.2.16	124.54.226.49
May 8, 2024 08:42:03.257491112 CEST	51934	2121	192.168.2.16	183.151.2.47
May 8, 2024 08:42:03.257580042 CEST	51936	2121	192.168.2.16	124.54.226.49
May 8, 2024 08:42:03.272907019 CEST	51786	21	192.168.2.16	171.95.102.10
May 8, 2024 08:42:03.273358107 CEST	51937	2121	192.168.2.16	71.34.143.153
May 8, 2024 08:42:03.273430109 CEST	51938	21	192.168.2.16	71.34.143.153
May 8, 2024 08:42:03.273457050 CEST	51939	21	192.168.2.16	59.7.179.14
May 8, 2024 08:42:03.286648035 CEST	21	51882	84.44.255.254	192.168.2.16
May 8, 2024 08:42:03.286724091 CEST	21	51904	84.44.255.254	192.168.2.16
May 8, 2024 08:42:03.286825895 CEST	51904	21	192.168.2.16	84.44.255.254
May 8, 2024 08:42:03.288887978 CEST	51878	2121	192.168.2.16	92.234.39.72
May 8, 2024 08:42:03.288907051 CEST	51889	21	192.168.2.16	218.158.89.232
May 8, 2024 08:42:03.289252043 CEST	51940	2121	192.168.2.16	59.7.179.14
May 8, 2024 08:42:03.289446115 CEST	51941	21	192.168.2.16	189.152.150.132
May 8, 2024 08:42:03.297873020 CEST	21	51654	96.126.118.190	192.168.2.16
May 8, 2024 08:42:03.300570011 CEST	21	51770	156.233.130.116	192.168.2.16
May 8, 2024 08:42:03.300874949 CEST	51942	2121	192.168.2.16	189.152.150.132
May 8, 2024 08:42:03.304933071 CEST	51880	21	192.168.2.16	101.114.75.186
May 8, 2024 08:42:03.304943085 CEST	51879	2121	192.168.2.16	101.114.75.186
May 8, 2024 08:42:03.305268049 CEST	51943	21	192.168.2.16	104.4.88.110
May 8, 2024 08:42:03.310177088 CEST	2121	51914	96.126.118.190	192.168.2.16
May 8, 2024 08:42:03.310249090 CEST	51914	2121	192.168.2.16	96.126.118.190
May 8, 2024 08:42:03.320904016 CEST	51839	2121	192.168.2.16	91.126.155.116
May 8, 2024 08:42:03.320904016 CEST	51838	21	192.168.2.16	91.126.155.116
May 8, 2024 08:42:03.321118116 CEST	51944	2121	192.168.2.16	104.4.88.110
May 8, 2024 08:42:03.336358070 CEST	2121	51907	210.180.125.220	192.168.2.16
May 8, 2024 08:42:03.336867094 CEST	51828	2121	192.168.2.16	94.56.108.73
May 8, 2024 08:42:03.337958097 CEST	21	51906	210.180.125.220	192.168.2.16
May 8, 2024 08:42:03.351066113 CEST	2121	51660	96.126.118.190	192.168.2.16
May 8, 2024 08:42:03.352893114 CEST	51781	21	192.168.2.16	83.171.235.211
May 8, 2024 08:42:03.353214979 CEST	51945	21	192.168.2.16	102.64.165.88
May 8, 2024 08:42:03.354361057 CEST	21	51905	34.149.79.8	192.168.2.16
May 8, 2024 08:42:03.354425907 CEST	51905	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:03.354487896 CEST	51905	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:03.354681015 CEST	51946	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:03.363374949 CEST	21	51826	211.192.239.54	192.168.2.16
May 8, 2024 08:42:03.366025925 CEST	2121	51908	34.149.79.8	192.168.2.16
May 8, 2024 08:42:03.366080046 CEST	51908	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:03.366147995 CEST	51908	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:03.366362095 CEST	51947	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:03.368880987 CEST	51819	21	192.168.2.16	38.31.161.189
May 8, 2024 08:42:03.368905067 CEST	51818	2121	192.168.2.16	38.31.161.189
May 8, 2024 08:42:03.370018005 CEST	51829	21	192.168.2.16	94.56.108.73
May 8, 2024 08:42:03.374314070 CEST	21	51796	115.19.136.196	192.168.2.16
May 8, 2024 08:42:03.377180099 CEST	21	51891	23.229.188.101	192.168.2.16
May 8, 2024 08:42:03.383409977 CEST	2121	51912	51.38.57.28	192.168.2.16
May 8, 2024 08:42:03.384905100 CEST	51884	21	192.168.2.16	201.130.140.23
May 8, 2024 08:42:03.385365009 CEST	51948	2121	192.168.2.16	102.64.165.88
May 8, 2024 08:42:03.385401964 CEST	51949	21	192.168.2.16	94.98.64.199
May 8, 2024 08:42:03.387331963 CEST	21	51911	51.38.57.28	192.168.2.16
May 8, 2024 08:42:03.387411118 CEST	51911	21	192.168.2.16	51.38.57.28
May 8, 2024 08:42:03.391277075 CEST	2121	51797	115.19.136.196	192.168.2.16
May 8, 2024 08:42:03.394793987 CEST	21	51895	171.244.37.116	192.168.2.16
May 8, 2024 08:42:03.394933939 CEST	51895	21	192.168.2.16	171.244.37.116
May 8, 2024 08:42:03.399401903 CEST	21	51923	66.217.151.0	192.168.2.16
May 8, 2024 08:42:03.400279999 CEST	2121	51924	66.217.151.0	192.168.2.16
May 8, 2024 08:42:03.400877953 CEST	51787	2121	192.168.2.16	171.95.102.10
May 8, 2024 08:42:03.401125908 CEST	51950	2121	192.168.2.16	94.98.64.199
May 8, 2024 08:42:03.406862020 CEST	21	51892	172.120.235.139	192.168.2.16
May 8, 2024 08:42:03.406984091 CEST	51892	21	192.168.2.16	172.120.235.139
May 8, 2024 08:42:03.407154083 CEST	51951	21	192.168.2.16	172.120.235.139
May 8, 2024 08:42:03.416465044 CEST	2121	51827	211.192.239.54	192.168.2.16
May 8, 2024 08:42:03.417229891 CEST	51952	21	192.168.2.16	218.32.108.110
May 8, 2024 08:42:03.427875996 CEST	51790	2121	192.168.2.16	18.154.135.191
May 8, 2024 08:42:03.432884932 CEST	51789	21	192.168.2.16	18.154.135.191
May 8, 2024 08:42:03.432909966 CEST	51791	21	192.168.2.16	200.219.95.134
May 8, 2024 08:42:03.433310032 CEST	51953	21	192.168.2.16	83.41.211.18
May 8, 2024 08:42:03.433347940 CEST	51954	2121	192.168.2.16	218.32.108.110
May 8, 2024 08:42:03.433387041 CEST	51955	2121	192.168.2.16	83.41.211.18
May 8, 2024 08:42:03.448884010 CEST	51794	2121	192.168.2.16	200.219.95.134
May 8, 2024 08:42:03.448903084 CEST	51858	21	192.168.2.16	135.148.177.63
May 8, 2024 08:42:03.448903084 CEST	51888	2121	192.168.2.16	201.130.140.23
May 8, 2024 08:42:03.449114084 CEST	51956	21	192.168.2.16	223.72.119.6
May 8, 2024 08:42:03.474706888 CEST	21	51777	84.21.172.237	192.168.2.16
May 8, 2024 08:42:03.480882883 CEST	51859	2121	192.168.2.16	135.148.177.63
May 8, 2024 08:42:03.481293917 CEST	21	51925	60.139.52.99	192.168.2.16
May 8, 2024 08:42:03.481301069 CEST	51957	2121	192.168.2.16	223.72.119.6
May 8, 2024 08:42:03.481318951 CEST	51958	21	192.168.2.16	185.68.4.125
May 8, 2024 08:42:03.496952057 CEST	51785	2121	192.168.2.16	83.171.235.211
May 8, 2024 08:42:03.497387886 CEST	51959	2121	192.168.2.16	185.68.4.125
May 8, 2024 08:42:03.497575998 CEST	51960	2121	192.168.2.16	1.227.238.87
May 8, 2024 08:42:03.497622013 CEST	51961	21	192.168.2.16	20.8.54.180
May 8, 2024 08:42:03.497641087 CEST	51962	21	192.168.2.16	1.227.238.87
May 8, 2024 08:42:03.499881983 CEST	2121	51926	60.139.52.99	192.168.2.16
May 8, 2024 08:42:03.509017944 CEST	21	51788	117.223.205.236	192.168.2.16
May 8, 2024 08:42:03.509154081 CEST	51788	21	192.168.2.16	117.223.205.236
May 8, 2024 08:42:03.509357929 CEST	51963	21	192.168.2.16	117.223.205.236
May 8, 2024 08:42:03.513145924 CEST	51964	2121	192.168.2.16	20.8.54.180
May 8, 2024 08:42:03.514782906 CEST	2121	51771	156.233.130.116	192.168.2.16
May 8, 2024 08:42:03.516549110 CEST	2121	51922	123.232.178.226	192.168.2.16
May 8, 2024 08:42:03.521038055 CEST	21	51905	34.149.79.8	192.168.2.16
May 8, 2024 08:42:03.521428108 CEST	21	51946	34.149.79.8	192.168.2.16
May 8, 2024 08:42:03.521491051 CEST	51946	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:03.528307915 CEST	2121	51778	84.21.172.237	192.168.2.16
May 8, 2024 08:42:03.528537989 CEST	51965	21	192.168.2.16	171.240.26.242
May 8, 2024 08:42:03.529186010 CEST	51966	21	192.168.2.16	31.179.174.249
May 8, 2024 08:42:03.529270887 CEST	51967	2121	192.168.2.16	171.240.26.242
May 8, 2024 08:42:03.530675888 CEST	2121	51908	34.149.79.8	192.168.2.16
May 8, 2024 08:42:03.530953884 CEST	2121	51947	34.149.79.8	192.168.2.16
May 8, 2024 08:42:03.531009912 CEST	51947	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:03.542553902 CEST	2121	51883	105.68.251.211	192.168.2.16
May 8, 2024 08:42:03.545264959 CEST	51968	2121	192.168.2.16	31.179.174.249
May 8, 2024 08:42:03.545392990 CEST	51969	21	192.168.2.16	81.21.231.72
May 8, 2024 08:42:03.557101965 CEST	2121	51818	38.31.161.189	192.168.2.16
May 8, 2024 08:42:03.560939074 CEST	51898	2121	192.168.2.16	218.158.89.232
May 8, 2024 08:42:03.561364889 CEST	51970	2121	192.168.2.16	81.21.231.72
May 8, 2024 08:42:03.561410904 CEST	51971	21	192.168.2.16	99.249.236.148
May 8, 2024 08:42:03.561420918 CEST	51972	2121	192.168.2.16	99.249.236.148
May 8, 2024 08:42:03.561506987 CEST	51973	21	192.168.2.16	190.51.17.139
May 8, 2024 08:42:03.562382936 CEST	21	51819	38.31.161.189	192.168.2.16
May 8, 2024 08:42:03.574754000 CEST	2121	51936	124.54.226.49	192.168.2.16
May 8, 2024 08:42:03.577114105 CEST	51974	2121	192.168.2.16	190.51.17.139
May 8, 2024 08:42:03.589045048 CEST	21	51951	172.120.235.139	192.168.2.16
May 8, 2024 08:42:03.589111090 CEST	51951	21	192.168.2.16	172.120.235.139
May 8, 2024 08:42:03.589168072 CEST	21	51892	172.120.235.139	192.168.2.16
May 8, 2024 08:42:03.589214087 CEST	51892	21	192.168.2.16	172.120.235.139
May 8, 2024 08:42:03.593079090 CEST	51621	21	192.168.2.16	77.75.121.3
May 8, 2024 08:42:03.593334913 CEST	51975	21	192.168.2.16	77.75.121.3
May 8, 2024 08:42:03.593380928 CEST	51976	21	192.168.2.16	101.229.210.80
May 8, 2024 08:42:03.593400002 CEST	51977	2121	192.168.2.16	101.229.210.80
May 8, 2024 08:42:03.604068041 CEST	21	51889	218.158.89.232	192.168.2.16
May 8, 2024 08:42:03.606905937 CEST	21	51904	84.44.255.254	192.168.2.16
May 8, 2024 08:42:03.606987953 CEST	51904	21	192.168.2.16	84.44.255.254
May 8, 2024 08:42:03.607094049 CEST	51904	21	192.168.2.16	84.44.255.254
May 8, 2024 08:42:03.607342005 CEST	51978	21	192.168.2.16	84.44.255.254
May 8, 2024 08:42:03.641313076 CEST	51979	21	192.168.2.16	73.111.10.90
May 8, 2024 08:42:03.646642923 CEST	2121	51839	91.126.155.116	192.168.2.16
May 8, 2024 08:42:03.654211044 CEST	21	51838	91.126.155.116	192.168.2.16
May 8, 2024 08:42:03.657177925 CEST	51980	2121	192.168.2.16	73.111.10.90
May 8, 2024 08:42:03.663284063 CEST	21	51781	83.171.235.211	192.168.2.16
May 8, 2024 08:42:03.671916008 CEST	51798	21	192.168.2.16	184.162.18.206
May 8, 2024 08:42:03.672317028 CEST	51981	21	192.168.2.16	85.229.248.246
May 8, 2024 08:42:03.681006908 CEST	21	51858	135.148.177.63	192.168.2.16
May 8, 2024 08:42:03.683892012 CEST	21	51946	34.149.79.8	192.168.2.16
May 8, 2024 08:42:03.683948040 CEST	51946	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:03.684025049 CEST	51946	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:03.684185982 CEST	51982	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:03.687886000 CEST	51799	2121	192.168.2.16	184.162.18.206
May 8, 2024 08:42:03.688277960 CEST	51983	2121	192.168.2.16	85.229.248.246
May 8, 2024 08:42:03.693502903 CEST	2121	51947	34.149.79.8	192.168.2.16
May 8, 2024 08:42:03.693608046 CEST	51947	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:03.693727016 CEST	51947	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:03.693979025 CEST	51984	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:03.708544016 CEST	21	51911	51.38.57.28	192.168.2.16
May 8, 2024 08:42:03.708645105 CEST	51911	21	192.168.2.16	51.38.57.28
May 8, 2024 08:42:03.708929062 CEST	51985	21	192.168.2.16	41.228.35.66
May 8, 2024 08:42:03.721813917 CEST	2121	51859	135.148.177.63	192.168.2.16
May 8, 2024 08:42:03.741261005 CEST	21	51895	171.244.37.116	192.168.2.16
May 8, 2024 08:42:03.741432905 CEST	51895	21	192.168.2.16	171.244.37.116
May 8, 2024 08:42:03.755304098 CEST	2121	51828	94.56.108.73	192.168.2.16
May 8, 2024 08:42:03.770198107 CEST	21	51899	196.210.0.111	192.168.2.16
May 8, 2024 08:42:03.770343065 CEST	51899	21	192.168.2.16	196.210.0.111
May 8, 2024 08:42:03.784271955 CEST	51986	2121	192.168.2.16	41.228.35.66
May 8, 2024 08:42:03.799881935 CEST	51900	21	192.168.2.16	71.79.3.251
May 8, 2024 08:42:03.800390959 CEST	51987	2121	192.168.2.16	211.201.27.47
May 8, 2024 08:42:03.800507069 CEST	51988	21	192.168.2.16	211.201.27.47
May 8, 2024 08:42:03.801855087 CEST	2121	51785	83.171.235.211	192.168.2.16
May 8, 2024 08:42:03.805237055 CEST	2121	51960	1.227.238.87	192.168.2.16
May 8, 2024 08:42:03.809170008 CEST	21	51962	1.227.238.87	192.168.2.16
May 8, 2024 08:42:03.811928988 CEST	21	51951	172.120.235.139	192.168.2.16
May 8, 2024 08:42:03.813395023 CEST	21	51829	94.56.108.73	192.168.2.16
May 8, 2024 08:42:03.818295002 CEST	51951	21	192.168.2.16	172.120.235.139
May 8, 2024 08:42:03.818541050 CEST	51989	21	192.168.2.16	93.236.206.101
May 8, 2024 08:42:03.818658113 CEST	51990	2121	192.168.2.16	93.236.206.101
May 8, 2024 08:42:03.818721056 CEST	51991	21	192.168.2.16	126.159.107.249
May 8, 2024 08:42:03.831904888 CEST	51901	2121	192.168.2.16	71.79.3.251
May 8, 2024 08:42:03.847043991 CEST	21	51982	34.149.79.8	192.168.2.16
May 8, 2024 08:42:03.847112894 CEST	51982	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:03.847261906 CEST	21	51946	34.149.79.8	192.168.2.16
May 8, 2024 08:42:03.847907066 CEST	51907	2121	192.168.2.16	210.180.125.220
May 8, 2024 08:42:03.847934008 CEST	51906	21	192.168.2.16	210.180.125.220
May 8, 2024 08:42:03.848203897 CEST	51803	21	192.168.2.16	3.161.59.120
May 8, 2024 08:42:03.848206997 CEST	51992	2121	192.168.2.16	126.159.107.249
May 8, 2024 08:42:03.856893063 CEST	2121	51947	34.149.79.8	192.168.2.16
May 8, 2024 08:42:03.857316971 CEST	2121	51984	34.149.79.8	192.168.2.16
May 8, 2024 08:42:03.857388020 CEST	51984	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:03.875292063 CEST	2121	51898	218.158.89.232	192.168.2.16
May 8, 2024 08:42:03.878886938 CEST	51826	21	192.168.2.16	211.192.239.54
May 8, 2024 08:42:03.879139900 CEST	21	51969	81.21.231.72	192.168.2.16
May 8, 2024 08:42:03.879215002 CEST	21	51952	218.32.108.110	192.168.2.16
May 8, 2024 08:42:03.880876064 CEST	51796	21	192.168.2.16	115.19.136.196
May 8, 2024 08:42:03.881928921 CEST	51804	2121	192.168.2.16	3.161.59.120
May 8, 2024 08:42:03.894906044 CEST	51912	2121	192.168.2.16	51.38.57.28
May 8, 2024 08:42:03.894918919 CEST	51902	21	192.168.2.16	182.92.22.163
May 8, 2024 08:42:03.894922018 CEST	51797	2121	192.168.2.16	115.19.136.196
May 8, 2024 08:42:03.895170927 CEST	2121	51954	218.32.108.110	192.168.2.16
May 8, 2024 08:42:03.898087025 CEST	2121	51970	81.21.231.72	192.168.2.16
May 8, 2024 08:42:03.901673079 CEST	21	51976	101.229.210.80	192.168.2.16
May 8, 2024 08:42:03.910181999 CEST	21	51975	77.75.121.3	192.168.2.16
May 8, 2024 08:42:03.910253048 CEST	51975	21	192.168.2.16	77.75.121.3
May 8, 2024 08:42:03.910897017 CEST	51923	21	192.168.2.16	66.217.151.0
May 8, 2024 08:42:03.910907030 CEST	51806	2121	192.168.2.16	129.26.88.198
May 8, 2024 08:42:03.910907984 CEST	51805	21	192.168.2.16	129.26.88.198
May 8, 2024 08:42:03.911875963 CEST	51924	2121	192.168.2.16	66.217.151.0
May 8, 2024 08:42:03.913053989 CEST	51903	2121	192.168.2.16	182.92.22.163
May 8, 2024 08:42:03.919903040 CEST	2121	51977	101.229.210.80	192.168.2.16
May 8, 2024 08:42:03.926413059 CEST	21	51904	84.44.255.254	192.168.2.16
May 8, 2024 08:42:03.926718950 CEST	21	51978	84.44.255.254	192.168.2.16
May 8, 2024 08:42:03.926810026 CEST	51978	21	192.168.2.16	84.44.255.254
May 8, 2024 08:42:03.926893950 CEST	51827	2121	192.168.2.16	211.192.239.54
May 8, 2024 08:42:03.943217993 CEST	51993	21	192.168.2.16	37.69.31.161
May 8, 2024 08:42:03.943766117 CEST	21	51621	77.75.121.3	192.168.2.16
May 8, 2024 08:42:03.990895033 CEST	51925	21	192.168.2.16	60.139.52.99
May 8, 2024 08:42:03.990932941 CEST	51807	21	192.168.2.16	76.110.236.78
May 8, 2024 08:42:04.001127005 CEST	21	51951	172.120.235.139	192.168.2.16
May 8, 2024 08:42:04.001390934 CEST	21	51951	172.120.235.139	192.168.2.16
May 8, 2024 08:42:04.001405954 CEST	21	51963	117.223.205.236	192.168.2.16
May 8, 2024 08:42:04.001504898 CEST	51963	21	192.168.2.16	117.223.205.236
May 8, 2024 08:42:04.001575947 CEST	51951	21	192.168.2.16	172.120.235.139
May 8, 2024 08:42:04.005897999 CEST	51926	2121	192.168.2.16	60.139.52.99
May 8, 2024 08:42:04.005939960 CEST	51691	21	192.168.2.16	38.38.120.85
May 8, 2024 08:42:04.006297112 CEST	51994	21	192.168.2.16	38.38.120.85
May 8, 2024 08:42:04.006391048 CEST	51995	2121	192.168.2.16	37.69.31.161
May 8, 2024 08:42:04.009315014 CEST	21	51788	117.223.205.236	192.168.2.16
May 8, 2024 08:42:04.009381056 CEST	51788	21	192.168.2.16	117.223.205.236
May 8, 2024 08:42:04.011143923 CEST	21	51982	34.149.79.8	192.168.2.16
May 8, 2024 08:42:04.011200905 CEST	51982	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:04.011272907 CEST	51982	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:04.011481047 CEST	51996	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:04.019789934 CEST	2121	51984	34.149.79.8	192.168.2.16
May 8, 2024 08:42:04.019840002 CEST	51984	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:04.019934893 CEST	51984	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:04.020165920 CEST	51997	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:04.021934032 CEST	51809	21	192.168.2.16	119.123.63.70
May 8, 2024 08:42:04.021939993 CEST	51922	2121	192.168.2.16	123.232.178.226
May 8, 2024 08:42:04.021969080 CEST	51811	2121	192.168.2.16	119.123.63.70
May 8, 2024 08:42:04.022025108 CEST	51808	2121	192.168.2.16	76.110.236.78
May 8, 2024 08:42:04.031114101 CEST	21	51911	51.38.57.28	192.168.2.16
May 8, 2024 08:42:04.031173944 CEST	51911	21	192.168.2.16	51.38.57.28
May 8, 2024 08:42:04.031934977 CEST	21	51911	51.38.57.28	192.168.2.16
May 8, 2024 08:42:04.031997919 CEST	51911	21	192.168.2.16	51.38.57.28
May 8, 2024 08:42:04.053879976 CEST	51883	2121	192.168.2.16	105.68.251.211
May 8, 2024 08:42:04.054014921 CEST	51498	2121	192.168.2.16	38.207.205.17
May 8, 2024 08:42:04.069885969 CEST	51819	21	192.168.2.16	38.31.161.189
May 8, 2024 08:42:04.069905043 CEST	51818	2121	192.168.2.16	38.31.161.189
May 8, 2024 08:42:04.069905996 CEST	51814	21	192.168.2.16	104.76.76.237
May 8, 2024 08:42:04.070017099 CEST	51813	2121	192.168.2.16	104.76.76.237
May 8, 2024 08:42:04.070163965 CEST	51998	21	192.168.2.16	68.83.54.183
May 8, 2024 08:42:04.085500956 CEST	21	51802	91.146.97.65	192.168.2.16
May 8, 2024 08:42:04.085551023 CEST	51802	21	192.168.2.16	91.146.97.65
May 8, 2024 08:42:04.085882902 CEST	51936	2121	192.168.2.16	124.54.226.49
May 8, 2024 08:42:04.086224079 CEST	51999	2121	192.168.2.16	68.83.54.183
May 8, 2024 08:42:04.092719078 CEST	21	51895	171.244.37.116	192.168.2.16
May 8, 2024 08:42:04.092850924 CEST	51895	21	192.168.2.16	171.244.37.116
May 8, 2024 08:42:04.093003988 CEST	52000	21	192.168.2.16	171.244.37.116
May 8, 2024 08:42:04.117897034 CEST	51889	21	192.168.2.16	218.158.89.232
May 8, 2024 08:42:04.117896080 CEST	51917	21	192.168.2.16	24.124.110.138
May 8, 2024 08:42:04.118025064 CEST	51915	21	192.168.2.16	88.75.109.235
May 8, 2024 08:42:04.118024111 CEST	51916	2121	192.168.2.16	88.75.109.235
May 8, 2024 08:42:04.118263006 CEST	52001	21	192.168.2.16	197.26.33.147
May 8, 2024 08:42:04.121010065 CEST	21	51991	126.159.107.249	192.168.2.16
May 8, 2024 08:42:04.140465021 CEST	21	51923	66.217.151.0	192.168.2.16
May 8, 2024 08:42:04.140743971 CEST	2121	51924	66.217.151.0	192.168.2.16
May 8, 2024 08:42:04.148885965 CEST	51919	2121	192.168.2.16	119.71.5.164
May 8, 2024 08:42:04.148901939 CEST	51918	21	192.168.2.16	119.71.5.164
May 8, 2024 08:42:04.148905993 CEST	51920	2121	192.168.2.16	24.124.110.138
May 8, 2024 08:42:04.148922920 CEST	51921	21	192.168.2.16	123.232.178.226
May 8, 2024 08:42:04.148922920 CEST	51839	2121	192.168.2.16	91.126.155.116
May 8, 2024 08:42:04.150290966 CEST	2121	51907	210.180.125.220	192.168.2.16
May 8, 2024 08:42:04.151114941 CEST	2121	51992	126.159.107.249	192.168.2.16
May 8, 2024 08:42:04.151926994 CEST	21	51906	210.180.125.220	192.168.2.16
May 8, 2024 08:42:04.164889097 CEST	51838	21	192.168.2.16	91.126.155.116
May 8, 2024 08:42:04.174637079 CEST	21	51982	34.149.79.8	192.168.2.16
May 8, 2024 08:42:04.174877882 CEST	21	51996	34.149.79.8	192.168.2.16
May 8, 2024 08:42:04.174946070 CEST	51996	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:04.183444023 CEST	2121	51984	34.149.79.8	192.168.2.16
May 8, 2024 08:42:04.183455944 CEST	2121	51997	34.149.79.8	192.168.2.16
May 8, 2024 08:42:04.183517933 CEST	51997	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:04.191107035 CEST	21	51826	211.192.239.54	192.168.2.16
May 8, 2024 08:42:04.196429014 CEST	21	51994	38.38.120.85	192.168.2.16
May 8, 2024 08:42:04.196486950 CEST	51994	21	192.168.2.16	38.38.120.85
May 8, 2024 08:42:04.196897030 CEST	51858	21	192.168.2.16	135.148.177.63
May 8, 2024 08:42:04.204509974 CEST	21	51796	115.19.136.196	192.168.2.16
May 8, 2024 08:42:04.210860014 CEST	2121	51912	51.38.57.28	192.168.2.16
May 8, 2024 08:42:04.211596966 CEST	21	51951	172.120.235.139	192.168.2.16
May 8, 2024 08:42:04.211709976 CEST	51951	21	192.168.2.16	172.120.235.139
May 8, 2024 08:42:04.211869955 CEST	52002	21	192.168.2.16	172.120.235.139
May 8, 2024 08:42:04.212894917 CEST	51928	21	192.168.2.16	223.10.255.186
May 8, 2024 08:42:04.213058949 CEST	51927	2121	192.168.2.16	223.10.255.186
May 8, 2024 08:42:04.219212055 CEST	2121	51797	115.19.136.196	192.168.2.16
May 8, 2024 08:42:04.219566107 CEST	52003	2121	192.168.2.16	197.26.33.147
May 8, 2024 08:42:04.227884054 CEST	21	51975	77.75.121.3	192.168.2.16
May 8, 2024 08:42:04.228027105 CEST	51975	21	192.168.2.16	77.75.121.3
May 8, 2024 08:42:04.228895903 CEST	51859	2121	192.168.2.16	135.148.177.63
May 8, 2024 08:42:04.228897095 CEST	51929	21	192.168.2.16	24.58.45.63
May 8, 2024 08:42:04.228913069 CEST	51931	21	192.168.2.16	186.210.130.138
May 8, 2024 08:42:04.228925943 CEST	51930	2121	192.168.2.16	24.58.45.63
May 8, 2024 08:42:04.229305029 CEST	52004	21	192.168.2.16	173.234.100.8
May 8, 2024 08:42:04.229398012 CEST	52005	2121	192.168.2.16	173.234.100.8
May 8, 2024 08:42:04.235765934 CEST	21	51691	38.38.120.85	192.168.2.16
May 8, 2024 08:42:04.244496107 CEST	2121	51827	211.192.239.54	192.168.2.16
May 8, 2024 08:42:04.245285034 CEST	52006	21	192.168.2.16	60.120.31.113
May 8, 2024 08:42:04.245392084 CEST	51932	21	192.168.2.16	183.151.2.47
May 8, 2024 08:42:04.245415926 CEST	51933	2121	192.168.2.16	186.210.130.138
May 8, 2024 08:42:04.246296883 CEST	21	51978	84.44.255.254	192.168.2.16
May 8, 2024 08:42:04.246350050 CEST	51978	21	192.168.2.16	84.44.255.254
May 8, 2024 08:42:04.246426105 CEST	51978	21	192.168.2.16	84.44.255.254
May 8, 2024 08:42:04.246622086 CEST	52007	21	192.168.2.16	84.44.255.254
May 8, 2024 08:42:04.254992008 CEST	21	51899	196.210.0.111	192.168.2.16
May 8, 2024 08:42:04.255003929 CEST	21	51899	196.210.0.111	192.168.2.16
May 8, 2024 08:42:04.255182981 CEST	51899	21	192.168.2.16	196.210.0.111
May 8, 2024 08:42:04.258094072 CEST	2121	51818	38.31.161.189	192.168.2.16
May 8, 2024 08:42:04.260901928 CEST	51935	21	192.168.2.16	124.54.226.49
May 8, 2024 08:42:04.260982037 CEST	51828	2121	192.168.2.16	94.56.108.73
May 8, 2024 08:42:04.261007071 CEST	51934	2121	192.168.2.16	183.151.2.47
May 8, 2024 08:42:04.263168097 CEST	21	51819	38.31.161.189	192.168.2.16
May 8, 2024 08:42:04.263586044 CEST	52008	2121	192.168.2.16	60.120.31.113
May 8, 2024 08:42:04.276897907 CEST	51937	2121	192.168.2.16	71.34.143.153
May 8, 2024 08:42:04.276936054 CEST	51939	21	192.168.2.16	59.7.179.14
May 8, 2024 08:42:04.277098894 CEST	52009	21	192.168.2.16	154.202.14.113
May 8, 2024 08:42:04.277127028 CEST	51938	21	192.168.2.16	71.34.143.153
May 8, 2024 08:42:04.291970015 CEST	21	51925	60.139.52.99	192.168.2.16
May 8, 2024 08:42:04.292932034 CEST	51820	21	192.168.2.16	45.49.192.14
May 8, 2024 08:42:04.292956114 CEST	51941	21	192.168.2.16	189.152.150.132
May 8, 2024 08:42:04.292968035 CEST	51940	2121	192.168.2.16	59.7.179.14
May 8, 2024 08:42:04.309055090 CEST	51942	2121	192.168.2.16	189.152.150.132
May 8, 2024 08:42:04.309079885 CEST	51962	21	192.168.2.16	1.227.238.87
May 8, 2024 08:42:04.309340000 CEST	2121	51926	60.139.52.99	192.168.2.16
May 8, 2024 08:42:04.309432030 CEST	51960	2121	192.168.2.16	1.227.238.87
May 8, 2024 08:42:04.309442043 CEST	51943	21	192.168.2.16	104.4.88.110
May 8, 2024 08:42:04.324896097 CEST	51829	21	192.168.2.16	94.56.108.73
May 8, 2024 08:42:04.324966908 CEST	51944	2121	192.168.2.16	104.4.88.110
May 8, 2024 08:42:04.337619066 CEST	21	51996	34.149.79.8	192.168.2.16
May 8, 2024 08:42:04.337672949 CEST	51996	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:04.337769032 CEST	51996	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:04.338002920 CEST	52010	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:04.341243029 CEST	52011	2121	192.168.2.16	154.202.14.113
May 8, 2024 08:42:04.346138000 CEST	2121	51997	34.149.79.8	192.168.2.16
May 8, 2024 08:42:04.346199036 CEST	51997	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:04.346287966 CEST	51997	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:04.346484900 CEST	52012	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:04.356895924 CEST	51802	21	192.168.2.16	91.146.97.65
May 8, 2024 08:42:04.356914997 CEST	51822	21	192.168.2.16	125.46.97.201
May 8, 2024 08:42:04.357028961 CEST	51945	21	192.168.2.16	102.64.165.88
May 8, 2024 08:42:04.357125044 CEST	52013	21	192.168.2.16	73.151.35.77
May 8, 2024 08:42:04.372925997 CEST	51821	2121	192.168.2.16	45.49.192.14
May 8, 2024 08:42:04.387979984 CEST	21	51994	38.38.120.85	192.168.2.16
May 8, 2024 08:42:04.388149023 CEST	51994	21	192.168.2.16	38.38.120.85
May 8, 2024 08:42:04.388880014 CEST	51952	21	192.168.2.16	218.32.108.110
May 8, 2024 08:42:04.388906002 CEST	51948	2121	192.168.2.16	102.64.165.88
May 8, 2024 08:42:04.388925076 CEST	51949	21	192.168.2.16	94.98.64.199
May 8, 2024 08:42:04.388925076 CEST	51898	2121	192.168.2.16	218.158.89.232
May 8, 2024 08:42:04.390077114 CEST	2121	51922	123.232.178.226	192.168.2.16
May 8, 2024 08:42:04.390105963 CEST	51969	21	192.168.2.16	81.21.231.72
May 8, 2024 08:42:04.393636942 CEST	21	52002	172.120.235.139	192.168.2.16
May 8, 2024 08:42:04.393667936 CEST	21	51951	172.120.235.139	192.168.2.16
May 8, 2024 08:42:04.393699884 CEST	52002	21	192.168.2.16	172.120.235.139
May 8, 2024 08:42:04.393726110 CEST	51951	21	192.168.2.16	172.120.235.139
May 8, 2024 08:42:04.402839899 CEST	2121	51936	124.54.226.49	192.168.2.16
May 8, 2024 08:42:04.403692007 CEST	2121	51883	105.68.251.211	192.168.2.16
May 8, 2024 08:42:04.404875040 CEST	51954	2121	192.168.2.16	218.32.108.110
May 8, 2024 08:42:04.404900074 CEST	51970	2121	192.168.2.16	81.21.231.72
May 8, 2024 08:42:04.404905081 CEST	51950	2121	192.168.2.16	94.98.64.199
May 8, 2024 08:42:04.404905081 CEST	51976	21	192.168.2.16	101.229.210.80
May 8, 2024 08:42:04.407382011 CEST	51823	2121	192.168.2.16	125.46.97.201
May 8, 2024 08:42:04.419717073 CEST	21	52004	173.234.100.8	192.168.2.16
May 8, 2024 08:42:04.421797991 CEST	2121	52005	173.234.100.8	192.168.2.16
May 8, 2024 08:42:04.429029942 CEST	21	51858	135.148.177.63	192.168.2.16
May 8, 2024 08:42:04.432706118 CEST	21	51889	218.158.89.232	192.168.2.16
May 8, 2024 08:42:04.435909986 CEST	51955	2121	192.168.2.16	83.41.211.18
May 8, 2024 08:42:04.435918093 CEST	51953	21	192.168.2.16	83.41.211.18
May 8, 2024 08:42:04.435920000 CEST	51977	2121	192.168.2.16	101.229.210.80
May 8, 2024 08:42:04.439788103 CEST	21	51895	171.244.37.116	192.168.2.16
May 8, 2024 08:42:04.439928055 CEST	21	51895	171.244.37.116	192.168.2.16
May 8, 2024 08:42:04.439990044 CEST	51895	21	192.168.2.16	171.244.37.116
May 8, 2024 08:42:04.444075108 CEST	21	52000	171.244.37.116	192.168.2.16
May 8, 2024 08:42:04.444144964 CEST	52000	21	192.168.2.16	171.244.37.116
May 8, 2024 08:42:04.451911926 CEST	51956	21	192.168.2.16	223.72.119.6
May 8, 2024 08:42:04.452301979 CEST	52014	2121	192.168.2.16	73.151.35.77
May 8, 2024 08:42:04.452389002 CEST	52015	21	192.168.2.16	14.69.93.166
May 8, 2024 08:42:04.469744921 CEST	2121	51859	135.148.177.63	192.168.2.16
May 8, 2024 08:42:04.473401070 CEST	2121	51839	91.126.155.116	192.168.2.16
May 8, 2024 08:42:04.483889103 CEST	51957	2121	192.168.2.16	223.72.119.6
May 8, 2024 08:42:04.483896971 CEST	51958	21	192.168.2.16	185.68.4.125
May 8, 2024 08:42:04.484709024 CEST	51830	21	192.168.2.16	121.229.221.64
May 8, 2024 08:42:04.495156050 CEST	21	51691	38.38.120.85	192.168.2.16
May 8, 2024 08:42:04.495222092 CEST	51691	21	192.168.2.16	38.38.120.85
May 8, 2024 08:42:04.495260000 CEST	21	51691	38.38.120.85	192.168.2.16
May 8, 2024 08:42:04.495342016 CEST	51691	21	192.168.2.16	38.38.120.85
May 8, 2024 08:42:04.495938063 CEST	21	51691	38.38.120.85	192.168.2.16
May 8, 2024 08:42:04.495985031 CEST	51691	21	192.168.2.16	38.38.120.85
May 8, 2024 08:42:04.498967886 CEST	21	52001	197.26.33.147	192.168.2.16
May 8, 2024 08:42:04.499041080 CEST	52001	21	192.168.2.16	197.26.33.147
May 8, 2024 08:42:04.499404907 CEST	21	51838	91.126.155.116	192.168.2.16
May 8, 2024 08:42:04.499907970 CEST	51961	21	192.168.2.16	20.8.54.180
May 8, 2024 08:42:04.499918938 CEST	51959	2121	192.168.2.16	185.68.4.125
May 8, 2024 08:42:04.500133038 CEST	21	51996	34.149.79.8	192.168.2.16
May 8, 2024 08:42:04.500447989 CEST	21	52010	34.149.79.8	192.168.2.16
May 8, 2024 08:42:04.500504971 CEST	52010	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:04.501307964 CEST	21	51963	117.223.205.236	192.168.2.16
May 8, 2024 08:42:04.501442909 CEST	51963	21	192.168.2.16	117.223.205.236
May 8, 2024 08:42:04.503655910 CEST	21	52009	154.202.14.113	192.168.2.16
May 8, 2024 08:42:04.508601904 CEST	2121	51997	34.149.79.8	192.168.2.16
May 8, 2024 08:42:04.508676052 CEST	2121	52012	34.149.79.8	192.168.2.16
May 8, 2024 08:42:04.508733034 CEST	52012	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:04.515896082 CEST	51964	2121	192.168.2.16	20.8.54.180
May 8, 2024 08:42:04.515897036 CEST	51831	2121	192.168.2.16	121.229.221.64
May 8, 2024 08:42:04.516186953 CEST	52016	2121	192.168.2.16	14.69.93.166
May 8, 2024 08:42:04.531902075 CEST	51966	21	192.168.2.16	31.179.174.249
May 8, 2024 08:42:04.531915903 CEST	51965	21	192.168.2.16	171.240.26.242
May 8, 2024 08:42:04.531935930 CEST	51967	2121	192.168.2.16	171.240.26.242
May 8, 2024 08:42:04.544008017 CEST	21	51975	77.75.121.3	192.168.2.16
May 8, 2024 08:42:04.544056892 CEST	21	51975	77.75.121.3	192.168.2.16
May 8, 2024 08:42:04.544178963 CEST	51975	21	192.168.2.16	77.75.121.3
May 8, 2024 08:42:04.547899008 CEST	51968	2121	192.168.2.16	31.179.174.249
May 8, 2024 08:42:04.550904989 CEST	21	52006	60.120.31.113	192.168.2.16
May 8, 2024 08:42:04.562344074 CEST	21	52007	84.44.255.254	192.168.2.16
May 8, 2024 08:42:04.562412024 CEST	52007	21	192.168.2.16	84.44.255.254
May 8, 2024 08:42:04.563894033 CEST	51973	21	192.168.2.16	190.51.17.139
May 8, 2024 08:42:04.563894987 CEST	51972	2121	192.168.2.16	99.249.236.148
May 8, 2024 08:42:04.564423084 CEST	51971	21	192.168.2.16	99.249.236.148
May 8, 2024 08:42:04.564717054 CEST	52017	2121	192.168.2.16	94.13.12.246
May 8, 2024 08:42:04.564770937 CEST	52018	21	192.168.2.16	94.13.12.246
May 8, 2024 08:42:04.564788103 CEST	52019	21	192.168.2.16	122.142.243.149
May 8, 2024 08:42:04.564927101 CEST	52020	2121	192.168.2.16	122.142.243.149
May 8, 2024 08:42:04.565946102 CEST	21	51978	84.44.255.254	192.168.2.16
May 8, 2024 08:42:04.567826986 CEST	2121	52011	154.202.14.113	192.168.2.16
May 8, 2024 08:42:04.571726084 CEST	2121	52008	60.120.31.113	192.168.2.16
May 8, 2024 08:42:04.579921961 CEST	51974	2121	192.168.2.16	190.51.17.139
May 8, 2024 08:42:04.580466032 CEST	52021	21	192.168.2.16	211.252.166.9
May 8, 2024 08:42:04.580466032 CEST	52022	2121	192.168.2.16	211.252.166.9
May 8, 2024 08:42:04.580526114 CEST	52024	21	192.168.2.16	60.134.194.144
May 8, 2024 08:42:04.580760002 CEST	21	51994	38.38.120.85	192.168.2.16
May 8, 2024 08:42:04.580781937 CEST	52023	2121	192.168.2.16	60.134.194.144
May 8, 2024 08:42:04.580895901 CEST	21	51994	38.38.120.85	192.168.2.16
May 8, 2024 08:42:04.581006050 CEST	51994	21	192.168.2.16	38.38.120.85
May 8, 2024 08:42:04.595886946 CEST	51833	21	192.168.2.16	75.176.24.187
May 8, 2024 08:42:04.595887899 CEST	51832	2121	192.168.2.16	75.176.24.187
May 8, 2024 08:42:04.596724987 CEST	52025	21	192.168.2.16	58.38.143.77
May 8, 2024 08:42:04.596823931 CEST	52026	2121	192.168.2.16	58.38.143.77
May 8, 2024 08:42:04.596829891 CEST	52027	21	192.168.2.16	175.16.109.188
May 8, 2024 08:42:04.596889973 CEST	52028	2121	192.168.2.16	175.16.109.188
May 8, 2024 08:42:04.596952915 CEST	52029	21	192.168.2.16	177.30.55.192
May 8, 2024 08:42:04.612478018 CEST	52030	2121	192.168.2.16	177.30.55.192
May 8, 2024 08:42:04.612546921 CEST	52031	2121	192.168.2.16	58.50.254.97
May 8, 2024 08:42:04.612584114 CEST	52032	21	192.168.2.16	95.57.82.213
May 8, 2024 08:42:04.612612963 CEST	52033	21	192.168.2.16	58.50.254.97
May 8, 2024 08:42:04.612711906 CEST	52034	2121	192.168.2.16	95.57.82.213
May 8, 2024 08:42:04.617211103 CEST	2121	51960	1.227.238.87	192.168.2.16
May 8, 2024 08:42:04.618305922 CEST	21	52002	172.120.235.139	192.168.2.16
May 8, 2024 08:42:04.618403912 CEST	52002	21	192.168.2.16	172.120.235.139
May 8, 2024 08:42:04.621143103 CEST	21	51962	1.227.238.87	192.168.2.16
May 8, 2024 08:42:04.627880096 CEST	51836	2121	192.168.2.16	67.183.186.201
May 8, 2024 08:42:04.627881050 CEST	51991	21	192.168.2.16	126.159.107.249
May 8, 2024 08:42:04.628103018 CEST	51835	21	192.168.2.16	67.183.186.201
May 8, 2024 08:42:04.628407955 CEST	52035	21	192.168.2.16	118.71.57.92
May 8, 2024 08:42:04.628478050 CEST	52036	2121	192.168.2.16	118.71.57.92
May 8, 2024 08:42:04.628676891 CEST	52037	21	192.168.2.16	80.180.201.221
May 8, 2024 08:42:04.628678083 CEST	52039	21	192.168.2.16	119.113.76.216
May 8, 2024 08:42:04.628725052 CEST	52038	2121	192.168.2.16	80.180.201.221
May 8, 2024 08:42:04.643898010 CEST	51979	21	192.168.2.16	73.111.10.90
May 8, 2024 08:42:04.643907070 CEST	51924	2121	192.168.2.16	66.217.151.0
May 8, 2024 08:42:04.644013882 CEST	51923	21	192.168.2.16	66.217.151.0
May 8, 2024 08:42:04.644190073 CEST	52040	2121	192.168.2.16	119.113.76.216
May 8, 2024 08:42:04.659881115 CEST	51992	2121	192.168.2.16	126.159.107.249
May 8, 2024 08:42:04.659913063 CEST	51906	21	192.168.2.16	210.180.125.220
May 8, 2024 08:42:04.659914970 CEST	51907	2121	192.168.2.16	210.180.125.220
May 8, 2024 08:42:04.660108089 CEST	51980	2121	192.168.2.16	73.111.10.90
May 8, 2024 08:42:04.668673992 CEST	21	52010	34.149.79.8	192.168.2.16
May 8, 2024 08:42:04.668752909 CEST	52010	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:04.668812990 CEST	52010	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:04.669004917 CEST	52041	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:04.671999931 CEST	2121	52012	34.149.79.8	192.168.2.16
May 8, 2024 08:42:04.672050953 CEST	52012	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:04.672158003 CEST	52012	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:04.672399044 CEST	52042	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:04.675894976 CEST	51981	21	192.168.2.16	85.229.248.246
May 8, 2024 08:42:04.680275917 CEST	2121	51828	94.56.108.73	192.168.2.16
May 8, 2024 08:42:04.691004038 CEST	51983	2121	192.168.2.16	85.229.248.246
May 8, 2024 08:42:04.704029083 CEST	2121	51898	218.158.89.232	192.168.2.16
May 8, 2024 08:42:04.705892086 CEST	51826	21	192.168.2.16	211.192.239.54
May 8, 2024 08:42:04.716227055 CEST	21	51976	101.229.210.80	192.168.2.16
May 8, 2024 08:42:04.721874952 CEST	51985	21	192.168.2.16	41.228.35.66
May 8, 2024 08:42:04.721895933 CEST	51912	2121	192.168.2.16	51.38.57.28
May 8, 2024 08:42:04.723577023 CEST	21	51969	81.21.231.72	192.168.2.16
May 8, 2024 08:42:04.737895966 CEST	51841	21	192.168.2.16	122.36.240.79
May 8, 2024 08:42:04.739815950 CEST	2121	51970	81.21.231.72	192.168.2.16
May 8, 2024 08:42:04.743084908 CEST	21	51621	77.75.121.3	192.168.2.16
May 8, 2024 08:42:04.743141890 CEST	51621	21	192.168.2.16	77.75.121.3
May 8, 2024 08:42:04.743187904 CEST	21	51621	77.75.121.3	192.168.2.16
May 8, 2024 08:42:04.743233919 CEST	51621	21	192.168.2.16	77.75.121.3
May 8, 2024 08:42:04.743520021 CEST	21	51621	77.75.121.3	192.168.2.16
May 8, 2024 08:42:04.743561983 CEST	51621	21	192.168.2.16	77.75.121.3
May 8, 2024 08:42:04.750446081 CEST	2121	51977	101.229.210.80	192.168.2.16
May 8, 2024 08:42:04.753887892 CEST	51827	2121	192.168.2.16	211.192.239.54
May 8, 2024 08:42:04.766293049 CEST	21	51829	94.56.108.73	192.168.2.16
May 8, 2024 08:42:04.766916037 CEST	21	51899	196.210.0.111	192.168.2.16
May 8, 2024 08:42:04.769898891 CEST	51845	21	192.168.2.16	176.114.196.43
May 8, 2024 08:42:04.769898891 CEST	51844	2121	192.168.2.16	122.36.240.79
May 8, 2024 08:42:04.777842045 CEST	21	52015	14.69.93.166	192.168.2.16
May 8, 2024 08:42:04.785890102 CEST	51846	2121	192.168.2.16	176.114.196.43
May 8, 2024 08:42:04.787333965 CEST	51986	2121	192.168.2.16	41.228.35.66
May 8, 2024 08:42:04.795377970 CEST	21	52000	171.244.37.116	192.168.2.16
May 8, 2024 08:42:04.795563936 CEST	52000	21	192.168.2.16	171.244.37.116
May 8, 2024 08:42:04.800061941 CEST	21	52002	172.120.235.139	192.168.2.16
May 8, 2024 08:42:04.800389051 CEST	21	52002	172.120.235.139	192.168.2.16
May 8, 2024 08:42:04.800474882 CEST	52002	21	192.168.2.16	172.120.235.139
May 8, 2024 08:42:04.800906897 CEST	51847	21	192.168.2.16	148.66.8.13
May 8, 2024 08:42:04.800910950 CEST	51988	21	192.168.2.16	211.201.27.47
May 8, 2024 08:42:04.800910950 CEST	51925	21	192.168.2.16	60.139.52.99
May 8, 2024 08:42:04.800920963 CEST	51848	2121	192.168.2.16	148.66.8.13
May 8, 2024 08:42:04.800920963 CEST	51987	2121	192.168.2.16	211.201.27.47
May 8, 2024 08:42:04.809766054 CEST	21	51994	38.38.120.85	192.168.2.16
May 8, 2024 08:42:04.817142010 CEST	51926	2121	192.168.2.16	60.139.52.99
May 8, 2024 08:42:04.831111908 CEST	21	52010	34.149.79.8	192.168.2.16
May 8, 2024 08:42:04.831423998 CEST	21	52041	34.149.79.8	192.168.2.16
May 8, 2024 08:42:04.831495047 CEST	52041	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:04.832885027 CEST	51989	21	192.168.2.16	93.236.206.101
May 8, 2024 08:42:04.832902908 CEST	51990	2121	192.168.2.16	93.236.206.101
May 8, 2024 08:42:04.832904100 CEST	51851	21	192.168.2.16	178.232.116.12
May 8, 2024 08:42:04.834240913 CEST	2121	52012	34.149.79.8	192.168.2.16
May 8, 2024 08:42:04.834769011 CEST	2121	52042	34.149.79.8	192.168.2.16
May 8, 2024 08:42:04.834820032 CEST	52042	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:04.841069937 CEST	2121	52016	14.69.93.166	192.168.2.16
May 8, 2024 08:42:04.848881006 CEST	51853	21	192.168.2.16	175.136.119.90
May 8, 2024 08:42:04.848897934 CEST	51852	2121	192.168.2.16	178.232.116.12
May 8, 2024 08:42:04.851357937 CEST	21	51952	218.32.108.110	192.168.2.16
May 8, 2024 08:42:04.864933968 CEST	51855	2121	192.168.2.16	175.136.119.90
May 8, 2024 08:42:04.867331028 CEST	2121	51954	218.32.108.110	192.168.2.16
May 8, 2024 08:42:04.871316910 CEST	21	51923	66.217.151.0	192.168.2.16
May 8, 2024 08:42:04.871464968 CEST	2121	51924	66.217.151.0	192.168.2.16
May 8, 2024 08:42:04.879975080 CEST	21	52024	60.134.194.144	192.168.2.16
May 8, 2024 08:42:04.880661011 CEST	2121	52023	60.134.194.144	192.168.2.16
May 8, 2024 08:42:04.881233931 CEST	21	52007	84.44.255.254	192.168.2.16
May 8, 2024 08:42:04.881298065 CEST	52007	21	192.168.2.16	84.44.255.254
May 8, 2024 08:42:04.881375074 CEST	52007	21	192.168.2.16	84.44.255.254
May 8, 2024 08:42:04.881628036 CEST	52043	21	192.168.2.16	84.44.255.254
May 8, 2024 08:42:04.895903111 CEST	51922	2121	192.168.2.16	123.232.178.226
May 8, 2024 08:42:04.901808023 CEST	21	51975	77.75.121.3	192.168.2.16
May 8, 2024 08:42:04.905967951 CEST	21	52001	197.26.33.147	192.168.2.16
May 8, 2024 08:42:04.906030893 CEST	52001	21	192.168.2.16	197.26.33.147
May 8, 2024 08:42:04.906138897 CEST	52001	21	192.168.2.16	197.26.33.147
May 8, 2024 08:42:04.906183958 CEST	52001	21	192.168.2.16	197.26.33.147
May 8, 2024 08:42:04.906456947 CEST	52044	21	192.168.2.16	20.194.55.18
May 8, 2024 08:42:04.911889076 CEST	51936	2121	192.168.2.16	124.54.226.49
May 8, 2024 08:42:04.911890984 CEST	51883	2121	192.168.2.16	105.68.251.211
May 8, 2024 08:42:04.912151098 CEST	52045	2121	192.168.2.16	20.194.55.18
May 8, 2024 08:42:04.927912951 CEST	52004	21	192.168.2.16	173.234.100.8
May 8, 2024 08:42:04.927930117 CEST	52005	2121	192.168.2.16	173.234.100.8
May 8, 2024 08:42:04.929143906 CEST	21	51991	126.159.107.249	192.168.2.16
May 8, 2024 08:42:04.943912029 CEST	51889	21	192.168.2.16	218.158.89.232
May 8, 2024 08:42:04.943912983 CEST	51858	21	192.168.2.16	135.148.177.63
May 8, 2024 08:42:04.944242001 CEST	51993	21	192.168.2.16	37.69.31.161
May 8, 2024 08:42:04.960566044 CEST	51856	21	192.168.2.16	80.39.203.17
May 8, 2024 08:42:04.961360931 CEST	2121	51907	210.180.125.220	192.168.2.16
May 8, 2024 08:42:04.961504936 CEST	2121	51992	126.159.107.249	192.168.2.16
May 8, 2024 08:42:04.962440014 CEST	21	51906	210.180.125.220	192.168.2.16
May 8, 2024 08:42:04.975878954 CEST	51859	2121	192.168.2.16	135.148.177.63
May 8, 2024 08:42:04.975899935 CEST	51857	2121	192.168.2.16	80.39.203.17
May 8, 2024 08:42:04.975907087 CEST	51839	2121	192.168.2.16	91.126.155.116
May 8, 2024 08:42:04.991916895 CEST	51860	21	192.168.2.16	73.110.154.93
May 8, 2024 08:42:04.995117903 CEST	21	52041	34.149.79.8	192.168.2.16
May 8, 2024 08:42:04.995198965 CEST	52041	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:04.995903969 CEST	52041	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:04.996277094 CEST	52046	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:05.007920027 CEST	51838	21	192.168.2.16	91.126.155.116
May 8, 2024 08:42:05.007920027 CEST	51995	2121	192.168.2.16	37.69.31.161
May 8, 2024 08:42:05.007930994 CEST	52009	21	192.168.2.16	154.202.14.113
May 8, 2024 08:42:05.008326054 CEST	52047	21	192.168.2.16	122.167.225.161
May 8, 2024 08:42:05.009932995 CEST	2121	52042	34.149.79.8	192.168.2.16
May 8, 2024 08:42:05.010025024 CEST	52042	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:05.010098934 CEST	52042	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:05.010339975 CEST	52048	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:05.011162043 CEST	21	52002	172.120.235.139	192.168.2.16
May 8, 2024 08:42:05.011271000 CEST	52002	21	192.168.2.16	172.120.235.139
May 8, 2024 08:42:05.011415005 CEST	52049	21	192.168.2.16	172.120.235.139
May 8, 2024 08:42:05.017693043 CEST	21	51963	117.223.205.236	192.168.2.16
May 8, 2024 08:42:05.018157959 CEST	21	51826	211.192.239.54	192.168.2.16
May 8, 2024 08:42:05.019244909 CEST	21	51963	117.223.205.236	192.168.2.16
May 8, 2024 08:42:05.019387960 CEST	51963	21	192.168.2.16	117.223.205.236
May 8, 2024 08:42:05.037945986 CEST	2121	51912	51.38.57.28	192.168.2.16
May 8, 2024 08:42:05.039885998 CEST	51862	2121	192.168.2.16	73.110.154.93
May 8, 2024 08:42:05.040352106 CEST	52050	2121	192.168.2.16	122.167.225.161
May 8, 2024 08:42:05.055903912 CEST	51864	2121	192.168.2.16	31.150.22.103
May 8, 2024 08:42:05.055907965 CEST	52006	21	192.168.2.16	60.120.31.113
May 8, 2024 08:42:05.055910110 CEST	51863	21	192.168.2.16	31.150.22.103
May 8, 2024 08:42:05.071937084 CEST	52008	2121	192.168.2.16	60.120.31.113
May 8, 2024 08:42:05.071939945 CEST	51866	21	192.168.2.16	73.81.203.75
May 8, 2024 08:42:05.071954012 CEST	52011	2121	192.168.2.16	154.202.14.113
May 8, 2024 08:42:05.071957111 CEST	51868	2121	192.168.2.16	73.81.203.75
May 8, 2024 08:42:05.071964979 CEST	51998	21	192.168.2.16	68.83.54.183
May 8, 2024 08:42:05.073179960 CEST	2121	51827	211.192.239.54	192.168.2.16
May 8, 2024 08:42:05.073592901 CEST	52051	21	192.168.2.16	83.33.136.192
May 8, 2024 08:42:05.087909937 CEST	51870	21	192.168.2.16	184.66.15.203
May 8, 2024 08:42:05.087914944 CEST	51999	2121	192.168.2.16	68.83.54.183
May 8, 2024 08:42:05.102344990 CEST	21	51925	60.139.52.99	192.168.2.16
May 8, 2024 08:42:05.118125916 CEST	21	52004	173.234.100.8	192.168.2.16
May 8, 2024 08:42:05.119926929 CEST	51960	2121	192.168.2.16	1.227.238.87
May 8, 2024 08:42:05.120134115 CEST	2121	52005	173.234.100.8	192.168.2.16
May 8, 2024 08:42:05.120872021 CEST	2121	51926	60.139.52.99	192.168.2.16
May 8, 2024 08:42:05.135930061 CEST	51962	21	192.168.2.16	1.227.238.87
May 8, 2024 08:42:05.146876097 CEST	51871	2121	192.168.2.16	184.66.15.203
May 8, 2024 08:42:05.149099112 CEST	21	52000	171.244.37.116	192.168.2.16
May 8, 2024 08:42:05.149250031 CEST	52000	21	192.168.2.16	171.244.37.116
May 8, 2024 08:42:05.158287048 CEST	21	52041	34.149.79.8	192.168.2.16
May 8, 2024 08:42:05.158679008 CEST	21	52046	34.149.79.8	192.168.2.16
May 8, 2024 08:42:05.158746958 CEST	52046	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:05.167882919 CEST	51881	21	192.168.2.16	105.68.251.211
May 8, 2024 08:42:05.172477961 CEST	2121	52042	34.149.79.8	192.168.2.16
May 8, 2024 08:42:05.172712088 CEST	2121	52048	34.149.79.8	192.168.2.16
May 8, 2024 08:42:05.172779083 CEST	52048	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:05.176033020 CEST	21	51858	135.148.177.63	192.168.2.16
May 8, 2024 08:42:05.183881044 CEST	51828	2121	192.168.2.16	94.56.108.73
May 8, 2024 08:42:05.193047047 CEST	21	52002	172.120.235.139	192.168.2.16
May 8, 2024 08:42:05.193099976 CEST	52002	21	192.168.2.16	172.120.235.139
May 8, 2024 08:42:05.193156004 CEST	21	52049	172.120.235.139	192.168.2.16
May 8, 2024 08:42:05.193212986 CEST	52049	21	192.168.2.16	172.120.235.139
May 8, 2024 08:42:05.198746920 CEST	21	52007	84.44.255.254	192.168.2.16
May 8, 2024 08:42:05.198913097 CEST	21	52043	84.44.255.254	192.168.2.16
May 8, 2024 08:42:05.198976994 CEST	52043	21	192.168.2.16	84.44.255.254
May 8, 2024 08:42:05.199887037 CEST	51872	21	192.168.2.16	78.19.78.115
May 8, 2024 08:42:05.199903011 CEST	51873	2121	192.168.2.16	78.19.78.115
May 8, 2024 08:42:05.200114012 CEST	51874	21	192.168.2.16	92.234.39.72
May 8, 2024 08:42:05.200246096 CEST	52052	2121	192.168.2.16	83.33.136.192
May 8, 2024 08:42:05.215886116 CEST	51898	2121	192.168.2.16	218.158.89.232
May 8, 2024 08:42:05.216025114 CEST	51875	21	192.168.2.16	91.146.97.65
May 8, 2024 08:42:05.216736078 CEST	2121	51859	135.148.177.63	192.168.2.16
May 8, 2024 08:42:05.228897095 CEST	2121	51936	124.54.226.49	192.168.2.16
May 8, 2024 08:42:05.231884003 CEST	52003	2121	192.168.2.16	197.26.33.147
May 8, 2024 08:42:05.231909037 CEST	51976	21	192.168.2.16	101.229.210.80
May 8, 2024 08:42:05.232057095 CEST	51969	21	192.168.2.16	81.21.231.72
May 8, 2024 08:42:05.232239008 CEST	52053	21	192.168.2.16	24.118.206.209
May 8, 2024 08:42:05.234563112 CEST	21	52009	154.202.14.113	192.168.2.16
May 8, 2024 08:42:05.247905970 CEST	51970	2121	192.168.2.16	81.21.231.72
May 8, 2024 08:42:05.258554935 CEST	21	51889	218.158.89.232	192.168.2.16
May 8, 2024 08:42:05.261600018 CEST	2121	51883	105.68.251.211	192.168.2.16
May 8, 2024 08:42:05.263894081 CEST	51977	2121	192.168.2.16	101.229.210.80
May 8, 2024 08:42:05.263926029 CEST	2121	51922	123.232.178.226	192.168.2.16
May 8, 2024 08:42:05.264517069 CEST	52054	2121	192.168.2.16	24.118.206.209
May 8, 2024 08:42:05.279900074 CEST	52015	21	192.168.2.16	14.69.93.166
May 8, 2024 08:42:05.281034946 CEST	51829	21	192.168.2.16	94.56.108.73
May 8, 2024 08:42:05.286866903 CEST	21	52001	197.26.33.147	192.168.2.16
May 8, 2024 08:42:05.288814068 CEST	21	52001	197.26.33.147	192.168.2.16
May 8, 2024 08:42:05.298551083 CEST	2121	52011	154.202.14.113	192.168.2.16
May 8, 2024 08:42:05.299889088 CEST	51878	2121	192.168.2.16	92.234.39.72
May 8, 2024 08:42:05.300491095 CEST	2121	51839	91.126.155.116	192.168.2.16
May 8, 2024 08:42:05.311944008 CEST	51879	2121	192.168.2.16	101.114.75.186
May 8, 2024 08:42:05.312231064 CEST	51880	21	192.168.2.16	101.114.75.186
May 8, 2024 08:42:05.312231064 CEST	52055	21	192.168.2.16	120.24.160.35
May 8, 2024 08:42:05.321171999 CEST	21	52046	34.149.79.8	192.168.2.16
May 8, 2024 08:42:05.321223021 CEST	52046	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:05.321307898 CEST	52046	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:05.321515083 CEST	52056	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:05.335242987 CEST	2121	52048	34.149.79.8	192.168.2.16
May 8, 2024 08:42:05.335300922 CEST	52048	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:05.335402966 CEST	52048	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:05.335688114 CEST	52057	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:05.342413902 CEST	21	51838	91.126.155.116	192.168.2.16
May 8, 2024 08:42:05.342749119 CEST	52058	2121	192.168.2.16	62.140.135.146
May 8, 2024 08:42:05.349879980 CEST	52016	2121	192.168.2.16	14.69.93.166
May 8, 2024 08:42:05.359910965 CEST	51952	21	192.168.2.16	218.32.108.110
May 8, 2024 08:42:05.360006094 CEST	52013	21	192.168.2.16	73.151.35.77
May 8, 2024 08:42:05.361614943 CEST	21	52006	60.120.31.113	192.168.2.16
May 8, 2024 08:42:05.375907898 CEST	51954	2121	192.168.2.16	218.32.108.110
May 8, 2024 08:42:05.375910997 CEST	51924	2121	192.168.2.16	66.217.151.0
May 8, 2024 08:42:05.375930071 CEST	51923	21	192.168.2.16	66.217.151.0
May 8, 2024 08:42:05.376439095 CEST	52059	21	192.168.2.16	62.140.135.146
May 8, 2024 08:42:05.379219055 CEST	2121	52008	60.120.31.113	192.168.2.16
May 8, 2024 08:42:05.390877962 CEST	52023	2121	192.168.2.16	60.134.194.144
May 8, 2024 08:42:05.390903950 CEST	52024	21	192.168.2.16	60.134.194.144
May 8, 2024 08:42:05.390911102 CEST	51884	21	192.168.2.16	201.130.140.23
May 8, 2024 08:42:05.407464981 CEST	52060	21	192.168.2.16	38.207.205.17
May 8, 2024 08:42:05.407526970 CEST	52061	21	192.168.2.16	46.34.34.117
May 8, 2024 08:42:05.416695118 CEST	21	52049	172.120.235.139	192.168.2.16
May 8, 2024 08:42:05.416832924 CEST	52049	21	192.168.2.16	172.120.235.139
May 8, 2024 08:42:05.423260927 CEST	52062	21	192.168.2.16	38.239.154.176
May 8, 2024 08:42:05.423356056 CEST	52063	2121	192.168.2.16	38.207.205.17
May 8, 2024 08:42:05.429224014 CEST	2121	51960	1.227.238.87	192.168.2.16
May 8, 2024 08:42:05.442873955 CEST	51991	21	192.168.2.16	126.159.107.249
May 8, 2024 08:42:05.449101925 CEST	21	51962	1.227.238.87	192.168.2.16
May 8, 2024 08:42:05.453880072 CEST	51888	2121	192.168.2.16	201.130.140.23
May 8, 2024 08:42:05.453908920 CEST	52014	2121	192.168.2.16	73.151.35.77
May 8, 2024 08:42:05.463813066 CEST	21	51910	96.126.118.190	192.168.2.16
May 8, 2024 08:42:05.463989019 CEST	51910	21	192.168.2.16	96.126.118.190
May 8, 2024 08:42:05.469882965 CEST	51992	2121	192.168.2.16	126.159.107.249
May 8, 2024 08:42:05.469886065 CEST	51906	21	192.168.2.16	210.180.125.220
May 8, 2024 08:42:05.469912052 CEST	51907	2121	192.168.2.16	210.180.125.220
May 8, 2024 08:42:05.483704090 CEST	21	52046	34.149.79.8	192.168.2.16
May 8, 2024 08:42:05.483716965 CEST	21	52056	34.149.79.8	192.168.2.16
May 8, 2024 08:42:05.483800888 CEST	52056	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:05.490740061 CEST	21	51963	117.223.205.236	192.168.2.16
May 8, 2024 08:42:05.498409986 CEST	2121	52048	34.149.79.8	192.168.2.16
May 8, 2024 08:42:05.498424053 CEST	2121	52057	34.149.79.8	192.168.2.16
May 8, 2024 08:42:05.498496056 CEST	52057	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:05.502878904 CEST	21	52000	171.244.37.116	192.168.2.16
May 8, 2024 08:42:05.503009081 CEST	52000	21	192.168.2.16	171.244.37.116
May 8, 2024 08:42:05.503180981 CEST	52064	21	192.168.2.16	171.244.37.116
May 8, 2024 08:42:05.514877081 CEST	21	52043	84.44.255.254	192.168.2.16
May 8, 2024 08:42:05.514935970 CEST	52043	21	192.168.2.16	84.44.255.254
May 8, 2024 08:42:05.515017986 CEST	52043	21	192.168.2.16	84.44.255.254
May 8, 2024 08:42:05.515235901 CEST	52065	21	192.168.2.16	84.44.255.254
May 8, 2024 08:42:05.517353058 CEST	2121	51914	96.126.118.190	192.168.2.16
May 8, 2024 08:42:05.517472029 CEST	51914	2121	192.168.2.16	96.126.118.190
May 8, 2024 08:42:05.521583080 CEST	21	51881	105.68.251.211	192.168.2.16
May 8, 2024 08:42:05.531542063 CEST	2121	51898	218.158.89.232	192.168.2.16
May 8, 2024 08:42:05.542659998 CEST	21	51976	101.229.210.80	192.168.2.16
May 8, 2024 08:42:05.549920082 CEST	51912	2121	192.168.2.16	51.38.57.28
May 8, 2024 08:42:05.565884113 CEST	52017	2121	192.168.2.16	94.13.12.246
May 8, 2024 08:42:05.565900087 CEST	21	51969	81.21.231.72	192.168.2.16
May 8, 2024 08:42:05.565906048 CEST	52019	21	192.168.2.16	122.142.243.149
May 8, 2024 08:42:05.565906048 CEST	52020	2121	192.168.2.16	122.142.243.149
May 8, 2024 08:42:05.567876101 CEST	52018	21	192.168.2.16	94.13.12.246
May 8, 2024 08:42:05.578828096 CEST	2121	51977	101.229.210.80	192.168.2.16
May 8, 2024 08:42:05.581902027 CEST	52021	21	192.168.2.16	211.252.166.9
May 8, 2024 08:42:05.581991911 CEST	52022	2121	192.168.2.16	211.252.166.9
May 8, 2024 08:42:05.582734108 CEST	2121	51970	81.21.231.72	192.168.2.16
May 8, 2024 08:42:05.597896099 CEST	52026	2121	192.168.2.16	58.38.143.77
May 8, 2024 08:42:05.597902060 CEST	52029	21	192.168.2.16	177.30.55.192
May 8, 2024 08:42:05.597904921 CEST	52027	21	192.168.2.16	175.16.109.188
May 8, 2024 08:42:05.598505974 CEST	21	52049	172.120.235.139	192.168.2.16
May 8, 2024 08:42:05.598902941 CEST	21	52049	172.120.235.139	192.168.2.16
May 8, 2024 08:42:05.599065065 CEST	52049	21	192.168.2.16	172.120.235.139
May 8, 2024 08:42:05.599874973 CEST	52025	21	192.168.2.16	58.38.143.77
May 8, 2024 08:42:05.600039959 CEST	52028	2121	192.168.2.16	175.16.109.188
May 8, 2024 08:42:05.602168083 CEST	2121	51828	94.56.108.73	192.168.2.16
May 8, 2024 08:42:05.603105068 CEST	21	51923	66.217.151.0	192.168.2.16
May 8, 2024 08:42:05.603302002 CEST	2121	51924	66.217.151.0	192.168.2.16
May 8, 2024 08:42:05.605392933 CEST	21	52015	14.69.93.166	192.168.2.16
May 8, 2024 08:42:05.613883972 CEST	51925	21	192.168.2.16	60.139.52.99
May 8, 2024 08:42:05.613903999 CEST	52031	2121	192.168.2.16	58.50.254.97
May 8, 2024 08:42:05.613904953 CEST	52033	21	192.168.2.16	58.50.254.97
May 8, 2024 08:42:05.613909960 CEST	52032	21	192.168.2.16	95.57.82.213
May 8, 2024 08:42:05.613910913 CEST	52034	2121	192.168.2.16	95.57.82.213
May 8, 2024 08:42:05.613912106 CEST	52030	2121	192.168.2.16	177.30.55.192
May 8, 2024 08:42:05.614132881 CEST	52066	21	192.168.2.16	51.38.57.28
May 8, 2024 08:42:05.629885912 CEST	51926	2121	192.168.2.16	60.139.52.99
May 8, 2024 08:42:05.629899979 CEST	52036	2121	192.168.2.16	118.71.57.92
May 8, 2024 08:42:05.629900932 CEST	52037	21	192.168.2.16	80.180.201.221
May 8, 2024 08:42:05.629900932 CEST	52004	21	192.168.2.16	173.234.100.8
May 8, 2024 08:42:05.629911900 CEST	52039	21	192.168.2.16	119.113.76.216
May 8, 2024 08:42:05.629916906 CEST	52038	2121	192.168.2.16	80.180.201.221
May 8, 2024 08:42:05.629921913 CEST	52005	2121	192.168.2.16	173.234.100.8
May 8, 2024 08:42:05.630018950 CEST	52035	21	192.168.2.16	118.71.57.92
May 8, 2024 08:42:05.645899057 CEST	52040	2121	192.168.2.16	119.113.76.216
May 8, 2024 08:42:05.646033049 CEST	21	52056	34.149.79.8	192.168.2.16
May 8, 2024 08:42:05.646095037 CEST	52056	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:05.646147966 CEST	52056	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:05.646383047 CEST	52067	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:05.661824942 CEST	2121	52057	34.149.79.8	192.168.2.16
May 8, 2024 08:42:05.661931038 CEST	52057	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:05.662066936 CEST	52057	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:05.662357092 CEST	52068	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:05.662431002 CEST	52069	21	192.168.2.16	201.79.158.238
May 8, 2024 08:42:05.663959980 CEST	21	52055	120.24.160.35	192.168.2.16
May 8, 2024 08:42:05.664028883 CEST	52055	21	192.168.2.16	120.24.160.35
May 8, 2024 08:42:05.668240070 CEST	2121	52058	62.140.135.146	192.168.2.16
May 8, 2024 08:42:05.668313026 CEST	52058	2121	192.168.2.16	62.140.135.146
May 8, 2024 08:42:05.669575930 CEST	21	51910	96.126.118.190	192.168.2.16
May 8, 2024 08:42:05.669656038 CEST	21	51910	96.126.118.190	192.168.2.16
May 8, 2024 08:42:05.669785976 CEST	51910	21	192.168.2.16	96.126.118.190
May 8, 2024 08:42:05.671502113 CEST	2121	52016	14.69.93.166	192.168.2.16
May 8, 2024 08:42:05.678153038 CEST	52070	2121	192.168.2.16	201.79.158.238
May 8, 2024 08:42:05.690284967 CEST	2121	52023	60.134.194.144	192.168.2.16
May 8, 2024 08:42:05.690614939 CEST	21	52024	60.134.194.144	192.168.2.16
May 8, 2024 08:42:05.702908039 CEST	21	52059	62.140.135.146	192.168.2.16
May 8, 2024 08:42:05.702977896 CEST	52059	21	192.168.2.16	62.140.135.146
May 8, 2024 08:42:05.722769976 CEST	21	51829	94.56.108.73	192.168.2.16
May 8, 2024 08:42:05.723130941 CEST	2121	51914	96.126.118.190	192.168.2.16
May 8, 2024 08:42:05.723300934 CEST	2121	51914	96.126.118.190	192.168.2.16
May 8, 2024 08:42:05.723478079 CEST	51914	2121	192.168.2.16	96.126.118.190
May 8, 2024 08:42:05.724765062 CEST	21	52062	38.239.154.176	192.168.2.16
May 8, 2024 08:42:05.724829912 CEST	52062	21	192.168.2.16	38.239.154.176
May 8, 2024 08:42:05.741885900 CEST	51936	2121	192.168.2.16	124.54.226.49
May 8, 2024 08:42:05.741893053 CEST	52009	21	192.168.2.16	154.202.14.113
May 8, 2024 08:42:05.742172956 CEST	52071	21	192.168.2.16	223.239.112.208
May 8, 2024 08:42:05.744111061 CEST	21	51991	126.159.107.249	192.168.2.16
May 8, 2024 08:42:05.745892048 CEST	21	52061	46.34.34.117	192.168.2.16
May 8, 2024 08:42:05.745953083 CEST	52061	21	192.168.2.16	46.34.34.117
May 8, 2024 08:42:05.752315998 CEST	21	51899	196.210.0.111	192.168.2.16
May 8, 2024 08:42:05.752455950 CEST	51899	21	192.168.2.16	196.210.0.111
May 8, 2024 08:42:05.752605915 CEST	52072	21	192.168.2.16	196.210.0.111
May 8, 2024 08:42:05.771305084 CEST	2121	51907	210.180.125.220	192.168.2.16
May 8, 2024 08:42:05.771317005 CEST	2121	51992	126.159.107.249	192.168.2.16
May 8, 2024 08:42:05.772494078 CEST	21	51906	210.180.125.220	192.168.2.16
May 8, 2024 08:42:05.773910046 CEST	51889	21	192.168.2.16	218.158.89.232
May 8, 2024 08:42:05.773921967 CEST	51922	2121	192.168.2.16	123.232.178.226
May 8, 2024 08:42:05.773936987 CEST	51883	2121	192.168.2.16	105.68.251.211
May 8, 2024 08:42:05.802970886 CEST	21	52060	38.207.205.17	192.168.2.16
May 8, 2024 08:42:05.805529118 CEST	21	51952	218.32.108.110	192.168.2.16
May 8, 2024 08:42:05.805903912 CEST	52011	2121	192.168.2.16	154.202.14.113
May 8, 2024 08:42:05.806878090 CEST	51900	21	192.168.2.16	71.79.3.251
May 8, 2024 08:42:05.808248997 CEST	21	52056	34.149.79.8	192.168.2.16
May 8, 2024 08:42:05.808489084 CEST	21	52049	172.120.235.139	192.168.2.16
May 8, 2024 08:42:05.808649063 CEST	52049	21	192.168.2.16	172.120.235.139
May 8, 2024 08:42:05.808684111 CEST	21	52067	34.149.79.8	192.168.2.16
May 8, 2024 08:42:05.808742046 CEST	52067	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:05.808924913 CEST	52073	21	192.168.2.16	172.120.235.139
May 8, 2024 08:42:05.820110083 CEST	21	52004	173.234.100.8	192.168.2.16
May 8, 2024 08:42:05.822117090 CEST	2121	52005	173.234.100.8	192.168.2.16
May 8, 2024 08:42:05.823952913 CEST	2121	51954	218.32.108.110	192.168.2.16
May 8, 2024 08:42:05.824450970 CEST	2121	52057	34.149.79.8	192.168.2.16
May 8, 2024 08:42:05.824770927 CEST	2121	52068	34.149.79.8	192.168.2.16
May 8, 2024 08:42:05.824835062 CEST	52068	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:05.827600002 CEST	21	52065	84.44.255.254	192.168.2.16
May 8, 2024 08:42:05.827666044 CEST	52065	21	192.168.2.16	84.44.255.254
May 8, 2024 08:42:05.830980062 CEST	21	52043	84.44.255.254	192.168.2.16
May 8, 2024 08:42:05.838222027 CEST	51901	2121	192.168.2.16	71.79.3.251
May 8, 2024 08:42:05.854160070 CEST	21	52000	171.244.37.116	192.168.2.16
May 8, 2024 08:42:05.854186058 CEST	52074	2121	192.168.2.16	223.239.112.208
May 8, 2024 08:42:05.854418039 CEST	21	52000	171.244.37.116	192.168.2.16
May 8, 2024 08:42:05.854468107 CEST	52000	21	192.168.2.16	171.244.37.116
May 8, 2024 08:42:05.865967035 CEST	2121	51912	51.38.57.28	192.168.2.16
May 8, 2024 08:42:05.869916916 CEST	52006	21	192.168.2.16	60.120.31.113
May 8, 2024 08:42:05.872704029 CEST	21	52064	171.244.37.116	192.168.2.16
May 8, 2024 08:42:05.872782946 CEST	52064	21	192.168.2.16	171.244.37.116
May 8, 2024 08:42:05.875711918 CEST	21	51910	96.126.118.190	192.168.2.16
May 8, 2024 08:42:05.875875950 CEST	51910	21	192.168.2.16	96.126.118.190
May 8, 2024 08:42:05.885905981 CEST	52008	2121	192.168.2.16	60.120.31.113
May 8, 2024 08:42:05.886131048 CEST	52075	21	192.168.2.16	58.237.219.23
May 8, 2024 08:42:05.901900053 CEST	51902	21	192.168.2.16	182.92.22.163
May 8, 2024 08:42:05.902179956 CEST	52076	2121	192.168.2.16	58.237.219.23
May 8, 2024 08:42:05.915031910 CEST	21	51925	60.139.52.99	192.168.2.16
May 8, 2024 08:42:05.917892933 CEST	51903	2121	192.168.2.16	182.92.22.163
May 8, 2024 08:42:05.917964935 CEST	52044	21	192.168.2.16	20.194.55.18
May 8, 2024 08:42:05.917968988 CEST	52045	2121	192.168.2.16	20.194.55.18
May 8, 2024 08:42:05.918195009 CEST	52077	21	192.168.2.16	86.80.158.42
May 8, 2024 08:42:05.929572105 CEST	2121	51914	96.126.118.190	192.168.2.16
May 8, 2024 08:42:05.929763079 CEST	51914	2121	192.168.2.16	96.126.118.190
May 8, 2024 08:42:05.931574106 CEST	21	52066	51.38.57.28	192.168.2.16
May 8, 2024 08:42:05.931633949 CEST	52066	21	192.168.2.16	51.38.57.28
May 8, 2024 08:42:05.933902025 CEST	51960	2121	192.168.2.16	1.227.238.87
May 8, 2024 08:42:05.934700012 CEST	2121	51926	60.139.52.99	192.168.2.16
May 8, 2024 08:42:05.949913025 CEST	51962	21	192.168.2.16	1.227.238.87
May 8, 2024 08:42:05.968381882 CEST	21	52009	154.202.14.113	192.168.2.16
May 8, 2024 08:42:05.971214056 CEST	21	52067	34.149.79.8	192.168.2.16
May 8, 2024 08:42:05.971283913 CEST	52067	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:05.971349001 CEST	52067	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:05.971522093 CEST	52078	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:05.987349033 CEST	2121	52068	34.149.79.8	192.168.2.16
May 8, 2024 08:42:05.987407923 CEST	52068	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:05.987488985 CEST	52068	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:05.987711906 CEST	52079	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:05.990386963 CEST	21	52049	172.120.235.139	192.168.2.16
May 8, 2024 08:42:05.990449905 CEST	52049	21	192.168.2.16	172.120.235.139
May 8, 2024 08:42:05.990504026 CEST	21	52073	172.120.235.139	192.168.2.16
May 8, 2024 08:42:05.990565062 CEST	52073	21	192.168.2.16	172.120.235.139
May 8, 2024 08:42:05.998245001 CEST	52080	2121	192.168.2.16	86.80.158.42
May 8, 2024 08:42:06.005496025 CEST	21	51802	91.146.97.65	192.168.2.16
May 8, 2024 08:42:06.005552053 CEST	51802	21	192.168.2.16	91.146.97.65
May 8, 2024 08:42:06.013884068 CEST	52047	21	192.168.2.16	122.167.225.161
May 8, 2024 08:42:06.014292002 CEST	52081	2121	192.168.2.16	176.255.232.146
May 8, 2024 08:42:06.014364958 CEST	52082	21	192.168.2.16	176.255.232.146
May 8, 2024 08:42:06.019567966 CEST	21	52055	120.24.160.35	192.168.2.16
May 8, 2024 08:42:06.019716024 CEST	52055	21	192.168.2.16	120.24.160.35
May 8, 2024 08:42:06.026439905 CEST	21	52062	38.239.154.176	192.168.2.16
May 8, 2024 08:42:06.026552916 CEST	52062	21	192.168.2.16	38.239.154.176
May 8, 2024 08:42:06.029903889 CEST	51881	21	192.168.2.16	105.68.251.211
May 8, 2024 08:42:06.030337095 CEST	52083	21	192.168.2.16	217.76.115.138
May 8, 2024 08:42:06.032392979 CEST	2121	52011	154.202.14.113	192.168.2.16
May 8, 2024 08:42:06.045878887 CEST	51898	2121	192.168.2.16	218.158.89.232
May 8, 2024 08:42:06.045881987 CEST	52050	2121	192.168.2.16	122.167.225.161
May 8, 2024 08:42:06.046156883 CEST	51976	21	192.168.2.16	101.229.210.80
May 8, 2024 08:42:06.058907032 CEST	2121	51936	124.54.226.49	192.168.2.16
May 8, 2024 08:42:06.062339067 CEST	52084	21	192.168.2.16	174.171.111.75
May 8, 2024 08:42:06.062382936 CEST	52085	2121	192.168.2.16	217.76.115.138
May 8, 2024 08:42:06.077980042 CEST	51969	21	192.168.2.16	81.21.231.72
May 8, 2024 08:42:06.077980042 CEST	52051	21	192.168.2.16	83.33.136.192
May 8, 2024 08:42:06.081660986 CEST	21	51910	96.126.118.190	192.168.2.16
May 8, 2024 08:42:06.081844091 CEST	51910	21	192.168.2.16	96.126.118.190
May 8, 2024 08:42:06.088782072 CEST	21	51889	218.158.89.232	192.168.2.16
May 8, 2024 08:42:06.093889952 CEST	51977	2121	192.168.2.16	101.229.210.80
May 8, 2024 08:42:06.093905926 CEST	51970	2121	192.168.2.16	81.21.231.72
May 8, 2024 08:42:06.095967054 CEST	21	52061	46.34.34.117	192.168.2.16
May 8, 2024 08:42:06.096240044 CEST	52061	21	192.168.2.16	46.34.34.117
May 8, 2024 08:42:06.109883070 CEST	51924	2121	192.168.2.16	66.217.151.0
May 8, 2024 08:42:06.109915018 CEST	52015	21	192.168.2.16	14.69.93.166
May 8, 2024 08:42:06.109915018 CEST	51923	21	192.168.2.16	66.217.151.0
May 8, 2024 08:42:06.110110044 CEST	52086	2121	192.168.2.16	174.171.111.75
May 8, 2024 08:42:06.124069929 CEST	2121	51883	105.68.251.211	192.168.2.16
May 8, 2024 08:42:06.125888109 CEST	51916	2121	192.168.2.16	88.75.109.235
May 8, 2024 08:42:06.125919104 CEST	51915	21	192.168.2.16	88.75.109.235
May 8, 2024 08:42:06.125919104 CEST	51917	21	192.168.2.16	24.124.110.138
May 8, 2024 08:42:06.133747101 CEST	21	52067	34.149.79.8	192.168.2.16
May 8, 2024 08:42:06.133899927 CEST	21	52078	34.149.79.8	192.168.2.16
May 8, 2024 08:42:06.133964062 CEST	52078	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:06.135685921 CEST	2121	51914	96.126.118.190	192.168.2.16
May 8, 2024 08:42:06.135835886 CEST	51914	2121	192.168.2.16	96.126.118.190
May 8, 2024 08:42:06.140069962 CEST	21	52065	84.44.255.254	192.168.2.16
May 8, 2024 08:42:06.140131950 CEST	52065	21	192.168.2.16	84.44.255.254
May 8, 2024 08:42:06.140196085 CEST	52065	21	192.168.2.16	84.44.255.254
May 8, 2024 08:42:06.140431881 CEST	52087	21	192.168.2.16	84.44.255.254
May 8, 2024 08:42:06.141697884 CEST	2121	51922	123.232.178.226	192.168.2.16
May 8, 2024 08:42:06.142235041 CEST	52088	21	192.168.2.16	148.113.158.15
May 8, 2024 08:42:06.149960041 CEST	2121	52068	34.149.79.8	192.168.2.16
May 8, 2024 08:42:06.150079012 CEST	2121	52079	34.149.79.8	192.168.2.16
May 8, 2024 08:42:06.150139093 CEST	52079	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:06.157882929 CEST	51919	2121	192.168.2.16	119.71.5.164
May 8, 2024 08:42:06.157912970 CEST	51920	2121	192.168.2.16	24.124.110.138
May 8, 2024 08:42:06.157912016 CEST	51918	21	192.168.2.16	119.71.5.164
May 8, 2024 08:42:06.158060074 CEST	51921	21	192.168.2.16	123.232.178.226
May 8, 2024 08:42:06.173907995 CEST	52016	2121	192.168.2.16	14.69.93.166
May 8, 2024 08:42:06.176131964 CEST	21	52006	60.120.31.113	192.168.2.16
May 8, 2024 08:42:06.194663048 CEST	2121	52008	60.120.31.113	192.168.2.16
May 8, 2024 08:42:06.205887079 CEST	52023	2121	192.168.2.16	60.134.194.144
May 8, 2024 08:42:06.205887079 CEST	52052	2121	192.168.2.16	83.33.136.192
May 8, 2024 08:42:06.208868027 CEST	52024	21	192.168.2.16	60.134.194.144
May 8, 2024 08:42:06.212491989 CEST	21	52073	172.120.235.139	192.168.2.16
May 8, 2024 08:42:06.212639093 CEST	52073	21	192.168.2.16	172.120.235.139
May 8, 2024 08:42:06.221883059 CEST	51928	21	192.168.2.16	223.10.255.186
May 8, 2024 08:42:06.221885920 CEST	51927	2121	192.168.2.16	223.10.255.186
May 8, 2024 08:42:06.234503031 CEST	21	51899	196.210.0.111	192.168.2.16
May 8, 2024 08:42:06.234568119 CEST	51899	21	192.168.2.16	196.210.0.111
May 8, 2024 08:42:06.235841990 CEST	21	52072	196.210.0.111	192.168.2.16
May 8, 2024 08:42:06.235927105 CEST	52072	21	192.168.2.16	196.210.0.111
May 8, 2024 08:42:06.237895966 CEST	51930	2121	192.168.2.16	24.58.45.63
May 8, 2024 08:42:06.237895012 CEST	51929	21	192.168.2.16	24.58.45.63
May 8, 2024 08:42:06.237916946 CEST	52053	21	192.168.2.16	24.118.206.209
May 8, 2024 08:42:06.237919092 CEST	51931	21	192.168.2.16	186.210.130.138
May 8, 2024 08:42:06.242295980 CEST	21	52064	171.244.37.116	192.168.2.16
May 8, 2024 08:42:06.242429972 CEST	52064	21	192.168.2.16	171.244.37.116
May 8, 2024 08:42:06.243273020 CEST	2121	51960	1.227.238.87	192.168.2.16
May 8, 2024 08:42:06.249093056 CEST	21	52066	51.38.57.28	192.168.2.16
May 8, 2024 08:42:06.249255896 CEST	52066	21	192.168.2.16	51.38.57.28
May 8, 2024 08:42:06.253884077 CEST	51932	21	192.168.2.16	183.151.2.47
May 8, 2024 08:42:06.253885031 CEST	51991	21	192.168.2.16	126.159.107.249
May 8, 2024 08:42:06.253957987 CEST	51933	2121	192.168.2.16	186.210.130.138
May 8, 2024 08:42:06.261257887 CEST	21	51962	1.227.238.87	192.168.2.16
May 8, 2024 08:42:06.269891977 CEST	51934	2121	192.168.2.16	183.151.2.47
May 8, 2024 08:42:06.269915104 CEST	52054	2121	192.168.2.16	24.118.206.209
May 8, 2024 08:42:06.269915104 CEST	51935	21	192.168.2.16	124.54.226.49
May 8, 2024 08:42:06.285887003 CEST	51992	2121	192.168.2.16	126.159.107.249
May 8, 2024 08:42:06.285901070 CEST	51938	21	192.168.2.16	71.34.143.153
May 8, 2024 08:42:06.285902977 CEST	51907	2121	192.168.2.16	210.180.125.220
May 8, 2024 08:42:06.285914898 CEST	51906	21	192.168.2.16	210.180.125.220
May 8, 2024 08:42:06.285928011 CEST	51939	21	192.168.2.16	59.7.179.14
May 8, 2024 08:42:06.285933971 CEST	51937	2121	192.168.2.16	71.34.143.153
May 8, 2024 08:42:06.287647963 CEST	21	51910	96.126.118.190	192.168.2.16
May 8, 2024 08:42:06.287868977 CEST	51910	21	192.168.2.16	96.126.118.190
May 8, 2024 08:42:06.296395063 CEST	21	52078	34.149.79.8	192.168.2.16
May 8, 2024 08:42:06.296468019 CEST	52078	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:06.296525002 CEST	52078	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:06.296714067 CEST	52089	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:06.301904917 CEST	51940	2121	192.168.2.16	59.7.179.14
May 8, 2024 08:42:06.302259922 CEST	52090	2121	192.168.2.16	148.113.158.15
May 8, 2024 08:42:06.302261114 CEST	51941	21	192.168.2.16	189.152.150.132
May 8, 2024 08:42:06.312547922 CEST	2121	52079	34.149.79.8	192.168.2.16
May 8, 2024 08:42:06.312594891 CEST	52079	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:06.312681913 CEST	52079	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:06.312911987 CEST	52091	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:06.317882061 CEST	51943	21	192.168.2.16	104.4.88.110
May 8, 2024 08:42:06.317912102 CEST	51952	21	192.168.2.16	218.32.108.110
May 8, 2024 08:42:06.317912102 CEST	52060	21	192.168.2.16	38.207.205.17
May 8, 2024 08:42:06.318279982 CEST	51942	2121	192.168.2.16	189.152.150.132
May 8, 2024 08:42:06.326842070 CEST	21	52062	38.239.154.176	192.168.2.16
May 8, 2024 08:42:06.326857090 CEST	21	52062	38.239.154.176	192.168.2.16
May 8, 2024 08:42:06.326973915 CEST	52062	21	192.168.2.16	38.239.154.176
May 8, 2024 08:42:06.333897114 CEST	51954	2121	192.168.2.16	218.32.108.110
May 8, 2024 08:42:06.333914042 CEST	52004	21	192.168.2.16	173.234.100.8
May 8, 2024 08:42:06.333939075 CEST	51944	2121	192.168.2.16	104.4.88.110
May 8, 2024 08:42:06.333942890 CEST	52005	2121	192.168.2.16	173.234.100.8
May 8, 2024 08:42:06.337477922 CEST	2121	51924	66.217.151.0	192.168.2.16
May 8, 2024 08:42:06.337526083 CEST	21	51923	66.217.151.0	192.168.2.16
May 8, 2024 08:42:06.338293076 CEST	52093	2121	192.168.2.16	79.98.26.88
May 8, 2024 08:42:06.338305950 CEST	52092	21	192.168.2.16	79.98.26.88
May 8, 2024 08:42:06.341619968 CEST	2121	51914	96.126.118.190	192.168.2.16
May 8, 2024 08:42:06.341790915 CEST	51914	2121	192.168.2.16	96.126.118.190
May 8, 2024 08:42:06.354161978 CEST	21	51976	101.229.210.80	192.168.2.16
May 8, 2024 08:42:06.360423088 CEST	2121	51898	218.158.89.232	192.168.2.16
May 8, 2024 08:42:06.365900993 CEST	51945	21	192.168.2.16	102.64.165.88
May 8, 2024 08:42:06.366338968 CEST	52094	2121	192.168.2.16	219.157.139.143
May 8, 2024 08:42:06.366368055 CEST	52095	21	192.168.2.16	219.157.139.143
May 8, 2024 08:42:06.367523909 CEST	21	52055	120.24.160.35	192.168.2.16
May 8, 2024 08:42:06.367568016 CEST	21	52055	120.24.160.35	192.168.2.16
May 8, 2024 08:42:06.367679119 CEST	52055	21	192.168.2.16	120.24.160.35
May 8, 2024 08:42:06.373073101 CEST	21	52083	217.76.115.138	192.168.2.16
May 8, 2024 08:42:06.373143911 CEST	52083	21	192.168.2.16	217.76.115.138
May 8, 2024 08:42:06.377346039 CEST	21	52088	148.113.158.15	192.168.2.16
May 8, 2024 08:42:06.381922960 CEST	51912	2121	192.168.2.16	51.38.57.28
May 8, 2024 08:42:06.382400036 CEST	52096	21	192.168.2.16	219.254.64.131
May 8, 2024 08:42:06.385452986 CEST	21	51881	105.68.251.211	192.168.2.16
May 8, 2024 08:42:06.394746065 CEST	21	52073	172.120.235.139	192.168.2.16
May 8, 2024 08:42:06.395041943 CEST	21	52073	172.120.235.139	192.168.2.16
May 8, 2024 08:42:06.395184040 CEST	52073	21	192.168.2.16	172.120.235.139
May 8, 2024 08:42:06.397906065 CEST	51949	21	192.168.2.16	94.98.64.199
May 8, 2024 08:42:06.397907019 CEST	51948	2121	192.168.2.16	102.64.165.88
May 8, 2024 08:42:06.398094893 CEST	52097	2121	192.168.2.16	219.254.64.131
May 8, 2024 08:42:06.409507036 CEST	2121	51977	101.229.210.80	192.168.2.16
May 8, 2024 08:42:06.411545992 CEST	21	51969	81.21.231.72	192.168.2.16
May 8, 2024 08:42:06.413945913 CEST	51950	2121	192.168.2.16	94.98.64.199
May 8, 2024 08:42:06.429884911 CEST	51925	21	192.168.2.16	60.139.52.99
May 8, 2024 08:42:06.429897070 CEST	52063	2121	192.168.2.16	38.207.205.17
May 8, 2024 08:42:06.430083036 CEST	2121	51970	81.21.231.72	192.168.2.16
May 8, 2024 08:42:06.435051918 CEST	21	52061	46.34.34.117	192.168.2.16
May 8, 2024 08:42:06.435486078 CEST	21	52015	14.69.93.166	192.168.2.16
May 8, 2024 08:42:06.436611891 CEST	21	52061	46.34.34.117	192.168.2.16
May 8, 2024 08:42:06.436758041 CEST	52061	21	192.168.2.16	46.34.34.117
May 8, 2024 08:42:06.445050001 CEST	51955	2121	192.168.2.16	83.41.211.18
May 8, 2024 08:42:06.445879936 CEST	51953	21	192.168.2.16	83.41.211.18
May 8, 2024 08:42:06.445898056 CEST	51926	2121	192.168.2.16	60.139.52.99
May 8, 2024 08:42:06.452369928 CEST	21	52065	84.44.255.254	192.168.2.16
May 8, 2024 08:42:06.458818913 CEST	21	52089	34.149.79.8	192.168.2.16
May 8, 2024 08:42:06.458909035 CEST	52089	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:06.458929062 CEST	21	52078	34.149.79.8	192.168.2.16
May 8, 2024 08:42:06.460180044 CEST	21	52087	84.44.255.254	192.168.2.16
May 8, 2024 08:42:06.460241079 CEST	52087	21	192.168.2.16	84.44.255.254
May 8, 2024 08:42:06.461908102 CEST	51956	21	192.168.2.16	223.72.119.6
May 8, 2024 08:42:06.475013018 CEST	2121	52079	34.149.79.8	192.168.2.16
May 8, 2024 08:42:06.475317001 CEST	2121	52091	34.149.79.8	192.168.2.16
May 8, 2024 08:42:06.475368977 CEST	52091	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:06.477885008 CEST	52009	21	192.168.2.16	154.202.14.113
May 8, 2024 08:42:06.493766069 CEST	21	51910	96.126.118.190	192.168.2.16
May 8, 2024 08:42:06.493891954 CEST	51957	2121	192.168.2.16	223.72.119.6
May 8, 2024 08:42:06.493942976 CEST	51958	21	192.168.2.16	185.68.4.125
May 8, 2024 08:42:06.494376898 CEST	52099	21	192.168.2.16	123.190.23.158
May 8, 2024 08:42:06.495918989 CEST	21	51963	117.223.205.236	192.168.2.16
May 8, 2024 08:42:06.496071100 CEST	51963	21	192.168.2.16	117.223.205.236
May 8, 2024 08:42:06.496117115 CEST	2121	52016	14.69.93.166	192.168.2.16
May 8, 2024 08:42:06.496387959 CEST	52100	21	192.168.2.16	117.223.205.236
May 8, 2024 08:42:06.505333900 CEST	2121	52023	60.134.194.144	192.168.2.16
May 8, 2024 08:42:06.507642031 CEST	21	52024	60.134.194.144	192.168.2.16
May 8, 2024 08:42:06.509896040 CEST	51959	2121	192.168.2.16	185.68.4.125
May 8, 2024 08:42:06.509922028 CEST	51961	21	192.168.2.16	20.8.54.180
May 8, 2024 08:42:06.510188103 CEST	51910	21	192.168.2.16	96.126.118.190
May 8, 2024 08:42:06.510380030 CEST	52101	2121	192.168.2.16	123.190.23.158
May 8, 2024 08:42:06.524089098 CEST	21	52004	173.234.100.8	192.168.2.16
May 8, 2024 08:42:06.525917053 CEST	51964	2121	192.168.2.16	20.8.54.180
May 8, 2024 08:42:06.526184082 CEST	2121	52005	173.234.100.8	192.168.2.16
May 8, 2024 08:42:06.538058996 CEST	2121	52090	148.113.158.15	192.168.2.16
May 8, 2024 08:42:06.541887045 CEST	51965	21	192.168.2.16	171.240.26.242
May 8, 2024 08:42:06.541918039 CEST	51967	2121	192.168.2.16	171.240.26.242
May 8, 2024 08:42:06.541929960 CEST	52011	2121	192.168.2.16	154.202.14.113
May 8, 2024 08:42:06.547866106 CEST	2121	51914	96.126.118.190	192.168.2.16
May 8, 2024 08:42:06.548342943 CEST	51914	2121	192.168.2.16	96.126.118.190
May 8, 2024 08:42:06.552886009 CEST	51966	21	192.168.2.16	31.179.174.249
May 8, 2024 08:42:06.555692911 CEST	21	51991	126.159.107.249	192.168.2.16
May 8, 2024 08:42:06.557917118 CEST	51968	2121	192.168.2.16	31.179.174.249
May 8, 2024 08:42:06.566232920 CEST	21	52066	51.38.57.28	192.168.2.16
May 8, 2024 08:42:06.566267967 CEST	21	52066	51.38.57.28	192.168.2.16
May 8, 2024 08:42:06.566391945 CEST	52066	21	192.168.2.16	51.38.57.28
May 8, 2024 08:42:06.573895931 CEST	51936	2121	192.168.2.16	124.54.226.49
May 8, 2024 08:42:06.573896885 CEST	51973	21	192.168.2.16	190.51.17.139
May 8, 2024 08:42:06.573911905 CEST	51971	21	192.168.2.16	99.249.236.148
May 8, 2024 08:42:06.573925972 CEST	51972	2121	192.168.2.16	99.249.236.148
May 8, 2024 08:42:06.586699009 CEST	2121	51907	210.180.125.220	192.168.2.16
May 8, 2024 08:42:06.587199926 CEST	52103	21	192.168.2.16	181.97.152.233
May 8, 2024 08:42:06.587469101 CEST	2121	51992	126.159.107.249	192.168.2.16
May 8, 2024 08:42:06.588674068 CEST	21	51906	210.180.125.220	192.168.2.16
May 8, 2024 08:42:06.589894056 CEST	51974	2121	192.168.2.16	190.51.17.139
May 8, 2024 08:42:06.590346098 CEST	52104	2121	192.168.2.16	181.97.152.233
May 8, 2024 08:42:06.590373993 CEST	52105	21	192.168.2.16	38.60.203.180
May 8, 2024 08:42:06.605552912 CEST	21	52073	172.120.235.139	192.168.2.16
May 8, 2024 08:42:06.605707884 CEST	52073	21	192.168.2.16	172.120.235.139
May 8, 2024 08:42:06.605866909 CEST	52106	21	192.168.2.16	172.120.235.139
May 8, 2024 08:42:06.606408119 CEST	52107	2121	192.168.2.16	38.60.203.180
May 8, 2024 08:42:06.611879110 CEST	21	52064	171.244.37.116	192.168.2.16
May 8, 2024 08:42:06.612055063 CEST	52064	21	192.168.2.16	171.244.37.116
May 8, 2024 08:42:06.621220112 CEST	21	52089	34.149.79.8	192.168.2.16
May 8, 2024 08:42:06.621294022 CEST	52089	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:06.621347904 CEST	52089	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:06.621537924 CEST	52108	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:06.622329950 CEST	52109	21	192.168.2.16	83.52.138.245
May 8, 2024 08:42:06.622376919 CEST	52110	2121	192.168.2.16	83.52.138.245
May 8, 2024 08:42:06.635436058 CEST	21	52062	38.239.154.176	192.168.2.16
May 8, 2024 08:42:06.635567904 CEST	52062	21	192.168.2.16	38.239.154.176
May 8, 2024 08:42:06.635737896 CEST	52111	21	192.168.2.16	38.239.154.176
May 8, 2024 08:42:06.636153936 CEST	21	52062	38.239.154.176	192.168.2.16
May 8, 2024 08:42:06.636209965 CEST	52062	21	192.168.2.16	38.239.154.176
May 8, 2024 08:42:06.637844086 CEST	2121	52091	34.149.79.8	192.168.2.16
May 8, 2024 08:42:06.637909889 CEST	52091	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:06.637981892 CEST	52091	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:06.638194084 CEST	52112	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:06.653914928 CEST	51922	2121	192.168.2.16	123.232.178.226
May 8, 2024 08:42:06.655173063 CEST	51979	21	192.168.2.16	73.111.10.90
May 8, 2024 08:42:06.669903994 CEST	52069	21	192.168.2.16	201.79.158.238
May 8, 2024 08:42:06.669914961 CEST	51980	2121	192.168.2.16	73.111.10.90
May 8, 2024 08:42:06.673850060 CEST	2121	52093	79.98.26.88	192.168.2.16
May 8, 2024 08:42:06.674094915 CEST	21	52092	79.98.26.88	192.168.2.16
May 8, 2024 08:42:06.674182892 CEST	52092	21	192.168.2.16	79.98.26.88
May 8, 2024 08:42:06.685906887 CEST	51981	21	192.168.2.16	85.229.248.246
May 8, 2024 08:42:06.685919046 CEST	52006	21	192.168.2.16	60.120.31.113
May 8, 2024 08:42:06.692883968 CEST	52070	2121	192.168.2.16	201.79.158.238
May 8, 2024 08:42:06.697891951 CEST	2121	51912	51.38.57.28	192.168.2.16
May 8, 2024 08:42:06.701900959 CEST	51983	2121	192.168.2.16	85.229.248.246
May 8, 2024 08:42:06.702008009 CEST	52008	2121	192.168.2.16	60.120.31.113
May 8, 2024 08:42:06.704432964 CEST	21	52009	154.202.14.113	192.168.2.16
May 8, 2024 08:42:06.716197014 CEST	21	51910	96.126.118.190	192.168.2.16
May 8, 2024 08:42:06.716797113 CEST	51910	21	192.168.2.16	96.126.118.190
May 8, 2024 08:42:06.716811895 CEST	21	52083	217.76.115.138	192.168.2.16
May 8, 2024 08:42:06.716950893 CEST	52083	21	192.168.2.16	217.76.115.138
May 8, 2024 08:42:06.717185974 CEST	52114	21	192.168.2.16	91.212.27.173
May 8, 2024 08:42:06.718506098 CEST	52115	2121	192.168.2.16	91.212.27.173
May 8, 2024 08:42:06.731158018 CEST	21	51925	60.139.52.99	192.168.2.16
May 8, 2024 08:42:06.732918024 CEST	51985	21	192.168.2.16	41.228.35.66
May 8, 2024 08:42:06.733166933 CEST	52116	21	192.168.2.16	98.122.119.164
May 8, 2024 08:42:06.744570971 CEST	21	52072	196.210.0.111	192.168.2.16
May 8, 2024 08:42:06.744731903 CEST	52072	21	192.168.2.16	196.210.0.111
May 8, 2024 08:42:06.748610020 CEST	2121	51926	60.139.52.99	192.168.2.16
May 8, 2024 08:42:06.752043009 CEST	52071	21	192.168.2.16	223.239.112.208
May 8, 2024 08:42:06.752132893 CEST	51960	2121	192.168.2.16	1.227.238.87
May 8, 2024 08:42:06.752717018 CEST	52119	21	192.168.2.16	76.170.89.242
May 8, 2024 08:42:06.752774000 CEST	52118	2121	192.168.2.16	76.170.89.242
May 8, 2024 08:42:06.752774954 CEST	52120	21	192.168.2.16	176.253.150.191
May 8, 2024 08:42:06.752777100 CEST	52117	2121	192.168.2.16	98.122.119.164
May 8, 2024 08:42:06.756268978 CEST	2121	51914	96.126.118.190	192.168.2.16
May 8, 2024 08:42:06.756665945 CEST	51914	2121	192.168.2.16	96.126.118.190
May 8, 2024 08:42:06.763262033 CEST	21	52055	120.24.160.35	192.168.2.16
May 8, 2024 08:42:06.767909050 CEST	51962	21	192.168.2.16	1.227.238.87
May 8, 2024 08:42:06.769592047 CEST	2121	52011	154.202.14.113	192.168.2.16
May 8, 2024 08:42:06.769607067 CEST	21	51952	218.32.108.110	192.168.2.16
May 8, 2024 08:42:06.779875040 CEST	2121	51954	218.32.108.110	192.168.2.16
May 8, 2024 08:42:06.780061007 CEST	21	52087	84.44.255.254	192.168.2.16
May 8, 2024 08:42:06.780124903 CEST	52087	21	192.168.2.16	84.44.255.254
May 8, 2024 08:42:06.780186892 CEST	52087	21	192.168.2.16	84.44.255.254
May 8, 2024 08:42:06.780380964 CEST	52122	21	192.168.2.16	84.44.255.254
May 8, 2024 08:42:06.783121109 CEST	52123	2121	192.168.2.16	176.253.150.191
May 8, 2024 08:42:06.783476114 CEST	21	52089	34.149.79.8	192.168.2.16
May 8, 2024 08:42:06.783953905 CEST	21	52108	34.149.79.8	192.168.2.16
May 8, 2024 08:42:06.784020901 CEST	52108	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:06.787564039 CEST	21	52106	172.120.235.139	192.168.2.16
May 8, 2024 08:42:06.787641048 CEST	21	52073	172.120.235.139	192.168.2.16
May 8, 2024 08:42:06.787655115 CEST	52106	21	192.168.2.16	172.120.235.139
May 8, 2024 08:42:06.787693977 CEST	52073	21	192.168.2.16	172.120.235.139
May 8, 2024 08:42:06.798917055 CEST	51986	2121	192.168.2.16	41.228.35.66
May 8, 2024 08:42:06.799179077 CEST	52124	21	192.168.2.16	212.110.229.7
May 8, 2024 08:42:06.799207926 CEST	52125	2121	192.168.2.16	212.110.229.7
May 8, 2024 08:42:06.800348997 CEST	2121	52091	34.149.79.8	192.168.2.16
May 8, 2024 08:42:06.800363064 CEST	2121	52112	34.149.79.8	192.168.2.16
May 8, 2024 08:42:06.800436974 CEST	52112	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:06.811939955 CEST	21	52061	46.34.34.117	192.168.2.16
May 8, 2024 08:42:06.814884901 CEST	51988	21	192.168.2.16	211.201.27.47
May 8, 2024 08:42:06.814904928 CEST	51987	2121	192.168.2.16	211.201.27.47
May 8, 2024 08:42:06.831691980 CEST	52126	21	192.168.2.16	186.239.202.150
May 8, 2024 08:42:06.831815004 CEST	52127	2121	192.168.2.16	186.239.202.150
May 8, 2024 08:42:06.831829071 CEST	52128	21	192.168.2.16	94.214.147.214
May 8, 2024 08:42:06.846899986 CEST	51989	21	192.168.2.16	93.236.206.101
May 8, 2024 08:42:06.847582102 CEST	51990	2121	192.168.2.16	93.236.206.101
May 8, 2024 08:42:06.862188101 CEST	52129	2121	192.168.2.16	94.214.147.214
May 8, 2024 08:42:06.862190008 CEST	52074	2121	192.168.2.16	223.239.112.208
May 8, 2024 08:42:06.862216949 CEST	51976	21	192.168.2.16	101.229.210.80
May 8, 2024 08:42:06.877907991 CEST	52088	21	192.168.2.16	148.113.158.15
May 8, 2024 08:42:06.893229008 CEST	2121	51936	124.54.226.49	192.168.2.16
May 8, 2024 08:42:06.893688917 CEST	52130	21	192.168.2.16	36.150.121.139
May 8, 2024 08:42:06.893914938 CEST	51881	21	192.168.2.16	105.68.251.211
May 8, 2024 08:42:06.894021034 CEST	52075	21	192.168.2.16	58.237.219.23
May 8, 2024 08:42:06.909902096 CEST	52076	2121	192.168.2.16	58.237.219.23
May 8, 2024 08:42:06.921241045 CEST	21	52066	51.38.57.28	192.168.2.16
May 8, 2024 08:42:06.922909975 CEST	21	51910	96.126.118.190	192.168.2.16
May 8, 2024 08:42:06.923374891 CEST	51910	21	192.168.2.16	96.126.118.190
May 8, 2024 08:42:06.924885988 CEST	51969	21	192.168.2.16	81.21.231.72
May 8, 2024 08:42:06.924920082 CEST	51977	2121	192.168.2.16	101.229.210.80
May 8, 2024 08:42:06.925035954 CEST	52077	21	192.168.2.16	86.80.158.42
May 8, 2024 08:42:06.935828924 CEST	21	52062	38.239.154.176	192.168.2.16
May 8, 2024 08:42:06.941040039 CEST	51970	2121	192.168.2.16	81.21.231.72
May 8, 2024 08:42:06.941042900 CEST	52015	21	192.168.2.16	14.69.93.166
May 8, 2024 08:42:06.946625948 CEST	21	52108	34.149.79.8	192.168.2.16
May 8, 2024 08:42:06.946690083 CEST	52108	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:06.946748018 CEST	52108	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:06.946938992 CEST	52132	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:06.956902027 CEST	51993	21	192.168.2.16	37.69.31.161
May 8, 2024 08:42:06.957200050 CEST	52133	2121	192.168.2.16	36.150.121.139
May 8, 2024 08:42:06.957298994 CEST	21	52111	38.239.154.176	192.168.2.16
May 8, 2024 08:42:06.957381964 CEST	52111	21	192.168.2.16	38.239.154.176
May 8, 2024 08:42:06.962681055 CEST	2121	52112	34.149.79.8	192.168.2.16
May 8, 2024 08:42:06.962696075 CEST	2121	51914	96.126.118.190	192.168.2.16
May 8, 2024 08:42:06.962743044 CEST	52112	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:06.962937117 CEST	52112	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:06.963156939 CEST	51914	2121	192.168.2.16	96.126.118.190
May 8, 2024 08:42:06.963314056 CEST	52135	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:06.973187923 CEST	52136	21	192.168.2.16	51.124.217.197
May 8, 2024 08:42:06.985580921 CEST	21	52064	171.244.37.116	192.168.2.16
May 8, 2024 08:42:06.985775948 CEST	52064	21	192.168.2.16	171.244.37.116
May 8, 2024 08:42:06.986092091 CEST	52137	21	192.168.2.16	171.244.37.116
May 8, 2024 08:42:06.991461992 CEST	21	52006	60.120.31.113	192.168.2.16
May 8, 2024 08:42:07.004920006 CEST	52016	2121	192.168.2.16	14.69.93.166
May 8, 2024 08:42:07.004935026 CEST	52080	2121	192.168.2.16	86.80.158.42
May 8, 2024 08:42:07.004946947 CEST	52023	2121	192.168.2.16	60.134.194.144
May 8, 2024 08:42:07.005223989 CEST	52138	2121	192.168.2.16	51.124.217.197
May 8, 2024 08:42:07.007536888 CEST	2121	52008	60.120.31.113	192.168.2.16
May 8, 2024 08:42:07.011089087 CEST	21	52092	79.98.26.88	192.168.2.16
May 8, 2024 08:42:07.011217117 CEST	52092	21	192.168.2.16	79.98.26.88
May 8, 2024 08:42:07.011435986 CEST	21	52106	172.120.235.139	192.168.2.16
May 8, 2024 08:42:07.011476994 CEST	52139	21	192.168.2.16	84.151.162.29
May 8, 2024 08:42:07.011604071 CEST	52106	21	192.168.2.16	172.120.235.139
May 8, 2024 08:42:07.013439894 CEST	21	51963	117.223.205.236	192.168.2.16
May 8, 2024 08:42:07.013500929 CEST	51963	21	192.168.2.16	117.223.205.236
May 8, 2024 08:42:07.014125109 CEST	21	52100	117.223.205.236	192.168.2.16
May 8, 2024 08:42:07.014183998 CEST	52100	21	192.168.2.16	117.223.205.236
May 8, 2024 08:42:07.020900965 CEST	52081	2121	192.168.2.16	176.255.232.146
May 8, 2024 08:42:07.020903111 CEST	51995	2121	192.168.2.16	37.69.31.161
May 8, 2024 08:42:07.020911932 CEST	52082	21	192.168.2.16	176.255.232.146
May 8, 2024 08:42:07.020920038 CEST	52024	21	192.168.2.16	60.134.194.144
May 8, 2024 08:42:07.021224976 CEST	52140	2121	192.168.2.16	84.151.162.29
May 8, 2024 08:42:07.021399975 CEST	2121	51922	123.232.178.226	192.168.2.16
May 8, 2024 08:42:07.036896944 CEST	52004	21	192.168.2.16	173.234.100.8
May 8, 2024 08:42:07.036911964 CEST	52005	2121	192.168.2.16	173.234.100.8
May 8, 2024 08:42:07.037131071 CEST	52141	21	192.168.2.16	83.58.222.16
May 8, 2024 08:42:07.051898003 CEST	52090	2121	192.168.2.16	148.113.158.15
May 8, 2024 08:42:07.052489042 CEST	52142	2121	192.168.2.16	83.58.222.16
May 8, 2024 08:42:07.052563906 CEST	52143	21	192.168.2.16	209.38.228.218
May 8, 2024 08:42:07.059096098 CEST	21	52083	217.76.115.138	192.168.2.16
May 8, 2024 08:42:07.059163094 CEST	52083	21	192.168.2.16	217.76.115.138
May 8, 2024 08:42:07.059690952 CEST	21	52083	217.76.115.138	192.168.2.16
May 8, 2024 08:42:07.059739113 CEST	52083	21	192.168.2.16	217.76.115.138
May 8, 2024 08:42:07.063242912 CEST	2121	51960	1.227.238.87	192.168.2.16
May 8, 2024 08:42:07.067887068 CEST	51991	21	192.168.2.16	126.159.107.249
May 8, 2024 08:42:07.067922115 CEST	52085	2121	192.168.2.16	217.76.115.138
May 8, 2024 08:42:07.068021059 CEST	52084	21	192.168.2.16	174.171.111.75
May 8, 2024 08:42:07.068311930 CEST	52144	2121	192.168.2.16	209.38.228.218
May 8, 2024 08:42:07.068434000 CEST	52145	21	192.168.2.16	113.231.192.199
May 8, 2024 08:42:07.068464994 CEST	52146	2121	192.168.2.16	113.231.192.199
May 8, 2024 08:42:07.079353094 CEST	21	51962	1.227.238.87	192.168.2.16
May 8, 2024 08:42:07.079741955 CEST	52147	21	192.168.2.16	184.60.138.33
May 8, 2024 08:42:07.083923101 CEST	51998	21	192.168.2.16	68.83.54.183
May 8, 2024 08:42:07.084160089 CEST	52148	2121	192.168.2.16	184.60.138.33
May 8, 2024 08:42:07.096018076 CEST	21	52122	84.44.255.254	192.168.2.16
May 8, 2024 08:42:07.096086025 CEST	52122	21	192.168.2.16	84.44.255.254
May 8, 2024 08:42:07.099910021 CEST	51999	2121	192.168.2.16	68.83.54.183
May 8, 2024 08:42:07.099946976 CEST	21	52087	84.44.255.254	192.168.2.16
May 8, 2024 08:42:07.099977016 CEST	51992	2121	192.168.2.16	126.159.107.249
May 8, 2024 08:42:07.109194994 CEST	21	52108	34.149.79.8	192.168.2.16
May 8, 2024 08:42:07.109427929 CEST	21	52132	34.149.79.8	192.168.2.16
May 8, 2024 08:42:07.109497070 CEST	52132	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:07.112488985 CEST	21	52088	148.113.158.15	192.168.2.16
May 8, 2024 08:42:07.115916967 CEST	52086	2121	192.168.2.16	174.171.111.75
May 8, 2024 08:42:07.116185904 CEST	52149	21	192.168.2.16	115.46.86.127
May 8, 2024 08:42:07.125060081 CEST	2121	52112	34.149.79.8	192.168.2.16
May 8, 2024 08:42:07.125668049 CEST	2121	52135	34.149.79.8	192.168.2.16
May 8, 2024 08:42:07.125730991 CEST	52135	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:07.129153967 CEST	21	51910	96.126.118.190	192.168.2.16
May 8, 2024 08:42:07.129523039 CEST	51910	21	192.168.2.16	96.126.118.190
May 8, 2024 08:42:07.169852972 CEST	2121	51914	96.126.118.190	192.168.2.16
May 8, 2024 08:42:07.170238972 CEST	51914	2121	192.168.2.16	96.126.118.190
May 8, 2024 08:42:07.172476053 CEST	21	51976	101.229.210.80	192.168.2.16
May 8, 2024 08:42:07.178886890 CEST	52093	2121	192.168.2.16	79.98.26.88
May 8, 2024 08:42:07.193344116 CEST	21	52106	172.120.235.139	192.168.2.16
May 8, 2024 08:42:07.193701029 CEST	21	52106	172.120.235.139	192.168.2.16
May 8, 2024 08:42:07.193830013 CEST	52106	21	192.168.2.16	172.120.235.139
May 8, 2024 08:42:07.194482088 CEST	52152	21	192.168.2.16	65.141.220.74
May 8, 2024 08:42:07.194575071 CEST	52153	2121	192.168.2.16	115.46.86.127
May 8, 2024 08:42:07.194596052 CEST	52154	21	192.168.2.16	178.118.214.32
May 8, 2024 08:42:07.194626093 CEST	52155	2121	192.168.2.16	178.118.214.32
May 8, 2024 08:42:07.209996939 CEST	52009	21	192.168.2.16	154.202.14.113
May 8, 2024 08:42:07.210140944 CEST	52156	21	192.168.2.16	91.146.97.65
May 8, 2024 08:42:07.225909948 CEST	51802	21	192.168.2.16	91.146.97.65
May 8, 2024 08:42:07.227169037 CEST	21	52004	173.234.100.8	192.168.2.16
May 8, 2024 08:42:07.229212999 CEST	2121	52005	173.234.100.8	192.168.2.16
May 8, 2024 08:42:07.230422020 CEST	21	52072	196.210.0.111	192.168.2.16
May 8, 2024 08:42:07.230544090 CEST	21	52072	196.210.0.111	192.168.2.16
May 8, 2024 08:42:07.230654001 CEST	52072	21	192.168.2.16	196.210.0.111
May 8, 2024 08:42:07.235606909 CEST	2121	51977	101.229.210.80	192.168.2.16
May 8, 2024 08:42:07.241913080 CEST	52003	2121	192.168.2.16	197.26.33.147
May 8, 2024 08:42:07.242285967 CEST	52157	2121	192.168.2.16	65.141.220.74
May 8, 2024 08:42:07.242315054 CEST	52158	21	192.168.2.16	78.18.145.24
May 8, 2024 08:42:07.247267008 CEST	21	51881	105.68.251.211	192.168.2.16
May 8, 2024 08:42:07.257092953 CEST	52159	2121	192.168.2.16	78.18.145.24
May 8, 2024 08:42:07.258537054 CEST	21	51969	81.21.231.72	192.168.2.16
May 8, 2024 08:42:07.265902996 CEST	21	52015	14.69.93.166	192.168.2.16
May 8, 2024 08:42:07.271919012 CEST	51952	21	192.168.2.16	218.32.108.110
May 8, 2024 08:42:07.271919966 CEST	52011	2121	192.168.2.16	154.202.14.113
May 8, 2024 08:42:07.271989107 CEST	21	52132	34.149.79.8	192.168.2.16
May 8, 2024 08:42:07.272043943 CEST	52132	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:07.272519112 CEST	52132	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:07.272519112 CEST	52160	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:07.272597075 CEST	52161	21	192.168.2.16	217.82.62.148
May 8, 2024 08:42:07.272737026 CEST	52162	2121	192.168.2.16	217.82.62.148
May 8, 2024 08:42:07.274684906 CEST	2121	51970	81.21.231.72	192.168.2.16
May 8, 2024 08:42:07.274991989 CEST	52163	21	192.168.2.16	5.172.93.12
May 8, 2024 08:42:07.280268908 CEST	21	52111	38.239.154.176	192.168.2.16
May 8, 2024 08:42:07.280412912 CEST	52111	21	192.168.2.16	38.239.154.176
May 8, 2024 08:42:07.287709951 CEST	2121	52090	148.113.158.15	192.168.2.16
May 8, 2024 08:42:07.287882090 CEST	51954	2121	192.168.2.16	218.32.108.110
May 8, 2024 08:42:07.288109064 CEST	52164	2121	192.168.2.16	5.172.93.12
May 8, 2024 08:42:07.288125038 CEST	2121	52135	34.149.79.8	192.168.2.16
May 8, 2024 08:42:07.288178921 CEST	52135	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:07.288230896 CEST	52135	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:07.288393974 CEST	52165	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:07.304205894 CEST	52166	21	192.168.2.16	38.14.189.177
May 8, 2024 08:42:07.304295063 CEST	52167	2121	192.168.2.16	38.14.189.177
May 8, 2024 08:42:07.304646969 CEST	2121	52023	60.134.194.144	192.168.2.16
May 8, 2024 08:42:07.320842981 CEST	21	52024	60.134.194.144	192.168.2.16
May 8, 2024 08:42:07.326836109 CEST	2121	52016	14.69.93.166	192.168.2.16
May 8, 2024 08:42:07.335412979 CEST	21	51910	96.126.118.190	192.168.2.16
May 8, 2024 08:42:07.335911036 CEST	51910	21	192.168.2.16	96.126.118.190
May 8, 2024 08:42:07.337363005 CEST	21	52137	171.244.37.116	192.168.2.16
May 8, 2024 08:42:07.337443113 CEST	52137	21	192.168.2.16	171.244.37.116
May 8, 2024 08:42:07.346926928 CEST	21	52092	79.98.26.88	192.168.2.16
May 8, 2024 08:42:07.346992016 CEST	52092	21	192.168.2.16	79.98.26.88
May 8, 2024 08:42:07.347680092 CEST	21	52092	79.98.26.88	192.168.2.16
May 8, 2024 08:42:07.347727060 CEST	52092	21	192.168.2.16	79.98.26.88
May 8, 2024 08:42:07.356899977 CEST	21	52064	171.244.37.116	192.168.2.16
May 8, 2024 08:42:07.356909990 CEST	21	52064	171.244.37.116	192.168.2.16
May 8, 2024 08:42:07.356965065 CEST	52064	21	192.168.2.16	171.244.37.116
May 8, 2024 08:42:07.365885973 CEST	52013	21	192.168.2.16	73.151.35.77
May 8, 2024 08:42:07.365886927 CEST	52094	2121	192.168.2.16	219.157.139.143
May 8, 2024 08:42:07.369694948 CEST	21	51991	126.159.107.249	192.168.2.16
May 8, 2024 08:42:07.376950979 CEST	2121	51914	96.126.118.190	192.168.2.16
May 8, 2024 08:42:07.377397060 CEST	51914	2121	192.168.2.16	96.126.118.190
May 8, 2024 08:42:07.381884098 CEST	52095	21	192.168.2.16	219.157.139.143
May 8, 2024 08:42:07.382456064 CEST	52170	21	192.168.2.16	45.135.178.209
May 8, 2024 08:42:07.382457972 CEST	52096	21	192.168.2.16	219.254.64.131
May 8, 2024 08:42:07.382590055 CEST	52171	2121	192.168.2.16	45.135.178.209
May 8, 2024 08:42:07.393497944 CEST	21	52152	65.141.220.74	192.168.2.16
May 8, 2024 08:42:07.401348114 CEST	2121	51992	126.159.107.249	192.168.2.16
May 8, 2024 08:42:07.403976917 CEST	21	52106	172.120.235.139	192.168.2.16
May 8, 2024 08:42:07.404094934 CEST	52106	21	192.168.2.16	172.120.235.139
May 8, 2024 08:42:07.404254913 CEST	52172	21	192.168.2.16	172.120.235.139
May 8, 2024 08:42:07.411741018 CEST	21	52122	84.44.255.254	192.168.2.16
May 8, 2024 08:42:07.411797047 CEST	52122	21	192.168.2.16	84.44.255.254
May 8, 2024 08:42:07.411879063 CEST	52122	21	192.168.2.16	84.44.255.254
May 8, 2024 08:42:07.412096024 CEST	52173	21	192.168.2.16	84.44.255.254
May 8, 2024 08:42:07.412909031 CEST	52097	2121	192.168.2.16	219.254.64.131
May 8, 2024 08:42:07.413152933 CEST	52174	21	192.168.2.16	23.8.196.230
May 8, 2024 08:42:07.434911966 CEST	21	52160	34.149.79.8	192.168.2.16
May 8, 2024 08:42:07.434978962 CEST	52160	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:07.434979916 CEST	21	52132	34.149.79.8	192.168.2.16
May 8, 2024 08:42:07.436479092 CEST	21	52009	154.202.14.113	192.168.2.16
May 8, 2024 08:42:07.445116043 CEST	52175	2121	192.168.2.16	23.8.196.230
May 8, 2024 08:42:07.445491076 CEST	2121	52157	65.141.220.74	192.168.2.16
May 8, 2024 08:42:07.450582027 CEST	2121	52135	34.149.79.8	192.168.2.16
May 8, 2024 08:42:07.450773954 CEST	2121	52165	34.149.79.8	192.168.2.16
May 8, 2024 08:42:07.450831890 CEST	52165	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:07.459916115 CEST	52014	2121	192.168.2.16	73.151.35.77
May 8, 2024 08:42:07.460072994 CEST	52176	21	192.168.2.16	194.87.78.149
May 8, 2024 08:42:07.486823082 CEST	21	52166	38.14.189.177	192.168.2.16
May 8, 2024 08:42:07.486896038 CEST	52166	21	192.168.2.16	38.14.189.177
May 8, 2024 08:42:07.498581886 CEST	2121	52011	154.202.14.113	192.168.2.16
May 8, 2024 08:42:07.506896973 CEST	52006	21	192.168.2.16	60.120.31.113
May 8, 2024 08:42:07.506905079 CEST	52099	21	192.168.2.16	123.190.23.158
May 8, 2024 08:42:07.514403105 CEST	2121	52093	79.98.26.88	192.168.2.16
May 8, 2024 08:42:07.521734953 CEST	2121	52155	178.118.214.32	192.168.2.16
May 8, 2024 08:42:07.522910118 CEST	52008	2121	192.168.2.16	60.120.31.113
May 8, 2024 08:42:07.522912979 CEST	52101	2121	192.168.2.16	123.190.23.158
May 8, 2024 08:42:07.523266077 CEST	52177	2121	192.168.2.16	194.87.78.149
May 8, 2024 08:42:07.527630091 CEST	21	52100	117.223.205.236	192.168.2.16
May 8, 2024 08:42:07.527787924 CEST	52100	21	192.168.2.16	117.223.205.236
May 8, 2024 08:42:07.528115988 CEST	21	52154	178.118.214.32	192.168.2.16
May 8, 2024 08:42:07.541733980 CEST	21	51910	96.126.118.190	192.168.2.16
May 8, 2024 08:42:07.542152882 CEST	51910	21	192.168.2.16	96.126.118.190
May 8, 2024 08:42:07.570920944 CEST	52020	2121	192.168.2.16	122.142.243.149
May 8, 2024 08:42:07.570920944 CEST	52018	21	192.168.2.16	94.13.12.246
May 8, 2024 08:42:07.571006060 CEST	52017	2121	192.168.2.16	94.13.12.246
May 8, 2024 08:42:07.571547031 CEST	52019	21	192.168.2.16	122.142.243.149
May 8, 2024 08:42:07.583898067 CEST	2121	51914	96.126.118.190	192.168.2.16
May 8, 2024 08:42:07.584227085 CEST	51914	2121	192.168.2.16	96.126.118.190
May 8, 2024 08:42:07.586180925 CEST	21	52172	172.120.235.139	192.168.2.16
May 8, 2024 08:42:07.586193085 CEST	21	52106	172.120.235.139	192.168.2.16
May 8, 2024 08:42:07.586241007 CEST	52172	21	192.168.2.16	172.120.235.139
May 8, 2024 08:42:07.586267948 CEST	52106	21	192.168.2.16	172.120.235.139
May 8, 2024 08:42:07.586909056 CEST	52021	21	192.168.2.16	211.252.166.9
May 8, 2024 08:42:07.587042093 CEST	52022	2121	192.168.2.16	211.252.166.9
May 8, 2024 08:42:07.587141991 CEST	52103	21	192.168.2.16	181.97.152.233
May 8, 2024 08:42:07.597537994 CEST	21	52160	34.149.79.8	192.168.2.16
May 8, 2024 08:42:07.597583055 CEST	52160	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:07.597649097 CEST	52160	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:07.597827911 CEST	52180	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:07.602004051 CEST	21	52111	38.239.154.176	192.168.2.16
May 8, 2024 08:42:07.602062941 CEST	21	52111	38.239.154.176	192.168.2.16
May 8, 2024 08:42:07.602174044 CEST	52111	21	192.168.2.16	38.239.154.176
May 8, 2024 08:42:07.602874041 CEST	52105	21	192.168.2.16	38.60.203.180
May 8, 2024 08:42:07.602905035 CEST	52026	2121	192.168.2.16	58.38.143.77
May 8, 2024 08:42:07.602905989 CEST	52029	21	192.168.2.16	177.30.55.192
May 8, 2024 08:42:07.602906942 CEST	52104	2121	192.168.2.16	181.97.152.233
May 8, 2024 08:42:07.602906942 CEST	52025	21	192.168.2.16	58.38.143.77
May 8, 2024 08:42:07.603339911 CEST	52028	2121	192.168.2.16	175.16.109.188
May 8, 2024 08:42:07.603344917 CEST	52027	21	192.168.2.16	175.16.109.188
May 8, 2024 08:42:07.613356113 CEST	2121	52165	34.149.79.8	192.168.2.16
May 8, 2024 08:42:07.613401890 CEST	52165	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:07.613485098 CEST	52165	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:07.613707066 CEST	52181	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:07.618906975 CEST	52107	2121	192.168.2.16	38.60.203.180
May 8, 2024 08:42:07.618911028 CEST	52030	2121	192.168.2.16	177.30.55.192
May 8, 2024 08:42:07.618911982 CEST	52088	21	192.168.2.16	148.113.158.15
May 8, 2024 08:42:07.618920088 CEST	52032	21	192.168.2.16	95.57.82.213
May 8, 2024 08:42:07.618920088 CEST	52031	2121	192.168.2.16	58.50.254.97
May 8, 2024 08:42:07.618921041 CEST	52033	21	192.168.2.16	58.50.254.97
May 8, 2024 08:42:07.618923903 CEST	52034	2121	192.168.2.16	95.57.82.213
May 8, 2024 08:42:07.634879112 CEST	52110	2121	192.168.2.16	83.52.138.245
May 8, 2024 08:42:07.634890079 CEST	52109	21	192.168.2.16	83.52.138.245
May 8, 2024 08:42:07.634896040 CEST	52039	21	192.168.2.16	119.113.76.216
May 8, 2024 08:42:07.634898901 CEST	52036	2121	192.168.2.16	118.71.57.92
May 8, 2024 08:42:07.634902000 CEST	52038	2121	192.168.2.16	80.180.201.221
May 8, 2024 08:42:07.634905100 CEST	52035	21	192.168.2.16	118.71.57.92
May 8, 2024 08:42:07.639884949 CEST	52037	21	192.168.2.16	80.180.201.221
May 8, 2024 08:42:07.650897026 CEST	52040	2121	192.168.2.16	119.113.76.216
May 8, 2024 08:42:07.672169924 CEST	21	52166	38.14.189.177	192.168.2.16
May 8, 2024 08:42:07.672296047 CEST	52166	21	192.168.2.16	38.14.189.177
May 8, 2024 08:42:07.672493935 CEST	52182	21	192.168.2.16	86.144.51.124
May 8, 2024 08:42:07.688653946 CEST	21	52137	171.244.37.116	192.168.2.16
May 8, 2024 08:42:07.688879013 CEST	52137	21	192.168.2.16	171.244.37.116
May 8, 2024 08:42:07.695018053 CEST	21	52170	45.135.178.209	192.168.2.16
May 8, 2024 08:42:07.698710918 CEST	2121	52171	45.135.178.209	192.168.2.16
May 8, 2024 08:42:07.727396965 CEST	21	52122	84.44.255.254	192.168.2.16
May 8, 2024 08:42:07.728888988 CEST	52115	2121	192.168.2.16	91.212.27.173
May 8, 2024 08:42:07.728915930 CEST	52114	21	192.168.2.16	91.212.27.173
May 8, 2024 08:42:07.731679916 CEST	21	52173	84.44.255.254	192.168.2.16
May 8, 2024 08:42:07.731760025 CEST	52173	21	192.168.2.16	84.44.255.254
May 8, 2024 08:42:07.736601114 CEST	21	51952	218.32.108.110	192.168.2.16
May 8, 2024 08:42:07.743921041 CEST	52116	21	192.168.2.16	98.122.119.164
May 8, 2024 08:42:07.750591040 CEST	21	51910	96.126.118.190	192.168.2.16
May 8, 2024 08:42:07.750776052 CEST	51910	21	192.168.2.16	96.126.118.190
May 8, 2024 08:42:07.751269102 CEST	2121	51954	218.32.108.110	192.168.2.16
May 8, 2024 08:42:07.752228022 CEST	21	52072	196.210.0.111	192.168.2.16
May 8, 2024 08:42:07.759918928 CEST	52119	21	192.168.2.16	76.170.89.242
May 8, 2024 08:42:07.759922028 CEST	52118	2121	192.168.2.16	76.170.89.242
May 8, 2024 08:42:07.759922028 CEST	52117	2121	192.168.2.16	98.122.119.164
May 8, 2024 08:42:07.760133028 CEST	52120	21	192.168.2.16	176.253.150.191
May 8, 2024 08:42:07.760263920 CEST	52183	2121	192.168.2.16	86.144.51.124
May 8, 2024 08:42:07.761568069 CEST	21	52160	34.149.79.8	192.168.2.16
May 8, 2024 08:42:07.761985064 CEST	21	52180	34.149.79.8	192.168.2.16
May 8, 2024 08:42:07.762041092 CEST	52180	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:07.775825977 CEST	2121	52165	34.149.79.8	192.168.2.16
May 8, 2024 08:42:07.775899887 CEST	2121	52181	34.149.79.8	192.168.2.16
May 8, 2024 08:42:07.775902033 CEST	52015	21	192.168.2.16	14.69.93.166
May 8, 2024 08:42:07.775939941 CEST	21	52061	46.34.34.117	192.168.2.16
May 8, 2024 08:42:07.775949955 CEST	52181	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:07.776067019 CEST	52061	21	192.168.2.16	46.34.34.117
May 8, 2024 08:42:07.776237011 CEST	52184	21	192.168.2.16	73.100.139.198
May 8, 2024 08:42:07.776335001 CEST	52185	21	192.168.2.16	46.34.34.117
May 8, 2024 08:42:07.791685104 CEST	2121	51914	96.126.118.190	192.168.2.16
May 8, 2024 08:42:07.791805983 CEST	51914	2121	192.168.2.16	96.126.118.190
May 8, 2024 08:42:07.791886091 CEST	52090	2121	192.168.2.16	148.113.158.15
May 8, 2024 08:42:07.802881956 CEST	52123	2121	192.168.2.16	176.253.150.191
May 8, 2024 08:42:07.807806015 CEST	21	52172	172.120.235.139	192.168.2.16
May 8, 2024 08:42:07.807893991 CEST	52125	2121	192.168.2.16	212.110.229.7
May 8, 2024 08:42:07.807905912 CEST	52124	21	192.168.2.16	212.110.229.7
May 8, 2024 08:42:07.808032036 CEST	52172	21	192.168.2.16	172.120.235.139
May 8, 2024 08:42:07.808173895 CEST	52186	2121	192.168.2.16	73.100.139.198
May 8, 2024 08:42:07.808192015 CEST	52023	2121	192.168.2.16	60.134.194.144
May 8, 2024 08:42:07.812499046 CEST	21	52006	60.120.31.113	192.168.2.16
May 8, 2024 08:42:07.821419954 CEST	21	52176	194.87.78.149	192.168.2.16
May 8, 2024 08:42:07.823914051 CEST	52024	21	192.168.2.16	60.134.194.144
May 8, 2024 08:42:07.824328899 CEST	52187	21	192.168.2.16	52.151.5.213
May 8, 2024 08:42:07.829832077 CEST	2121	52008	60.120.31.113	192.168.2.16
May 8, 2024 08:42:07.839890957 CEST	52016	2121	192.168.2.16	14.69.93.166
May 8, 2024 08:42:07.840070009 CEST	52127	2121	192.168.2.16	186.239.202.150
May 8, 2024 08:42:07.840069056 CEST	52128	21	192.168.2.16	94.214.147.214
May 8, 2024 08:42:07.840070009 CEST	52126	21	192.168.2.16	186.239.202.150
May 8, 2024 08:42:07.840188026 CEST	52188	2121	192.168.2.16	52.151.5.213
May 8, 2024 08:42:07.854578972 CEST	21	52088	148.113.158.15	192.168.2.16
May 8, 2024 08:42:07.854686022 CEST	21	52166	38.14.189.177	192.168.2.16
May 8, 2024 08:42:07.854743004 CEST	52166	21	192.168.2.16	38.14.189.177
May 8, 2024 08:42:07.855154037 CEST	52189	21	192.168.2.16	116.78.34.142
May 8, 2024 08:42:07.855370998 CEST	21	52166	38.14.189.177	192.168.2.16
May 8, 2024 08:42:07.855415106 CEST	52166	21	192.168.2.16	38.14.189.177
May 8, 2024 08:42:07.871007919 CEST	52129	2121	192.168.2.16	94.214.147.214
May 8, 2024 08:42:07.884696960 CEST	2121	52177	194.87.78.149	192.168.2.16
May 8, 2024 08:42:07.901894093 CEST	52152	21	192.168.2.16	65.141.220.74
May 8, 2024 08:42:07.901915073 CEST	52130	21	192.168.2.16	36.150.121.139
May 8, 2024 08:42:07.902169943 CEST	52190	2121	192.168.2.16	116.78.34.142
May 8, 2024 08:42:07.917915106 CEST	52045	2121	192.168.2.16	20.194.55.18
May 8, 2024 08:42:07.918097019 CEST	52191	21	192.168.2.16	138.0.240.33
May 8, 2024 08:42:07.924751997 CEST	21	52180	34.149.79.8	192.168.2.16
May 8, 2024 08:42:07.924813032 CEST	52180	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:07.924875975 CEST	52180	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:07.925043106 CEST	52192	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:07.931374073 CEST	21	52111	38.239.154.176	192.168.2.16
May 8, 2024 08:42:07.931502104 CEST	52111	21	192.168.2.16	38.239.154.176
May 8, 2024 08:42:07.931689978 CEST	52193	21	192.168.2.16	38.239.154.176
May 8, 2024 08:42:07.932084084 CEST	21	52111	38.239.154.176	192.168.2.16
May 8, 2024 08:42:07.932123899 CEST	52111	21	192.168.2.16	38.239.154.176
May 8, 2024 08:42:07.933902979 CEST	52044	21	192.168.2.16	20.194.55.18
May 8, 2024 08:42:07.938183069 CEST	2121	52181	34.149.79.8	192.168.2.16
May 8, 2024 08:42:07.938235998 CEST	52181	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:07.938333988 CEST	52181	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:07.938555956 CEST	52194	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:07.939373970 CEST	21	51975	77.75.121.3	192.168.2.16
May 8, 2024 08:42:07.939515114 CEST	51975	21	192.168.2.16	77.75.121.3
May 8, 2024 08:42:07.939662933 CEST	52195	21	192.168.2.16	77.75.121.3
May 8, 2024 08:42:07.949894905 CEST	52157	2121	192.168.2.16	65.141.220.74
May 8, 2024 08:42:07.956641912 CEST	21	51910	96.126.118.190	192.168.2.16
May 8, 2024 08:42:07.957047939 CEST	51910	21	192.168.2.16	96.126.118.190
May 8, 2024 08:42:07.957221985 CEST	52197	21	192.168.2.16	96.126.118.190
May 8, 2024 08:42:07.965894938 CEST	52133	2121	192.168.2.16	36.150.121.139
May 8, 2024 08:42:07.981887102 CEST	52136	21	192.168.2.16	51.124.217.197
May 8, 2024 08:42:07.989737034 CEST	21	52172	172.120.235.139	192.168.2.16
May 8, 2024 08:42:07.990005970 CEST	21	52172	172.120.235.139	192.168.2.16
May 8, 2024 08:42:07.990125895 CEST	52172	21	192.168.2.16	172.120.235.139
May 8, 2024 08:42:07.997746944 CEST	2121	51914	96.126.118.190	192.168.2.16
May 8, 2024 08:42:07.998117924 CEST	51914	2121	192.168.2.16	96.126.118.190
May 8, 2024 08:42:07.998281002 CEST	52199	2121	192.168.2.16	96.126.118.190
May 8, 2024 08:42:08.012928963 CEST	52138	2121	192.168.2.16	51.124.217.197
May 8, 2024 08:42:08.016165972 CEST	52139	21	192.168.2.16	84.151.162.29
May 8, 2024 08:42:08.027851105 CEST	2121	52090	148.113.158.15	192.168.2.16
May 8, 2024 08:42:08.028915882 CEST	52093	2121	192.168.2.16	79.98.26.88
May 8, 2024 08:42:08.028914928 CEST	52047	21	192.168.2.16	122.167.225.161
May 8, 2024 08:42:08.028928995 CEST	52140	2121	192.168.2.16	84.151.162.29
May 8, 2024 08:42:08.028929949 CEST	52155	2121	192.168.2.16	178.118.214.32
May 8, 2024 08:42:08.029083967 CEST	52154	21	192.168.2.16	178.118.214.32
May 8, 2024 08:42:08.039772987 CEST	21	52137	171.244.37.116	192.168.2.16
May 8, 2024 08:42:08.039973974 CEST	52137	21	192.168.2.16	171.244.37.116
May 8, 2024 08:42:08.044939041 CEST	52141	21	192.168.2.16	83.58.222.16
May 8, 2024 08:42:08.051388979 CEST	21	52173	84.44.255.254	192.168.2.16
May 8, 2024 08:42:08.051456928 CEST	52173	21	192.168.2.16	84.44.255.254
May 8, 2024 08:42:08.051578999 CEST	52173	21	192.168.2.16	84.44.255.254
May 8, 2024 08:42:08.051902056 CEST	52200	21	192.168.2.16	84.44.255.254
May 8, 2024 08:42:08.057409048 CEST	21	52100	117.223.205.236	192.168.2.16
May 8, 2024 08:42:08.057423115 CEST	21	52100	117.223.205.236	192.168.2.16
May 8, 2024 08:42:08.057606936 CEST	52100	21	192.168.2.16	117.223.205.236
May 8, 2024 08:42:08.060930967 CEST	52050	2121	192.168.2.16	122.167.225.161
May 8, 2024 08:42:08.060933113 CEST	52143	21	192.168.2.16	209.38.228.218
May 8, 2024 08:42:08.060971975 CEST	52142	2121	192.168.2.16	83.58.222.16
May 8, 2024 08:42:08.076916933 CEST	52144	2121	192.168.2.16	209.38.228.218
May 8, 2024 08:42:08.076920033 CEST	52145	21	192.168.2.16	113.231.192.199
May 8, 2024 08:42:08.076925993 CEST	52146	2121	192.168.2.16	113.231.192.199
May 8, 2024 08:42:08.087250948 CEST	21	52192	34.149.79.8	192.168.2.16
May 8, 2024 08:42:08.087265015 CEST	21	52180	34.149.79.8	192.168.2.16
May 8, 2024 08:42:08.087356091 CEST	52192	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:08.092921019 CEST	52147	21	192.168.2.16	184.60.138.33
May 8, 2024 08:42:08.092921972 CEST	52148	2121	192.168.2.16	184.60.138.33
May 8, 2024 08:42:08.092921972 CEST	52051	21	192.168.2.16	83.33.136.192
May 8, 2024 08:42:08.100528002 CEST	2121	52181	34.149.79.8	192.168.2.16
May 8, 2024 08:42:08.100897074 CEST	2121	52194	34.149.79.8	192.168.2.16
May 8, 2024 08:42:08.100960016 CEST	52194	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:08.101176977 CEST	21	52015	14.69.93.166	192.168.2.16
May 8, 2024 08:42:08.101589918 CEST	52201	2121	192.168.2.16	138.0.240.33
May 8, 2024 08:42:08.101735115 CEST	21	52152	65.141.220.74	192.168.2.16
May 8, 2024 08:42:08.107722044 CEST	2121	52023	60.134.194.144	192.168.2.16
May 8, 2024 08:42:08.108239889 CEST	52202	21	192.168.2.16	171.106.156.251
May 8, 2024 08:42:08.115041971 CEST	21	52185	46.34.34.117	192.168.2.16
May 8, 2024 08:42:08.115108013 CEST	52185	21	192.168.2.16	46.34.34.117
May 8, 2024 08:42:08.120076895 CEST	21	52061	46.34.34.117	192.168.2.16
May 8, 2024 08:42:08.120136023 CEST	52061	21	192.168.2.16	46.34.34.117
May 8, 2024 08:42:08.124941111 CEST	52149	21	192.168.2.16	115.46.86.127
May 8, 2024 08:42:08.125516891 CEST	52203	2121	192.168.2.16	171.106.156.251
May 8, 2024 08:42:08.125607967 CEST	21	52024	60.134.194.144	192.168.2.16
May 8, 2024 08:42:08.125664949 CEST	52204	2121	192.168.2.16	5.53.240.249
May 8, 2024 08:42:08.125756979 CEST	52205	21	192.168.2.16	5.53.240.249
May 8, 2024 08:42:08.125967026 CEST	52206	21	192.168.2.16	35.239.238.170
May 8, 2024 08:42:08.140922070 CEST	51145	2121	192.168.2.16	62.140.135.146
May 8, 2024 08:42:08.140923023 CEST	51144	21	192.168.2.16	62.140.135.146
May 8, 2024 08:42:08.141015053 CEST	51891	21	192.168.2.16	23.229.188.101
May 8, 2024 08:42:08.141285896 CEST	52207	21	192.168.2.16	23.229.188.101
May 8, 2024 08:42:08.153022051 CEST	2121	52157	65.141.220.74	192.168.2.16
May 8, 2024 08:42:08.157855034 CEST	52208	2121	192.168.2.16	35.239.238.170
May 8, 2024 08:42:08.157881021 CEST	52209	21	192.168.2.16	187.252.207.89
May 8, 2024 08:42:08.157918930 CEST	52211	21	192.168.2.16	176.120.72.26
May 8, 2024 08:42:08.157918930 CEST	52210	2121	192.168.2.16	187.252.207.89
May 8, 2024 08:42:08.162590981 CEST	2121	52016	14.69.93.166	192.168.2.16
May 8, 2024 08:42:08.163544893 CEST	21	52197	96.126.118.190	192.168.2.16
May 8, 2024 08:42:08.163625956 CEST	52197	21	192.168.2.16	96.126.118.190
May 8, 2024 08:42:08.173362017 CEST	52212	2121	192.168.2.16	176.120.72.26
May 8, 2024 08:42:08.200018883 CEST	21	52172	172.120.235.139	192.168.2.16
May 8, 2024 08:42:08.200211048 CEST	52172	21	192.168.2.16	172.120.235.139
May 8, 2024 08:42:08.200472116 CEST	52213	21	192.168.2.16	172.120.235.139
May 8, 2024 08:42:08.204420090 CEST	21	51910	96.126.118.190	192.168.2.16
May 8, 2024 08:42:08.204436064 CEST	2121	52199	96.126.118.190	192.168.2.16
May 8, 2024 08:42:08.204510927 CEST	52199	2121	192.168.2.16	96.126.118.190
May 8, 2024 08:42:08.204911947 CEST	52170	21	192.168.2.16	45.135.178.209
May 8, 2024 08:42:08.204912901 CEST	52153	2121	192.168.2.16	115.46.86.127
May 8, 2024 08:42:08.204974890 CEST	52171	2121	192.168.2.16	45.135.178.209
May 8, 2024 08:42:08.207627058 CEST	52052	2121	192.168.2.16	83.33.136.192
May 8, 2024 08:42:08.221071959 CEST	52156	21	192.168.2.16	91.146.97.65
May 8, 2024 08:42:08.221426010 CEST	52214	21	192.168.2.16	104.231.204.135
May 8, 2024 08:42:08.221519947 CEST	52215	2121	192.168.2.16	104.231.204.135
May 8, 2024 08:42:08.236226082 CEST	21	52193	38.239.154.176	192.168.2.16
May 8, 2024 08:42:08.236320019 CEST	52193	21	192.168.2.16	38.239.154.176
May 8, 2024 08:42:08.236963034 CEST	52053	21	192.168.2.16	24.118.206.209
May 8, 2024 08:42:08.237500906 CEST	52216	21	192.168.2.16	81.104.120.112
May 8, 2024 08:42:08.237557888 CEST	52217	21	192.168.2.16	98.179.233.178
May 8, 2024 08:42:08.237560034 CEST	52218	2121	192.168.2.16	98.179.233.178
May 8, 2024 08:42:08.244529009 CEST	2121	51914	96.126.118.190	192.168.2.16
May 8, 2024 08:42:08.249588013 CEST	21	52192	34.149.79.8	192.168.2.16
May 8, 2024 08:42:08.249644995 CEST	52192	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:08.249711037 CEST	52192	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:08.249880075 CEST	52219	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:08.252938986 CEST	52158	21	192.168.2.16	78.18.145.24
May 8, 2024 08:42:08.253031969 CEST	21	52111	38.239.154.176	192.168.2.16
May 8, 2024 08:42:08.253204107 CEST	52220	2121	192.168.2.16	81.104.120.112
May 8, 2024 08:42:08.253406048 CEST	52221	21	192.168.2.16	189.105.117.208
May 8, 2024 08:42:08.255093098 CEST	21	52195	77.75.121.3	192.168.2.16
May 8, 2024 08:42:08.255151033 CEST	52195	21	192.168.2.16	77.75.121.3
May 8, 2024 08:42:08.255526066 CEST	21	51975	77.75.121.3	192.168.2.16
May 8, 2024 08:42:08.255584002 CEST	51975	21	192.168.2.16	77.75.121.3
May 8, 2024 08:42:08.255916119 CEST	21	51975	77.75.121.3	192.168.2.16
May 8, 2024 08:42:08.255965948 CEST	51975	21	192.168.2.16	77.75.121.3
May 8, 2024 08:42:08.263840914 CEST	2121	52194	34.149.79.8	192.168.2.16
May 8, 2024 08:42:08.263892889 CEST	52194	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:08.264014006 CEST	52194	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:08.264333963 CEST	52222	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:08.268919945 CEST	52159	2121	192.168.2.16	78.18.145.24
May 8, 2024 08:42:08.269332886 CEST	52223	2121	192.168.2.16	189.105.117.208
May 8, 2024 08:42:08.269399881 CEST	52224	21	192.168.2.16	73.201.234.25
May 8, 2024 08:42:08.284910917 CEST	52161	21	192.168.2.16	217.82.62.148
May 8, 2024 08:42:08.284934044 CEST	52054	2121	192.168.2.16	24.118.206.209
May 8, 2024 08:42:08.284934998 CEST	52162	2121	192.168.2.16	217.82.62.148
May 8, 2024 08:42:08.284971952 CEST	52163	21	192.168.2.16	5.172.93.12
May 8, 2024 08:42:08.285407066 CEST	52225	2121	192.168.2.16	85.7.181.109
May 8, 2024 08:42:08.285491943 CEST	52226	2121	192.168.2.16	73.201.234.25
May 8, 2024 08:42:08.285531998 CEST	52227	21	192.168.2.16	85.7.181.109
May 8, 2024 08:42:08.300906897 CEST	52164	2121	192.168.2.16	5.172.93.12
May 8, 2024 08:42:08.301213026 CEST	52228	21	192.168.2.16	76.185.49.230
May 8, 2024 08:42:08.301337957 CEST	52229	2121	192.168.2.16	76.185.49.230
May 8, 2024 08:42:08.315915108 CEST	52167	2121	192.168.2.16	38.14.189.177
May 8, 2024 08:42:08.316371918 CEST	52230	2121	192.168.2.16	118.48.36.223
May 8, 2024 08:42:08.316431046 CEST	52231	21	192.168.2.16	118.48.36.223
May 8, 2024 08:42:08.331897020 CEST	52060	21	192.168.2.16	38.207.205.17
May 8, 2024 08:42:08.332092047 CEST	52232	21	192.168.2.16	38.6.37.19
May 8, 2024 08:42:08.332093954 CEST	52176	21	192.168.2.16	194.87.78.149
May 8, 2024 08:42:08.339214087 CEST	21	52207	23.229.188.101	192.168.2.16
May 8, 2024 08:42:08.339301109 CEST	52207	21	192.168.2.16	23.229.188.101
May 8, 2024 08:42:08.353471994 CEST	2121	52155	178.118.214.32	192.168.2.16
May 8, 2024 08:42:08.361917973 CEST	21	52154	178.118.214.32	192.168.2.16
May 8, 2024 08:42:08.363897085 CEST	52088	21	192.168.2.16	148.113.158.15
May 8, 2024 08:42:08.364162922 CEST	21	52200	84.44.255.254	192.168.2.16
May 8, 2024 08:42:08.364222050 CEST	52200	21	192.168.2.16	84.44.255.254
May 8, 2024 08:42:08.364368916 CEST	52233	2121	192.168.2.16	38.6.37.19
May 8, 2024 08:42:08.364377022 CEST	2121	52093	79.98.26.88	192.168.2.16
May 8, 2024 08:42:08.371043921 CEST	21	52173	84.44.255.254	192.168.2.16
May 8, 2024 08:42:08.382103920 CEST	21	52172	172.120.235.139	192.168.2.16
May 8, 2024 08:42:08.382132053 CEST	21	52213	172.120.235.139	192.168.2.16
May 8, 2024 08:42:08.382181883 CEST	52172	21	192.168.2.16	172.120.235.139
May 8, 2024 08:42:08.382240057 CEST	52213	21	192.168.2.16	172.120.235.139
May 8, 2024 08:42:08.385263920 CEST	21	51891	23.229.188.101	192.168.2.16
May 8, 2024 08:42:08.393205881 CEST	21	52137	171.244.37.116	192.168.2.16
May 8, 2024 08:42:08.393357992 CEST	52137	21	192.168.2.16	171.244.37.116
May 8, 2024 08:42:08.393640041 CEST	52234	21	192.168.2.16	171.244.37.116
May 8, 2024 08:42:08.395931005 CEST	52177	2121	192.168.2.16	194.87.78.149
May 8, 2024 08:42:08.396429062 CEST	52235	21	192.168.2.16	99.229.51.22
May 8, 2024 08:42:08.396431923 CEST	52236	2121	192.168.2.16	99.229.51.22
May 8, 2024 08:42:08.411793947 CEST	21	52192	34.149.79.8	192.168.2.16
May 8, 2024 08:42:08.412262917 CEST	52237	21	192.168.2.16	76.136.205.151
May 8, 2024 08:42:08.412288904 CEST	21	52219	34.149.79.8	192.168.2.16
May 8, 2024 08:42:08.412353992 CEST	52219	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:08.426326990 CEST	2121	52194	34.149.79.8	192.168.2.16
May 8, 2024 08:42:08.426422119 CEST	2121	52222	34.149.79.8	192.168.2.16
May 8, 2024 08:42:08.426481962 CEST	52222	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:08.427913904 CEST	52174	21	192.168.2.16	23.8.196.230
May 8, 2024 08:42:08.443919897 CEST	52063	2121	192.168.2.16	38.207.205.17
May 8, 2024 08:42:08.444327116 CEST	52238	21	192.168.2.16	116.39.121.211
May 8, 2024 08:42:08.444403887 CEST	52239	2121	192.168.2.16	76.136.205.151
May 8, 2024 08:42:08.459891081 CEST	52175	2121	192.168.2.16	23.8.196.230
May 8, 2024 08:42:08.460360050 CEST	52240	2121	192.168.2.16	116.39.121.211
May 8, 2024 08:42:08.472786903 CEST	21	52185	46.34.34.117	192.168.2.16
May 8, 2024 08:42:08.473001957 CEST	52185	21	192.168.2.16	46.34.34.117
May 8, 2024 08:42:08.492604017 CEST	52241	21	192.168.2.16	178.118.142.181
May 8, 2024 08:42:08.492647886 CEST	52242	2121	192.168.2.16	178.118.142.181
May 8, 2024 08:42:08.508622885 CEST	52243	21	192.168.2.16	153.142.206.60
May 8, 2024 08:42:08.508727074 CEST	52244	2121	192.168.2.16	153.142.206.60
May 8, 2024 08:42:08.518461943 CEST	21	52170	45.135.178.209	192.168.2.16
May 8, 2024 08:42:08.522538900 CEST	2121	52171	45.135.178.209	192.168.2.16
May 8, 2024 08:42:08.524300098 CEST	52245	21	192.168.2.16	174.113.104.133
May 8, 2024 08:42:08.537952900 CEST	21	52207	23.229.188.101	192.168.2.16
May 8, 2024 08:42:08.538265944 CEST	52207	21	192.168.2.16	23.229.188.101
May 8, 2024 08:42:08.538590908 CEST	21	52193	38.239.154.176	192.168.2.16
May 8, 2024 08:42:08.538706064 CEST	52193	21	192.168.2.16	38.239.154.176
May 8, 2024 08:42:08.539917946 CEST	52090	2121	192.168.2.16	148.113.158.15
May 8, 2024 08:42:08.540441990 CEST	52246	2121	192.168.2.16	174.113.104.133
May 8, 2024 08:42:08.540494919 CEST	52248	2121	192.168.2.16	93.162.245.45
May 8, 2024 08:42:08.540496111 CEST	52247	21	192.168.2.16	93.162.245.45
May 8, 2024 08:42:08.556252956 CEST	52249	21	192.168.2.16	2.60.202.145
May 8, 2024 08:42:08.561738968 CEST	21	52100	117.223.205.236	192.168.2.16
May 8, 2024 08:42:08.572573900 CEST	52250	2121	192.168.2.16	2.60.202.145
May 8, 2024 08:42:08.572596073 CEST	52251	21	192.168.2.16	201.88.197.211
May 8, 2024 08:42:08.572654963 CEST	52252	2121	192.168.2.16	201.88.197.211
May 8, 2024 08:42:08.574457884 CEST	21	52195	77.75.121.3	192.168.2.16
May 8, 2024 08:42:08.574649096 CEST	52195	21	192.168.2.16	77.75.121.3
May 8, 2024 08:42:08.577769041 CEST	21	52219	34.149.79.8	192.168.2.16
May 8, 2024 08:42:08.577830076 CEST	52219	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:08.577903032 CEST	52219	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:08.578119040 CEST	52253	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:08.588349104 CEST	52254	21	192.168.2.16	92.116.148.136
May 8, 2024 08:42:08.588937998 CEST	2121	52222	34.149.79.8	192.168.2.16
May 8, 2024 08:42:08.588987112 CEST	52222	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:08.589068890 CEST	52222	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:08.589263916 CEST	52255	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:08.598680973 CEST	21	52088	148.113.158.15	192.168.2.16
May 8, 2024 08:42:08.606343985 CEST	21	52213	172.120.235.139	192.168.2.16
May 8, 2024 08:42:08.606533051 CEST	52213	21	192.168.2.16	172.120.235.139
May 8, 2024 08:42:08.614888906 CEST	52152	21	192.168.2.16	65.141.220.74
May 8, 2024 08:42:08.615158081 CEST	21	51135	96.126.118.190	192.168.2.16
May 8, 2024 08:42:08.615170002 CEST	2121	51137	96.126.118.190	192.168.2.16
May 8, 2024 08:42:08.615211964 CEST	51135	21	192.168.2.16	96.126.118.190
May 8, 2024 08:42:08.615480900 CEST	51137	2121	192.168.2.16	96.126.118.190
May 8, 2024 08:42:08.631198883 CEST	2121	52230	118.48.36.223	192.168.2.16
May 8, 2024 08:42:08.635725021 CEST	21	52232	38.6.37.19	192.168.2.16
May 8, 2024 08:42:08.640852928 CEST	21	52231	118.48.36.223	192.168.2.16
May 8, 2024 08:42:08.652461052 CEST	52256	2121	192.168.2.16	92.116.148.136
May 8, 2024 08:42:08.666611910 CEST	2121	52233	38.6.37.19	192.168.2.16
May 8, 2024 08:42:08.667893887 CEST	52157	2121	192.168.2.16	65.141.220.74
May 8, 2024 08:42:08.668194056 CEST	52257	21	192.168.2.16	142.11.215.85
May 8, 2024 08:42:08.676542044 CEST	21	52200	84.44.255.254	192.168.2.16
May 8, 2024 08:42:08.676618099 CEST	52200	21	192.168.2.16	84.44.255.254
May 8, 2024 08:42:08.676742077 CEST	52200	21	192.168.2.16	84.44.255.254
May 8, 2024 08:42:08.677031994 CEST	52258	21	192.168.2.16	84.44.255.254
May 8, 2024 08:42:08.683922052 CEST	52182	21	192.168.2.16	86.144.51.124
May 8, 2024 08:42:08.684267998 CEST	52259	2121	192.168.2.16	142.11.215.85
May 8, 2024 08:42:08.689905882 CEST	52069	21	192.168.2.16	201.79.158.238
May 8, 2024 08:42:08.692842960 CEST	21	52176	194.87.78.149	192.168.2.16
May 8, 2024 08:42:08.699920893 CEST	52070	2121	192.168.2.16	201.79.158.238
May 8, 2024 08:42:08.700269938 CEST	52260	21	192.168.2.16	192.241.123.5
May 8, 2024 08:42:08.716420889 CEST	52261	2121	192.168.2.16	192.241.123.5
May 8, 2024 08:42:08.718705893 CEST	21	52072	196.210.0.111	192.168.2.16
May 8, 2024 08:42:08.719618082 CEST	52072	21	192.168.2.16	196.210.0.111
May 8, 2024 08:42:08.719837904 CEST	52262	21	192.168.2.16	196.210.0.111
May 8, 2024 08:42:08.733599901 CEST	21	52207	23.229.188.101	192.168.2.16
May 8, 2024 08:42:08.733614922 CEST	21	52207	23.229.188.101	192.168.2.16
May 8, 2024 08:42:08.733792067 CEST	52207	21	192.168.2.16	23.229.188.101
May 8, 2024 08:42:08.740341902 CEST	21	52219	34.149.79.8	192.168.2.16
May 8, 2024 08:42:08.740515947 CEST	21	52253	34.149.79.8	192.168.2.16
May 8, 2024 08:42:08.740583897 CEST	52253	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:08.744134903 CEST	21	52137	171.244.37.116	192.168.2.16
May 8, 2024 08:42:08.744148016 CEST	21	52137	171.244.37.116	192.168.2.16
May 8, 2024 08:42:08.744191885 CEST	52137	21	192.168.2.16	171.244.37.116
May 8, 2024 08:42:08.751167059 CEST	2121	52222	34.149.79.8	192.168.2.16
May 8, 2024 08:42:08.751553059 CEST	2121	52255	34.149.79.8	192.168.2.16
May 8, 2024 08:42:08.751857996 CEST	52255	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:08.757025957 CEST	2121	52177	194.87.78.149	192.168.2.16
May 8, 2024 08:42:08.757863998 CEST	21	52234	171.244.37.116	192.168.2.16
May 8, 2024 08:42:08.757925987 CEST	52234	21	192.168.2.16	171.244.37.116
May 8, 2024 08:42:08.763895035 CEST	52071	21	192.168.2.16	223.239.112.208
May 8, 2024 08:42:08.763906002 CEST	52183	2121	192.168.2.16	86.144.51.124
May 8, 2024 08:42:08.775751114 CEST	2121	52090	148.113.158.15	192.168.2.16
May 8, 2024 08:42:08.779907942 CEST	52184	21	192.168.2.16	73.100.139.198
May 8, 2024 08:42:08.789767981 CEST	21	52213	172.120.235.139	192.168.2.16
May 8, 2024 08:42:08.790194035 CEST	21	52213	172.120.235.139	192.168.2.16
May 8, 2024 08:42:08.790328979 CEST	52213	21	192.168.2.16	172.120.235.139
May 8, 2024 08:42:08.796308994 CEST	52263	21	192.168.2.16	94.13.187.158
May 8, 2024 08:42:08.800209045 CEST	21	52243	153.142.206.60	192.168.2.16
May 8, 2024 08:42:08.811628103 CEST	21	52185	46.34.34.117	192.168.2.16
May 8, 2024 08:42:08.811642885 CEST	21	52185	46.34.34.117	192.168.2.16
May 8, 2024 08:42:08.811816931 CEST	52185	21	192.168.2.16	46.34.34.117
May 8, 2024 08:42:08.811947107 CEST	52186	2121	192.168.2.16	73.100.139.198
May 8, 2024 08:42:08.812274933 CEST	52264	2121	192.168.2.16	94.13.187.158
May 8, 2024 08:42:08.812340021 CEST	52265	21	192.168.2.16	126.217.92.175
May 8, 2024 08:42:08.813743114 CEST	21	52152	65.141.220.74	192.168.2.16
May 8, 2024 08:42:08.827912092 CEST	52187	21	192.168.2.16	52.151.5.213
May 8, 2024 08:42:08.828433037 CEST	52266	2121	192.168.2.16	126.217.92.175
May 8, 2024 08:42:08.828547001 CEST	52267	21	192.168.2.16	113.109.212.89
May 8, 2024 08:42:08.839464903 CEST	21	52193	38.239.154.176	192.168.2.16
May 8, 2024 08:42:08.839584112 CEST	21	52193	38.239.154.176	192.168.2.16
May 8, 2024 08:42:08.839699984 CEST	52193	21	192.168.2.16	38.239.154.176
May 8, 2024 08:42:08.843907118 CEST	52188	2121	192.168.2.16	52.151.5.213
May 8, 2024 08:42:08.859899044 CEST	52189	21	192.168.2.16	116.78.34.142
May 8, 2024 08:42:08.861952066 CEST	52155	2121	192.168.2.16	178.118.214.32
May 8, 2024 08:42:08.871515036 CEST	2121	52157	65.141.220.74	192.168.2.16
May 8, 2024 08:42:08.875893116 CEST	52093	2121	192.168.2.16	79.98.26.88
May 8, 2024 08:42:08.875916958 CEST	52074	2121	192.168.2.16	223.239.112.208
May 8, 2024 08:42:08.875921011 CEST	52154	21	192.168.2.16	178.118.214.32
May 8, 2024 08:42:08.877758980 CEST	21	52257	142.11.215.85	192.168.2.16
May 8, 2024 08:42:08.877845049 CEST	52257	21	192.168.2.16	142.11.215.85
May 8, 2024 08:42:08.890024900 CEST	21	52195	77.75.121.3	192.168.2.16
May 8, 2024 08:42:08.890074015 CEST	21	52195	77.75.121.3	192.168.2.16
May 8, 2024 08:42:08.890201092 CEST	52195	21	192.168.2.16	77.75.121.3
May 8, 2024 08:42:08.903103113 CEST	21	52253	34.149.79.8	192.168.2.16
May 8, 2024 08:42:08.903172016 CEST	52253	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:08.903225899 CEST	52253	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:08.903435946 CEST	52268	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:08.911889076 CEST	52075	21	192.168.2.16	58.237.219.23
May 8, 2024 08:42:08.912127972 CEST	52190	2121	192.168.2.16	116.78.34.142
May 8, 2024 08:42:08.914297104 CEST	2121	52255	34.149.79.8	192.168.2.16
May 8, 2024 08:42:08.914346933 CEST	52255	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:08.914483070 CEST	52255	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:08.914763927 CEST	52269	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:08.923913002 CEST	52076	2121	192.168.2.16	58.237.219.23
May 8, 2024 08:42:08.925062895 CEST	52191	21	192.168.2.16	138.0.240.33
May 8, 2024 08:42:08.938910007 CEST	52077	21	192.168.2.16	86.80.158.42
May 8, 2024 08:42:08.949790955 CEST	21	51891	23.229.188.101	192.168.2.16
May 8, 2024 08:42:08.949856997 CEST	51891	21	192.168.2.16	23.229.188.101
May 8, 2024 08:42:08.949892044 CEST	21	51891	23.229.188.101	192.168.2.16
May 8, 2024 08:42:08.949934006 CEST	51891	21	192.168.2.16	23.229.188.101
May 8, 2024 08:42:08.950596094 CEST	21	51891	23.229.188.101	192.168.2.16
May 8, 2024 08:42:08.950635910 CEST	51891	21	192.168.2.16	23.229.188.101
May 8, 2024 08:42:08.955193996 CEST	52270	2121	192.168.2.16	113.109.212.89
May 8, 2024 08:42:08.969559908 CEST	21	52207	23.229.188.101	192.168.2.16
May 8, 2024 08:42:08.989320993 CEST	21	52200	84.44.255.254	192.168.2.16
May 8, 2024 08:42:08.996896029 CEST	21	52258	84.44.255.254	192.168.2.16
May 8, 2024 08:42:08.996990919 CEST	52258	21	192.168.2.16	84.44.255.254
May 8, 2024 08:42:09.001739025 CEST	21	52213	172.120.235.139	192.168.2.16
May 8, 2024 08:42:09.001949072 CEST	52213	21	192.168.2.16	172.120.235.139
May 8, 2024 08:42:09.002177000 CEST	52271	21	192.168.2.16	172.120.235.139
May 8, 2024 08:42:09.017890930 CEST	52080	2121	192.168.2.16	86.80.158.42
May 8, 2024 08:42:09.018258095 CEST	52272	21	192.168.2.16	151.197.204.59
May 8, 2024 08:42:09.033920050 CEST	52082	21	192.168.2.16	176.255.232.146
May 8, 2024 08:42:09.033941031 CEST	52081	2121	192.168.2.16	176.255.232.146
May 8, 2024 08:42:09.033962965 CEST	52170	21	192.168.2.16	45.135.178.209
May 8, 2024 08:42:09.033965111 CEST	52171	2121	192.168.2.16	45.135.178.209
May 8, 2024 08:42:09.065619946 CEST	21	52253	34.149.79.8	192.168.2.16
May 8, 2024 08:42:09.065797091 CEST	21	52268	34.149.79.8	192.168.2.16
May 8, 2024 08:42:09.065880060 CEST	52268	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:09.076865911 CEST	2121	52255	34.149.79.8	192.168.2.16
May 8, 2024 08:42:09.076921940 CEST	2121	52269	34.149.79.8	192.168.2.16
May 8, 2024 08:42:09.076977968 CEST	52269	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:09.081902981 CEST	52084	21	192.168.2.16	174.171.111.75
May 8, 2024 08:42:09.081916094 CEST	52085	2121	192.168.2.16	217.76.115.138
May 8, 2024 08:42:09.082479954 CEST	52273	2121	192.168.2.16	151.197.204.59
May 8, 2024 08:42:09.087521076 CEST	21	52257	142.11.215.85	192.168.2.16
May 8, 2024 08:42:09.087641954 CEST	52257	21	192.168.2.16	142.11.215.85
May 8, 2024 08:42:09.087867975 CEST	52274	21	192.168.2.16	14.90.138.213
May 8, 2024 08:42:09.098248959 CEST	52275	2121	192.168.2.16	14.90.138.213
May 8, 2024 08:42:09.112164974 CEST	21	52265	126.217.92.175	192.168.2.16
May 8, 2024 08:42:09.113929987 CEST	52202	21	192.168.2.16	171.106.156.251
May 8, 2024 08:42:09.113938093 CEST	52088	21	192.168.2.16	148.113.158.15
May 8, 2024 08:42:09.114012003 CEST	52201	2121	192.168.2.16	138.0.240.33
May 8, 2024 08:42:09.122993946 CEST	21	52234	171.244.37.116	192.168.2.16
May 8, 2024 08:42:09.123143911 CEST	52234	21	192.168.2.16	171.244.37.116
May 8, 2024 08:42:09.128865957 CEST	2121	52266	126.217.92.175	192.168.2.16
May 8, 2024 08:42:09.129905939 CEST	52204	2121	192.168.2.16	5.53.240.249
May 8, 2024 08:42:09.129924059 CEST	52086	2121	192.168.2.16	174.171.111.75
May 8, 2024 08:42:09.129926920 CEST	52203	2121	192.168.2.16	171.106.156.251
May 8, 2024 08:42:09.131694078 CEST	52205	21	192.168.2.16	5.53.240.249
May 8, 2024 08:42:09.131695032 CEST	52206	21	192.168.2.16	35.239.238.170
May 8, 2024 08:42:09.142313957 CEST	21	52193	38.239.154.176	192.168.2.16
May 8, 2024 08:42:09.142496109 CEST	52193	21	192.168.2.16	38.239.154.176
May 8, 2024 08:42:09.142715931 CEST	52276	21	192.168.2.16	38.239.154.176
May 8, 2024 08:42:09.143079042 CEST	21	52193	38.239.154.176	192.168.2.16
May 8, 2024 08:42:09.143129110 CEST	52193	21	192.168.2.16	38.239.154.176
May 8, 2024 08:42:09.145895958 CEST	52230	2121	192.168.2.16	118.48.36.223
May 8, 2024 08:42:09.145901918 CEST	52232	21	192.168.2.16	38.6.37.19
May 8, 2024 08:42:09.146011114 CEST	52231	21	192.168.2.16	118.48.36.223
May 8, 2024 08:42:09.161910057 CEST	52209	21	192.168.2.16	187.252.207.89
May 8, 2024 08:42:09.161911964 CEST	52208	2121	192.168.2.16	35.239.238.170
May 8, 2024 08:42:09.162805080 CEST	52211	21	192.168.2.16	176.120.72.26
May 8, 2024 08:42:09.162805080 CEST	52210	2121	192.168.2.16	187.252.207.89
May 8, 2024 08:42:09.177922010 CEST	52233	2121	192.168.2.16	38.6.37.19
May 8, 2024 08:42:09.178294897 CEST	52212	2121	192.168.2.16	176.120.72.26
May 8, 2024 08:42:09.183702946 CEST	21	52213	172.120.235.139	192.168.2.16
May 8, 2024 08:42:09.183782101 CEST	52213	21	192.168.2.16	172.120.235.139
May 8, 2024 08:42:09.183887005 CEST	21	52271	172.120.235.139	192.168.2.16
May 8, 2024 08:42:09.183953047 CEST	52271	21	192.168.2.16	172.120.235.139
May 8, 2024 08:42:09.184794903 CEST	21	52185	46.34.34.117	192.168.2.16
May 8, 2024 08:42:09.187388897 CEST	2121	52155	178.118.214.32	192.168.2.16
May 8, 2024 08:42:09.193906069 CEST	52176	21	192.168.2.16	194.87.78.149
May 8, 2024 08:42:09.199942112 CEST	21	52154	178.118.214.32	192.168.2.16
May 8, 2024 08:42:09.202691078 CEST	21	52262	196.210.0.111	192.168.2.16
May 8, 2024 08:42:09.202769995 CEST	52262	21	192.168.2.16	196.210.0.111
May 8, 2024 08:42:09.203418970 CEST	21	52072	196.210.0.111	192.168.2.16
May 8, 2024 08:42:09.203471899 CEST	52072	21	192.168.2.16	196.210.0.111
May 8, 2024 08:42:09.211338043 CEST	2121	52093	79.98.26.88	192.168.2.16
May 8, 2024 08:42:09.225907087 CEST	52214	21	192.168.2.16	104.231.204.135
May 8, 2024 08:42:09.225922108 CEST	52215	2121	192.168.2.16	104.231.204.135
May 8, 2024 08:42:09.226264954 CEST	52277	21	192.168.2.16	80.234.15.119
May 8, 2024 08:42:09.228511095 CEST	21	52268	34.149.79.8	192.168.2.16
May 8, 2024 08:42:09.228569031 CEST	52268	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:09.228645086 CEST	52268	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:09.228859901 CEST	52278	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:09.239726067 CEST	2121	52269	34.149.79.8	192.168.2.16
May 8, 2024 08:42:09.239784002 CEST	52269	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:09.239882946 CEST	52269	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:09.240098000 CEST	52279	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:09.241911888 CEST	52217	21	192.168.2.16	98.179.233.178
May 8, 2024 08:42:09.241920948 CEST	52218	2121	192.168.2.16	98.179.233.178
May 8, 2024 08:42:09.242249966 CEST	52216	21	192.168.2.16	81.104.120.112
May 8, 2024 08:42:09.244889975 CEST	21	52195	77.75.121.3	192.168.2.16
May 8, 2024 08:42:09.257900953 CEST	52221	21	192.168.2.16	189.105.117.208
May 8, 2024 08:42:09.257922888 CEST	52220	2121	192.168.2.16	81.104.120.112
May 8, 2024 08:42:09.257941008 CEST	52177	2121	192.168.2.16	194.87.78.149
May 8, 2024 08:42:09.272911072 CEST	52223	2121	192.168.2.16	189.105.117.208
May 8, 2024 08:42:09.272953987 CEST	52224	21	192.168.2.16	73.201.234.25
May 8, 2024 08:42:09.288891077 CEST	52225	2121	192.168.2.16	85.7.181.109
May 8, 2024 08:42:09.288892984 CEST	52090	2121	192.168.2.16	148.113.158.15
May 8, 2024 08:42:09.294034958 CEST	52226	2121	192.168.2.16	73.201.234.25
May 8, 2024 08:42:09.294034958 CEST	52227	21	192.168.2.16	85.7.181.109
May 8, 2024 08:42:09.296365023 CEST	21	52257	142.11.215.85	192.168.2.16
May 8, 2024 08:42:09.296471119 CEST	21	52257	142.11.215.85	192.168.2.16
May 8, 2024 08:42:09.296535969 CEST	52257	21	192.168.2.16	142.11.215.85
May 8, 2024 08:42:09.304898977 CEST	52243	21	192.168.2.16	153.142.206.60
May 8, 2024 08:42:09.304920912 CEST	52228	21	192.168.2.16	76.185.49.230
May 8, 2024 08:42:09.304951906 CEST	52229	2121	192.168.2.16	76.185.49.230
May 8, 2024 08:42:09.316531897 CEST	21	52258	84.44.255.254	192.168.2.16
May 8, 2024 08:42:09.316605091 CEST	52258	21	192.168.2.16	84.44.255.254
May 8, 2024 08:42:09.316786051 CEST	52258	21	192.168.2.16	84.44.255.254
May 8, 2024 08:42:09.317176104 CEST	52280	21	192.168.2.16	84.44.255.254
May 8, 2024 08:42:09.320911884 CEST	52152	21	192.168.2.16	65.141.220.74
May 8, 2024 08:42:09.346658945 CEST	21	52170	45.135.178.209	192.168.2.16
May 8, 2024 08:42:09.348512888 CEST	21	52088	148.113.158.15	192.168.2.16
May 8, 2024 08:42:09.350039959 CEST	2121	52171	45.135.178.209	192.168.2.16
May 8, 2024 08:42:09.368941069 CEST	52094	2121	192.168.2.16	219.157.139.143
May 8, 2024 08:42:09.369424105 CEST	52281	2121	192.168.2.16	80.234.15.119
May 8, 2024 08:42:09.369539976 CEST	52282	21	192.168.2.16	76.31.14.147
May 8, 2024 08:42:09.384927034 CEST	52157	2121	192.168.2.16	65.141.220.74
May 8, 2024 08:42:09.384939909 CEST	52095	21	192.168.2.16	219.157.139.143
May 8, 2024 08:42:09.384943008 CEST	52096	21	192.168.2.16	219.254.64.131
May 8, 2024 08:42:09.391024113 CEST	21	52268	34.149.79.8	192.168.2.16
May 8, 2024 08:42:09.391184092 CEST	21	52278	34.149.79.8	192.168.2.16
May 8, 2024 08:42:09.391264915 CEST	52278	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:09.400921106 CEST	52235	21	192.168.2.16	99.229.51.22
May 8, 2024 08:42:09.400927067 CEST	52236	2121	192.168.2.16	99.229.51.22
May 8, 2024 08:42:09.402221918 CEST	2121	52269	34.149.79.8	192.168.2.16
May 8, 2024 08:42:09.402324915 CEST	2121	52279	34.149.79.8	192.168.2.16
May 8, 2024 08:42:09.402400017 CEST	52279	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:09.404736042 CEST	21	52274	14.90.138.213	192.168.2.16
May 8, 2024 08:42:09.407219887 CEST	21	52271	172.120.235.139	192.168.2.16
May 8, 2024 08:42:09.407337904 CEST	52271	21	192.168.2.16	172.120.235.139
May 8, 2024 08:42:09.416914940 CEST	52097	2121	192.168.2.16	219.254.64.131
May 8, 2024 08:42:09.417382002 CEST	2121	52275	14.90.138.213	192.168.2.16
May 8, 2024 08:42:09.417423964 CEST	52237	21	192.168.2.16	76.136.205.151
May 8, 2024 08:42:09.443522930 CEST	21	52193	38.239.154.176	192.168.2.16
May 8, 2024 08:42:09.443851948 CEST	21	52276	38.239.154.176	192.168.2.16
May 8, 2024 08:42:09.443919897 CEST	52276	21	192.168.2.16	38.239.154.176
May 8, 2024 08:42:09.448919058 CEST	52238	21	192.168.2.16	116.39.121.211
May 8, 2024 08:42:09.449590921 CEST	52239	2121	192.168.2.16	76.136.205.151
May 8, 2024 08:42:09.449739933 CEST	21	52232	38.6.37.19	192.168.2.16
May 8, 2024 08:42:09.462569952 CEST	2121	52230	118.48.36.223	192.168.2.16
May 8, 2024 08:42:09.463923931 CEST	52240	2121	192.168.2.16	116.39.121.211
May 8, 2024 08:42:09.464250088 CEST	52283	2121	192.168.2.16	76.31.14.147
May 8, 2024 08:42:09.471285105 CEST	21	52231	118.48.36.223	192.168.2.16
May 8, 2024 08:42:09.482266903 CEST	2121	52233	38.6.37.19	192.168.2.16
May 8, 2024 08:42:09.488296032 CEST	21	52234	171.244.37.116	192.168.2.16
May 8, 2024 08:42:09.488457918 CEST	52234	21	192.168.2.16	171.244.37.116
May 8, 2024 08:42:09.495913982 CEST	52242	2121	192.168.2.16	178.118.142.181
May 8, 2024 08:42:09.496026993 CEST	52241	21	192.168.2.16	178.118.142.181
May 8, 2024 08:42:09.511914015 CEST	52099	21	192.168.2.16	123.190.23.158
May 8, 2024 08:42:09.511955976 CEST	52244	2121	192.168.2.16	153.142.206.60
May 8, 2024 08:42:09.519790888 CEST	21	52152	65.141.220.74	192.168.2.16
May 8, 2024 08:42:09.524729013 CEST	2121	52090	148.113.158.15	192.168.2.16
May 8, 2024 08:42:09.527925014 CEST	52101	2121	192.168.2.16	123.190.23.158
May 8, 2024 08:42:09.528028011 CEST	52245	21	192.168.2.16	174.113.104.133
May 8, 2024 08:42:09.543895960 CEST	52248	2121	192.168.2.16	93.162.245.45
May 8, 2024 08:42:09.543915033 CEST	52246	2121	192.168.2.16	174.113.104.133
May 8, 2024 08:42:09.543915987 CEST	52247	21	192.168.2.16	93.162.245.45
May 8, 2024 08:42:09.544238091 CEST	52284	21	192.168.2.16	109.193.13.3
May 8, 2024 08:42:09.553796053 CEST	21	52278	34.149.79.8	192.168.2.16
May 8, 2024 08:42:09.553859949 CEST	52278	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:09.553942919 CEST	52278	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:09.554172993 CEST	52285	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:09.554733038 CEST	21	52176	194.87.78.149	192.168.2.16
May 8, 2024 08:42:09.559942007 CEST	52249	21	192.168.2.16	2.60.202.145
May 8, 2024 08:42:09.564457893 CEST	21	52100	117.223.205.236	192.168.2.16
May 8, 2024 08:42:09.564620972 CEST	52100	21	192.168.2.16	117.223.205.236
May 8, 2024 08:42:09.564702988 CEST	2121	52279	34.149.79.8	192.168.2.16
May 8, 2024 08:42:09.564754009 CEST	52279	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:09.564855099 CEST	52279	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:09.564913988 CEST	52286	21	192.168.2.16	117.223.205.236
May 8, 2024 08:42:09.565079927 CEST	52287	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:09.575886965 CEST	52252	2121	192.168.2.16	201.88.197.211
May 8, 2024 08:42:09.575921059 CEST	52250	2121	192.168.2.16	2.60.202.145
May 8, 2024 08:42:09.576028109 CEST	52251	21	192.168.2.16	201.88.197.211
May 8, 2024 08:42:09.576473951 CEST	52288	2121	192.168.2.16	109.193.13.3
May 8, 2024 08:42:09.576625109 CEST	52289	21	192.168.2.16	94.208.110.104
May 8, 2024 08:42:09.576657057 CEST	52290	2121	192.168.2.16	94.208.110.104
May 8, 2024 08:42:09.576745033 CEST	52291	21	192.168.2.16	174.80.147.247
May 8, 2024 08:42:09.588558912 CEST	2121	52157	65.141.220.74	192.168.2.16
May 8, 2024 08:42:09.588992119 CEST	21	52271	172.120.235.139	192.168.2.16
May 8, 2024 08:42:09.589322090 CEST	21	52271	172.120.235.139	192.168.2.16
May 8, 2024 08:42:09.589478016 CEST	52271	21	192.168.2.16	172.120.235.139
May 8, 2024 08:42:09.591906071 CEST	52254	21	192.168.2.16	92.116.148.136
May 8, 2024 08:42:09.591957092 CEST	51994	21	192.168.2.16	38.38.120.85
May 8, 2024 08:42:09.592073917 CEST	52103	21	192.168.2.16	181.97.152.233
May 8, 2024 08:42:09.592391014 CEST	52292	21	192.168.2.16	38.38.120.85
May 8, 2024 08:42:09.592619896 CEST	52293	2121	192.168.2.16	174.80.147.247
May 8, 2024 08:42:09.592701912 CEST	52294	21	192.168.2.16	217.60.7.133
May 8, 2024 08:42:09.597455025 CEST	21	52243	153.142.206.60	192.168.2.16
May 8, 2024 08:42:09.607887983 CEST	52105	21	192.168.2.16	38.60.203.180
May 8, 2024 08:42:09.607917070 CEST	52104	2121	192.168.2.16	181.97.152.233
May 8, 2024 08:42:09.608619928 CEST	52295	2121	192.168.2.16	217.60.7.133
May 8, 2024 08:42:09.608760118 CEST	52296	2121	192.168.2.16	14.51.46.49
May 8, 2024 08:42:09.608854055 CEST	52297	21	192.168.2.16	14.51.46.49
May 8, 2024 08:42:09.608877897 CEST	52298	21	192.168.2.16	117.183.63.223
May 8, 2024 08:42:09.608910084 CEST	52299	2121	192.168.2.16	117.183.63.223
May 8, 2024 08:42:09.618954897 CEST	2121	52177	194.87.78.149	192.168.2.16
May 8, 2024 08:42:09.623913050 CEST	52265	21	192.168.2.16	126.217.92.175
May 8, 2024 08:42:09.623918056 CEST	52107	2121	192.168.2.16	38.60.203.180
May 8, 2024 08:42:09.624556065 CEST	52300	21	192.168.2.16	71.213.34.99
May 8, 2024 08:42:09.624625921 CEST	52301	21	192.168.2.16	80.31.142.62
May 8, 2024 08:42:09.624660015 CEST	52302	21	192.168.2.16	189.238.13.141
May 8, 2024 08:42:09.624722004 CEST	52303	2121	192.168.2.16	71.213.34.99
May 8, 2024 08:42:09.624733925 CEST	52304	2121	192.168.2.16	80.31.142.62
May 8, 2024 08:42:09.629848003 CEST	21	52280	84.44.255.254	192.168.2.16
May 8, 2024 08:42:09.629905939 CEST	52280	21	192.168.2.16	84.44.255.254
May 8, 2024 08:42:09.636174917 CEST	21	52258	84.44.255.254	192.168.2.16
May 8, 2024 08:42:09.639898062 CEST	52110	2121	192.168.2.16	83.52.138.245
May 8, 2024 08:42:09.639914989 CEST	52109	21	192.168.2.16	83.52.138.245
May 8, 2024 08:42:09.640511990 CEST	52305	2121	192.168.2.16	189.238.13.141
May 8, 2024 08:42:09.640619040 CEST	52307	21	192.168.2.16	60.114.139.124
May 8, 2024 08:42:09.640638113 CEST	52306	2121	192.168.2.16	60.114.139.124
May 8, 2024 08:42:09.640661001 CEST	52308	21	192.168.2.16	85.136.244.223
May 8, 2024 08:42:09.640743971 CEST	52309	2121	192.168.2.16	85.136.244.223
May 8, 2024 08:42:09.643182039 CEST	52266	2121	192.168.2.16	126.217.92.175
May 8, 2024 08:42:09.655960083 CEST	52256	2121	192.168.2.16	92.116.148.136
May 8, 2024 08:42:09.656172037 CEST	52310	21	192.168.2.16	88.8.158.250
May 8, 2024 08:42:09.687894106 CEST	52155	2121	192.168.2.16	178.118.214.32
May 8, 2024 08:42:09.687910080 CEST	52259	2121	192.168.2.16	142.11.215.85
May 8, 2024 08:42:09.703932047 CEST	52260	21	192.168.2.16	192.241.123.5
May 8, 2024 08:42:09.704004049 CEST	52154	21	192.168.2.16	178.118.214.32
May 8, 2024 08:42:09.715130091 CEST	21	52262	196.210.0.111	192.168.2.16
May 8, 2024 08:42:09.715328932 CEST	52262	21	192.168.2.16	196.210.0.111
May 8, 2024 08:42:09.716322899 CEST	21	52278	34.149.79.8	192.168.2.16
May 8, 2024 08:42:09.716569901 CEST	21	52285	34.149.79.8	192.168.2.16
May 8, 2024 08:42:09.716648102 CEST	52285	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:09.719932079 CEST	52093	2121	192.168.2.16	79.98.26.88
May 8, 2024 08:42:09.719933033 CEST	52261	2121	192.168.2.16	192.241.123.5
May 8, 2024 08:42:09.726982117 CEST	2121	52279	34.149.79.8	192.168.2.16
May 8, 2024 08:42:09.727447987 CEST	2121	52287	34.149.79.8	192.168.2.16
May 8, 2024 08:42:09.727530956 CEST	52287	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:09.734935045 CEST	52115	2121	192.168.2.16	91.212.27.173
May 8, 2024 08:42:09.736027002 CEST	52114	21	192.168.2.16	91.212.27.173
May 8, 2024 08:42:09.745358944 CEST	21	52276	38.239.154.176	192.168.2.16
May 8, 2024 08:42:09.745532036 CEST	52276	21	192.168.2.16	38.239.154.176
May 8, 2024 08:42:09.750931025 CEST	52116	21	192.168.2.16	98.122.119.164
May 8, 2024 08:42:09.766952991 CEST	52119	21	192.168.2.16	76.170.89.242
May 8, 2024 08:42:09.766952038 CEST	52118	2121	192.168.2.16	76.170.89.242
May 8, 2024 08:42:09.766956091 CEST	52117	2121	192.168.2.16	98.122.119.164
May 8, 2024 08:42:09.767899036 CEST	52120	21	192.168.2.16	176.253.150.191
May 8, 2024 08:42:09.781919003 CEST	21	52292	38.38.120.85	192.168.2.16
May 8, 2024 08:42:09.782005072 CEST	52292	21	192.168.2.16	38.38.120.85
May 8, 2024 08:42:09.798929930 CEST	52263	21	192.168.2.16	94.13.187.158
May 8, 2024 08:42:09.799374104 CEST	21	52271	172.120.235.139	192.168.2.16
May 8, 2024 08:42:09.799520016 CEST	52271	21	192.168.2.16	172.120.235.139
May 8, 2024 08:42:09.799761057 CEST	52311	21	192.168.2.16	172.120.235.139
May 8, 2024 08:42:09.814934969 CEST	52264	2121	192.168.2.16	94.13.187.158
May 8, 2024 08:42:09.814937115 CEST	52124	21	192.168.2.16	212.110.229.7
May 8, 2024 08:42:09.814938068 CEST	52123	2121	192.168.2.16	176.253.150.191
May 8, 2024 08:42:09.815112114 CEST	52125	2121	192.168.2.16	212.110.229.7
May 8, 2024 08:42:09.820764065 CEST	21	51994	38.38.120.85	192.168.2.16
May 8, 2024 08:42:09.830925941 CEST	52267	21	192.168.2.16	113.109.212.89
May 8, 2024 08:42:09.845484018 CEST	21	51802	91.146.97.65	192.168.2.16
May 8, 2024 08:42:09.845529079 CEST	51802	21	192.168.2.16	91.146.97.65
May 8, 2024 08:42:09.846908092 CEST	52170	21	192.168.2.16	45.135.178.209
May 8, 2024 08:42:09.846925974 CEST	52127	2121	192.168.2.16	186.239.202.150
May 8, 2024 08:42:09.846935987 CEST	52128	21	192.168.2.16	94.214.147.214
May 8, 2024 08:42:09.846937895 CEST	52126	21	192.168.2.16	186.239.202.150
May 8, 2024 08:42:09.855575085 CEST	21	52234	171.244.37.116	192.168.2.16
May 8, 2024 08:42:09.855741978 CEST	52234	21	192.168.2.16	171.244.37.116
May 8, 2024 08:42:09.856003046 CEST	52312	21	192.168.2.16	171.244.37.116
May 8, 2024 08:42:09.862917900 CEST	52171	2121	192.168.2.16	45.135.178.209
May 8, 2024 08:42:09.878909111 CEST	52129	2121	192.168.2.16	94.214.147.214
May 8, 2024 08:42:09.879055023 CEST	21	52285	34.149.79.8	192.168.2.16
May 8, 2024 08:42:09.879111052 CEST	52285	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:09.879184961 CEST	52285	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:09.879374027 CEST	52313	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:09.889949083 CEST	2121	52287	34.149.79.8	192.168.2.16
May 8, 2024 08:42:09.890007019 CEST	52287	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:09.890115976 CEST	52287	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:09.890338898 CEST	52314	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:09.910918951 CEST	52130	21	192.168.2.16	36.150.121.139
May 8, 2024 08:42:09.910919905 CEST	52274	21	192.168.2.16	14.90.138.213
May 8, 2024 08:42:09.911240101 CEST	52315	2121	192.168.2.16	88.8.158.250
May 8, 2024 08:42:09.922651052 CEST	2121	52296	14.51.46.49	192.168.2.16
May 8, 2024 08:42:09.923357010 CEST	21	52265	126.217.92.175	192.168.2.16
May 8, 2024 08:42:09.923794985 CEST	21	52297	14.51.46.49	192.168.2.16
May 8, 2024 08:42:09.926678896 CEST	2121	52295	217.60.7.133	192.168.2.16
May 8, 2024 08:42:09.926918983 CEST	52275	2121	192.168.2.16	14.90.138.213
May 8, 2024 08:42:09.927277088 CEST	52316	21	192.168.2.16	123.112.188.163
May 8, 2024 08:42:09.938277006 CEST	21	52307	60.114.139.124	192.168.2.16
May 8, 2024 08:42:09.939363003 CEST	2121	52306	60.114.139.124	192.168.2.16
May 8, 2024 08:42:09.942301035 CEST	21	52280	84.44.255.254	192.168.2.16
May 8, 2024 08:42:09.942363977 CEST	52280	21	192.168.2.16	84.44.255.254
May 8, 2024 08:42:09.942459106 CEST	52280	21	192.168.2.16	84.44.255.254
May 8, 2024 08:42:09.942708015 CEST	52317	21	192.168.2.16	84.44.255.254
May 8, 2024 08:42:09.945566893 CEST	2121	52266	126.217.92.175	192.168.2.16
May 8, 2024 08:42:09.958910942 CEST	52232	21	192.168.2.16	38.6.37.19
May 8, 2024 08:42:09.959837914 CEST	52270	2121	192.168.2.16	113.109.212.89
May 8, 2024 08:42:09.973524094 CEST	21	52292	38.38.120.85	192.168.2.16
May 8, 2024 08:42:09.973774910 CEST	52292	21	192.168.2.16	38.38.120.85
May 8, 2024 08:42:09.974905014 CEST	52133	2121	192.168.2.16	36.150.121.139
May 8, 2024 08:42:09.974929094 CEST	52231	21	192.168.2.16	118.48.36.223
May 8, 2024 08:42:09.974944115 CEST	52230	2121	192.168.2.16	118.48.36.223
May 8, 2024 08:42:09.981326103 CEST	21	52271	172.120.235.139	192.168.2.16
May 8, 2024 08:42:09.981374979 CEST	52271	21	192.168.2.16	172.120.235.139
May 8, 2024 08:42:09.981417894 CEST	21	52311	172.120.235.139	192.168.2.16
May 8, 2024 08:42:09.981478930 CEST	52311	21	192.168.2.16	172.120.235.139
May 8, 2024 08:42:09.990926981 CEST	52136	21	192.168.2.16	51.124.217.197
May 8, 2024 08:42:09.990932941 CEST	52233	2121	192.168.2.16	38.6.37.19
May 8, 2024 08:42:10.013394117 CEST	2121	52155	178.118.214.32	192.168.2.16
May 8, 2024 08:42:10.022913933 CEST	52138	2121	192.168.2.16	51.124.217.197
May 8, 2024 08:42:10.022926092 CEST	52139	21	192.168.2.16	84.151.162.29
May 8, 2024 08:42:10.023246050 CEST	52318	2121	192.168.2.16	123.112.188.163
May 8, 2024 08:42:10.023282051 CEST	52272	21	192.168.2.16	151.197.204.59
May 8, 2024 08:42:10.023287058 CEST	52152	21	192.168.2.16	65.141.220.74
May 8, 2024 08:42:10.029833078 CEST	21	52154	178.118.214.32	192.168.2.16
May 8, 2024 08:42:10.030524969 CEST	21	52286	117.223.205.236	192.168.2.16
May 8, 2024 08:42:10.030586004 CEST	52286	21	192.168.2.16	117.223.205.236
May 8, 2024 08:42:10.030962944 CEST	21	52100	117.223.205.236	192.168.2.16
May 8, 2024 08:42:10.031008959 CEST	52100	21	192.168.2.16	117.223.205.236
May 8, 2024 08:42:10.038893938 CEST	52140	2121	192.168.2.16	84.151.162.29
May 8, 2024 08:42:10.041600943 CEST	21	52285	34.149.79.8	192.168.2.16
May 8, 2024 08:42:10.041815042 CEST	21	52313	34.149.79.8	192.168.2.16
May 8, 2024 08:42:10.041884899 CEST	52313	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:10.045495987 CEST	21	52276	38.239.154.176	192.168.2.16
May 8, 2024 08:42:10.045587063 CEST	21	52276	38.239.154.176	192.168.2.16
May 8, 2024 08:42:10.045722961 CEST	52276	21	192.168.2.16	38.239.154.176
May 8, 2024 08:42:10.052403927 CEST	2121	52287	34.149.79.8	192.168.2.16
May 8, 2024 08:42:10.052496910 CEST	2121	52314	34.149.79.8	192.168.2.16
May 8, 2024 08:42:10.052556992 CEST	52314	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:10.054919958 CEST	51498	2121	192.168.2.16	38.207.205.17
May 8, 2024 08:42:10.054924965 CEST	52141	21	192.168.2.16	83.58.222.16
May 8, 2024 08:42:10.055185080 CEST	52319	21	192.168.2.16	120.27.208.231
May 8, 2024 08:42:10.055378914 CEST	2121	52093	79.98.26.88	192.168.2.16
May 8, 2024 08:42:10.055680990 CEST	52320	2121	192.168.2.16	120.27.208.231
May 8, 2024 08:42:10.056444883 CEST	52176	21	192.168.2.16	194.87.78.149
May 8, 2024 08:42:10.070923090 CEST	52143	21	192.168.2.16	209.38.228.218
May 8, 2024 08:42:10.070924044 CEST	52142	2121	192.168.2.16	83.58.222.16
May 8, 2024 08:42:10.086908102 CEST	52144	2121	192.168.2.16	209.38.228.218
May 8, 2024 08:42:10.086916924 CEST	52145	21	192.168.2.16	113.231.192.199
May 8, 2024 08:42:10.086918116 CEST	52146	2121	192.168.2.16	113.231.192.199
May 8, 2024 08:42:10.087475061 CEST	52273	2121	192.168.2.16	151.197.204.59
May 8, 2024 08:42:10.087476969 CEST	52321	21	192.168.2.16	78.58.170.246
May 8, 2024 08:42:10.102901936 CEST	52157	2121	192.168.2.16	65.141.220.74
May 8, 2024 08:42:10.102916956 CEST	52148	2121	192.168.2.16	184.60.138.33
May 8, 2024 08:42:10.102921963 CEST	52243	21	192.168.2.16	153.142.206.60
May 8, 2024 08:42:10.102930069 CEST	52147	21	192.168.2.16	184.60.138.33
May 8, 2024 08:42:10.134893894 CEST	52177	2121	192.168.2.16	194.87.78.149
May 8, 2024 08:42:10.134921074 CEST	52149	21	192.168.2.16	115.46.86.127
May 8, 2024 08:42:10.153069019 CEST	21	52185	46.34.34.117	192.168.2.16
May 8, 2024 08:42:10.153242111 CEST	52185	21	192.168.2.16	46.34.34.117
May 8, 2024 08:42:10.153520107 CEST	52322	21	192.168.2.16	46.34.34.117
May 8, 2024 08:42:10.159432888 CEST	21	52170	45.135.178.209	192.168.2.16
May 8, 2024 08:42:10.163342953 CEST	21	52292	38.38.120.85	192.168.2.16
May 8, 2024 08:42:10.163389921 CEST	21	52292	38.38.120.85	192.168.2.16
May 8, 2024 08:42:10.163547993 CEST	52292	21	192.168.2.16	38.38.120.85
May 8, 2024 08:42:10.179016113 CEST	2121	52171	45.135.178.209	192.168.2.16
May 8, 2024 08:42:10.197010994 CEST	21	52262	196.210.0.111	192.168.2.16
May 8, 2024 08:42:10.197024107 CEST	21	52262	196.210.0.111	192.168.2.16
May 8, 2024 08:42:10.197138071 CEST	52262	21	192.168.2.16	196.210.0.111
May 8, 2024 08:42:10.204319954 CEST	21	52313	34.149.79.8	192.168.2.16
May 8, 2024 08:42:10.204368114 CEST	52313	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:10.204451084 CEST	52313	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:10.204653978 CEST	52323	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:10.205075026 CEST	21	52311	172.120.235.139	192.168.2.16
May 8, 2024 08:42:10.205197096 CEST	52311	21	192.168.2.16	172.120.235.139
May 8, 2024 08:42:10.214771986 CEST	2121	52314	34.149.79.8	192.168.2.16
May 8, 2024 08:42:10.214828968 CEST	52314	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:10.214939117 CEST	52153	2121	192.168.2.16	115.46.86.127
May 8, 2024 08:42:10.214994907 CEST	52314	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:10.215255976 CEST	52324	2121	192.168.2.16	78.58.170.246
May 8, 2024 08:42:10.215302944 CEST	52325	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:10.220259905 CEST	21	52234	171.244.37.116	192.168.2.16
May 8, 2024 08:42:10.220271111 CEST	21	52234	171.244.37.116	192.168.2.16
May 8, 2024 08:42:10.220314980 CEST	52234	21	192.168.2.16	171.244.37.116
May 8, 2024 08:42:10.221736908 CEST	21	52152	65.141.220.74	192.168.2.16
May 8, 2024 08:42:10.222069025 CEST	52326	21	192.168.2.16	170.238.228.49
May 8, 2024 08:42:10.226295948 CEST	21	52312	171.244.37.116	192.168.2.16
May 8, 2024 08:42:10.226357937 CEST	52312	21	192.168.2.16	171.244.37.116
May 8, 2024 08:42:10.227935076 CEST	21	52274	14.90.138.213	192.168.2.16
May 8, 2024 08:42:10.230885029 CEST	52277	21	192.168.2.16	80.234.15.119
May 8, 2024 08:42:10.230906010 CEST	52156	21	192.168.2.16	91.146.97.65
May 8, 2024 08:42:10.246788025 CEST	2121	52275	14.90.138.213	192.168.2.16
May 8, 2024 08:42:10.247235060 CEST	52327	2121	192.168.2.16	170.238.228.49
May 8, 2024 08:42:10.254663944 CEST	21	52280	84.44.255.254	192.168.2.16
May 8, 2024 08:42:10.261506081 CEST	21	52232	38.6.37.19	192.168.2.16
May 8, 2024 08:42:10.262343884 CEST	21	52317	84.44.255.254	192.168.2.16
May 8, 2024 08:42:10.262412071 CEST	52317	21	192.168.2.16	84.44.255.254
May 8, 2024 08:42:10.262908936 CEST	52158	21	192.168.2.16	78.18.145.24
May 8, 2024 08:42:10.278899908 CEST	52159	2121	192.168.2.16	78.18.145.24
May 8, 2024 08:42:10.279479980 CEST	52328	21	192.168.2.16	34.117.50.102
May 8, 2024 08:42:10.289936066 CEST	2121	52230	118.48.36.223	192.168.2.16
May 8, 2024 08:42:10.293250084 CEST	2121	52233	38.6.37.19	192.168.2.16
May 8, 2024 08:42:10.294887066 CEST	52161	21	192.168.2.16	217.82.62.148
May 8, 2024 08:42:10.294908047 CEST	52162	2121	192.168.2.16	217.82.62.148
May 8, 2024 08:42:10.294917107 CEST	52163	21	192.168.2.16	5.172.93.12
May 8, 2024 08:42:10.298363924 CEST	21	52231	118.48.36.223	192.168.2.16
May 8, 2024 08:42:10.298568010 CEST	21	51994	38.38.120.85	192.168.2.16
May 8, 2024 08:42:10.298621893 CEST	51994	21	192.168.2.16	38.38.120.85
May 8, 2024 08:42:10.298651934 CEST	21	51994	38.38.120.85	192.168.2.16
May 8, 2024 08:42:10.298696041 CEST	51994	21	192.168.2.16	38.38.120.85
May 8, 2024 08:42:10.299289942 CEST	21	51994	38.38.120.85	192.168.2.16
May 8, 2024 08:42:10.299331903 CEST	51994	21	192.168.2.16	38.38.120.85
May 8, 2024 08:42:10.306025982 CEST	2121	52157	65.141.220.74	192.168.2.16
May 8, 2024 08:42:10.306430101 CEST	52329	2121	192.168.2.16	34.117.50.102
May 8, 2024 08:42:10.310914993 CEST	52164	2121	192.168.2.16	5.172.93.12
May 8, 2024 08:42:10.326931953 CEST	52167	2121	192.168.2.16	38.14.189.177
May 8, 2024 08:42:10.352757931 CEST	21	52276	38.239.154.176	192.168.2.16
May 8, 2024 08:42:10.352895021 CEST	52276	21	192.168.2.16	38.239.154.176
May 8, 2024 08:42:10.353102922 CEST	52330	21	192.168.2.16	38.239.154.176
May 8, 2024 08:42:10.353553057 CEST	21	52276	38.239.154.176	192.168.2.16
May 8, 2024 08:42:10.353594065 CEST	52276	21	192.168.2.16	38.239.154.176
May 8, 2024 08:42:10.366971970 CEST	21	52313	34.149.79.8	192.168.2.16
May 8, 2024 08:42:10.367038012 CEST	21	52323	34.149.79.8	192.168.2.16
May 8, 2024 08:42:10.367109060 CEST	52323	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:10.373400927 CEST	21	52197	96.126.118.190	192.168.2.16
May 8, 2024 08:42:10.373569965 CEST	52197	21	192.168.2.16	96.126.118.190
May 8, 2024 08:42:10.374918938 CEST	52281	2121	192.168.2.16	80.234.15.119
May 8, 2024 08:42:10.374994993 CEST	52282	21	192.168.2.16	76.31.14.147
May 8, 2024 08:42:10.377115011 CEST	2121	52314	34.149.79.8	192.168.2.16
May 8, 2024 08:42:10.377665997 CEST	2121	52325	34.149.79.8	192.168.2.16
May 8, 2024 08:42:10.377732992 CEST	52325	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:10.386899948 CEST	21	52311	172.120.235.139	192.168.2.16
May 8, 2024 08:42:10.387126923 CEST	21	52311	172.120.235.139	192.168.2.16
May 8, 2024 08:42:10.387265921 CEST	52311	21	192.168.2.16	172.120.235.139
May 8, 2024 08:42:10.392844915 CEST	21	52292	38.38.120.85	192.168.2.16
May 8, 2024 08:42:10.394660950 CEST	21	52243	153.142.206.60	192.168.2.16
May 8, 2024 08:42:10.417435884 CEST	21	52176	194.87.78.149	192.168.2.16
May 8, 2024 08:42:10.418553114 CEST	2121	52199	96.126.118.190	192.168.2.16
May 8, 2024 08:42:10.418745041 CEST	52199	2121	192.168.2.16	96.126.118.190
May 8, 2024 08:42:10.422442913 CEST	52331	21	192.168.2.16	38.207.205.17
May 8, 2024 08:42:10.437917948 CEST	52296	2121	192.168.2.16	14.51.46.49
May 8, 2024 08:42:10.437935114 CEST	52297	21	192.168.2.16	14.51.46.49
May 8, 2024 08:42:10.437937021 CEST	52295	2121	192.168.2.16	217.60.7.133
May 8, 2024 08:42:10.438234091 CEST	52174	21	192.168.2.16	23.8.196.230
May 8, 2024 08:42:10.438234091 CEST	52332	2121	192.168.2.16	38.207.205.17
May 8, 2024 08:42:10.438257933 CEST	52265	21	192.168.2.16	126.217.92.175
May 8, 2024 08:42:10.452892065 CEST	52306	2121	192.168.2.16	60.114.139.124
May 8, 2024 08:42:10.452919006 CEST	52266	2121	192.168.2.16	126.217.92.175
May 8, 2024 08:42:10.452919006 CEST	52307	21	192.168.2.16	60.114.139.124
May 8, 2024 08:42:10.468918085 CEST	52283	2121	192.168.2.16	76.31.14.147
May 8, 2024 08:42:10.474895000 CEST	52175	2121	192.168.2.16	23.8.196.230
May 8, 2024 08:42:10.495915890 CEST	2121	52177	194.87.78.149	192.168.2.16
May 8, 2024 08:42:10.496898890 CEST	21	52185	46.34.34.117	192.168.2.16
May 8, 2024 08:42:10.496957064 CEST	52185	21	192.168.2.16	46.34.34.117
May 8, 2024 08:42:10.497529030 CEST	21	52322	46.34.34.117	192.168.2.16
May 8, 2024 08:42:10.497595072 CEST	52322	21	192.168.2.16	46.34.34.117
May 8, 2024 08:42:10.516937017 CEST	52155	2121	192.168.2.16	178.118.214.32
May 8, 2024 08:42:10.529562950 CEST	21	52323	34.149.79.8	192.168.2.16
May 8, 2024 08:42:10.529642105 CEST	52323	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:10.529738903 CEST	52323	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:10.529999018 CEST	52333	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:10.532936096 CEST	52154	21	192.168.2.16	178.118.214.32
May 8, 2024 08:42:10.540179014 CEST	2121	52325	34.149.79.8	192.168.2.16
May 8, 2024 08:42:10.540246010 CEST	52325	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:10.540323019 CEST	52325	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:10.540546894 CEST	52334	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:10.543149948 CEST	21	52286	117.223.205.236	192.168.2.16
May 8, 2024 08:42:10.543319941 CEST	52286	21	192.168.2.16	117.223.205.236
May 8, 2024 08:42:10.548935890 CEST	52284	21	192.168.2.16	109.193.13.3
May 8, 2024 08:42:10.571132898 CEST	21	52326	170.238.228.49	192.168.2.16
May 8, 2024 08:42:10.579950094 CEST	21	52197	96.126.118.190	192.168.2.16
May 8, 2024 08:42:10.580152988 CEST	21	52197	96.126.118.190	192.168.2.16
May 8, 2024 08:42:10.580369949 CEST	52197	21	192.168.2.16	96.126.118.190
May 8, 2024 08:42:10.580905914 CEST	52290	2121	192.168.2.16	94.208.110.104
May 8, 2024 08:42:10.580929041 CEST	52291	21	192.168.2.16	174.80.147.247
May 8, 2024 08:42:10.580935001 CEST	52288	2121	192.168.2.16	109.193.13.3
May 8, 2024 08:42:10.582022905 CEST	52289	21	192.168.2.16	94.208.110.104
May 8, 2024 08:42:10.582103014 CEST	21	52317	84.44.255.254	192.168.2.16
May 8, 2024 08:42:10.582165956 CEST	52317	21	192.168.2.16	84.44.255.254
May 8, 2024 08:42:10.582230091 CEST	52317	21	192.168.2.16	84.44.255.254
May 8, 2024 08:42:10.582487106 CEST	52335	21	192.168.2.16	84.44.255.254
May 8, 2024 08:42:10.596827030 CEST	21	52312	171.244.37.116	192.168.2.16
May 8, 2024 08:42:10.596900940 CEST	52293	2121	192.168.2.16	174.80.147.247
May 8, 2024 08:42:10.596956968 CEST	52294	21	192.168.2.16	217.60.7.133
May 8, 2024 08:42:10.596961021 CEST	52312	21	192.168.2.16	171.244.37.116
May 8, 2024 08:42:10.597541094 CEST	21	52311	172.120.235.139	192.168.2.16
May 8, 2024 08:42:10.597685099 CEST	52311	21	192.168.2.16	172.120.235.139
May 8, 2024 08:42:10.597923994 CEST	52336	21	192.168.2.16	172.120.235.139
May 8, 2024 08:42:10.608186007 CEST	2121	52327	170.238.228.49	192.168.2.16
May 8, 2024 08:42:10.612921000 CEST	52298	21	192.168.2.16	117.183.63.223
May 8, 2024 08:42:10.614901066 CEST	52299	2121	192.168.2.16	117.183.63.223
May 8, 2024 08:42:10.624818087 CEST	2121	52199	96.126.118.190	192.168.2.16
May 8, 2024 08:42:10.624916077 CEST	2121	52199	96.126.118.190	192.168.2.16
May 8, 2024 08:42:10.625076056 CEST	52199	2121	192.168.2.16	96.126.118.190
May 8, 2024 08:42:10.628899097 CEST	52303	2121	192.168.2.16	71.213.34.99
May 8, 2024 08:42:10.628911972 CEST	52301	21	192.168.2.16	80.31.142.62
May 8, 2024 08:42:10.628914118 CEST	52304	2121	192.168.2.16	80.31.142.62
May 8, 2024 08:42:10.628932953 CEST	52302	21	192.168.2.16	189.238.13.141
May 8, 2024 08:42:10.628941059 CEST	52300	21	192.168.2.16	71.213.34.99
May 8, 2024 08:42:10.644891977 CEST	52305	2121	192.168.2.16	189.238.13.141
May 8, 2024 08:42:10.644906998 CEST	52308	21	192.168.2.16	85.136.244.223
May 8, 2024 08:42:10.644913912 CEST	52309	2121	192.168.2.16	85.136.244.223
May 8, 2024 08:42:10.652786970 CEST	21	52276	38.239.154.176	192.168.2.16
May 8, 2024 08:42:10.660939932 CEST	52170	21	192.168.2.16	45.135.178.209
May 8, 2024 08:42:10.660945892 CEST	52310	21	192.168.2.16	88.8.158.250
May 8, 2024 08:42:10.674611092 CEST	21	52330	38.239.154.176	192.168.2.16
May 8, 2024 08:42:10.674685955 CEST	52330	21	192.168.2.16	38.239.154.176
May 8, 2024 08:42:10.676955938 CEST	52058	2121	192.168.2.16	62.140.135.146
May 8, 2024 08:42:10.677251101 CEST	52337	2121	192.168.2.16	62.140.135.146
May 8, 2024 08:42:10.677359104 CEST	52338	21	192.168.2.16	124.218.36.10
May 8, 2024 08:42:10.692106009 CEST	21	52323	34.149.79.8	192.168.2.16
May 8, 2024 08:42:10.692399025 CEST	21	52333	34.149.79.8	192.168.2.16
May 8, 2024 08:42:10.692471027 CEST	52333	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:10.692915916 CEST	52171	2121	192.168.2.16	45.135.178.209
May 8, 2024 08:42:10.693231106 CEST	52339	2121	192.168.2.16	124.218.36.10
May 8, 2024 08:42:10.693233013 CEST	52182	21	192.168.2.16	86.144.51.124
May 8, 2024 08:42:10.702672958 CEST	2121	52325	34.149.79.8	192.168.2.16
May 8, 2024 08:42:10.703013897 CEST	2121	52334	34.149.79.8	192.168.2.16
May 8, 2024 08:42:10.703074932 CEST	52334	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:10.708945990 CEST	52059	21	192.168.2.16	62.140.135.146
May 8, 2024 08:42:10.709120989 CEST	52340	21	192.168.2.16	62.140.135.146
May 8, 2024 08:42:10.717888117 CEST	21	52262	196.210.0.111	192.168.2.16
May 8, 2024 08:42:10.737220049 CEST	21	52265	126.217.92.175	192.168.2.16
May 8, 2024 08:42:10.740919113 CEST	52274	21	192.168.2.16	14.90.138.213
May 8, 2024 08:42:10.750526905 CEST	2121	52306	60.114.139.124	192.168.2.16
May 8, 2024 08:42:10.750539064 CEST	21	52307	60.114.139.124	192.168.2.16
May 8, 2024 08:42:10.751188993 CEST	2121	52296	14.51.46.49	192.168.2.16
May 8, 2024 08:42:10.752336025 CEST	21	52297	14.51.46.49	192.168.2.16
May 8, 2024 08:42:10.753390074 CEST	2121	52266	126.217.92.175	192.168.2.16
May 8, 2024 08:42:10.755189896 CEST	2121	52295	217.60.7.133	192.168.2.16
May 8, 2024 08:42:10.756926060 CEST	52275	2121	192.168.2.16	14.90.138.213
May 8, 2024 08:42:10.757535934 CEST	52341	21	192.168.2.16	193.238.110.81
May 8, 2024 08:42:10.772917986 CEST	52232	21	192.168.2.16	38.6.37.19
May 8, 2024 08:42:10.779439926 CEST	21	52311	172.120.235.139	192.168.2.16
May 8, 2024 08:42:10.779500961 CEST	52311	21	192.168.2.16	172.120.235.139
May 8, 2024 08:42:10.779608011 CEST	21	52336	172.120.235.139	192.168.2.16
May 8, 2024 08:42:10.779675007 CEST	52336	21	192.168.2.16	172.120.235.139
May 8, 2024 08:42:10.783891916 CEST	52183	2121	192.168.2.16	86.144.51.124
May 8, 2024 08:42:10.786647081 CEST	21	52197	96.126.118.190	192.168.2.16
May 8, 2024 08:42:10.786843061 CEST	52197	21	192.168.2.16	96.126.118.190
May 8, 2024 08:42:10.788893938 CEST	52184	21	192.168.2.16	73.100.139.198
May 8, 2024 08:42:10.804905891 CEST	52230	2121	192.168.2.16	118.48.36.223
May 8, 2024 08:42:10.804912090 CEST	52231	21	192.168.2.16	118.48.36.223
May 8, 2024 08:42:10.805119991 CEST	52233	2121	192.168.2.16	38.6.37.19
May 8, 2024 08:42:10.820903063 CEST	52186	2121	192.168.2.16	73.100.139.198
May 8, 2024 08:42:10.824310064 CEST	21	52331	38.207.205.17	192.168.2.16
May 8, 2024 08:42:10.831335068 CEST	2121	52199	96.126.118.190	192.168.2.16
May 8, 2024 08:42:10.831573009 CEST	52199	2121	192.168.2.16	96.126.118.190
May 8, 2024 08:42:10.836937904 CEST	52187	21	192.168.2.16	52.151.5.213
May 8, 2024 08:42:10.839855909 CEST	2121	52155	178.118.214.32	192.168.2.16
May 8, 2024 08:42:10.840373993 CEST	52342	2121	192.168.2.16	193.238.110.81
May 8, 2024 08:42:10.852381945 CEST	21	52322	46.34.34.117	192.168.2.16
May 8, 2024 08:42:10.852586031 CEST	52322	21	192.168.2.16	46.34.34.117
May 8, 2024 08:42:10.852938890 CEST	52188	2121	192.168.2.16	52.151.5.213
May 8, 2024 08:42:10.855231047 CEST	21	52333	34.149.79.8	192.168.2.16
May 8, 2024 08:42:10.855287075 CEST	52333	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:10.855411053 CEST	52333	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:10.855695963 CEST	52343	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:10.858839989 CEST	21	52154	178.118.214.32	192.168.2.16
May 8, 2024 08:42:10.865668058 CEST	2121	52334	34.149.79.8	192.168.2.16
May 8, 2024 08:42:10.865739107 CEST	52334	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:10.865861893 CEST	52334	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:10.866168976 CEST	52344	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:10.869241953 CEST	52345	21	192.168.2.16	141.134.38.81
May 8, 2024 08:42:10.869242907 CEST	52189	21	192.168.2.16	116.78.34.142
May 8, 2024 08:42:10.884223938 CEST	52346	2121	192.168.2.16	141.134.38.81
May 8, 2024 08:42:10.899933100 CEST	52243	21	192.168.2.16	153.142.206.60
May 8, 2024 08:42:10.900244951 CEST	52347	21	192.168.2.16	173.16.214.83
May 8, 2024 08:42:10.902117968 CEST	21	52317	84.44.255.254	192.168.2.16
May 8, 2024 08:42:10.902657986 CEST	21	52335	84.44.255.254	192.168.2.16
May 8, 2024 08:42:10.902736902 CEST	52335	21	192.168.2.16	84.44.255.254
May 8, 2024 08:42:10.915966988 CEST	52315	2121	192.168.2.16	88.8.158.250
May 8, 2024 08:42:10.916127920 CEST	52348	2121	192.168.2.16	173.16.214.83
May 8, 2024 08:42:10.916150093 CEST	52190	2121	192.168.2.16	116.78.34.142
May 8, 2024 08:42:10.931935072 CEST	52191	21	192.168.2.16	138.0.240.33
May 8, 2024 08:42:10.931972980 CEST	52176	21	192.168.2.16	194.87.78.149
May 8, 2024 08:42:10.931973934 CEST	52316	21	192.168.2.16	123.112.188.163
May 8, 2024 08:42:10.932255030 CEST	52349	21	192.168.2.16	112.163.110.99
May 8, 2024 08:42:10.967060089 CEST	21	52312	171.244.37.116	192.168.2.16
May 8, 2024 08:42:10.967375040 CEST	52312	21	192.168.2.16	171.244.37.116
May 8, 2024 08:42:10.973583937 CEST	21	52170	45.135.178.209	192.168.2.16
May 8, 2024 08:42:10.993736982 CEST	21	52197	96.126.118.190	192.168.2.16
May 8, 2024 08:42:10.993973970 CEST	52197	21	192.168.2.16	96.126.118.190
May 8, 2024 08:42:10.996258020 CEST	52350	2121	192.168.2.16	112.163.110.99
May 8, 2024 08:42:10.997613907 CEST	21	52330	38.239.154.176	192.168.2.16
May 8, 2024 08:42:10.997775078 CEST	52330	21	192.168.2.16	38.239.154.176
May 8, 2024 08:42:11.002809048 CEST	21	52336	172.120.235.139	192.168.2.16
May 8, 2024 08:42:11.002999067 CEST	52336	21	192.168.2.16	172.120.235.139
May 8, 2024 08:42:11.003087997 CEST	2121	52337	62.140.135.146	192.168.2.16
May 8, 2024 08:42:11.003177881 CEST	52337	2121	192.168.2.16	62.140.135.146
May 8, 2024 08:42:11.009236097 CEST	2121	52171	45.135.178.209	192.168.2.16
May 8, 2024 08:42:11.011940002 CEST	52177	2121	192.168.2.16	194.87.78.149
May 8, 2024 08:42:11.012321949 CEST	52351	21	192.168.2.16	81.247.4.75
May 8, 2024 08:42:11.018002987 CEST	21	52333	34.149.79.8	192.168.2.16
May 8, 2024 08:42:11.018476963 CEST	21	52343	34.149.79.8	192.168.2.16
May 8, 2024 08:42:11.018557072 CEST	52343	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:11.028027058 CEST	52318	2121	192.168.2.16	123.112.188.163
May 8, 2024 08:42:11.028513908 CEST	52352	2121	192.168.2.16	203.229.48.78
May 8, 2024 08:42:11.028593063 CEST	52354	21	192.168.2.16	203.229.48.78
May 8, 2024 08:42:11.028604031 CEST	52353	2121	192.168.2.16	81.247.4.75
May 8, 2024 08:42:11.029145002 CEST	2121	52334	34.149.79.8	192.168.2.16
May 8, 2024 08:42:11.029273033 CEST	2121	52344	34.149.79.8	192.168.2.16
May 8, 2024 08:42:11.029329062 CEST	52344	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:11.034567118 CEST	21	52340	62.140.135.146	192.168.2.16
May 8, 2024 08:42:11.034652948 CEST	52340	21	192.168.2.16	62.140.135.146
May 8, 2024 08:42:11.037621975 CEST	2121	52199	96.126.118.190	192.168.2.16
May 8, 2024 08:42:11.037771940 CEST	52199	2121	192.168.2.16	96.126.118.190
May 8, 2024 08:42:11.058224916 CEST	21	52274	14.90.138.213	192.168.2.16
May 8, 2024 08:42:11.059952021 CEST	52319	21	192.168.2.16	120.27.208.231
May 8, 2024 08:42:11.059952974 CEST	52320	2121	192.168.2.16	120.27.208.231
May 8, 2024 08:42:11.062616110 CEST	21	52286	117.223.205.236	192.168.2.16
May 8, 2024 08:42:11.062628984 CEST	21	52286	117.223.205.236	192.168.2.16
May 8, 2024 08:42:11.063925982 CEST	52286	21	192.168.2.16	117.223.205.236
May 8, 2024 08:42:11.075436115 CEST	21	52232	38.6.37.19	192.168.2.16
May 8, 2024 08:42:11.075944901 CEST	52326	21	192.168.2.16	170.238.228.49
May 8, 2024 08:42:11.076287985 CEST	2121	52275	14.90.138.213	192.168.2.16
May 8, 2024 08:42:11.076451063 CEST	52355	2121	192.168.2.16	182.218.102.189
May 8, 2024 08:42:11.076548100 CEST	52356	21	192.168.2.16	182.218.102.189
May 8, 2024 08:42:11.091988087 CEST	52321	21	192.168.2.16	78.58.170.246
May 8, 2024 08:42:11.107434034 CEST	2121	52233	38.6.37.19	192.168.2.16
May 8, 2024 08:42:11.120306969 CEST	2121	52230	118.48.36.223	192.168.2.16
May 8, 2024 08:42:11.123924971 CEST	52201	2121	192.168.2.16	138.0.240.33
May 8, 2024 08:42:11.123966932 CEST	52327	2121	192.168.2.16	170.238.228.49
May 8, 2024 08:42:11.124022007 CEST	52202	21	192.168.2.16	171.106.156.251
May 8, 2024 08:42:11.124188900 CEST	52357	21	192.168.2.16	42.233.42.32
May 8, 2024 08:42:11.128891945 CEST	21	52231	118.48.36.223	192.168.2.16
May 8, 2024 08:42:11.139921904 CEST	52203	2121	192.168.2.16	171.106.156.251
May 8, 2024 08:42:11.139936924 CEST	52206	21	192.168.2.16	35.239.238.170
May 8, 2024 08:42:11.139941931 CEST	52205	21	192.168.2.16	5.53.240.249
May 8, 2024 08:42:11.142891884 CEST	52204	2121	192.168.2.16	5.53.240.249
May 8, 2024 08:42:11.161887884 CEST	52208	2121	192.168.2.16	35.239.238.170
May 8, 2024 08:42:11.162024975 CEST	52211	21	192.168.2.16	176.120.72.26
May 8, 2024 08:42:11.171925068 CEST	52209	21	192.168.2.16	187.252.207.89
May 8, 2024 08:42:11.171927929 CEST	52210	2121	192.168.2.16	187.252.207.89
May 8, 2024 08:42:11.180988073 CEST	21	52343	34.149.79.8	192.168.2.16
May 8, 2024 08:42:11.181152105 CEST	52343	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:11.181236029 CEST	52343	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:11.181468964 CEST	52358	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:11.184726000 CEST	21	52336	172.120.235.139	192.168.2.16
May 8, 2024 08:42:11.185018063 CEST	21	52336	172.120.235.139	192.168.2.16
May 8, 2024 08:42:11.185275078 CEST	52336	21	192.168.2.16	172.120.235.139
May 8, 2024 08:42:11.187920094 CEST	52212	2121	192.168.2.16	176.120.72.26
May 8, 2024 08:42:11.190711021 CEST	21	52322	46.34.34.117	192.168.2.16
May 8, 2024 08:42:11.191513062 CEST	21	52322	46.34.34.117	192.168.2.16
May 8, 2024 08:42:11.191524982 CEST	2121	52344	34.149.79.8	192.168.2.16
May 8, 2024 08:42:11.191586971 CEST	52344	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:11.191736937 CEST	52344	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:11.191740990 CEST	52322	21	192.168.2.16	46.34.34.117
May 8, 2024 08:42:11.191932917 CEST	21	52243	153.142.206.60	192.168.2.16
May 8, 2024 08:42:11.191987991 CEST	52359	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:11.200310946 CEST	21	52197	96.126.118.190	192.168.2.16
May 8, 2024 08:42:11.200478077 CEST	52197	21	192.168.2.16	96.126.118.190
May 8, 2024 08:42:11.219933033 CEST	52324	2121	192.168.2.16	78.58.170.246
May 8, 2024 08:42:11.222532034 CEST	21	52335	84.44.255.254	192.168.2.16
May 8, 2024 08:42:11.222596884 CEST	52335	21	192.168.2.16	84.44.255.254
May 8, 2024 08:42:11.222750902 CEST	52335	21	192.168.2.16	84.44.255.254
May 8, 2024 08:42:11.223062992 CEST	52360	21	192.168.2.16	84.44.255.254
May 8, 2024 08:42:11.235938072 CEST	52215	2121	192.168.2.16	104.231.204.135
May 8, 2024 08:42:11.235943079 CEST	52214	21	192.168.2.16	104.231.204.135
May 8, 2024 08:42:11.239927053 CEST	21	52349	112.163.110.99	192.168.2.16
May 8, 2024 08:42:11.244738102 CEST	2121	52199	96.126.118.190	192.168.2.16
May 8, 2024 08:42:11.244962931 CEST	52199	2121	192.168.2.16	96.126.118.190
May 8, 2024 08:42:11.251919985 CEST	52307	21	192.168.2.16	60.114.139.124
May 8, 2024 08:42:11.251923084 CEST	52265	21	192.168.2.16	126.217.92.175
May 8, 2024 08:42:11.251944065 CEST	52296	2121	192.168.2.16	14.51.46.49
May 8, 2024 08:42:11.251948118 CEST	52218	2121	192.168.2.16	98.179.233.178
May 8, 2024 08:42:11.251949072 CEST	52216	21	192.168.2.16	81.104.120.112
May 8, 2024 08:42:11.251950026 CEST	52217	21	192.168.2.16	98.179.233.178
May 8, 2024 08:42:11.251950979 CEST	52306	2121	192.168.2.16	60.114.139.124
May 8, 2024 08:42:11.266930103 CEST	52266	2121	192.168.2.16	126.217.92.175
May 8, 2024 08:42:11.266930103 CEST	52221	21	192.168.2.16	189.105.117.208
May 8, 2024 08:42:11.266933918 CEST	52220	2121	192.168.2.16	81.104.120.112
May 8, 2024 08:42:11.267054081 CEST	52297	21	192.168.2.16	14.51.46.49
May 8, 2024 08:42:11.267059088 CEST	52295	2121	192.168.2.16	217.60.7.133
May 8, 2024 08:42:11.282902956 CEST	52223	2121	192.168.2.16	189.105.117.208
May 8, 2024 08:42:11.282921076 CEST	52328	21	192.168.2.16	34.117.50.102
May 8, 2024 08:42:11.282921076 CEST	52224	21	192.168.2.16	73.201.234.25
May 8, 2024 08:42:11.292753935 CEST	21	52176	194.87.78.149	192.168.2.16
May 8, 2024 08:42:11.293189049 CEST	52361	2121	192.168.2.16	42.233.42.32
May 8, 2024 08:42:11.298911095 CEST	52225	2121	192.168.2.16	85.7.181.109
May 8, 2024 08:42:11.298912048 CEST	52226	2121	192.168.2.16	73.201.234.25
May 8, 2024 08:42:11.298913002 CEST	52227	21	192.168.2.16	85.7.181.109
May 8, 2024 08:42:11.303596020 CEST	2121	52350	112.163.110.99	192.168.2.16
May 8, 2024 08:42:11.314935923 CEST	52329	2121	192.168.2.16	34.117.50.102
May 8, 2024 08:42:11.315135956 CEST	52229	2121	192.168.2.16	76.185.49.230
May 8, 2024 08:42:11.317895889 CEST	52228	21	192.168.2.16	76.185.49.230
May 8, 2024 08:42:11.319258928 CEST	21	52330	38.239.154.176	192.168.2.16
May 8, 2024 08:42:11.319336891 CEST	21	52330	38.239.154.176	192.168.2.16
May 8, 2024 08:42:11.319473028 CEST	52330	21	192.168.2.16	38.239.154.176
May 8, 2024 08:42:11.330933094 CEST	52331	21	192.168.2.16	38.207.205.17
May 8, 2024 08:42:11.338248014 CEST	21	52312	171.244.37.116	192.168.2.16
May 8, 2024 08:42:11.338407993 CEST	52312	21	192.168.2.16	171.244.37.116
May 8, 2024 08:42:11.338648081 CEST	52362	21	192.168.2.16	171.244.37.116
May 8, 2024 08:42:11.345135927 CEST	21	52358	34.149.79.8	192.168.2.16
May 8, 2024 08:42:11.345232010 CEST	52358	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:11.345294952 CEST	21	52343	34.149.79.8	192.168.2.16
May 8, 2024 08:42:11.353888035 CEST	2121	52344	34.149.79.8	192.168.2.16
May 8, 2024 08:42:11.354336977 CEST	2121	52359	34.149.79.8	192.168.2.16
May 8, 2024 08:42:11.354408026 CEST	52359	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:11.374025106 CEST	2121	52177	194.87.78.149	192.168.2.16
May 8, 2024 08:42:11.374500990 CEST	52363	21	192.168.2.16	24.194.149.253
May 8, 2024 08:42:11.379215002 CEST	52055	21	192.168.2.16	120.24.160.35
May 8, 2024 08:42:11.379486084 CEST	52364	21	192.168.2.16	120.24.160.35
May 8, 2024 08:42:11.379524946 CEST	52365	2121	192.168.2.16	24.194.149.253
May 8, 2024 08:42:11.379585028 CEST	52366	21	192.168.2.16	75.80.244.38
May 8, 2024 08:42:11.393508911 CEST	21	52336	172.120.235.139	192.168.2.16
May 8, 2024 08:42:11.393642902 CEST	52336	21	192.168.2.16	172.120.235.139
May 8, 2024 08:42:11.393815041 CEST	52367	21	192.168.2.16	172.120.235.139
May 8, 2024 08:42:11.394197941 CEST	52368	2121	192.168.2.16	75.80.244.38
May 8, 2024 08:42:11.409944057 CEST	52235	21	192.168.2.16	99.229.51.22
May 8, 2024 08:42:11.409948111 CEST	52236	2121	192.168.2.16	99.229.51.22
May 8, 2024 08:42:11.410096884 CEST	52369	21	192.168.2.16	189.243.100.126
May 8, 2024 08:42:11.410693884 CEST	21	52197	96.126.118.190	192.168.2.16
May 8, 2024 08:42:11.411109924 CEST	52197	21	192.168.2.16	96.126.118.190
May 8, 2024 08:42:11.425921917 CEST	52237	21	192.168.2.16	76.136.205.151
May 8, 2024 08:42:11.427122116 CEST	21	52326	170.238.228.49	192.168.2.16
May 8, 2024 08:42:11.441931009 CEST	52332	2121	192.168.2.16	38.207.205.17
May 8, 2024 08:42:11.453545094 CEST	2121	52199	96.126.118.190	192.168.2.16
May 8, 2024 08:42:11.453979015 CEST	52199	2121	192.168.2.16	96.126.118.190
May 8, 2024 08:42:11.457921028 CEST	52238	21	192.168.2.16	116.39.121.211
May 8, 2024 08:42:11.457923889 CEST	52239	2121	192.168.2.16	76.136.205.151
May 8, 2024 08:42:11.473953009 CEST	52240	2121	192.168.2.16	116.39.121.211
May 8, 2024 08:42:11.485183001 CEST	2121	52327	170.238.228.49	192.168.2.16
May 8, 2024 08:42:11.505935907 CEST	52242	2121	192.168.2.16	178.118.142.181
May 8, 2024 08:42:11.505940914 CEST	52241	21	192.168.2.16	178.118.142.181
May 8, 2024 08:42:11.506202936 CEST	52372	2121	192.168.2.16	189.243.100.126
May 8, 2024 08:42:11.507546902 CEST	21	52358	34.149.79.8	192.168.2.16
May 8, 2024 08:42:11.507603884 CEST	52358	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:11.507750988 CEST	52358	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:11.508075953 CEST	52373	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:11.516925097 CEST	2121	52359	34.149.79.8	192.168.2.16
May 8, 2024 08:42:11.516973972 CEST	52359	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:11.517090082 CEST	52359	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:11.517374039 CEST	52374	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:11.522103071 CEST	52244	2121	192.168.2.16	153.142.206.60
May 8, 2024 08:42:11.522486925 CEST	52375	21	192.168.2.16	52.130.182.124
May 8, 2024 08:42:11.537909985 CEST	52245	21	192.168.2.16	174.113.104.133
May 8, 2024 08:42:11.538239002 CEST	21	52286	117.223.205.236	192.168.2.16
May 8, 2024 08:42:11.542412996 CEST	21	52335	84.44.255.254	192.168.2.16
May 8, 2024 08:42:11.542781115 CEST	21	52360	84.44.255.254	192.168.2.16
May 8, 2024 08:42:11.542838097 CEST	52360	21	192.168.2.16	84.44.255.254
May 8, 2024 08:42:11.549787045 CEST	2121	52306	60.114.139.124	192.168.2.16
May 8, 2024 08:42:11.549839020 CEST	21	52307	60.114.139.124	192.168.2.16
May 8, 2024 08:42:11.551275969 CEST	21	52265	126.217.92.175	192.168.2.16
May 8, 2024 08:42:11.553905964 CEST	52247	21	192.168.2.16	93.162.245.45
May 8, 2024 08:42:11.553930044 CEST	52248	2121	192.168.2.16	93.162.245.45
May 8, 2024 08:42:11.553935051 CEST	52246	2121	192.168.2.16	174.113.104.133
May 8, 2024 08:42:11.562565088 CEST	21	52322	46.34.34.117	192.168.2.16
May 8, 2024 08:42:11.565614939 CEST	2121	52296	14.51.46.49	192.168.2.16
May 8, 2024 08:42:11.568027973 CEST	2121	52266	126.217.92.175	192.168.2.16
May 8, 2024 08:42:11.569976091 CEST	52249	21	192.168.2.16	2.60.202.145
May 8, 2024 08:42:11.569978952 CEST	52274	21	192.168.2.16	14.90.138.213
May 8, 2024 08:42:11.570014000 CEST	52066	21	192.168.2.16	51.38.57.28
May 8, 2024 08:42:11.570200920 CEST	52376	21	192.168.2.16	51.38.57.28
May 8, 2024 08:42:11.575453043 CEST	21	52367	172.120.235.139	192.168.2.16
May 8, 2024 08:42:11.575515032 CEST	52367	21	192.168.2.16	172.120.235.139
May 8, 2024 08:42:11.575534105 CEST	21	52336	172.120.235.139	192.168.2.16
May 8, 2024 08:42:11.575588942 CEST	52336	21	192.168.2.16	172.120.235.139
May 8, 2024 08:42:11.582093954 CEST	21	52297	14.51.46.49	192.168.2.16
May 8, 2024 08:42:11.584285975 CEST	2121	52295	217.60.7.133	192.168.2.16
May 8, 2024 08:42:11.585891008 CEST	52250	2121	192.168.2.16	2.60.202.145
May 8, 2024 08:42:11.585908890 CEST	52252	2121	192.168.2.16	201.88.197.211
May 8, 2024 08:42:11.585911036 CEST	52275	2121	192.168.2.16	14.90.138.213
May 8, 2024 08:42:11.585912943 CEST	52251	21	192.168.2.16	201.88.197.211
May 8, 2024 08:42:11.586014986 CEST	52232	21	192.168.2.16	38.6.37.19
May 8, 2024 08:42:11.601929903 CEST	52254	21	192.168.2.16	92.116.148.136
May 8, 2024 08:42:11.602500916 CEST	52377	2121	192.168.2.16	52.130.182.124
May 8, 2024 08:42:11.602519989 CEST	52378	21	192.168.2.16	149.224.220.82
May 8, 2024 08:42:11.602595091 CEST	52379	2121	192.168.2.16	149.224.220.82
May 8, 2024 08:42:11.617913008 CEST	52233	2121	192.168.2.16	38.6.37.19
May 8, 2024 08:42:11.618179083 CEST	21	52197	96.126.118.190	192.168.2.16
May 8, 2024 08:42:11.618406057 CEST	52380	21	192.168.2.16	173.223.108.99
May 8, 2024 08:42:11.618819952 CEST	52197	21	192.168.2.16	96.126.118.190
May 8, 2024 08:42:11.633889914 CEST	52058	2121	192.168.2.16	62.140.135.146
May 8, 2024 08:42:11.633889914 CEST	52231	21	192.168.2.16	118.48.36.223
May 8, 2024 08:42:11.633900881 CEST	52230	2121	192.168.2.16	118.48.36.223
May 8, 2024 08:42:11.634332895 CEST	52382	2121	192.168.2.16	173.223.108.99
May 8, 2024 08:42:11.634361029 CEST	52383	21	192.168.2.16	78.150.98.19
May 8, 2024 08:42:11.649224997 CEST	21	52330	38.239.154.176	192.168.2.16
May 8, 2024 08:42:11.649239063 CEST	21	52330	38.239.154.176	192.168.2.16
May 8, 2024 08:42:11.649287939 CEST	52330	21	192.168.2.16	38.239.154.176
May 8, 2024 08:42:11.649336100 CEST	52330	21	192.168.2.16	38.239.154.176
May 8, 2024 08:42:11.649476051 CEST	52384	21	192.168.2.16	38.239.154.176
May 8, 2024 08:42:11.660314083 CEST	52256	2121	192.168.2.16	92.116.148.136
May 8, 2024 08:42:11.660466909 CEST	2121	52199	96.126.118.190	192.168.2.16
May 8, 2024 08:42:11.660820007 CEST	52199	2121	192.168.2.16	96.126.118.190
May 8, 2024 08:42:11.669864893 CEST	21	52358	34.149.79.8	192.168.2.16
May 8, 2024 08:42:11.670203924 CEST	21	52373	34.149.79.8	192.168.2.16
May 8, 2024 08:42:11.670262098 CEST	52373	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:11.677886009 CEST	52338	21	192.168.2.16	124.218.36.10
May 8, 2024 08:42:11.679467916 CEST	2121	52359	34.149.79.8	192.168.2.16
May 8, 2024 08:42:11.679542065 CEST	2121	52374	34.149.79.8	192.168.2.16
May 8, 2024 08:42:11.679584980 CEST	52374	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:11.681907892 CEST	52059	21	192.168.2.16	62.140.135.146
May 8, 2024 08:42:11.682817936 CEST	21	52262	196.210.0.111	192.168.2.16
May 8, 2024 08:42:11.682920933 CEST	52262	21	192.168.2.16	196.210.0.111
May 8, 2024 08:42:11.683105946 CEST	52386	21	192.168.2.16	196.210.0.111
May 8, 2024 08:42:11.689719915 CEST	21	52362	171.244.37.116	192.168.2.16
May 8, 2024 08:42:11.689766884 CEST	52362	21	192.168.2.16	171.244.37.116
May 8, 2024 08:42:11.697892904 CEST	52259	2121	192.168.2.16	142.11.215.85
May 8, 2024 08:42:11.697894096 CEST	52243	21	192.168.2.16	153.142.206.60
May 8, 2024 08:42:11.697901964 CEST	52339	2121	192.168.2.16	124.218.36.10
May 8, 2024 08:42:11.708302975 CEST	21	52312	171.244.37.116	192.168.2.16
May 8, 2024 08:42:11.708314896 CEST	21	52312	171.244.37.116	192.168.2.16
May 8, 2024 08:42:11.708353043 CEST	52312	21	192.168.2.16	171.244.37.116
May 8, 2024 08:42:11.713908911 CEST	52260	21	192.168.2.16	192.241.123.5
May 8, 2024 08:42:11.713924885 CEST	21	52055	120.24.160.35	192.168.2.16
May 8, 2024 08:42:11.713963032 CEST	52055	21	192.168.2.16	120.24.160.35
May 8, 2024 08:42:11.721745014 CEST	21	52364	120.24.160.35	192.168.2.16
May 8, 2024 08:42:11.721808910 CEST	52364	21	192.168.2.16	120.24.160.35
May 8, 2024 08:42:11.727030039 CEST	21	52055	120.24.160.35	192.168.2.16
May 8, 2024 08:42:11.727077961 CEST	52055	21	192.168.2.16	120.24.160.35
May 8, 2024 08:42:11.727276087 CEST	21	52055	120.24.160.35	192.168.2.16
May 8, 2024 08:42:11.727308035 CEST	52055	21	192.168.2.16	120.24.160.35
May 8, 2024 08:42:11.729932070 CEST	52261	2121	192.168.2.16	192.241.123.5
May 8, 2024 08:42:11.730355978 CEST	52387	2121	192.168.2.16	78.150.98.19
May 8, 2024 08:42:11.730390072 CEST	52388	21	192.168.2.16	23.208.54.103
May 8, 2024 08:42:11.745919943 CEST	52349	21	192.168.2.16	112.163.110.99
May 8, 2024 08:42:11.746201038 CEST	52389	2121	192.168.2.16	23.208.54.103
May 8, 2024 08:42:11.761987925 CEST	52341	21	192.168.2.16	193.238.110.81
May 8, 2024 08:42:11.762733936 CEST	52390	21	192.168.2.16	101.115.94.168
May 8, 2024 08:42:11.762872934 CEST	52391	2121	192.168.2.16	211.87.151.249
May 8, 2024 08:42:11.762937069 CEST	52392	21	192.168.2.16	211.87.151.249
May 8, 2024 08:42:11.762990952 CEST	52393	2121	192.168.2.16	101.115.94.168
May 8, 2024 08:42:11.794142962 CEST	52394	21	192.168.2.16	71.167.147.190
May 8, 2024 08:42:11.799091101 CEST	21	52367	172.120.235.139	192.168.2.16
May 8, 2024 08:42:11.799216986 CEST	52367	21	192.168.2.16	172.120.235.139
May 8, 2024 08:42:11.810127020 CEST	52350	2121	192.168.2.16	112.163.110.99
May 8, 2024 08:42:11.810132027 CEST	52263	21	192.168.2.16	94.13.187.158
May 8, 2024 08:42:11.810220003 CEST	52395	2121	192.168.2.16	71.167.147.190
May 8, 2024 08:42:11.810290098 CEST	52396	21	192.168.2.16	213.209.135.181
May 8, 2024 08:42:11.825362921 CEST	21	52197	96.126.118.190	192.168.2.16
May 8, 2024 08:42:11.825835943 CEST	52197	21	192.168.2.16	96.126.118.190
May 8, 2024 08:42:11.825917959 CEST	52264	2121	192.168.2.16	94.13.187.158
May 8, 2024 08:42:11.832442045 CEST	21	52373	34.149.79.8	192.168.2.16
May 8, 2024 08:42:11.832505941 CEST	52373	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:11.832577944 CEST	52373	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:11.832766056 CEST	52398	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:11.841783047 CEST	2121	52374	34.149.79.8	192.168.2.16
May 8, 2024 08:42:11.841836929 CEST	52374	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:11.841905117 CEST	52267	21	192.168.2.16	113.109.212.89
May 8, 2024 08:42:11.842021942 CEST	52342	2121	192.168.2.16	193.238.110.81
May 8, 2024 08:42:11.842209101 CEST	52374	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:11.842561007 CEST	52400	2121	192.168.2.16	213.209.135.181
May 8, 2024 08:42:11.842565060 CEST	52399	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:11.842606068 CEST	52401	21	192.168.2.16	119.163.240.172
May 8, 2024 08:42:11.842613935 CEST	52402	2121	192.168.2.16	119.163.240.172
May 8, 2024 08:42:11.862658978 CEST	21	52360	84.44.255.254	192.168.2.16
May 8, 2024 08:42:11.862735987 CEST	52360	21	192.168.2.16	84.44.255.254
May 8, 2024 08:42:11.862782955 CEST	52360	21	192.168.2.16	84.44.255.254
May 8, 2024 08:42:11.862983942 CEST	52403	21	192.168.2.16	84.44.255.254
May 8, 2024 08:42:11.867084980 CEST	2121	52199	96.126.118.190	192.168.2.16
May 8, 2024 08:42:11.867449045 CEST	52199	2121	192.168.2.16	96.126.118.190
May 8, 2024 08:42:11.873900890 CEST	52345	21	192.168.2.16	141.134.38.81
May 8, 2024 08:42:11.874221087 CEST	52405	21	192.168.2.16	50.71.239.26
May 8, 2024 08:42:11.888015985 CEST	21	52376	51.38.57.28	192.168.2.16
May 8, 2024 08:42:11.888036013 CEST	21	52274	14.90.138.213	192.168.2.16
May 8, 2024 08:42:11.888175964 CEST	52376	21	192.168.2.16	51.38.57.28
May 8, 2024 08:42:11.888602018 CEST	21	52232	38.6.37.19	192.168.2.16
May 8, 2024 08:42:11.889933109 CEST	52346	2121	192.168.2.16	141.134.38.81
May 8, 2024 08:42:11.904963970 CEST	2121	52275	14.90.138.213	192.168.2.16
May 8, 2024 08:42:11.905930996 CEST	52347	21	192.168.2.16	173.16.214.83
May 8, 2024 08:42:11.906769991 CEST	52406	2121	192.168.2.16	50.71.239.26
May 8, 2024 08:42:11.906800985 CEST	52407	21	192.168.2.16	68.83.50.239
May 8, 2024 08:42:11.920263052 CEST	2121	52233	38.6.37.19	192.168.2.16
May 8, 2024 08:42:11.921932936 CEST	52348	2121	192.168.2.16	173.16.214.83
May 8, 2024 08:42:11.925199986 CEST	21	52066	51.38.57.28	192.168.2.16
May 8, 2024 08:42:11.937936068 CEST	52326	21	192.168.2.16	170.238.228.49
May 8, 2024 08:42:11.938431025 CEST	52408	2121	192.168.2.16	68.83.50.239
May 8, 2024 08:42:11.949013948 CEST	2121	52230	118.48.36.223	192.168.2.16
May 8, 2024 08:42:11.957978964 CEST	21	52231	118.48.36.223	192.168.2.16
May 8, 2024 08:42:11.970016956 CEST	52270	2121	192.168.2.16	113.109.212.89
May 8, 2024 08:42:11.970460892 CEST	52409	2121	192.168.2.16	187.8.95.189
May 8, 2024 08:42:11.970504045 CEST	52410	21	192.168.2.16	187.8.95.189
May 8, 2024 08:42:11.970820904 CEST	21	52330	38.239.154.176	192.168.2.16
May 8, 2024 08:42:11.970849991 CEST	52411	21	192.168.2.16	221.217.135.170
May 8, 2024 08:42:11.970985889 CEST	21	52384	38.239.154.176	192.168.2.16
May 8, 2024 08:42:11.971054077 CEST	52384	21	192.168.2.16	38.239.154.176
May 8, 2024 08:42:11.980905056 CEST	21	52367	172.120.235.139	192.168.2.16
May 8, 2024 08:42:11.981252909 CEST	21	52367	172.120.235.139	192.168.2.16
May 8, 2024 08:42:11.981393099 CEST	52367	21	192.168.2.16	172.120.235.139
May 8, 2024 08:42:11.986182928 CEST	52412	2121	192.168.2.16	221.217.135.170
May 8, 2024 08:42:11.989729881 CEST	21	52243	153.142.206.60	192.168.2.16
May 8, 2024 08:42:11.994687080 CEST	21	52373	34.149.79.8	192.168.2.16
May 8, 2024 08:42:11.995151043 CEST	21	52398	34.149.79.8	192.168.2.16
May 8, 2024 08:42:11.995244980 CEST	52398	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:12.000924110 CEST	52327	2121	192.168.2.16	170.238.228.49
May 8, 2024 08:42:12.001503944 CEST	52413	21	192.168.2.16	23.106.228.71
May 8, 2024 08:42:12.004292011 CEST	2121	52374	34.149.79.8	192.168.2.16
May 8, 2024 08:42:12.004991055 CEST	2121	52399	34.149.79.8	192.168.2.16
May 8, 2024 08:42:12.005067110 CEST	52399	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:12.016941071 CEST	52351	21	192.168.2.16	81.247.4.75
May 8, 2024 08:42:12.017332077 CEST	52414	2121	192.168.2.16	23.106.228.71
May 8, 2024 08:42:12.017383099 CEST	52415	21	192.168.2.16	136.146.3.38
May 8, 2024 08:42:12.032309055 CEST	21	52197	96.126.118.190	192.168.2.16
May 8, 2024 08:42:12.032880068 CEST	52197	21	192.168.2.16	96.126.118.190
May 8, 2024 08:42:12.032928944 CEST	52272	21	192.168.2.16	151.197.204.59
May 8, 2024 08:42:12.032941103 CEST	52354	21	192.168.2.16	203.229.48.78
May 8, 2024 08:42:12.032944918 CEST	52352	2121	192.168.2.16	203.229.48.78
May 8, 2024 08:42:12.032948017 CEST	52353	2121	192.168.2.16	81.247.4.75
May 8, 2024 08:42:12.033258915 CEST	52417	2121	192.168.2.16	136.146.3.38
May 8, 2024 08:42:12.041366100 CEST	21	52362	171.244.37.116	192.168.2.16
May 8, 2024 08:42:12.041496038 CEST	52362	21	192.168.2.16	171.244.37.116
May 8, 2024 08:42:12.049355984 CEST	52418	21	192.168.2.16	68.61.201.86
May 8, 2024 08:42:12.053216934 CEST	21	52349	112.163.110.99	192.168.2.16
May 8, 2024 08:42:12.063915968 CEST	52306	2121	192.168.2.16	60.114.139.124
May 8, 2024 08:42:12.063946009 CEST	52307	21	192.168.2.16	60.114.139.124
May 8, 2024 08:42:12.063951015 CEST	52265	21	192.168.2.16	126.217.92.175
May 8, 2024 08:42:12.064450979 CEST	52419	2121	192.168.2.16	68.61.201.86
May 8, 2024 08:42:12.064507961 CEST	52420	21	192.168.2.16	81.40.233.239
May 8, 2024 08:42:12.066103935 CEST	21	52364	120.24.160.35	192.168.2.16
May 8, 2024 08:42:12.066273928 CEST	52364	21	192.168.2.16	120.24.160.35
May 8, 2024 08:42:12.073924065 CEST	2121	52199	96.126.118.190	192.168.2.16
May 8, 2024 08:42:12.074410915 CEST	52199	2121	192.168.2.16	96.126.118.190
May 8, 2024 08:42:12.079917908 CEST	52296	2121	192.168.2.16	14.51.46.49
May 8, 2024 08:42:12.079924107 CEST	52356	21	192.168.2.16	182.218.102.189
May 8, 2024 08:42:12.079947948 CEST	52266	2121	192.168.2.16	126.217.92.175
May 8, 2024 08:42:12.079951048 CEST	52355	2121	192.168.2.16	182.218.102.189
May 8, 2024 08:42:12.080728054 CEST	52424	21	192.168.2.16	190.181.70.59
May 8, 2024 08:42:12.080749035 CEST	52422	2121	192.168.2.16	81.40.233.239
May 8, 2024 08:42:12.080766916 CEST	52423	2121	192.168.2.16	222.234.43.115
May 8, 2024 08:42:12.080766916 CEST	52425	21	192.168.2.16	222.234.43.115
May 8, 2024 08:42:12.095956087 CEST	52297	21	192.168.2.16	14.51.46.49
May 8, 2024 08:42:12.095957994 CEST	52273	2121	192.168.2.16	151.197.204.59
May 8, 2024 08:42:12.095968008 CEST	52295	2121	192.168.2.16	217.60.7.133
May 8, 2024 08:42:12.096457005 CEST	52426	2121	192.168.2.16	190.181.70.59
May 8, 2024 08:42:12.117889881 CEST	2121	52350	112.163.110.99	192.168.2.16
May 8, 2024 08:42:12.127907991 CEST	52357	21	192.168.2.16	42.233.42.32
May 8, 2024 08:42:12.128334045 CEST	52427	21	192.168.2.16	139.99.155.35
May 8, 2024 08:42:12.156578064 CEST	21	52396	213.209.135.181	192.168.2.16
May 8, 2024 08:42:12.157804966 CEST	21	52398	34.149.79.8	192.168.2.16
May 8, 2024 08:42:12.157882929 CEST	52398	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:12.157959938 CEST	52398	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:12.158201933 CEST	52428	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:12.164695024 CEST	21	52262	196.210.0.111	192.168.2.16
May 8, 2024 08:42:12.164751053 CEST	52262	21	192.168.2.16	196.210.0.111
May 8, 2024 08:42:12.167686939 CEST	2121	52399	34.149.79.8	192.168.2.16
May 8, 2024 08:42:12.167722940 CEST	21	52386	196.210.0.111	192.168.2.16
May 8, 2024 08:42:12.167753935 CEST	52399	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:12.167781115 CEST	52386	21	192.168.2.16	196.210.0.111
May 8, 2024 08:42:12.167982101 CEST	52399	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:12.168258905 CEST	52429	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:12.178950071 CEST	21	52403	84.44.255.254	192.168.2.16
May 8, 2024 08:42:12.179048061 CEST	52403	21	192.168.2.16	84.44.255.254
May 8, 2024 08:42:12.182460070 CEST	21	52360	84.44.255.254	192.168.2.16
May 8, 2024 08:42:12.191756010 CEST	21	52367	172.120.235.139	192.168.2.16
May 8, 2024 08:42:12.191991091 CEST	52367	21	192.168.2.16	172.120.235.139
May 8, 2024 08:42:12.192231894 CEST	52430	21	192.168.2.16	172.120.235.139
May 8, 2024 08:42:12.192563057 CEST	2121	52400	213.209.135.181	192.168.2.16
May 8, 2024 08:42:12.207700014 CEST	21	52376	51.38.57.28	192.168.2.16
May 8, 2024 08:42:12.207948923 CEST	52376	21	192.168.2.16	51.38.57.28
May 8, 2024 08:42:12.208380938 CEST	52431	2121	192.168.2.16	139.99.155.35
May 8, 2024 08:42:12.224169016 CEST	52432	21	192.168.2.16	91.146.97.65
May 8, 2024 08:42:12.239368916 CEST	21	52197	96.126.118.190	192.168.2.16
May 8, 2024 08:42:12.239773989 CEST	52197	21	192.168.2.16	96.126.118.190
May 8, 2024 08:42:12.239906073 CEST	52277	21	192.168.2.16	80.234.15.119
May 8, 2024 08:42:12.256458044 CEST	52434	21	192.168.2.16	92.195.99.36
May 8, 2024 08:42:12.272207022 CEST	52435	2121	192.168.2.16	92.195.99.36
May 8, 2024 08:42:12.281219006 CEST	2121	52199	96.126.118.190	192.168.2.16
May 8, 2024 08:42:12.281739950 CEST	52199	2121	192.168.2.16	96.126.118.190
May 8, 2024 08:42:12.287576914 CEST	52437	21	192.168.2.16	73.134.83.136
May 8, 2024 08:42:12.287806034 CEST	52439	21	192.168.2.16	50.45.81.25
May 8, 2024 08:42:12.287806988 CEST	52438	2121	192.168.2.16	73.134.83.136
May 8, 2024 08:42:12.290035963 CEST	21	52326	170.238.228.49	192.168.2.16
May 8, 2024 08:42:12.293996096 CEST	21	52384	38.239.154.176	192.168.2.16
May 8, 2024 08:42:12.294151068 CEST	52384	21	192.168.2.16	38.239.154.176
May 8, 2024 08:42:12.294162035 CEST	21	52413	23.106.228.71	192.168.2.16
May 8, 2024 08:42:12.294224977 CEST	52413	21	192.168.2.16	23.106.228.71
May 8, 2024 08:42:12.302964926 CEST	52361	2121	192.168.2.16	42.233.42.32
May 8, 2024 08:42:12.303397894 CEST	52440	2121	192.168.2.16	50.45.81.25
May 8, 2024 08:42:12.308672905 CEST	2121	52414	23.106.228.71	192.168.2.16
May 8, 2024 08:42:12.319251060 CEST	52441	21	192.168.2.16	71.218.252.24
May 8, 2024 08:42:12.321352959 CEST	21	52398	34.149.79.8	192.168.2.16
May 8, 2024 08:42:12.321645975 CEST	21	52428	34.149.79.8	192.168.2.16
May 8, 2024 08:42:12.321718931 CEST	52428	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:12.331526041 CEST	2121	52399	34.149.79.8	192.168.2.16
May 8, 2024 08:42:12.331538916 CEST	2121	52429	34.149.79.8	192.168.2.16
May 8, 2024 08:42:12.331605911 CEST	52429	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:12.362173080 CEST	2121	52327	170.238.228.49	192.168.2.16
May 8, 2024 08:42:12.362731934 CEST	2121	52306	60.114.139.124	192.168.2.16
May 8, 2024 08:42:12.362746000 CEST	21	52307	60.114.139.124	192.168.2.16
May 8, 2024 08:42:12.364057064 CEST	21	52265	126.217.92.175	192.168.2.16
May 8, 2024 08:42:12.364495039 CEST	52442	2121	192.168.2.16	71.218.252.24
May 8, 2024 08:42:12.375049114 CEST	21	52367	172.120.235.139	192.168.2.16
May 8, 2024 08:42:12.375061989 CEST	21	52430	172.120.235.139	192.168.2.16
May 8, 2024 08:42:12.375113010 CEST	52367	21	192.168.2.16	172.120.235.139
May 8, 2024 08:42:12.375150919 CEST	52430	21	192.168.2.16	172.120.235.139
May 8, 2024 08:42:12.380409002 CEST	2121	52423	222.234.43.115	192.168.2.16
May 8, 2024 08:42:12.381580114 CEST	2121	52266	126.217.92.175	192.168.2.16
May 8, 2024 08:42:12.381947994 CEST	52443	21	192.168.2.16	108.190.27.147
May 8, 2024 08:42:12.382924080 CEST	52363	21	192.168.2.16	24.194.149.253
May 8, 2024 08:42:12.382925034 CEST	52366	21	192.168.2.16	75.80.244.38
May 8, 2024 08:42:12.382924080 CEST	52281	2121	192.168.2.16	80.234.15.119
May 8, 2024 08:42:12.382939100 CEST	52282	21	192.168.2.16	76.31.14.147
May 8, 2024 08:42:12.382940054 CEST	52365	2121	192.168.2.16	24.194.149.253
May 8, 2024 08:42:12.392757893 CEST	21	52362	171.244.37.116	192.168.2.16
May 8, 2024 08:42:12.392926931 CEST	52362	21	192.168.2.16	171.244.37.116
May 8, 2024 08:42:12.393699884 CEST	2121	52296	14.51.46.49	192.168.2.16
May 8, 2024 08:42:12.398936987 CEST	52368	2121	192.168.2.16	75.80.244.38
May 8, 2024 08:42:12.399915934 CEST	52274	21	192.168.2.16	14.90.138.213
May 8, 2024 08:42:12.410352945 CEST	21	52297	14.51.46.49	192.168.2.16
May 8, 2024 08:42:12.413208008 CEST	2121	52295	217.60.7.133	192.168.2.16
May 8, 2024 08:42:12.413316965 CEST	21	52364	120.24.160.35	192.168.2.16
May 8, 2024 08:42:12.413425922 CEST	21	52364	120.24.160.35	192.168.2.16
May 8, 2024 08:42:12.413618088 CEST	52364	21	192.168.2.16	120.24.160.35
May 8, 2024 08:42:12.414951086 CEST	52369	21	192.168.2.16	189.243.100.126
May 8, 2024 08:42:12.414952993 CEST	52275	2121	192.168.2.16	14.90.138.213
May 8, 2024 08:42:12.415410995 CEST	52444	2121	192.168.2.16	108.190.27.147
May 8, 2024 08:42:12.446378946 CEST	21	52197	96.126.118.190	192.168.2.16
May 8, 2024 08:42:12.446902990 CEST	52197	21	192.168.2.16	96.126.118.190
May 8, 2024 08:42:12.447235107 CEST	52446	21	192.168.2.16	64.98.100.10
May 8, 2024 08:42:12.478940010 CEST	52283	2121	192.168.2.16	76.31.14.147
May 8, 2024 08:42:12.480005980 CEST	21	52207	23.229.188.101	192.168.2.16
May 8, 2024 08:42:12.480180979 CEST	52207	21	192.168.2.16	23.229.188.101
May 8, 2024 08:42:12.480496883 CEST	52447	21	192.168.2.16	23.229.188.101
May 8, 2024 08:42:12.484950066 CEST	21	52428	34.149.79.8	192.168.2.16
May 8, 2024 08:42:12.485029936 CEST	52428	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:12.485107899 CEST	52428	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:12.485358000 CEST	52448	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:12.488194942 CEST	2121	52199	96.126.118.190	192.168.2.16
May 8, 2024 08:42:12.488647938 CEST	52199	2121	192.168.2.16	96.126.118.190
May 8, 2024 08:42:12.493813992 CEST	2121	52429	34.149.79.8	192.168.2.16
May 8, 2024 08:42:12.493902922 CEST	52429	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:12.494014978 CEST	52429	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:12.494319916 CEST	52450	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:12.495045900 CEST	21	52403	84.44.255.254	192.168.2.16
May 8, 2024 08:42:12.495110035 CEST	52403	21	192.168.2.16	84.44.255.254
May 8, 2024 08:42:12.495187998 CEST	52403	21	192.168.2.16	84.44.255.254
May 8, 2024 08:42:12.495423079 CEST	52451	21	192.168.2.16	84.44.255.254
May 8, 2024 08:42:12.510948896 CEST	52372	2121	192.168.2.16	189.243.100.126
May 8, 2024 08:42:12.525784969 CEST	21	52376	51.38.57.28	192.168.2.16
May 8, 2024 08:42:12.525798082 CEST	21	52376	51.38.57.28	192.168.2.16
May 8, 2024 08:42:12.526005983 CEST	52376	21	192.168.2.16	51.38.57.28
May 8, 2024 08:42:12.526943922 CEST	52375	21	192.168.2.16	52.130.182.124
May 8, 2024 08:42:12.533305883 CEST	21	52322	46.34.34.117	192.168.2.16
May 8, 2024 08:42:12.533485889 CEST	52322	21	192.168.2.16	46.34.34.117
May 8, 2024 08:42:12.533755064 CEST	52452	21	192.168.2.16	46.34.34.117
May 8, 2024 08:42:12.542283058 CEST	21	52286	117.223.205.236	192.168.2.16
May 8, 2024 08:42:12.542440891 CEST	52286	21	192.168.2.16	117.223.205.236
May 8, 2024 08:42:12.542624950 CEST	52453	21	192.168.2.16	117.223.205.236
May 8, 2024 08:42:12.548847914 CEST	21	52294	217.60.7.133	192.168.2.16
May 8, 2024 08:42:12.558934927 CEST	52284	21	192.168.2.16	109.193.13.3
May 8, 2024 08:42:12.558940887 CEST	52349	21	192.168.2.16	112.163.110.99
May 8, 2024 08:42:12.587325096 CEST	21	52413	23.106.228.71	192.168.2.16
May 8, 2024 08:42:12.587472916 CEST	52413	21	192.168.2.16	23.106.228.71
May 8, 2024 08:42:12.587723970 CEST	52454	2121	192.168.2.16	64.98.100.10
May 8, 2024 08:42:12.590928078 CEST	52288	2121	192.168.2.16	109.193.13.3
May 8, 2024 08:42:12.591018915 CEST	52289	21	192.168.2.16	94.208.110.104
May 8, 2024 08:42:12.596903086 CEST	52290	2121	192.168.2.16	94.208.110.104
May 8, 2024 08:42:12.597079992 CEST	52293	2121	192.168.2.16	174.80.147.247
May 8, 2024 08:42:12.597080946 CEST	52291	21	192.168.2.16	174.80.147.247
May 8, 2024 08:42:12.597635984 CEST	21	52430	172.120.235.139	192.168.2.16
May 8, 2024 08:42:12.597815990 CEST	52430	21	192.168.2.16	172.120.235.139
May 8, 2024 08:42:12.606925011 CEST	52378	21	192.168.2.16	149.224.220.82
May 8, 2024 08:42:12.606928110 CEST	52377	2121	192.168.2.16	52.130.182.124
May 8, 2024 08:42:12.614917040 CEST	52379	2121	192.168.2.16	149.224.220.82
May 8, 2024 08:42:12.615654945 CEST	21	52384	38.239.154.176	192.168.2.16
May 8, 2024 08:42:12.615763903 CEST	21	52384	38.239.154.176	192.168.2.16
May 8, 2024 08:42:12.615907907 CEST	52384	21	192.168.2.16	38.239.154.176
May 8, 2024 08:42:12.622900009 CEST	52299	2121	192.168.2.16	117.183.63.223
May 8, 2024 08:42:12.622914076 CEST	52298	21	192.168.2.16	117.183.63.223
May 8, 2024 08:42:12.622915030 CEST	52350	2121	192.168.2.16	112.163.110.99
May 8, 2024 08:42:12.622917891 CEST	52380	21	192.168.2.16	173.223.108.99
May 8, 2024 08:42:12.633953094 CEST	21	52443	108.190.27.147	192.168.2.16
May 8, 2024 08:42:12.638916969 CEST	52300	21	192.168.2.16	71.213.34.99
May 8, 2024 08:42:12.638919115 CEST	52382	2121	192.168.2.16	173.223.108.99
May 8, 2024 08:42:12.638921022 CEST	52383	21	192.168.2.16	78.150.98.19
May 8, 2024 08:42:12.638921022 CEST	52301	21	192.168.2.16	80.31.142.62
May 8, 2024 08:42:12.638921022 CEST	52302	21	192.168.2.16	189.238.13.141
May 8, 2024 08:42:12.638936043 CEST	52303	2121	192.168.2.16	71.213.34.99
May 8, 2024 08:42:12.642029047 CEST	52304	2121	192.168.2.16	80.31.142.62
May 8, 2024 08:42:12.647528887 CEST	21	52428	34.149.79.8	192.168.2.16
May 8, 2024 08:42:12.647759914 CEST	21	52448	34.149.79.8	192.168.2.16
May 8, 2024 08:42:12.647845984 CEST	52448	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:12.654915094 CEST	52308	21	192.168.2.16	85.136.244.223
May 8, 2024 08:42:12.655596972 CEST	21	52197	96.126.118.190	192.168.2.16
May 8, 2024 08:42:12.655633926 CEST	52309	2121	192.168.2.16	85.136.244.223
May 8, 2024 08:42:12.655800104 CEST	52197	21	192.168.2.16	96.126.118.190
May 8, 2024 08:42:12.655822992 CEST	52305	2121	192.168.2.16	189.238.13.141
May 8, 2024 08:42:12.659812927 CEST	2121	52429	34.149.79.8	192.168.2.16
May 8, 2024 08:42:12.659831047 CEST	2121	52450	34.149.79.8	192.168.2.16
May 8, 2024 08:42:12.659924984 CEST	52450	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:12.666027069 CEST	2121	52444	108.190.27.147	192.168.2.16
May 8, 2024 08:42:12.670938969 CEST	52396	21	192.168.2.16	213.209.135.181
May 8, 2024 08:42:12.675657988 CEST	21	52207	23.229.188.101	192.168.2.16
May 8, 2024 08:42:12.675687075 CEST	21	52447	23.229.188.101	192.168.2.16
May 8, 2024 08:42:12.675723076 CEST	52207	21	192.168.2.16	23.229.188.101
May 8, 2024 08:42:12.675745010 CEST	52310	21	192.168.2.16	88.8.158.250
May 8, 2024 08:42:12.675765038 CEST	52447	21	192.168.2.16	23.229.188.101
May 8, 2024 08:42:12.676393032 CEST	21	52207	23.229.188.101	192.168.2.16
May 8, 2024 08:42:12.676440001 CEST	52207	21	192.168.2.16	23.229.188.101
May 8, 2024 08:42:12.682400942 CEST	21	52386	196.210.0.111	192.168.2.16
May 8, 2024 08:42:12.682547092 CEST	52386	21	192.168.2.16	196.210.0.111
May 8, 2024 08:42:12.687263012 CEST	52455	21	192.168.2.16	174.74.200.173
May 8, 2024 08:42:12.695137978 CEST	2121	52199	96.126.118.190	192.168.2.16
May 8, 2024 08:42:12.695328951 CEST	52199	2121	192.168.2.16	96.126.118.190
May 8, 2024 08:42:12.702931881 CEST	52400	2121	192.168.2.16	213.209.135.181
May 8, 2024 08:42:12.717567921 CEST	21	52274	14.90.138.213	192.168.2.16
May 8, 2024 08:42:12.734488010 CEST	2121	52275	14.90.138.213	192.168.2.16
May 8, 2024 08:42:12.734944105 CEST	52387	2121	192.168.2.16	78.150.98.19
May 8, 2024 08:42:12.735225916 CEST	52456	2121	192.168.2.16	174.74.200.173
May 8, 2024 08:42:12.735227108 CEST	52388	21	192.168.2.16	23.208.54.103
May 8, 2024 08:42:12.735258102 CEST	52457	21	192.168.2.16	91.12.174.73
May 8, 2024 08:42:12.744831085 CEST	21	52362	171.244.37.116	192.168.2.16
May 8, 2024 08:42:12.744999886 CEST	52362	21	192.168.2.16	171.244.37.116
May 8, 2024 08:42:12.745237112 CEST	52458	21	192.168.2.16	171.244.37.116
May 8, 2024 08:42:12.750941038 CEST	52389	2121	192.168.2.16	23.208.54.103
May 8, 2024 08:42:12.766951084 CEST	52390	21	192.168.2.16	101.115.94.168
May 8, 2024 08:42:12.766951084 CEST	52391	2121	192.168.2.16	211.87.151.249
May 8, 2024 08:42:12.767656088 CEST	52393	2121	192.168.2.16	101.115.94.168
May 8, 2024 08:42:12.767656088 CEST	52392	21	192.168.2.16	211.87.151.249
May 8, 2024 08:42:12.767656088 CEST	52459	2121	192.168.2.16	91.12.174.73
May 8, 2024 08:42:12.769936085 CEST	21	52066	51.38.57.28	192.168.2.16
May 8, 2024 08:42:12.769947052 CEST	21	52066	51.38.57.28	192.168.2.16
May 8, 2024 08:42:12.770006895 CEST	52066	21	192.168.2.16	51.38.57.28
May 8, 2024 08:42:12.770030975 CEST	52066	21	192.168.2.16	51.38.57.28
May 8, 2024 08:42:12.770515919 CEST	21	52066	51.38.57.28	192.168.2.16
May 8, 2024 08:42:12.770555973 CEST	52066	21	192.168.2.16	51.38.57.28
May 8, 2024 08:42:12.779566050 CEST	21	52430	172.120.235.139	192.168.2.16
May 8, 2024 08:42:12.779861927 CEST	21	52430	172.120.235.139	192.168.2.16
May 8, 2024 08:42:12.780045033 CEST	52430	21	192.168.2.16	172.120.235.139
May 8, 2024 08:42:12.783327103 CEST	52460	21	192.168.2.16	217.224.163.247
May 8, 2024 08:42:12.795834064 CEST	21	52364	120.24.160.35	192.168.2.16
May 8, 2024 08:42:12.798954010 CEST	52326	21	192.168.2.16	170.238.228.49
May 8, 2024 08:42:12.801567078 CEST	52394	21	192.168.2.16	71.167.147.190
May 8, 2024 08:42:12.810386896 CEST	21	52448	34.149.79.8	192.168.2.16
May 8, 2024 08:42:12.810481071 CEST	52448	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:12.810570955 CEST	52448	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:12.810810089 CEST	52461	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:12.814402103 CEST	21	52403	84.44.255.254	192.168.2.16
May 8, 2024 08:42:12.815175056 CEST	52414	2121	192.168.2.16	23.106.228.71
May 8, 2024 08:42:12.815577984 CEST	52395	2121	192.168.2.16	71.167.147.190
May 8, 2024 08:42:12.815577984 CEST	52462	2121	192.168.2.16	217.224.163.247
May 8, 2024 08:42:12.818324089 CEST	21	52451	84.44.255.254	192.168.2.16
May 8, 2024 08:42:12.818418980 CEST	52451	21	192.168.2.16	84.44.255.254
May 8, 2024 08:42:12.822149992 CEST	2121	52450	34.149.79.8	192.168.2.16
May 8, 2024 08:42:12.822207928 CEST	52450	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:12.822323084 CEST	52450	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:12.822596073 CEST	52463	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:12.831283092 CEST	52464	21	192.168.2.16	93.199.145.206
May 8, 2024 08:42:12.846940994 CEST	52402	2121	192.168.2.16	119.163.240.172
May 8, 2024 08:42:12.847253084 CEST	52465	2121	192.168.2.16	93.199.145.206
May 8, 2024 08:42:12.849895000 CEST	52401	21	192.168.2.16	119.163.240.172
May 8, 2024 08:42:12.862271070 CEST	21	52197	96.126.118.190	192.168.2.16
May 8, 2024 08:42:12.862848997 CEST	52197	21	192.168.2.16	96.126.118.190
May 8, 2024 08:42:12.862965107 CEST	52306	2121	192.168.2.16	60.114.139.124
May 8, 2024 08:42:12.862978935 CEST	52307	21	192.168.2.16	60.114.139.124
May 8, 2024 08:42:12.862998962 CEST	52327	2121	192.168.2.16	170.238.228.49
May 8, 2024 08:42:12.863090992 CEST	52467	21	192.168.2.16	96.126.118.190
May 8, 2024 08:42:12.863413095 CEST	52468	21	192.168.2.16	165.225.117.193
May 8, 2024 08:42:12.865880966 CEST	21	52349	112.163.110.99	192.168.2.16
May 8, 2024 08:42:12.868689060 CEST	21	52452	46.34.34.117	192.168.2.16
May 8, 2024 08:42:12.868757963 CEST	52452	21	192.168.2.16	46.34.34.117
May 8, 2024 08:42:12.872241974 CEST	21	52447	23.229.188.101	192.168.2.16
May 8, 2024 08:42:12.872437954 CEST	52447	21	192.168.2.16	23.229.188.101
May 8, 2024 08:42:12.875116110 CEST	21	52322	46.34.34.117	192.168.2.16
May 8, 2024 08:42:12.875173092 CEST	52322	21	192.168.2.16	46.34.34.117
May 8, 2024 08:42:12.878959894 CEST	52405	21	192.168.2.16	50.71.239.26
May 8, 2024 08:42:12.881200075 CEST	21	52376	51.38.57.28	192.168.2.16
May 8, 2024 08:42:12.883219957 CEST	21	52413	23.106.228.71	192.168.2.16
May 8, 2024 08:42:12.883274078 CEST	52413	21	192.168.2.16	23.106.228.71
May 8, 2024 08:42:12.894917011 CEST	52423	2121	192.168.2.16	222.234.43.115
May 8, 2024 08:42:12.896457911 CEST	52296	2121	192.168.2.16	14.51.46.49
May 8, 2024 08:42:12.901755095 CEST	2121	52199	96.126.118.190	192.168.2.16
May 8, 2024 08:42:12.902268887 CEST	52199	2121	192.168.2.16	96.126.118.190
May 8, 2024 08:42:12.902441978 CEST	52470	2121	192.168.2.16	96.126.118.190
May 8, 2024 08:42:12.910907984 CEST	52406	2121	192.168.2.16	50.71.239.26
May 8, 2024 08:42:12.910933018 CEST	52407	21	192.168.2.16	68.83.50.239
May 8, 2024 08:42:12.910940886 CEST	52297	21	192.168.2.16	14.51.46.49
May 8, 2024 08:42:12.911344051 CEST	52471	2121	192.168.2.16	165.225.117.193
May 8, 2024 08:42:12.926914930 CEST	52315	2121	192.168.2.16	88.8.158.250
May 8, 2024 08:42:12.927160978 CEST	52472	21	192.168.2.16	13.73.2.38
May 8, 2024 08:42:12.927257061 CEST	52295	2121	192.168.2.16	217.60.7.133
May 8, 2024 08:42:12.930624008 CEST	2121	52350	112.163.110.99	192.168.2.16
May 8, 2024 08:42:12.942507029 CEST	21	52384	38.239.154.176	192.168.2.16
May 8, 2024 08:42:12.942687988 CEST	52384	21	192.168.2.16	38.239.154.176
May 8, 2024 08:42:12.942907095 CEST	52316	21	192.168.2.16	123.112.188.163
May 8, 2024 08:42:12.942912102 CEST	52473	21	192.168.2.16	38.239.154.176
May 8, 2024 08:42:12.942929029 CEST	52408	2121	192.168.2.16	68.83.50.239
May 8, 2024 08:42:12.942934036 CEST	51802	21	192.168.2.16	91.146.97.65
May 8, 2024 08:42:12.943164110 CEST	21	52384	38.239.154.176	192.168.2.16
May 8, 2024 08:42:12.943223953 CEST	52384	21	192.168.2.16	38.239.154.176
May 8, 2024 08:42:12.973481894 CEST	21	52448	34.149.79.8	192.168.2.16
May 8, 2024 08:42:12.973772049 CEST	21	52461	34.149.79.8	192.168.2.16
May 8, 2024 08:42:12.973843098 CEST	52461	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:12.974910021 CEST	52411	21	192.168.2.16	221.217.135.170
May 8, 2024 08:42:12.974912882 CEST	52409	2121	192.168.2.16	187.8.95.189
May 8, 2024 08:42:12.975754023 CEST	52410	21	192.168.2.16	187.8.95.189
May 8, 2024 08:42:12.985136032 CEST	2121	52450	34.149.79.8	192.168.2.16
May 8, 2024 08:42:12.985563993 CEST	2121	52463	34.149.79.8	192.168.2.16
May 8, 2024 08:42:12.985642910 CEST	52463	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:12.989814997 CEST	21	52430	172.120.235.139	192.168.2.16
May 8, 2024 08:42:12.989964962 CEST	52430	21	192.168.2.16	172.120.235.139
May 8, 2024 08:42:12.990225077 CEST	52474	21	192.168.2.16	172.120.235.139
May 8, 2024 08:42:12.990930080 CEST	52412	2121	192.168.2.16	221.217.135.170
May 8, 2024 08:42:13.017904997 CEST	21	52396	213.209.135.181	192.168.2.16
May 8, 2024 08:42:13.022929907 CEST	52415	21	192.168.2.16	136.146.3.38
May 8, 2024 08:42:13.038939953 CEST	52417	2121	192.168.2.16	136.146.3.38
May 8, 2024 08:42:13.038944006 CEST	52318	2121	192.168.2.16	123.112.188.163
May 8, 2024 08:42:13.053000927 CEST	2121	52400	213.209.135.181	192.168.2.16
May 8, 2024 08:42:13.054920912 CEST	52294	21	192.168.2.16	217.60.7.133
May 8, 2024 08:42:13.054938078 CEST	52418	21	192.168.2.16	68.61.201.86
May 8, 2024 08:42:13.068123102 CEST	21	52447	23.229.188.101	192.168.2.16
May 8, 2024 08:42:13.068200111 CEST	21	52447	23.229.188.101	192.168.2.16
May 8, 2024 08:42:13.068437099 CEST	52447	21	192.168.2.16	23.229.188.101
May 8, 2024 08:42:13.068763971 CEST	21	52467	96.126.118.190	192.168.2.16
May 8, 2024 08:42:13.068841934 CEST	52467	21	192.168.2.16	96.126.118.190
May 8, 2024 08:42:13.070926905 CEST	52420	21	192.168.2.16	81.40.233.239
May 8, 2024 08:42:13.070946932 CEST	52419	2121	192.168.2.16	68.61.201.86
May 8, 2024 08:42:13.070950985 CEST	52320	2121	192.168.2.16	120.27.208.231
May 8, 2024 08:42:13.070950985 CEST	52319	21	192.168.2.16	120.27.208.231
May 8, 2024 08:42:13.080394030 CEST	21	52286	117.223.205.236	192.168.2.16
May 8, 2024 08:42:13.080461025 CEST	52286	21	192.168.2.16	117.223.205.236
May 8, 2024 08:42:13.080595016 CEST	21	52453	117.223.205.236	192.168.2.16
May 8, 2024 08:42:13.080670118 CEST	52453	21	192.168.2.16	117.223.205.236
May 8, 2024 08:42:13.086915016 CEST	52425	21	192.168.2.16	222.234.43.115
May 8, 2024 08:42:13.086932898 CEST	52422	2121	192.168.2.16	81.40.233.239
May 8, 2024 08:42:13.090034008 CEST	52424	21	192.168.2.16	190.181.70.59
May 8, 2024 08:42:13.091753006 CEST	21	52458	171.244.37.116	192.168.2.16
May 8, 2024 08:42:13.091831923 CEST	52458	21	192.168.2.16	171.244.37.116
May 8, 2024 08:42:13.096159935 CEST	21	52362	171.244.37.116	192.168.2.16
May 8, 2024 08:42:13.096172094 CEST	21	52362	171.244.37.116	192.168.2.16
May 8, 2024 08:42:13.096225023 CEST	52362	21	192.168.2.16	171.244.37.116
May 8, 2024 08:42:13.102952003 CEST	52321	21	192.168.2.16	78.58.170.246
May 8, 2024 08:42:13.103029013 CEST	52426	2121	192.168.2.16	190.181.70.59
May 8, 2024 08:42:13.103296041 CEST	52475	2121	192.168.2.16	13.73.2.38
May 8, 2024 08:42:13.105421066 CEST	2121	52414	23.106.228.71	192.168.2.16
May 8, 2024 08:42:13.108494043 CEST	2121	52470	96.126.118.190	192.168.2.16
May 8, 2024 08:42:13.108570099 CEST	52470	2121	192.168.2.16	96.126.118.190
May 8, 2024 08:42:13.111084938 CEST	21	52197	96.126.118.190	192.168.2.16
May 8, 2024 08:42:13.119388103 CEST	52476	21	192.168.2.16	40.75.106.85
May 8, 2024 08:42:13.134953022 CEST	52427	21	192.168.2.16	139.99.155.35
May 8, 2024 08:42:13.135296106 CEST	52443	21	192.168.2.16	108.190.27.147
May 8, 2024 08:42:13.135694027 CEST	52478	21	192.168.2.16	24.166.113.31
May 8, 2024 08:42:13.135730982 CEST	52479	21	192.168.2.16	100.37.12.121
May 8, 2024 08:42:13.135754108 CEST	52480	2121	192.168.2.16	24.166.113.31
May 8, 2024 08:42:13.135787010 CEST	52477	2121	192.168.2.16	40.75.106.85
May 8, 2024 08:42:13.136396885 CEST	21	52461	34.149.79.8	192.168.2.16
May 8, 2024 08:42:13.136447906 CEST	52461	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:13.136548042 CEST	52461	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:13.136732101 CEST	52481	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:13.138298035 CEST	21	52451	84.44.255.254	192.168.2.16
May 8, 2024 08:42:13.138355017 CEST	52451	21	192.168.2.16	84.44.255.254
May 8, 2024 08:42:13.138443947 CEST	52451	21	192.168.2.16	84.44.255.254
May 8, 2024 08:42:13.138672113 CEST	52482	21	192.168.2.16	84.44.255.254
May 8, 2024 08:42:13.148128986 CEST	2121	52463	34.149.79.8	192.168.2.16
May 8, 2024 08:42:13.148197889 CEST	52463	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:13.148324013 CEST	52463	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:13.148574114 CEST	52483	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:13.151082039 CEST	21	52326	170.238.228.49	192.168.2.16
May 8, 2024 08:42:13.151160002 CEST	2121	52199	96.126.118.190	192.168.2.16
May 8, 2024 08:42:13.160164118 CEST	2121	52306	60.114.139.124	192.168.2.16
May 8, 2024 08:42:13.160758018 CEST	21	52307	60.114.139.124	192.168.2.16
May 8, 2024 08:42:13.166910887 CEST	52444	2121	192.168.2.16	108.190.27.147
May 8, 2024 08:42:13.167617083 CEST	52486	21	192.168.2.16	178.90.187.168
May 8, 2024 08:42:13.167649984 CEST	52487	2121	192.168.2.16	104.1.61.99
May 8, 2024 08:42:13.167650938 CEST	52484	21	192.168.2.16	104.1.61.99
May 8, 2024 08:42:13.167826891 CEST	21	52386	196.210.0.111	192.168.2.16
May 8, 2024 08:42:13.167839050 CEST	21	52386	196.210.0.111	192.168.2.16
May 8, 2024 08:42:13.167851925 CEST	52485	2121	192.168.2.16	100.37.12.121
May 8, 2024 08:42:13.167989016 CEST	52386	21	192.168.2.16	196.210.0.111
May 8, 2024 08:42:13.171742916 CEST	21	52430	172.120.235.139	192.168.2.16
May 8, 2024 08:42:13.171803951 CEST	52430	21	192.168.2.16	172.120.235.139
May 8, 2024 08:42:13.171883106 CEST	21	52474	172.120.235.139	192.168.2.16
May 8, 2024 08:42:13.171946049 CEST	52474	21	192.168.2.16	172.120.235.139
May 8, 2024 08:42:13.183492899 CEST	52488	2121	192.168.2.16	38.154.133.22
May 8, 2024 08:42:13.183567047 CEST	52489	21	192.168.2.16	38.154.133.22
May 8, 2024 08:42:13.183595896 CEST	52490	2121	192.168.2.16	178.90.187.168
May 8, 2024 08:42:13.193166018 CEST	2121	52423	222.234.43.115	192.168.2.16
May 8, 2024 08:42:13.211221933 CEST	2121	52296	14.51.46.49	192.168.2.16
May 8, 2024 08:42:13.211719036 CEST	52491	21	192.168.2.16	20.76.243.166
May 8, 2024 08:42:13.214893103 CEST	52431	2121	192.168.2.16	139.99.155.35
May 8, 2024 08:42:13.217998981 CEST	21	52452	46.34.34.117	192.168.2.16
May 8, 2024 08:42:13.218370914 CEST	52452	21	192.168.2.16	46.34.34.117
May 8, 2024 08:42:13.223103046 CEST	2121	52327	170.238.228.49	192.168.2.16
May 8, 2024 08:42:13.225774050 CEST	21	52297	14.51.46.49	192.168.2.16
May 8, 2024 08:42:13.226372004 CEST	52492	2121	192.168.2.16	20.76.243.166
May 8, 2024 08:42:13.230914116 CEST	52432	21	192.168.2.16	91.146.97.65
May 8, 2024 08:42:13.230947018 CEST	52324	2121	192.168.2.16	78.58.170.246
May 8, 2024 08:42:13.231362104 CEST	52493	21	192.168.2.16	149.102.11.65
May 8, 2024 08:42:13.231389046 CEST	52494	2121	192.168.2.16	149.102.11.65
May 8, 2024 08:42:13.242763996 CEST	21	52473	38.239.154.176	192.168.2.16
May 8, 2024 08:42:13.242837906 CEST	52473	21	192.168.2.16	38.239.154.176
May 8, 2024 08:42:13.244467974 CEST	2121	52295	217.60.7.133	192.168.2.16
May 8, 2024 08:42:13.247833014 CEST	52496	2121	192.168.2.16	8.210.121.63
May 8, 2024 08:42:13.247849941 CEST	52495	21	192.168.2.16	8.210.121.63
May 8, 2024 08:42:13.247850895 CEST	52497	21	192.168.2.16	27.199.155.226
May 8, 2024 08:42:13.262911081 CEST	52434	21	192.168.2.16	92.195.99.36
May 8, 2024 08:42:13.263298035 CEST	52498	2121	192.168.2.16	27.199.155.226
May 8, 2024 08:42:13.263339043 CEST	52499	21	192.168.2.16	79.50.168.227
May 8, 2024 08:42:13.263451099 CEST	52500	2121	192.168.2.16	79.50.168.227
May 8, 2024 08:42:13.264276981 CEST	21	52384	38.239.154.176	192.168.2.16
May 8, 2024 08:42:13.278923988 CEST	52435	2121	192.168.2.16	92.195.99.36
May 8, 2024 08:42:13.279489040 CEST	52501	21	192.168.2.16	58.186.249.162
May 8, 2024 08:42:13.279674053 CEST	52502	2121	192.168.2.16	58.186.249.162
May 8, 2024 08:42:13.294919968 CEST	52437	21	192.168.2.16	73.134.83.136
May 8, 2024 08:42:13.294951916 CEST	52439	21	192.168.2.16	50.45.81.25
May 8, 2024 08:42:13.294953108 CEST	52328	21	192.168.2.16	34.117.50.102
May 8, 2024 08:42:13.294961929 CEST	52438	2121	192.168.2.16	73.134.83.136
May 8, 2024 08:42:13.295438051 CEST	52503	2121	192.168.2.16	121.148.8.80
May 8, 2024 08:42:13.295505047 CEST	52504	21	192.168.2.16	121.148.8.80
May 8, 2024 08:42:13.295561075 CEST	52505	21	192.168.2.16	86.4.188.93
May 8, 2024 08:42:13.300021887 CEST	21	52481	34.149.79.8	192.168.2.16
May 8, 2024 08:42:13.300086975 CEST	52481	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:13.300211906 CEST	21	52461	34.149.79.8	192.168.2.16
May 8, 2024 08:42:13.304522038 CEST	21	52447	23.229.188.101	192.168.2.16
May 8, 2024 08:42:13.304575920 CEST	52440	2121	192.168.2.16	50.45.81.25
May 8, 2024 08:42:13.311162949 CEST	52506	2121	192.168.2.16	86.4.188.93
May 8, 2024 08:42:13.311260939 CEST	52507	21	192.168.2.16	1.246.221.132
May 8, 2024 08:42:13.311989069 CEST	2121	52463	34.149.79.8	192.168.2.16
May 8, 2024 08:42:13.312648058 CEST	2121	52483	34.149.79.8	192.168.2.16
May 8, 2024 08:42:13.312707901 CEST	52483	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:13.326917887 CEST	52441	21	192.168.2.16	71.218.252.24
May 8, 2024 08:42:13.328320026 CEST	52329	2121	192.168.2.16	34.117.50.102
May 8, 2024 08:42:13.342942953 CEST	52331	21	192.168.2.16	38.207.205.17
May 8, 2024 08:42:13.374952078 CEST	52442	2121	192.168.2.16	71.218.252.24
May 8, 2024 08:42:13.374952078 CEST	52349	21	192.168.2.16	112.163.110.99
May 8, 2024 08:42:13.388079882 CEST	21	52443	108.190.27.147	192.168.2.16
May 8, 2024 08:42:13.394088030 CEST	21	52474	172.120.235.139	192.168.2.16
May 8, 2024 08:42:13.394404888 CEST	52474	21	192.168.2.16	172.120.235.139
May 8, 2024 08:42:13.407601118 CEST	52509	21	192.168.2.16	172.190.237.210
May 8, 2024 08:42:13.407603979 CEST	52508	2121	192.168.2.16	1.246.221.132
May 8, 2024 08:42:13.418020964 CEST	2121	52444	108.190.27.147	192.168.2.16
May 8, 2024 08:42:13.423465967 CEST	52510	2121	192.168.2.16	172.190.237.210
May 8, 2024 08:42:13.438836098 CEST	21	52458	171.244.37.116	192.168.2.16
May 8, 2024 08:42:13.438913107 CEST	52350	2121	192.168.2.16	112.163.110.99
May 8, 2024 08:42:13.439050913 CEST	52458	21	192.168.2.16	171.244.37.116
May 8, 2024 08:42:13.454906940 CEST	52332	2121	192.168.2.16	38.207.205.17
May 8, 2024 08:42:13.454916000 CEST	52446	21	192.168.2.16	64.98.100.10
May 8, 2024 08:42:13.455457926 CEST	52511	2121	192.168.2.16	62.99.82.15
May 8, 2024 08:42:13.455622911 CEST	52512	21	192.168.2.16	62.99.82.15
May 8, 2024 08:42:13.459539890 CEST	21	52482	84.44.255.254	192.168.2.16
May 8, 2024 08:42:13.459609032 CEST	52482	21	192.168.2.16	84.44.255.254
May 8, 2024 08:42:13.459822893 CEST	21	52451	84.44.255.254	192.168.2.16
May 8, 2024 08:42:13.462356091 CEST	21	52481	34.149.79.8	192.168.2.16
May 8, 2024 08:42:13.462400913 CEST	52481	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:13.462471962 CEST	52481	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:13.462642908 CEST	52513	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:13.471189976 CEST	52514	21	192.168.2.16	115.56.86.19
May 8, 2024 08:42:13.475194931 CEST	2121	52483	34.149.79.8	192.168.2.16
May 8, 2024 08:42:13.475254059 CEST	52483	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:13.475337982 CEST	52483	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:13.475563049 CEST	52515	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:13.503482103 CEST	52516	2121	192.168.2.16	115.56.86.19
May 8, 2024 08:42:13.503509045 CEST	52517	21	192.168.2.16	120.79.86.61
May 8, 2024 08:42:13.518970966 CEST	52396	21	192.168.2.16	213.209.135.181
May 8, 2024 08:42:13.519256115 CEST	52518	2121	192.168.2.16	120.79.86.61
May 8, 2024 08:42:13.521332026 CEST	2121	51402	96.126.118.190	192.168.2.16
May 8, 2024 08:42:13.521373034 CEST	21	51399	96.126.118.190	192.168.2.16
May 8, 2024 08:42:13.521384001 CEST	51402	2121	192.168.2.16	96.126.118.190
May 8, 2024 08:42:13.521411896 CEST	51399	21	192.168.2.16	96.126.118.190
May 8, 2024 08:42:13.535310984 CEST	52519	21	192.168.2.16	79.107.214.63
May 8, 2024 08:42:13.544065952 CEST	21	52473	38.239.154.176	192.168.2.16
May 8, 2024 08:42:13.544258118 CEST	52473	21	192.168.2.16	38.239.154.176
May 8, 2024 08:42:13.550951958 CEST	52058	2121	192.168.2.16	62.140.135.146
May 8, 2024 08:42:13.551475048 CEST	52520	21	192.168.2.16	104.107.13.22
May 8, 2024 08:42:13.551568031 CEST	52521	2121	192.168.2.16	104.107.13.22
May 8, 2024 08:42:13.551599979 CEST	52522	2121	192.168.2.16	79.107.214.63
May 8, 2024 08:42:13.558689117 CEST	21	52452	46.34.34.117	192.168.2.16
May 8, 2024 08:42:13.558708906 CEST	21	52452	46.34.34.117	192.168.2.16
May 8, 2024 08:42:13.558924913 CEST	52452	21	192.168.2.16	46.34.34.117
May 8, 2024 08:42:13.566931009 CEST	52400	2121	192.168.2.16	213.209.135.181
May 8, 2024 08:42:13.567157984 CEST	52523	21	192.168.2.16	118.87.14.32
May 8, 2024 08:42:13.567883968 CEST	21	52495	8.210.121.63	192.168.2.16
May 8, 2024 08:42:13.568566084 CEST	2121	52496	8.210.121.63	192.168.2.16
May 8, 2024 08:42:13.576031923 CEST	21	52453	117.223.205.236	192.168.2.16
May 8, 2024 08:42:13.576078892 CEST	21	52474	172.120.235.139	192.168.2.16
May 8, 2024 08:42:13.576185942 CEST	52453	21	192.168.2.16	117.223.205.236
May 8, 2024 08:42:13.576389074 CEST	21	52474	172.120.235.139	192.168.2.16
May 8, 2024 08:42:13.576472998 CEST	52474	21	192.168.2.16	172.120.235.139
May 8, 2024 08:42:13.583492994 CEST	52525	21	192.168.2.16	66.111.116.250
May 8, 2024 08:42:13.583493948 CEST	52524	2121	192.168.2.16	118.87.14.32
May 8, 2024 08:42:13.583589077 CEST	52526	2121	192.168.2.16	66.111.116.250
May 8, 2024 08:42:13.598792076 CEST	21	52507	1.246.221.132	192.168.2.16
May 8, 2024 08:42:13.598937988 CEST	52454	2121	192.168.2.16	64.98.100.10
May 8, 2024 08:42:13.598949909 CEST	52059	21	192.168.2.16	62.140.135.146
May 8, 2024 08:42:13.599298954 CEST	52527	21	192.168.2.16	208.113.228.78
May 8, 2024 08:42:13.603189945 CEST	2121	52502	58.186.249.162	192.168.2.16
May 8, 2024 08:42:13.604754925 CEST	2121	52500	79.50.168.227	192.168.2.16
May 8, 2024 08:42:13.607863903 CEST	21	52499	79.50.168.227	192.168.2.16
May 8, 2024 08:42:13.609131098 CEST	21	52501	58.186.249.162	192.168.2.16
May 8, 2024 08:42:13.613933086 CEST	2121	52503	121.148.8.80	192.168.2.16
May 8, 2024 08:42:13.614445925 CEST	21	52504	121.148.8.80	192.168.2.16
May 8, 2024 08:42:13.614931107 CEST	52414	2121	192.168.2.16	23.106.228.71
May 8, 2024 08:42:13.624625921 CEST	21	52481	34.149.79.8	192.168.2.16
May 8, 2024 08:42:13.625031948 CEST	21	52513	34.149.79.8	192.168.2.16
May 8, 2024 08:42:13.625093937 CEST	52513	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:13.637698889 CEST	2121	52483	34.149.79.8	192.168.2.16
May 8, 2024 08:42:13.637958050 CEST	2121	52515	34.149.79.8	192.168.2.16
May 8, 2024 08:42:13.638027906 CEST	52515	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:13.662955999 CEST	52326	21	192.168.2.16	170.238.228.49
May 8, 2024 08:42:13.663331985 CEST	52528	2121	192.168.2.16	208.113.228.78
May 8, 2024 08:42:13.682533026 CEST	21	52349	112.163.110.99	192.168.2.16
May 8, 2024 08:42:13.685372114 CEST	21	52386	196.210.0.111	192.168.2.16
May 8, 2024 08:42:13.692938089 CEST	52338	21	192.168.2.16	124.218.36.10
May 8, 2024 08:42:13.693034887 CEST	52455	21	192.168.2.16	174.74.200.173
May 8, 2024 08:42:13.693927050 CEST	52423	2121	192.168.2.16	222.234.43.115
May 8, 2024 08:42:13.694281101 CEST	52529	21	192.168.2.16	23.37.100.62
May 8, 2024 08:42:13.695115089 CEST	2121	52508	1.246.221.132	192.168.2.16
May 8, 2024 08:42:13.709927082 CEST	52339	2121	192.168.2.16	124.218.36.10
May 8, 2024 08:42:13.710232973 CEST	52530	2121	192.168.2.16	23.37.100.62
May 8, 2024 08:42:13.725928068 CEST	52327	2121	192.168.2.16	170.238.228.49
May 8, 2024 08:42:13.726344109 CEST	52531	21	192.168.2.16	177.173.125.137
May 8, 2024 08:42:13.741911888 CEST	52457	21	192.168.2.16	91.12.174.73
May 8, 2024 08:42:13.743366003 CEST	52456	2121	192.168.2.16	174.74.200.173
May 8, 2024 08:42:13.746414900 CEST	2121	52350	112.163.110.99	192.168.2.16
May 8, 2024 08:42:13.773931026 CEST	52459	2121	192.168.2.16	91.12.174.73
May 8, 2024 08:42:13.774022102 CEST	52341	21	192.168.2.16	193.238.110.81
May 8, 2024 08:42:13.779122114 CEST	21	52482	84.44.255.254	192.168.2.16
May 8, 2024 08:42:13.779192924 CEST	52482	21	192.168.2.16	84.44.255.254
May 8, 2024 08:42:13.779304981 CEST	52482	21	192.168.2.16	84.44.255.254
May 8, 2024 08:42:13.779599905 CEST	52532	21	192.168.2.16	84.44.255.254
May 8, 2024 08:42:13.785646915 CEST	21	52458	171.244.37.116	192.168.2.16
May 8, 2024 08:42:13.785824060 CEST	52458	21	192.168.2.16	171.244.37.116
May 8, 2024 08:42:13.785839081 CEST	21	52474	172.120.235.139	192.168.2.16
May 8, 2024 08:42:13.785964012 CEST	52474	21	192.168.2.16	172.120.235.139
May 8, 2024 08:42:13.786194086 CEST	52533	21	192.168.2.16	172.120.235.139
May 8, 2024 08:42:13.787481070 CEST	21	52513	34.149.79.8	192.168.2.16
May 8, 2024 08:42:13.787540913 CEST	52513	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:13.787595034 CEST	52513	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:13.787729025 CEST	52534	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:13.789938927 CEST	52460	21	192.168.2.16	217.224.163.247
May 8, 2024 08:42:13.801145077 CEST	2121	52515	34.149.79.8	192.168.2.16
May 8, 2024 08:42:13.801227093 CEST	52515	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:13.801328897 CEST	52515	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:13.801625013 CEST	52535	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:13.806263924 CEST	52536	2121	192.168.2.16	177.173.125.137
May 8, 2024 08:42:13.821921110 CEST	52462	2121	192.168.2.16	217.224.163.247
May 8, 2024 08:42:13.822518110 CEST	52537	21	192.168.2.16	125.149.109.253
May 8, 2024 08:42:13.836940050 CEST	52464	21	192.168.2.16	93.199.145.206
May 8, 2024 08:42:13.837351084 CEST	52538	2121	192.168.2.16	125.149.109.253
May 8, 2024 08:42:13.844135046 CEST	21	52473	38.239.154.176	192.168.2.16
May 8, 2024 08:42:13.844199896 CEST	21	52473	38.239.154.176	192.168.2.16
May 8, 2024 08:42:13.844358921 CEST	52473	21	192.168.2.16	38.239.154.176
May 8, 2024 08:42:13.852139950 CEST	21	52517	120.79.86.61	192.168.2.16
May 8, 2024 08:42:13.852936983 CEST	52465	2121	192.168.2.16	93.199.145.206
May 8, 2024 08:42:13.852936983 CEST	52342	2121	192.168.2.16	193.238.110.81
May 8, 2024 08:42:13.864546061 CEST	2121	52518	120.79.86.61	192.168.2.16
May 8, 2024 08:42:13.865324020 CEST	21	52396	213.209.135.181	192.168.2.16
May 8, 2024 08:42:13.879949093 CEST	52468	21	192.168.2.16	165.225.117.193
May 8, 2024 08:42:13.884949923 CEST	52345	21	192.168.2.16	141.134.38.81
May 8, 2024 08:42:13.900944948 CEST	52443	21	192.168.2.16	108.190.27.147
May 8, 2024 08:42:13.901043892 CEST	52195	21	192.168.2.16	77.75.121.3
May 8, 2024 08:42:13.901043892 CEST	52346	2121	192.168.2.16	141.134.38.81
May 8, 2024 08:42:13.901403904 CEST	52539	21	192.168.2.16	77.75.121.3
May 8, 2024 08:42:13.906383038 CEST	2121	52414	23.106.228.71	192.168.2.16
May 8, 2024 08:42:13.916924000 CEST	52471	2121	192.168.2.16	165.225.117.193
May 8, 2024 08:42:13.916963100 CEST	52347	21	192.168.2.16	173.16.214.83
May 8, 2024 08:42:13.916991949 CEST	2121	52400	213.209.135.181	192.168.2.16
May 8, 2024 08:42:13.928982973 CEST	21	52452	46.34.34.117	192.168.2.16
May 8, 2024 08:42:13.932940006 CEST	52472	21	192.168.2.16	13.73.2.38
May 8, 2024 08:42:13.932943106 CEST	52348	2121	192.168.2.16	173.16.214.83
May 8, 2024 08:42:13.932956934 CEST	52444	2121	192.168.2.16	108.190.27.147
May 8, 2024 08:42:13.949959040 CEST	21	52513	34.149.79.8	192.168.2.16
May 8, 2024 08:42:13.950130939 CEST	21	52534	34.149.79.8	192.168.2.16
May 8, 2024 08:42:13.950198889 CEST	52534	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:13.965217113 CEST	2121	52515	34.149.79.8	192.168.2.16
May 8, 2024 08:42:13.965365887 CEST	52540	21	192.168.2.16	91.179.69.230
May 8, 2024 08:42:13.965607882 CEST	2121	52535	34.149.79.8	192.168.2.16
May 8, 2024 08:42:13.965676069 CEST	52535	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:13.967736006 CEST	21	52474	172.120.235.139	192.168.2.16
May 8, 2024 08:42:13.967794895 CEST	52474	21	192.168.2.16	172.120.235.139
May 8, 2024 08:42:13.967858076 CEST	21	52533	172.120.235.139	192.168.2.16
May 8, 2024 08:42:13.967914104 CEST	52533	21	192.168.2.16	172.120.235.139
May 8, 2024 08:42:13.993978977 CEST	2121	52423	222.234.43.115	192.168.2.16
May 8, 2024 08:42:14.012931108 CEST	21	52326	170.238.228.49	192.168.2.16
May 8, 2024 08:42:14.013458014 CEST	52541	2121	192.168.2.16	91.179.69.230
May 8, 2024 08:42:14.029373884 CEST	52542	21	192.168.2.16	126.216.119.205
May 8, 2024 08:42:14.029376030 CEST	52351	21	192.168.2.16	81.247.4.75
May 8, 2024 08:42:14.044955015 CEST	52354	21	192.168.2.16	203.229.48.78
May 8, 2024 08:42:14.044959068 CEST	52352	2121	192.168.2.16	203.229.48.78
May 8, 2024 08:42:14.045182943 CEST	52353	2121	192.168.2.16	81.247.4.75
May 8, 2024 08:42:14.067337990 CEST	21	52453	117.223.205.236	192.168.2.16
May 8, 2024 08:42:14.071070910 CEST	21	52453	117.223.205.236	192.168.2.16
May 8, 2024 08:42:14.071345091 CEST	52453	21	192.168.2.16	117.223.205.236
May 8, 2024 08:42:14.075933933 CEST	52495	21	192.168.2.16	8.210.121.63
May 8, 2024 08:42:14.078042030 CEST	52496	2121	192.168.2.16	8.210.121.63
May 8, 2024 08:42:14.087371111 CEST	2121	52327	170.238.228.49	192.168.2.16
May 8, 2024 08:42:14.087898970 CEST	52543	2121	192.168.2.16	126.216.119.205
May 8, 2024 08:42:14.091923952 CEST	52356	21	192.168.2.16	182.218.102.189
May 8, 2024 08:42:14.091942072 CEST	52355	2121	192.168.2.16	182.218.102.189
May 8, 2024 08:42:14.092211962 CEST	52544	21	192.168.2.16	84.14.161.154
May 8, 2024 08:42:14.093643904 CEST	21	52531	177.173.125.137	192.168.2.16
May 8, 2024 08:42:14.095479012 CEST	21	52532	84.44.255.254	192.168.2.16
May 8, 2024 08:42:14.095551968 CEST	52532	21	192.168.2.16	84.44.255.254
May 8, 2024 08:42:14.098625898 CEST	21	52482	84.44.255.254	192.168.2.16
May 8, 2024 08:42:14.107918978 CEST	52507	21	192.168.2.16	1.246.221.132
May 8, 2024 08:42:14.107934952 CEST	52502	2121	192.168.2.16	58.186.249.162
May 8, 2024 08:42:14.107938051 CEST	52475	2121	192.168.2.16	13.73.2.38
May 8, 2024 08:42:14.107938051 CEST	52500	2121	192.168.2.16	79.50.168.227
May 8, 2024 08:42:14.112716913 CEST	21	52534	34.149.79.8	192.168.2.16
May 8, 2024 08:42:14.112776041 CEST	52534	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:14.112893105 CEST	52534	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:14.113178015 CEST	52545	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:14.122921944 CEST	52503	2121	192.168.2.16	121.148.8.80
May 8, 2024 08:42:14.122941971 CEST	52504	21	192.168.2.16	121.148.8.80
May 8, 2024 08:42:14.122945070 CEST	52476	21	192.168.2.16	40.75.106.85
May 8, 2024 08:42:14.122945070 CEST	52501	21	192.168.2.16	58.186.249.162
May 8, 2024 08:42:14.122946978 CEST	52499	21	192.168.2.16	79.50.168.227
May 8, 2024 08:42:14.128094912 CEST	2121	52535	34.149.79.8	192.168.2.16
May 8, 2024 08:42:14.128165960 CEST	52535	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:14.128273010 CEST	52535	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:14.128519058 CEST	52546	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:14.134943962 CEST	21	52458	171.244.37.116	192.168.2.16
May 8, 2024 08:42:14.135072947 CEST	52458	21	192.168.2.16	171.244.37.116
May 8, 2024 08:42:14.135258913 CEST	52547	21	192.168.2.16	171.244.37.116
May 8, 2024 08:42:14.137933969 CEST	52480	2121	192.168.2.16	24.166.113.31
May 8, 2024 08:42:14.137938023 CEST	52477	2121	192.168.2.16	40.75.106.85
May 8, 2024 08:42:14.137939930 CEST	52357	21	192.168.2.16	42.233.42.32
May 8, 2024 08:42:14.137939930 CEST	52479	21	192.168.2.16	100.37.12.121
May 8, 2024 08:42:14.138021946 CEST	52478	21	192.168.2.16	24.166.113.31
May 8, 2024 08:42:14.142852068 CEST	21	52537	125.149.109.253	192.168.2.16
May 8, 2024 08:42:14.146615028 CEST	21	52473	38.239.154.176	192.168.2.16
May 8, 2024 08:42:14.146912098 CEST	52473	21	192.168.2.16	38.239.154.176
May 8, 2024 08:42:14.147080898 CEST	52548	21	192.168.2.16	38.239.154.176
May 8, 2024 08:42:14.147155046 CEST	21	52473	38.239.154.176	192.168.2.16
May 8, 2024 08:42:14.147208929 CEST	52473	21	192.168.2.16	38.239.154.176
May 8, 2024 08:42:14.163321972 CEST	2121	52538	125.149.109.253	192.168.2.16
May 8, 2024 08:42:14.169970036 CEST	52487	2121	192.168.2.16	104.1.61.99
May 8, 2024 08:42:14.169974089 CEST	52485	2121	192.168.2.16	100.37.12.121
May 8, 2024 08:42:14.169975042 CEST	52486	21	192.168.2.16	178.90.187.168
May 8, 2024 08:42:14.169975042 CEST	52484	21	192.168.2.16	104.1.61.99
May 8, 2024 08:42:14.176446915 CEST	2121	52536	177.173.125.137	192.168.2.16
May 8, 2024 08:42:14.178071022 CEST	21	52443	108.190.27.147	192.168.2.16
May 8, 2024 08:42:14.185900927 CEST	52349	21	192.168.2.16	112.163.110.99
May 8, 2024 08:42:14.185920000 CEST	52488	2121	192.168.2.16	38.154.133.22
May 8, 2024 08:42:14.185920000 CEST	52489	21	192.168.2.16	38.154.133.22
May 8, 2024 08:42:14.186019897 CEST	52490	2121	192.168.2.16	178.90.187.168
May 8, 2024 08:42:14.187987089 CEST	2121	52444	108.190.27.147	192.168.2.16
May 8, 2024 08:42:14.188817024 CEST	21	52533	172.120.235.139	192.168.2.16
May 8, 2024 08:42:14.188973904 CEST	52533	21	192.168.2.16	172.120.235.139
May 8, 2024 08:42:14.201900005 CEST	52508	2121	192.168.2.16	1.246.221.132
May 8, 2024 08:42:14.211735010 CEST	21	52539	77.75.121.3	192.168.2.16
May 8, 2024 08:42:14.211817980 CEST	52539	21	192.168.2.16	77.75.121.3
May 8, 2024 08:42:14.217931032 CEST	52491	21	192.168.2.16	20.76.243.166
May 8, 2024 08:42:14.233901024 CEST	52492	2121	192.168.2.16	20.76.243.166
May 8, 2024 08:42:14.233925104 CEST	52493	21	192.168.2.16	149.102.11.65
May 8, 2024 08:42:14.233927011 CEST	52494	2121	192.168.2.16	149.102.11.65
May 8, 2024 08:42:14.234247923 CEST	52549	2121	192.168.2.16	84.14.161.154
May 8, 2024 08:42:14.249917984 CEST	52350	2121	192.168.2.16	112.163.110.99
May 8, 2024 08:42:14.249921083 CEST	52497	21	192.168.2.16	27.199.155.226
May 8, 2024 08:42:14.255780935 CEST	21	52195	77.75.121.3	192.168.2.16
May 8, 2024 08:42:14.265928030 CEST	52498	2121	192.168.2.16	27.199.155.226
May 8, 2024 08:42:14.275774002 CEST	21	52534	34.149.79.8	192.168.2.16
May 8, 2024 08:42:14.275788069 CEST	21	52545	34.149.79.8	192.168.2.16
May 8, 2024 08:42:14.275863886 CEST	52545	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:14.292325974 CEST	2121	52535	34.149.79.8	192.168.2.16
May 8, 2024 08:42:14.292503119 CEST	2121	52546	34.149.79.8	192.168.2.16
May 8, 2024 08:42:14.292571068 CEST	52546	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:14.295397997 CEST	21	52294	217.60.7.133	192.168.2.16
May 8, 2024 08:42:14.297933102 CEST	52505	21	192.168.2.16	86.4.188.93
May 8, 2024 08:42:14.314172029 CEST	52506	2121	192.168.2.16	86.4.188.93
May 8, 2024 08:42:14.314178944 CEST	52361	2121	192.168.2.16	42.233.42.32
May 8, 2024 08:42:14.325824976 CEST	21	52542	126.216.119.205	192.168.2.16
May 8, 2024 08:42:14.361953974 CEST	52517	21	192.168.2.16	120.79.86.61
May 8, 2024 08:42:14.371234894 CEST	21	52533	172.120.235.139	192.168.2.16
May 8, 2024 08:42:14.371634960 CEST	21	52533	172.120.235.139	192.168.2.16
May 8, 2024 08:42:14.371803045 CEST	52533	21	192.168.2.16	172.120.235.139
May 8, 2024 08:42:14.377954006 CEST	52518	2121	192.168.2.16	120.79.86.61
May 8, 2024 08:42:14.377954960 CEST	52396	21	192.168.2.16	213.209.135.181
May 8, 2024 08:42:14.378463984 CEST	52550	21	192.168.2.16	117.196.164.98
May 8, 2024 08:42:14.378490925 CEST	52551	2121	192.168.2.16	117.196.164.98
May 8, 2024 08:42:14.384953976 CEST	2121	52543	126.216.119.205	192.168.2.16
May 8, 2024 08:42:14.393937111 CEST	52363	21	192.168.2.16	24.194.149.253
May 8, 2024 08:42:14.394021988 CEST	52366	21	192.168.2.16	75.80.244.38
May 8, 2024 08:42:14.394025087 CEST	52365	2121	192.168.2.16	24.194.149.253
May 8, 2024 08:42:14.395773888 CEST	21	52507	1.246.221.132	192.168.2.16
May 8, 2024 08:42:14.396701097 CEST	21	52495	8.210.121.63	192.168.2.16
May 8, 2024 08:42:14.398741007 CEST	2121	52496	8.210.121.63	192.168.2.16
May 8, 2024 08:42:14.409990072 CEST	52368	2121	192.168.2.16	75.80.244.38
May 8, 2024 08:42:14.409991980 CEST	52414	2121	192.168.2.16	23.106.228.71
May 8, 2024 08:42:14.410023928 CEST	52509	21	192.168.2.16	172.190.237.210
May 8, 2024 08:42:14.412233114 CEST	21	52532	84.44.255.254	192.168.2.16
May 8, 2024 08:42:14.412303925 CEST	52532	21	192.168.2.16	84.44.255.254
May 8, 2024 08:42:14.412476063 CEST	52532	21	192.168.2.16	84.44.255.254
May 8, 2024 08:42:14.414565086 CEST	52552	21	192.168.2.16	84.44.255.254
May 8, 2024 08:42:14.425947905 CEST	52369	21	192.168.2.16	189.243.100.126
May 8, 2024 08:42:14.425951004 CEST	52400	2121	192.168.2.16	213.209.135.181
May 8, 2024 08:42:14.426031113 CEST	52510	2121	192.168.2.16	172.190.237.210
May 8, 2024 08:42:14.433902979 CEST	2121	52502	58.186.249.162	192.168.2.16
May 8, 2024 08:42:14.438788891 CEST	21	52545	34.149.79.8	192.168.2.16
May 8, 2024 08:42:14.438858986 CEST	52545	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:14.438955069 CEST	52545	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:14.439214945 CEST	52553	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:14.442042112 CEST	2121	52503	121.148.8.80	192.168.2.16
May 8, 2024 08:42:14.442472935 CEST	21	52504	121.148.8.80	192.168.2.16
May 8, 2024 08:42:14.447474957 CEST	21	52473	38.239.154.176	192.168.2.16
May 8, 2024 08:42:14.447868109 CEST	21	52548	38.239.154.176	192.168.2.16
May 8, 2024 08:42:14.447933912 CEST	52548	21	192.168.2.16	38.239.154.176
May 8, 2024 08:42:14.450346947 CEST	2121	52500	79.50.168.227	192.168.2.16
May 8, 2024 08:42:14.453094006 CEST	21	52501	58.186.249.162	192.168.2.16
May 8, 2024 08:42:14.457043886 CEST	2121	52546	34.149.79.8	192.168.2.16
May 8, 2024 08:42:14.457108021 CEST	52546	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:14.457221985 CEST	52546	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:14.457516909 CEST	52554	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:14.457916021 CEST	52511	2121	192.168.2.16	62.99.82.15
May 8, 2024 08:42:14.457935095 CEST	52512	21	192.168.2.16	62.99.82.15
May 8, 2024 08:42:14.468458891 CEST	21	52499	79.50.168.227	192.168.2.16
May 8, 2024 08:42:14.473979950 CEST	52514	21	192.168.2.16	115.56.86.19
May 8, 2024 08:42:14.474344015 CEST	52555	21	192.168.2.16	142.58.253.70
May 8, 2024 08:42:14.481483936 CEST	21	52458	171.244.37.116	192.168.2.16
May 8, 2024 08:42:14.481497049 CEST	21	52458	171.244.37.116	192.168.2.16
May 8, 2024 08:42:14.481560946 CEST	52458	21	192.168.2.16	171.244.37.116
May 8, 2024 08:42:14.491880894 CEST	2121	52508	1.246.221.132	192.168.2.16
May 8, 2024 08:42:14.496390104 CEST	21	52349	112.163.110.99	192.168.2.16
May 8, 2024 08:42:14.496889114 CEST	52556	2121	192.168.2.16	142.58.253.70
May 8, 2024 08:42:14.501332045 CEST	21	52547	171.244.37.116	192.168.2.16
May 8, 2024 08:42:14.501406908 CEST	52547	21	192.168.2.16	171.244.37.116
May 8, 2024 08:42:14.504942894 CEST	52516	2121	192.168.2.16	115.56.86.19
May 8, 2024 08:42:14.504951000 CEST	52423	2121	192.168.2.16	222.234.43.115
May 8, 2024 08:42:14.520952940 CEST	52372	2121	192.168.2.16	189.243.100.126
May 8, 2024 08:42:14.525125027 CEST	21	52539	77.75.121.3	192.168.2.16
May 8, 2024 08:42:14.525355101 CEST	52539	21	192.168.2.16	77.75.121.3
May 8, 2024 08:42:14.536966085 CEST	52375	21	192.168.2.16	52.130.182.124
May 8, 2024 08:42:14.539937973 CEST	52519	21	192.168.2.16	79.107.214.63
May 8, 2024 08:42:14.552947998 CEST	52522	2121	192.168.2.16	79.107.214.63
May 8, 2024 08:42:14.552953005 CEST	52521	2121	192.168.2.16	104.107.13.22
May 8, 2024 08:42:14.552969933 CEST	52520	21	192.168.2.16	104.107.13.22
May 8, 2024 08:42:14.553416967 CEST	52557	21	192.168.2.16	117.2.136.7
May 8, 2024 08:42:14.558082104 CEST	2121	52350	112.163.110.99	192.168.2.16
May 8, 2024 08:42:14.568953037 CEST	52523	21	192.168.2.16	118.87.14.32
May 8, 2024 08:42:14.569299936 CEST	52558	2121	192.168.2.16	117.2.136.7
May 8, 2024 08:42:14.581878901 CEST	21	52533	172.120.235.139	192.168.2.16
May 8, 2024 08:42:14.582062006 CEST	52533	21	192.168.2.16	172.120.235.139
May 8, 2024 08:42:14.582300901 CEST	52559	21	192.168.2.16	172.120.235.139
May 8, 2024 08:42:14.583967924 CEST	52524	2121	192.168.2.16	118.87.14.32
May 8, 2024 08:42:14.583996058 CEST	52526	2121	192.168.2.16	66.111.116.250
May 8, 2024 08:42:14.584002972 CEST	52525	21	192.168.2.16	66.111.116.250
May 8, 2024 08:42:14.584836006 CEST	52560	21	192.168.2.16	189.230.46.54
May 8, 2024 08:42:14.584970951 CEST	52561	2121	192.168.2.16	189.230.46.54
May 8, 2024 08:42:14.585040092 CEST	52562	2121	192.168.2.16	71.208.108.88
May 8, 2024 08:42:14.585076094 CEST	52563	21	192.168.2.16	71.208.108.88
May 8, 2024 08:42:14.586967945 CEST	21	52453	117.223.205.236	192.168.2.16
May 8, 2024 08:42:14.599963903 CEST	52531	21	192.168.2.16	177.173.125.137
May 8, 2024 08:42:14.599966049 CEST	52527	21	192.168.2.16	208.113.228.78
May 8, 2024 08:42:14.600378990 CEST	52564	21	192.168.2.16	206.188.231.5
May 8, 2024 08:42:14.600428104 CEST	52565	2121	192.168.2.16	206.188.231.5
May 8, 2024 08:42:14.601329088 CEST	21	52545	34.149.79.8	192.168.2.16
May 8, 2024 08:42:14.601399899 CEST	21	52553	34.149.79.8	192.168.2.16
May 8, 2024 08:42:14.601474047 CEST	52553	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:14.615926981 CEST	52379	2121	192.168.2.16	149.224.220.82
May 8, 2024 08:42:14.615926981 CEST	52377	2121	192.168.2.16	52.130.182.124
May 8, 2024 08:42:14.616066933 CEST	52378	21	192.168.2.16	149.224.220.82
May 8, 2024 08:42:14.616409063 CEST	52566	2121	192.168.2.16	75.191.157.107
May 8, 2024 08:42:14.616446018 CEST	52567	21	192.168.2.16	75.191.157.107
May 8, 2024 08:42:14.619684935 CEST	2121	52546	34.149.79.8	192.168.2.16
May 8, 2024 08:42:14.619807959 CEST	2121	52554	34.149.79.8	192.168.2.16
May 8, 2024 08:42:14.619873047 CEST	52554	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:14.631933928 CEST	52380	21	192.168.2.16	173.223.108.99
May 8, 2024 08:42:14.632781982 CEST	52568	21	192.168.2.16	58.228.231.90
May 8, 2024 08:42:14.632790089 CEST	52569	21	192.168.2.16	98.53.238.203
May 8, 2024 08:42:14.632832050 CEST	52570	2121	192.168.2.16	58.228.231.90
May 8, 2024 08:42:14.632931948 CEST	52571	2121	192.168.2.16	98.53.238.203
May 8, 2024 08:42:14.632931948 CEST	52572	21	192.168.2.16	20.109.69.47
May 8, 2024 08:42:14.647949934 CEST	52383	21	192.168.2.16	78.150.98.19
May 8, 2024 08:42:14.647950888 CEST	52382	2121	192.168.2.16	173.223.108.99
May 8, 2024 08:42:14.648413897 CEST	52573	2121	192.168.2.16	20.109.69.47
May 8, 2024 08:42:14.648416042 CEST	52537	21	192.168.2.16	125.149.109.253
May 8, 2024 08:42:14.648427010 CEST	52574	2121	192.168.2.16	178.120.157.17
May 8, 2024 08:42:14.648471117 CEST	52575	21	192.168.2.16	178.120.157.17
May 8, 2024 08:42:14.663933039 CEST	52538	2121	192.168.2.16	125.149.109.253
May 8, 2024 08:42:14.663994074 CEST	52528	2121	192.168.2.16	208.113.228.78
May 8, 2024 08:42:14.664247990 CEST	52576	21	192.168.2.16	65.48.76.169
May 8, 2024 08:42:14.668214083 CEST	21	52386	196.210.0.111	192.168.2.16
May 8, 2024 08:42:14.668355942 CEST	52386	21	192.168.2.16	196.210.0.111
May 8, 2024 08:42:14.668521881 CEST	52577	21	192.168.2.16	196.210.0.111
May 8, 2024 08:42:14.679939985 CEST	52443	21	192.168.2.16	108.190.27.147
May 8, 2024 08:42:14.680011034 CEST	52536	2121	192.168.2.16	177.173.125.137
May 8, 2024 08:42:14.695943117 CEST	52444	2121	192.168.2.16	108.190.27.147
May 8, 2024 08:42:14.695949078 CEST	52529	21	192.168.2.16	23.37.100.62
May 8, 2024 08:42:14.700257063 CEST	2121	52414	23.106.228.71	192.168.2.16
May 8, 2024 08:42:14.705001116 CEST	21	52517	120.79.86.61	192.168.2.16
May 8, 2024 08:42:14.711936951 CEST	52530	2121	192.168.2.16	23.37.100.62
May 8, 2024 08:42:14.724158049 CEST	2121	52518	120.79.86.61	192.168.2.16
May 8, 2024 08:42:14.724258900 CEST	21	52396	213.209.135.181	192.168.2.16
May 8, 2024 08:42:14.728292942 CEST	21	52532	84.44.255.254	192.168.2.16
May 8, 2024 08:42:14.730647087 CEST	21	52552	84.44.255.254	192.168.2.16
May 8, 2024 08:42:14.730741978 CEST	52552	21	192.168.2.16	84.44.255.254
May 8, 2024 08:42:14.743954897 CEST	52387	2121	192.168.2.16	78.150.98.19
May 8, 2024 08:42:14.746052980 CEST	52388	21	192.168.2.16	23.208.54.103
May 8, 2024 08:42:14.749833107 CEST	21	52548	38.239.154.176	192.168.2.16
May 8, 2024 08:42:14.751189947 CEST	52548	21	192.168.2.16	38.239.154.176
May 8, 2024 08:42:14.759938002 CEST	52389	2121	192.168.2.16	23.208.54.103
May 8, 2024 08:42:14.763741970 CEST	21	52553	34.149.79.8	192.168.2.16
May 8, 2024 08:42:14.763806105 CEST	52553	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:14.763878107 CEST	52553	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:14.764049053 CEST	21	52559	172.120.235.139	192.168.2.16
May 8, 2024 08:42:14.764111996 CEST	21	52533	172.120.235.139	192.168.2.16
May 8, 2024 08:42:14.764117002 CEST	52578	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:14.764121056 CEST	52559	21	192.168.2.16	172.120.235.139
May 8, 2024 08:42:14.764153957 CEST	52533	21	192.168.2.16	172.120.235.139
May 8, 2024 08:42:14.774954081 CEST	52391	2121	192.168.2.16	211.87.151.249
May 8, 2024 08:42:14.774956942 CEST	52390	21	192.168.2.16	101.115.94.168
May 8, 2024 08:42:14.776010990 CEST	2121	52400	213.209.135.181	192.168.2.16
May 8, 2024 08:42:14.776046991 CEST	52393	2121	192.168.2.16	101.115.94.168
May 8, 2024 08:42:14.776052952 CEST	52392	21	192.168.2.16	211.87.151.249
May 8, 2024 08:42:14.782279015 CEST	2121	52554	34.149.79.8	192.168.2.16
May 8, 2024 08:42:14.782337904 CEST	52554	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:14.782490015 CEST	52554	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:14.782799006 CEST	52579	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:14.803463936 CEST	2121	52423	222.234.43.115	192.168.2.16
May 8, 2024 08:42:14.809158087 CEST	52394	21	192.168.2.16	71.167.147.190
May 8, 2024 08:42:14.818852901 CEST	21	52564	206.188.231.5	192.168.2.16
May 8, 2024 08:42:14.819561005 CEST	2121	52565	206.188.231.5	192.168.2.16
May 8, 2024 08:42:14.821260929 CEST	2121	52551	117.196.164.98	192.168.2.16
May 8, 2024 08:42:14.821816921 CEST	21	52550	117.196.164.98	192.168.2.16
May 8, 2024 08:42:14.821949005 CEST	52395	2121	192.168.2.16	71.167.147.190
May 8, 2024 08:42:14.835658073 CEST	21	52539	77.75.121.3	192.168.2.16
May 8, 2024 08:42:14.835720062 CEST	21	52539	77.75.121.3	192.168.2.16
May 8, 2024 08:42:14.835906029 CEST	52539	21	192.168.2.16	77.75.121.3
May 8, 2024 08:42:14.836937904 CEST	52542	21	192.168.2.16	126.216.119.205
May 8, 2024 08:42:14.851943970 CEST	52401	21	192.168.2.16	119.163.240.172
May 8, 2024 08:42:14.851948023 CEST	52402	2121	192.168.2.16	119.163.240.172
May 8, 2024 08:42:14.867775917 CEST	21	52547	171.244.37.116	192.168.2.16
May 8, 2024 08:42:14.868016958 CEST	52547	21	192.168.2.16	171.244.37.116
May 8, 2024 08:42:14.884325981 CEST	52405	21	192.168.2.16	50.71.239.26
May 8, 2024 08:42:14.898243904 CEST	21	52452	46.34.34.117	192.168.2.16
May 8, 2024 08:42:14.898443937 CEST	52452	21	192.168.2.16	46.34.34.117
May 8, 2024 08:42:14.898741007 CEST	52580	21	192.168.2.16	46.34.34.117
May 8, 2024 08:42:14.899926901 CEST	52507	21	192.168.2.16	1.246.221.132
May 8, 2024 08:42:14.899933100 CEST	52495	21	192.168.2.16	8.210.121.63
May 8, 2024 08:42:14.902029037 CEST	52543	2121	192.168.2.16	126.216.119.205
May 8, 2024 08:42:14.902029037 CEST	52496	2121	192.168.2.16	8.210.121.63
May 8, 2024 08:42:14.916558981 CEST	52581	2121	192.168.2.16	65.48.76.169
May 8, 2024 08:42:14.921530962 CEST	21	52568	58.228.231.90	192.168.2.16
May 8, 2024 08:42:14.926381111 CEST	21	52553	34.149.79.8	192.168.2.16
May 8, 2024 08:42:14.926947117 CEST	21	52578	34.149.79.8	192.168.2.16
May 8, 2024 08:42:14.927026033 CEST	52578	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:14.927908897 CEST	52406	2121	192.168.2.16	50.71.239.26
May 8, 2024 08:42:14.929132938 CEST	52407	21	192.168.2.16	68.83.50.239
May 8, 2024 08:42:14.932316065 CEST	52582	21	192.168.2.16	76.53.43.125
May 8, 2024 08:42:14.934410095 CEST	21	52443	108.190.27.147	192.168.2.16
May 8, 2024 08:42:14.939546108 CEST	2121	52570	58.228.231.90	192.168.2.16
May 8, 2024 08:42:14.944809914 CEST	2121	52554	34.149.79.8	192.168.2.16
May 8, 2024 08:42:14.945102930 CEST	2121	52579	34.149.79.8	192.168.2.16
May 8, 2024 08:42:14.945178986 CEST	52579	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:14.945976019 CEST	2121	52444	108.190.27.147	192.168.2.16
May 8, 2024 08:42:14.947935104 CEST	52502	2121	192.168.2.16	58.186.249.162
May 8, 2024 08:42:14.947937012 CEST	52408	2121	192.168.2.16	68.83.50.239
May 8, 2024 08:42:14.947941065 CEST	52504	21	192.168.2.16	121.148.8.80
May 8, 2024 08:42:14.948107958 CEST	52503	2121	192.168.2.16	121.148.8.80
May 8, 2024 08:42:14.963927031 CEST	52500	2121	192.168.2.16	79.50.168.227
May 8, 2024 08:42:14.965068102 CEST	52501	21	192.168.2.16	58.186.249.162
May 8, 2024 08:42:14.965069056 CEST	52540	21	192.168.2.16	91.179.69.230
May 8, 2024 08:42:14.967673063 CEST	21	52537	125.149.109.253	192.168.2.16
May 8, 2024 08:42:14.970551968 CEST	21	52531	177.173.125.137	192.168.2.16
May 8, 2024 08:42:14.976006031 CEST	21	52195	77.75.121.3	192.168.2.16
May 8, 2024 08:42:14.976027966 CEST	21	52195	77.75.121.3	192.168.2.16
May 8, 2024 08:42:14.976073980 CEST	52195	21	192.168.2.16	77.75.121.3
May 8, 2024 08:42:14.976103067 CEST	52195	21	192.168.2.16	77.75.121.3
May 8, 2024 08:42:14.976362944 CEST	21	52195	77.75.121.3	192.168.2.16
May 8, 2024 08:42:14.976406097 CEST	52195	21	192.168.2.16	77.75.121.3
May 8, 2024 08:42:14.979929924 CEST	52409	2121	192.168.2.16	187.8.95.189
May 8, 2024 08:42:14.979929924 CEST	52499	21	192.168.2.16	79.50.168.227
May 8, 2024 08:42:14.979958057 CEST	52411	21	192.168.2.16	221.217.135.170
May 8, 2024 08:42:14.979958057 CEST	52410	21	192.168.2.16	187.8.95.189
May 8, 2024 08:42:14.985822916 CEST	21	52559	172.120.235.139	192.168.2.16
May 8, 2024 08:42:14.986027956 CEST	52559	21	192.168.2.16	172.120.235.139
May 8, 2024 08:42:14.988117933 CEST	2121	52538	125.149.109.253	192.168.2.16
May 8, 2024 08:42:14.995932102 CEST	52508	2121	192.168.2.16	1.246.221.132
May 8, 2024 08:42:14.995956898 CEST	52412	2121	192.168.2.16	221.217.135.170
May 8, 2024 08:42:15.028522015 CEST	52583	2121	192.168.2.16	76.53.43.125
May 8, 2024 08:42:15.028548956 CEST	52541	2121	192.168.2.16	91.179.69.230
May 8, 2024 08:42:15.028559923 CEST	52415	21	192.168.2.16	136.146.3.38
May 8, 2024 08:42:15.046689987 CEST	52417	2121	192.168.2.16	136.146.3.38
May 8, 2024 08:42:15.046966076 CEST	21	52552	84.44.255.254	192.168.2.16
May 8, 2024 08:42:15.047036886 CEST	52552	21	192.168.2.16	84.44.255.254
May 8, 2024 08:42:15.047131062 CEST	52552	21	192.168.2.16	84.44.255.254
May 8, 2024 08:42:15.047399998 CEST	52584	21	192.168.2.16	84.44.255.254
May 8, 2024 08:42:15.050306082 CEST	2121	52536	177.173.125.137	192.168.2.16
May 8, 2024 08:42:15.051374912 CEST	21	52548	38.239.154.176	192.168.2.16
May 8, 2024 08:42:15.051429987 CEST	21	52548	38.239.154.176	192.168.2.16
May 8, 2024 08:42:15.051600933 CEST	52548	21	192.168.2.16	38.239.154.176
May 8, 2024 08:42:15.057363987 CEST	52418	21	192.168.2.16	68.61.201.86
May 8, 2024 08:42:15.060444117 CEST	52585	21	192.168.2.16	23.1.144.246
May 8, 2024 08:42:15.060621023 CEST	52586	2121	192.168.2.16	23.1.144.246
May 8, 2024 08:42:15.075942993 CEST	52419	2121	192.168.2.16	68.61.201.86
May 8, 2024 08:42:15.075944901 CEST	52420	21	192.168.2.16	81.40.233.239
May 8, 2024 08:42:15.089885950 CEST	21	52578	34.149.79.8	192.168.2.16
May 8, 2024 08:42:15.090003967 CEST	52578	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:15.090090990 CEST	52578	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:15.090363979 CEST	52587	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:15.091914892 CEST	52425	21	192.168.2.16	222.234.43.115
May 8, 2024 08:42:15.091954947 CEST	52422	2121	192.168.2.16	81.40.233.239
May 8, 2024 08:42:15.092370987 CEST	52588	21	192.168.2.16	222.124.81.78
May 8, 2024 08:42:15.094340086 CEST	52424	21	192.168.2.16	190.181.70.59
May 8, 2024 08:42:15.094666004 CEST	52544	21	192.168.2.16	84.14.161.154
May 8, 2024 08:42:15.107594967 CEST	2121	52579	34.149.79.8	192.168.2.16
May 8, 2024 08:42:15.107671022 CEST	52579	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:15.107814074 CEST	52579	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:15.107939005 CEST	52426	2121	192.168.2.16	190.181.70.59
May 8, 2024 08:42:15.108223915 CEST	52589	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:15.133285046 CEST	21	52542	126.216.119.205	192.168.2.16
May 8, 2024 08:42:15.139952898 CEST	52427	21	192.168.2.16	139.99.155.35
May 8, 2024 08:42:15.148080111 CEST	21	52577	196.210.0.111	192.168.2.16
May 8, 2024 08:42:15.148155928 CEST	52577	21	192.168.2.16	196.210.0.111
May 8, 2024 08:42:15.155837059 CEST	21	52386	196.210.0.111	192.168.2.16
May 8, 2024 08:42:15.155960083 CEST	52386	21	192.168.2.16	196.210.0.111
May 8, 2024 08:42:15.168421984 CEST	21	52559	172.120.235.139	192.168.2.16
May 8, 2024 08:42:15.168683052 CEST	21	52559	172.120.235.139	192.168.2.16
May 8, 2024 08:42:15.168853045 CEST	52559	21	192.168.2.16	172.120.235.139
May 8, 2024 08:42:15.171994925 CEST	52292	21	192.168.2.16	38.38.120.85
May 8, 2024 08:42:15.172313929 CEST	52590	21	192.168.2.16	38.38.120.85
May 8, 2024 08:42:15.185539007 CEST	21	52507	1.246.221.132	192.168.2.16
May 8, 2024 08:42:15.185689926 CEST	21	52539	77.75.121.3	192.168.2.16
May 8, 2024 08:42:15.198312044 CEST	2121	52543	126.216.119.205	192.168.2.16
May 8, 2024 08:42:15.203936100 CEST	52414	2121	192.168.2.16	23.106.228.71
May 8, 2024 08:42:15.219929934 CEST	52431	2121	192.168.2.16	139.99.155.35
May 8, 2024 08:42:15.219934940 CEST	52517	21	192.168.2.16	120.79.86.61
May 8, 2024 08:42:15.220246077 CEST	52591	2121	192.168.2.16	222.124.81.78
May 8, 2024 08:42:15.221472025 CEST	21	52495	8.210.121.63	192.168.2.16
May 8, 2024 08:42:15.222702026 CEST	2121	52496	8.210.121.63	192.168.2.16
May 8, 2024 08:42:15.233872890 CEST	21	52547	171.244.37.116	192.168.2.16
May 8, 2024 08:42:15.234014034 CEST	52547	21	192.168.2.16	171.244.37.116
May 8, 2024 08:42:15.235933065 CEST	52518	2121	192.168.2.16	120.79.86.61
May 8, 2024 08:42:15.235935926 CEST	52396	21	192.168.2.16	213.209.135.181
May 8, 2024 08:42:15.236859083 CEST	21	52580	46.34.34.117	192.168.2.16
May 8, 2024 08:42:15.236900091 CEST	52549	2121	192.168.2.16	84.14.161.154
May 8, 2024 08:42:15.236901045 CEST	52432	21	192.168.2.16	91.146.97.65
May 8, 2024 08:42:15.236936092 CEST	52580	21	192.168.2.16	46.34.34.117
May 8, 2024 08:42:15.240994930 CEST	21	52452	46.34.34.117	192.168.2.16
May 8, 2024 08:42:15.241060019 CEST	52452	21	192.168.2.16	46.34.34.117
May 8, 2024 08:42:15.254951000 CEST	21	52578	34.149.79.8	192.168.2.16
May 8, 2024 08:42:15.255439043 CEST	21	52587	34.149.79.8	192.168.2.16
May 8, 2024 08:42:15.255527020 CEST	52587	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:15.266290903 CEST	21	52504	121.148.8.80	192.168.2.16
May 8, 2024 08:42:15.266835928 CEST	2121	52503	121.148.8.80	192.168.2.16
May 8, 2024 08:42:15.267954111 CEST	52434	21	192.168.2.16	92.195.99.36
May 8, 2024 08:42:15.270112038 CEST	2121	52579	34.149.79.8	192.168.2.16
May 8, 2024 08:42:15.270627975 CEST	2121	52589	34.149.79.8	192.168.2.16
May 8, 2024 08:42:15.270724058 CEST	52589	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:15.271564960 CEST	2121	52502	58.186.249.162	192.168.2.16
May 8, 2024 08:42:15.276220083 CEST	21	52467	96.126.118.190	192.168.2.16
May 8, 2024 08:42:15.276408911 CEST	52467	21	192.168.2.16	96.126.118.190
May 8, 2024 08:42:15.283154011 CEST	2121	52508	1.246.221.132	192.168.2.16
May 8, 2024 08:42:15.283947945 CEST	52400	2121	192.168.2.16	213.209.135.181
May 8, 2024 08:42:15.284060001 CEST	52435	2121	192.168.2.16	92.195.99.36
May 8, 2024 08:42:15.284398079 CEST	52592	21	192.168.2.16	79.133.2.40
May 8, 2024 08:42:15.294428110 CEST	21	52501	58.186.249.162	192.168.2.16
May 8, 2024 08:42:15.299931049 CEST	52438	2121	192.168.2.16	73.134.83.136
May 8, 2024 08:42:15.299947977 CEST	52439	21	192.168.2.16	50.45.81.25
May 8, 2024 08:42:15.299954891 CEST	52437	21	192.168.2.16	73.134.83.136
May 8, 2024 08:42:15.304754972 CEST	2121	52500	79.50.168.227	192.168.2.16
May 8, 2024 08:42:15.315453053 CEST	2121	52470	96.126.118.190	192.168.2.16
May 8, 2024 08:42:15.315664053 CEST	52470	2121	192.168.2.16	96.126.118.190
May 8, 2024 08:42:15.315932035 CEST	52423	2121	192.168.2.16	222.234.43.115
May 8, 2024 08:42:15.315944910 CEST	52440	2121	192.168.2.16	50.45.81.25
May 8, 2024 08:42:15.316287994 CEST	52593	2121	192.168.2.16	79.133.2.40
May 8, 2024 08:42:15.324127913 CEST	21	52499	79.50.168.227	192.168.2.16
May 8, 2024 08:42:15.331939936 CEST	52564	21	192.168.2.16	206.188.231.5
May 8, 2024 08:42:15.331960917 CEST	52441	21	192.168.2.16	71.218.252.24
May 8, 2024 08:42:15.331963062 CEST	52550	21	192.168.2.16	117.196.164.98
May 8, 2024 08:42:15.333928108 CEST	52565	2121	192.168.2.16	206.188.231.5
May 8, 2024 08:42:15.334021091 CEST	52551	2121	192.168.2.16	117.196.164.98
May 8, 2024 08:42:15.357230902 CEST	21	52548	38.239.154.176	192.168.2.16
May 8, 2024 08:42:15.357434988 CEST	52548	21	192.168.2.16	38.239.154.176
May 8, 2024 08:42:15.357672930 CEST	52594	21	192.168.2.16	38.239.154.176
May 8, 2024 08:42:15.357942104 CEST	21	52548	38.239.154.176	192.168.2.16
May 8, 2024 08:42:15.358000994 CEST	52548	21	192.168.2.16	38.239.154.176
May 8, 2024 08:42:15.362406015 CEST	21	52590	38.38.120.85	192.168.2.16
May 8, 2024 08:42:15.362498999 CEST	52590	21	192.168.2.16	38.38.120.85
May 8, 2024 08:42:15.365075111 CEST	21	52552	84.44.255.254	192.168.2.16
May 8, 2024 08:42:15.369292974 CEST	21	52584	84.44.255.254	192.168.2.16
May 8, 2024 08:42:15.369374990 CEST	52584	21	192.168.2.16	84.44.255.254
May 8, 2024 08:42:15.379354000 CEST	21	52559	172.120.235.139	192.168.2.16
May 8, 2024 08:42:15.379543066 CEST	52559	21	192.168.2.16	172.120.235.139
May 8, 2024 08:42:15.379760027 CEST	52595	21	192.168.2.16	172.120.235.139
May 8, 2024 08:42:15.379967928 CEST	52442	2121	192.168.2.16	71.218.252.24
May 8, 2024 08:42:15.400767088 CEST	21	52292	38.38.120.85	192.168.2.16
May 8, 2024 08:42:15.418054104 CEST	21	52587	34.149.79.8	192.168.2.16
May 8, 2024 08:42:15.418128967 CEST	52587	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:15.418248892 CEST	52587	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:15.418536901 CEST	52596	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:15.427947044 CEST	52568	21	192.168.2.16	58.228.231.90
May 8, 2024 08:42:15.428453922 CEST	52597	21	192.168.2.16	38.207.205.17
May 8, 2024 08:42:15.433274984 CEST	2121	52589	34.149.79.8	192.168.2.16
May 8, 2024 08:42:15.433362961 CEST	52589	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:15.433439016 CEST	52589	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:15.433689117 CEST	52598	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:15.443947077 CEST	52443	21	192.168.2.16	108.190.27.147
May 8, 2024 08:42:15.444214106 CEST	52570	2121	192.168.2.16	58.228.231.90
May 8, 2024 08:42:15.444217920 CEST	52599	2121	192.168.2.16	38.207.205.17
May 8, 2024 08:42:15.449706078 CEST	21	52292	38.38.120.85	192.168.2.16
May 8, 2024 08:42:15.449753046 CEST	21	52292	38.38.120.85	192.168.2.16
May 8, 2024 08:42:15.449778080 CEST	52292	21	192.168.2.16	38.38.120.85
May 8, 2024 08:42:15.449806929 CEST	52292	21	192.168.2.16	38.38.120.85
May 8, 2024 08:42:15.450294971 CEST	21	52292	38.38.120.85	192.168.2.16
May 8, 2024 08:42:15.450340033 CEST	52292	21	192.168.2.16	38.38.120.85
May 8, 2024 08:42:15.459944010 CEST	52446	21	192.168.2.16	64.98.100.10
May 8, 2024 08:42:15.459944010 CEST	52444	2121	192.168.2.16	108.190.27.147
May 8, 2024 08:42:15.475950956 CEST	52537	21	192.168.2.16	125.149.109.253
May 8, 2024 08:42:15.481903076 CEST	52531	21	192.168.2.16	177.173.125.137
May 8, 2024 08:42:15.481978893 CEST	52555	21	192.168.2.16	142.58.253.70
May 8, 2024 08:42:15.482125998 CEST	21	52467	96.126.118.190	192.168.2.16
May 8, 2024 08:42:15.482307911 CEST	21	52467	96.126.118.190	192.168.2.16
May 8, 2024 08:42:15.482531071 CEST	52467	21	192.168.2.16	96.126.118.190
May 8, 2024 08:42:15.491950989 CEST	52538	2121	192.168.2.16	125.149.109.253
May 8, 2024 08:42:15.494246960 CEST	2121	52414	23.106.228.71	192.168.2.16
May 8, 2024 08:42:15.507919073 CEST	52556	2121	192.168.2.16	142.58.253.70
May 8, 2024 08:42:15.508523941 CEST	52600	21	192.168.2.16	213.118.93.224
May 8, 2024 08:42:15.521508932 CEST	2121	52470	96.126.118.190	192.168.2.16
May 8, 2024 08:42:15.521600962 CEST	2121	52470	96.126.118.190	192.168.2.16
May 8, 2024 08:42:15.521858931 CEST	52470	2121	192.168.2.16	96.126.118.190
May 8, 2024 08:42:15.549807072 CEST	21	52564	206.188.231.5	192.168.2.16
May 8, 2024 08:42:15.551918983 CEST	2121	52565	206.188.231.5	192.168.2.16
May 8, 2024 08:42:15.554481030 CEST	21	52590	38.38.120.85	192.168.2.16
May 8, 2024 08:42:15.554760933 CEST	52590	21	192.168.2.16	38.38.120.85
May 8, 2024 08:42:15.555929899 CEST	52536	2121	192.168.2.16	177.173.125.137
May 8, 2024 08:42:15.555947065 CEST	52557	21	192.168.2.16	117.2.136.7
May 8, 2024 08:42:15.559751034 CEST	21	52517	120.79.86.61	192.168.2.16
May 8, 2024 08:42:15.561389923 CEST	21	52559	172.120.235.139	192.168.2.16
May 8, 2024 08:42:15.561409950 CEST	21	52595	172.120.235.139	192.168.2.16
May 8, 2024 08:42:15.561464071 CEST	52559	21	192.168.2.16	172.120.235.139
May 8, 2024 08:42:15.561520100 CEST	52595	21	192.168.2.16	172.120.235.139
May 8, 2024 08:42:15.571943045 CEST	52558	2121	192.168.2.16	117.2.136.7
May 8, 2024 08:42:15.577388048 CEST	2121	52518	120.79.86.61	192.168.2.16
May 8, 2024 08:42:15.580647945 CEST	21	52587	34.149.79.8	192.168.2.16
May 8, 2024 08:42:15.580980062 CEST	21	52596	34.149.79.8	192.168.2.16
May 8, 2024 08:42:15.581058025 CEST	52596	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:15.582276106 CEST	21	52396	213.209.135.181	192.168.2.16
May 8, 2024 08:42:15.587949038 CEST	52561	2121	192.168.2.16	189.230.46.54
May 8, 2024 08:42:15.589247942 CEST	21	52580	46.34.34.117	192.168.2.16
May 8, 2024 08:42:15.589292049 CEST	52562	2121	192.168.2.16	71.208.108.88
May 8, 2024 08:42:15.589293003 CEST	52560	21	192.168.2.16	189.230.46.54
May 8, 2024 08:42:15.589545012 CEST	52580	21	192.168.2.16	46.34.34.117
May 8, 2024 08:42:15.589919090 CEST	52563	21	192.168.2.16	71.208.108.88
May 8, 2024 08:42:15.595792055 CEST	2121	52589	34.149.79.8	192.168.2.16
May 8, 2024 08:42:15.596084118 CEST	2121	52598	34.149.79.8	192.168.2.16
May 8, 2024 08:42:15.596158981 CEST	52598	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:15.601155996 CEST	21	52453	117.223.205.236	192.168.2.16
May 8, 2024 08:42:15.601358891 CEST	52453	21	192.168.2.16	117.223.205.236
May 8, 2024 08:42:15.601699114 CEST	52601	21	192.168.2.16	117.223.205.236
May 8, 2024 08:42:15.601936102 CEST	21	52547	171.244.37.116	192.168.2.16
May 8, 2024 08:42:15.602044106 CEST	52547	21	192.168.2.16	171.244.37.116
May 8, 2024 08:42:15.602180958 CEST	52602	21	192.168.2.16	171.244.37.116
May 8, 2024 08:42:15.603940964 CEST	52454	2121	192.168.2.16	64.98.100.10
May 8, 2024 08:42:15.604332924 CEST	52603	2121	192.168.2.16	213.118.93.224
May 8, 2024 08:42:15.614489079 CEST	2121	52423	222.234.43.115	192.168.2.16
May 8, 2024 08:42:15.615053892 CEST	52604	21	192.168.2.16	82.15.12.248
May 8, 2024 08:42:15.618938923 CEST	52566	2121	192.168.2.16	75.191.157.107
May 8, 2024 08:42:15.618941069 CEST	52567	21	192.168.2.16	75.191.157.107
May 8, 2024 08:42:15.631567955 CEST	21	52592	79.133.2.40	192.168.2.16
May 8, 2024 08:42:15.633970976 CEST	2121	52400	213.209.135.181	192.168.2.16
May 8, 2024 08:42:15.634522915 CEST	52605	2121	192.168.2.16	82.15.12.248
May 8, 2024 08:42:15.634912014 CEST	52572	21	192.168.2.16	20.109.69.47
May 8, 2024 08:42:15.634936094 CEST	52569	21	192.168.2.16	98.53.238.203
May 8, 2024 08:42:15.642923117 CEST	52571	2121	192.168.2.16	98.53.238.203
May 8, 2024 08:42:15.644680023 CEST	52542	21	192.168.2.16	126.216.119.205
May 8, 2024 08:42:15.650947094 CEST	52575	21	192.168.2.16	178.120.157.17
May 8, 2024 08:42:15.650950909 CEST	52573	2121	192.168.2.16	20.109.69.47
May 8, 2024 08:42:15.650988102 CEST	52574	2121	192.168.2.16	178.120.157.17
May 8, 2024 08:42:15.658648968 CEST	21	52548	38.239.154.176	192.168.2.16
May 8, 2024 08:42:15.658940077 CEST	21	52594	38.239.154.176	192.168.2.16
May 8, 2024 08:42:15.659018040 CEST	52594	21	192.168.2.16	38.239.154.176
May 8, 2024 08:42:15.660116911 CEST	21	52577	196.210.0.111	192.168.2.16
May 8, 2024 08:42:15.660283089 CEST	52577	21	192.168.2.16	196.210.0.111
May 8, 2024 08:42:15.663870096 CEST	2121	52593	79.133.2.40	192.168.2.16
May 8, 2024 08:42:15.667011976 CEST	52576	21	192.168.2.16	65.48.76.169
May 8, 2024 08:42:15.683407068 CEST	52606	21	192.168.2.16	59.14.80.32
May 8, 2024 08:42:15.688263893 CEST	21	52467	96.126.118.190	192.168.2.16
May 8, 2024 08:42:15.688451052 CEST	52467	21	192.168.2.16	96.126.118.190
May 8, 2024 08:42:15.690088987 CEST	21	52584	84.44.255.254	192.168.2.16
May 8, 2024 08:42:15.690165997 CEST	52584	21	192.168.2.16	84.44.255.254
May 8, 2024 08:42:15.690237999 CEST	52584	21	192.168.2.16	84.44.255.254
May 8, 2024 08:42:15.690464020 CEST	52607	21	192.168.2.16	84.44.255.254
May 8, 2024 08:42:15.694008112 CEST	21	52443	108.190.27.147	192.168.2.16
May 8, 2024 08:42:15.694463015 CEST	52608	2121	192.168.2.16	59.14.80.32
May 8, 2024 08:42:15.698951006 CEST	52543	2121	192.168.2.16	126.216.119.205
May 8, 2024 08:42:15.698952913 CEST	52507	21	192.168.2.16	1.246.221.132
May 8, 2024 08:42:15.698990107 CEST	52455	21	192.168.2.16	174.74.200.173
May 8, 2024 08:42:15.699245930 CEST	52609	21	192.168.2.16	84.36.50.25
May 8, 2024 08:42:15.707932949 CEST	2121	52444	108.190.27.147	192.168.2.16
May 8, 2024 08:42:15.708447933 CEST	52610	2121	192.168.2.16	84.36.50.25
May 8, 2024 08:42:15.714538097 CEST	21	52568	58.228.231.90	192.168.2.16
May 8, 2024 08:42:15.727889061 CEST	2121	52470	96.126.118.190	192.168.2.16
May 8, 2024 08:42:15.728193045 CEST	52470	2121	192.168.2.16	96.126.118.190
May 8, 2024 08:42:15.730951071 CEST	52495	21	192.168.2.16	8.210.121.63
May 8, 2024 08:42:15.731082916 CEST	52496	2121	192.168.2.16	8.210.121.63
May 8, 2024 08:42:15.743561983 CEST	21	52596	34.149.79.8	192.168.2.16
May 8, 2024 08:42:15.743638992 CEST	52596	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:15.743722916 CEST	52596	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:15.743978977 CEST	52611	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:15.744887114 CEST	21	52590	38.38.120.85	192.168.2.16
May 8, 2024 08:42:15.744993925 CEST	21	52590	38.38.120.85	192.168.2.16
May 8, 2024 08:42:15.745121002 CEST	52590	21	192.168.2.16	38.38.120.85
May 8, 2024 08:42:15.749247074 CEST	52456	2121	192.168.2.16	174.74.200.173
May 8, 2024 08:42:15.749283075 CEST	52457	21	192.168.2.16	91.12.174.73
May 8, 2024 08:42:15.750535965 CEST	2121	52570	58.228.231.90	192.168.2.16
May 8, 2024 08:42:15.758583069 CEST	2121	52598	34.149.79.8	192.168.2.16
May 8, 2024 08:42:15.758699894 CEST	52598	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:15.758816957 CEST	52598	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:15.759135008 CEST	52612	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:15.765361071 CEST	52613	21	192.168.2.16	79.157.117.148
May 8, 2024 08:42:15.767947912 CEST	21	52550	117.196.164.98	192.168.2.16
May 8, 2024 08:42:15.777230024 CEST	2121	52551	117.196.164.98	192.168.2.16
May 8, 2024 08:42:15.780947924 CEST	52502	2121	192.168.2.16	58.186.249.162
May 8, 2024 08:42:15.782038927 CEST	52459	2121	192.168.2.16	91.12.174.73
May 8, 2024 08:42:15.782040119 CEST	52504	21	192.168.2.16	121.148.8.80
May 8, 2024 08:42:15.782042027 CEST	52503	2121	192.168.2.16	121.148.8.80
May 8, 2024 08:42:15.785432100 CEST	21	52595	172.120.235.139	192.168.2.16
May 8, 2024 08:42:15.785631895 CEST	52595	21	192.168.2.16	172.120.235.139
May 8, 2024 08:42:15.793097019 CEST	21	52537	125.149.109.253	192.168.2.16
May 8, 2024 08:42:15.796942949 CEST	52508	2121	192.168.2.16	1.246.221.132
May 8, 2024 08:42:15.796955109 CEST	52501	21	192.168.2.16	58.186.249.162
May 8, 2024 08:42:15.796957016 CEST	52460	21	192.168.2.16	217.224.163.247
May 8, 2024 08:42:15.812956095 CEST	52500	2121	192.168.2.16	79.50.168.227
May 8, 2024 08:42:15.818151951 CEST	2121	52538	125.149.109.253	192.168.2.16
May 8, 2024 08:42:15.828521013 CEST	21	52597	38.207.205.17	192.168.2.16
May 8, 2024 08:42:15.829016924 CEST	52462	2121	192.168.2.16	217.224.163.247
May 8, 2024 08:42:15.829924107 CEST	52499	21	192.168.2.16	79.50.168.227
May 8, 2024 08:42:15.844978094 CEST	52464	21	192.168.2.16	93.199.145.206
May 8, 2024 08:42:15.845446110 CEST	52614	2121	192.168.2.16	79.157.117.148
May 8, 2024 08:42:15.850811958 CEST	21	52531	177.173.125.137	192.168.2.16
May 8, 2024 08:42:15.860955000 CEST	52465	2121	192.168.2.16	93.199.145.206
May 8, 2024 08:42:15.877321005 CEST	52615	21	192.168.2.16	14.42.87.238
May 8, 2024 08:42:15.892955065 CEST	52468	21	192.168.2.16	165.225.117.193
May 8, 2024 08:42:15.893239975 CEST	52616	2121	192.168.2.16	14.42.87.238
May 8, 2024 08:42:15.894495964 CEST	21	52467	96.126.118.190	192.168.2.16
May 8, 2024 08:42:15.894737959 CEST	52467	21	192.168.2.16	96.126.118.190
May 8, 2024 08:42:15.906068087 CEST	21	52596	34.149.79.8	192.168.2.16
May 8, 2024 08:42:15.906384945 CEST	21	52611	34.149.79.8	192.168.2.16
May 8, 2024 08:42:15.906493902 CEST	52611	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:15.909455061 CEST	52617	21	192.168.2.16	70.69.249.93
May 8, 2024 08:42:15.921477079 CEST	2121	52598	34.149.79.8	192.168.2.16
May 8, 2024 08:42:15.921525955 CEST	2121	52612	34.149.79.8	192.168.2.16
May 8, 2024 08:42:15.921614885 CEST	52612	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:15.924997091 CEST	52471	2121	192.168.2.16	165.225.117.193
May 8, 2024 08:42:15.925004005 CEST	52581	2121	192.168.2.16	65.48.76.169
May 8, 2024 08:42:15.925364971 CEST	52618	2121	192.168.2.16	70.69.249.93
May 8, 2024 08:42:15.925386906 CEST	2121	52536	177.173.125.137	192.168.2.16
May 8, 2024 08:42:15.928891897 CEST	21	52580	46.34.34.117	192.168.2.16
May 8, 2024 08:42:15.932096004 CEST	21	52580	46.34.34.117	192.168.2.16
May 8, 2024 08:42:15.932327986 CEST	52580	21	192.168.2.16	46.34.34.117
May 8, 2024 08:42:15.934154987 CEST	2121	52470	96.126.118.190	192.168.2.16
May 8, 2024 08:42:15.934339046 CEST	52470	2121	192.168.2.16	96.126.118.190
May 8, 2024 08:42:15.940788031 CEST	21	52542	126.216.119.205	192.168.2.16
May 8, 2024 08:42:15.942915916 CEST	52582	21	192.168.2.16	76.53.43.125
May 8, 2024 08:42:15.945533991 CEST	52472	21	192.168.2.16	13.73.2.38
May 8, 2024 08:42:15.960942984 CEST	21	52594	38.239.154.176	192.168.2.16
May 8, 2024 08:42:15.961178064 CEST	52594	21	192.168.2.16	38.239.154.176
May 8, 2024 08:42:15.967313051 CEST	21	52595	172.120.235.139	192.168.2.16
May 8, 2024 08:42:15.967448950 CEST	21	52547	171.244.37.116	192.168.2.16
May 8, 2024 08:42:15.967461109 CEST	21	52547	171.244.37.116	192.168.2.16
May 8, 2024 08:42:15.967538118 CEST	21	52595	172.120.235.139	192.168.2.16
May 8, 2024 08:42:15.967545986 CEST	52547	21	192.168.2.16	171.244.37.116
May 8, 2024 08:42:15.967695951 CEST	52595	21	192.168.2.16	172.120.235.139
May 8, 2024 08:42:15.968398094 CEST	21	52376	51.38.57.28	192.168.2.16
May 8, 2024 08:42:15.968512058 CEST	52376	21	192.168.2.16	51.38.57.28
May 8, 2024 08:42:15.968749046 CEST	52619	21	192.168.2.16	51.38.57.28
May 8, 2024 08:42:15.972204924 CEST	21	52602	171.244.37.116	192.168.2.16
May 8, 2024 08:42:15.972286940 CEST	52602	21	192.168.2.16	171.244.37.116
May 8, 2024 08:42:15.974852085 CEST	21	52590	38.38.120.85	192.168.2.16
May 8, 2024 08:42:15.985749006 CEST	21	52507	1.246.221.132	192.168.2.16
May 8, 2024 08:42:15.995038986 CEST	2121	52543	126.216.119.205	192.168.2.16
May 8, 2024 08:42:16.000490904 CEST	21	52606	59.14.80.32	192.168.2.16
May 8, 2024 08:42:16.005023956 CEST	52337	2121	192.168.2.16	62.140.135.146
May 8, 2024 08:42:16.005311966 CEST	52620	2121	192.168.2.16	62.140.135.146
May 8, 2024 08:42:16.006542921 CEST	21	52607	84.44.255.254	192.168.2.16
May 8, 2024 08:42:16.006618977 CEST	52607	21	192.168.2.16	84.44.255.254
May 8, 2024 08:42:16.009874105 CEST	21	52584	84.44.255.254	192.168.2.16
May 8, 2024 08:42:16.010226011 CEST	2121	52608	59.14.80.32	192.168.2.16
May 8, 2024 08:42:16.021328926 CEST	52621	21	192.168.2.16	27.208.56.139
May 8, 2024 08:42:16.036935091 CEST	52583	2121	192.168.2.16	76.53.43.125
May 8, 2024 08:42:16.037141085 CEST	52340	21	192.168.2.16	62.140.135.146
May 8, 2024 08:42:16.037619114 CEST	52622	21	192.168.2.16	62.140.135.146
May 8, 2024 08:42:16.037739992 CEST	52623	21	192.168.2.16	45.7.174.124
May 8, 2024 08:42:16.037815094 CEST	52624	2121	192.168.2.16	27.208.56.139
May 8, 2024 08:42:16.037834883 CEST	52625	2121	192.168.2.16	45.7.174.124
May 8, 2024 08:42:16.050967932 CEST	21	52495	8.210.121.63	192.168.2.16
May 8, 2024 08:42:16.051768064 CEST	2121	52496	8.210.121.63	192.168.2.16
May 8, 2024 08:42:16.052937031 CEST	52564	21	192.168.2.16	206.188.231.5
May 8, 2024 08:42:16.052939892 CEST	52565	2121	192.168.2.16	206.188.231.5
May 8, 2024 08:42:16.067194939 CEST	2121	52610	84.36.50.25	192.168.2.16
May 8, 2024 08:42:16.068917036 CEST	52586	2121	192.168.2.16	23.1.144.246
May 8, 2024 08:42:16.068929911 CEST	52585	21	192.168.2.16	23.1.144.246
May 8, 2024 08:42:16.068968058 CEST	21	52611	34.149.79.8	192.168.2.16
May 8, 2024 08:42:16.069001913 CEST	52517	21	192.168.2.16	120.79.86.61
May 8, 2024 08:42:16.069036961 CEST	52611	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:16.069247007 CEST	52611	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:16.069624901 CEST	52626	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:16.074142933 CEST	21	52601	117.223.205.236	192.168.2.16
May 8, 2024 08:42:16.074202061 CEST	52601	21	192.168.2.16	117.223.205.236
May 8, 2024 08:42:16.080830097 CEST	21	52453	117.223.205.236	192.168.2.16
May 8, 2024 08:42:16.080907106 CEST	52453	21	192.168.2.16	117.223.205.236
May 8, 2024 08:42:16.084060907 CEST	2121	52612	34.149.79.8	192.168.2.16
May 8, 2024 08:42:16.084109068 CEST	52612	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:16.084120035 CEST	2121	52508	1.246.221.132	192.168.2.16
May 8, 2024 08:42:16.084233999 CEST	52612	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:16.084656000 CEST	52627	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:16.084914923 CEST	52518	2121	192.168.2.16	120.79.86.61
May 8, 2024 08:42:16.085362911 CEST	52628	2121	192.168.2.16	82.14.108.81
May 8, 2024 08:42:16.085390091 CEST	52629	21	192.168.2.16	82.14.108.81
May 8, 2024 08:42:16.100502014 CEST	21	52504	121.148.8.80	192.168.2.16
May 8, 2024 08:42:16.100699902 CEST	21	52467	96.126.118.190	192.168.2.16
May 8, 2024 08:42:16.100917101 CEST	52588	21	192.168.2.16	222.124.81.78
May 8, 2024 08:42:16.100990057 CEST	52467	21	192.168.2.16	96.126.118.190
May 8, 2024 08:42:16.100996017 CEST	2121	52503	121.148.8.80	192.168.2.16
May 8, 2024 08:42:16.103385925 CEST	2121	52502	58.186.249.162	192.168.2.16
May 8, 2024 08:42:16.116961956 CEST	52475	2121	192.168.2.16	13.73.2.38
May 8, 2024 08:42:16.130320072 CEST	21	52501	58.186.249.162	192.168.2.16
May 8, 2024 08:42:16.132944107 CEST	52476	21	192.168.2.16	40.75.106.85
May 8, 2024 08:42:16.133373976 CEST	52630	21	192.168.2.16	77.207.103.248
May 8, 2024 08:42:16.133378983 CEST	52592	21	192.168.2.16	79.133.2.40
May 8, 2024 08:42:16.140024900 CEST	21	52577	196.210.0.111	192.168.2.16
May 8, 2024 08:42:16.140038013 CEST	21	52577	196.210.0.111	192.168.2.16
May 8, 2024 08:42:16.140229940 CEST	52577	21	192.168.2.16	196.210.0.111
May 8, 2024 08:42:16.140297890 CEST	2121	52470	96.126.118.190	192.168.2.16
May 8, 2024 08:42:16.140508890 CEST	52470	2121	192.168.2.16	96.126.118.190
May 8, 2024 08:42:16.148905993 CEST	52479	21	192.168.2.16	100.37.12.121
May 8, 2024 08:42:16.148917913 CEST	52480	2121	192.168.2.16	24.166.113.31
May 8, 2024 08:42:16.148926973 CEST	52478	21	192.168.2.16	24.166.113.31
May 8, 2024 08:42:16.149277925 CEST	52477	2121	192.168.2.16	40.75.106.85
May 8, 2024 08:42:16.153912067 CEST	2121	52500	79.50.168.227	192.168.2.16
May 8, 2024 08:42:16.164917946 CEST	52593	2121	192.168.2.16	79.133.2.40
May 8, 2024 08:42:16.174139023 CEST	21	52499	79.50.168.227	192.168.2.16
May 8, 2024 08:42:16.178729057 CEST	21	52595	172.120.235.139	192.168.2.16
May 8, 2024 08:42:16.178942919 CEST	52595	21	192.168.2.16	172.120.235.139
May 8, 2024 08:42:16.179204941 CEST	52631	21	192.168.2.16	172.120.235.139
May 8, 2024 08:42:16.180916071 CEST	52485	2121	192.168.2.16	100.37.12.121
May 8, 2024 08:42:16.180954933 CEST	52486	21	192.168.2.16	178.90.187.168
May 8, 2024 08:42:16.180954933 CEST	52484	21	192.168.2.16	104.1.61.99
May 8, 2024 08:42:16.180962086 CEST	52487	2121	192.168.2.16	104.1.61.99
May 8, 2024 08:42:16.186515093 CEST	52490	2121	192.168.2.16	178.90.187.168
May 8, 2024 08:42:16.196928978 CEST	52488	2121	192.168.2.16	38.154.133.22
May 8, 2024 08:42:16.196947098 CEST	52489	21	192.168.2.16	38.154.133.22
May 8, 2024 08:42:16.201680899 CEST	21	52615	14.42.87.238	192.168.2.16
May 8, 2024 08:42:16.207242966 CEST	2121	52616	14.42.87.238	192.168.2.16
May 8, 2024 08:42:16.228935003 CEST	52591	2121	192.168.2.16	222.124.81.78
May 8, 2024 08:42:16.228936911 CEST	52568	21	192.168.2.16	58.228.231.90
May 8, 2024 08:42:16.230030060 CEST	52491	21	192.168.2.16	20.76.243.166
May 8, 2024 08:42:16.231656075 CEST	21	52611	34.149.79.8	192.168.2.16
May 8, 2024 08:42:16.231988907 CEST	21	52626	34.149.79.8	192.168.2.16
May 8, 2024 08:42:16.232070923 CEST	52626	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:16.244926929 CEST	52494	2121	192.168.2.16	149.102.11.65
May 8, 2024 08:42:16.244949102 CEST	52492	2121	192.168.2.16	20.76.243.166
May 8, 2024 08:42:16.244951010 CEST	52493	21	192.168.2.16	149.102.11.65
May 8, 2024 08:42:16.246567965 CEST	2121	52612	34.149.79.8	192.168.2.16
May 8, 2024 08:42:16.247020006 CEST	2121	52627	34.149.79.8	192.168.2.16
May 8, 2024 08:42:16.247087955 CEST	52627	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:16.260968924 CEST	52570	2121	192.168.2.16	58.228.231.90
May 8, 2024 08:42:16.260968924 CEST	52497	21	192.168.2.16	27.199.155.226
May 8, 2024 08:42:16.261416912 CEST	21	52594	38.239.154.176	192.168.2.16
May 8, 2024 08:42:16.261490107 CEST	21	52594	38.239.154.176	192.168.2.16
May 8, 2024 08:42:16.261645079 CEST	52594	21	192.168.2.16	38.239.154.176
May 8, 2024 08:42:16.271207094 CEST	2121	52565	206.188.231.5	192.168.2.16
May 8, 2024 08:42:16.271825075 CEST	21	52564	206.188.231.5	192.168.2.16
May 8, 2024 08:42:16.276936054 CEST	52550	21	192.168.2.16	117.196.164.98
May 8, 2024 08:42:16.276937008 CEST	52498	2121	192.168.2.16	27.199.155.226
May 8, 2024 08:42:16.287033081 CEST	21	52376	51.38.57.28	192.168.2.16
May 8, 2024 08:42:16.287115097 CEST	52376	21	192.168.2.16	51.38.57.28
May 8, 2024 08:42:16.287529945 CEST	21	52376	51.38.57.28	192.168.2.16
May 8, 2024 08:42:16.287576914 CEST	52376	21	192.168.2.16	51.38.57.28
May 8, 2024 08:42:16.291089058 CEST	21	52619	51.38.57.28	192.168.2.16
May 8, 2024 08:42:16.291158915 CEST	52619	21	192.168.2.16	51.38.57.28
May 8, 2024 08:42:16.292913914 CEST	52551	2121	192.168.2.16	117.196.164.98
May 8, 2024 08:42:16.292943954 CEST	52537	21	192.168.2.16	125.149.109.253
May 8, 2024 08:42:16.293272972 CEST	52632	2121	192.168.2.16	77.207.103.248
May 8, 2024 08:42:16.301594019 CEST	21	52580	46.34.34.117	192.168.2.16
May 8, 2024 08:42:16.307362080 CEST	21	52467	96.126.118.190	192.168.2.16
May 8, 2024 08:42:16.307863951 CEST	52467	21	192.168.2.16	96.126.118.190
May 8, 2024 08:42:16.308934927 CEST	52505	21	192.168.2.16	86.4.188.93
May 8, 2024 08:42:16.322810888 CEST	21	52607	84.44.255.254	192.168.2.16
May 8, 2024 08:42:16.322859049 CEST	52607	21	192.168.2.16	84.44.255.254
May 8, 2024 08:42:16.323048115 CEST	52607	21	192.168.2.16	84.44.255.254
May 8, 2024 08:42:16.323390961 CEST	52634	21	192.168.2.16	84.44.255.254
May 8, 2024 08:42:16.324908018 CEST	52506	2121	192.168.2.16	86.4.188.93
May 8, 2024 08:42:16.324934006 CEST	52538	2121	192.168.2.16	125.149.109.253
May 8, 2024 08:42:16.331594944 CEST	2121	52620	62.140.135.146	192.168.2.16
May 8, 2024 08:42:16.331655025 CEST	52620	2121	192.168.2.16	62.140.135.146
May 8, 2024 08:42:16.340917110 CEST	52597	21	192.168.2.16	38.207.205.17
May 8, 2024 08:42:16.343174934 CEST	21	52602	171.244.37.116	192.168.2.16
May 8, 2024 08:42:16.343364954 CEST	52602	21	192.168.2.16	171.244.37.116
May 8, 2024 08:42:16.346606016 CEST	2121	52470	96.126.118.190	192.168.2.16
May 8, 2024 08:42:16.347012043 CEST	52470	2121	192.168.2.16	96.126.118.190
May 8, 2024 08:42:16.356930971 CEST	52531	21	192.168.2.16	177.173.125.137
May 8, 2024 08:42:16.360680103 CEST	21	52595	172.120.235.139	192.168.2.16
May 8, 2024 08:42:16.360730886 CEST	52595	21	192.168.2.16	172.120.235.139
May 8, 2024 08:42:16.360874891 CEST	21	52631	172.120.235.139	192.168.2.16
May 8, 2024 08:42:16.360939980 CEST	52631	21	192.168.2.16	172.120.235.139
May 8, 2024 08:42:16.363863945 CEST	21	52622	62.140.135.146	192.168.2.16
May 8, 2024 08:42:16.363920927 CEST	52622	21	192.168.2.16	62.140.135.146
May 8, 2024 08:42:16.388809919 CEST	52636	21	192.168.2.16	173.29.240.123
May 8, 2024 08:42:16.388916969 CEST	52637	2121	192.168.2.16	173.29.240.123
May 8, 2024 08:42:16.389091015 CEST	52638	21	192.168.2.16	176.50.254.243
May 8, 2024 08:42:16.394553900 CEST	21	52626	34.149.79.8	192.168.2.16
May 8, 2024 08:42:16.394608974 CEST	52626	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:16.394675970 CEST	52626	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:16.394859076 CEST	52639	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:16.395406008 CEST	2121	52625	45.7.174.124	192.168.2.16
May 8, 2024 08:42:16.404329062 CEST	52640	2121	192.168.2.16	176.50.254.243
May 8, 2024 08:42:16.409517050 CEST	2121	52627	34.149.79.8	192.168.2.16
May 8, 2024 08:42:16.409579039 CEST	52627	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:16.409676075 CEST	52627	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:16.409956932 CEST	52641	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:16.416752100 CEST	21	52517	120.79.86.61	192.168.2.16
May 8, 2024 08:42:16.418931007 CEST	52509	21	192.168.2.16	172.190.237.210
May 8, 2024 08:42:16.419162989 CEST	52642	21	192.168.2.16	91.69.213.1
May 8, 2024 08:42:16.432388067 CEST	2121	52518	120.79.86.61	192.168.2.16
May 8, 2024 08:42:16.434931040 CEST	52510	2121	192.168.2.16	172.190.237.210
May 8, 2024 08:42:16.435408115 CEST	52536	2121	192.168.2.16	177.173.125.137
May 8, 2024 08:42:16.449918985 CEST	52542	21	192.168.2.16	126.216.119.205
May 8, 2024 08:42:16.450030088 CEST	52599	2121	192.168.2.16	38.207.205.17
May 8, 2024 08:42:16.465917110 CEST	52511	2121	192.168.2.16	62.99.82.15
May 8, 2024 08:42:16.465919971 CEST	52512	21	192.168.2.16	62.99.82.15
May 8, 2024 08:42:16.480643988 CEST	21	52592	79.133.2.40	192.168.2.16
May 8, 2024 08:42:16.481934071 CEST	52514	21	192.168.2.16	115.56.86.19
May 8, 2024 08:42:16.497939110 CEST	52507	21	192.168.2.16	1.246.221.132
May 8, 2024 08:42:16.498028040 CEST	52543	2121	192.168.2.16	126.216.119.205
May 8, 2024 08:42:16.512558937 CEST	2121	52593	79.133.2.40	192.168.2.16
May 8, 2024 08:42:16.513906002 CEST	52606	21	192.168.2.16	59.14.80.32
May 8, 2024 08:42:16.513921022 CEST	21	52467	96.126.118.190	192.168.2.16
May 8, 2024 08:42:16.513926029 CEST	52516	2121	192.168.2.16	115.56.86.19
May 8, 2024 08:42:16.513936996 CEST	52608	2121	192.168.2.16	59.14.80.32
May 8, 2024 08:42:16.513955116 CEST	52600	21	192.168.2.16	213.118.93.224
May 8, 2024 08:42:16.514565945 CEST	52643	2121	192.168.2.16	91.69.213.1
May 8, 2024 08:42:16.514914989 CEST	52467	21	192.168.2.16	96.126.118.190
May 8, 2024 08:42:16.515450001 CEST	21	52568	58.228.231.90	192.168.2.16
May 8, 2024 08:42:16.530220985 CEST	52645	21	192.168.2.16	174.99.83.101
May 8, 2024 08:42:16.545938969 CEST	52519	21	192.168.2.16	79.107.214.63
May 8, 2024 08:42:16.553250074 CEST	2121	52470	96.126.118.190	192.168.2.16
May 8, 2024 08:42:16.553729057 CEST	52470	2121	192.168.2.16	96.126.118.190
May 8, 2024 08:42:16.556988001 CEST	21	52639	34.149.79.8	192.168.2.16
May 8, 2024 08:42:16.557080984 CEST	52639	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:16.557107925 CEST	21	52626	34.149.79.8	192.168.2.16
May 8, 2024 08:42:16.561935902 CEST	52495	21	192.168.2.16	8.210.121.63
May 8, 2024 08:42:16.561944008 CEST	52522	2121	192.168.2.16	79.107.214.63
May 8, 2024 08:42:16.561954975 CEST	52496	2121	192.168.2.16	8.210.121.63
May 8, 2024 08:42:16.561969042 CEST	52521	2121	192.168.2.16	104.107.13.22
May 8, 2024 08:42:16.561971903 CEST	52520	21	192.168.2.16	104.107.13.22
May 8, 2024 08:42:16.566673994 CEST	21	52594	38.239.154.176	192.168.2.16
May 8, 2024 08:42:16.566826105 CEST	52594	21	192.168.2.16	38.239.154.176
May 8, 2024 08:42:16.567051888 CEST	52647	21	192.168.2.16	38.239.154.176
May 8, 2024 08:42:16.567260981 CEST	21	52594	38.239.154.176	192.168.2.16
May 8, 2024 08:42:16.567318916 CEST	52594	21	192.168.2.16	38.239.154.176
May 8, 2024 08:42:16.567658901 CEST	2121	52570	58.228.231.90	192.168.2.16
May 8, 2024 08:42:16.572055101 CEST	2121	52627	34.149.79.8	192.168.2.16
May 8, 2024 08:42:16.572376013 CEST	2121	52641	34.149.79.8	192.168.2.16
May 8, 2024 08:42:16.572444916 CEST	52641	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:16.577907085 CEST	52610	2121	192.168.2.16	84.36.50.25
May 8, 2024 08:42:16.577935934 CEST	52523	21	192.168.2.16	118.87.14.32
May 8, 2024 08:42:16.580435038 CEST	21	52631	172.120.235.139	192.168.2.16
May 8, 2024 08:42:16.580581903 CEST	52631	21	192.168.2.16	172.120.235.139
May 8, 2024 08:42:16.588848114 CEST	21	52601	117.223.205.236	192.168.2.16
May 8, 2024 08:42:16.588993073 CEST	52601	21	192.168.2.16	117.223.205.236
May 8, 2024 08:42:16.593926907 CEST	52525	21	192.168.2.16	66.111.116.250
May 8, 2024 08:42:16.593944073 CEST	52526	2121	192.168.2.16	66.111.116.250
May 8, 2024 08:42:16.593944073 CEST	52508	2121	192.168.2.16	1.246.221.132
May 8, 2024 08:42:16.593950987 CEST	52524	2121	192.168.2.16	118.87.14.32
May 8, 2024 08:42:16.608042002 CEST	21	52537	125.149.109.253	192.168.2.16
May 8, 2024 08:42:16.609930038 CEST	52504	21	192.168.2.16	121.148.8.80
May 8, 2024 08:42:16.609951019 CEST	52502	2121	192.168.2.16	58.186.249.162
May 8, 2024 08:42:16.609961987 CEST	52603	2121	192.168.2.16	213.118.93.224
May 8, 2024 08:42:16.609966040 CEST	52503	2121	192.168.2.16	121.148.8.80
May 8, 2024 08:42:16.609966040 CEST	52527	21	192.168.2.16	208.113.228.78
May 8, 2024 08:42:16.610697031 CEST	52648	2121	192.168.2.16	174.99.83.101
May 8, 2024 08:42:16.610790968 CEST	52649	2121	192.168.2.16	24.232.195.12
May 8, 2024 08:42:16.610791922 CEST	52650	21	192.168.2.16	24.232.195.12
May 8, 2024 08:42:16.613802910 CEST	21	52619	51.38.57.28	192.168.2.16
May 8, 2024 08:42:16.613986015 CEST	52619	21	192.168.2.16	51.38.57.28
May 8, 2024 08:42:16.625948906 CEST	52604	21	192.168.2.16	82.15.12.248
May 8, 2024 08:42:16.626354933 CEST	52651	21	192.168.2.16	125.177.70.124
May 8, 2024 08:42:16.639000893 CEST	21	52607	84.44.255.254	192.168.2.16
May 8, 2024 08:42:16.639291048 CEST	21	52634	84.44.255.254	192.168.2.16
May 8, 2024 08:42:16.639363050 CEST	52634	21	192.168.2.16	84.44.255.254
May 8, 2024 08:42:16.641935110 CEST	52605	2121	192.168.2.16	82.15.12.248
May 8, 2024 08:42:16.642028093 CEST	52501	21	192.168.2.16	58.186.249.162
May 8, 2024 08:42:16.642400026 CEST	52652	2121	192.168.2.16	125.177.70.124
May 8, 2024 08:42:16.642528057 CEST	52653	21	192.168.2.16	61.83.64.58
May 8, 2024 08:42:16.648649931 CEST	2121	52538	125.149.109.253	192.168.2.16
May 8, 2024 08:42:16.654876947 CEST	21	52577	196.210.0.111	192.168.2.16
May 8, 2024 08:42:16.657974005 CEST	52500	2121	192.168.2.16	79.50.168.227
May 8, 2024 08:42:16.674024105 CEST	52528	2121	192.168.2.16	208.113.228.78
May 8, 2024 08:42:16.689939022 CEST	52499	21	192.168.2.16	79.50.168.227
May 8, 2024 08:42:16.705926895 CEST	52529	21	192.168.2.16	23.37.100.62
May 8, 2024 08:42:16.706028938 CEST	52615	21	192.168.2.16	14.42.87.238
May 8, 2024 08:42:16.706031084 CEST	52609	21	192.168.2.16	84.36.50.25
May 8, 2024 08:42:16.714744091 CEST	21	52602	171.244.37.116	192.168.2.16
May 8, 2024 08:42:16.714961052 CEST	52602	21	192.168.2.16	171.244.37.116
May 8, 2024 08:42:16.715162039 CEST	21	52550	117.196.164.98	192.168.2.16
May 8, 2024 08:42:16.720927954 CEST	21	52639	34.149.79.8	192.168.2.16
May 8, 2024 08:42:16.721004963 CEST	52639	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:16.721071959 CEST	52639	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:16.721323013 CEST	52654	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:16.721934080 CEST	52530	2121	192.168.2.16	23.37.100.62
May 8, 2024 08:42:16.721936941 CEST	52616	2121	192.168.2.16	14.42.87.238
May 8, 2024 08:42:16.721987963 CEST	21	52467	96.126.118.190	192.168.2.16
May 8, 2024 08:42:16.722385883 CEST	52467	21	192.168.2.16	96.126.118.190
May 8, 2024 08:42:16.731606960 CEST	21	52531	177.173.125.137	192.168.2.16
May 8, 2024 08:42:16.734922886 CEST	2121	52641	34.149.79.8	192.168.2.16
May 8, 2024 08:42:16.734996080 CEST	52641	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:16.735089064 CEST	52641	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:16.735321999 CEST	52656	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:16.736413956 CEST	2121	52551	117.196.164.98	192.168.2.16
May 8, 2024 08:42:16.736448050 CEST	21	52642	91.69.213.1	192.168.2.16
May 8, 2024 08:42:16.738513947 CEST	52657	2121	192.168.2.16	61.83.64.58
May 8, 2024 08:42:16.738552094 CEST	52658	21	192.168.2.16	90.200.108.245
May 8, 2024 08:42:16.747457027 CEST	21	52542	126.216.119.205	192.168.2.16
May 8, 2024 08:42:16.754255056 CEST	52659	2121	192.168.2.16	90.200.108.245
May 8, 2024 08:42:16.761683941 CEST	2121	52470	96.126.118.190	192.168.2.16
May 8, 2024 08:42:16.762279987 CEST	52470	2121	192.168.2.16	96.126.118.190
May 8, 2024 08:42:16.764683962 CEST	21	52631	172.120.235.139	192.168.2.16
May 8, 2024 08:42:16.765109062 CEST	21	52631	172.120.235.139	192.168.2.16
May 8, 2024 08:42:16.765223026 CEST	52631	21	192.168.2.16	172.120.235.139
May 8, 2024 08:42:16.769954920 CEST	52613	21	192.168.2.16	79.157.117.148
May 8, 2024 08:42:16.770621061 CEST	52661	21	192.168.2.16	27.70.216.73
May 8, 2024 08:42:16.770622969 CEST	52662	2121	192.168.2.16	27.70.216.73
May 8, 2024 08:42:16.770708084 CEST	52663	21	192.168.2.16	80.200.85.226
May 8, 2024 08:42:16.770745039 CEST	52664	2121	192.168.2.16	80.200.85.226
May 8, 2024 08:42:16.784749985 CEST	21	52507	1.246.221.132	192.168.2.16
May 8, 2024 08:42:16.785249949 CEST	52665	21	192.168.2.16	14.33.48.181
May 8, 2024 08:42:16.785926104 CEST	52564	21	192.168.2.16	206.188.231.5
May 8, 2024 08:42:16.785954952 CEST	52565	2121	192.168.2.16	206.188.231.5
May 8, 2024 08:42:16.794290066 CEST	2121	52543	126.216.119.205	192.168.2.16
May 8, 2024 08:42:16.802273035 CEST	52666	2121	192.168.2.16	14.33.48.181
May 8, 2024 08:42:16.811208963 CEST	2121	52536	177.173.125.137	192.168.2.16
May 8, 2024 08:42:16.818216085 CEST	52667	21	192.168.2.16	37.16.27.158
May 8, 2024 08:42:16.830231905 CEST	2121	52608	59.14.80.32	192.168.2.16
May 8, 2024 08:42:16.830276966 CEST	21	52606	59.14.80.32	192.168.2.16
May 8, 2024 08:42:16.832092047 CEST	2121	52643	91.69.213.1	192.168.2.16
May 8, 2024 08:42:16.849921942 CEST	52614	2121	192.168.2.16	79.157.117.148
May 8, 2024 08:42:16.850435972 CEST	52668	2121	192.168.2.16	37.16.27.158
May 8, 2024 08:42:16.850470066 CEST	52669	21	192.168.2.16	94.224.39.238
May 8, 2024 08:42:16.866960049 CEST	21	52594	38.239.154.176	192.168.2.16
May 8, 2024 08:42:16.879704952 CEST	2121	52508	1.246.221.132	192.168.2.16
May 8, 2024 08:42:16.882265091 CEST	52670	2121	192.168.2.16	94.224.39.238
May 8, 2024 08:42:16.882920027 CEST	21	52495	8.210.121.63	192.168.2.16
May 8, 2024 08:42:16.883208990 CEST	21	52639	34.149.79.8	192.168.2.16
May 8, 2024 08:42:16.883656025 CEST	2121	52496	8.210.121.63	192.168.2.16
May 8, 2024 08:42:16.883719921 CEST	21	52654	34.149.79.8	192.168.2.16
May 8, 2024 08:42:16.883795977 CEST	52654	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:16.888535023 CEST	21	52647	38.239.154.176	192.168.2.16
May 8, 2024 08:42:16.888605118 CEST	52647	21	192.168.2.16	38.239.154.176
May 8, 2024 08:42:16.897527933 CEST	2121	52641	34.149.79.8	192.168.2.16
May 8, 2024 08:42:16.897738934 CEST	2121	52656	34.149.79.8	192.168.2.16
May 8, 2024 08:42:16.897809982 CEST	52656	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:16.897933006 CEST	52625	2121	192.168.2.16	45.7.174.124
May 8, 2024 08:42:16.898719072 CEST	52671	2121	192.168.2.16	14.56.103.222
May 8, 2024 08:42:16.898737907 CEST	52672	21	192.168.2.16	99.226.140.144
May 8, 2024 08:42:16.898763895 CEST	52673	21	192.168.2.16	14.56.103.222
May 8, 2024 08:42:16.914007902 CEST	52617	21	192.168.2.16	70.69.249.93
May 8, 2024 08:42:16.914330959 CEST	52674	2121	192.168.2.16	99.226.140.144
May 8, 2024 08:42:16.914350986 CEST	52675	21	192.168.2.16	91.210.56.114
May 8, 2024 08:42:16.928314924 CEST	21	52467	96.126.118.190	192.168.2.16
May 8, 2024 08:42:16.929022074 CEST	52467	21	192.168.2.16	96.126.118.190
May 8, 2024 08:42:16.929929018 CEST	21	52504	121.148.8.80	192.168.2.16
May 8, 2024 08:42:16.929950953 CEST	52618	2121	192.168.2.16	70.69.249.93
May 8, 2024 08:42:16.929960012 CEST	52517	21	192.168.2.16	120.79.86.61
May 8, 2024 08:42:16.930365086 CEST	52677	2121	192.168.2.16	91.210.56.114
May 8, 2024 08:42:16.930464029 CEST	2121	52503	121.148.8.80	192.168.2.16
May 8, 2024 08:42:16.930705070 CEST	52678	21	192.168.2.16	99.84.176.196
May 8, 2024 08:42:16.933231115 CEST	2121	52502	58.186.249.162	192.168.2.16
May 8, 2024 08:42:16.935894966 CEST	21	52619	51.38.57.28	192.168.2.16
May 8, 2024 08:42:16.935909033 CEST	21	52619	51.38.57.28	192.168.2.16
May 8, 2024 08:42:16.936105967 CEST	52619	21	192.168.2.16	51.38.57.28
May 8, 2024 08:42:16.936850071 CEST	2121	52610	84.36.50.25	192.168.2.16
May 8, 2024 08:42:16.944086075 CEST	21	52651	125.177.70.124	192.168.2.16
May 8, 2024 08:42:16.946574926 CEST	52679	2121	192.168.2.16	99.84.176.196
May 8, 2024 08:42:16.946578026 CEST	52518	2121	192.168.2.16	120.79.86.61
May 8, 2024 08:42:16.946618080 CEST	52680	21	192.168.2.16	45.84.171.147
May 8, 2024 08:42:16.953202009 CEST	21	52653	61.83.64.58	192.168.2.16
May 8, 2024 08:42:16.955359936 CEST	21	52634	84.44.255.254	192.168.2.16
May 8, 2024 08:42:16.955427885 CEST	52634	21	192.168.2.16	84.44.255.254
May 8, 2024 08:42:16.955516100 CEST	52634	21	192.168.2.16	84.44.255.254
May 8, 2024 08:42:16.955763102 CEST	52681	21	192.168.2.16	84.44.255.254
May 8, 2024 08:42:16.961934090 CEST	52337	2121	192.168.2.16	62.140.135.146
May 8, 2024 08:42:16.967935085 CEST	2121	52652	125.177.70.124	192.168.2.16
May 8, 2024 08:42:16.968620062 CEST	2121	52470	96.126.118.190	192.168.2.16
May 8, 2024 08:42:16.969095945 CEST	52470	2121	192.168.2.16	96.126.118.190
May 8, 2024 08:42:16.971982956 CEST	2121	52649	24.232.195.12	192.168.2.16
May 8, 2024 08:42:16.972307920 CEST	21	52501	58.186.249.162	192.168.2.16
May 8, 2024 08:42:16.972735882 CEST	52683	2121	192.168.2.16	45.84.171.147
May 8, 2024 08:42:16.973630905 CEST	21	52650	24.232.195.12	192.168.2.16
May 8, 2024 08:42:16.975352049 CEST	21	52631	172.120.235.139	192.168.2.16
May 8, 2024 08:42:16.975483894 CEST	52631	21	192.168.2.16	172.120.235.139
May 8, 2024 08:42:16.975615025 CEST	52684	21	192.168.2.16	172.120.235.139
May 8, 2024 08:42:16.977945089 CEST	52540	21	192.168.2.16	91.179.69.230
May 8, 2024 08:42:16.978331089 CEST	52685	21	192.168.2.16	46.142.20.21
May 8, 2024 08:42:16.978372097 CEST	52686	21	192.168.2.16	20.159.158.251
May 8, 2024 08:42:16.978413105 CEST	52687	2121	192.168.2.16	46.142.20.21
May 8, 2024 08:42:16.980694056 CEST	21	52667	37.16.27.158	192.168.2.16
May 8, 2024 08:42:16.980763912 CEST	52667	21	192.168.2.16	37.16.27.158
May 8, 2024 08:42:16.993935108 CEST	52592	21	192.168.2.16	79.133.2.40
May 8, 2024 08:42:16.994024992 CEST	52340	21	192.168.2.16	62.140.135.146
May 8, 2024 08:42:16.994167089 CEST	52688	2121	192.168.2.16	20.159.158.251
May 8, 2024 08:42:16.998786926 CEST	2121	52500	79.50.168.227	192.168.2.16
May 8, 2024 08:42:17.004358053 CEST	2121	52565	206.188.231.5	192.168.2.16
May 8, 2024 08:42:17.004987955 CEST	21	52564	206.188.231.5	192.168.2.16
May 8, 2024 08:42:17.009217978 CEST	52689	21	192.168.2.16	172.115.192.129
May 8, 2024 08:42:17.014996052 CEST	2121	52668	37.16.27.158	192.168.2.16
May 8, 2024 08:42:17.015072107 CEST	52668	2121	192.168.2.16	37.16.27.158
May 8, 2024 08:42:17.024910927 CEST	52593	2121	192.168.2.16	79.133.2.40
May 8, 2024 08:42:17.024931908 CEST	52568	21	192.168.2.16	58.228.231.90
May 8, 2024 08:42:17.024934053 CEST	52621	21	192.168.2.16	27.208.56.139
May 8, 2024 08:42:17.025517941 CEST	52690	2121	192.168.2.16	172.115.192.129
May 8, 2024 08:42:17.028862953 CEST	21	52615	14.42.87.238	192.168.2.16
May 8, 2024 08:42:17.034141064 CEST	21	52499	79.50.168.227	192.168.2.16
May 8, 2024 08:42:17.035824060 CEST	2121	52616	14.42.87.238	192.168.2.16
May 8, 2024 08:42:17.040942907 CEST	52541	2121	192.168.2.16	91.179.69.230
May 8, 2024 08:42:17.041167021 CEST	52691	21	192.168.2.16	188.48.109.89
May 8, 2024 08:42:17.041167021 CEST	52624	2121	192.168.2.16	27.208.56.139
May 8, 2024 08:42:17.041188002 CEST	52623	21	192.168.2.16	45.7.174.124
May 8, 2024 08:42:17.047977924 CEST	2121	52657	61.83.64.58	192.168.2.16
May 8, 2024 08:42:17.049422026 CEST	21	52654	34.149.79.8	192.168.2.16
May 8, 2024 08:42:17.049505949 CEST	52654	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:17.049562931 CEST	52654	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:17.049751043 CEST	52692	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:17.056283951 CEST	52693	2121	192.168.2.16	188.48.109.89
May 8, 2024 08:42:17.056442976 CEST	52694	21	192.168.2.16	195.253.27.78
May 8, 2024 08:42:17.060369015 CEST	2121	52656	34.149.79.8	192.168.2.16
May 8, 2024 08:42:17.060427904 CEST	52656	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:17.060517073 CEST	52656	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:17.060709000 CEST	52695	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:17.071933985 CEST	52570	2121	192.168.2.16	58.228.231.90
May 8, 2024 08:42:17.072310925 CEST	52696	2121	192.168.2.16	195.253.27.78
May 8, 2024 08:42:17.072375059 CEST	52697	21	192.168.2.16	156.213.148.34
May 8, 2024 08:42:17.086297035 CEST	21	52602	171.244.37.116	192.168.2.16
May 8, 2024 08:42:17.086410999 CEST	52602	21	192.168.2.16	171.244.37.116
May 8, 2024 08:42:17.086548090 CEST	52698	21	192.168.2.16	171.244.37.116
May 8, 2024 08:42:17.087930918 CEST	52628	2121	192.168.2.16	82.14.108.81
May 8, 2024 08:42:17.088449001 CEST	52699	2121	192.168.2.16	156.213.148.34
May 8, 2024 08:42:17.088449955 CEST	52629	21	192.168.2.16	82.14.108.81
May 8, 2024 08:42:17.088469028 CEST	52700	2121	192.168.2.16	207.161.41.167
May 8, 2024 08:42:17.088524103 CEST	52701	21	192.168.2.16	207.161.41.167
May 8, 2024 08:42:17.093416929 CEST	21	52601	117.223.205.236	192.168.2.16
May 8, 2024 08:42:17.094033957 CEST	21	52601	117.223.205.236	192.168.2.16
May 8, 2024 08:42:17.094208002 CEST	52601	21	192.168.2.16	117.223.205.236
May 8, 2024 08:42:17.097646952 CEST	21	52665	14.33.48.181	192.168.2.16
May 8, 2024 08:42:17.103934050 CEST	52544	21	192.168.2.16	84.14.161.154
May 8, 2024 08:42:17.104329109 CEST	52702	21	192.168.2.16	139.130.247.205
May 8, 2024 08:42:17.116286039 CEST	2121	52666	14.33.48.181	192.168.2.16
May 8, 2024 08:42:17.119951010 CEST	52537	21	192.168.2.16	125.149.109.253
May 8, 2024 08:42:17.134860992 CEST	21	52467	96.126.118.190	192.168.2.16
May 8, 2024 08:42:17.135298967 CEST	52467	21	192.168.2.16	96.126.118.190
May 8, 2024 08:42:17.135942936 CEST	52630	21	192.168.2.16	77.207.103.248
May 8, 2024 08:42:17.136226892 CEST	52704	2121	192.168.2.16	139.130.247.205
May 8, 2024 08:42:17.143412113 CEST	21	52667	37.16.27.158	192.168.2.16
May 8, 2024 08:42:17.143440962 CEST	2121	52662	27.70.216.73	192.168.2.16
May 8, 2024 08:42:17.143466949 CEST	52667	21	192.168.2.16	37.16.27.158
May 8, 2024 08:42:17.143517971 CEST	52667	21	192.168.2.16	37.16.27.158
May 8, 2024 08:42:17.143564939 CEST	52667	21	192.168.2.16	37.16.27.158
May 8, 2024 08:42:17.143898010 CEST	52705	21	192.168.2.16	99.225.2.139
May 8, 2024 08:42:17.151942968 CEST	52538	2121	192.168.2.16	125.149.109.253
May 8, 2024 08:42:17.157246113 CEST	21	52684	172.120.235.139	192.168.2.16
May 8, 2024 08:42:17.157299995 CEST	52684	21	192.168.2.16	172.120.235.139
May 8, 2024 08:42:17.157301903 CEST	21	52631	172.120.235.139	192.168.2.16
May 8, 2024 08:42:17.157346010 CEST	52631	21	192.168.2.16	172.120.235.139
May 8, 2024 08:42:17.175185919 CEST	2121	52470	96.126.118.190	192.168.2.16
May 8, 2024 08:42:17.175672054 CEST	52470	2121	192.168.2.16	96.126.118.190
May 8, 2024 08:42:17.177637100 CEST	2121	52668	37.16.27.158	192.168.2.16
May 8, 2024 08:42:17.177685976 CEST	52668	2121	192.168.2.16	37.16.27.158
May 8, 2024 08:42:17.177769899 CEST	52668	2121	192.168.2.16	37.16.27.158
May 8, 2024 08:42:17.177820921 CEST	52668	2121	192.168.2.16	37.16.27.158
May 8, 2024 08:42:17.178138971 CEST	52707	2121	192.168.2.16	99.225.2.139
May 8, 2024 08:42:17.211962938 CEST	21	52692	34.149.79.8	192.168.2.16
May 8, 2024 08:42:17.211977005 CEST	21	52654	34.149.79.8	192.168.2.16
May 8, 2024 08:42:17.212024927 CEST	52692	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:17.212512970 CEST	21	52647	38.239.154.176	192.168.2.16
May 8, 2024 08:42:17.212722063 CEST	52647	21	192.168.2.16	38.239.154.176
May 8, 2024 08:42:17.214968920 CEST	52550	21	192.168.2.16	117.196.164.98
May 8, 2024 08:42:17.215521097 CEST	52708	21	192.168.2.16	91.8.230.74
May 8, 2024 08:42:17.216137886 CEST	2121	52671	14.56.103.222	192.168.2.16
May 8, 2024 08:42:17.217698097 CEST	21	52673	14.56.103.222	192.168.2.16
May 8, 2024 08:42:17.223058939 CEST	2121	52656	34.149.79.8	192.168.2.16
May 8, 2024 08:42:17.223124027 CEST	2121	52695	34.149.79.8	192.168.2.16
May 8, 2024 08:42:17.223182917 CEST	52695	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:17.231290102 CEST	52709	21	192.168.2.16	91.146.97.65
May 8, 2024 08:42:17.246928930 CEST	52531	21	192.168.2.16	177.173.125.137
May 8, 2024 08:42:17.246938944 CEST	52551	2121	192.168.2.16	117.196.164.98
May 8, 2024 08:42:17.246939898 CEST	52549	2121	192.168.2.16	84.14.161.154
May 8, 2024 08:42:17.246944904 CEST	52642	21	192.168.2.16	91.69.213.1
May 8, 2024 08:42:17.255556107 CEST	2121	52625	45.7.174.124	192.168.2.16
May 8, 2024 08:42:17.262922049 CEST	52542	21	192.168.2.16	126.216.119.205
May 8, 2024 08:42:17.263313055 CEST	52710	2121	192.168.2.16	91.8.230.74
May 8, 2024 08:42:17.271332979 CEST	21	52634	84.44.255.254	192.168.2.16
May 8, 2024 08:42:17.274647951 CEST	21	52517	120.79.86.61	192.168.2.16
May 8, 2024 08:42:17.274885893 CEST	21	52580	46.34.34.117	192.168.2.16
May 8, 2024 08:42:17.275007963 CEST	52711	21	192.168.2.16	151.200.237.130
May 8, 2024 08:42:17.275022984 CEST	52580	21	192.168.2.16	46.34.34.117
May 8, 2024 08:42:17.275357008 CEST	52712	21	192.168.2.16	46.34.34.117
May 8, 2024 08:42:17.275511026 CEST	21	52681	84.44.255.254	192.168.2.16
May 8, 2024 08:42:17.275578022 CEST	52681	21	192.168.2.16	84.44.255.254
May 8, 2024 08:42:17.279256105 CEST	52713	2121	192.168.2.16	151.200.237.130
May 8, 2024 08:42:17.286209106 CEST	2121	52518	120.79.86.61	192.168.2.16
May 8, 2024 08:42:17.294919968 CEST	52632	2121	192.168.2.16	77.207.103.248
May 8, 2024 08:42:17.294948101 CEST	52543	2121	192.168.2.16	126.216.119.205
May 8, 2024 08:42:17.295753956 CEST	52714	21	192.168.2.16	20.113.31.216
May 8, 2024 08:42:17.295911074 CEST	52715	2121	192.168.2.16	20.113.31.216
May 8, 2024 08:42:17.296150923 CEST	52716	21	192.168.2.16	201.131.70.62
May 8, 2024 08:42:17.296225071 CEST	21	52619	51.38.57.28	192.168.2.16
May 8, 2024 08:42:17.305921078 CEST	21	52667	37.16.27.158	192.168.2.16
May 8, 2024 08:42:17.305936098 CEST	21	52667	37.16.27.158	192.168.2.16
May 8, 2024 08:42:17.311362028 CEST	52717	2121	192.168.2.16	201.131.70.62
May 8, 2024 08:42:17.311485052 CEST	52718	21	192.168.2.16	107.10.23.54
May 8, 2024 08:42:17.311490059 CEST	21	52568	58.228.231.90	192.168.2.16
May 8, 2024 08:42:17.321151018 CEST	21	52680	45.84.171.147	192.168.2.16
May 8, 2024 08:42:17.326937914 CEST	52536	2121	192.168.2.16	177.173.125.137
May 8, 2024 08:42:17.327214956 CEST	52719	2121	192.168.2.16	107.10.23.54
May 8, 2024 08:42:17.340123892 CEST	2121	52668	37.16.27.158	192.168.2.16
May 8, 2024 08:42:17.340164900 CEST	2121	52668	37.16.27.158	192.168.2.16
May 8, 2024 08:42:17.341134071 CEST	21	52592	79.133.2.40	192.168.2.16
May 8, 2024 08:42:17.341244936 CEST	21	52467	96.126.118.190	192.168.2.16
May 8, 2024 08:42:17.341682911 CEST	52467	21	192.168.2.16	96.126.118.190
May 8, 2024 08:42:17.342905998 CEST	52608	2121	192.168.2.16	59.14.80.32
May 8, 2024 08:42:17.342941999 CEST	52606	21	192.168.2.16	59.14.80.32
May 8, 2024 08:42:17.342943907 CEST	52643	2121	192.168.2.16	91.69.213.1
May 8, 2024 08:42:17.365087032 CEST	2121	52683	45.84.171.147	192.168.2.16
May 8, 2024 08:42:17.365442991 CEST	21	52447	23.229.188.101	192.168.2.16
May 8, 2024 08:42:17.365578890 CEST	52447	21	192.168.2.16	23.229.188.101
May 8, 2024 08:42:17.365816116 CEST	52721	21	192.168.2.16	23.229.188.101
May 8, 2024 08:42:17.372596979 CEST	2121	52593	79.133.2.40	192.168.2.16
May 8, 2024 08:42:17.374197960 CEST	21	52692	34.149.79.8	192.168.2.16
May 8, 2024 08:42:17.374252081 CEST	52692	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:17.374406099 CEST	52692	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:17.374631882 CEST	52722	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:17.375128984 CEST	52723	21	192.168.2.16	96.33.139.67
May 8, 2024 08:42:17.375303030 CEST	52058	2121	192.168.2.16	62.140.135.146
May 8, 2024 08:42:17.378645897 CEST	2121	52570	58.228.231.90	192.168.2.16
May 8, 2024 08:42:17.380903959 CEST	21	52684	172.120.235.139	192.168.2.16
May 8, 2024 08:42:17.381017923 CEST	52684	21	192.168.2.16	172.120.235.139
May 8, 2024 08:42:17.381854057 CEST	2121	52470	96.126.118.190	192.168.2.16
May 8, 2024 08:42:17.382250071 CEST	52470	2121	192.168.2.16	96.126.118.190
May 8, 2024 08:42:17.385641098 CEST	2121	52695	34.149.79.8	192.168.2.16
May 8, 2024 08:42:17.385693073 CEST	52695	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:17.385760069 CEST	52695	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:17.385987997 CEST	52725	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:17.390944004 CEST	52637	2121	192.168.2.16	173.29.240.123
May 8, 2024 08:42:17.390957117 CEST	52638	21	192.168.2.16	176.50.254.243
May 8, 2024 08:42:17.396905899 CEST	52636	21	192.168.2.16	173.29.240.123
May 8, 2024 08:42:17.406936884 CEST	52640	2121	192.168.2.16	176.50.254.243
May 8, 2024 08:42:17.423031092 CEST	52364	21	192.168.2.16	120.24.160.35
May 8, 2024 08:42:17.423281908 CEST	52726	21	192.168.2.16	120.24.160.35
May 8, 2024 08:42:17.432986021 CEST	21	52698	171.244.37.116	192.168.2.16
May 8, 2024 08:42:17.433048010 CEST	52698	21	192.168.2.16	171.244.37.116
May 8, 2024 08:42:17.437731981 CEST	52059	21	192.168.2.16	62.140.135.146
May 8, 2024 08:42:17.437753916 CEST	21	52537	125.149.109.253	192.168.2.16
May 8, 2024 08:42:17.438258886 CEST	52727	2121	192.168.2.16	96.33.139.67
May 8, 2024 08:42:17.438946962 CEST	52610	2121	192.168.2.16	84.36.50.25
May 8, 2024 08:42:17.454920053 CEST	52651	21	192.168.2.16	125.177.70.124
May 8, 2024 08:42:17.454940081 CEST	52653	21	192.168.2.16	61.83.64.58
May 8, 2024 08:42:17.455254078 CEST	52728	21	192.168.2.16	109.134.120.4
May 8, 2024 08:42:17.458020926 CEST	21	52602	171.244.37.116	192.168.2.16
May 8, 2024 08:42:17.458045006 CEST	21	52602	171.244.37.116	192.168.2.16
May 8, 2024 08:42:17.458086014 CEST	52602	21	192.168.2.16	171.244.37.116
May 8, 2024 08:42:17.469944000 CEST	52652	2121	192.168.2.16	125.177.70.124
May 8, 2024 08:42:17.474981070 CEST	2121	52538	125.149.109.253	192.168.2.16
May 8, 2024 08:42:17.475404024 CEST	52729	2121	192.168.2.16	109.134.120.4
May 8, 2024 08:42:17.485929012 CEST	52555	21	192.168.2.16	142.58.253.70
May 8, 2024 08:42:17.485930920 CEST	52650	21	192.168.2.16	24.232.195.12
May 8, 2024 08:42:17.485985041 CEST	52649	2121	192.168.2.16	24.232.195.12
May 8, 2024 08:42:17.517924070 CEST	52564	21	192.168.2.16	206.188.231.5
May 8, 2024 08:42:17.518028975 CEST	52556	2121	192.168.2.16	142.58.253.70
May 8, 2024 08:42:17.518035889 CEST	52565	2121	192.168.2.16	206.188.231.5
May 8, 2024 08:42:17.533940077 CEST	52615	21	192.168.2.16	14.42.87.238
May 8, 2024 08:42:17.533941031 CEST	52645	21	192.168.2.16	174.99.83.101
May 8, 2024 08:42:17.534173965 CEST	21	52647	38.239.154.176	192.168.2.16
May 8, 2024 08:42:17.534276009 CEST	21	52647	38.239.154.176	192.168.2.16
May 8, 2024 08:42:17.534427881 CEST	52647	21	192.168.2.16	38.239.154.176
May 8, 2024 08:42:17.536473036 CEST	21	52692	34.149.79.8	192.168.2.16
May 8, 2024 08:42:17.536766052 CEST	21	52722	34.149.79.8	192.168.2.16
May 8, 2024 08:42:17.536832094 CEST	52722	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:17.547473907 CEST	21	52467	96.126.118.190	192.168.2.16
May 8, 2024 08:42:17.548094034 CEST	52467	21	192.168.2.16	96.126.118.190
May 8, 2024 08:42:17.548105955 CEST	2121	52725	34.149.79.8	192.168.2.16
May 8, 2024 08:42:17.548150063 CEST	2121	52695	34.149.79.8	192.168.2.16
May 8, 2024 08:42:17.548163891 CEST	52725	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:17.549907923 CEST	52616	2121	192.168.2.16	14.42.87.238
May 8, 2024 08:42:17.549936056 CEST	52657	2121	192.168.2.16	61.83.64.58
May 8, 2024 08:42:17.559113979 CEST	21	52542	126.216.119.205	192.168.2.16
May 8, 2024 08:42:17.561065912 CEST	21	52447	23.229.188.101	192.168.2.16
May 8, 2024 08:42:17.561268091 CEST	52447	21	192.168.2.16	23.229.188.101
May 8, 2024 08:42:17.562558889 CEST	21	52447	23.229.188.101	192.168.2.16
May 8, 2024 08:42:17.562731981 CEST	21	52684	172.120.235.139	192.168.2.16
May 8, 2024 08:42:17.562764883 CEST	52447	21	192.168.2.16	23.229.188.101
May 8, 2024 08:42:17.562984943 CEST	21	52684	172.120.235.139	192.168.2.16
May 8, 2024 08:42:17.563146114 CEST	52684	21	192.168.2.16	172.120.235.139
May 8, 2024 08:42:17.564215899 CEST	21	52642	91.69.213.1	192.168.2.16
May 8, 2024 08:42:17.565901041 CEST	52557	21	192.168.2.16	117.2.136.7
May 8, 2024 08:42:17.565922022 CEST	21	52721	23.229.188.101	192.168.2.16
May 8, 2024 08:42:17.566004992 CEST	52721	21	192.168.2.16	23.229.188.101
May 8, 2024 08:42:17.574167013 CEST	21	52601	117.223.205.236	192.168.2.16
May 8, 2024 08:42:17.581923962 CEST	52558	2121	192.168.2.16	117.2.136.7
May 8, 2024 08:42:17.582221031 CEST	52730	21	192.168.2.16	191.102.146.6
May 8, 2024 08:42:17.588243961 CEST	2121	52470	96.126.118.190	192.168.2.16
May 8, 2024 08:42:17.588367939 CEST	52470	2121	192.168.2.16	96.126.118.190
May 8, 2024 08:42:17.591528893 CEST	2121	52543	126.216.119.205	192.168.2.16
May 8, 2024 08:42:17.595447063 CEST	21	52681	84.44.255.254	192.168.2.16
May 8, 2024 08:42:17.595500946 CEST	52681	21	192.168.2.16	84.44.255.254
May 8, 2024 08:42:17.595561981 CEST	52681	21	192.168.2.16	84.44.255.254
May 8, 2024 08:42:17.595760107 CEST	52731	21	192.168.2.16	84.44.255.254
May 8, 2024 08:42:17.597929001 CEST	52561	2121	192.168.2.16	189.230.46.54
May 8, 2024 08:42:17.597981930 CEST	52560	21	192.168.2.16	189.230.46.54
May 8, 2024 08:42:17.597982883 CEST	52563	21	192.168.2.16	71.208.108.88
May 8, 2024 08:42:17.597982883 CEST	52562	2121	192.168.2.16	71.208.108.88
May 8, 2024 08:42:17.598025084 CEST	52665	21	192.168.2.16	14.33.48.181
May 8, 2024 08:42:17.598196983 CEST	52732	2121	192.168.2.16	191.102.146.6
May 8, 2024 08:42:17.611819983 CEST	21	52531	177.173.125.137	192.168.2.16
May 8, 2024 08:42:17.612183094 CEST	52733	21	192.168.2.16	66.31.64.77
May 8, 2024 08:42:17.612941027 CEST	21	52712	46.34.34.117	192.168.2.16
May 8, 2024 08:42:17.613006115 CEST	52712	21	192.168.2.16	46.34.34.117
May 8, 2024 08:42:17.613903046 CEST	52648	2121	192.168.2.16	174.99.83.101
May 8, 2024 08:42:17.614154100 CEST	52734	2121	192.168.2.16	66.31.64.77
May 8, 2024 08:42:17.616816044 CEST	21	52580	46.34.34.117	192.168.2.16
May 8, 2024 08:42:17.616858959 CEST	52580	21	192.168.2.16	46.34.34.117
May 8, 2024 08:42:17.624886036 CEST	21	52577	196.210.0.111	192.168.2.16
May 8, 2024 08:42:17.625010967 CEST	52577	21	192.168.2.16	196.210.0.111
May 8, 2024 08:42:17.625221968 CEST	52735	21	192.168.2.16	196.210.0.111
May 8, 2024 08:42:17.629904032 CEST	52666	2121	192.168.2.16	14.33.48.181
May 8, 2024 08:42:17.629921913 CEST	52567	21	192.168.2.16	75.191.157.107
May 8, 2024 08:42:17.629923105 CEST	52566	2121	192.168.2.16	75.191.157.107
May 8, 2024 08:42:17.645905972 CEST	52572	21	192.168.2.16	20.109.69.47
May 8, 2024 08:42:17.645927906 CEST	52571	2121	192.168.2.16	98.53.238.203
May 8, 2024 08:42:17.645987988 CEST	52569	21	192.168.2.16	98.53.238.203
May 8, 2024 08:42:17.646018982 CEST	52662	2121	192.168.2.16	27.70.216.73
May 8, 2024 08:42:17.650841951 CEST	21	52550	117.196.164.98	192.168.2.16
May 8, 2024 08:42:17.658543110 CEST	2121	52608	59.14.80.32	192.168.2.16
May 8, 2024 08:42:17.659111023 CEST	21	52606	59.14.80.32	192.168.2.16
May 8, 2024 08:42:17.660514116 CEST	2121	52643	91.69.213.1	192.168.2.16
May 8, 2024 08:42:17.661936045 CEST	52573	2121	192.168.2.16	20.109.69.47
May 8, 2024 08:42:17.661937952 CEST	52574	2121	192.168.2.16	178.120.157.17
May 8, 2024 08:42:17.662028074 CEST	52575	21	192.168.2.16	178.120.157.17
May 8, 2024 08:42:17.677917957 CEST	52576	21	192.168.2.16	65.48.76.169
May 8, 2024 08:42:17.691276073 CEST	2121	52551	117.196.164.98	192.168.2.16
May 8, 2024 08:42:17.694350958 CEST	52736	21	192.168.2.16	37.78.201.99
May 8, 2024 08:42:17.697458029 CEST	2121	52536	177.173.125.137	192.168.2.16
May 8, 2024 08:42:17.700052023 CEST	21	52722	34.149.79.8	192.168.2.16
May 8, 2024 08:42:17.700129032 CEST	52722	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:17.700192928 CEST	52722	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:17.700403929 CEST	52737	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:17.710197926 CEST	52738	2121	192.168.2.16	37.78.201.99
May 8, 2024 08:42:17.711489916 CEST	2121	52725	34.149.79.8	192.168.2.16
May 8, 2024 08:42:17.711544037 CEST	52725	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:17.711644888 CEST	52725	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:17.711905003 CEST	52739	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:17.718588114 CEST	21	51802	91.146.97.65	192.168.2.16
May 8, 2024 08:42:17.718630075 CEST	51802	21	192.168.2.16	91.146.97.65
May 8, 2024 08:42:17.725929022 CEST	52671	2121	192.168.2.16	14.56.103.222
May 8, 2024 08:42:17.725943089 CEST	52673	21	192.168.2.16	14.56.103.222
May 8, 2024 08:42:17.737598896 CEST	2121	52565	206.188.231.5	192.168.2.16
May 8, 2024 08:42:17.738240957 CEST	21	52564	206.188.231.5	192.168.2.16
May 8, 2024 08:42:17.741931915 CEST	52658	21	192.168.2.16	90.200.108.245
May 8, 2024 08:42:17.742316961 CEST	52740	21	192.168.2.16	79.117.51.233
May 8, 2024 08:42:17.742429018 CEST	52741	2121	192.168.2.16	79.117.51.233
May 8, 2024 08:42:17.754033089 CEST	21	52467	96.126.118.190	192.168.2.16
May 8, 2024 08:42:17.754462004 CEST	52467	21	192.168.2.16	96.126.118.190
May 8, 2024 08:42:17.754615068 CEST	52743	21	192.168.2.16	96.126.118.190
May 8, 2024 08:42:17.757934093 CEST	52659	2121	192.168.2.16	90.200.108.245
May 8, 2024 08:42:17.757941008 CEST	52625	2121	192.168.2.16	45.7.174.124
May 8, 2024 08:42:17.758358955 CEST	52744	21	192.168.2.16	84.80.237.2
May 8, 2024 08:42:17.762031078 CEST	52745	2121	192.168.2.16	84.80.237.2
May 8, 2024 08:42:17.765522003 CEST	21	52653	61.83.64.58	192.168.2.16
May 8, 2024 08:42:17.765894890 CEST	21	52726	120.24.160.35	192.168.2.16
May 8, 2024 08:42:17.765976906 CEST	52726	21	192.168.2.16	120.24.160.35
May 8, 2024 08:42:17.768974066 CEST	21	52721	23.229.188.101	192.168.2.16
May 8, 2024 08:42:17.769161940 CEST	52721	21	192.168.2.16	23.229.188.101
May 8, 2024 08:42:17.769581079 CEST	21	52684	172.120.235.139	192.168.2.16
May 8, 2024 08:42:17.769686937 CEST	52684	21	192.168.2.16	172.120.235.139
May 8, 2024 08:42:17.769886971 CEST	52746	21	192.168.2.16	172.120.235.139
May 8, 2024 08:42:17.772557020 CEST	21	52651	125.177.70.124	192.168.2.16
May 8, 2024 08:42:17.773988962 CEST	52664	2121	192.168.2.16	80.200.85.226
May 8, 2024 08:42:17.774013996 CEST	52661	21	192.168.2.16	27.70.216.73
May 8, 2024 08:42:17.774234056 CEST	52747	21	192.168.2.16	88.85.176.111
May 8, 2024 08:42:17.774281025 CEST	52663	21	192.168.2.16	80.200.85.226
May 8, 2024 08:42:17.779464960 CEST	21	52698	171.244.37.116	192.168.2.16
May 8, 2024 08:42:17.779624939 CEST	52698	21	192.168.2.16	171.244.37.116
May 8, 2024 08:42:17.790369034 CEST	52748	2121	192.168.2.16	88.85.176.111
May 8, 2024 08:42:17.794548035 CEST	2121	52470	96.126.118.190	192.168.2.16
May 8, 2024 08:42:17.795114040 CEST	52470	2121	192.168.2.16	96.126.118.190
May 8, 2024 08:42:17.795310974 CEST	52750	2121	192.168.2.16	96.126.118.190
May 8, 2024 08:42:17.795386076 CEST	2121	52652	125.177.70.124	192.168.2.16
May 8, 2024 08:42:17.798187971 CEST	2121	52610	84.36.50.25	192.168.2.16
May 8, 2024 08:42:17.808851004 CEST	21	52364	120.24.160.35	192.168.2.16
May 8, 2024 08:42:17.821955919 CEST	52568	21	192.168.2.16	58.228.231.90
May 8, 2024 08:42:17.822051048 CEST	52680	21	192.168.2.16	45.84.171.147
May 8, 2024 08:42:17.822293997 CEST	52751	21	192.168.2.16	86.51.153.63
May 8, 2024 08:42:17.838336945 CEST	52752	2121	192.168.2.16	86.51.153.63
May 8, 2024 08:42:17.847537041 CEST	21	52650	24.232.195.12	192.168.2.16
May 8, 2024 08:42:17.847737074 CEST	2121	52649	24.232.195.12	192.168.2.16
May 8, 2024 08:42:17.853925943 CEST	52592	21	192.168.2.16	79.133.2.40
May 8, 2024 08:42:17.853929996 CEST	52669	21	192.168.2.16	94.224.39.238
May 8, 2024 08:42:17.854290009 CEST	52753	21	192.168.2.16	108.51.123.143
May 8, 2024 08:42:17.857697010 CEST	21	52647	38.239.154.176	192.168.2.16
May 8, 2024 08:42:17.857841015 CEST	52647	21	192.168.2.16	38.239.154.176
May 8, 2024 08:42:17.857980967 CEST	52754	21	192.168.2.16	38.239.154.176
May 8, 2024 08:42:17.858437061 CEST	21	52647	38.239.154.176	192.168.2.16
May 8, 2024 08:42:17.858494997 CEST	52647	21	192.168.2.16	38.239.154.176
May 8, 2024 08:42:17.858530045 CEST	21	52615	14.42.87.238	192.168.2.16
May 8, 2024 08:42:17.858827114 CEST	2121	52657	61.83.64.58	192.168.2.16
May 8, 2024 08:42:17.862514973 CEST	21	52722	34.149.79.8	192.168.2.16
May 8, 2024 08:42:17.862762928 CEST	21	52737	34.149.79.8	192.168.2.16
May 8, 2024 08:42:17.862838030 CEST	52737	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:17.866616011 CEST	2121	52616	14.42.87.238	192.168.2.16
May 8, 2024 08:42:17.869954109 CEST	52683	2121	192.168.2.16	45.84.171.147
May 8, 2024 08:42:17.870306969 CEST	52755	2121	192.168.2.16	108.51.123.143
May 8, 2024 08:42:17.873711109 CEST	2121	52725	34.149.79.8	192.168.2.16
May 8, 2024 08:42:17.874305010 CEST	2121	52739	34.149.79.8	192.168.2.16
May 8, 2024 08:42:17.874370098 CEST	52739	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:17.885942936 CEST	52570	2121	192.168.2.16	58.228.231.90
May 8, 2024 08:42:17.885943890 CEST	52593	2121	192.168.2.16	79.133.2.40
May 8, 2024 08:42:17.885966063 CEST	52670	2121	192.168.2.16	94.224.39.238
May 8, 2024 08:42:17.901957989 CEST	52672	21	192.168.2.16	99.226.140.144
May 8, 2024 08:42:17.910938978 CEST	21	52665	14.33.48.181	192.168.2.16
May 8, 2024 08:42:17.915230989 CEST	21	52731	84.44.255.254	192.168.2.16
May 8, 2024 08:42:17.915254116 CEST	21	52681	84.44.255.254	192.168.2.16
May 8, 2024 08:42:17.915309906 CEST	52731	21	192.168.2.16	84.44.255.254
May 8, 2024 08:42:17.917941093 CEST	52674	2121	192.168.2.16	99.226.140.144
May 8, 2024 08:42:17.917943954 CEST	52675	21	192.168.2.16	91.210.56.114
May 8, 2024 08:42:17.918266058 CEST	52756	21	192.168.2.16	174.112.199.80
May 8, 2024 08:42:17.933932066 CEST	52581	2121	192.168.2.16	65.48.76.169
May 8, 2024 08:42:17.933942080 CEST	52677	2121	192.168.2.16	91.210.56.114
May 8, 2024 08:42:17.934026003 CEST	52678	21	192.168.2.16	99.84.176.196
May 8, 2024 08:42:17.934333086 CEST	52757	2121	192.168.2.16	174.112.199.80
May 8, 2024 08:42:17.944868088 CEST	2121	52666	14.33.48.181	192.168.2.16
May 8, 2024 08:42:17.949918985 CEST	52582	21	192.168.2.16	76.53.43.125
May 8, 2024 08:42:17.949930906 CEST	52679	2121	192.168.2.16	99.84.176.196
May 8, 2024 08:42:17.951426029 CEST	21	52684	172.120.235.139	192.168.2.16
May 8, 2024 08:42:17.951491117 CEST	52684	21	192.168.2.16	172.120.235.139
May 8, 2024 08:42:17.951539040 CEST	21	52746	172.120.235.139	192.168.2.16
May 8, 2024 08:42:17.951617956 CEST	52746	21	192.168.2.16	172.120.235.139
May 8, 2024 08:42:17.961028099 CEST	21	52743	96.126.118.190	192.168.2.16
May 8, 2024 08:42:17.961107969 CEST	52743	21	192.168.2.16	96.126.118.190
May 8, 2024 08:42:17.964433908 CEST	21	52712	46.34.34.117	192.168.2.16
May 8, 2024 08:42:17.964616060 CEST	52712	21	192.168.2.16	46.34.34.117
May 8, 2024 08:42:17.969513893 CEST	21	52721	23.229.188.101	192.168.2.16
May 8, 2024 08:42:17.969739914 CEST	21	52721	23.229.188.101	192.168.2.16
May 8, 2024 08:42:17.969928026 CEST	52721	21	192.168.2.16	23.229.188.101
May 8, 2024 08:42:17.981956959 CEST	52685	21	192.168.2.16	46.142.20.21
May 8, 2024 08:42:17.981978893 CEST	52686	21	192.168.2.16	20.159.158.251
May 8, 2024 08:42:17.982247114 CEST	52687	2121	192.168.2.16	46.142.20.21
May 8, 2024 08:42:17.997941017 CEST	52688	2121	192.168.2.16	20.159.158.251
May 8, 2024 08:42:18.001137972 CEST	21	52467	96.126.118.190	192.168.2.16
May 8, 2024 08:42:18.001322031 CEST	2121	52750	96.126.118.190	192.168.2.16
May 8, 2024 08:42:18.001394987 CEST	52750	2121	192.168.2.16	96.126.118.190
May 8, 2024 08:42:18.013942003 CEST	52689	21	192.168.2.16	172.115.192.129
May 8, 2024 08:42:18.019442081 CEST	2121	52662	27.70.216.73	192.168.2.16
May 8, 2024 08:42:18.026628971 CEST	21	52737	34.149.79.8	192.168.2.16
May 8, 2024 08:42:18.026699066 CEST	52737	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:18.026798964 CEST	52737	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:18.027075052 CEST	52758	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:18.029938936 CEST	52690	2121	192.168.2.16	172.115.192.129
May 8, 2024 08:42:18.036892891 CEST	2121	52739	34.149.79.8	192.168.2.16
May 8, 2024 08:42:18.036959887 CEST	52739	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:18.037086010 CEST	52739	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:18.037385941 CEST	52759	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:18.042985916 CEST	2121	52671	14.56.103.222	192.168.2.16
May 8, 2024 08:42:18.044420004 CEST	2121	52470	96.126.118.190	192.168.2.16
May 8, 2024 08:42:18.045921087 CEST	52691	21	192.168.2.16	188.48.109.89
May 8, 2024 08:42:18.045929909 CEST	52583	2121	192.168.2.16	76.53.43.125
May 8, 2024 08:42:18.047550917 CEST	21	52673	14.56.103.222	192.168.2.16
May 8, 2024 08:42:18.061952114 CEST	52693	2121	192.168.2.16	188.48.109.89
May 8, 2024 08:42:18.062030077 CEST	52694	21	192.168.2.16	195.253.27.78
May 8, 2024 08:42:18.077965975 CEST	52642	21	192.168.2.16	91.69.213.1
May 8, 2024 08:42:18.077970982 CEST	52585	21	192.168.2.16	23.1.144.246
May 8, 2024 08:42:18.077996969 CEST	52586	2121	192.168.2.16	23.1.144.246
May 8, 2024 08:42:18.077996969 CEST	52697	21	192.168.2.16	156.213.148.34
May 8, 2024 08:42:18.078000069 CEST	52696	2121	192.168.2.16	195.253.27.78
May 8, 2024 08:42:18.093904018 CEST	52701	21	192.168.2.16	207.161.41.167
May 8, 2024 08:42:18.093907118 CEST	52700	2121	192.168.2.16	207.161.41.167
May 8, 2024 08:42:18.093924046 CEST	52699	2121	192.168.2.16	156.213.148.34
May 8, 2024 08:42:18.102300882 CEST	21	52735	196.210.0.111	192.168.2.16
May 8, 2024 08:42:18.102416039 CEST	52735	21	192.168.2.16	196.210.0.111
May 8, 2024 08:42:18.109957933 CEST	52588	21	192.168.2.16	222.124.81.78
May 8, 2024 08:42:18.110034943 CEST	52702	21	192.168.2.16	139.130.247.205
May 8, 2024 08:42:18.110320091 CEST	52760	21	192.168.2.16	178.196.176.3
May 8, 2024 08:42:18.111191034 CEST	21	52726	120.24.160.35	192.168.2.16
May 8, 2024 08:42:18.111279964 CEST	21	52568	58.228.231.90	192.168.2.16
May 8, 2024 08:42:18.111908913 CEST	52726	21	192.168.2.16	120.24.160.35
May 8, 2024 08:42:18.113786936 CEST	52761	2121	192.168.2.16	178.196.176.3
May 8, 2024 08:42:18.115686893 CEST	2121	52625	45.7.174.124	192.168.2.16
May 8, 2024 08:42:18.116185904 CEST	21	52577	196.210.0.111	192.168.2.16
May 8, 2024 08:42:18.116244078 CEST	52577	21	192.168.2.16	196.210.0.111
May 8, 2024 08:42:18.126100063 CEST	21	52698	171.244.37.116	192.168.2.16
May 8, 2024 08:42:18.126223087 CEST	52698	21	192.168.2.16	171.244.37.116
May 8, 2024 08:42:18.126389980 CEST	52762	21	192.168.2.16	27.11.119.251
May 8, 2024 08:42:18.142035961 CEST	52704	2121	192.168.2.16	139.130.247.205
May 8, 2024 08:42:18.142100096 CEST	21	52747	88.85.176.111	192.168.2.16
May 8, 2024 08:42:18.142623901 CEST	52763	2121	192.168.2.16	27.11.119.251
May 8, 2024 08:42:18.142680883 CEST	52764	21	192.168.2.16	95.252.27.121
May 8, 2024 08:42:18.142755032 CEST	52766	2121	192.168.2.16	95.121.52.45
May 8, 2024 08:42:18.142755985 CEST	52765	21	192.168.2.16	95.121.52.45
May 8, 2024 08:42:18.157926083 CEST	52705	21	192.168.2.16	99.225.2.139
May 8, 2024 08:42:18.158211946 CEST	21	52754	38.239.154.176	192.168.2.16
May 8, 2024 08:42:18.158237934 CEST	52550	21	192.168.2.16	117.196.164.98
May 8, 2024 08:42:18.158916950 CEST	52754	21	192.168.2.16	38.239.154.176
May 8, 2024 08:42:18.160996914 CEST	2121	52748	88.85.176.111	192.168.2.16
May 8, 2024 08:42:18.168344975 CEST	21	52746	172.120.235.139	192.168.2.16
May 8, 2024 08:42:18.169045925 CEST	52746	21	192.168.2.16	172.120.235.139
May 8, 2024 08:42:18.173948050 CEST	52608	2121	192.168.2.16	59.14.80.32
May 8, 2024 08:42:18.173948050 CEST	52606	21	192.168.2.16	59.14.80.32
May 8, 2024 08:42:18.173973083 CEST	52643	2121	192.168.2.16	91.69.213.1
May 8, 2024 08:42:18.174621105 CEST	52768	21	192.168.2.16	69.136.37.217
May 8, 2024 08:42:18.174622059 CEST	52767	2121	192.168.2.16	95.252.27.121
May 8, 2024 08:42:18.174786091 CEST	52770	21	192.168.2.16	13.249.157.223
May 8, 2024 08:42:18.174786091 CEST	52769	2121	192.168.2.16	69.136.37.217
May 8, 2024 08:42:18.179343939 CEST	21	52647	38.239.154.176	192.168.2.16
May 8, 2024 08:42:18.189121962 CEST	21	52737	34.149.79.8	192.168.2.16
May 8, 2024 08:42:18.189441919 CEST	21	52758	34.149.79.8	192.168.2.16
May 8, 2024 08:42:18.189932108 CEST	52707	2121	192.168.2.16	99.225.2.139
May 8, 2024 08:42:18.189960957 CEST	52758	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:18.190404892 CEST	52771	2121	192.168.2.16	13.249.157.223
May 8, 2024 08:42:18.190412998 CEST	52772	2121	192.168.2.16	67.10.243.234
May 8, 2024 08:42:18.190444946 CEST	52773	21	192.168.2.16	67.10.243.234
May 8, 2024 08:42:18.193236113 CEST	2121	52570	58.228.231.90	192.168.2.16
May 8, 2024 08:42:18.194016933 CEST	52774	21	192.168.2.16	168.182.182.67
May 8, 2024 08:42:18.199399948 CEST	2121	52739	34.149.79.8	192.168.2.16
May 8, 2024 08:42:18.199703932 CEST	2121	52759	34.149.79.8	192.168.2.16
May 8, 2024 08:42:18.201282978 CEST	21	52592	79.133.2.40	192.168.2.16
May 8, 2024 08:42:18.202033043 CEST	52759	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:18.206423998 CEST	52551	2121	192.168.2.16	117.196.164.98
May 8, 2024 08:42:18.210369110 CEST	21	52721	23.229.188.101	192.168.2.16
May 8, 2024 08:42:18.211721897 CEST	21	52751	86.51.153.63	192.168.2.16
May 8, 2024 08:42:18.211971998 CEST	52751	21	192.168.2.16	86.51.153.63
May 8, 2024 08:42:18.212421894 CEST	2121	52752	86.51.153.63	192.168.2.16
May 8, 2024 08:42:18.213146925 CEST	21	52680	45.84.171.147	192.168.2.16
May 8, 2024 08:42:18.222069979 CEST	52708	21	192.168.2.16	91.8.230.74
May 8, 2024 08:42:18.222349882 CEST	52775	2121	192.168.2.16	168.182.182.67
May 8, 2024 08:42:18.233592033 CEST	2121	52593	79.133.2.40	192.168.2.16
May 8, 2024 08:42:18.234870911 CEST	21	52731	84.44.255.254	192.168.2.16
May 8, 2024 08:42:18.235377073 CEST	52731	21	192.168.2.16	84.44.255.254
May 8, 2024 08:42:18.235661030 CEST	52731	21	192.168.2.16	84.44.255.254
May 8, 2024 08:42:18.235665083 CEST	52776	21	192.168.2.16	84.44.255.254
May 8, 2024 08:42:18.237945080 CEST	52591	2121	192.168.2.16	222.124.81.78
May 8, 2024 08:42:18.238229990 CEST	52709	21	192.168.2.16	91.146.97.65
May 8, 2024 08:42:18.238571882 CEST	52778	21	192.168.2.16	73.250.24.123
May 8, 2024 08:42:18.238573074 CEST	52777	21	192.168.2.16	94.134.82.214
May 8, 2024 08:42:18.238573074 CEST	52779	2121	192.168.2.16	73.250.24.123
May 8, 2024 08:42:18.248878002 CEST	2121	52683	45.84.171.147	192.168.2.16
May 8, 2024 08:42:18.256119967 CEST	52780	2121	192.168.2.16	94.134.82.214
May 8, 2024 08:42:18.269927979 CEST	52710	2121	192.168.2.16	91.8.230.74
May 8, 2024 08:42:18.270030022 CEST	52653	21	192.168.2.16	61.83.64.58
May 8, 2024 08:42:18.270277977 CEST	52781	21	192.168.2.16	60.132.78.147
May 8, 2024 08:42:18.285952091 CEST	52651	21	192.168.2.16	125.177.70.124
May 8, 2024 08:42:18.286138058 CEST	52713	2121	192.168.2.16	151.200.237.130
May 8, 2024 08:42:18.286217928 CEST	52711	21	192.168.2.16	151.200.237.130
May 8, 2024 08:42:18.299247026 CEST	21	52364	120.24.160.35	192.168.2.16
May 8, 2024 08:42:18.299267054 CEST	21	52364	120.24.160.35	192.168.2.16
May 8, 2024 08:42:18.299338102 CEST	52364	21	192.168.2.16	120.24.160.35
May 8, 2024 08:42:18.299372911 CEST	52364	21	192.168.2.16	120.24.160.35
May 8, 2024 08:42:18.299523115 CEST	21	52364	120.24.160.35	192.168.2.16
May 8, 2024 08:42:18.299628019 CEST	52364	21	192.168.2.16	120.24.160.35
May 8, 2024 08:42:18.299925089 CEST	21	52712	46.34.34.117	192.168.2.16
May 8, 2024 08:42:18.300076008 CEST	21	52712	46.34.34.117	192.168.2.16
May 8, 2024 08:42:18.300693989 CEST	52712	21	192.168.2.16	46.34.34.117
May 8, 2024 08:42:18.301937103 CEST	52715	2121	192.168.2.16	20.113.31.216
May 8, 2024 08:42:18.301939011 CEST	52652	2121	192.168.2.16	125.177.70.124
May 8, 2024 08:42:18.301953077 CEST	52714	21	192.168.2.16	20.113.31.216
May 8, 2024 08:42:18.301966906 CEST	52716	21	192.168.2.16	201.131.70.62
May 8, 2024 08:42:18.302035093 CEST	52610	2121	192.168.2.16	84.36.50.25
May 8, 2024 08:42:18.302583933 CEST	52782	2121	192.168.2.16	60.132.78.147
May 8, 2024 08:42:18.317222118 CEST	52783	21	192.168.2.16	98.36.128.209
May 8, 2024 08:42:18.317259073 CEST	52717	2121	192.168.2.16	201.131.70.62
May 8, 2024 08:42:18.317318916 CEST	52718	21	192.168.2.16	107.10.23.54
May 8, 2024 08:42:18.332926035 CEST	52719	2121	192.168.2.16	107.10.23.54
May 8, 2024 08:42:18.348931074 CEST	52597	21	192.168.2.16	38.207.205.17
May 8, 2024 08:42:18.348934889 CEST	52650	21	192.168.2.16	24.232.195.12
May 8, 2024 08:42:18.348989964 CEST	52649	2121	192.168.2.16	24.232.195.12
May 8, 2024 08:42:18.351645947 CEST	21	52746	172.120.235.139	192.168.2.16
May 8, 2024 08:42:18.352157116 CEST	21	52746	172.120.235.139	192.168.2.16
May 8, 2024 08:42:18.352415085 CEST	52746	21	192.168.2.16	172.120.235.139
May 8, 2024 08:42:18.353784084 CEST	21	52758	34.149.79.8	192.168.2.16
May 8, 2024 08:42:18.353941917 CEST	52758	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:18.354001999 CEST	52758	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:18.354207039 CEST	52784	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:18.364913940 CEST	52657	2121	192.168.2.16	61.83.64.58
May 8, 2024 08:42:18.365933895 CEST	2121	52759	34.149.79.8	192.168.2.16
May 8, 2024 08:42:18.366097927 CEST	52759	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:18.366097927 CEST	52759	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:18.366610050 CEST	52785	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:18.380053043 CEST	52615	21	192.168.2.16	14.42.87.238
May 8, 2024 08:42:18.380948067 CEST	52616	2121	192.168.2.16	14.42.87.238
May 8, 2024 08:42:18.380948067 CEST	52723	21	192.168.2.16	96.33.139.67
May 8, 2024 08:42:18.395168066 CEST	21	52642	91.69.213.1	192.168.2.16
May 8, 2024 08:42:18.412998915 CEST	52665	21	192.168.2.16	14.33.48.181
May 8, 2024 08:42:18.413338900 CEST	52786	2121	192.168.2.16	98.36.128.209
May 8, 2024 08:42:18.427748919 CEST	2121	51660	96.126.118.190	192.168.2.16
May 8, 2024 08:42:18.427805901 CEST	21	51654	96.126.118.190	192.168.2.16
May 8, 2024 08:42:18.427838087 CEST	51660	2121	192.168.2.16	96.126.118.190
May 8, 2024 08:42:18.427887917 CEST	51654	21	192.168.2.16	96.126.118.190
May 8, 2024 08:42:18.429697037 CEST	52787	21	192.168.2.16	172.117.76.139
May 8, 2024 08:42:18.445281982 CEST	52727	2121	192.168.2.16	96.33.139.67
May 8, 2024 08:42:18.459952116 CEST	52728	21	192.168.2.16	109.134.120.4
May 8, 2024 08:42:18.459954977 CEST	52599	2121	192.168.2.16	38.207.205.17
May 8, 2024 08:42:18.459954977 CEST	52666	2121	192.168.2.16	14.33.48.181
May 8, 2024 08:42:18.460470915 CEST	21	52754	38.239.154.176	192.168.2.16
May 8, 2024 08:42:18.460648060 CEST	52789	2121	192.168.2.16	172.117.76.139
May 8, 2024 08:42:18.460690975 CEST	52788	21	192.168.2.16	120.79.9.235
May 8, 2024 08:42:18.460748911 CEST	52754	21	192.168.2.16	38.239.154.176
May 8, 2024 08:42:18.461182117 CEST	21	52726	120.24.160.35	192.168.2.16
May 8, 2024 08:42:18.461287975 CEST	21	52726	120.24.160.35	192.168.2.16
May 8, 2024 08:42:18.462857008 CEST	52726	21	192.168.2.16	120.24.160.35
May 8, 2024 08:42:18.473531008 CEST	21	52698	171.244.37.116	192.168.2.16
May 8, 2024 08:42:18.473664999 CEST	52698	21	192.168.2.16	171.244.37.116
May 8, 2024 08:42:18.473887920 CEST	52790	21	192.168.2.16	171.244.37.116
May 8, 2024 08:42:18.476232052 CEST	52791	2121	192.168.2.16	120.79.9.235
May 8, 2024 08:42:18.490118027 CEST	2121	52608	59.14.80.32	192.168.2.16
May 8, 2024 08:42:18.490232944 CEST	21	52606	59.14.80.32	192.168.2.16
May 8, 2024 08:42:18.491447926 CEST	2121	52643	91.69.213.1	192.168.2.16
May 8, 2024 08:42:18.499922037 CEST	52729	2121	192.168.2.16	109.134.120.4
May 8, 2024 08:42:18.507266998 CEST	52792	21	192.168.2.16	106.200.113.162
May 8, 2024 08:42:18.516346931 CEST	21	52758	34.149.79.8	192.168.2.16
May 8, 2024 08:42:18.516415119 CEST	21	52784	34.149.79.8	192.168.2.16
May 8, 2024 08:42:18.516767979 CEST	52784	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:18.522934914 CEST	52662	2121	192.168.2.16	27.70.216.73
May 8, 2024 08:42:18.522938013 CEST	52600	21	192.168.2.16	213.118.93.224
May 8, 2024 08:42:18.528667927 CEST	2121	52759	34.149.79.8	192.168.2.16
May 8, 2024 08:42:18.529238939 CEST	2121	52785	34.149.79.8	192.168.2.16
May 8, 2024 08:42:18.532321930 CEST	52785	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:18.539231062 CEST	52793	2121	192.168.2.16	106.200.113.162
May 8, 2024 08:42:18.551604986 CEST	21	52776	84.44.255.254	192.168.2.16
May 8, 2024 08:42:18.551712036 CEST	52776	21	192.168.2.16	84.44.255.254
May 8, 2024 08:42:18.554946899 CEST	52671	2121	192.168.2.16	14.56.103.222
May 8, 2024 08:42:18.554948092 CEST	52673	21	192.168.2.16	14.56.103.222
May 8, 2024 08:42:18.554960966 CEST	21	52731	84.44.255.254	192.168.2.16
May 8, 2024 08:42:18.555598021 CEST	52794	2121	192.168.2.16	222.136.152.252
May 8, 2024 08:42:18.555708885 CEST	52795	21	192.168.2.16	211.246.184.173
May 8, 2024 08:42:18.555969000 CEST	52796	21	192.168.2.16	222.136.152.252
May 8, 2024 08:42:18.558665991 CEST	21	52746	172.120.235.139	192.168.2.16
May 8, 2024 08:42:18.558847904 CEST	52746	21	192.168.2.16	172.120.235.139
May 8, 2024 08:42:18.560812950 CEST	52797	21	192.168.2.16	172.120.235.139
May 8, 2024 08:42:18.563347101 CEST	21	52781	60.132.78.147	192.168.2.16
May 8, 2024 08:42:18.571146011 CEST	52798	2121	192.168.2.16	211.246.184.173
May 8, 2024 08:42:18.578272104 CEST	21	52601	117.223.205.236	192.168.2.16
May 8, 2024 08:42:18.578603983 CEST	52601	21	192.168.2.16	117.223.205.236
May 8, 2024 08:42:18.578603983 CEST	52799	21	192.168.2.16	117.223.205.236
May 8, 2024 08:42:18.580413103 CEST	21	52653	61.83.64.58	192.168.2.16
May 8, 2024 08:42:18.586936951 CEST	52730	21	192.168.2.16	191.102.146.6
May 8, 2024 08:42:18.587629080 CEST	52801	21	192.168.2.16	32.219.249.216
May 8, 2024 08:42:18.587632895 CEST	52800	21	192.168.2.16	98.29.67.27
May 8, 2024 08:42:18.589996099 CEST	52802	2121	192.168.2.16	98.29.67.27
May 8, 2024 08:42:18.594819069 CEST	21	52550	117.196.164.98	192.168.2.16
May 8, 2024 08:42:18.595432043 CEST	2121	52782	60.132.78.147	192.168.2.16
May 8, 2024 08:42:18.602940083 CEST	52732	2121	192.168.2.16	191.102.146.6
May 8, 2024 08:42:18.604064941 CEST	21	52651	125.177.70.124	192.168.2.16
May 8, 2024 08:42:18.604095936 CEST	52803	2121	192.168.2.16	32.219.249.216
May 8, 2024 08:42:18.608298063 CEST	21	52735	196.210.0.111	192.168.2.16
May 8, 2024 08:42:18.609518051 CEST	52735	21	192.168.2.16	196.210.0.111
May 8, 2024 08:42:18.611438990 CEST	21	52751	86.51.153.63	192.168.2.16
May 8, 2024 08:42:18.611546993 CEST	52751	21	192.168.2.16	86.51.153.63
May 8, 2024 08:42:18.614028931 CEST	52804	21	192.168.2.16	191.136.203.161
May 8, 2024 08:42:18.618911982 CEST	52603	2121	192.168.2.16	213.118.93.224
May 8, 2024 08:42:18.618911982 CEST	52733	21	192.168.2.16	66.31.64.77
May 8, 2024 08:42:18.618931055 CEST	52734	2121	192.168.2.16	66.31.64.77
May 8, 2024 08:42:18.618942022 CEST	52625	2121	192.168.2.16	45.7.174.124
May 8, 2024 08:42:18.619223118 CEST	52805	2121	192.168.2.16	191.136.203.161
May 8, 2024 08:42:18.628139019 CEST	2121	52652	125.177.70.124	192.168.2.16
May 8, 2024 08:42:18.634944916 CEST	52604	21	192.168.2.16	82.15.12.248
May 8, 2024 08:42:18.649858952 CEST	2121	52551	117.196.164.98	192.168.2.16
May 8, 2024 08:42:18.650295019 CEST	52806	21	192.168.2.16	175.125.169.40
May 8, 2024 08:42:18.650935888 CEST	52605	2121	192.168.2.16	82.15.12.248
May 8, 2024 08:42:18.650937080 CEST	52747	21	192.168.2.16	88.85.176.111
May 8, 2024 08:42:18.663332939 CEST	2121	52610	84.36.50.25	192.168.2.16
May 8, 2024 08:42:18.667259932 CEST	52807	2121	192.168.2.16	175.125.169.40
May 8, 2024 08:42:18.667259932 CEST	52748	2121	192.168.2.16	88.85.176.111
May 8, 2024 08:42:18.669404030 CEST	21	52712	46.34.34.117	192.168.2.16
May 8, 2024 08:42:18.674449921 CEST	2121	52657	61.83.64.58	192.168.2.16
May 8, 2024 08:42:18.680620909 CEST	21	52784	34.149.79.8	192.168.2.16
May 8, 2024 08:42:18.684227943 CEST	52784	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:18.684227943 CEST	52784	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:18.685312986 CEST	52808	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:18.696446896 CEST	2121	52785	34.149.79.8	192.168.2.16
May 8, 2024 08:42:18.696607113 CEST	2121	52616	14.42.87.238	192.168.2.16
May 8, 2024 08:42:18.696641922 CEST	52785	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:18.696641922 CEST	52785	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:18.697770119 CEST	52809	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:18.699203968 CEST	52736	21	192.168.2.16	37.78.201.99
May 8, 2024 08:42:18.699206114 CEST	52810	21	192.168.2.16	210.104.41.236
May 8, 2024 08:42:18.702253103 CEST	21	52615	14.42.87.238	192.168.2.16
May 8, 2024 08:42:18.709878922 CEST	21	52650	24.232.195.12	192.168.2.16
May 8, 2024 08:42:18.710143089 CEST	2121	52649	24.232.195.12	192.168.2.16
May 8, 2024 08:42:18.714951992 CEST	52592	21	192.168.2.16	79.133.2.40
May 8, 2024 08:42:18.714951992 CEST	52738	2121	192.168.2.16	37.78.201.99
May 8, 2024 08:42:18.714953899 CEST	52609	21	192.168.2.16	84.36.50.25
May 8, 2024 08:42:18.715305090 CEST	52752	2121	192.168.2.16	86.51.153.63
May 8, 2024 08:42:18.715305090 CEST	52811	2121	192.168.2.16	210.104.41.236
May 8, 2024 08:42:18.715305090 CEST	52680	21	192.168.2.16	45.84.171.147
May 8, 2024 08:42:18.724248886 CEST	21	52665	14.33.48.181	192.168.2.16
May 8, 2024 08:42:18.740669966 CEST	21	52746	172.120.235.139	192.168.2.16
May 8, 2024 08:42:18.742023945 CEST	52746	21	192.168.2.16	172.120.235.139
May 8, 2024 08:42:18.742517948 CEST	21	52797	172.120.235.139	192.168.2.16
May 8, 2024 08:42:18.745739937 CEST	52797	21	192.168.2.16	172.120.235.139
May 8, 2024 08:42:18.747199059 CEST	52593	2121	192.168.2.16	79.133.2.40
May 8, 2024 08:42:18.747203112 CEST	52741	2121	192.168.2.16	79.117.51.233
May 8, 2024 08:42:18.749061108 CEST	52740	21	192.168.2.16	79.117.51.233
May 8, 2024 08:42:18.761724949 CEST	21	52754	38.239.154.176	192.168.2.16
May 8, 2024 08:42:18.761801958 CEST	21	52754	38.239.154.176	192.168.2.16
May 8, 2024 08:42:18.762912035 CEST	52745	2121	192.168.2.16	84.80.237.2
May 8, 2024 08:42:18.762912035 CEST	52754	21	192.168.2.16	38.239.154.176
May 8, 2024 08:42:18.762912035 CEST	52744	21	192.168.2.16	84.80.237.2
May 8, 2024 08:42:18.763947010 CEST	52683	2121	192.168.2.16	45.84.171.147
May 8, 2024 08:42:18.774979115 CEST	2121	52666	14.33.48.181	192.168.2.16
May 8, 2024 08:42:18.782026052 CEST	52613	21	192.168.2.16	79.157.117.148
May 8, 2024 08:42:18.819909096 CEST	21	52698	171.244.37.116	192.168.2.16
May 8, 2024 08:42:18.819922924 CEST	21	52698	171.244.37.116	192.168.2.16
May 8, 2024 08:42:18.820270061 CEST	52698	21	192.168.2.16	171.244.37.116
May 8, 2024 08:42:18.829590082 CEST	21	52790	171.244.37.116	192.168.2.16
May 8, 2024 08:42:18.830307961 CEST	52790	21	192.168.2.16	171.244.37.116
May 8, 2024 08:42:18.844894886 CEST	21	52726	120.24.160.35	192.168.2.16
May 8, 2024 08:42:18.846467018 CEST	21	52784	34.149.79.8	192.168.2.16
May 8, 2024 08:42:18.847729921 CEST	21	52808	34.149.79.8	192.168.2.16
May 8, 2024 08:42:18.848231077 CEST	52808	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:18.857920885 CEST	52614	2121	192.168.2.16	79.157.117.148
May 8, 2024 08:42:18.857923031 CEST	52753	21	192.168.2.16	108.51.123.143
May 8, 2024 08:42:18.859055042 CEST	2121	52785	34.149.79.8	192.168.2.16
May 8, 2024 08:42:18.859885931 CEST	2121	52809	34.149.79.8	192.168.2.16
May 8, 2024 08:42:18.862027884 CEST	52809	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:18.869597912 CEST	21	52776	84.44.255.254	192.168.2.16
May 8, 2024 08:42:18.870079041 CEST	52776	21	192.168.2.16	84.44.255.254
May 8, 2024 08:42:18.870372057 CEST	52812	21	192.168.2.16	84.44.255.254
May 8, 2024 08:42:18.870373011 CEST	52776	21	192.168.2.16	84.44.255.254
May 8, 2024 08:42:18.873780966 CEST	2121	52671	14.56.103.222	192.168.2.16
May 8, 2024 08:42:18.873931885 CEST	52337	2121	192.168.2.16	62.140.135.146
May 8, 2024 08:42:18.873934984 CEST	52755	2121	192.168.2.16	108.51.123.143
May 8, 2024 08:42:18.874428034 CEST	21	52673	14.56.103.222	192.168.2.16
May 8, 2024 08:42:18.897454977 CEST	2121	52662	27.70.216.73	192.168.2.16
May 8, 2024 08:42:18.905955076 CEST	52340	21	192.168.2.16	62.140.135.146
May 8, 2024 08:42:18.905963898 CEST	52642	21	192.168.2.16	91.69.213.1
May 8, 2024 08:42:18.921922922 CEST	52756	21	192.168.2.16	174.112.199.80
May 8, 2024 08:42:18.921925068 CEST	52617	21	192.168.2.16	70.69.249.93
May 8, 2024 08:42:18.937939882 CEST	52618	2121	192.168.2.16	70.69.249.93
May 8, 2024 08:42:18.938704967 CEST	52757	2121	192.168.2.16	174.112.199.80
May 8, 2024 08:42:18.962018967 CEST	21	52797	172.120.235.139	192.168.2.16
May 8, 2024 08:42:18.966031075 CEST	52797	21	192.168.2.16	172.120.235.139
May 8, 2024 08:42:18.970437050 CEST	52813	21	192.168.2.16	86.23.102.114
May 8, 2024 08:42:18.976711988 CEST	2121	52625	45.7.174.124	192.168.2.16
May 8, 2024 08:42:18.986406088 CEST	2121	52805	191.136.203.161	192.168.2.16
May 8, 2024 08:42:18.999389887 CEST	21	52751	86.51.153.63	192.168.2.16
May 8, 2024 08:42:19.001667976 CEST	52751	21	192.168.2.16	86.51.153.63
May 8, 2024 08:42:19.001941919 CEST	52608	2121	192.168.2.16	59.14.80.32
May 8, 2024 08:42:19.001944065 CEST	52606	21	192.168.2.16	59.14.80.32
May 8, 2024 08:42:19.001945019 CEST	52643	2121	192.168.2.16	91.69.213.1
May 8, 2024 08:42:19.010745049 CEST	21	52808	34.149.79.8	192.168.2.16
May 8, 2024 08:42:19.010905027 CEST	52808	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:19.010905027 CEST	52808	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:19.011554003 CEST	52814	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:19.018198967 CEST	52815	2121	192.168.2.16	86.23.102.114
May 8, 2024 08:42:19.018286943 CEST	21	52747	88.85.176.111	192.168.2.16
May 8, 2024 08:42:19.024350882 CEST	2121	52809	34.149.79.8	192.168.2.16
May 8, 2024 08:42:19.024898052 CEST	52809	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:19.025162935 CEST	52809	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:19.025168896 CEST	52816	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:19.034085035 CEST	52621	21	192.168.2.16	27.208.56.139
May 8, 2024 08:42:19.037990093 CEST	2121	52748	88.85.176.111	192.168.2.16
May 8, 2024 08:42:19.049923897 CEST	52624	2121	192.168.2.16	27.208.56.139
May 8, 2024 08:42:19.049926996 CEST	52623	21	192.168.2.16	45.7.174.124
May 8, 2024 08:42:19.063846111 CEST	21	52592	79.133.2.40	192.168.2.16
May 8, 2024 08:42:19.066246033 CEST	52781	21	192.168.2.16	60.132.78.147
May 8, 2024 08:42:19.073200941 CEST	21	52754	38.239.154.176	192.168.2.16
May 8, 2024 08:42:19.073571920 CEST	52754	21	192.168.2.16	38.239.154.176
May 8, 2024 08:42:19.073577881 CEST	52817	21	192.168.2.16	38.239.154.176
May 8, 2024 08:42:19.074059963 CEST	21	52754	38.239.154.176	192.168.2.16
May 8, 2024 08:42:19.076020956 CEST	52754	21	192.168.2.16	38.239.154.176
May 8, 2024 08:42:19.081070900 CEST	52653	21	192.168.2.16	61.83.64.58
May 8, 2024 08:42:19.082293034 CEST	52818	21	192.168.2.16	160.237.79.186
May 8, 2024 08:42:19.086347103 CEST	21	52735	196.210.0.111	192.168.2.16
May 8, 2024 08:42:19.086358070 CEST	21	52735	196.210.0.111	192.168.2.16
May 8, 2024 08:42:19.086927891 CEST	52735	21	192.168.2.16	196.210.0.111
May 8, 2024 08:42:19.088859081 CEST	2121	52752	86.51.153.63	192.168.2.16
May 8, 2024 08:42:19.095613003 CEST	21	52799	117.223.205.236	192.168.2.16
May 8, 2024 08:42:19.096152067 CEST	2121	52593	79.133.2.40	192.168.2.16
May 8, 2024 08:42:19.096261978 CEST	52799	21	192.168.2.16	117.223.205.236
May 8, 2024 08:42:19.096898079 CEST	52819	2121	192.168.2.16	160.237.79.186
May 8, 2024 08:42:19.096940041 CEST	52782	2121	192.168.2.16	60.132.78.147
May 8, 2024 08:42:19.096940041 CEST	52629	21	192.168.2.16	82.14.108.81
May 8, 2024 08:42:19.096944094 CEST	52628	2121	192.168.2.16	82.14.108.81
May 8, 2024 08:42:19.097094059 CEST	21	52680	45.84.171.147	192.168.2.16
May 8, 2024 08:42:19.098402023 CEST	52820	21	192.168.2.16	194.26.205.242
May 8, 2024 08:42:19.100529909 CEST	21	52601	117.223.205.236	192.168.2.16
May 8, 2024 08:42:19.102031946 CEST	52601	21	192.168.2.16	117.223.205.236
May 8, 2024 08:42:19.112942934 CEST	52760	21	192.168.2.16	178.196.176.3
May 8, 2024 08:42:19.112942934 CEST	52651	21	192.168.2.16	125.177.70.124
May 8, 2024 08:42:19.128956079 CEST	52762	21	192.168.2.16	27.11.119.251
May 8, 2024 08:42:19.128957987 CEST	52761	2121	192.168.2.16	178.196.176.3
May 8, 2024 08:42:19.143945932 CEST	52630	21	192.168.2.16	77.207.103.248
May 8, 2024 08:42:19.143949032 CEST	52764	21	192.168.2.16	95.252.27.121
May 8, 2024 08:42:19.143949032 CEST	52766	2121	192.168.2.16	95.121.52.45
May 8, 2024 08:42:19.143953085 CEST	52763	2121	192.168.2.16	27.11.119.251
May 8, 2024 08:42:19.144136906 CEST	52765	21	192.168.2.16	95.121.52.45
May 8, 2024 08:42:19.144140959 CEST	52652	2121	192.168.2.16	125.177.70.124
May 8, 2024 08:42:19.147802114 CEST	21	52797	172.120.235.139	192.168.2.16
May 8, 2024 08:42:19.148003101 CEST	21	52797	172.120.235.139	192.168.2.16
May 8, 2024 08:42:19.148185968 CEST	52797	21	192.168.2.16	172.120.235.139
May 8, 2024 08:42:19.173300982 CEST	21	52808	34.149.79.8	192.168.2.16
May 8, 2024 08:42:19.173744917 CEST	21	52814	34.149.79.8	192.168.2.16
May 8, 2024 08:42:19.173830032 CEST	52814	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:19.175920010 CEST	52610	2121	192.168.2.16	84.36.50.25
May 8, 2024 08:42:19.175931931 CEST	52770	21	192.168.2.16	13.249.157.223
May 8, 2024 08:42:19.175940990 CEST	52769	2121	192.168.2.16	69.136.37.217
May 8, 2024 08:42:19.175941944 CEST	52768	21	192.168.2.16	69.136.37.217
May 8, 2024 08:42:19.175947905 CEST	52767	2121	192.168.2.16	95.252.27.121
May 8, 2024 08:42:19.177046061 CEST	2121	52683	45.84.171.147	192.168.2.16
May 8, 2024 08:42:19.185892105 CEST	21	52790	171.244.37.116	192.168.2.16
May 8, 2024 08:42:19.186028957 CEST	52790	21	192.168.2.16	171.244.37.116
May 8, 2024 08:42:19.186280012 CEST	21	52776	84.44.255.254	192.168.2.16
May 8, 2024 08:42:19.187263966 CEST	2121	52809	34.149.79.8	192.168.2.16
May 8, 2024 08:42:19.187550068 CEST	2121	52816	34.149.79.8	192.168.2.16
May 8, 2024 08:42:19.187612057 CEST	52816	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:19.190006971 CEST	21	52812	84.44.255.254	192.168.2.16
May 8, 2024 08:42:19.190068007 CEST	52812	21	192.168.2.16	84.44.255.254
May 8, 2024 08:42:19.191914082 CEST	52657	2121	192.168.2.16	61.83.64.58
May 8, 2024 08:42:19.191939116 CEST	52773	21	192.168.2.16	67.10.243.234
May 8, 2024 08:42:19.191948891 CEST	52772	2121	192.168.2.16	67.10.243.234
May 8, 2024 08:42:19.192030907 CEST	52771	2121	192.168.2.16	13.249.157.223
May 8, 2024 08:42:19.207916021 CEST	52774	21	192.168.2.16	168.182.182.67
May 8, 2024 08:42:19.207918882 CEST	52616	2121	192.168.2.16	14.42.87.238
May 8, 2024 08:42:19.207940102 CEST	52615	21	192.168.2.16	14.42.87.238
May 8, 2024 08:42:19.223110914 CEST	21	52642	91.69.213.1	192.168.2.16
May 8, 2024 08:42:19.223942995 CEST	52650	21	192.168.2.16	24.232.195.12
May 8, 2024 08:42:19.224128008 CEST	52649	2121	192.168.2.16	24.232.195.12
May 8, 2024 08:42:19.224131107 CEST	52775	2121	192.168.2.16	168.182.182.67
May 8, 2024 08:42:19.227416039 CEST	21	52590	38.38.120.85	192.168.2.16
May 8, 2024 08:42:19.227591038 CEST	52590	21	192.168.2.16	38.38.120.85
May 8, 2024 08:42:19.227821112 CEST	52821	21	192.168.2.16	38.38.120.85
May 8, 2024 08:42:19.239948034 CEST	52665	21	192.168.2.16	14.33.48.181
May 8, 2024 08:42:19.239965916 CEST	52779	2121	192.168.2.16	73.250.24.123
May 8, 2024 08:42:19.239969015 CEST	52777	21	192.168.2.16	94.134.82.214
May 8, 2024 08:42:19.239972115 CEST	52778	21	192.168.2.16	73.250.24.123
May 8, 2024 08:42:19.240437984 CEST	52822	2121	192.168.2.16	194.26.205.242
May 8, 2024 08:42:19.260931969 CEST	52780	2121	192.168.2.16	94.134.82.214
May 8, 2024 08:42:19.287920952 CEST	52666	2121	192.168.2.16	14.33.48.181
May 8, 2024 08:42:19.303940058 CEST	52632	2121	192.168.2.16	77.207.103.248
May 8, 2024 08:42:19.318033934 CEST	21	52606	59.14.80.32	192.168.2.16
May 8, 2024 08:42:19.318458080 CEST	2121	52608	59.14.80.32	192.168.2.16
May 8, 2024 08:42:19.318563938 CEST	52823	21	192.168.2.16	79.146.98.25
May 8, 2024 08:42:19.318846941 CEST	52824	2121	192.168.2.16	79.146.98.25
May 8, 2024 08:42:19.318941116 CEST	52783	21	192.168.2.16	98.36.128.209
May 8, 2024 08:42:19.319928885 CEST	2121	52643	91.69.213.1	192.168.2.16
May 8, 2024 08:42:19.338073969 CEST	21	52814	34.149.79.8	192.168.2.16
May 8, 2024 08:42:19.338146925 CEST	52814	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:19.338232040 CEST	52814	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:19.338457108 CEST	52825	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:19.352152109 CEST	2121	52816	34.149.79.8	192.168.2.16
May 8, 2024 08:42:19.352226973 CEST	52816	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:19.352349997 CEST	52816	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:19.352669954 CEST	52826	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:19.358704090 CEST	21	52797	172.120.235.139	192.168.2.16
May 8, 2024 08:42:19.358834028 CEST	52797	21	192.168.2.16	172.120.235.139
May 8, 2024 08:42:19.359030962 CEST	52827	21	192.168.2.16	172.120.235.139
May 8, 2024 08:42:19.359411001 CEST	21	52781	60.132.78.147	192.168.2.16
May 8, 2024 08:42:19.373790026 CEST	21	52754	38.239.154.176	192.168.2.16
May 8, 2024 08:42:19.373814106 CEST	21	52817	38.239.154.176	192.168.2.16
May 8, 2024 08:42:19.373927116 CEST	52817	21	192.168.2.16	38.239.154.176
May 8, 2024 08:42:19.382940054 CEST	52671	2121	192.168.2.16	14.56.103.222
May 8, 2024 08:42:19.382941008 CEST	52673	21	192.168.2.16	14.56.103.222
May 8, 2024 08:42:19.389749050 CEST	2121	52782	60.132.78.147	192.168.2.16
May 8, 2024 08:42:19.391371012 CEST	21	52653	61.83.64.58	192.168.2.16
May 8, 2024 08:42:19.398933887 CEST	52636	21	192.168.2.16	173.29.240.123
May 8, 2024 08:42:19.398948908 CEST	52637	2121	192.168.2.16	173.29.240.123
May 8, 2024 08:42:19.399069071 CEST	52638	21	192.168.2.16	176.50.254.243
May 8, 2024 08:42:19.413938046 CEST	52640	2121	192.168.2.16	176.50.254.243
May 8, 2024 08:42:19.414874077 CEST	52662	2121	192.168.2.16	27.70.216.73
May 8, 2024 08:42:19.417675972 CEST	21	52590	38.38.120.85	192.168.2.16
May 8, 2024 08:42:19.417727947 CEST	52590	21	192.168.2.16	38.38.120.85
May 8, 2024 08:42:19.418236017 CEST	21	52590	38.38.120.85	192.168.2.16
May 8, 2024 08:42:19.418286085 CEST	52590	21	192.168.2.16	38.38.120.85
May 8, 2024 08:42:19.419919014 CEST	21	52821	38.38.120.85	192.168.2.16
May 8, 2024 08:42:19.419992924 CEST	52821	21	192.168.2.16	38.38.120.85
May 8, 2024 08:42:19.428929090 CEST	52786	2121	192.168.2.16	98.36.128.209
May 8, 2024 08:42:19.430761099 CEST	21	52651	125.177.70.124	192.168.2.16
May 8, 2024 08:42:19.443933010 CEST	52787	21	192.168.2.16	172.117.76.139
May 8, 2024 08:42:19.469573021 CEST	2121	52652	125.177.70.124	192.168.2.16
May 8, 2024 08:42:19.474958897 CEST	52788	21	192.168.2.16	120.79.9.235
May 8, 2024 08:42:19.475307941 CEST	52789	2121	192.168.2.16	172.117.76.139
May 8, 2024 08:42:19.475308895 CEST	52828	21	192.168.2.16	94.208.246.163
May 8, 2024 08:42:19.490947962 CEST	52791	2121	192.168.2.16	120.79.9.235
May 8, 2024 08:42:19.490957022 CEST	52625	2121	192.168.2.16	45.7.174.124
May 8, 2024 08:42:19.490963936 CEST	52805	2121	192.168.2.16	191.136.203.161
May 8, 2024 08:42:19.500387907 CEST	21	52814	34.149.79.8	192.168.2.16
May 8, 2024 08:42:19.500633001 CEST	21	52825	34.149.79.8	192.168.2.16
May 8, 2024 08:42:19.500709057 CEST	52825	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:19.503858089 CEST	2121	52657	61.83.64.58	192.168.2.16
May 8, 2024 08:42:19.506928921 CEST	52792	21	192.168.2.16	106.200.113.162
May 8, 2024 08:42:19.507335901 CEST	52829	2121	192.168.2.16	94.208.246.163
May 8, 2024 08:42:19.512123108 CEST	21	52812	84.44.255.254	192.168.2.16
May 8, 2024 08:42:19.512192965 CEST	52812	21	192.168.2.16	84.44.255.254
May 8, 2024 08:42:19.512295961 CEST	52812	21	192.168.2.16	84.44.255.254
May 8, 2024 08:42:19.512557030 CEST	52830	21	192.168.2.16	84.44.255.254
May 8, 2024 08:42:19.514741898 CEST	2121	52816	34.149.79.8	192.168.2.16
May 8, 2024 08:42:19.514789104 CEST	2121	52826	34.149.79.8	192.168.2.16
May 8, 2024 08:42:19.514849901 CEST	52826	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:19.522936106 CEST	52747	21	192.168.2.16	88.85.176.111
May 8, 2024 08:42:19.526273966 CEST	2121	52616	14.42.87.238	192.168.2.16
May 8, 2024 08:42:19.533972979 CEST	21	52615	14.42.87.238	192.168.2.16
May 8, 2024 08:42:19.534380913 CEST	52831	21	192.168.2.16	95.171.194.152
May 8, 2024 08:42:19.535970926 CEST	2121	52610	84.36.50.25	192.168.2.16
May 8, 2024 08:42:19.538917065 CEST	52793	2121	192.168.2.16	106.200.113.162
May 8, 2024 08:42:19.538930893 CEST	52645	21	192.168.2.16	174.99.83.101
May 8, 2024 08:42:19.538930893 CEST	52748	2121	192.168.2.16	88.85.176.111
May 8, 2024 08:42:19.539338112 CEST	52832	2121	192.168.2.16	95.171.194.152
May 8, 2024 08:42:19.540658951 CEST	21	52797	172.120.235.139	192.168.2.16
May 8, 2024 08:42:19.540715933 CEST	52797	21	192.168.2.16	172.120.235.139
May 8, 2024 08:42:19.540805101 CEST	21	52827	172.120.235.139	192.168.2.16
May 8, 2024 08:42:19.540869951 CEST	52827	21	192.168.2.16	172.120.235.139
May 8, 2024 08:42:19.542968035 CEST	21	52790	171.244.37.116	192.168.2.16
May 8, 2024 08:42:19.543072939 CEST	52790	21	192.168.2.16	171.244.37.116
May 8, 2024 08:42:19.551531076 CEST	21	52665	14.33.48.181	192.168.2.16
May 8, 2024 08:42:19.555419922 CEST	52833	2121	192.168.2.16	94.6.74.207
May 8, 2024 08:42:19.555458069 CEST	52834	21	192.168.2.16	94.6.74.207
May 8, 2024 08:42:19.569933891 CEST	52794	2121	192.168.2.16	222.136.152.252
May 8, 2024 08:42:19.569946051 CEST	52796	21	192.168.2.16	222.136.152.252
May 8, 2024 08:42:19.569948912 CEST	52795	21	192.168.2.16	211.246.184.173
May 8, 2024 08:42:19.570173025 CEST	52835	21	192.168.2.16	31.181.186.167
May 8, 2024 08:42:19.585510969 CEST	21	52650	24.232.195.12	192.168.2.16
May 8, 2024 08:42:19.585680008 CEST	2121	52649	24.232.195.12	192.168.2.16
May 8, 2024 08:42:19.585936069 CEST	52798	2121	192.168.2.16	211.246.184.173
May 8, 2024 08:42:19.586503029 CEST	52836	2121	192.168.2.16	31.181.186.167
May 8, 2024 08:42:19.586528063 CEST	52837	21	192.168.2.16	160.121.41.198
May 8, 2024 08:42:19.586556911 CEST	52838	2121	192.168.2.16	160.121.41.198
May 8, 2024 08:42:19.586585045 CEST	52839	21	192.168.2.16	78.186.180.252
May 8, 2024 08:42:19.594302893 CEST	21	52735	196.210.0.111	192.168.2.16
May 8, 2024 08:42:19.601916075 CEST	52801	21	192.168.2.16	32.219.249.216
May 8, 2024 08:42:19.601926088 CEST	52800	21	192.168.2.16	98.29.67.27
May 8, 2024 08:42:19.601939917 CEST	52802	2121	192.168.2.16	98.29.67.27
May 8, 2024 08:42:19.601953030 CEST	52680	21	192.168.2.16	45.84.171.147
May 8, 2024 08:42:19.601953030 CEST	52752	2121	192.168.2.16	86.51.153.63
May 8, 2024 08:42:19.602138042 CEST	2121	52666	14.33.48.181	192.168.2.16
May 8, 2024 08:42:19.613723040 CEST	21	52821	38.38.120.85	192.168.2.16
May 8, 2024 08:42:19.613907099 CEST	52821	21	192.168.2.16	38.38.120.85
May 8, 2024 08:42:19.617935896 CEST	52804	21	192.168.2.16	191.136.203.161
May 8, 2024 08:42:19.617948055 CEST	52803	2121	192.168.2.16	32.219.249.216
May 8, 2024 08:42:19.617949963 CEST	52648	2121	192.168.2.16	174.99.83.101
May 8, 2024 08:42:19.618346930 CEST	52840	2121	192.168.2.16	78.186.180.252
May 8, 2024 08:42:19.618391037 CEST	52841	21	192.168.2.16	73.119.184.97
May 8, 2024 08:42:19.633502960 CEST	52843	21	192.168.2.16	52.137.122.207
May 8, 2024 08:42:19.633502960 CEST	52842	2121	192.168.2.16	73.119.184.97
May 8, 2024 08:42:19.633625031 CEST	52844	2121	192.168.2.16	52.137.122.207
May 8, 2024 08:42:19.638283014 CEST	21	52712	46.34.34.117	192.168.2.16
May 8, 2024 08:42:19.638427019 CEST	52712	21	192.168.2.16	46.34.34.117
May 8, 2024 08:42:19.638633013 CEST	52845	21	192.168.2.16	46.34.34.117
May 8, 2024 08:42:19.649419069 CEST	52847	2121	192.168.2.16	36.95.88.230
May 8, 2024 08:42:19.649463892 CEST	52846	21	192.168.2.16	36.95.88.230
May 8, 2024 08:42:19.649492979 CEST	52848	21	192.168.2.16	24.170.119.218
May 8, 2024 08:42:19.662985086 CEST	21	52825	34.149.79.8	192.168.2.16
May 8, 2024 08:42:19.663057089 CEST	52825	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:19.663114071 CEST	52825	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:19.663269997 CEST	52849	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:19.664922953 CEST	52806	21	192.168.2.16	175.125.169.40
May 8, 2024 08:42:19.665211916 CEST	52850	2121	192.168.2.16	24.170.119.218
May 8, 2024 08:42:19.676326036 CEST	21	52817	38.239.154.176	192.168.2.16
May 8, 2024 08:42:19.676518917 CEST	52817	21	192.168.2.16	38.239.154.176
May 8, 2024 08:42:19.677094936 CEST	2121	52826	34.149.79.8	192.168.2.16
May 8, 2024 08:42:19.677155972 CEST	52826	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:19.677256107 CEST	52826	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:19.677494049 CEST	52851	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:19.680938959 CEST	52683	2121	192.168.2.16	45.84.171.147
May 8, 2024 08:42:19.680938959 CEST	52807	2121	192.168.2.16	175.125.169.40
May 8, 2024 08:42:19.700822115 CEST	2121	52671	14.56.103.222	192.168.2.16
May 8, 2024 08:42:19.701198101 CEST	21	52673	14.56.103.222	192.168.2.16
May 8, 2024 08:42:19.712956905 CEST	52810	21	192.168.2.16	210.104.41.236
May 8, 2024 08:42:19.727941036 CEST	52811	2121	192.168.2.16	210.104.41.236
May 8, 2024 08:42:19.728900909 CEST	52642	21	192.168.2.16	91.69.213.1
May 8, 2024 08:42:19.731272936 CEST	21	52799	117.223.205.236	192.168.2.16
May 8, 2024 08:42:19.731472015 CEST	52799	21	192.168.2.16	117.223.205.236
May 8, 2024 08:42:19.746598005 CEST	52658	21	192.168.2.16	90.200.108.245
May 8, 2024 08:42:19.759335041 CEST	52659	2121	192.168.2.16	90.200.108.245
May 8, 2024 08:42:19.762036085 CEST	21	52827	172.120.235.139	192.168.2.16
May 8, 2024 08:42:19.762234926 CEST	52827	21	192.168.2.16	172.120.235.139
May 8, 2024 08:42:19.787534952 CEST	2121	52662	27.70.216.73	192.168.2.16
May 8, 2024 08:42:19.788955927 CEST	52661	21	192.168.2.16	27.70.216.73
May 8, 2024 08:42:19.788955927 CEST	52663	21	192.168.2.16	80.200.85.226
May 8, 2024 08:42:19.789923906 CEST	52664	2121	192.168.2.16	80.200.85.226
May 8, 2024 08:42:19.805970907 CEST	21	52821	38.38.120.85	192.168.2.16
May 8, 2024 08:42:19.806099892 CEST	21	52821	38.38.120.85	192.168.2.16
May 8, 2024 08:42:19.806277990 CEST	52821	21	192.168.2.16	38.38.120.85
May 8, 2024 08:42:19.825256109 CEST	21	52825	34.149.79.8	192.168.2.16
May 8, 2024 08:42:19.825433016 CEST	21	52849	34.149.79.8	192.168.2.16
May 8, 2024 08:42:19.825505018 CEST	52849	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:19.831818104 CEST	21	52812	84.44.255.254	192.168.2.16
May 8, 2024 08:42:19.832130909 CEST	21	52830	84.44.255.254	192.168.2.16
May 8, 2024 08:42:19.832192898 CEST	52830	21	192.168.2.16	84.44.255.254
May 8, 2024 08:42:19.835983038 CEST	52539	21	192.168.2.16	77.75.121.3
May 8, 2024 08:42:19.836215973 CEST	52852	21	192.168.2.16	77.75.121.3
May 8, 2024 08:42:19.840188026 CEST	2121	52826	34.149.79.8	192.168.2.16
May 8, 2024 08:42:19.840215921 CEST	2121	52851	34.149.79.8	192.168.2.16
May 8, 2024 08:42:19.840364933 CEST	52851	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:19.842919111 CEST	52643	2121	192.168.2.16	91.69.213.1
May 8, 2024 08:42:19.848702908 CEST	2121	52625	45.7.174.124	192.168.2.16
May 8, 2024 08:42:19.858413935 CEST	2121	52805	191.136.203.161	192.168.2.16
May 8, 2024 08:42:19.867942095 CEST	52781	21	192.168.2.16	60.132.78.147
May 8, 2024 08:42:19.867949009 CEST	52669	21	192.168.2.16	94.224.39.238
May 8, 2024 08:42:19.868316889 CEST	52853	21	192.168.2.16	60.128.250.187
May 8, 2024 08:42:19.890288115 CEST	21	52747	88.85.176.111	192.168.2.16
May 8, 2024 08:42:19.898916006 CEST	52670	2121	192.168.2.16	94.224.39.238
May 8, 2024 08:42:19.898926020 CEST	52782	2121	192.168.2.16	60.132.78.147
May 8, 2024 08:42:19.898940086 CEST	52653	21	192.168.2.16	61.83.64.58
May 8, 2024 08:42:19.900795937 CEST	21	52790	171.244.37.116	192.168.2.16
May 8, 2024 08:42:19.900959969 CEST	52790	21	192.168.2.16	171.244.37.116
May 8, 2024 08:42:19.901173115 CEST	52854	21	192.168.2.16	171.244.37.116
May 8, 2024 08:42:19.909687996 CEST	2121	52748	88.85.176.111	192.168.2.16
May 8, 2024 08:42:19.913942099 CEST	52672	21	192.168.2.16	99.226.140.144
May 8, 2024 08:42:19.919372082 CEST	21	52837	160.121.41.198	192.168.2.16
May 8, 2024 08:42:19.919581890 CEST	52837	21	192.168.2.16	160.121.41.198
May 8, 2024 08:42:19.928936005 CEST	52674	2121	192.168.2.16	99.226.140.144
May 8, 2024 08:42:19.928951025 CEST	52675	21	192.168.2.16	91.210.56.114
May 8, 2024 08:42:19.929246902 CEST	52855	2121	192.168.2.16	60.128.250.187
May 8, 2024 08:42:19.943964958 CEST	21	52827	172.120.235.139	192.168.2.16
May 8, 2024 08:42:19.944236994 CEST	21	52827	172.120.235.139	192.168.2.16
May 8, 2024 08:42:19.944377899 CEST	52827	21	192.168.2.16	172.120.235.139
May 8, 2024 08:42:19.944926023 CEST	52651	21	192.168.2.16	125.177.70.124
May 8, 2024 08:42:19.944926977 CEST	52677	2121	192.168.2.16	91.210.56.114
May 8, 2024 08:42:19.944936991 CEST	52678	21	192.168.2.16	99.84.176.196
May 8, 2024 08:42:19.945211887 CEST	52856	21	192.168.2.16	80.48.205.205
May 8, 2024 08:42:19.960932970 CEST	52679	2121	192.168.2.16	99.84.176.196
May 8, 2024 08:42:19.969155073 CEST	21	52680	45.84.171.147	192.168.2.16
May 8, 2024 08:42:19.973599911 CEST	2121	52752	86.51.153.63	192.168.2.16
May 8, 2024 08:42:19.976897001 CEST	21	52712	46.34.34.117	192.168.2.16
May 8, 2024 08:42:19.976927996 CEST	52652	2121	192.168.2.16	125.177.70.124
May 8, 2024 08:42:19.976938009 CEST	52813	21	192.168.2.16	86.23.102.114
May 8, 2024 08:42:19.976959944 CEST	52712	21	192.168.2.16	46.34.34.117
May 8, 2024 08:42:19.977797031 CEST	21	52817	38.239.154.176	192.168.2.16
May 8, 2024 08:42:19.977849960 CEST	21	52817	38.239.154.176	192.168.2.16
May 8, 2024 08:42:19.978029966 CEST	52817	21	192.168.2.16	38.239.154.176
May 8, 2024 08:42:19.978349924 CEST	21	52845	46.34.34.117	192.168.2.16
May 8, 2024 08:42:19.978416920 CEST	52845	21	192.168.2.16	46.34.34.117
May 8, 2024 08:42:19.987802982 CEST	21	52849	34.149.79.8	192.168.2.16
May 8, 2024 08:42:19.987870932 CEST	52849	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:19.987936020 CEST	52849	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:19.988118887 CEST	52857	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:19.992914915 CEST	52687	2121	192.168.2.16	46.142.20.21
May 8, 2024 08:42:19.992930889 CEST	52685	21	192.168.2.16	46.142.20.21
May 8, 2024 08:42:19.993870020 CEST	52686	21	192.168.2.16	20.159.158.251
May 8, 2024 08:42:20.001398087 CEST	21	52539	77.75.121.3	192.168.2.16
May 8, 2024 08:42:20.001461029 CEST	52539	21	192.168.2.16	77.75.121.3
May 8, 2024 08:42:20.006797075 CEST	2121	52851	34.149.79.8	192.168.2.16
May 8, 2024 08:42:20.006860971 CEST	52851	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:20.006953955 CEST	52851	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:20.007203102 CEST	52858	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:20.008908987 CEST	52688	2121	192.168.2.16	20.159.158.251
May 8, 2024 08:42:20.008938074 CEST	52657	2121	192.168.2.16	61.83.64.58
May 8, 2024 08:42:20.024909019 CEST	52815	2121	192.168.2.16	86.23.102.114
May 8, 2024 08:42:20.024935007 CEST	52689	21	192.168.2.16	172.115.192.129
May 8, 2024 08:42:20.037811041 CEST	21	52821	38.38.120.85	192.168.2.16
May 8, 2024 08:42:20.040939093 CEST	52690	2121	192.168.2.16	172.115.192.129
May 8, 2024 08:42:20.041414976 CEST	52859	2121	192.168.2.16	80.48.205.205
May 8, 2024 08:42:20.046080112 CEST	21	52642	91.69.213.1	192.168.2.16
May 8, 2024 08:42:20.056922913 CEST	52691	21	192.168.2.16	188.48.109.89
May 8, 2024 08:42:20.056952953 CEST	52665	21	192.168.2.16	14.33.48.181
May 8, 2024 08:42:20.057188034 CEST	52860	21	192.168.2.16	24.164.151.97
May 8, 2024 08:42:20.069197893 CEST	2121	52683	45.84.171.147	192.168.2.16
May 8, 2024 08:42:20.072936058 CEST	52693	2121	192.168.2.16	188.48.109.89
May 8, 2024 08:42:20.072947979 CEST	52694	21	192.168.2.16	195.253.27.78
May 8, 2024 08:42:20.073493004 CEST	52861	21	192.168.2.16	223.206.58.167
May 8, 2024 08:42:20.073518991 CEST	52862	2121	192.168.2.16	24.164.151.97
May 8, 2024 08:42:20.088922024 CEST	52696	2121	192.168.2.16	195.253.27.78
May 8, 2024 08:42:20.088934898 CEST	52697	21	192.168.2.16	156.213.148.34
May 8, 2024 08:42:20.088937998 CEST	52818	21	192.168.2.16	160.237.79.186
May 8, 2024 08:42:20.088965893 CEST	52649	2121	192.168.2.16	24.232.195.12
May 8, 2024 08:42:20.088973999 CEST	52650	21	192.168.2.16	24.232.195.12
May 8, 2024 08:42:20.103969097 CEST	52820	21	192.168.2.16	194.26.205.242
May 8, 2024 08:42:20.103971004 CEST	52700	2121	192.168.2.16	207.161.41.167
May 8, 2024 08:42:20.103971958 CEST	52701	21	192.168.2.16	207.161.41.167
May 8, 2024 08:42:20.103971958 CEST	52666	2121	192.168.2.16	14.33.48.181
May 8, 2024 08:42:20.103972912 CEST	52699	2121	192.168.2.16	156.213.148.34
May 8, 2024 08:42:20.104063034 CEST	52819	2121	192.168.2.16	160.237.79.186
May 8, 2024 08:42:20.104450941 CEST	52863	2121	192.168.2.16	223.206.58.167
May 8, 2024 08:42:20.118932009 CEST	52702	21	192.168.2.16	139.130.247.205
May 8, 2024 08:42:20.146359921 CEST	21	52539	77.75.121.3	192.168.2.16
May 8, 2024 08:42:20.146420002 CEST	52539	21	192.168.2.16	77.75.121.3
May 8, 2024 08:42:20.146692991 CEST	21	52539	77.75.121.3	192.168.2.16
May 8, 2024 08:42:20.146737099 CEST	52539	21	192.168.2.16	77.75.121.3
May 8, 2024 08:42:20.150028944 CEST	21	52849	34.149.79.8	192.168.2.16
May 8, 2024 08:42:20.150489092 CEST	21	52857	34.149.79.8	192.168.2.16
May 8, 2024 08:42:20.150576115 CEST	52857	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:20.150948048 CEST	52704	2121	192.168.2.16	139.130.247.205
May 8, 2024 08:42:20.151825905 CEST	21	52830	84.44.255.254	192.168.2.16
May 8, 2024 08:42:20.151906013 CEST	52830	21	192.168.2.16	84.44.255.254
May 8, 2024 08:42:20.152009964 CEST	52830	21	192.168.2.16	84.44.255.254
May 8, 2024 08:42:20.152182102 CEST	21	52852	77.75.121.3	192.168.2.16
May 8, 2024 08:42:20.152244091 CEST	52852	21	192.168.2.16	77.75.121.3
May 8, 2024 08:42:20.152280092 CEST	52864	21	192.168.2.16	84.44.255.254
May 8, 2024 08:42:20.154472113 CEST	21	52827	172.120.235.139	192.168.2.16
May 8, 2024 08:42:20.154594898 CEST	52827	21	192.168.2.16	172.120.235.139
May 8, 2024 08:42:20.154827118 CEST	52865	21	192.168.2.16	172.120.235.139
May 8, 2024 08:42:20.161144972 CEST	21	52781	60.132.78.147	192.168.2.16
May 8, 2024 08:42:20.161705971 CEST	2121	52643	91.69.213.1	192.168.2.16
May 8, 2024 08:42:20.161998987 CEST	52866	21	192.168.2.16	76.125.250.125
May 8, 2024 08:42:20.165946007 CEST	52705	21	192.168.2.16	99.225.2.139
May 8, 2024 08:42:20.168135881 CEST	21	52743	96.126.118.190	192.168.2.16
May 8, 2024 08:42:20.168292046 CEST	52743	21	192.168.2.16	96.126.118.190
May 8, 2024 08:42:20.168967009 CEST	21	52853	60.128.250.187	192.168.2.16
May 8, 2024 08:42:20.169300079 CEST	2121	52851	34.149.79.8	192.168.2.16
May 8, 2024 08:42:20.169512033 CEST	2121	52858	34.149.79.8	192.168.2.16
May 8, 2024 08:42:20.169572115 CEST	52858	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:20.192213058 CEST	2121	52782	60.132.78.147	192.168.2.16
May 8, 2024 08:42:20.196938992 CEST	52707	2121	192.168.2.16	99.225.2.139
May 8, 2024 08:42:20.208183050 CEST	2121	52750	96.126.118.190	192.168.2.16
May 8, 2024 08:42:20.208367109 CEST	52750	2121	192.168.2.16	96.126.118.190
May 8, 2024 08:42:20.209037066 CEST	21	52653	61.83.64.58	192.168.2.16
May 8, 2024 08:42:20.212922096 CEST	52671	2121	192.168.2.16	14.56.103.222
May 8, 2024 08:42:20.212932110 CEST	52673	21	192.168.2.16	14.56.103.222
May 8, 2024 08:42:20.228954077 CEST	52708	21	192.168.2.16	91.8.230.74
May 8, 2024 08:42:20.229500055 CEST	52867	21	192.168.2.16	222.219.165.140
May 8, 2024 08:42:20.229557991 CEST	52868	2121	192.168.2.16	76.125.250.125
May 8, 2024 08:42:20.231750011 CEST	2121	52855	60.128.250.187	192.168.2.16
May 8, 2024 08:42:20.244937897 CEST	52709	21	192.168.2.16	91.146.97.65
May 8, 2024 08:42:20.244940996 CEST	52822	2121	192.168.2.16	194.26.205.242
May 8, 2024 08:42:20.247169971 CEST	21	52799	117.223.205.236	192.168.2.16
May 8, 2024 08:42:20.247638941 CEST	21	52854	171.244.37.116	192.168.2.16
May 8, 2024 08:42:20.247708082 CEST	52854	21	192.168.2.16	171.244.37.116
May 8, 2024 08:42:20.248152018 CEST	21	52799	117.223.205.236	192.168.2.16
May 8, 2024 08:42:20.248327017 CEST	52799	21	192.168.2.16	117.223.205.236
May 8, 2024 08:42:20.254347086 CEST	21	52837	160.121.41.198	192.168.2.16
May 8, 2024 08:42:20.254446983 CEST	52837	21	192.168.2.16	160.121.41.198
May 8, 2024 08:42:20.254724026 CEST	52869	2121	192.168.2.16	222.219.165.140
May 8, 2024 08:42:20.256347895 CEST	21	52790	171.244.37.116	192.168.2.16
May 8, 2024 08:42:20.256359100 CEST	21	52790	171.244.37.116	192.168.2.16
May 8, 2024 08:42:20.256407976 CEST	52790	21	192.168.2.16	171.244.37.116
May 8, 2024 08:42:20.262635946 CEST	21	52651	125.177.70.124	192.168.2.16
May 8, 2024 08:42:20.276947021 CEST	52710	2121	192.168.2.16	91.8.230.74
May 8, 2024 08:42:20.277296066 CEST	52870	21	192.168.2.16	96.255.189.170
May 8, 2024 08:42:20.287403107 CEST	21	52817	38.239.154.176	192.168.2.16
May 8, 2024 08:42:20.287544012 CEST	52817	21	192.168.2.16	38.239.154.176
May 8, 2024 08:42:20.287688017 CEST	52871	21	192.168.2.16	38.239.154.176
May 8, 2024 08:42:20.288001060 CEST	21	52817	38.239.154.176	192.168.2.16
May 8, 2024 08:42:20.288058043 CEST	52817	21	192.168.2.16	38.239.154.176
May 8, 2024 08:42:20.292944908 CEST	52711	21	192.168.2.16	151.200.237.130
May 8, 2024 08:42:20.292944908 CEST	52713	2121	192.168.2.16	151.200.237.130
May 8, 2024 08:42:20.293034077 CEST	52662	2121	192.168.2.16	27.70.216.73
May 8, 2024 08:42:20.302330971 CEST	2121	52652	125.177.70.124	192.168.2.16
May 8, 2024 08:42:20.308964968 CEST	52714	21	192.168.2.16	20.113.31.216
May 8, 2024 08:42:20.309168100 CEST	52715	2121	192.168.2.16	20.113.31.216
May 8, 2024 08:42:20.309170961 CEST	52716	21	192.168.2.16	201.131.70.62
May 8, 2024 08:42:20.312958002 CEST	21	52857	34.149.79.8	192.168.2.16
May 8, 2024 08:42:20.313014984 CEST	52857	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:20.313081980 CEST	52857	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:20.313299894 CEST	52872	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:20.318531990 CEST	2121	52657	61.83.64.58	192.168.2.16
May 8, 2024 08:42:20.324914932 CEST	52718	21	192.168.2.16	107.10.23.54
May 8, 2024 08:42:20.324924946 CEST	52824	2121	192.168.2.16	79.146.98.25
May 8, 2024 08:42:20.324938059 CEST	52717	2121	192.168.2.16	201.131.70.62
May 8, 2024 08:42:20.324940920 CEST	52823	21	192.168.2.16	79.146.98.25
May 8, 2024 08:42:20.325268984 CEST	52873	2121	192.168.2.16	96.255.189.170
May 8, 2024 08:42:20.326917887 CEST	21	52845	46.34.34.117	192.168.2.16
May 8, 2024 08:42:20.327105999 CEST	52845	21	192.168.2.16	46.34.34.117
May 8, 2024 08:42:20.331970930 CEST	2121	52858	34.149.79.8	192.168.2.16
May 8, 2024 08:42:20.332031965 CEST	52858	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:20.332159042 CEST	52858	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:20.332366943 CEST	52874	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:20.336512089 CEST	21	52865	172.120.235.139	192.168.2.16
May 8, 2024 08:42:20.336527109 CEST	21	52827	172.120.235.139	192.168.2.16
May 8, 2024 08:42:20.337048054 CEST	52827	21	192.168.2.16	172.120.235.139
May 8, 2024 08:42:20.337060928 CEST	52865	21	192.168.2.16	172.120.235.139
May 8, 2024 08:42:20.340913057 CEST	52719	2121	192.168.2.16	107.10.23.54
May 8, 2024 08:42:20.341322899 CEST	52875	21	192.168.2.16	73.49.216.251
May 8, 2024 08:42:20.368467093 CEST	21	52665	14.33.48.181	192.168.2.16
May 8, 2024 08:42:20.369029999 CEST	52876	2121	192.168.2.16	73.49.216.251
May 8, 2024 08:42:20.372934103 CEST	52805	2121	192.168.2.16	191.136.203.161
May 8, 2024 08:42:20.374569893 CEST	21	52743	96.126.118.190	192.168.2.16
May 8, 2024 08:42:20.374811888 CEST	21	52743	96.126.118.190	192.168.2.16
May 8, 2024 08:42:20.375009060 CEST	52743	21	192.168.2.16	96.126.118.190
May 8, 2024 08:42:20.388940096 CEST	52723	21	192.168.2.16	96.33.139.67
May 8, 2024 08:42:20.403945923 CEST	52747	21	192.168.2.16	88.85.176.111
May 8, 2024 08:42:20.414331913 CEST	2121	52750	96.126.118.190	192.168.2.16
May 8, 2024 08:42:20.414458990 CEST	2121	52750	96.126.118.190	192.168.2.16
May 8, 2024 08:42:20.414697886 CEST	52750	2121	192.168.2.16	96.126.118.190
May 8, 2024 08:42:20.417933941 CEST	2121	52666	14.33.48.181	192.168.2.16
May 8, 2024 08:42:20.419960976 CEST	52748	2121	192.168.2.16	88.85.176.111
May 8, 2024 08:42:20.436378956 CEST	52877	21	192.168.2.16	14.33.230.98
May 8, 2024 08:42:20.437113047 CEST	52878	21	192.168.2.16	38.207.205.17
May 8, 2024 08:42:20.451670885 CEST	21	52650	24.232.195.12	192.168.2.16
May 8, 2024 08:42:20.451870918 CEST	2121	52649	24.232.195.12	192.168.2.16
May 8, 2024 08:42:20.451951027 CEST	52727	2121	192.168.2.16	96.33.139.67
May 8, 2024 08:42:20.452290058 CEST	52879	2121	192.168.2.16	14.33.230.98
May 8, 2024 08:42:20.452429056 CEST	52880	2121	192.168.2.16	38.207.205.17
May 8, 2024 08:42:20.452577114 CEST	52881	21	192.168.2.16	50.109.87.151
May 8, 2024 08:42:20.467945099 CEST	52728	21	192.168.2.16	109.134.120.4
May 8, 2024 08:42:20.469050884 CEST	21	52852	77.75.121.3	192.168.2.16
May 8, 2024 08:42:20.469204903 CEST	52852	21	192.168.2.16	77.75.121.3
May 8, 2024 08:42:20.471508980 CEST	21	52830	84.44.255.254	192.168.2.16
May 8, 2024 08:42:20.471637011 CEST	21	52864	84.44.255.254	192.168.2.16
May 8, 2024 08:42:20.471698046 CEST	52864	21	192.168.2.16	84.44.255.254
May 8, 2024 08:42:20.475559950 CEST	21	52857	34.149.79.8	192.168.2.16
May 8, 2024 08:42:20.475713968 CEST	21	52872	34.149.79.8	192.168.2.16
May 8, 2024 08:42:20.475790024 CEST	52872	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:20.483932972 CEST	52752	2121	192.168.2.16	86.51.153.63
May 8, 2024 08:42:20.484642982 CEST	52828	21	192.168.2.16	94.208.246.163
May 8, 2024 08:42:20.484683037 CEST	2121	52704	139.130.247.205	192.168.2.16
May 8, 2024 08:42:20.487054110 CEST	52680	21	192.168.2.16	45.84.171.147
May 8, 2024 08:42:20.494457006 CEST	2121	52858	34.149.79.8	192.168.2.16
May 8, 2024 08:42:20.494750023 CEST	2121	52874	34.149.79.8	192.168.2.16
May 8, 2024 08:42:20.494810104 CEST	52874	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:20.499924898 CEST	52729	2121	192.168.2.16	109.134.120.4
May 8, 2024 08:42:20.514928102 CEST	52829	2121	192.168.2.16	94.208.246.163
May 8, 2024 08:42:20.515409946 CEST	52882	2121	192.168.2.16	50.109.87.151
May 8, 2024 08:42:20.530651093 CEST	2121	52671	14.56.103.222	192.168.2.16
May 8, 2024 08:42:20.531208038 CEST	52883	21	192.168.2.16	95.54.247.224
May 8, 2024 08:42:20.531305075 CEST	21	52673	14.56.103.222	192.168.2.16
May 8, 2024 08:42:20.546926975 CEST	52831	21	192.168.2.16	95.171.194.152
May 8, 2024 08:42:20.547307014 CEST	52884	2121	192.168.2.16	95.54.247.224
May 8, 2024 08:42:20.547314882 CEST	52832	2121	192.168.2.16	95.171.194.152
May 8, 2024 08:42:20.556704998 CEST	21	52865	172.120.235.139	192.168.2.16
May 8, 2024 08:42:20.556955099 CEST	52865	21	192.168.2.16	172.120.235.139
May 8, 2024 08:42:20.562928915 CEST	52833	2121	192.168.2.16	94.6.74.207
May 8, 2024 08:42:20.562948942 CEST	52834	21	192.168.2.16	94.6.74.207
May 8, 2024 08:42:20.578921080 CEST	52835	21	192.168.2.16	31.181.186.167
May 8, 2024 08:42:20.579015017 CEST	52683	2121	192.168.2.16	45.84.171.147
May 8, 2024 08:42:20.579122066 CEST	21	52735	196.210.0.111	192.168.2.16
May 8, 2024 08:42:20.579273939 CEST	52735	21	192.168.2.16	196.210.0.111
May 8, 2024 08:42:20.579473019 CEST	52885	21	192.168.2.16	196.210.0.111
May 8, 2024 08:42:20.581360102 CEST	21	52743	96.126.118.190	192.168.2.16
May 8, 2024 08:42:20.581532955 CEST	52743	21	192.168.2.16	96.126.118.190
May 8, 2024 08:42:20.587306023 CEST	21	52837	160.121.41.198	192.168.2.16
May 8, 2024 08:42:20.587424040 CEST	21	52837	160.121.41.198	192.168.2.16
May 8, 2024 08:42:20.587471962 CEST	52837	21	192.168.2.16	160.121.41.198
May 8, 2024 08:42:20.587649107 CEST	21	52817	38.239.154.176	192.168.2.16
May 8, 2024 08:42:20.588160038 CEST	21	52871	38.239.154.176	192.168.2.16
May 8, 2024 08:42:20.588171959 CEST	21	52837	160.121.41.198	192.168.2.16
May 8, 2024 08:42:20.588223934 CEST	52837	21	192.168.2.16	160.121.41.198
May 8, 2024 08:42:20.588232994 CEST	52871	21	192.168.2.16	38.239.154.176
May 8, 2024 08:42:20.594543934 CEST	21	52854	171.244.37.116	192.168.2.16
May 8, 2024 08:42:20.594660044 CEST	52854	21	192.168.2.16	171.244.37.116
May 8, 2024 08:42:20.594964027 CEST	52730	21	192.168.2.16	191.102.146.6
May 8, 2024 08:42:20.594964027 CEST	52836	2121	192.168.2.16	31.181.186.167
May 8, 2024 08:42:20.595057964 CEST	52838	2121	192.168.2.16	160.121.41.198
May 8, 2024 08:42:20.595057964 CEST	52839	21	192.168.2.16	78.186.180.252
May 8, 2024 08:42:20.610943079 CEST	52732	2121	192.168.2.16	191.102.146.6
May 8, 2024 08:42:20.611361027 CEST	52886	21	192.168.2.16	100.2.146.222
May 8, 2024 08:42:20.626962900 CEST	52733	21	192.168.2.16	66.31.64.77
May 8, 2024 08:42:20.626966000 CEST	52734	2121	192.168.2.16	66.31.64.77
May 8, 2024 08:42:20.626979113 CEST	52840	2121	192.168.2.16	78.186.180.252
May 8, 2024 08:42:20.627101898 CEST	52841	21	192.168.2.16	73.119.184.97
May 8, 2024 08:42:20.627378941 CEST	52887	2121	192.168.2.16	100.2.146.222
May 8, 2024 08:42:20.627545118 CEST	2121	52750	96.126.118.190	192.168.2.16
May 8, 2024 08:42:20.627710104 CEST	52750	2121	192.168.2.16	96.126.118.190
May 8, 2024 08:42:20.639372110 CEST	21	52872	34.149.79.8	192.168.2.16
May 8, 2024 08:42:20.639461040 CEST	52872	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:20.639713049 CEST	52872	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:20.639734983 CEST	52888	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:20.642925024 CEST	52842	2121	192.168.2.16	73.119.184.97
May 8, 2024 08:42:20.642945051 CEST	52844	2121	192.168.2.16	52.137.122.207
May 8, 2024 08:42:20.642954111 CEST	52843	21	192.168.2.16	52.137.122.207
May 8, 2024 08:42:20.643361092 CEST	52889	21	192.168.2.16	185.171.100.50
May 8, 2024 08:42:20.658804893 CEST	2121	52874	34.149.79.8	192.168.2.16
May 8, 2024 08:42:20.658871889 CEST	52874	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:20.658920050 CEST	52847	2121	192.168.2.16	36.95.88.230
May 8, 2024 08:42:20.658961058 CEST	52848	21	192.168.2.16	24.170.119.218
May 8, 2024 08:42:20.658961058 CEST	52846	21	192.168.2.16	36.95.88.230
May 8, 2024 08:42:20.659060955 CEST	52874	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:20.659539938 CEST	52890	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:20.664378881 CEST	21	52845	46.34.34.117	192.168.2.16
May 8, 2024 08:42:20.667009115 CEST	2121	52662	27.70.216.73	192.168.2.16
May 8, 2024 08:42:20.667459011 CEST	21	52845	46.34.34.117	192.168.2.16
May 8, 2024 08:42:20.667613029 CEST	52845	21	192.168.2.16	46.34.34.117
May 8, 2024 08:42:20.674910069 CEST	52781	21	192.168.2.16	60.132.78.147
May 8, 2024 08:42:20.674937963 CEST	52850	2121	192.168.2.16	24.170.119.218
May 8, 2024 08:42:20.677541971 CEST	52853	21	192.168.2.16	60.128.250.187
May 8, 2024 08:42:20.691330910 CEST	52891	2121	192.168.2.16	185.171.100.50
May 8, 2024 08:42:20.706928968 CEST	52782	2121	192.168.2.16	60.132.78.147
May 8, 2024 08:42:20.706942081 CEST	52736	21	192.168.2.16	37.78.201.99
May 8, 2024 08:42:20.707303047 CEST	52892	21	192.168.2.16	50.102.15.170
May 8, 2024 08:42:20.715064049 CEST	21	52799	117.223.205.236	192.168.2.16
May 8, 2024 08:42:20.723010063 CEST	52738	2121	192.168.2.16	37.78.201.99
May 8, 2024 08:42:20.738641024 CEST	21	52865	172.120.235.139	192.168.2.16
May 8, 2024 08:42:20.738923073 CEST	52855	2121	192.168.2.16	60.128.250.187
May 8, 2024 08:42:20.738956928 CEST	21	52865	172.120.235.139	192.168.2.16
May 8, 2024 08:42:20.739115953 CEST	52865	21	192.168.2.16	172.120.235.139
May 8, 2024 08:42:20.740412951 CEST	2121	52805	191.136.203.161	192.168.2.16
May 8, 2024 08:42:20.750319004 CEST	21	52877	14.33.230.98	192.168.2.16
May 8, 2024 08:42:20.754951000 CEST	52741	2121	192.168.2.16	79.117.51.233
May 8, 2024 08:42:20.754976988 CEST	52740	21	192.168.2.16	79.117.51.233
May 8, 2024 08:42:20.769720078 CEST	2121	52879	14.33.230.98	192.168.2.16
May 8, 2024 08:42:20.770916939 CEST	52745	2121	192.168.2.16	84.80.237.2
May 8, 2024 08:42:20.771087885 CEST	52744	21	192.168.2.16	84.80.237.2
May 8, 2024 08:42:20.771322012 CEST	52893	2121	192.168.2.16	50.102.15.170
May 8, 2024 08:42:20.771363974 CEST	21	52747	88.85.176.111	192.168.2.16
May 8, 2024 08:42:20.785188913 CEST	21	52852	77.75.121.3	192.168.2.16
May 8, 2024 08:42:20.785239935 CEST	21	52852	77.75.121.3	192.168.2.16
May 8, 2024 08:42:20.785413027 CEST	52852	21	192.168.2.16	77.75.121.3
May 8, 2024 08:42:20.788213968 CEST	21	52743	96.126.118.190	192.168.2.16
May 8, 2024 08:42:20.788387060 CEST	52743	21	192.168.2.16	96.126.118.190
May 8, 2024 08:42:20.790553093 CEST	2121	52748	88.85.176.111	192.168.2.16
May 8, 2024 08:42:20.791132927 CEST	21	52864	84.44.255.254	192.168.2.16
May 8, 2024 08:42:20.791193962 CEST	52864	21	192.168.2.16	84.44.255.254
May 8, 2024 08:42:20.791254044 CEST	52864	21	192.168.2.16	84.44.255.254
May 8, 2024 08:42:20.791472912 CEST	52894	21	192.168.2.16	84.44.255.254
May 8, 2024 08:42:20.801853895 CEST	21	52888	34.149.79.8	192.168.2.16
May 8, 2024 08:42:20.801927090 CEST	52888	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:20.802077055 CEST	21	52872	34.149.79.8	192.168.2.16
May 8, 2024 08:42:20.821425915 CEST	2121	52874	34.149.79.8	192.168.2.16
May 8, 2024 08:42:20.822035074 CEST	2121	52890	34.149.79.8	192.168.2.16
May 8, 2024 08:42:20.822109938 CEST	52890	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:20.832434893 CEST	21	52878	38.207.205.17	192.168.2.16
May 8, 2024 08:42:20.833842993 CEST	2121	52750	96.126.118.190	192.168.2.16
May 8, 2024 08:42:20.834065914 CEST	52750	2121	192.168.2.16	96.126.118.190
May 8, 2024 08:42:20.851372004 CEST	52895	21	192.168.2.16	109.96.226.101
May 8, 2024 08:42:20.855643988 CEST	2121	52752	86.51.153.63	192.168.2.16
May 8, 2024 08:42:20.866955996 CEST	52753	21	192.168.2.16	108.51.123.143
May 8, 2024 08:42:20.882951975 CEST	52755	2121	192.168.2.16	108.51.123.143
May 8, 2024 08:42:20.889911890 CEST	21	52871	38.239.154.176	192.168.2.16
May 8, 2024 08:42:20.890105009 CEST	52871	21	192.168.2.16	38.239.154.176
May 8, 2024 08:42:20.901180029 CEST	21	52680	45.84.171.147	192.168.2.16
May 8, 2024 08:42:20.915308952 CEST	52896	2121	192.168.2.16	109.96.226.101
May 8, 2024 08:42:20.915453911 CEST	52897	21	192.168.2.16	82.7.22.194
May 8, 2024 08:42:20.930943966 CEST	52756	21	192.168.2.16	174.112.199.80
May 8, 2024 08:42:20.931224108 CEST	52898	2121	192.168.2.16	82.7.22.194
May 8, 2024 08:42:20.941170931 CEST	21	52854	171.244.37.116	192.168.2.16
May 8, 2024 08:42:20.941324949 CEST	52854	21	192.168.2.16	171.244.37.116
May 8, 2024 08:42:20.946665049 CEST	21	52865	172.120.235.139	192.168.2.16
May 8, 2024 08:42:20.946810007 CEST	52865	21	192.168.2.16	172.120.235.139
May 8, 2024 08:42:20.946918964 CEST	52757	2121	192.168.2.16	174.112.199.80
May 8, 2024 08:42:20.946934938 CEST	52856	21	192.168.2.16	80.48.205.205
May 8, 2024 08:42:20.946983099 CEST	52899	21	192.168.2.16	172.120.235.139
May 8, 2024 08:42:20.957076073 CEST	2121	52683	45.84.171.147	192.168.2.16
May 8, 2024 08:42:20.964627981 CEST	21	52888	34.149.79.8	192.168.2.16
May 8, 2024 08:42:20.964699030 CEST	52888	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:20.964772940 CEST	52888	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:20.964943886 CEST	52900	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:20.968096972 CEST	21	52781	60.132.78.147	192.168.2.16
May 8, 2024 08:42:20.977973938 CEST	21	52853	60.128.250.187	192.168.2.16
May 8, 2024 08:42:20.979542017 CEST	52901	21	192.168.2.16	80.29.79.134
May 8, 2024 08:42:20.986350060 CEST	2121	52890	34.149.79.8	192.168.2.16
May 8, 2024 08:42:20.986407995 CEST	52890	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:20.986469984 CEST	52890	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:20.986677885 CEST	52902	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:20.994918108 CEST	52704	2121	192.168.2.16	139.130.247.205
May 8, 2024 08:42:20.995773077 CEST	21	52743	96.126.118.190	192.168.2.16
May 8, 2024 08:42:20.995989084 CEST	52743	21	192.168.2.16	96.126.118.190
May 8, 2024 08:42:20.998687983 CEST	21	52889	185.171.100.50	192.168.2.16
May 8, 2024 08:42:21.000171900 CEST	2121	52782	60.132.78.147	192.168.2.16
May 8, 2024 08:42:21.027287006 CEST	52903	2121	192.168.2.16	80.29.79.134
May 8, 2024 08:42:21.039518118 CEST	2121	52855	60.128.250.187	192.168.2.16
May 8, 2024 08:42:21.040982962 CEST	21	52845	46.34.34.117	192.168.2.16
May 8, 2024 08:42:21.042373896 CEST	2121	52750	96.126.118.190	192.168.2.16
May 8, 2024 08:42:21.042576075 CEST	52750	2121	192.168.2.16	96.126.118.190
May 8, 2024 08:42:21.042917013 CEST	52859	2121	192.168.2.16	80.48.205.205
May 8, 2024 08:42:21.043348074 CEST	52904	2121	192.168.2.16	71.219.51.1
May 8, 2024 08:42:21.043404102 CEST	52905	21	192.168.2.16	71.219.51.1
May 8, 2024 08:42:21.052655935 CEST	21	52885	196.210.0.111	192.168.2.16
May 8, 2024 08:42:21.052730083 CEST	52885	21	192.168.2.16	196.210.0.111
May 8, 2024 08:42:21.055411100 CEST	21	52735	196.210.0.111	192.168.2.16
May 8, 2024 08:42:21.055465937 CEST	52735	21	192.168.2.16	196.210.0.111
May 8, 2024 08:42:21.056691885 CEST	2121	52891	185.171.100.50	192.168.2.16
May 8, 2024 08:42:21.058945894 CEST	52860	21	192.168.2.16	24.164.151.97
May 8, 2024 08:42:21.074948072 CEST	52862	2121	192.168.2.16	24.164.151.97
May 8, 2024 08:42:21.074963093 CEST	52861	21	192.168.2.16	223.206.58.167
May 8, 2024 08:42:21.091429949 CEST	52906	21	192.168.2.16	117.99.191.171
May 8, 2024 08:42:21.091492891 CEST	52907	2121	192.168.2.16	117.99.191.171
May 8, 2024 08:42:21.104768038 CEST	21	52894	84.44.255.254	192.168.2.16
May 8, 2024 08:42:21.104835033 CEST	52894	21	192.168.2.16	84.44.255.254
May 8, 2024 08:42:21.106940985 CEST	52863	2121	192.168.2.16	223.206.58.167
May 8, 2024 08:42:21.111258984 CEST	21	52864	84.44.255.254	192.168.2.16
May 8, 2024 08:42:21.122925043 CEST	52760	21	192.168.2.16	178.196.176.3
May 8, 2024 08:42:21.126898050 CEST	21	52888	34.149.79.8	192.168.2.16
May 8, 2024 08:42:21.127320051 CEST	21	52900	34.149.79.8	192.168.2.16
May 8, 2024 08:42:21.127387047 CEST	52900	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:21.128701925 CEST	21	52865	172.120.235.139	192.168.2.16
May 8, 2024 08:42:21.128715992 CEST	21	52899	172.120.235.139	192.168.2.16
May 8, 2024 08:42:21.128751993 CEST	52865	21	192.168.2.16	172.120.235.139
May 8, 2024 08:42:21.128787041 CEST	52899	21	192.168.2.16	172.120.235.139
May 8, 2024 08:42:21.138946056 CEST	52761	2121	192.168.2.16	178.196.176.3
May 8, 2024 08:42:21.139229059 CEST	52762	21	192.168.2.16	27.11.119.251
May 8, 2024 08:42:21.139411926 CEST	52908	21	192.168.2.16	198.72.168.160
May 8, 2024 08:42:21.140621901 CEST	21	52852	77.75.121.3	192.168.2.16
May 8, 2024 08:42:21.148876905 CEST	2121	52890	34.149.79.8	192.168.2.16
May 8, 2024 08:42:21.149013996 CEST	2121	52902	34.149.79.8	192.168.2.16
May 8, 2024 08:42:21.149085999 CEST	52902	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:21.154934883 CEST	52763	2121	192.168.2.16	27.11.119.251
May 8, 2024 08:42:21.155056000 CEST	52765	21	192.168.2.16	95.121.52.45
May 8, 2024 08:42:21.156033993 CEST	52764	21	192.168.2.16	95.252.27.121
May 8, 2024 08:42:21.156049013 CEST	52766	2121	192.168.2.16	95.121.52.45
May 8, 2024 08:42:21.170944929 CEST	52866	21	192.168.2.16	76.125.250.125
May 8, 2024 08:42:21.186942101 CEST	52770	21	192.168.2.16	13.249.157.223
May 8, 2024 08:42:21.186942101 CEST	52767	2121	192.168.2.16	95.252.27.121
May 8, 2024 08:42:21.187066078 CEST	52769	2121	192.168.2.16	69.136.37.217
May 8, 2024 08:42:21.187067986 CEST	52768	21	192.168.2.16	69.136.37.217
May 8, 2024 08:42:21.192657948 CEST	21	52871	38.239.154.176	192.168.2.16
May 8, 2024 08:42:21.192739964 CEST	21	52871	38.239.154.176	192.168.2.16
May 8, 2024 08:42:21.192890882 CEST	52871	21	192.168.2.16	38.239.154.176
May 8, 2024 08:42:21.202780008 CEST	21	52743	96.126.118.190	192.168.2.16
May 8, 2024 08:42:21.202919006 CEST	52772	2121	192.168.2.16	67.10.243.234
May 8, 2024 08:42:21.202938080 CEST	52771	2121	192.168.2.16	13.249.157.223
May 8, 2024 08:42:21.202941895 CEST	52773	21	192.168.2.16	67.10.243.234
May 8, 2024 08:42:21.203425884 CEST	52743	21	192.168.2.16	96.126.118.190
May 8, 2024 08:42:21.218916893 CEST	52774	21	192.168.2.16	168.182.182.67
May 8, 2024 08:42:21.234930992 CEST	52868	2121	192.168.2.16	76.125.250.125
May 8, 2024 08:42:21.234940052 CEST	52775	2121	192.168.2.16	168.182.182.67
May 8, 2024 08:42:21.234950066 CEST	52867	21	192.168.2.16	222.219.165.140
May 8, 2024 08:42:21.249006033 CEST	2121	52750	96.126.118.190	192.168.2.16
May 8, 2024 08:42:21.249464989 CEST	52750	2121	192.168.2.16	96.126.118.190
May 8, 2024 08:42:21.250937939 CEST	52778	21	192.168.2.16	73.250.24.123
May 8, 2024 08:42:21.250938892 CEST	52877	21	192.168.2.16	14.33.230.98
May 8, 2024 08:42:21.250953913 CEST	52805	2121	192.168.2.16	191.136.203.161
May 8, 2024 08:42:21.255908012 CEST	52779	2121	192.168.2.16	73.250.24.123
May 8, 2024 08:42:21.256330967 CEST	52777	21	192.168.2.16	94.134.82.214
May 8, 2024 08:42:21.266916990 CEST	52780	2121	192.168.2.16	94.134.82.214
May 8, 2024 08:42:21.267213106 CEST	52869	2121	192.168.2.16	222.219.165.140
May 8, 2024 08:42:21.281305075 CEST	2121	52896	109.96.226.101	192.168.2.16
May 8, 2024 08:42:21.282926083 CEST	52747	21	192.168.2.16	88.85.176.111
May 8, 2024 08:42:21.282934904 CEST	52870	21	192.168.2.16	96.255.189.170
May 8, 2024 08:42:21.286912918 CEST	52879	2121	192.168.2.16	14.33.230.98
May 8, 2024 08:42:21.288642883 CEST	21	52854	171.244.37.116	192.168.2.16
May 8, 2024 08:42:21.288808107 CEST	52854	21	192.168.2.16	171.244.37.116
May 8, 2024 08:42:21.289041996 CEST	52911	21	192.168.2.16	171.244.37.116
May 8, 2024 08:42:21.289834023 CEST	21	52900	34.149.79.8	192.168.2.16
May 8, 2024 08:42:21.289906025 CEST	52900	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:21.289979935 CEST	52900	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:21.290180922 CEST	52912	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:21.298917055 CEST	52748	2121	192.168.2.16	88.85.176.111
May 8, 2024 08:42:21.299488068 CEST	52913	2121	192.168.2.16	198.72.168.160
May 8, 2024 08:42:21.311495066 CEST	2121	52902	34.149.79.8	192.168.2.16
May 8, 2024 08:42:21.311553001 CEST	52902	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:21.311618090 CEST	52902	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:21.311839104 CEST	52914	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:21.330939054 CEST	52783	21	192.168.2.16	98.36.128.209
May 8, 2024 08:42:21.331012011 CEST	52873	2121	192.168.2.16	96.255.189.170
May 8, 2024 08:42:21.331012011 CEST	52620	2121	192.168.2.16	62.140.135.146
May 8, 2024 08:42:21.331209898 CEST	52915	2121	192.168.2.16	62.140.135.146
May 8, 2024 08:42:21.346787930 CEST	21	52899	172.120.235.139	192.168.2.16
May 8, 2024 08:42:21.346995115 CEST	52878	21	192.168.2.16	38.207.205.17
May 8, 2024 08:42:21.346995115 CEST	52875	21	192.168.2.16	73.49.216.251
May 8, 2024 08:42:21.347048044 CEST	52899	21	192.168.2.16	172.120.235.139
May 8, 2024 08:42:21.362931967 CEST	52752	2121	192.168.2.16	86.51.153.63
May 8, 2024 08:42:21.378933907 CEST	52876	2121	192.168.2.16	73.49.216.251
May 8, 2024 08:42:21.378985882 CEST	52622	21	192.168.2.16	62.140.135.146
May 8, 2024 08:42:21.379339933 CEST	52916	21	192.168.2.16	62.140.135.146
May 8, 2024 08:42:21.395463943 CEST	52917	2121	192.168.2.16	46.163.151.66
May 8, 2024 08:42:21.395580053 CEST	52919	21	192.168.2.16	46.163.151.66
May 8, 2024 08:42:21.395651102 CEST	52918	21	192.168.2.16	95.88.100.53
May 8, 2024 08:42:21.409868956 CEST	21	52743	96.126.118.190	192.168.2.16
May 8, 2024 08:42:21.410331011 CEST	52743	21	192.168.2.16	96.126.118.190
May 8, 2024 08:42:21.411346912 CEST	52921	2121	192.168.2.16	95.88.100.53
May 8, 2024 08:42:21.417264938 CEST	21	52894	84.44.255.254	192.168.2.16
May 8, 2024 08:42:21.417319059 CEST	52894	21	192.168.2.16	84.44.255.254
May 8, 2024 08:42:21.417402983 CEST	52894	21	192.168.2.16	84.44.255.254
May 8, 2024 08:42:21.417613983 CEST	52922	21	192.168.2.16	84.44.255.254
May 8, 2024 08:42:21.442920923 CEST	52786	2121	192.168.2.16	98.36.128.209
May 8, 2024 08:42:21.452316046 CEST	21	52912	34.149.79.8	192.168.2.16
May 8, 2024 08:42:21.452370882 CEST	21	52900	34.149.79.8	192.168.2.16
May 8, 2024 08:42:21.452373028 CEST	52912	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:21.455846071 CEST	2121	52750	96.126.118.190	192.168.2.16
May 8, 2024 08:42:21.456270933 CEST	52750	2121	192.168.2.16	96.126.118.190
May 8, 2024 08:42:21.458934069 CEST	52787	21	192.168.2.16	172.117.76.139
May 8, 2024 08:42:21.458945036 CEST	52881	21	192.168.2.16	50.109.87.151
May 8, 2024 08:42:21.458947897 CEST	52880	2121	192.168.2.16	38.207.205.17
May 8, 2024 08:42:21.473989010 CEST	2121	52902	34.149.79.8	192.168.2.16
May 8, 2024 08:42:21.474208117 CEST	2121	52914	34.149.79.8	192.168.2.16
May 8, 2024 08:42:21.474317074 CEST	52914	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:21.474921942 CEST	52781	21	192.168.2.16	60.132.78.147
May 8, 2024 08:42:21.474940062 CEST	52788	21	192.168.2.16	120.79.9.235
May 8, 2024 08:42:21.474940062 CEST	52789	2121	192.168.2.16	172.117.76.139
May 8, 2024 08:42:21.490943909 CEST	52853	21	192.168.2.16	60.128.250.187
May 8, 2024 08:42:21.491995096 CEST	52791	2121	192.168.2.16	120.79.9.235
May 8, 2024 08:42:21.500650883 CEST	21	52871	38.239.154.176	192.168.2.16
May 8, 2024 08:42:21.500804901 CEST	52871	21	192.168.2.16	38.239.154.176
May 8, 2024 08:42:21.501038074 CEST	52924	21	192.168.2.16	38.239.154.176
May 8, 2024 08:42:21.501265049 CEST	21	52871	38.239.154.176	192.168.2.16
May 8, 2024 08:42:21.501313925 CEST	52871	21	192.168.2.16	38.239.154.176
May 8, 2024 08:42:21.506913900 CEST	52782	2121	192.168.2.16	60.132.78.147
May 8, 2024 08:42:21.506937981 CEST	52889	21	192.168.2.16	185.171.100.50
May 8, 2024 08:42:21.512520075 CEST	52792	21	192.168.2.16	106.200.113.162
May 8, 2024 08:42:21.522910118 CEST	52882	2121	192.168.2.16	50.109.87.151
May 8, 2024 08:42:21.528739929 CEST	21	52899	172.120.235.139	192.168.2.16
May 8, 2024 08:42:21.529165030 CEST	21	52899	172.120.235.139	192.168.2.16
May 8, 2024 08:42:21.529314041 CEST	52899	21	192.168.2.16	172.120.235.139
May 8, 2024 08:42:21.538927078 CEST	52793	2121	192.168.2.16	106.200.113.162
May 8, 2024 08:42:21.538947105 CEST	52883	21	192.168.2.16	95.54.247.224
May 8, 2024 08:42:21.539256096 CEST	52925	21	192.168.2.16	90.190.165.47
May 8, 2024 08:42:21.554925919 CEST	52855	2121	192.168.2.16	60.128.250.187
May 8, 2024 08:42:21.555799007 CEST	21	52885	196.210.0.111	192.168.2.16
May 8, 2024 08:42:21.555831909 CEST	52884	2121	192.168.2.16	95.54.247.224
May 8, 2024 08:42:21.555963993 CEST	52885	21	192.168.2.16	196.210.0.111
May 8, 2024 08:42:21.565280914 CEST	21	52877	14.33.230.98	192.168.2.16
May 8, 2024 08:42:21.570914984 CEST	52891	2121	192.168.2.16	185.171.100.50
May 8, 2024 08:42:21.570939064 CEST	52795	21	192.168.2.16	211.246.184.173
May 8, 2024 08:42:21.570939064 CEST	52794	2121	192.168.2.16	222.136.152.252
May 8, 2024 08:42:21.573456049 CEST	52796	21	192.168.2.16	222.136.152.252
May 8, 2024 08:42:21.586932898 CEST	52798	2121	192.168.2.16	211.246.184.173
May 8, 2024 08:42:21.601922989 CEST	52800	21	192.168.2.16	98.29.67.27
May 8, 2024 08:42:21.602027893 CEST	52802	2121	192.168.2.16	98.29.67.27
May 8, 2024 08:42:21.603626966 CEST	2121	52879	14.33.230.98	192.168.2.16
May 8, 2024 08:42:21.614531994 CEST	21	52912	34.149.79.8	192.168.2.16
May 8, 2024 08:42:21.614609003 CEST	52912	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:21.614659071 CEST	52912	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:21.614867926 CEST	52926	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:21.616791964 CEST	21	52743	96.126.118.190	192.168.2.16
May 8, 2024 08:42:21.616919041 CEST	52801	21	192.168.2.16	32.219.249.216
May 8, 2024 08:42:21.617542028 CEST	52886	21	192.168.2.16	100.2.146.222
May 8, 2024 08:42:21.617625952 CEST	52928	2121	192.168.2.16	90.190.165.47
May 8, 2024 08:42:21.617752075 CEST	52743	21	192.168.2.16	96.126.118.190
May 8, 2024 08:42:21.618407011 CEST	2121	52805	191.136.203.161	192.168.2.16
May 8, 2024 08:42:21.632949114 CEST	52804	21	192.168.2.16	191.136.203.161
May 8, 2024 08:42:21.632983923 CEST	52803	2121	192.168.2.16	32.219.249.216
May 8, 2024 08:42:21.633070946 CEST	52887	2121	192.168.2.16	100.2.146.222
May 8, 2024 08:42:21.635169029 CEST	21	52854	171.244.37.116	192.168.2.16
May 8, 2024 08:42:21.635329962 CEST	21	52854	171.244.37.116	192.168.2.16
May 8, 2024 08:42:21.635374069 CEST	52854	21	192.168.2.16	171.244.37.116
May 8, 2024 08:42:21.636732101 CEST	2121	52914	34.149.79.8	192.168.2.16
May 8, 2024 08:42:21.636787891 CEST	52914	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:21.636907101 CEST	52914	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:21.637164116 CEST	52929	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:21.650346994 CEST	21	52747	88.85.176.111	192.168.2.16
May 8, 2024 08:42:21.650751114 CEST	52930	21	192.168.2.16	20.81.148.204
May 8, 2024 08:42:21.656599045 CEST	2121	52915	62.140.135.146	192.168.2.16
May 8, 2024 08:42:21.656675100 CEST	52915	2121	192.168.2.16	62.140.135.146
May 8, 2024 08:42:21.658606052 CEST	21	52911	171.244.37.116	192.168.2.16
May 8, 2024 08:42:21.658670902 CEST	52911	21	192.168.2.16	171.244.37.116
May 8, 2024 08:42:21.662524939 CEST	2121	52750	96.126.118.190	192.168.2.16
May 8, 2024 08:42:21.662909985 CEST	52750	2121	192.168.2.16	96.126.118.190
May 8, 2024 08:42:21.664917946 CEST	52806	21	192.168.2.16	175.125.169.40
May 8, 2024 08:42:21.669580936 CEST	2121	52748	88.85.176.111	192.168.2.16
May 8, 2024 08:42:21.681402922 CEST	52932	2121	192.168.2.16	20.81.148.204
May 8, 2024 08:42:21.695947886 CEST	52807	2121	192.168.2.16	175.125.169.40
May 8, 2024 08:42:21.705557108 CEST	21	52916	62.140.135.146	192.168.2.16
May 8, 2024 08:42:21.705635071 CEST	52916	21	192.168.2.16	62.140.135.146
May 8, 2024 08:42:21.711920023 CEST	52892	21	192.168.2.16	50.102.15.170
May 8, 2024 08:42:21.716146946 CEST	21	52799	117.223.205.236	192.168.2.16
May 8, 2024 08:42:21.716320992 CEST	52799	21	192.168.2.16	117.223.205.236
May 8, 2024 08:42:21.716572046 CEST	52933	21	192.168.2.16	117.223.205.236
May 8, 2024 08:42:21.726933002 CEST	52810	21	192.168.2.16	210.104.41.236
May 8, 2024 08:42:21.729618073 CEST	21	52894	84.44.255.254	192.168.2.16
May 8, 2024 08:42:21.733364105 CEST	21	52922	84.44.255.254	192.168.2.16
May 8, 2024 08:42:21.733436108 CEST	52922	21	192.168.2.16	84.44.255.254
May 8, 2024 08:42:21.734396935 CEST	2121	52752	86.51.153.63	192.168.2.16
May 8, 2024 08:42:21.739939928 CEST	21	52899	172.120.235.139	192.168.2.16
May 8, 2024 08:42:21.740066051 CEST	52899	21	192.168.2.16	172.120.235.139
May 8, 2024 08:42:21.740250111 CEST	52934	21	192.168.2.16	172.120.235.139
May 8, 2024 08:42:21.741942883 CEST	52811	2121	192.168.2.16	210.104.41.236
May 8, 2024 08:42:21.742269993 CEST	52935	21	192.168.2.16	45.243.182.223
May 8, 2024 08:42:21.758518934 CEST	52936	2121	192.168.2.16	45.243.182.223
May 8, 2024 08:42:21.758630037 CEST	52937	21	192.168.2.16	178.70.228.49
May 8, 2024 08:42:21.768162966 CEST	21	52781	60.132.78.147	192.168.2.16
May 8, 2024 08:42:21.768719912 CEST	2121	52917	46.163.151.66	192.168.2.16
May 8, 2024 08:42:21.768731117 CEST	21	52919	46.163.151.66	192.168.2.16
May 8, 2024 08:42:21.773041010 CEST	52893	2121	192.168.2.16	50.102.15.170
May 8, 2024 08:42:21.773746967 CEST	52938	2121	192.168.2.16	178.70.228.49
May 8, 2024 08:42:21.773830891 CEST	52939	21	192.168.2.16	77.34.229.59
May 8, 2024 08:42:21.773962021 CEST	52940	2121	192.168.2.16	77.34.229.59
May 8, 2024 08:42:21.776813984 CEST	21	52912	34.149.79.8	192.168.2.16
May 8, 2024 08:42:21.777259111 CEST	21	52926	34.149.79.8	192.168.2.16
May 8, 2024 08:42:21.777319908 CEST	52926	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:21.788937092 CEST	52896	2121	192.168.2.16	109.96.226.101
May 8, 2024 08:42:21.789196014 CEST	52941	21	192.168.2.16	98.216.74.51
May 8, 2024 08:42:21.790986061 CEST	21	52853	60.128.250.187	192.168.2.16
May 8, 2024 08:42:21.799233913 CEST	2121	52914	34.149.79.8	192.168.2.16
May 8, 2024 08:42:21.799660921 CEST	2121	52929	34.149.79.8	192.168.2.16
May 8, 2024 08:42:21.799735069 CEST	52929	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:21.800085068 CEST	2121	52782	60.132.78.147	192.168.2.16
May 8, 2024 08:42:21.802809000 CEST	21	52871	38.239.154.176	192.168.2.16
May 8, 2024 08:42:21.803015947 CEST	21	52924	38.239.154.176	192.168.2.16
May 8, 2024 08:42:21.803078890 CEST	52924	21	192.168.2.16	38.239.154.176
May 8, 2024 08:42:21.821283102 CEST	52942	2121	192.168.2.16	98.216.74.51
May 8, 2024 08:42:21.824579954 CEST	21	52743	96.126.118.190	192.168.2.16
May 8, 2024 08:42:21.825074911 CEST	52743	21	192.168.2.16	96.126.118.190
May 8, 2024 08:42:21.852050066 CEST	52895	21	192.168.2.16	109.96.226.101
May 8, 2024 08:42:21.852520943 CEST	52944	21	192.168.2.16	193.115.118.112
May 8, 2024 08:42:21.855454922 CEST	2121	52855	60.128.250.187	192.168.2.16
May 8, 2024 08:42:21.861812115 CEST	21	52889	185.171.100.50	192.168.2.16
May 8, 2024 08:42:21.869117022 CEST	2121	52750	96.126.118.190	192.168.2.16
May 8, 2024 08:42:21.869559050 CEST	52750	2121	192.168.2.16	96.126.118.190
May 8, 2024 08:42:21.884341002 CEST	52946	2121	192.168.2.16	193.115.118.112
May 8, 2024 08:42:21.900312901 CEST	52947	21	192.168.2.16	73.244.194.242
May 8, 2024 08:42:21.916030884 CEST	52897	21	192.168.2.16	82.7.22.194
May 8, 2024 08:42:21.916435003 CEST	52948	2121	192.168.2.16	73.244.194.242
May 8, 2024 08:42:21.916515112 CEST	52949	21	192.168.2.16	171.5.151.204
May 8, 2024 08:42:21.921899080 CEST	21	52934	172.120.235.139	192.168.2.16
May 8, 2024 08:42:21.921911001 CEST	21	52899	172.120.235.139	192.168.2.16
May 8, 2024 08:42:21.921969891 CEST	52899	21	192.168.2.16	172.120.235.139
May 8, 2024 08:42:21.921987057 CEST	52934	21	192.168.2.16	172.120.235.139
May 8, 2024 08:42:21.931952953 CEST	52898	2121	192.168.2.16	82.7.22.194
May 8, 2024 08:42:21.932648897 CEST	52950	2121	192.168.2.16	171.5.151.204
May 8, 2024 08:42:21.932686090 CEST	52951	21	192.168.2.16	112.145.29.138
May 8, 2024 08:42:21.936475039 CEST	2121	52891	185.171.100.50	192.168.2.16
May 8, 2024 08:42:21.939924955 CEST	21	52926	34.149.79.8	192.168.2.16
May 8, 2024 08:42:21.939979076 CEST	52926	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:21.940037966 CEST	52926	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:21.940211058 CEST	52952	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:21.942219019 CEST	21	52619	51.38.57.28	192.168.2.16
May 8, 2024 08:42:21.942336082 CEST	52619	21	192.168.2.16	51.38.57.28
May 8, 2024 08:42:21.942502975 CEST	52953	21	192.168.2.16	51.38.57.28
May 8, 2024 08:42:21.948271036 CEST	52954	2121	192.168.2.16	112.145.29.138
May 8, 2024 08:42:21.962220907 CEST	2121	52929	34.149.79.8	192.168.2.16
May 8, 2024 08:42:21.962271929 CEST	52929	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:21.962344885 CEST	52929	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:21.962543964 CEST	52955	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:21.979917049 CEST	52901	21	192.168.2.16	80.29.79.134
May 8, 2024 08:42:21.979984999 CEST	52813	21	192.168.2.16	86.23.102.114
May 8, 2024 08:42:21.980608940 CEST	52956	2121	192.168.2.16	47.98.196.75
May 8, 2024 08:42:21.980614901 CEST	52957	21	192.168.2.16	47.98.196.75
May 8, 2024 08:42:21.980679989 CEST	52958	21	192.168.2.16	72.94.54.194
May 8, 2024 08:42:21.996140957 CEST	52959	2121	192.168.2.16	72.94.54.194
May 8, 2024 08:42:22.009524107 CEST	21	52845	46.34.34.117	192.168.2.16
May 8, 2024 08:42:22.009677887 CEST	52845	21	192.168.2.16	46.34.34.117
May 8, 2024 08:42:22.009936094 CEST	52960	21	192.168.2.16	46.34.34.117
May 8, 2024 08:42:22.011346102 CEST	52961	21	192.168.2.16	62.74.64.79
May 8, 2024 08:42:22.026983976 CEST	52815	2121	192.168.2.16	86.23.102.114
May 8, 2024 08:42:22.027272940 CEST	52962	2121	192.168.2.16	62.74.64.79
May 8, 2024 08:42:22.031624079 CEST	21	52911	171.244.37.116	192.168.2.16
May 8, 2024 08:42:22.031749010 CEST	52911	21	192.168.2.16	171.244.37.116
May 8, 2024 08:42:22.032830954 CEST	21	52885	196.210.0.111	192.168.2.16
May 8, 2024 08:42:22.032844067 CEST	21	52885	196.210.0.111	192.168.2.16
May 8, 2024 08:42:22.032962084 CEST	52885	21	192.168.2.16	196.210.0.111
May 8, 2024 08:42:22.035197020 CEST	21	52743	96.126.118.190	192.168.2.16
May 8, 2024 08:42:22.035535097 CEST	52743	21	192.168.2.16	96.126.118.190
May 8, 2024 08:42:22.042926073 CEST	52903	2121	192.168.2.16	80.29.79.134
May 8, 2024 08:42:22.042973042 CEST	52904	2121	192.168.2.16	71.219.51.1
May 8, 2024 08:42:22.042974949 CEST	52905	21	192.168.2.16	71.219.51.1
May 8, 2024 08:42:22.043246984 CEST	52964	21	192.168.2.16	64.233.171.82
May 8, 2024 08:42:22.052068949 CEST	21	52922	84.44.255.254	192.168.2.16
May 8, 2024 08:42:22.052133083 CEST	52922	21	192.168.2.16	84.44.255.254
May 8, 2024 08:42:22.052186012 CEST	52922	21	192.168.2.16	84.44.255.254
May 8, 2024 08:42:22.052366018 CEST	52965	21	192.168.2.16	84.44.255.254
May 8, 2024 08:42:22.058949947 CEST	51498	2121	192.168.2.16	38.207.205.17
May 8, 2024 08:42:22.059390068 CEST	52966	2121	192.168.2.16	64.233.171.82
May 8, 2024 08:42:22.059415102 CEST	52967	21	192.168.2.16	95.108.21.236
May 8, 2024 08:42:22.074924946 CEST	52877	21	192.168.2.16	14.33.230.98
May 8, 2024 08:42:22.075392962 CEST	52968	21	192.168.2.16	14.199.15.208
May 8, 2024 08:42:22.075455904 CEST	52969	2121	192.168.2.16	95.108.21.236
May 8, 2024 08:42:22.076170921 CEST	2121	52750	96.126.118.190	192.168.2.16
May 8, 2024 08:42:22.076510906 CEST	52750	2121	192.168.2.16	96.126.118.190
May 8, 2024 08:42:22.090910912 CEST	52818	21	192.168.2.16	160.237.79.186
May 8, 2024 08:42:22.090928078 CEST	52906	21	192.168.2.16	117.99.191.171
May 8, 2024 08:42:22.091829062 CEST	52971	2121	192.168.2.16	14.199.15.208
May 8, 2024 08:42:22.091953993 CEST	52972	21	192.168.2.16	81.40.86.11
May 8, 2024 08:42:22.092040062 CEST	52973	2121	192.168.2.16	81.40.86.11
May 8, 2024 08:42:22.102833986 CEST	21	52926	34.149.79.8	192.168.2.16
May 8, 2024 08:42:22.102845907 CEST	21	52952	34.149.79.8	192.168.2.16
May 8, 2024 08:42:22.102940083 CEST	52952	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:22.105384111 CEST	21	52924	38.239.154.176	192.168.2.16
May 8, 2024 08:42:22.105532885 CEST	52924	21	192.168.2.16	38.239.154.176
May 8, 2024 08:42:22.105953932 CEST	52820	21	192.168.2.16	194.26.205.242
May 8, 2024 08:42:22.105954885 CEST	52907	2121	192.168.2.16	117.99.191.171
May 8, 2024 08:42:22.105957031 CEST	52819	2121	192.168.2.16	160.237.79.186
May 8, 2024 08:42:22.106057882 CEST	52879	2121	192.168.2.16	14.33.230.98
May 8, 2024 08:42:22.106264114 CEST	52974	21	192.168.2.16	66.152.152.78
May 8, 2024 08:42:22.110361099 CEST	21	52721	23.229.188.101	192.168.2.16
May 8, 2024 08:42:22.110481024 CEST	52721	21	192.168.2.16	23.229.188.101
May 8, 2024 08:42:22.110692978 CEST	52975	21	192.168.2.16	23.229.188.101
May 8, 2024 08:42:22.121949911 CEST	52805	2121	192.168.2.16	191.136.203.161
May 8, 2024 08:42:22.124725103 CEST	2121	52929	34.149.79.8	192.168.2.16
May 8, 2024 08:42:22.124893904 CEST	2121	52955	34.149.79.8	192.168.2.16
May 8, 2024 08:42:22.124962091 CEST	52955	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:22.138308048 CEST	52976	2121	192.168.2.16	66.152.152.78
May 8, 2024 08:42:22.139894009 CEST	21	52934	172.120.235.139	192.168.2.16
May 8, 2024 08:42:22.140007973 CEST	52934	21	192.168.2.16	172.120.235.139
May 8, 2024 08:42:22.153940916 CEST	52908	21	192.168.2.16	198.72.168.160
May 8, 2024 08:42:22.154134035 CEST	52977	21	192.168.2.16	102.39.31.115
May 8, 2024 08:42:22.154225111 CEST	2121	52896	109.96.226.101	192.168.2.16
May 8, 2024 08:42:22.185336113 CEST	52978	2121	192.168.2.16	102.39.31.115
May 8, 2024 08:42:22.210639000 CEST	21	52799	117.223.205.236	192.168.2.16
May 8, 2024 08:42:22.210697889 CEST	52799	21	192.168.2.16	117.223.205.236
May 8, 2024 08:42:22.210978031 CEST	21	52933	117.223.205.236	192.168.2.16
May 8, 2024 08:42:22.211038113 CEST	52933	21	192.168.2.16	117.223.205.236
May 8, 2024 08:42:22.217335939 CEST	52979	21	192.168.2.16	197.26.33.147
May 8, 2024 08:42:22.233347893 CEST	52980	21	192.168.2.16	91.146.97.65
May 8, 2024 08:42:22.245111942 CEST	21	52743	96.126.118.190	192.168.2.16
May 8, 2024 08:42:22.245532990 CEST	52743	21	192.168.2.16	96.126.118.190
May 8, 2024 08:42:22.248950005 CEST	52822	2121	192.168.2.16	194.26.205.242
May 8, 2024 08:42:22.261296988 CEST	21	52953	51.38.57.28	192.168.2.16
May 8, 2024 08:42:22.261374950 CEST	52953	21	192.168.2.16	51.38.57.28
May 8, 2024 08:42:22.264136076 CEST	21	52619	51.38.57.28	192.168.2.16
May 8, 2024 08:42:22.264192104 CEST	52619	21	192.168.2.16	51.38.57.28
May 8, 2024 08:42:22.264633894 CEST	21	52619	51.38.57.28	192.168.2.16
May 8, 2024 08:42:22.264678955 CEST	52619	21	192.168.2.16	51.38.57.28
May 8, 2024 08:42:22.265305996 CEST	52982	21	192.168.2.16	217.76.115.138
May 8, 2024 08:42:22.267354965 CEST	21	52952	34.149.79.8	192.168.2.16
May 8, 2024 08:42:22.267411947 CEST	52952	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:22.267486095 CEST	52952	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:22.267688036 CEST	52983	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:22.281467915 CEST	52984	21	192.168.2.16	79.98.26.88
May 8, 2024 08:42:22.281497955 CEST	52985	21	192.168.2.16	38.14.189.177
May 8, 2024 08:42:22.282877922 CEST	2121	52750	96.126.118.190	192.168.2.16
May 8, 2024 08:42:22.283236027 CEST	52750	2121	192.168.2.16	96.126.118.190
May 8, 2024 08:42:22.288410902 CEST	2121	52955	34.149.79.8	192.168.2.16
May 8, 2024 08:42:22.288461924 CEST	52955	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:22.288538933 CEST	52955	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:22.288728952 CEST	52987	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:22.292547941 CEST	2121	52956	47.98.196.75	192.168.2.16
May 8, 2024 08:42:22.296040058 CEST	21	52957	47.98.196.75	192.168.2.16
May 8, 2024 08:42:22.296957016 CEST	52620	2121	192.168.2.16	62.140.135.146
May 8, 2024 08:42:22.296992064 CEST	52853	21	192.168.2.16	60.128.250.187
May 8, 2024 08:42:22.297789097 CEST	52988	21	192.168.2.16	142.11.215.85
May 8, 2024 08:42:22.297812939 CEST	52989	21	192.168.2.16	37.16.27.158
May 8, 2024 08:42:22.297837019 CEST	52990	21	192.168.2.16	23.106.228.71
May 8, 2024 08:42:22.301775932 CEST	21	52949	171.5.151.204	192.168.2.16
May 8, 2024 08:42:22.312942982 CEST	52913	2121	192.168.2.16	198.72.168.160
May 8, 2024 08:42:22.313625097 CEST	52991	2121	192.168.2.16	37.16.27.158
May 8, 2024 08:42:22.313750982 CEST	52992	21	192.168.2.16	86.51.153.63
May 8, 2024 08:42:22.314264059 CEST	21	52721	23.229.188.101	192.168.2.16
May 8, 2024 08:42:22.314316988 CEST	52721	21	192.168.2.16	23.229.188.101
May 8, 2024 08:42:22.314464092 CEST	21	52975	23.229.188.101	192.168.2.16
May 8, 2024 08:42:22.314524889 CEST	52975	21	192.168.2.16	23.229.188.101
May 8, 2024 08:42:22.314712048 CEST	21	52721	23.229.188.101	192.168.2.16
May 8, 2024 08:42:22.314749002 CEST	52721	21	192.168.2.16	23.229.188.101
May 8, 2024 08:42:22.321578979 CEST	21	52934	172.120.235.139	192.168.2.16
May 8, 2024 08:42:22.321995020 CEST	21	52934	172.120.235.139	192.168.2.16
May 8, 2024 08:42:22.322114944 CEST	52934	21	192.168.2.16	172.120.235.139
May 8, 2024 08:42:22.328950882 CEST	52823	21	192.168.2.16	79.146.98.25
May 8, 2024 08:42:22.328953028 CEST	52824	2121	192.168.2.16	79.146.98.25
May 8, 2024 08:42:22.329547882 CEST	52993	21	192.168.2.16	160.121.41.198
May 8, 2024 08:42:22.343931913 CEST	52622	21	192.168.2.16	62.140.135.146
May 8, 2024 08:42:22.345930099 CEST	21	52845	46.34.34.117	192.168.2.16
May 8, 2024 08:42:22.345987082 CEST	52845	21	192.168.2.16	46.34.34.117
May 8, 2024 08:42:22.351115942 CEST	21	52960	46.34.34.117	192.168.2.16
May 8, 2024 08:42:22.351180077 CEST	52960	21	192.168.2.16	46.34.34.117
May 8, 2024 08:42:22.359940052 CEST	52855	2121	192.168.2.16	60.128.250.187
May 8, 2024 08:42:22.367863894 CEST	21	52922	84.44.255.254	192.168.2.16
May 8, 2024 08:42:22.371391058 CEST	21	52965	84.44.255.254	192.168.2.16
May 8, 2024 08:42:22.371457100 CEST	52965	21	192.168.2.16	84.44.255.254
May 8, 2024 08:42:22.375946045 CEST	52889	21	192.168.2.16	185.171.100.50
May 8, 2024 08:42:22.376331091 CEST	52994	21	192.168.2.16	206.51.242.132
May 8, 2024 08:42:22.388284922 CEST	21	52877	14.33.230.98	192.168.2.16
May 8, 2024 08:42:22.401282072 CEST	21	52911	171.244.37.116	192.168.2.16
May 8, 2024 08:42:22.401439905 CEST	52911	21	192.168.2.16	171.244.37.116
May 8, 2024 08:42:22.406941891 CEST	52918	21	192.168.2.16	95.88.100.53
May 8, 2024 08:42:22.406960011 CEST	52919	21	192.168.2.16	46.163.151.66
May 8, 2024 08:42:22.406961918 CEST	52917	2121	192.168.2.16	46.163.151.66
May 8, 2024 08:42:22.408196926 CEST	21	52924	38.239.154.176	192.168.2.16
May 8, 2024 08:42:22.408307076 CEST	21	52924	38.239.154.176	192.168.2.16
May 8, 2024 08:42:22.408433914 CEST	52924	21	192.168.2.16	38.239.154.176
May 8, 2024 08:42:22.422943115 CEST	52921	2121	192.168.2.16	95.88.100.53
May 8, 2024 08:42:22.424706936 CEST	2121	52879	14.33.230.98	192.168.2.16
May 8, 2024 08:42:22.431643009 CEST	21	52952	34.149.79.8	192.168.2.16
May 8, 2024 08:42:22.431694031 CEST	21	52983	34.149.79.8	192.168.2.16
May 8, 2024 08:42:22.431761026 CEST	52983	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:22.438940048 CEST	52891	2121	192.168.2.16	185.171.100.50
May 8, 2024 08:42:22.439539909 CEST	52995	2121	192.168.2.16	206.51.242.132
May 8, 2024 08:42:22.451504946 CEST	2121	52987	34.149.79.8	192.168.2.16
May 8, 2024 08:42:22.451531887 CEST	2121	52955	34.149.79.8	192.168.2.16
May 8, 2024 08:42:22.451565981 CEST	52987	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:22.452121019 CEST	21	52743	96.126.118.190	192.168.2.16
May 8, 2024 08:42:22.452255964 CEST	52743	21	192.168.2.16	96.126.118.190
May 8, 2024 08:42:22.457158089 CEST	21	52871	38.239.154.176	192.168.2.16
May 8, 2024 08:42:22.457199097 CEST	52871	21	192.168.2.16	38.239.154.176
May 8, 2024 08:42:22.460448980 CEST	21	52989	37.16.27.158	192.168.2.16
May 8, 2024 08:42:22.460510969 CEST	52989	21	192.168.2.16	37.16.27.158
May 8, 2024 08:42:22.464895964 CEST	21	52985	38.14.189.177	192.168.2.16
May 8, 2024 08:42:22.464948893 CEST	52985	21	192.168.2.16	38.14.189.177
May 8, 2024 08:42:22.470386028 CEST	52996	21	192.168.2.16	69.244.200.119
May 8, 2024 08:42:22.477004051 CEST	2121	52991	37.16.27.158	192.168.2.16
May 8, 2024 08:42:22.477062941 CEST	52991	2121	192.168.2.16	37.16.27.158
May 8, 2024 08:42:22.485948086 CEST	52828	21	192.168.2.16	94.208.246.163
May 8, 2024 08:42:22.486540079 CEST	52997	2121	192.168.2.16	69.244.200.119
May 8, 2024 08:42:22.490684986 CEST	2121	52750	96.126.118.190	192.168.2.16
May 8, 2024 08:42:22.490905046 CEST	52750	2121	192.168.2.16	96.126.118.190
May 8, 2024 08:42:22.491925955 CEST	2121	52805	191.136.203.161	192.168.2.16
May 8, 2024 08:42:22.492278099 CEST	52998	21	192.168.2.16	38.130.169.40
May 8, 2024 08:42:22.506947041 CEST	21	52988	142.11.215.85	192.168.2.16
May 8, 2024 08:42:22.507029057 CEST	52988	21	192.168.2.16	142.11.215.85
May 8, 2024 08:42:22.517086983 CEST	21	52975	23.229.188.101	192.168.2.16
May 8, 2024 08:42:22.517280102 CEST	52975	21	192.168.2.16	23.229.188.101
May 8, 2024 08:42:22.517962933 CEST	52829	2121	192.168.2.16	94.208.246.163
May 8, 2024 08:42:22.522293091 CEST	21	52934	172.120.235.139	192.168.2.16
May 8, 2024 08:42:22.522452116 CEST	52934	21	192.168.2.16	172.120.235.139
May 8, 2024 08:42:22.522701979 CEST	52999	21	192.168.2.16	172.120.235.139
May 8, 2024 08:42:22.538496017 CEST	21	52994	206.51.242.132	192.168.2.16
May 8, 2024 08:42:22.538570881 CEST	52994	21	192.168.2.16	206.51.242.132
May 8, 2024 08:42:22.544651031 CEST	21	52885	196.210.0.111	192.168.2.16
May 8, 2024 08:42:22.549968958 CEST	52925	21	192.168.2.16	90.190.165.47
May 8, 2024 08:42:22.549972057 CEST	52832	2121	192.168.2.16	95.171.194.152
May 8, 2024 08:42:22.549973965 CEST	52831	21	192.168.2.16	95.171.194.152
May 8, 2024 08:42:22.550491095 CEST	21	52726	120.24.160.35	192.168.2.16
May 8, 2024 08:42:22.550636053 CEST	52726	21	192.168.2.16	120.24.160.35
May 8, 2024 08:42:22.550829887 CEST	53000	21	192.168.2.16	120.24.160.35
May 8, 2024 08:42:22.566034079 CEST	52834	21	192.168.2.16	94.6.74.207
May 8, 2024 08:42:22.566104889 CEST	52833	2121	192.168.2.16	94.6.74.207
May 8, 2024 08:42:22.581954002 CEST	52835	21	192.168.2.16	31.181.186.167
May 8, 2024 08:42:22.584433079 CEST	21	52953	51.38.57.28	192.168.2.16
May 8, 2024 08:42:22.584625959 CEST	52953	21	192.168.2.16	51.38.57.28
May 8, 2024 08:42:22.591257095 CEST	21	52990	23.106.228.71	192.168.2.16
May 8, 2024 08:42:22.591327906 CEST	52990	21	192.168.2.16	23.106.228.71
May 8, 2024 08:42:22.594187021 CEST	21	52983	34.149.79.8	192.168.2.16
May 8, 2024 08:42:22.594244957 CEST	52983	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:22.594331026 CEST	52983	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:22.594610929 CEST	53001	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:22.596930981 CEST	52838	2121	192.168.2.16	160.121.41.198
May 8, 2024 08:42:22.596945047 CEST	52839	21	192.168.2.16	78.186.180.252
May 8, 2024 08:42:22.596945047 CEST	52836	2121	192.168.2.16	31.181.186.167
May 8, 2024 08:42:22.597244024 CEST	53002	2121	192.168.2.16	38.130.169.40
May 8, 2024 08:42:22.599912882 CEST	21	52979	197.26.33.147	192.168.2.16
May 8, 2024 08:42:22.599980116 CEST	52979	21	192.168.2.16	197.26.33.147
May 8, 2024 08:42:22.600384951 CEST	21	52853	60.128.250.187	192.168.2.16
May 8, 2024 08:42:22.603301048 CEST	2121	52995	206.51.242.132	192.168.2.16
May 8, 2024 08:42:22.603368998 CEST	52995	2121	192.168.2.16	206.51.242.132
May 8, 2024 08:42:22.609675884 CEST	21	52982	217.76.115.138	192.168.2.16
May 8, 2024 08:42:22.609730959 CEST	52982	21	192.168.2.16	217.76.115.138
May 8, 2024 08:42:22.613286018 CEST	53003	21	192.168.2.16	23.82.68.202
May 8, 2024 08:42:22.613360882 CEST	53004	2121	192.168.2.16	23.82.68.202
May 8, 2024 08:42:22.614028931 CEST	2121	52987	34.149.79.8	192.168.2.16
May 8, 2024 08:42:22.614093065 CEST	52987	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:22.614171028 CEST	52987	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:22.614397049 CEST	53005	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:22.618077993 CEST	21	52984	79.98.26.88	192.168.2.16
May 8, 2024 08:42:22.618143082 CEST	52984	21	192.168.2.16	79.98.26.88
May 8, 2024 08:42:22.622869968 CEST	21	52989	37.16.27.158	192.168.2.16
May 8, 2024 08:42:22.622932911 CEST	52989	21	192.168.2.16	37.16.27.158
May 8, 2024 08:42:22.623007059 CEST	52989	21	192.168.2.16	37.16.27.158
May 8, 2024 08:42:22.623215914 CEST	53006	21	192.168.2.16	37.16.27.158
May 8, 2024 08:42:22.628945112 CEST	52840	2121	192.168.2.16	78.186.180.252
May 8, 2024 08:42:22.629020929 CEST	52841	21	192.168.2.16	73.119.184.97
May 8, 2024 08:42:22.629280090 CEST	53007	21	192.168.2.16	45.115.111.16
May 8, 2024 08:42:22.629463911 CEST	52928	2121	192.168.2.16	90.190.165.47
May 8, 2024 08:42:22.639447927 CEST	2121	52991	37.16.27.158	192.168.2.16
May 8, 2024 08:42:22.639496088 CEST	52991	2121	192.168.2.16	37.16.27.158
May 8, 2024 08:42:22.639565945 CEST	52991	2121	192.168.2.16	37.16.27.158
May 8, 2024 08:42:22.639760017 CEST	53008	2121	192.168.2.16	37.16.27.158
May 8, 2024 08:42:22.644937992 CEST	52842	2121	192.168.2.16	73.119.184.97
May 8, 2024 08:42:22.644939899 CEST	52844	2121	192.168.2.16	52.137.122.207
May 8, 2024 08:42:22.644958019 CEST	52843	21	192.168.2.16	52.137.122.207
May 8, 2024 08:42:22.649092913 CEST	21	52985	38.14.189.177	192.168.2.16
May 8, 2024 08:42:22.649306059 CEST	52985	21	192.168.2.16	38.14.189.177
May 8, 2024 08:42:22.658799887 CEST	21	52743	96.126.118.190	192.168.2.16
May 8, 2024 08:42:22.659773111 CEST	52743	21	192.168.2.16	96.126.118.190
May 8, 2024 08:42:22.659957886 CEST	53010	21	192.168.2.16	96.126.118.190
May 8, 2024 08:42:22.660440922 CEST	2121	52855	60.128.250.187	192.168.2.16
May 8, 2024 08:42:22.660939932 CEST	52846	21	192.168.2.16	36.95.88.230
May 8, 2024 08:42:22.660964966 CEST	52930	21	192.168.2.16	20.81.148.204
May 8, 2024 08:42:22.660981894 CEST	52896	2121	192.168.2.16	109.96.226.101
May 8, 2024 08:42:22.660996914 CEST	52847	2121	192.168.2.16	36.95.88.230
May 8, 2024 08:42:22.660999060 CEST	52848	21	192.168.2.16	24.170.119.218
May 8, 2024 08:42:22.666347980 CEST	21	52993	160.121.41.198	192.168.2.16
May 8, 2024 08:42:22.666418076 CEST	52993	21	192.168.2.16	160.121.41.198
May 8, 2024 08:42:22.677081108 CEST	52850	2121	192.168.2.16	24.170.119.218
May 8, 2024 08:42:22.690567970 CEST	21	52965	84.44.255.254	192.168.2.16
May 8, 2024 08:42:22.690634966 CEST	52965	21	192.168.2.16	84.44.255.254
May 8, 2024 08:42:22.690721035 CEST	52965	21	192.168.2.16	84.44.255.254
May 8, 2024 08:42:22.690985918 CEST	53011	21	192.168.2.16	84.44.255.254
May 8, 2024 08:42:22.692945004 CEST	52932	2121	192.168.2.16	20.81.148.204
May 8, 2024 08:42:22.697312117 CEST	2121	52750	96.126.118.190	192.168.2.16
May 8, 2024 08:42:22.697712898 CEST	52750	2121	192.168.2.16	96.126.118.190
May 8, 2024 08:42:22.697856903 CEST	53013	2121	192.168.2.16	96.126.118.190
May 8, 2024 08:42:22.701180935 CEST	21	52994	206.51.242.132	192.168.2.16
May 8, 2024 08:42:22.701268911 CEST	52994	21	192.168.2.16	206.51.242.132
May 8, 2024 08:42:22.701335907 CEST	52994	21	192.168.2.16	206.51.242.132
May 8, 2024 08:42:22.701373100 CEST	52994	21	192.168.2.16	206.51.242.132
May 8, 2024 08:42:22.701601028 CEST	53014	2121	192.168.2.16	45.115.111.16
May 8, 2024 08:42:22.701728106 CEST	21	52992	86.51.153.63	192.168.2.16
May 8, 2024 08:42:22.701786995 CEST	52992	21	192.168.2.16	86.51.153.63
May 8, 2024 08:42:22.704232931 CEST	21	52934	172.120.235.139	192.168.2.16
May 8, 2024 08:42:22.704284906 CEST	52934	21	192.168.2.16	172.120.235.139
May 8, 2024 08:42:22.704395056 CEST	21	52999	172.120.235.139	192.168.2.16
May 8, 2024 08:42:22.704446077 CEST	21	52960	46.34.34.117	192.168.2.16
May 8, 2024 08:42:22.704451084 CEST	52999	21	192.168.2.16	172.120.235.139
May 8, 2024 08:42:22.704588890 CEST	52960	21	192.168.2.16	46.34.34.117
May 8, 2024 08:42:22.708952904 CEST	52337	2121	192.168.2.16	62.140.135.146
May 8, 2024 08:42:22.709244013 CEST	53015	21	192.168.2.16	76.132.33.233
May 8, 2024 08:42:22.716058969 CEST	21	52988	142.11.215.85	192.168.2.16
May 8, 2024 08:42:22.716248035 CEST	52988	21	192.168.2.16	142.11.215.85
May 8, 2024 08:42:22.718410015 CEST	21	52975	23.229.188.101	192.168.2.16
May 8, 2024 08:42:22.718498945 CEST	21	52975	23.229.188.101	192.168.2.16
May 8, 2024 08:42:22.718610048 CEST	52975	21	192.168.2.16	23.229.188.101
May 8, 2024 08:42:22.722179890 CEST	21	52924	38.239.154.176	192.168.2.16
May 8, 2024 08:42:22.722289085 CEST	52924	21	192.168.2.16	38.239.154.176
May 8, 2024 08:42:22.722446918 CEST	53016	21	192.168.2.16	38.239.154.176
May 8, 2024 08:42:22.722949982 CEST	21	52924	38.239.154.176	192.168.2.16
May 8, 2024 08:42:22.722995043 CEST	52924	21	192.168.2.16	38.239.154.176
May 8, 2024 08:42:22.724958897 CEST	52340	21	192.168.2.16	62.140.135.146
May 8, 2024 08:42:22.725281000 CEST	53017	2121	192.168.2.16	76.132.33.233
May 8, 2024 08:42:22.730940104 CEST	21	52889	185.171.100.50	192.168.2.16
May 8, 2024 08:42:22.739705086 CEST	21	52933	117.223.205.236	192.168.2.16
May 8, 2024 08:42:22.739907026 CEST	52933	21	192.168.2.16	117.223.205.236
May 8, 2024 08:42:22.756690979 CEST	21	52983	34.149.79.8	192.168.2.16
May 8, 2024 08:42:22.757003069 CEST	21	53001	34.149.79.8	192.168.2.16
May 8, 2024 08:42:22.757036924 CEST	52935	21	192.168.2.16	45.243.182.223
May 8, 2024 08:42:22.757070065 CEST	53001	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:22.757482052 CEST	53018	21	192.168.2.16	115.134.175.63
May 8, 2024 08:42:22.757586956 CEST	53019	2121	192.168.2.16	115.134.175.63
May 8, 2024 08:42:22.765902042 CEST	2121	52995	206.51.242.132	192.168.2.16
May 8, 2024 08:42:22.765952110 CEST	52995	2121	192.168.2.16	206.51.242.132
May 8, 2024 08:42:22.766026020 CEST	52995	2121	192.168.2.16	206.51.242.132
May 8, 2024 08:42:22.766063929 CEST	52995	2121	192.168.2.16	206.51.242.132
May 8, 2024 08:42:22.766315937 CEST	53020	21	192.168.2.16	79.9.120.235
May 8, 2024 08:42:22.772926092 CEST	52939	21	192.168.2.16	77.34.229.59
May 8, 2024 08:42:22.772950888 CEST	52937	21	192.168.2.16	178.70.228.49
May 8, 2024 08:42:22.772964001 CEST	52936	2121	192.168.2.16	45.243.182.223
May 8, 2024 08:42:22.773312092 CEST	21	52911	171.244.37.116	192.168.2.16
May 8, 2024 08:42:22.773361921 CEST	53021	2121	192.168.2.16	79.9.120.235
May 8, 2024 08:42:22.773406029 CEST	53022	21	192.168.2.16	61.169.64.197
May 8, 2024 08:42:22.773463011 CEST	52911	21	192.168.2.16	171.244.37.116
May 8, 2024 08:42:22.773674965 CEST	53023	21	192.168.2.16	171.244.37.116
May 8, 2024 08:42:22.776465893 CEST	2121	52987	34.149.79.8	192.168.2.16
May 8, 2024 08:42:22.776822090 CEST	2121	53005	34.149.79.8	192.168.2.16
May 8, 2024 08:42:22.776882887 CEST	53005	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:22.779689074 CEST	21	52919	46.163.151.66	192.168.2.16
May 8, 2024 08:42:22.779740095 CEST	2121	52917	46.163.151.66	192.168.2.16
May 8, 2024 08:42:22.785195112 CEST	21	52989	37.16.27.158	192.168.2.16
May 8, 2024 08:42:22.785399914 CEST	21	53006	37.16.27.158	192.168.2.16
May 8, 2024 08:42:22.785470963 CEST	53006	21	192.168.2.16	37.16.27.158
May 8, 2024 08:42:22.788925886 CEST	52938	2121	192.168.2.16	178.70.228.49
May 8, 2024 08:42:22.789567947 CEST	52940	2121	192.168.2.16	77.34.229.59
May 8, 2024 08:42:22.789567947 CEST	52941	21	192.168.2.16	98.216.74.51
May 8, 2024 08:42:22.801716089 CEST	2121	52991	37.16.27.158	192.168.2.16
May 8, 2024 08:42:22.801906109 CEST	2121	53008	37.16.27.158	192.168.2.16
May 8, 2024 08:42:22.801968098 CEST	53008	2121	192.168.2.16	37.16.27.158
May 8, 2024 08:42:22.804037094 CEST	2121	52891	185.171.100.50	192.168.2.16
May 8, 2024 08:42:22.804928064 CEST	52949	21	192.168.2.16	171.5.151.204
May 8, 2024 08:42:22.804936886 CEST	52956	2121	192.168.2.16	47.98.196.75
May 8, 2024 08:42:22.805582047 CEST	52957	21	192.168.2.16	47.98.196.75
May 8, 2024 08:42:22.820972919 CEST	52942	2121	192.168.2.16	98.216.74.51
May 8, 2024 08:42:22.831715107 CEST	21	52985	38.14.189.177	192.168.2.16
May 8, 2024 08:42:22.831837893 CEST	21	52985	38.14.189.177	192.168.2.16
May 8, 2024 08:42:22.847559929 CEST	52985	21	192.168.2.16	38.14.189.177
May 8, 2024 08:42:22.864753008 CEST	21	52994	206.51.242.132	192.168.2.16
May 8, 2024 08:42:22.865971088 CEST	21	53010	96.126.118.190	192.168.2.16
May 8, 2024 08:42:22.866061926 CEST	53010	21	192.168.2.16	96.126.118.190
May 8, 2024 08:42:22.867929935 CEST	52944	21	192.168.2.16	193.115.118.112
May 8, 2024 08:42:22.868271112 CEST	53024	2121	192.168.2.16	61.169.64.197
May 8, 2024 08:42:22.883943081 CEST	52946	2121	192.168.2.16	193.115.118.112
May 8, 2024 08:42:22.884529114 CEST	53025	21	192.168.2.16	120.224.128.120
May 8, 2024 08:42:22.884577990 CEST	21	52990	23.106.228.71	192.168.2.16
May 8, 2024 08:42:22.884742022 CEST	52990	21	192.168.2.16	23.106.228.71
May 8, 2024 08:42:22.892807007 CEST	21	52726	120.24.160.35	192.168.2.16
May 8, 2024 08:42:22.892864943 CEST	52726	21	192.168.2.16	120.24.160.35
May 8, 2024 08:42:22.892944098 CEST	21	53000	120.24.160.35	192.168.2.16
May 8, 2024 08:42:22.893007040 CEST	53000	21	192.168.2.16	120.24.160.35
May 8, 2024 08:42:22.893202066 CEST	21	52726	120.24.160.35	192.168.2.16
May 8, 2024 08:42:22.893244982 CEST	52726	21	192.168.2.16	120.24.160.35
May 8, 2024 08:42:22.899945021 CEST	52877	21	192.168.2.16	14.33.230.98
May 8, 2024 08:42:22.903420925 CEST	21	52953	51.38.57.28	192.168.2.16
May 8, 2024 08:42:22.903435946 CEST	21	52953	51.38.57.28	192.168.2.16
May 8, 2024 08:42:22.903548956 CEST	52953	21	192.168.2.16	51.38.57.28
May 8, 2024 08:42:22.903824091 CEST	2121	53013	96.126.118.190	192.168.2.16
May 8, 2024 08:42:22.903882027 CEST	53013	2121	192.168.2.16	96.126.118.190
May 8, 2024 08:42:22.907773972 CEST	21	52743	96.126.118.190	192.168.2.16
May 8, 2024 08:42:22.915941000 CEST	52947	21	192.168.2.16	73.244.194.242
May 8, 2024 08:42:22.922482014 CEST	21	53001	34.149.79.8	192.168.2.16
May 8, 2024 08:42:22.922545910 CEST	53001	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:22.922594070 CEST	53001	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:22.922637939 CEST	21	52999	172.120.235.139	192.168.2.16
May 8, 2024 08:42:22.922770023 CEST	52999	21	192.168.2.16	172.120.235.139
May 8, 2024 08:42:22.922843933 CEST	53026	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:22.925065041 CEST	21	52988	142.11.215.85	192.168.2.16
May 8, 2024 08:42:22.925199032 CEST	52988	21	192.168.2.16	142.11.215.85
May 8, 2024 08:42:22.925920010 CEST	52948	2121	192.168.2.16	73.244.194.242
May 8, 2024 08:42:22.928205967 CEST	2121	52995	206.51.242.132	192.168.2.16
May 8, 2024 08:42:22.930917025 CEST	52879	2121	192.168.2.16	14.33.230.98
May 8, 2024 08:42:22.931128025 CEST	53027	2121	192.168.2.16	120.224.128.120
May 8, 2024 08:42:22.939316988 CEST	2121	53005	34.149.79.8	192.168.2.16
May 8, 2024 08:42:22.939368963 CEST	53005	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:22.939444065 CEST	53005	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:22.939671040 CEST	53028	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:22.944411993 CEST	2121	52750	96.126.118.190	192.168.2.16
May 8, 2024 08:42:22.946943045 CEST	52950	2121	192.168.2.16	171.5.151.204
May 8, 2024 08:42:22.946962118 CEST	52856	21	192.168.2.16	80.48.205.205
May 8, 2024 08:42:22.946968079 CEST	52951	21	192.168.2.16	112.145.29.138
May 8, 2024 08:42:22.947138071 CEST	53029	21	192.168.2.16	154.95.173.67
May 8, 2024 08:42:22.947829008 CEST	21	53006	37.16.27.158	192.168.2.16
May 8, 2024 08:42:22.947904110 CEST	53006	21	192.168.2.16	37.16.27.158
May 8, 2024 08:42:22.947952986 CEST	53006	21	192.168.2.16	37.16.27.158
May 8, 2024 08:42:22.948090076 CEST	53030	21	192.168.2.16	37.16.27.158
May 8, 2024 08:42:22.952461004 CEST	21	52982	217.76.115.138	192.168.2.16
May 8, 2024 08:42:22.952641964 CEST	52982	21	192.168.2.16	217.76.115.138
May 8, 2024 08:42:22.955096960 CEST	21	52984	79.98.26.88	192.168.2.16
May 8, 2024 08:42:22.955260038 CEST	52984	21	192.168.2.16	79.98.26.88
May 8, 2024 08:42:22.961278915 CEST	21	52975	23.229.188.101	192.168.2.16
May 8, 2024 08:42:22.962940931 CEST	52954	2121	192.168.2.16	112.145.29.138
May 8, 2024 08:42:22.964325905 CEST	2121	53008	37.16.27.158	192.168.2.16
May 8, 2024 08:42:22.964411974 CEST	53008	2121	192.168.2.16	37.16.27.158
May 8, 2024 08:42:22.964476109 CEST	53008	2121	192.168.2.16	37.16.27.158
May 8, 2024 08:42:22.964795113 CEST	53031	2121	192.168.2.16	37.16.27.158
May 8, 2024 08:42:22.994957924 CEST	52958	21	192.168.2.16	72.94.54.194
May 8, 2024 08:42:23.003679991 CEST	21	52979	197.26.33.147	192.168.2.16
May 8, 2024 08:42:23.003743887 CEST	52979	21	192.168.2.16	197.26.33.147
May 8, 2024 08:42:23.003813982 CEST	52979	21	192.168.2.16	197.26.33.147
May 8, 2024 08:42:23.004019976 CEST	53032	21	192.168.2.16	197.26.33.147
May 8, 2024 08:42:23.004875898 CEST	21	52993	160.121.41.198	192.168.2.16
May 8, 2024 08:42:23.005124092 CEST	52993	21	192.168.2.16	160.121.41.198
May 8, 2024 08:42:23.006920099 CEST	21	53011	84.44.255.254	192.168.2.16
May 8, 2024 08:42:23.006989956 CEST	53011	21	192.168.2.16	84.44.255.254
May 8, 2024 08:42:23.009759903 CEST	21	52965	84.44.255.254	192.168.2.16
May 8, 2024 08:42:23.010922909 CEST	52959	2121	192.168.2.16	72.94.54.194
May 8, 2024 08:42:23.023888111 CEST	21	53016	38.239.154.176	192.168.2.16
May 8, 2024 08:42:23.023962021 CEST	53016	21	192.168.2.16	38.239.154.176
May 8, 2024 08:42:23.024092913 CEST	21	52924	38.239.154.176	192.168.2.16
May 8, 2024 08:42:23.026226044 CEST	2121	52896	109.96.226.101	192.168.2.16
May 8, 2024 08:42:23.026942015 CEST	52961	21	192.168.2.16	62.74.64.79
May 8, 2024 08:42:23.040157080 CEST	21	52985	38.14.189.177	192.168.2.16
May 8, 2024 08:42:23.040297985 CEST	52985	21	192.168.2.16	38.14.189.177
May 8, 2024 08:42:23.040477037 CEST	53033	21	192.168.2.16	38.14.189.177
May 8, 2024 08:42:23.040941000 CEST	21	52985	38.14.189.177	192.168.2.16
May 8, 2024 08:42:23.040986061 CEST	52985	21	192.168.2.16	38.14.189.177
May 8, 2024 08:42:23.041928053 CEST	52962	2121	192.168.2.16	62.74.64.79
May 8, 2024 08:42:23.047939062 CEST	21	52960	46.34.34.117	192.168.2.16
May 8, 2024 08:42:23.048928976 CEST	21	52960	46.34.34.117	192.168.2.16
May 8, 2024 08:42:23.049097061 CEST	52960	21	192.168.2.16	46.34.34.117
May 8, 2024 08:42:23.057919025 CEST	52859	2121	192.168.2.16	80.48.205.205
May 8, 2024 08:42:23.058048010 CEST	52964	21	192.168.2.16	64.233.171.82
May 8, 2024 08:42:23.073924065 CEST	52966	2121	192.168.2.16	64.233.171.82
May 8, 2024 08:42:23.073925018 CEST	52967	21	192.168.2.16	95.108.21.236
May 8, 2024 08:42:23.073935986 CEST	52860	21	192.168.2.16	24.164.151.97
May 8, 2024 08:42:23.083923101 CEST	52862	2121	192.168.2.16	24.164.151.97
May 8, 2024 08:42:23.085083008 CEST	21	53001	34.149.79.8	192.168.2.16
May 8, 2024 08:42:23.085202932 CEST	21	53026	34.149.79.8	192.168.2.16
May 8, 2024 08:42:23.085266113 CEST	53026	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:23.089937925 CEST	52861	21	192.168.2.16	223.206.58.167
May 8, 2024 08:42:23.089941978 CEST	52968	21	192.168.2.16	14.199.15.208
May 8, 2024 08:42:23.089982986 CEST	52969	2121	192.168.2.16	95.108.21.236
May 8, 2024 08:42:23.101784945 CEST	2121	53005	34.149.79.8	192.168.2.16
May 8, 2024 08:42:23.101798058 CEST	2121	53028	34.149.79.8	192.168.2.16
May 8, 2024 08:42:23.101866007 CEST	53028	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:23.103072882 CEST	21	52992	86.51.153.63	192.168.2.16
May 8, 2024 08:42:23.103256941 CEST	52992	21	192.168.2.16	86.51.153.63
May 8, 2024 08:42:23.104468107 CEST	21	52999	172.120.235.139	192.168.2.16
May 8, 2024 08:42:23.104918003 CEST	21	52999	172.120.235.139	192.168.2.16
May 8, 2024 08:42:23.105026960 CEST	52999	21	192.168.2.16	172.120.235.139
May 8, 2024 08:42:23.105933905 CEST	52972	21	192.168.2.16	81.40.86.11
May 8, 2024 08:42:23.105935097 CEST	52971	2121	192.168.2.16	14.199.15.208
May 8, 2024 08:42:23.106054068 CEST	52973	2121	192.168.2.16	81.40.86.11
May 8, 2024 08:42:23.106055975 CEST	52853	21	192.168.2.16	60.128.250.187
May 8, 2024 08:42:23.106056929 CEST	52974	21	192.168.2.16	66.152.152.78
May 8, 2024 08:42:23.110131025 CEST	21	53006	37.16.27.158	192.168.2.16
May 8, 2024 08:42:23.110311985 CEST	21	53030	37.16.27.158	192.168.2.16
May 8, 2024 08:42:23.110367060 CEST	53030	21	192.168.2.16	37.16.27.158
May 8, 2024 08:42:23.120949030 CEST	52863	2121	192.168.2.16	223.206.58.167
May 8, 2024 08:42:23.121053934 CEST	2121	52956	47.98.196.75	192.168.2.16
May 8, 2024 08:42:23.121628046 CEST	21	52957	47.98.196.75	192.168.2.16
May 8, 2024 08:42:23.121704102 CEST	53034	2121	192.168.2.16	154.95.173.67
May 8, 2024 08:42:23.121767998 CEST	53035	21	192.168.2.16	24.173.68.198
May 8, 2024 08:42:23.124768019 CEST	21	53023	171.244.37.116	192.168.2.16
May 8, 2024 08:42:23.124829054 CEST	53023	21	192.168.2.16	171.244.37.116
May 8, 2024 08:42:23.126610994 CEST	2121	53008	37.16.27.158	192.168.2.16
May 8, 2024 08:42:23.127024889 CEST	2121	53031	37.16.27.158	192.168.2.16
May 8, 2024 08:42:23.127079010 CEST	53031	2121	192.168.2.16	37.16.27.158
May 8, 2024 08:42:23.135540962 CEST	21	52988	142.11.215.85	192.168.2.16
May 8, 2024 08:42:23.135677099 CEST	52988	21	192.168.2.16	142.11.215.85
May 8, 2024 08:42:23.135899067 CEST	53036	21	192.168.2.16	142.11.215.85
May 8, 2024 08:42:23.136312008 CEST	53037	2121	192.168.2.16	24.173.68.198
May 8, 2024 08:42:23.142299891 CEST	21	52911	171.244.37.116	192.168.2.16
May 8, 2024 08:42:23.142410994 CEST	21	52911	171.244.37.116	192.168.2.16
May 8, 2024 08:42:23.142455101 CEST	52911	21	192.168.2.16	171.244.37.116
May 8, 2024 08:42:23.151922941 CEST	52976	2121	192.168.2.16	66.152.152.78
May 8, 2024 08:42:23.152622938 CEST	53038	21	192.168.2.16	187.172.30.152
May 8, 2024 08:42:23.152690887 CEST	53039	2121	192.168.2.16	187.172.30.152
May 8, 2024 08:42:23.152729034 CEST	53040	21	192.168.2.16	5.251.87.3
May 8, 2024 08:42:23.152822018 CEST	53041	2121	192.168.2.16	5.251.87.3
May 8, 2024 08:42:23.167953014 CEST	52977	21	192.168.2.16	102.39.31.115
May 8, 2024 08:42:23.168021917 CEST	52855	2121	192.168.2.16	60.128.250.187
May 8, 2024 08:42:23.177512884 CEST	21	52990	23.106.228.71	192.168.2.16
May 8, 2024 08:42:23.177799940 CEST	21	52990	23.106.228.71	192.168.2.16
May 8, 2024 08:42:23.178004980 CEST	52990	21	192.168.2.16	23.106.228.71
May 8, 2024 08:42:23.183933973 CEST	52866	21	192.168.2.16	76.125.250.125
May 8, 2024 08:42:23.185003042 CEST	53042	21	192.168.2.16	80.139.29.120
May 8, 2024 08:42:23.185137033 CEST	53044	2121	192.168.2.16	80.139.29.120
May 8, 2024 08:42:23.185138941 CEST	53043	21	192.168.2.16	31.14.133.36
May 8, 2024 08:42:23.185230017 CEST	53045	2121	192.168.2.16	31.14.133.36
May 8, 2024 08:42:23.190040112 CEST	21	52949	171.5.151.204	192.168.2.16
May 8, 2024 08:42:23.199948072 CEST	52978	2121	192.168.2.16	102.39.31.115
May 8, 2024 08:42:23.201071978 CEST	53046	21	192.168.2.16	218.55.173.142
May 8, 2024 08:42:23.201167107 CEST	53048	21	192.168.2.16	130.93.138.36
May 8, 2024 08:42:23.201217890 CEST	53047	2121	192.168.2.16	218.55.173.142
May 8, 2024 08:42:23.201311111 CEST	53049	2121	192.168.2.16	130.93.138.36
May 8, 2024 08:42:23.210035086 CEST	21	52933	117.223.205.236	192.168.2.16
May 8, 2024 08:42:23.213502884 CEST	21	52877	14.33.230.98	192.168.2.16
May 8, 2024 08:42:23.222712040 CEST	21	52985	38.14.189.177	192.168.2.16
May 8, 2024 08:42:23.222877026 CEST	21	53033	38.14.189.177	192.168.2.16
May 8, 2024 08:42:23.222961903 CEST	53033	21	192.168.2.16	38.14.189.177
May 8, 2024 08:42:23.226912975 CEST	21	52933	117.223.205.236	192.168.2.16
May 8, 2024 08:42:23.227133036 CEST	52933	21	192.168.2.16	117.223.205.236
May 8, 2024 08:42:23.231944084 CEST	52889	21	192.168.2.16	185.171.100.50
May 8, 2024 08:42:23.232394934 CEST	53050	21	192.168.2.16	95.70.121.39
May 8, 2024 08:42:23.236057997 CEST	21	53000	120.24.160.35	192.168.2.16
May 8, 2024 08:42:23.236244917 CEST	53000	21	192.168.2.16	120.24.160.35
May 8, 2024 08:42:23.247684956 CEST	2121	52879	14.33.230.98	192.168.2.16
May 8, 2024 08:42:23.247700930 CEST	21	53026	34.149.79.8	192.168.2.16
May 8, 2024 08:42:23.247756004 CEST	53026	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:23.247818947 CEST	53026	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:23.247932911 CEST	52980	21	192.168.2.16	91.146.97.65
May 8, 2024 08:42:23.248159885 CEST	52867	21	192.168.2.16	222.219.165.140
May 8, 2024 08:42:23.248164892 CEST	52868	2121	192.168.2.16	76.125.250.125
May 8, 2024 08:42:23.248303890 CEST	53051	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:23.248591900 CEST	53052	2121	192.168.2.16	95.70.121.39
May 8, 2024 08:42:23.248706102 CEST	53053	2121	192.168.2.16	12.247.61.30
May 8, 2024 08:42:23.248708010 CEST	53054	21	192.168.2.16	12.247.61.30
May 8, 2024 08:42:23.261318922 CEST	21	52953	51.38.57.28	192.168.2.16
May 8, 2024 08:42:23.264142990 CEST	53055	21	192.168.2.16	98.19.172.225
May 8, 2024 08:42:23.264236927 CEST	2121	53028	34.149.79.8	192.168.2.16
May 8, 2024 08:42:23.264287949 CEST	53028	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:23.264367104 CEST	53028	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:23.264561892 CEST	53056	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:23.269332886 CEST	21	53029	154.95.173.67	192.168.2.16
May 8, 2024 08:42:23.269396067 CEST	53029	21	192.168.2.16	154.95.173.67
May 8, 2024 08:42:23.273046970 CEST	21	53030	37.16.27.158	192.168.2.16
May 8, 2024 08:42:23.274398088 CEST	53030	21	192.168.2.16	37.16.27.158
May 8, 2024 08:42:23.274472952 CEST	53030	21	192.168.2.16	37.16.27.158
May 8, 2024 08:42:23.274682045 CEST	53057	21	192.168.2.16	37.16.27.158
May 8, 2024 08:42:23.279937983 CEST	52869	2121	192.168.2.16	222.219.165.140
May 8, 2024 08:42:23.282344103 CEST	21	53022	61.169.64.197	192.168.2.16
May 8, 2024 08:42:23.289470911 CEST	2121	53031	37.16.27.158	192.168.2.16
May 8, 2024 08:42:23.290060043 CEST	53031	2121	192.168.2.16	37.16.27.158
May 8, 2024 08:42:23.290112019 CEST	53031	2121	192.168.2.16	37.16.27.158
May 8, 2024 08:42:23.290266037 CEST	53058	2121	192.168.2.16	37.16.27.158
May 8, 2024 08:42:23.290896893 CEST	21	52984	79.98.26.88	192.168.2.16
May 8, 2024 08:42:23.291028023 CEST	21	52984	79.98.26.88	192.168.2.16
May 8, 2024 08:42:23.291172981 CEST	52984	21	192.168.2.16	79.98.26.88
May 8, 2024 08:42:23.293744087 CEST	21	52982	217.76.115.138	192.168.2.16
May 8, 2024 08:42:23.293896914 CEST	21	52982	217.76.115.138	192.168.2.16
May 8, 2024 08:42:23.294024944 CEST	52982	21	192.168.2.16	217.76.115.138
May 8, 2024 08:42:23.295929909 CEST	52870	21	192.168.2.16	96.255.189.170
May 8, 2024 08:42:23.306102991 CEST	21	52999	172.120.235.139	192.168.2.16
May 8, 2024 08:42:23.306577921 CEST	52999	21	192.168.2.16	172.120.235.139
May 8, 2024 08:42:23.306740046 CEST	53059	21	192.168.2.16	172.120.235.139
May 8, 2024 08:42:23.310400009 CEST	2121	53024	61.169.64.197	192.168.2.16
May 8, 2024 08:42:23.311918974 CEST	52891	2121	192.168.2.16	185.171.100.50
May 8, 2024 08:42:23.322995901 CEST	21	53011	84.44.255.254	192.168.2.16
May 8, 2024 08:42:23.323551893 CEST	53011	21	192.168.2.16	84.44.255.254
May 8, 2024 08:42:23.323618889 CEST	53011	21	192.168.2.16	84.44.255.254
May 8, 2024 08:42:23.323803902 CEST	53060	21	192.168.2.16	84.44.255.254
May 8, 2024 08:42:23.325750113 CEST	21	53016	38.239.154.176	192.168.2.16
May 8, 2024 08:42:23.325896025 CEST	53016	21	192.168.2.16	38.239.154.176
May 8, 2024 08:42:23.328203917 CEST	53061	2121	192.168.2.16	98.19.172.225
May 8, 2024 08:42:23.329950094 CEST	21	53025	120.224.128.120	192.168.2.16
May 8, 2024 08:42:23.334427118 CEST	21	51910	96.126.118.190	192.168.2.16
May 8, 2024 08:42:23.334489107 CEST	2121	51914	96.126.118.190	192.168.2.16
May 8, 2024 08:42:23.334537029 CEST	51910	21	192.168.2.16	96.126.118.190
May 8, 2024 08:42:23.335943937 CEST	51914	2121	192.168.2.16	96.126.118.190
May 8, 2024 08:42:23.341864109 CEST	21	52993	160.121.41.198	192.168.2.16
May 8, 2024 08:42:23.341948032 CEST	21	52993	160.121.41.198	192.168.2.16
May 8, 2024 08:42:23.342147112 CEST	52993	21	192.168.2.16	160.121.41.198
May 8, 2024 08:42:23.343943119 CEST	52873	2121	192.168.2.16	96.255.189.170
May 8, 2024 08:42:23.344434023 CEST	21	52988	142.11.215.85	192.168.2.16
May 8, 2024 08:42:23.344609022 CEST	21	53036	142.11.215.85	192.168.2.16
May 8, 2024 08:42:23.344674110 CEST	53036	21	192.168.2.16	142.11.215.85
May 8, 2024 08:42:23.344902992 CEST	21	52988	142.11.215.85	192.168.2.16
May 8, 2024 08:42:23.345127106 CEST	52988	21	192.168.2.16	142.11.215.85
May 8, 2024 08:42:23.358922005 CEST	52878	21	192.168.2.16	38.207.205.17
May 8, 2024 08:42:23.358922005 CEST	52875	21	192.168.2.16	73.49.216.251
May 8, 2024 08:42:23.386086941 CEST	21	53032	197.26.33.147	192.168.2.16
May 8, 2024 08:42:23.386145115 CEST	21	52979	197.26.33.147	192.168.2.16
May 8, 2024 08:42:23.386153936 CEST	53032	21	192.168.2.16	197.26.33.147
May 8, 2024 08:42:23.390921116 CEST	52876	2121	192.168.2.16	73.49.216.251
May 8, 2024 08:42:23.406940937 CEST	51144	21	192.168.2.16	62.140.135.146
May 8, 2024 08:42:23.406943083 CEST	51145	2121	192.168.2.16	62.140.135.146
May 8, 2024 08:42:23.406994104 CEST	21	53033	38.14.189.177	192.168.2.16
May 8, 2024 08:42:23.407130003 CEST	21	52853	60.128.250.187	192.168.2.16
May 8, 2024 08:42:23.407320976 CEST	53033	21	192.168.2.16	38.14.189.177
May 8, 2024 08:42:23.407702923 CEST	53062	21	192.168.2.16	88.92.121.224
May 8, 2024 08:42:23.410162926 CEST	21	53026	34.149.79.8	192.168.2.16
May 8, 2024 08:42:23.410706997 CEST	21	53051	34.149.79.8	192.168.2.16
May 8, 2024 08:42:23.410772085 CEST	53051	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:23.423304081 CEST	53063	2121	192.168.2.16	88.92.121.224
May 8, 2024 08:42:23.423952103 CEST	21	52960	46.34.34.117	192.168.2.16
May 8, 2024 08:42:23.426440954 CEST	2121	53028	34.149.79.8	192.168.2.16
May 8, 2024 08:42:23.426776886 CEST	2121	53056	34.149.79.8	192.168.2.16
May 8, 2024 08:42:23.426842928 CEST	53056	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:23.436697960 CEST	21	53030	37.16.27.158	192.168.2.16
May 8, 2024 08:42:23.436844110 CEST	21	53057	37.16.27.158	192.168.2.16
May 8, 2024 08:42:23.436925888 CEST	53057	21	192.168.2.16	37.16.27.158
May 8, 2024 08:42:23.438914061 CEST	21	53054	12.247.61.30	192.168.2.16
May 8, 2024 08:42:23.439222097 CEST	53064	21	192.168.2.16	83.232.10.191
May 8, 2024 08:42:23.442773104 CEST	2121	53053	12.247.61.30	192.168.2.16
May 8, 2024 08:42:23.452507973 CEST	2121	53058	37.16.27.158	192.168.2.16
May 8, 2024 08:42:23.452578068 CEST	53058	2121	192.168.2.16	37.16.27.158
May 8, 2024 08:42:23.468280077 CEST	2121	52855	60.128.250.187	192.168.2.16
May 8, 2024 08:42:23.468673944 CEST	53065	2121	192.168.2.16	83.232.10.191
May 8, 2024 08:42:23.470918894 CEST	52996	21	192.168.2.16	69.244.200.119
May 8, 2024 08:42:23.470963955 CEST	52880	2121	192.168.2.16	38.207.205.17
May 8, 2024 08:42:23.470963001 CEST	52881	21	192.168.2.16	50.109.87.151
May 8, 2024 08:42:23.471379995 CEST	53066	2121	192.168.2.16	174.177.40.166
May 8, 2024 08:42:23.471479893 CEST	53067	21	192.168.2.16	174.177.40.166
May 8, 2024 08:42:23.476094007 CEST	21	53023	171.244.37.116	192.168.2.16
May 8, 2024 08:42:23.476219893 CEST	53023	21	192.168.2.16	171.244.37.116
May 8, 2024 08:42:23.486952066 CEST	52997	2121	192.168.2.16	69.244.200.119
May 8, 2024 08:42:23.487503052 CEST	53068	21	192.168.2.16	208.125.86.206
May 8, 2024 08:42:23.488503933 CEST	21	53059	172.120.235.139	192.168.2.16
May 8, 2024 08:42:23.488518953 CEST	21	52999	172.120.235.139	192.168.2.16
May 8, 2024 08:42:23.488590002 CEST	52999	21	192.168.2.16	172.120.235.139
May 8, 2024 08:42:23.488600016 CEST	53059	21	192.168.2.16	172.120.235.139
May 8, 2024 08:42:23.490143061 CEST	21	52992	86.51.153.63	192.168.2.16
May 8, 2024 08:42:23.491688013 CEST	21	52992	86.51.153.63	192.168.2.16
May 8, 2024 08:42:23.491846085 CEST	52992	21	192.168.2.16	86.51.153.63
May 8, 2024 08:42:23.502918005 CEST	52998	21	192.168.2.16	38.130.169.40
May 8, 2024 08:42:23.509063005 CEST	21	52885	196.210.0.111	192.168.2.16
May 8, 2024 08:42:23.509210110 CEST	52885	21	192.168.2.16	196.210.0.111
May 8, 2024 08:42:23.509391069 CEST	53069	21	192.168.2.16	196.210.0.111
May 8, 2024 08:42:23.511116982 CEST	21	52990	23.106.228.71	192.168.2.16
May 8, 2024 08:42:23.519387007 CEST	53070	2121	192.168.2.16	208.125.86.206
May 8, 2024 08:42:23.532927990 CEST	2121	53049	130.93.138.36	192.168.2.16
May 8, 2024 08:42:23.534006119 CEST	21	53048	130.93.138.36	192.168.2.16
May 8, 2024 08:42:23.534950972 CEST	52882	2121	192.168.2.16	50.109.87.151
May 8, 2024 08:42:23.535095930 CEST	52896	2121	192.168.2.16	109.96.226.101
May 8, 2024 08:42:23.550939083 CEST	52883	21	192.168.2.16	95.54.247.224
May 8, 2024 08:42:23.551345110 CEST	53071	21	192.168.2.16	172.166.82.81
May 8, 2024 08:42:23.553669930 CEST	21	53036	142.11.215.85	192.168.2.16
May 8, 2024 08:42:23.553924084 CEST	53036	21	192.168.2.16	142.11.215.85
May 8, 2024 08:42:23.566926956 CEST	52884	2121	192.168.2.16	95.54.247.224
May 8, 2024 08:42:23.567507982 CEST	53072	2121	192.168.2.16	69.207.62.104
May 8, 2024 08:42:23.567569017 CEST	53074	21	192.168.2.16	69.207.62.104
May 8, 2024 08:42:23.567573071 CEST	53073	2121	192.168.2.16	172.166.82.81
May 8, 2024 08:42:23.575090885 CEST	21	53051	34.149.79.8	192.168.2.16
May 8, 2024 08:42:23.575166941 CEST	53051	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:23.575215101 CEST	53051	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:23.575361013 CEST	53075	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:23.580317020 CEST	21	53000	120.24.160.35	192.168.2.16
May 8, 2024 08:42:23.580495119 CEST	21	53000	120.24.160.35	192.168.2.16
May 8, 2024 08:42:23.580698967 CEST	53000	21	192.168.2.16	120.24.160.35
May 8, 2024 08:42:23.583177090 CEST	53076	21	192.168.2.16	52.140.47.113
May 8, 2024 08:42:23.588716030 CEST	21	52889	185.171.100.50	192.168.2.16
May 8, 2024 08:42:23.591178894 CEST	2121	53056	34.149.79.8	192.168.2.16
May 8, 2024 08:42:23.591223001 CEST	53056	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:23.591316938 CEST	53056	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:23.591320038 CEST	21	53033	38.14.189.177	192.168.2.16
May 8, 2024 08:42:23.591478109 CEST	21	53033	38.14.189.177	192.168.2.16
May 8, 2024 08:42:23.591573954 CEST	53077	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:23.591681957 CEST	53033	21	192.168.2.16	38.14.189.177
May 8, 2024 08:42:23.594857931 CEST	21	53029	154.95.173.67	192.168.2.16
May 8, 2024 08:42:23.594961882 CEST	53029	21	192.168.2.16	154.95.173.67
May 8, 2024 08:42:23.595128059 CEST	53078	2121	192.168.2.16	52.140.47.113
May 8, 2024 08:42:23.598927975 CEST	53002	2121	192.168.2.16	38.130.169.40
May 8, 2024 08:42:23.599472046 CEST	53079	21	192.168.2.16	112.113.132.170
May 8, 2024 08:42:23.599519014 CEST	53080	21	192.168.2.16	59.8.252.60
May 8, 2024 08:42:23.599596977 CEST	53081	2121	192.168.2.16	112.113.132.170
May 8, 2024 08:42:23.601056099 CEST	21	53057	37.16.27.158	192.168.2.16
May 8, 2024 08:42:23.601114035 CEST	53057	21	192.168.2.16	37.16.27.158
May 8, 2024 08:42:23.601180077 CEST	53057	21	192.168.2.16	37.16.27.158
May 8, 2024 08:42:23.601331949 CEST	53082	21	192.168.2.16	37.16.27.158
May 8, 2024 08:42:23.603035927 CEST	21	53055	98.19.172.225	192.168.2.16
May 8, 2024 08:42:23.604439974 CEST	2121	53061	98.19.172.225	192.168.2.16
May 8, 2024 08:42:23.614948988 CEST	53003	21	192.168.2.16	23.82.68.202
May 8, 2024 08:42:23.614963055 CEST	53004	2121	192.168.2.16	23.82.68.202
May 8, 2024 08:42:23.615447044 CEST	53083	21	192.168.2.16	2.83.144.253
May 8, 2024 08:42:23.615505934 CEST	53084	2121	192.168.2.16	59.8.252.60
May 8, 2024 08:42:23.617311954 CEST	2121	53058	37.16.27.158	192.168.2.16
May 8, 2024 08:42:23.617501020 CEST	53058	2121	192.168.2.16	37.16.27.158
May 8, 2024 08:42:23.617553949 CEST	53058	2121	192.168.2.16	37.16.27.158
May 8, 2024 08:42:23.617707014 CEST	53085	2121	192.168.2.16	37.16.27.158
May 8, 2024 08:42:23.628273964 CEST	21	53016	38.239.154.176	192.168.2.16
May 8, 2024 08:42:23.628287077 CEST	21	53016	38.239.154.176	192.168.2.16
May 8, 2024 08:42:23.628411055 CEST	53016	21	192.168.2.16	38.239.154.176
May 8, 2024 08:42:23.630944967 CEST	52886	21	192.168.2.16	100.2.146.222
May 8, 2024 08:42:23.630948067 CEST	52956	2121	192.168.2.16	47.98.196.75
May 8, 2024 08:42:23.630944967 CEST	53007	21	192.168.2.16	45.115.111.16
May 8, 2024 08:42:23.630951881 CEST	52957	21	192.168.2.16	47.98.196.75
May 8, 2024 08:42:23.639481068 CEST	21	53011	84.44.255.254	192.168.2.16
May 8, 2024 08:42:23.643240929 CEST	21	53060	84.44.255.254	192.168.2.16
May 8, 2024 08:42:23.643307924 CEST	53060	21	192.168.2.16	84.44.255.254
May 8, 2024 08:42:23.646960020 CEST	52887	2121	192.168.2.16	100.2.146.222
May 8, 2024 08:42:23.662229061 CEST	53086	2121	192.168.2.16	2.83.144.253
May 8, 2024 08:42:23.666176081 CEST	21	52984	79.98.26.88	192.168.2.16
May 8, 2024 08:42:23.674906015 CEST	21	52982	217.76.115.138	192.168.2.16
May 8, 2024 08:42:23.676862001 CEST	2121	52891	185.171.100.50	192.168.2.16
May 8, 2024 08:42:23.678291082 CEST	53087	21	192.168.2.16	111.229.201.52
May 8, 2024 08:42:23.686218023 CEST	21	52993	160.121.41.198	192.168.2.16
May 8, 2024 08:42:23.686357975 CEST	52993	21	192.168.2.16	160.121.41.198
May 8, 2024 08:42:23.686600924 CEST	53088	21	192.168.2.16	160.121.41.198
May 8, 2024 08:42:23.687053919 CEST	21	52993	160.121.41.198	192.168.2.16
May 8, 2024 08:42:23.687113047 CEST	52993	21	192.168.2.16	160.121.41.198
May 8, 2024 08:42:23.693945885 CEST	52949	21	192.168.2.16	171.5.151.204
May 8, 2024 08:42:23.707515001 CEST	21	53059	172.120.235.139	192.168.2.16
May 8, 2024 08:42:23.707672119 CEST	53059	21	192.168.2.16	172.120.235.139
May 8, 2024 08:42:23.709920883 CEST	53015	21	192.168.2.16	76.132.33.233
May 8, 2024 08:42:23.709947109 CEST	53014	2121	192.168.2.16	45.115.111.16
May 8, 2024 08:42:23.710323095 CEST	53089	2121	192.168.2.16	111.229.201.52
May 8, 2024 08:42:23.725919008 CEST	52892	21	192.168.2.16	50.102.15.170
May 8, 2024 08:42:23.726011992 CEST	52877	21	192.168.2.16	14.33.230.98
May 8, 2024 08:42:23.726011992 CEST	53017	2121	192.168.2.16	76.132.33.233
May 8, 2024 08:42:23.726260900 CEST	53090	21	192.168.2.16	14.47.1.126
May 8, 2024 08:42:23.737524986 CEST	21	53075	34.149.79.8	192.168.2.16
May 8, 2024 08:42:23.737546921 CEST	21	53051	34.149.79.8	192.168.2.16
May 8, 2024 08:42:23.737591982 CEST	53075	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:23.746834040 CEST	21	53068	208.125.86.206	192.168.2.16
May 8, 2024 08:42:23.753434896 CEST	2121	53056	34.149.79.8	192.168.2.16
May 8, 2024 08:42:23.753920078 CEST	2121	53077	34.149.79.8	192.168.2.16
May 8, 2024 08:42:23.753981113 CEST	53077	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:23.757920027 CEST	53018	21	192.168.2.16	115.134.175.63
May 8, 2024 08:42:23.759604931 CEST	52879	2121	192.168.2.16	14.33.230.98
May 8, 2024 08:42:23.763101101 CEST	21	53036	142.11.215.85	192.168.2.16
May 8, 2024 08:42:23.763271093 CEST	53036	21	192.168.2.16	142.11.215.85
May 8, 2024 08:42:23.763318062 CEST	21	53057	37.16.27.158	192.168.2.16
May 8, 2024 08:42:23.763500929 CEST	21	53082	37.16.27.158	192.168.2.16
May 8, 2024 08:42:23.763556004 CEST	53082	21	192.168.2.16	37.16.27.158
May 8, 2024 08:42:23.772942066 CEST	53031	2121	192.168.2.16	37.16.27.158
May 8, 2024 08:42:23.774909973 CEST	53019	2121	192.168.2.16	115.134.175.63
May 8, 2024 08:42:23.774925947 CEST	53020	21	192.168.2.16	79.9.120.235
May 8, 2024 08:42:23.777442932 CEST	2121	53070	208.125.86.206	192.168.2.16
May 8, 2024 08:42:23.778492928 CEST	21	53033	38.14.189.177	192.168.2.16
May 8, 2024 08:42:23.778614998 CEST	53033	21	192.168.2.16	38.14.189.177
May 8, 2024 08:42:23.778785944 CEST	53091	21	192.168.2.16	38.14.189.177
May 8, 2024 08:42:23.779280901 CEST	21	53033	38.14.189.177	192.168.2.16
May 8, 2024 08:42:23.779340029 CEST	53033	21	192.168.2.16	38.14.189.177
May 8, 2024 08:42:23.779625893 CEST	2121	53058	37.16.27.158	192.168.2.16
May 8, 2024 08:42:23.779892921 CEST	2121	53085	37.16.27.158	192.168.2.16
May 8, 2024 08:42:23.779956102 CEST	53085	2121	192.168.2.16	37.16.27.158
May 8, 2024 08:42:23.786199093 CEST	21	53032	197.26.33.147	192.168.2.16
May 8, 2024 08:42:23.786250114 CEST	53032	21	192.168.2.16	197.26.33.147
May 8, 2024 08:42:23.786344051 CEST	53032	21	192.168.2.16	197.26.33.147
May 8, 2024 08:42:23.786575079 CEST	53092	21	192.168.2.16	197.26.33.147
May 8, 2024 08:42:23.787941933 CEST	53022	21	192.168.2.16	61.169.64.197
May 8, 2024 08:42:23.787944078 CEST	53021	2121	192.168.2.16	79.9.120.235
May 8, 2024 08:42:23.787957907 CEST	52893	2121	192.168.2.16	50.102.15.170
May 8, 2024 08:42:23.820421934 CEST	21	53064	83.232.10.191	192.168.2.16
May 8, 2024 08:42:23.821293116 CEST	21	51135	96.126.118.190	192.168.2.16
May 8, 2024 08:42:23.821821928 CEST	51135	21	192.168.2.16	96.126.118.190
May 8, 2024 08:42:23.822210073 CEST	2121	53065	83.232.10.191	192.168.2.16
May 8, 2024 08:42:23.824518919 CEST	2121	51137	96.126.118.190	192.168.2.16
May 8, 2024 08:42:23.825177908 CEST	51137	2121	192.168.2.16	96.126.118.190
May 8, 2024 08:42:23.826962948 CEST	21	53023	171.244.37.116	192.168.2.16
May 8, 2024 08:42:23.828248978 CEST	53023	21	192.168.2.16	171.244.37.116
May 8, 2024 08:42:23.833918095 CEST	53024	2121	192.168.2.16	61.169.64.197
May 8, 2024 08:42:23.834940910 CEST	53025	21	192.168.2.16	120.224.128.120
May 8, 2024 08:42:23.866947889 CEST	52895	21	192.168.2.16	109.96.226.101
May 8, 2024 08:42:23.891520977 CEST	21	53059	172.120.235.139	192.168.2.16
May 8, 2024 08:42:23.891901970 CEST	21	53059	172.120.235.139	192.168.2.16
May 8, 2024 08:42:23.892082930 CEST	53059	21	192.168.2.16	172.120.235.139
May 8, 2024 08:42:23.901892900 CEST	2121	52896	109.96.226.101	192.168.2.16
May 8, 2024 08:42:23.902714968 CEST	21	53075	34.149.79.8	192.168.2.16
May 8, 2024 08:42:23.905364037 CEST	53075	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:23.905425072 CEST	53075	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:23.905622005 CEST	53093	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:23.915486097 CEST	21	52992	86.51.153.63	192.168.2.16
May 8, 2024 08:42:23.916505098 CEST	2121	53077	34.149.79.8	192.168.2.16
May 8, 2024 08:42:23.916569948 CEST	53077	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:23.916646004 CEST	53077	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:23.916908979 CEST	53094	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:23.917135954 CEST	21	53029	154.95.173.67	192.168.2.16
May 8, 2024 08:42:23.917190075 CEST	53029	21	192.168.2.16	154.95.173.67
May 8, 2024 08:42:23.917996883 CEST	21	53029	154.95.173.67	192.168.2.16
May 8, 2024 08:42:23.918041945 CEST	53029	21	192.168.2.16	154.95.173.67
May 8, 2024 08:42:23.920563936 CEST	21	53080	59.8.252.60	192.168.2.16
May 8, 2024 08:42:23.926198959 CEST	21	53082	37.16.27.158	192.168.2.16
May 8, 2024 08:42:23.926415920 CEST	53082	21	192.168.2.16	37.16.27.158
May 8, 2024 08:42:23.926479101 CEST	53082	21	192.168.2.16	37.16.27.158
May 8, 2024 08:42:23.926640987 CEST	53095	21	192.168.2.16	37.16.27.158
May 8, 2024 08:42:23.929928064 CEST	52897	21	192.168.2.16	82.7.22.194
May 8, 2024 08:42:23.935075045 CEST	2121	53031	37.16.27.158	192.168.2.16
May 8, 2024 08:42:23.935280085 CEST	2121	53084	59.8.252.60	192.168.2.16
May 8, 2024 08:42:23.940386057 CEST	21	53016	38.239.154.176	192.168.2.16
May 8, 2024 08:42:23.941015959 CEST	21	53016	38.239.154.176	192.168.2.16
May 8, 2024 08:42:23.941085100 CEST	53016	21	192.168.2.16	38.239.154.176
May 8, 2024 08:42:23.941143990 CEST	53016	21	192.168.2.16	38.239.154.176
May 8, 2024 08:42:23.941276073 CEST	53096	21	192.168.2.16	38.239.154.176
May 8, 2024 08:42:23.942481041 CEST	2121	53085	37.16.27.158	192.168.2.16
May 8, 2024 08:42:23.942543030 CEST	53085	2121	192.168.2.16	37.16.27.158
May 8, 2024 08:42:23.942600012 CEST	53085	2121	192.168.2.16	37.16.27.158
May 8, 2024 08:42:23.942754984 CEST	53097	2121	192.168.2.16	37.16.27.158
May 8, 2024 08:42:23.943306923 CEST	2121	52956	47.98.196.75	192.168.2.16
May 8, 2024 08:42:23.945921898 CEST	53027	2121	192.168.2.16	120.224.128.120
May 8, 2024 08:42:23.945924997 CEST	53053	2121	192.168.2.16	12.247.61.30
May 8, 2024 08:42:23.945935011 CEST	52898	2121	192.168.2.16	82.7.22.194
May 8, 2024 08:42:23.945941925 CEST	53054	21	192.168.2.16	12.247.61.30
May 8, 2024 08:42:23.947201014 CEST	21	52957	47.98.196.75	192.168.2.16
May 8, 2024 08:42:23.960977077 CEST	21	53033	38.14.189.177	192.168.2.16
May 8, 2024 08:42:23.961882114 CEST	21	53000	120.24.160.35	192.168.2.16
May 8, 2024 08:42:23.962796926 CEST	21	53060	84.44.255.254	192.168.2.16
May 8, 2024 08:42:23.963965893 CEST	21	53091	38.14.189.177	192.168.2.16
May 8, 2024 08:42:23.964030981 CEST	53060	21	192.168.2.16	84.44.255.254
May 8, 2024 08:42:23.964056015 CEST	53091	21	192.168.2.16	38.14.189.177
May 8, 2024 08:42:23.964083910 CEST	53060	21	192.168.2.16	84.44.255.254
May 8, 2024 08:42:23.964354992 CEST	53098	21	192.168.2.16	84.44.255.254
May 8, 2024 08:42:23.973372936 CEST	21	53036	142.11.215.85	192.168.2.16
May 8, 2024 08:42:23.973515034 CEST	53036	21	192.168.2.16	142.11.215.85
May 8, 2024 08:42:23.973722935 CEST	53099	21	192.168.2.16	142.11.215.85
May 8, 2024 08:42:23.978307009 CEST	53100	2121	192.168.2.16	14.47.1.126
May 8, 2024 08:42:23.981621981 CEST	21	52885	196.210.0.111	192.168.2.16
May 8, 2024 08:42:23.982127905 CEST	52885	21	192.168.2.16	196.210.0.111
May 8, 2024 08:42:23.993562937 CEST	21	53069	196.210.0.111	192.168.2.16
May 8, 2024 08:42:23.993639946 CEST	53069	21	192.168.2.16	196.210.0.111
May 8, 2024 08:42:23.993926048 CEST	52901	21	192.168.2.16	80.29.79.134
May 8, 2024 08:42:24.022686958 CEST	21	53088	160.121.41.198	192.168.2.16
May 8, 2024 08:42:24.022777081 CEST	53088	21	192.168.2.16	160.121.41.198
May 8, 2024 08:42:24.023004055 CEST	21	52993	160.121.41.198	192.168.2.16
May 8, 2024 08:42:24.041028023 CEST	21	52877	14.33.230.98	192.168.2.16
May 8, 2024 08:42:24.041922092 CEST	53049	2121	192.168.2.16	130.93.138.36
May 8, 2024 08:42:24.042207003 CEST	53048	21	192.168.2.16	130.93.138.36
May 8, 2024 08:42:24.043736935 CEST	21	53090	14.47.1.126	192.168.2.16
May 8, 2024 08:42:24.057929993 CEST	52905	21	192.168.2.16	71.219.51.1
May 8, 2024 08:42:24.057934999 CEST	52903	2121	192.168.2.16	80.29.79.134
May 8, 2024 08:42:24.058032990 CEST	52904	2121	192.168.2.16	71.219.51.1
May 8, 2024 08:42:24.067976952 CEST	21	53093	34.149.79.8	192.168.2.16
May 8, 2024 08:42:24.068044901 CEST	53093	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:24.077289104 CEST	2121	52879	14.33.230.98	192.168.2.16
May 8, 2024 08:42:24.079068899 CEST	2121	53094	34.149.79.8	192.168.2.16
May 8, 2024 08:42:24.079082012 CEST	2121	53077	34.149.79.8	192.168.2.16
May 8, 2024 08:42:24.079145908 CEST	53094	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:24.081455946 CEST	21	52949	171.5.151.204	192.168.2.16
May 8, 2024 08:42:24.088737965 CEST	21	53082	37.16.27.158	192.168.2.16
May 8, 2024 08:42:24.088793993 CEST	21	53095	37.16.27.158	192.168.2.16
May 8, 2024 08:42:24.088855028 CEST	53095	21	192.168.2.16	37.16.27.158
May 8, 2024 08:42:24.089930058 CEST	52889	21	192.168.2.16	185.171.100.50
May 8, 2024 08:42:24.095669985 CEST	21	53059	172.120.235.139	192.168.2.16
May 8, 2024 08:42:24.104737997 CEST	2121	53085	37.16.27.158	192.168.2.16
May 8, 2024 08:42:24.104926109 CEST	52906	21	192.168.2.16	117.99.191.171
May 8, 2024 08:42:24.104950905 CEST	2121	53097	37.16.27.158	192.168.2.16
May 8, 2024 08:42:24.105009079 CEST	53055	21	192.168.2.16	98.19.172.225
May 8, 2024 08:42:24.105016947 CEST	53061	2121	192.168.2.16	98.19.172.225
May 8, 2024 08:42:24.105017900 CEST	52907	2121	192.168.2.16	117.99.191.171
May 8, 2024 08:42:24.105056047 CEST	53097	2121	192.168.2.16	37.16.27.158
May 8, 2024 08:42:24.108062029 CEST	21	53022	61.169.64.197	192.168.2.16
May 8, 2024 08:42:24.135921955 CEST	53059	21	192.168.2.16	172.120.235.139
May 8, 2024 08:42:24.135935068 CEST	53034	2121	192.168.2.16	154.95.173.67
May 8, 2024 08:42:24.136034012 CEST	53035	21	192.168.2.16	24.173.68.198
May 8, 2024 08:42:24.136092901 CEST	21	53054	12.247.61.30	192.168.2.16
May 8, 2024 08:42:24.140019894 CEST	2121	53053	12.247.61.30	192.168.2.16
May 8, 2024 08:42:24.150717974 CEST	21	53091	38.14.189.177	192.168.2.16
May 8, 2024 08:42:24.151927948 CEST	52933	21	192.168.2.16	117.223.205.236
May 8, 2024 08:42:24.151930094 CEST	53039	2121	192.168.2.16	187.172.30.152
May 8, 2024 08:42:24.151957989 CEST	53037	2121	192.168.2.16	24.173.68.198
May 8, 2024 08:42:24.151957989 CEST	53038	21	192.168.2.16	187.172.30.152
May 8, 2024 08:42:24.151957989 CEST	53040	21	192.168.2.16	5.251.87.3
May 8, 2024 08:42:24.151961088 CEST	53041	2121	192.168.2.16	5.251.87.3
May 8, 2024 08:42:24.166922092 CEST	52908	21	192.168.2.16	198.72.168.160
May 8, 2024 08:42:24.167113066 CEST	21	53032	197.26.33.147	192.168.2.16
May 8, 2024 08:42:24.168813944 CEST	21	53092	197.26.33.147	192.168.2.16
May 8, 2024 08:42:24.169001102 CEST	53092	21	192.168.2.16	197.26.33.147
May 8, 2024 08:42:24.175182104 CEST	2121	53024	61.169.64.197	192.168.2.16
May 8, 2024 08:42:24.180298090 CEST	21	53023	171.244.37.116	192.168.2.16
May 8, 2024 08:42:24.182198048 CEST	21	53036	142.11.215.85	192.168.2.16
May 8, 2024 08:42:24.182315111 CEST	21	53036	142.11.215.85	192.168.2.16
May 8, 2024 08:42:24.182442904 CEST	53036	21	192.168.2.16	142.11.215.85
May 8, 2024 08:42:24.182542086 CEST	21	53099	142.11.215.85	192.168.2.16
May 8, 2024 08:42:24.182611942 CEST	53099	21	192.168.2.16	142.11.215.85
May 8, 2024 08:42:24.183163881 CEST	52891	2121	192.168.2.16	185.171.100.50
May 8, 2024 08:42:24.198925972 CEST	53091	21	192.168.2.16	38.14.189.177
May 8, 2024 08:42:24.198935032 CEST	53042	21	192.168.2.16	80.139.29.120
May 8, 2024 08:42:24.198946953 CEST	53044	2121	192.168.2.16	80.139.29.120
May 8, 2024 08:42:24.198949099 CEST	53043	21	192.168.2.16	31.14.133.36
May 8, 2024 08:42:24.199270964 CEST	53045	2121	192.168.2.16	31.14.133.36
May 8, 2024 08:42:24.214921951 CEST	53047	2121	192.168.2.16	218.55.173.142
May 8, 2024 08:42:24.214924097 CEST	53046	21	192.168.2.16	218.55.173.142
May 8, 2024 08:42:24.216042042 CEST	52620	2121	192.168.2.16	62.140.135.146
May 8, 2024 08:42:24.230725050 CEST	21	53093	34.149.79.8	192.168.2.16
May 8, 2024 08:42:24.230808020 CEST	53093	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:24.230918884 CEST	53023	21	192.168.2.16	171.244.37.116
May 8, 2024 08:42:24.241363049 CEST	21	53016	38.239.154.176	192.168.2.16
May 8, 2024 08:42:24.241375923 CEST	21	53096	38.239.154.176	192.168.2.16
May 8, 2024 08:42:24.241466999 CEST	53096	21	192.168.2.16	38.239.154.176
May 8, 2024 08:42:24.241592884 CEST	2121	53094	34.149.79.8	192.168.2.16
May 8, 2024 08:42:24.241647005 CEST	53094	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:24.246917009 CEST	53068	21	192.168.2.16	208.125.86.206
May 8, 2024 08:42:24.246948004 CEST	53050	21	192.168.2.16	95.70.121.39
May 8, 2024 08:42:24.251389980 CEST	21	53095	37.16.27.158	192.168.2.16
May 8, 2024 08:42:24.252074957 CEST	53095	21	192.168.2.16	37.16.27.158
May 8, 2024 08:42:24.258975983 CEST	21	52852	77.75.121.3	192.168.2.16
May 8, 2024 08:42:24.262928009 CEST	53052	2121	192.168.2.16	95.70.121.39
May 8, 2024 08:42:24.264796972 CEST	52622	21	192.168.2.16	62.140.135.146
May 8, 2024 08:42:24.267599106 CEST	2121	53097	37.16.27.158	192.168.2.16
May 8, 2024 08:42:24.267657042 CEST	53097	2121	192.168.2.16	37.16.27.158
May 8, 2024 08:42:24.278929949 CEST	53070	2121	192.168.2.16	208.125.86.206
May 8, 2024 08:42:24.280265093 CEST	21	53098	84.44.255.254	192.168.2.16
May 8, 2024 08:42:24.280333042 CEST	53098	21	192.168.2.16	84.44.255.254
May 8, 2024 08:42:24.282582998 CEST	21	52821	38.38.120.85	192.168.2.16
May 8, 2024 08:42:24.283409119 CEST	21	53060	84.44.255.254	192.168.2.16
May 8, 2024 08:42:24.290965080 CEST	21	53025	120.224.128.120	192.168.2.16
May 8, 2024 08:42:24.293816090 CEST	2121	53100	14.47.1.126	192.168.2.16
May 8, 2024 08:42:24.310935020 CEST	52852	21	192.168.2.16	77.75.121.3
May 8, 2024 08:42:24.326934099 CEST	52913	2121	192.168.2.16	198.72.168.160
May 8, 2024 08:42:24.326937914 CEST	53064	21	192.168.2.16	83.232.10.191
May 8, 2024 08:42:24.326951981 CEST	53065	2121	192.168.2.16	83.232.10.191
May 8, 2024 08:42:24.326951981 CEST	52821	21	192.168.2.16	38.38.120.85
May 8, 2024 08:42:24.360449076 CEST	21	53088	160.121.41.198	192.168.2.16
May 8, 2024 08:42:24.373502016 CEST	2121	53049	130.93.138.36	192.168.2.16
May 8, 2024 08:42:24.374628067 CEST	21	53048	130.93.138.36	192.168.2.16
May 8, 2024 08:42:24.374927998 CEST	51802	21	192.168.2.16	91.146.97.65
May 8, 2024 08:42:24.379992008 CEST	21	53055	98.19.172.225	192.168.2.16
May 8, 2024 08:42:24.381230116 CEST	2121	53061	98.19.172.225	192.168.2.16
May 8, 2024 08:42:24.390952110 CEST	53075	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:24.391578913 CEST	21	53099	142.11.215.85	192.168.2.16
May 8, 2024 08:42:24.392956018 CEST	21	52960	46.34.34.117	192.168.2.16
May 8, 2024 08:42:24.406934977 CEST	53088	21	192.168.2.16	160.121.41.198
May 8, 2024 08:42:24.406939030 CEST	52896	2121	192.168.2.16	109.96.226.101
May 8, 2024 08:42:24.406977892 CEST	52918	21	192.168.2.16	95.88.100.53
May 8, 2024 08:42:24.406979084 CEST	52919	21	192.168.2.16	46.163.151.66
May 8, 2024 08:42:24.406990051 CEST	53062	21	192.168.2.16	88.92.121.224
May 8, 2024 08:42:24.421933889 CEST	53080	21	192.168.2.16	59.8.252.60
May 8, 2024 08:42:24.422020912 CEST	52917	2121	192.168.2.16	46.163.151.66
May 8, 2024 08:42:24.437923908 CEST	53099	21	192.168.2.16	142.11.215.85
May 8, 2024 08:42:24.437937975 CEST	52960	21	192.168.2.16	46.34.34.117
May 8, 2024 08:42:24.437941074 CEST	52921	2121	192.168.2.16	95.88.100.53
May 8, 2024 08:42:24.437941074 CEST	53063	2121	192.168.2.16	88.92.121.224
May 8, 2024 08:42:24.438091993 CEST	53084	2121	192.168.2.16	59.8.252.60
May 8, 2024 08:42:24.445187092 CEST	21	52889	185.171.100.50	192.168.2.16
May 8, 2024 08:42:24.453931093 CEST	52956	2121	192.168.2.16	47.98.196.75
May 8, 2024 08:42:24.453933001 CEST	52957	21	192.168.2.16	47.98.196.75
May 8, 2024 08:42:24.461818933 CEST	21	52933	117.223.205.236	192.168.2.16
May 8, 2024 08:42:24.461879969 CEST	52933	21	192.168.2.16	117.223.205.236
May 8, 2024 08:42:24.485917091 CEST	53066	2121	192.168.2.16	174.177.40.166
May 8, 2024 08:42:24.486557007 CEST	53067	21	192.168.2.16	174.177.40.166
May 8, 2024 08:42:24.507172108 CEST	21	53068	208.125.86.206	192.168.2.16
May 8, 2024 08:42:24.508423090 CEST	21	53069	196.210.0.111	192.168.2.16
May 8, 2024 08:42:24.536958933 CEST	2121	53070	208.125.86.206	192.168.2.16
May 8, 2024 08:42:24.543021917 CEST	21	53096	38.239.154.176	192.168.2.16
May 8, 2024 08:42:24.548074007 CEST	2121	52891	185.171.100.50	192.168.2.16
May 8, 2024 08:42:24.549942970 CEST	53069	21	192.168.2.16	196.210.0.111
May 8, 2024 08:42:24.549953938 CEST	52925	21	192.168.2.16	90.190.165.47
May 8, 2024 08:42:24.549956083 CEST	53090	21	192.168.2.16	14.47.1.126
May 8, 2024 08:42:24.553147078 CEST	21	53075	34.149.79.8	192.168.2.16
May 8, 2024 08:42:24.565942049 CEST	53071	21	192.168.2.16	172.166.82.81
May 8, 2024 08:42:24.568926096 CEST	21	53092	197.26.33.147	192.168.2.16
May 8, 2024 08:42:24.569281101 CEST	53092	21	192.168.2.16	197.26.33.147
May 8, 2024 08:42:24.581932068 CEST	53072	2121	192.168.2.16	69.207.62.104
May 8, 2024 08:42:24.581954002 CEST	53073	2121	192.168.2.16	172.166.82.81
May 8, 2024 08:42:24.582035065 CEST	53074	21	192.168.2.16	69.207.62.104
May 8, 2024 08:42:24.596337080 CEST	21	53098	84.44.255.254	192.168.2.16
May 8, 2024 08:42:24.596410990 CEST	53098	21	192.168.2.16	84.44.255.254
May 8, 2024 08:42:24.596920967 CEST	53076	21	192.168.2.16	52.140.47.113
May 8, 2024 08:42:24.596935987 CEST	53096	21	192.168.2.16	38.239.154.176
May 8, 2024 08:42:24.596936941 CEST	52949	21	192.168.2.16	171.5.151.204
May 8, 2024 08:42:24.596999884 CEST	53078	2121	192.168.2.16	52.140.47.113
May 8, 2024 08:42:24.612920046 CEST	53081	2121	192.168.2.16	112.113.132.170
May 8, 2024 08:42:24.612920046 CEST	53079	21	192.168.2.16	112.113.132.170
May 8, 2024 08:42:24.614475012 CEST	53022	21	192.168.2.16	61.169.64.197
May 8, 2024 08:42:24.625133991 CEST	21	52933	117.223.205.236	192.168.2.16
May 8, 2024 08:42:24.628922939 CEST	53083	21	192.168.2.16	2.83.144.253
May 8, 2024 08:42:24.644921064 CEST	52928	2121	192.168.2.16	90.190.165.47
May 8, 2024 08:42:24.644931078 CEST	53053	2121	192.168.2.16	12.247.61.30
May 8, 2024 08:42:24.644938946 CEST	53054	21	192.168.2.16	12.247.61.30
May 8, 2024 08:42:24.660949945 CEST	52930	21	192.168.2.16	20.81.148.204
May 8, 2024 08:42:24.676958084 CEST	53024	2121	192.168.2.16	61.169.64.197
May 8, 2024 08:42:24.676959038 CEST	53086	2121	192.168.2.16	2.83.144.253
May 8, 2024 08:42:24.692935944 CEST	52932	2121	192.168.2.16	20.81.148.204
May 8, 2024 08:42:24.694044113 CEST	53087	21	192.168.2.16	111.229.201.52
May 8, 2024 08:42:24.694369078 CEST	21	53064	83.232.10.191	192.168.2.16
May 8, 2024 08:42:24.696151972 CEST	2121	53065	83.232.10.191	192.168.2.16
May 8, 2024 08:42:24.723922968 CEST	53089	2121	192.168.2.16	111.229.201.52
May 8, 2024 08:42:24.744537115 CEST	21	53080	59.8.252.60	192.168.2.16
May 8, 2024 08:42:24.757975101 CEST	2121	53084	59.8.252.60	192.168.2.16
May 8, 2024 08:42:24.766278982 CEST	2121	52956	47.98.196.75	192.168.2.16
May 8, 2024 08:42:24.771625042 CEST	21	52957	47.98.196.75	192.168.2.16
May 8, 2024 08:42:24.771928072 CEST	52935	21	192.168.2.16	45.243.182.223
May 8, 2024 08:42:24.774584055 CEST	2121	52896	109.96.226.101	192.168.2.16
May 8, 2024 08:42:24.781398058 CEST	21	52919	46.163.151.66	192.168.2.16
May 8, 2024 08:42:24.787926912 CEST	52939	21	192.168.2.16	77.34.229.59
May 8, 2024 08:42:24.788074017 CEST	52937	21	192.168.2.16	178.70.228.49
May 8, 2024 08:42:24.789000988 CEST	52936	2121	192.168.2.16	45.243.182.223
May 8, 2024 08:42:24.796678066 CEST	2121	52917	46.163.151.66	192.168.2.16
May 8, 2024 08:42:24.803922892 CEST	53100	2121	192.168.2.16	14.47.1.126
May 8, 2024 08:42:24.803942919 CEST	52938	2121	192.168.2.16	178.70.228.49
May 8, 2024 08:42:24.803946972 CEST	53025	21	192.168.2.16	120.224.128.120
May 8, 2024 08:42:24.803958893 CEST	52940	2121	192.168.2.16	77.34.229.59
May 8, 2024 08:42:24.803958893 CEST	52941	21	192.168.2.16	98.216.74.51
May 8, 2024 08:42:24.835127115 CEST	21	53054	12.247.61.30	192.168.2.16
May 8, 2024 08:42:24.835932970 CEST	52942	2121	192.168.2.16	98.216.74.51
May 8, 2024 08:42:24.839020967 CEST	2121	53053	12.247.61.30	192.168.2.16
May 8, 2024 08:42:24.867837906 CEST	21	53090	14.47.1.126	192.168.2.16
May 8, 2024 08:42:24.880485058 CEST	21	52992	86.51.153.63	192.168.2.16
May 8, 2024 08:42:24.882945061 CEST	53048	21	192.168.2.16	130.93.138.36
May 8, 2024 08:42:24.882946014 CEST	53055	21	192.168.2.16	98.19.172.225
May 8, 2024 08:42:24.882946968 CEST	53049	2121	192.168.2.16	130.93.138.36
May 8, 2024 08:42:24.882950068 CEST	52944	21	192.168.2.16	193.115.118.112
May 8, 2024 08:42:24.883837938 CEST	53061	2121	192.168.2.16	98.19.172.225
May 8, 2024 08:42:24.883837938 CEST	52946	2121	192.168.2.16	193.115.118.112
May 8, 2024 08:42:24.927099943 CEST	21	53022	61.169.64.197	192.168.2.16
May 8, 2024 08:42:24.930922985 CEST	52992	21	192.168.2.16	86.51.153.63
May 8, 2024 08:42:24.930924892 CEST	52948	2121	192.168.2.16	73.244.194.242
May 8, 2024 08:42:24.930943012 CEST	52947	21	192.168.2.16	73.244.194.242
May 8, 2024 08:42:24.961931944 CEST	52950	2121	192.168.2.16	171.5.151.204
May 8, 2024 08:42:24.962021112 CEST	52951	21	192.168.2.16	112.145.29.138
May 8, 2024 08:42:24.977922916 CEST	52954	2121	192.168.2.16	112.145.29.138
May 8, 2024 08:42:24.982209921 CEST	21	52949	171.5.151.204	192.168.2.16
May 8, 2024 08:42:25.009926081 CEST	52058	2121	192.168.2.16	62.140.135.146
May 8, 2024 08:42:25.009938955 CEST	53068	21	192.168.2.16	208.125.86.206
May 8, 2024 08:42:25.009943008 CEST	52958	21	192.168.2.16	72.94.54.194
May 8, 2024 08:42:25.014455080 CEST	2121	53024	61.169.64.197	192.168.2.16
May 8, 2024 08:42:25.025921106 CEST	52959	2121	192.168.2.16	72.94.54.194
May 8, 2024 08:42:25.041945934 CEST	53070	2121	192.168.2.16	208.125.86.206
May 8, 2024 08:42:25.041950941 CEST	52962	2121	192.168.2.16	62.74.64.79
May 8, 2024 08:42:25.041951895 CEST	52961	21	192.168.2.16	62.74.64.79
May 8, 2024 08:42:25.073056936 CEST	21	53010	96.126.118.190	192.168.2.16
May 8, 2024 08:42:25.073282957 CEST	52964	21	192.168.2.16	64.233.171.82
May 8, 2024 08:42:25.074048996 CEST	52967	21	192.168.2.16	95.108.21.236
May 8, 2024 08:42:25.087935925 CEST	52966	2121	192.168.2.16	64.233.171.82
May 8, 2024 08:42:25.103919983 CEST	52969	2121	192.168.2.16	95.108.21.236
May 8, 2024 08:42:25.103924036 CEST	52968	21	192.168.2.16	14.199.15.208
May 8, 2024 08:42:25.103933096 CEST	52059	21	192.168.2.16	62.140.135.146
May 8, 2024 08:42:25.110292912 CEST	2121	53013	96.126.118.190	192.168.2.16
May 8, 2024 08:42:25.118930101 CEST	53010	21	192.168.2.16	96.126.118.190
May 8, 2024 08:42:25.118936062 CEST	52973	2121	192.168.2.16	81.40.86.11
May 8, 2024 08:42:25.118937016 CEST	52971	2121	192.168.2.16	14.199.15.208
May 8, 2024 08:42:25.119477034 CEST	2121	53100	14.47.1.126	192.168.2.16
May 8, 2024 08:42:25.119499922 CEST	52972	21	192.168.2.16	81.40.86.11
May 8, 2024 08:42:25.119513988 CEST	52974	21	192.168.2.16	66.152.152.78
May 8, 2024 08:42:25.150928974 CEST	53013	2121	192.168.2.16	96.126.118.190
May 8, 2024 08:42:25.167619944 CEST	52976	2121	192.168.2.16	66.152.152.78
May 8, 2024 08:42:25.183608055 CEST	52977	21	192.168.2.16	102.39.31.115
May 8, 2024 08:42:25.198966026 CEST	53065	2121	192.168.2.16	83.232.10.191
May 8, 2024 08:42:25.199007034 CEST	53064	21	192.168.2.16	83.232.10.191
May 8, 2024 08:42:25.214916945 CEST	52978	2121	192.168.2.16	102.39.31.115
May 8, 2024 08:42:25.217257977 CEST	2121	53049	130.93.138.36	192.168.2.16
May 8, 2024 08:42:25.218517065 CEST	21	53048	130.93.138.36	192.168.2.16
May 8, 2024 08:42:25.233272076 CEST	21	53055	98.19.172.225	192.168.2.16
May 8, 2024 08:42:25.234448910 CEST	2121	53061	98.19.172.225	192.168.2.16
May 8, 2024 08:42:25.259958029 CEST	21	53025	120.224.128.120	192.168.2.16
May 8, 2024 08:42:25.262924910 CEST	52980	21	192.168.2.16	91.146.97.65
May 8, 2024 08:42:25.262938023 CEST	53084	2121	192.168.2.16	59.8.252.60
May 8, 2024 08:42:25.262938023 CEST	53080	21	192.168.2.16	59.8.252.60
May 8, 2024 08:42:25.269510984 CEST	21	53068	208.125.86.206	192.168.2.16
May 8, 2024 08:42:25.278923035 CEST	52957	21	192.168.2.16	47.98.196.75
May 8, 2024 08:42:25.281661987 CEST	52956	2121	192.168.2.16	47.98.196.75
May 8, 2024 08:42:25.301795006 CEST	2121	53070	208.125.86.206	192.168.2.16
May 8, 2024 08:42:25.342926979 CEST	53054	21	192.168.2.16	12.247.61.30
May 8, 2024 08:42:25.342931032 CEST	53053	2121	192.168.2.16	12.247.61.30
May 8, 2024 08:42:25.373935938 CEST	53090	21	192.168.2.16	14.47.1.126
May 8, 2024 08:42:25.437937021 CEST	53022	21	192.168.2.16	61.169.64.197
May 8, 2024 08:42:25.485932112 CEST	52949	21	192.168.2.16	171.5.151.204
May 8, 2024 08:42:25.485933065 CEST	52996	21	192.168.2.16	69.244.200.119
May 8, 2024 08:42:25.501939058 CEST	52997	2121	192.168.2.16	69.244.200.119
May 8, 2024 08:42:25.517940044 CEST	52998	21	192.168.2.16	38.130.169.40
May 8, 2024 08:42:25.517944098 CEST	53024	2121	192.168.2.16	61.169.64.197
May 8, 2024 08:42:25.533092022 CEST	21	53054	12.247.61.30	192.168.2.16
May 8, 2024 08:42:25.537072897 CEST	2121	53053	12.247.61.30	192.168.2.16
May 8, 2024 08:42:25.546412945 CEST	21	53064	83.232.10.191	192.168.2.16
May 8, 2024 08:42:25.548217058 CEST	2121	53065	83.232.10.191	192.168.2.16
May 8, 2024 08:42:25.581830978 CEST	2121	53084	59.8.252.60	192.168.2.16
May 8, 2024 08:42:25.584253073 CEST	21	53080	59.8.252.60	192.168.2.16
May 8, 2024 08:42:25.593266010 CEST	21	52957	47.98.196.75	192.168.2.16
May 8, 2024 08:42:25.597820997 CEST	2121	52956	47.98.196.75	192.168.2.16
May 8, 2024 08:42:25.613935947 CEST	53002	2121	192.168.2.16	38.130.169.40
May 8, 2024 08:42:25.628601074 CEST	21	52933	117.223.205.236	192.168.2.16
May 8, 2024 08:42:25.629939079 CEST	53003	21	192.168.2.16	23.82.68.202
May 8, 2024 08:42:25.629986048 CEST	53100	2121	192.168.2.16	14.47.1.126
May 8, 2024 08:42:25.629986048 CEST	53004	2121	192.168.2.16	23.82.68.202
May 8, 2024 08:42:25.645939112 CEST	53007	21	192.168.2.16	45.115.111.16
May 8, 2024 08:42:25.677932024 CEST	52933	21	192.168.2.16	117.223.205.236
May 8, 2024 08:42:25.690305948 CEST	21	53090	14.47.1.126	192.168.2.16
May 8, 2024 08:42:25.709940910 CEST	53014	2121	192.168.2.16	45.115.111.16
May 8, 2024 08:42:25.710575104 CEST	53015	21	192.168.2.16	76.132.33.233
May 8, 2024 08:42:25.725933075 CEST	53048	21	192.168.2.16	130.93.138.36
May 8, 2024 08:42:25.725938082 CEST	53049	2121	192.168.2.16	130.93.138.36
May 8, 2024 08:42:25.726465940 CEST	53017	2121	192.168.2.16	76.132.33.233
May 8, 2024 08:42:25.741925001 CEST	53055	21	192.168.2.16	98.19.172.225
May 8, 2024 08:42:25.746043921 CEST	53061	2121	192.168.2.16	98.19.172.225
May 8, 2024 08:42:25.772938013 CEST	53025	21	192.168.2.16	120.224.128.120
May 8, 2024 08:42:25.772938967 CEST	53018	21	192.168.2.16	115.134.175.63
May 8, 2024 08:42:25.773751974 CEST	53068	21	192.168.2.16	208.125.86.206
May 8, 2024 08:42:25.788925886 CEST	53019	2121	192.168.2.16	115.134.175.63
May 8, 2024 08:42:25.788944006 CEST	53020	21	192.168.2.16	79.9.120.235
May 8, 2024 08:42:25.788954020 CEST	53021	2121	192.168.2.16	79.9.120.235
May 8, 2024 08:42:25.803952932 CEST	53070	2121	192.168.2.16	208.125.86.206
May 8, 2024 08:42:25.872524023 CEST	21	52949	171.5.151.204	192.168.2.16
May 8, 2024 08:42:25.947520018 CEST	2121	53100	14.47.1.126	192.168.2.16
May 8, 2024 08:42:25.947936058 CEST	53027	2121	192.168.2.16	120.224.128.120
May 8, 2024 08:42:25.996812105 CEST	21	52975	23.229.188.101	192.168.2.16
May 8, 2024 08:42:26.034887075 CEST	21	53068	208.125.86.206	192.168.2.16
May 8, 2024 08:42:26.042922020 CEST	52815	2121	192.168.2.16	86.23.102.114
May 8, 2024 08:42:26.043216944 CEST	53053	2121	192.168.2.16	12.247.61.30
May 8, 2024 08:42:26.043216944 CEST	53054	21	192.168.2.16	12.247.61.30
May 8, 2024 08:42:26.043216944 CEST	52975	21	192.168.2.16	23.229.188.101
May 8, 2024 08:42:26.053694010 CEST	21	53055	98.19.172.225	192.168.2.16
May 8, 2024 08:42:26.054871082 CEST	2121	53061	98.19.172.225	192.168.2.16
May 8, 2024 08:42:26.057920933 CEST	53065	2121	192.168.2.16	83.232.10.191
May 8, 2024 08:42:26.057934046 CEST	53064	21	192.168.2.16	83.232.10.191
May 8, 2024 08:42:26.058039904 CEST	2121	53049	130.93.138.36	192.168.2.16
May 8, 2024 08:42:26.058522940 CEST	21	53048	130.93.138.36	192.168.2.16
May 8, 2024 08:42:26.063811064 CEST	2121	53070	208.125.86.206	192.168.2.16
May 8, 2024 08:42:26.088942051 CEST	53084	2121	192.168.2.16	59.8.252.60
May 8, 2024 08:42:26.088942051 CEST	53080	21	192.168.2.16	59.8.252.60
May 8, 2024 08:42:26.104933023 CEST	52818	21	192.168.2.16	160.237.79.186
May 8, 2024 08:42:26.121026993 CEST	52820	21	192.168.2.16	194.26.205.242
May 8, 2024 08:42:26.121032953 CEST	52819	2121	192.168.2.16	160.237.79.186
May 8, 2024 08:42:26.137062073 CEST	53034	2121	192.168.2.16	154.95.173.67
May 8, 2024 08:42:26.137063980 CEST	53035	21	192.168.2.16	24.173.68.198
May 8, 2024 08:42:26.151938915 CEST	53039	2121	192.168.2.16	187.172.30.152
May 8, 2024 08:42:26.151938915 CEST	53037	2121	192.168.2.16	24.173.68.198
May 8, 2024 08:42:26.151949883 CEST	53038	21	192.168.2.16	187.172.30.152
May 8, 2024 08:42:26.151949883 CEST	53040	21	192.168.2.16	5.251.87.3
May 8, 2024 08:42:26.151954889 CEST	53041	2121	192.168.2.16	5.251.87.3
May 8, 2024 08:42:26.198930979 CEST	53090	21	192.168.2.16	14.47.1.126
May 8, 2024 08:42:26.198937893 CEST	53042	21	192.168.2.16	80.139.29.120
May 8, 2024 08:42:26.198950052 CEST	53044	2121	192.168.2.16	80.139.29.120
May 8, 2024 08:42:26.198956966 CEST	53043	21	192.168.2.16	31.14.133.36
May 8, 2024 08:42:26.199392080 CEST	53045	2121	192.168.2.16	31.14.133.36
May 8, 2024 08:42:26.206554890 CEST	21	53022	61.169.64.197	192.168.2.16
May 8, 2024 08:42:26.230022907 CEST	53047	2121	192.168.2.16	218.55.173.142
May 8, 2024 08:42:26.230024099 CEST	53046	21	192.168.2.16	218.55.173.142
May 8, 2024 08:42:26.233514071 CEST	21	53054	12.247.61.30	192.168.2.16
May 8, 2024 08:42:26.234673977 CEST	2121	53024	61.169.64.197	192.168.2.16
May 8, 2024 08:42:26.237337112 CEST	2121	53053	12.247.61.30	192.168.2.16
May 8, 2024 08:42:26.261960983 CEST	53050	21	192.168.2.16	95.70.121.39
May 8, 2024 08:42:26.261960983 CEST	52822	2121	192.168.2.16	194.26.205.242
May 8, 2024 08:42:26.278021097 CEST	53052	2121	192.168.2.16	95.70.121.39
May 8, 2024 08:42:26.341936111 CEST	52823	21	192.168.2.16	79.146.98.25
May 8, 2024 08:42:26.341937065 CEST	52824	2121	192.168.2.16	79.146.98.25
May 8, 2024 08:42:26.409439087 CEST	2121	53084	59.8.252.60	192.168.2.16
May 8, 2024 08:42:26.411901951 CEST	21	53080	59.8.252.60	192.168.2.16
May 8, 2024 08:42:26.414360046 CEST	21	53064	83.232.10.191	192.168.2.16
May 8, 2024 08:42:26.416137934 CEST	2121	53065	83.232.10.191	192.168.2.16
May 8, 2024 08:42:26.420922041 CEST	53062	21	192.168.2.16	88.92.121.224
May 8, 2024 08:42:26.452949047 CEST	53063	2121	192.168.2.16	88.92.121.224
May 8, 2024 08:42:26.452949047 CEST	53100	2121	192.168.2.16	14.47.1.126
May 8, 2024 08:42:26.471179962 CEST	21	52990	23.106.228.71	192.168.2.16
May 8, 2024 08:42:26.500935078 CEST	53067	21	192.168.2.16	174.177.40.166
May 8, 2024 08:42:26.500969887 CEST	52828	21	192.168.2.16	94.208.246.163
May 8, 2024 08:42:26.503870010 CEST	53066	2121	192.168.2.16	174.177.40.166
May 8, 2024 08:42:26.515007019 CEST	21	53090	14.47.1.126	192.168.2.16
May 8, 2024 08:42:26.516944885 CEST	52990	21	192.168.2.16	23.106.228.71
May 8, 2024 08:42:26.532929897 CEST	52829	2121	192.168.2.16	94.208.246.163
May 8, 2024 08:42:26.548924923 CEST	53068	21	192.168.2.16	208.125.86.206
May 8, 2024 08:42:26.565045118 CEST	52831	21	192.168.2.16	95.171.194.152
May 8, 2024 08:42:26.565045118 CEST	53070	2121	192.168.2.16	208.125.86.206
May 8, 2024 08:42:26.565045118 CEST	53048	21	192.168.2.16	130.93.138.36
May 8, 2024 08:42:26.565045118 CEST	53049	2121	192.168.2.16	130.93.138.36
May 8, 2024 08:42:26.565047979 CEST	53055	21	192.168.2.16	98.19.172.225
May 8, 2024 08:42:26.565051079 CEST	52832	2121	192.168.2.16	95.171.194.152
May 8, 2024 08:42:26.565052032 CEST	53061	2121	192.168.2.16	98.19.172.225
May 8, 2024 08:42:26.580933094 CEST	52833	2121	192.168.2.16	94.6.74.207
May 8, 2024 08:42:26.580934048 CEST	53071	21	192.168.2.16	172.166.82.81
May 8, 2024 08:42:26.580935955 CEST	52834	21	192.168.2.16	94.6.74.207
May 8, 2024 08:42:26.596940994 CEST	53074	21	192.168.2.16	69.207.62.104
May 8, 2024 08:42:26.596942902 CEST	53073	2121	192.168.2.16	172.166.82.81
May 8, 2024 08:42:26.596944094 CEST	52838	2121	192.168.2.16	160.121.41.198
May 8, 2024 08:42:26.596965075 CEST	53078	2121	192.168.2.16	52.140.47.113
May 8, 2024 08:42:26.596966028 CEST	52839	21	192.168.2.16	78.186.180.252
May 8, 2024 08:42:26.596966982 CEST	53076	21	192.168.2.16	52.140.47.113
May 8, 2024 08:42:26.596967936 CEST	52836	2121	192.168.2.16	31.181.186.167
May 8, 2024 08:42:26.596995115 CEST	52835	21	192.168.2.16	31.181.186.167
May 8, 2024 08:42:26.600140095 CEST	53072	2121	192.168.2.16	69.207.62.104
May 8, 2024 08:42:26.628021002 CEST	53081	2121	192.168.2.16	112.113.132.170
May 8, 2024 08:42:26.628400087 CEST	53079	21	192.168.2.16	112.113.132.170
May 8, 2024 08:42:26.643923998 CEST	53083	21	192.168.2.16	2.83.144.253
May 8, 2024 08:42:26.643937111 CEST	52840	2121	192.168.2.16	78.186.180.252
May 8, 2024 08:42:26.644927025 CEST	52841	21	192.168.2.16	73.119.184.97
May 8, 2024 08:42:26.658935070 CEST	52842	2121	192.168.2.16	73.119.184.97
May 8, 2024 08:42:26.660913944 CEST	52844	2121	192.168.2.16	52.137.122.207
May 8, 2024 08:42:26.660916090 CEST	52843	21	192.168.2.16	52.137.122.207
May 8, 2024 08:42:26.675020933 CEST	52847	2121	192.168.2.16	36.95.88.230
May 8, 2024 08:42:26.675028086 CEST	52846	21	192.168.2.16	36.95.88.230
May 8, 2024 08:42:26.675028086 CEST	52848	21	192.168.2.16	24.170.119.218
May 8, 2024 08:42:26.690926075 CEST	53086	2121	192.168.2.16	2.83.144.253
May 8, 2024 08:42:26.692919970 CEST	52850	2121	192.168.2.16	24.170.119.218
May 8, 2024 08:42:26.706932068 CEST	53087	21	192.168.2.16	111.229.201.52
May 8, 2024 08:42:26.721924067 CEST	53022	21	192.168.2.16	61.169.64.197
May 8, 2024 08:42:26.738029003 CEST	53089	2121	192.168.2.16	111.229.201.52
May 8, 2024 08:42:26.738029003 CEST	53024	2121	192.168.2.16	61.169.64.197
May 8, 2024 08:42:26.768420935 CEST	2121	53100	14.47.1.126	192.168.2.16
May 8, 2024 08:42:26.808777094 CEST	21	53068	208.125.86.206	192.168.2.16
May 8, 2024 08:42:26.823659897 CEST	2121	53070	208.125.86.206	192.168.2.16
May 8, 2024 08:42:26.879175901 CEST	2121	53061	98.19.172.225	192.168.2.16
May 8, 2024 08:42:26.879198074 CEST	21	53055	98.19.172.225	192.168.2.16
May 8, 2024 08:42:26.897378922 CEST	2121	53049	130.93.138.36	192.168.2.16
May 8, 2024 08:42:26.898494005 CEST	21	53048	130.93.138.36	192.168.2.16
May 8, 2024 08:42:26.912954092 CEST	53084	2121	192.168.2.16	59.8.252.60
May 8, 2024 08:42:26.912954092 CEST	53080	21	192.168.2.16	59.8.252.60
May 8, 2024 08:42:26.927922010 CEST	53064	21	192.168.2.16	83.232.10.191
May 8, 2024 08:42:26.927946091 CEST	53065	2121	192.168.2.16	83.232.10.191
May 8, 2024 08:42:26.960047960 CEST	52856	21	192.168.2.16	80.48.205.205
May 8, 2024 08:42:27.023941040 CEST	53090	21	192.168.2.16	14.47.1.126
May 8, 2024 08:42:27.029350996 CEST	21	53022	61.169.64.197	192.168.2.16
May 8, 2024 08:42:27.071958065 CEST	52859	2121	192.168.2.16	80.48.205.205
May 8, 2024 08:42:27.085216999 CEST	2121	53024	61.169.64.197	192.168.2.16
May 8, 2024 08:42:27.087950945 CEST	52860	21	192.168.2.16	24.164.151.97
May 8, 2024 08:42:27.087950945 CEST	52862	2121	192.168.2.16	24.164.151.97
May 8, 2024 08:42:27.104023933 CEST	52861	21	192.168.2.16	223.206.58.167
May 8, 2024 08:42:27.136024952 CEST	52863	2121	192.168.2.16	223.206.58.167
May 8, 2024 08:42:27.184030056 CEST	52866	21	192.168.2.16	76.125.250.125
May 8, 2024 08:42:27.232378960 CEST	2121	53084	59.8.252.60	192.168.2.16
May 8, 2024 08:42:27.233784914 CEST	21	53080	59.8.252.60	192.168.2.16
May 8, 2024 08:42:27.248040915 CEST	52868	2121	192.168.2.16	76.125.250.125
May 8, 2024 08:42:27.262957096 CEST	52867	21	192.168.2.16	222.219.165.140
May 8, 2024 08:42:27.278928995 CEST	53100	2121	192.168.2.16	14.47.1.126
May 8, 2024 08:42:27.294938087 CEST	52869	2121	192.168.2.16	222.219.165.140
May 8, 2024 08:42:27.300966024 CEST	21	53064	83.232.10.191	192.168.2.16
May 8, 2024 08:42:27.302772045 CEST	2121	53065	83.232.10.191	192.168.2.16
May 8, 2024 08:42:27.310947895 CEST	52870	21	192.168.2.16	96.255.189.170
May 8, 2024 08:42:27.341540098 CEST	21	53090	14.47.1.126	192.168.2.16
May 8, 2024 08:42:27.358923912 CEST	52878	21	192.168.2.16	38.207.205.17
May 8, 2024 08:42:27.358938932 CEST	52873	2121	192.168.2.16	96.255.189.170
May 8, 2024 08:42:27.373948097 CEST	52875	21	192.168.2.16	73.49.216.251
May 8, 2024 08:42:27.405930996 CEST	52876	2121	192.168.2.16	73.49.216.251
May 8, 2024 08:42:27.443305016 CEST	21	52953	51.38.57.28	192.168.2.16
May 8, 2024 08:42:27.484947920 CEST	52953	21	192.168.2.16	51.38.57.28
May 8, 2024 08:42:27.484950066 CEST	52880	2121	192.168.2.16	38.207.205.17
May 8, 2024 08:42:27.484954119 CEST	52881	21	192.168.2.16	50.109.87.151
May 8, 2024 08:42:27.547940016 CEST	52882	2121	192.168.2.16	50.109.87.151
May 8, 2024 08:42:27.567923069 CEST	52883	21	192.168.2.16	95.54.247.224
May 8, 2024 08:42:27.579926968 CEST	52884	2121	192.168.2.16	95.54.247.224
May 8, 2024 08:42:27.594486952 CEST	2121	53100	14.47.1.126	192.168.2.16
May 8, 2024 08:42:27.643944025 CEST	52886	21	192.168.2.16	100.2.146.222
May 8, 2024 08:42:27.659948111 CEST	52887	2121	192.168.2.16	100.2.146.222
May 8, 2024 08:42:27.738951921 CEST	52892	21	192.168.2.16	50.102.15.170
May 8, 2024 08:42:27.802925110 CEST	52893	2121	192.168.2.16	50.102.15.170
May 8, 2024 08:42:27.881944895 CEST	52895	21	192.168.2.16	109.96.226.101
May 8, 2024 08:42:27.931684971 CEST	52897	21	192.168.2.16	82.7.22.194
May 8, 2024 08:42:27.945960045 CEST	52898	2121	192.168.2.16	82.7.22.194
May 8, 2024 08:42:28.008938074 CEST	52901	21	192.168.2.16	80.29.79.134
May 8, 2024 08:42:28.056934118 CEST	52620	2121	192.168.2.16	62.140.135.146
May 8, 2024 08:42:28.057168961 CEST	52903	2121	192.168.2.16	80.29.79.134
May 8, 2024 08:42:28.072926998 CEST	52905	21	192.168.2.16	71.219.51.1
May 8, 2024 08:42:28.072937012 CEST	52904	2121	192.168.2.16	71.219.51.1
May 8, 2024 08:42:28.105623007 CEST	52622	21	192.168.2.16	62.140.135.146
May 8, 2024 08:42:28.105709076 CEST	52906	21	192.168.2.16	117.99.191.171
May 8, 2024 08:42:28.120951891 CEST	52907	2121	192.168.2.16	117.99.191.171
May 8, 2024 08:42:28.167933941 CEST	52908	21	192.168.2.16	198.72.168.160
May 8, 2024 08:42:28.241089106 CEST	21	52197	96.126.118.190	192.168.2.16
May 8, 2024 08:42:28.241122007 CEST	2121	52199	96.126.118.190	192.168.2.16
May 8, 2024 08:42:28.241148949 CEST	52197	21	192.168.2.16	96.126.118.190
May 8, 2024 08:42:28.241170883 CEST	52199	2121	192.168.2.16	96.126.118.190
May 8, 2024 08:42:28.327965975 CEST	52913	2121	192.168.2.16	198.72.168.160
May 8, 2024 08:42:28.421947956 CEST	52919	21	192.168.2.16	46.163.151.66
May 8, 2024 08:42:28.421962976 CEST	52918	21	192.168.2.16	95.88.100.53
May 8, 2024 08:42:28.421967983 CEST	52917	2121	192.168.2.16	46.163.151.66
May 8, 2024 08:42:28.433326006 CEST	21	52984	79.98.26.88	192.168.2.16
May 8, 2024 08:42:28.437941074 CEST	52921	2121	192.168.2.16	95.88.100.53
May 8, 2024 08:42:28.485929966 CEST	52984	21	192.168.2.16	79.98.26.88
May 8, 2024 08:42:28.549957991 CEST	52925	21	192.168.2.16	90.190.165.47
May 8, 2024 08:42:28.627078056 CEST	21	53000	120.24.160.35	192.168.2.16
May 8, 2024 08:42:28.661935091 CEST	52928	2121	192.168.2.16	90.190.165.47
May 8, 2024 08:42:28.661947012 CEST	52930	21	192.168.2.16	20.81.148.204
May 8, 2024 08:42:28.676958084 CEST	53000	21	192.168.2.16	120.24.160.35
May 8, 2024 08:42:28.692951918 CEST	52932	2121	192.168.2.16	20.81.148.204
May 8, 2024 08:42:28.771939993 CEST	52935	21	192.168.2.16	45.243.182.223
May 8, 2024 08:42:28.787954092 CEST	52937	21	192.168.2.16	178.70.228.49
May 8, 2024 08:42:28.794678926 CEST	21	52919	46.163.151.66	192.168.2.16
May 8, 2024 08:42:28.794897079 CEST	2121	52917	46.163.151.66	192.168.2.16
May 8, 2024 08:42:28.803935051 CEST	52936	2121	192.168.2.16	45.243.182.223
May 8, 2024 08:42:28.803937912 CEST	52940	2121	192.168.2.16	77.34.229.59
May 8, 2024 08:42:28.803937912 CEST	52939	21	192.168.2.16	77.34.229.59
May 8, 2024 08:42:28.818952084 CEST	52938	2121	192.168.2.16	178.70.228.49
May 8, 2024 08:42:28.820241928 CEST	52941	21	192.168.2.16	98.216.74.51
May 8, 2024 08:42:28.850954056 CEST	52942	2121	192.168.2.16	98.216.74.51
May 8, 2024 08:42:28.885706902 CEST	2121	51402	96.126.118.190	192.168.2.16
May 8, 2024 08:42:28.885720015 CEST	21	51399	96.126.118.190	192.168.2.16
May 8, 2024 08:42:28.885763884 CEST	51402	2121	192.168.2.16	96.126.118.190
May 8, 2024 08:42:28.886049986 CEST	51399	21	192.168.2.16	96.126.118.190
May 8, 2024 08:42:28.896927118 CEST	52944	21	192.168.2.16	193.115.118.112
May 8, 2024 08:42:28.898926020 CEST	52946	2121	192.168.2.16	193.115.118.112
May 8, 2024 08:42:28.939937115 CEST	52947	21	192.168.2.16	73.244.194.242
May 8, 2024 08:42:28.945971966 CEST	52948	2121	192.168.2.16	73.244.194.242
May 8, 2024 08:42:28.961937904 CEST	52950	2121	192.168.2.16	171.5.151.204
May 8, 2024 08:42:28.961941004 CEST	52951	21	192.168.2.16	112.145.29.138
May 8, 2024 08:42:28.977933884 CEST	52954	2121	192.168.2.16	112.145.29.138
May 8, 2024 08:42:29.024936914 CEST	52958	21	192.168.2.16	72.94.54.194
May 8, 2024 08:42:29.040945053 CEST	52959	2121	192.168.2.16	72.94.54.194
May 8, 2024 08:42:29.056962967 CEST	52961	21	192.168.2.16	62.74.64.79
May 8, 2024 08:42:29.059313059 CEST	52962	2121	192.168.2.16	62.74.64.79
May 8, 2024 08:42:29.087946892 CEST	52964	21	192.168.2.16	64.233.171.82
May 8, 2024 08:42:29.087950945 CEST	52966	2121	192.168.2.16	64.233.171.82
May 8, 2024 08:42:29.090039015 CEST	52967	21	192.168.2.16	95.108.21.236
May 8, 2024 08:42:29.103931904 CEST	52968	21	192.168.2.16	14.199.15.208
May 8, 2024 08:42:29.103933096 CEST	52969	2121	192.168.2.16	95.108.21.236
May 8, 2024 08:42:29.119951963 CEST	52972	21	192.168.2.16	81.40.86.11
May 8, 2024 08:42:29.119976044 CEST	52971	2121	192.168.2.16	14.199.15.208
May 8, 2024 08:42:29.119982004 CEST	52973	2121	192.168.2.16	81.40.86.11
May 8, 2024 08:42:29.119983912 CEST	52974	21	192.168.2.16	66.152.152.78
May 8, 2024 08:42:29.192929983 CEST	52976	2121	192.168.2.16	66.152.152.78
May 8, 2024 08:42:29.198934078 CEST	52977	21	192.168.2.16	102.39.31.115
May 8, 2024 08:42:29.205080986 CEST	21	52982	217.76.115.138	192.168.2.16
May 8, 2024 08:42:29.214946985 CEST	52978	2121	192.168.2.16	102.39.31.115
May 8, 2024 08:42:29.260946989 CEST	52982	21	192.168.2.16	217.76.115.138
May 8, 2024 08:42:29.276942015 CEST	52980	21	192.168.2.16	91.146.97.65
May 8, 2024 08:42:29.500942945 CEST	52996	21	192.168.2.16	69.244.200.119
May 8, 2024 08:42:29.516941071 CEST	52997	2121	192.168.2.16	69.244.200.119
May 8, 2024 08:42:29.532944918 CEST	52998	21	192.168.2.16	38.130.169.40
May 8, 2024 08:42:29.628933907 CEST	53002	2121	192.168.2.16	38.130.169.40
May 8, 2024 08:42:29.644948006 CEST	53004	2121	192.168.2.16	23.82.68.202
May 8, 2024 08:42:29.644948959 CEST	53003	21	192.168.2.16	23.82.68.202
May 8, 2024 08:42:29.660937071 CEST	53007	21	192.168.2.16	45.115.111.16
May 8, 2024 08:42:29.724925995 CEST	53015	21	192.168.2.16	76.132.33.233
May 8, 2024 08:42:29.724947929 CEST	53014	2121	192.168.2.16	45.115.111.16
May 8, 2024 08:42:29.740923882 CEST	53017	2121	192.168.2.16	76.132.33.233
May 8, 2024 08:42:29.772943020 CEST	53018	21	192.168.2.16	115.134.175.63
May 8, 2024 08:42:29.788939953 CEST	53021	2121	192.168.2.16	79.9.120.235
May 8, 2024 08:42:29.788949966 CEST	53019	2121	192.168.2.16	115.134.175.63
May 8, 2024 08:42:29.788953066 CEST	53020	21	192.168.2.16	79.9.120.235
May 8, 2024 08:42:29.948956013 CEST	53027	2121	192.168.2.16	120.224.128.120
May 8, 2024 08:42:30.113986969 CEST	2121	53013	96.126.118.190	192.168.2.16
May 8, 2024 08:42:30.114052057 CEST	53013	2121	192.168.2.16	96.126.118.190
May 8, 2024 08:42:30.140949965 CEST	53034	2121	192.168.2.16	154.95.173.67
May 8, 2024 08:42:30.141443014 CEST	53035	21	192.168.2.16	24.173.68.198
May 8, 2024 08:42:30.156939030 CEST	53039	2121	192.168.2.16	187.172.30.152
May 8, 2024 08:42:30.156955957 CEST	53040	21	192.168.2.16	5.251.87.3
May 8, 2024 08:42:30.156959057 CEST	53038	21	192.168.2.16	187.172.30.152
May 8, 2024 08:42:30.156966925 CEST	53037	2121	192.168.2.16	24.173.68.198
May 8, 2024 08:42:30.158052921 CEST	53041	2121	192.168.2.16	5.251.87.3
May 8, 2024 08:42:30.203953028 CEST	53042	21	192.168.2.16	80.139.29.120
May 8, 2024 08:42:30.203970909 CEST	53043	21	192.168.2.16	31.14.133.36
May 8, 2024 08:42:30.203972101 CEST	53044	2121	192.168.2.16	80.139.29.120
May 8, 2024 08:42:30.205672026 CEST	53045	2121	192.168.2.16	31.14.133.36
May 8, 2024 08:42:30.225075006 CEST	21	53010	96.126.118.190	192.168.2.16
May 8, 2024 08:42:30.225126982 CEST	53010	21	192.168.2.16	96.126.118.190
May 8, 2024 08:42:30.235929966 CEST	53047	2121	192.168.2.16	218.55.173.142
May 8, 2024 08:42:30.235944986 CEST	53046	21	192.168.2.16	218.55.173.142
May 8, 2024 08:42:30.267947912 CEST	53050	21	192.168.2.16	95.70.121.39
May 8, 2024 08:42:30.283948898 CEST	53052	2121	192.168.2.16	95.70.121.39
May 8, 2024 08:42:30.363935947 CEST	52340	21	192.168.2.16	62.140.135.146
May 8, 2024 08:42:30.364130974 CEST	52337	2121	192.168.2.16	62.140.135.146
May 8, 2024 08:42:30.427937031 CEST	53062	21	192.168.2.16	88.92.121.224
May 8, 2024 08:42:30.459953070 CEST	53063	2121	192.168.2.16	88.92.121.224
May 8, 2024 08:42:30.507952929 CEST	53066	2121	192.168.2.16	174.177.40.166
May 8, 2024 08:42:30.507958889 CEST	53067	21	192.168.2.16	174.177.40.166
May 8, 2024 08:42:30.587961912 CEST	53071	21	192.168.2.16	172.166.82.81
May 8, 2024 08:42:30.603943110 CEST	53072	2121	192.168.2.16	69.207.62.104
May 8, 2024 08:42:30.603943110 CEST	53078	2121	192.168.2.16	52.140.47.113
May 8, 2024 08:42:30.604197979 CEST	53073	2121	192.168.2.16	172.166.82.81
May 8, 2024 08:42:30.604197979 CEST	53076	21	192.168.2.16	52.140.47.113
May 8, 2024 08:42:30.604202032 CEST	53074	21	192.168.2.16	69.207.62.104
May 8, 2024 08:42:30.635967970 CEST	53081	2121	192.168.2.16	112.113.132.170
May 8, 2024 08:42:30.635998011 CEST	53079	21	192.168.2.16	112.113.132.170
May 8, 2024 08:42:30.651953936 CEST	53083	21	192.168.2.16	2.83.144.253
May 8, 2024 08:42:30.699945927 CEST	53086	2121	192.168.2.16	2.83.144.253
May 8, 2024 08:42:30.715950966 CEST	53087	21	192.168.2.16	111.229.201.52
May 8, 2024 08:42:30.748563051 CEST	53089	2121	192.168.2.16	111.229.201.52
May 8, 2024 08:42:33.077599049 CEST	21	51802	91.146.97.65	192.168.2.16
May 8, 2024 08:42:33.077647924 CEST	51802	21	192.168.2.16	91.146.97.65
May 8, 2024 08:42:33.147830963 CEST	21	52467	96.126.118.190	192.168.2.16
May 8, 2024 08:42:33.147845984 CEST	2121	52470	96.126.118.190	192.168.2.16
May 8, 2024 08:42:33.147883892 CEST	52467	21	192.168.2.16	96.126.118.190
May 8, 2024 08:42:33.147908926 CEST	52470	2121	192.168.2.16	96.126.118.190
May 8, 2024 08:42:33.780971050 CEST	53025	21	192.168.2.16	120.224.128.120
May 8, 2024 08:42:34.001161098 CEST	2121	51660	96.126.118.190	192.168.2.16
May 8, 2024 08:42:34.001214981 CEST	51660	2121	192.168.2.16	96.126.118.190
May 8, 2024 08:42:34.001303911 CEST	21	51654	96.126.118.190	192.168.2.16
May 8, 2024 08:42:34.001344919 CEST	51654	21	192.168.2.16	96.126.118.190
May 8, 2024 08:42:34.051945925 CEST	52815	2121	192.168.2.16	86.23.102.114
May 8, 2024 08:42:34.118062019 CEST	52818	21	192.168.2.16	160.237.79.186
May 8, 2024 08:42:34.130937099 CEST	52820	21	192.168.2.16	194.26.205.242
May 8, 2024 08:42:34.130964041 CEST	52819	2121	192.168.2.16	160.237.79.186
May 8, 2024 08:42:34.275904894 CEST	52822	2121	192.168.2.16	194.26.205.242
May 8, 2024 08:42:34.354947090 CEST	52824	2121	192.168.2.16	79.146.98.25
May 8, 2024 08:42:34.354959965 CEST	52823	21	192.168.2.16	79.146.98.25
May 8, 2024 08:42:34.514952898 CEST	52828	21	192.168.2.16	94.208.246.163
May 8, 2024 08:42:34.546960115 CEST	52829	2121	192.168.2.16	94.208.246.163
May 8, 2024 08:42:34.578959942 CEST	52832	2121	192.168.2.16	95.171.194.152
May 8, 2024 08:42:34.578962088 CEST	52831	21	192.168.2.16	95.171.194.152
May 8, 2024 08:42:34.586652040 CEST	21	53025	120.224.128.120	192.168.2.16
May 8, 2024 08:42:34.594944000 CEST	52833	2121	192.168.2.16	94.6.74.207
May 8, 2024 08:42:34.595177889 CEST	52834	21	192.168.2.16	94.6.74.207
May 8, 2024 08:42:34.610940933 CEST	52835	21	192.168.2.16	31.181.186.167
May 8, 2024 08:42:34.610955954 CEST	52838	2121	192.168.2.16	160.121.41.198
May 8, 2024 08:42:34.610955954 CEST	52839	21	192.168.2.16	78.186.180.252
May 8, 2024 08:42:34.612155914 CEST	52836	2121	192.168.2.16	31.181.186.167
May 8, 2024 08:42:34.658946991 CEST	52844	2121	192.168.2.16	52.137.122.207
May 8, 2024 08:42:34.658965111 CEST	52841	21	192.168.2.16	73.119.184.97
May 8, 2024 08:42:34.658967018 CEST	52840	2121	192.168.2.16	78.186.180.252
May 8, 2024 08:42:34.661039114 CEST	52843	21	192.168.2.16	52.137.122.207
May 8, 2024 08:42:34.673939943 CEST	52842	2121	192.168.2.16	73.119.184.97
May 8, 2024 08:42:34.689935923 CEST	52846	21	192.168.2.16	36.95.88.230
May 8, 2024 08:42:34.689949036 CEST	52848	21	192.168.2.16	24.170.119.218
May 8, 2024 08:42:34.689951897 CEST	52847	2121	192.168.2.16	36.95.88.230
May 8, 2024 08:42:34.705988884 CEST	52850	2121	192.168.2.16	24.170.119.218
May 8, 2024 08:42:34.894614935 CEST	52984	21	192.168.2.16	79.98.26.88
May 8, 2024 08:42:34.895237923 CEST	52960	21	192.168.2.16	46.34.34.117
May 8, 2024 08:42:34.895325899 CEST	52975	21	192.168.2.16	23.229.188.101
May 8, 2024 08:42:34.896119118 CEST	52933	21	192.168.2.16	117.223.205.236
May 8, 2024 08:42:34.896246910 CEST	52982	21	192.168.2.16	217.76.115.138
May 8, 2024 08:42:34.898099899 CEST	53010	21	192.168.2.16	96.126.118.190
May 8, 2024 08:42:34.900257111 CEST	52852	21	192.168.2.16	77.75.121.3
May 8, 2024 08:42:34.900424957 CEST	52916	21	192.168.2.16	62.140.135.146
May 8, 2024 08:42:34.901186943 CEST	53069	21	192.168.2.16	196.210.0.111
May 8, 2024 08:42:34.901379108 CEST	52953	21	192.168.2.16	51.38.57.28
May 8, 2024 08:42:34.901434898 CEST	53000	21	192.168.2.16	120.24.160.35
May 8, 2024 08:42:34.902796030 CEST	52821	21	192.168.2.16	38.38.120.85
May 8, 2024 08:42:34.903417110 CEST	53094	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:34.903521061 CEST	53013	2121	192.168.2.16	96.126.118.190
May 8, 2024 08:42:34.903536081 CEST	53092	21	192.168.2.16	197.26.33.147
May 8, 2024 08:42:34.903714895 CEST	52990	21	192.168.2.16	23.106.228.71
May 8, 2024 08:42:34.903875113 CEST	52915	2121	192.168.2.16	62.140.135.146
May 8, 2024 08:42:34.903939962 CEST	53059	21	192.168.2.16	172.120.235.139
May 8, 2024 08:42:34.904119015 CEST	53023	21	192.168.2.16	171.244.37.116
May 8, 2024 08:42:34.904161930 CEST	53097	2121	192.168.2.16	37.16.27.158
May 8, 2024 08:42:34.904321909 CEST	52992	21	192.168.2.16	86.51.153.63
May 8, 2024 08:42:34.904498100 CEST	53098	21	192.168.2.16	84.44.255.254
May 8, 2024 08:42:34.904541016 CEST	53095	21	192.168.2.16	37.16.27.158
May 8, 2024 08:42:34.904627085 CEST	53093	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:34.904782057 CEST	53013	2121	192.168.2.16	96.126.118.190
May 8, 2024 08:42:34.904820919 CEST	53101	21	192.168.2.16	79.98.26.88
May 8, 2024 08:42:34.904995918 CEST	53099	21	192.168.2.16	142.11.215.85
May 8, 2024 08:42:34.904997110 CEST	53010	21	192.168.2.16	96.126.118.190
May 8, 2024 08:42:34.905121088 CEST	53102	21	192.168.2.16	46.34.34.117
May 8, 2024 08:42:34.905121088 CEST	53091	21	192.168.2.16	38.14.189.177
May 8, 2024 08:42:34.905358076 CEST	53088	21	192.168.2.16	160.121.41.198
May 8, 2024 08:42:34.905380011 CEST	53103	21	192.168.2.16	23.229.188.101
May 8, 2024 08:42:34.905399084 CEST	53096	21	192.168.2.16	38.239.154.176
May 8, 2024 08:42:34.905450106 CEST	53104	21	192.168.2.16	91.146.97.65
May 8, 2024 08:42:34.905570984 CEST	53105	21	192.168.2.16	117.223.205.236
May 8, 2024 08:42:34.905610085 CEST	53106	21	192.168.2.16	77.75.121.3
May 8, 2024 08:42:34.905689955 CEST	53107	21	192.168.2.16	217.76.115.138
May 8, 2024 08:42:34.905759096 CEST	53108	21	192.168.2.16	120.24.160.35
May 8, 2024 08:42:34.905817986 CEST	53109	21	192.168.2.16	62.140.135.146
May 8, 2024 08:42:34.905885935 CEST	53110	2121	192.168.2.16	38.207.205.17
May 8, 2024 08:42:34.905939102 CEST	53111	21	192.168.2.16	115.17.145.232
May 8, 2024 08:42:34.905951023 CEST	53112	21	192.168.2.16	23.106.228.71
May 8, 2024 08:42:34.906021118 CEST	53113	21	192.168.2.16	38.207.205.17
May 8, 2024 08:42:34.906063080 CEST	53114	2121	192.168.2.16	62.140.135.146
May 8, 2024 08:42:34.906191111 CEST	53115	21	192.168.2.16	172.120.235.139
May 8, 2024 08:42:34.906217098 CEST	53116	21	192.168.2.16	51.38.57.28
May 8, 2024 08:42:34.906356096 CEST	53117	21	192.168.2.16	38.38.120.85
May 8, 2024 08:42:34.906394958 CEST	53118	21	192.168.2.16	86.51.153.63
May 8, 2024 08:42:34.906426907 CEST	53119	2121	192.168.2.16	37.16.27.158
May 8, 2024 08:42:34.906533957 CEST	53120	21	192.168.2.16	197.26.33.147
May 8, 2024 08:42:34.906574011 CEST	53121	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:34.906641960 CEST	53122	21	192.168.2.16	84.44.255.254
May 8, 2024 08:42:34.906713009 CEST	53123	21	192.168.2.16	171.244.37.116
May 8, 2024 08:42:34.906721115 CEST	53124	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:34.906796932 CEST	53125	2121	192.168.2.16	96.126.118.190
May 8, 2024 08:42:34.906852007 CEST	53126	21	192.168.2.16	96.126.118.190
May 8, 2024 08:42:34.906862020 CEST	53127	21	192.168.2.16	37.16.27.158
May 8, 2024 08:42:34.907375097 CEST	53128	2121	192.168.2.16	115.17.145.232
May 8, 2024 08:42:34.909050941 CEST	53129	21	192.168.2.16	105.216.108.87
May 8, 2024 08:42:34.909198046 CEST	53130	2121	192.168.2.16	105.216.108.87
May 8, 2024 08:42:34.909224033 CEST	53131	21	192.168.2.16	171.226.169.252
May 8, 2024 08:42:34.909332037 CEST	53132	2121	192.168.2.16	171.226.169.252
May 8, 2024 08:42:34.909390926 CEST	53133	21	192.168.2.16	150.147.112.54
May 8, 2024 08:42:34.909452915 CEST	53134	2121	192.168.2.16	150.147.112.54
May 8, 2024 08:42:34.909495115 CEST	53135	21	192.168.2.16	160.169.130.232
May 8, 2024 08:42:34.909534931 CEST	53136	2121	192.168.2.16	160.169.130.232
May 8, 2024 08:42:34.909612894 CEST	53137	21	192.168.2.16	211.21.23.232
May 8, 2024 08:42:34.909661055 CEST	53138	2121	192.168.2.16	211.21.23.232
May 8, 2024 08:42:34.909734011 CEST	53139	21	192.168.2.16	73.51.251.56
May 8, 2024 08:42:34.909763098 CEST	53140	2121	192.168.2.16	73.51.251.56
May 8, 2024 08:42:34.909862041 CEST	53141	2121	192.168.2.16	190.57.210.15
May 8, 2024 08:42:34.909883022 CEST	53142	21	192.168.2.16	190.57.210.15
May 8, 2024 08:42:34.910059929 CEST	53143	21	192.168.2.16	94.21.184.140
May 8, 2024 08:42:34.910113096 CEST	53144	2121	192.168.2.16	94.21.184.140
May 8, 2024 08:42:34.910192013 CEST	53145	21	192.168.2.16	114.84.185.193
May 8, 2024 08:42:34.910221100 CEST	53146	2121	192.168.2.16	114.84.185.193
May 8, 2024 08:42:34.910310984 CEST	53147	21	192.168.2.16	162.55.133.234
May 8, 2024 08:42:34.910346985 CEST	53148	2121	192.168.2.16	162.55.133.234
May 8, 2024 08:42:34.910409927 CEST	53149	21	192.168.2.16	150.109.254.101
May 8, 2024 08:42:34.910470009 CEST	53150	2121	192.168.2.16	150.109.254.101
May 8, 2024 08:42:34.910487890 CEST	53151	21	192.168.2.16	95.158.183.229
May 8, 2024 08:42:34.910556078 CEST	53152	2121	192.168.2.16	95.158.183.229
May 8, 2024 08:42:34.910698891 CEST	53153	21	192.168.2.16	174.87.240.88
May 8, 2024 08:42:34.910722017 CEST	53154	2121	192.168.2.16	174.87.240.88
May 8, 2024 08:42:34.910784960 CEST	53155	21	192.168.2.16	69.140.176.86
May 8, 2024 08:42:34.910832882 CEST	53156	2121	192.168.2.16	69.140.176.86
May 8, 2024 08:42:34.910896063 CEST	53157	21	192.168.2.16	82.183.51.114
May 8, 2024 08:42:34.910950899 CEST	53158	2121	192.168.2.16	82.183.51.114
May 8, 2024 08:42:34.910974979 CEST	53159	21	192.168.2.16	202.186.239.174
May 8, 2024 08:42:34.911015034 CEST	53160	2121	192.168.2.16	202.186.239.174
May 8, 2024 08:42:34.911112070 CEST	53161	21	192.168.2.16	75.80.230.16
May 8, 2024 08:42:34.911133051 CEST	53162	2121	192.168.2.16	75.80.230.16
May 8, 2024 08:42:34.911254883 CEST	53164	2121	192.168.2.16	50.47.186.20
May 8, 2024 08:42:34.911256075 CEST	53163	21	192.168.2.16	50.47.186.20
May 8, 2024 08:42:34.911271095 CEST	53165	21	192.168.2.16	87.10.177.248
May 8, 2024 08:42:34.911294937 CEST	53166	2121	192.168.2.16	87.10.177.248
May 8, 2024 08:42:34.911420107 CEST	53167	21	192.168.2.16	71.230.245.143
May 8, 2024 08:42:34.911458969 CEST	53168	2121	192.168.2.16	71.230.245.143
May 8, 2024 08:42:34.911504030 CEST	53169	21	192.168.2.16	69.202.179.175
May 8, 2024 08:42:34.911582947 CEST	53170	2121	192.168.2.16	69.202.179.175
May 8, 2024 08:42:34.911623955 CEST	53171	21	192.168.2.16	187.214.174.56
May 8, 2024 08:42:34.911704063 CEST	53172	2121	192.168.2.16	187.214.174.56
May 8, 2024 08:42:34.911848068 CEST	53173	21	192.168.2.16	141.140.5.87
May 8, 2024 08:42:34.911905050 CEST	53174	21	192.168.2.16	47.41.226.216
May 8, 2024 08:42:34.911953926 CEST	53175	2121	192.168.2.16	141.140.5.87
May 8, 2024 08:42:34.911999941 CEST	53176	2121	192.168.2.16	47.41.226.216
May 8, 2024 08:42:34.912067890 CEST	53177	21	192.168.2.16	178.205.184.119
May 8, 2024 08:42:34.912115097 CEST	53178	2121	192.168.2.16	178.205.184.119
May 8, 2024 08:42:34.912166119 CEST	53179	21	192.168.2.16	189.176.111.218
May 8, 2024 08:42:34.912221909 CEST	53180	2121	192.168.2.16	189.176.111.218
May 8, 2024 08:42:34.912261009 CEST	53181	21	192.168.2.16	5.232.137.30
May 8, 2024 08:42:34.912319899 CEST	53182	2121	192.168.2.16	5.232.137.30
May 8, 2024 08:42:34.912359953 CEST	53183	21	192.168.2.16	77.56.187.179
May 8, 2024 08:42:34.912419081 CEST	53184	2121	192.168.2.16	77.56.187.179
May 8, 2024 08:42:34.912444115 CEST	53185	21	192.168.2.16	173.231.211.98
May 8, 2024 08:42:34.912494898 CEST	53186	2121	192.168.2.16	173.231.211.98
May 8, 2024 08:42:34.912585020 CEST	53187	21	192.168.2.16	147.158.187.113
May 8, 2024 08:42:34.912615061 CEST	53188	2121	192.168.2.16	147.158.187.113
May 8, 2024 08:42:34.912727118 CEST	53189	21	192.168.2.16	121.189.84.215
May 8, 2024 08:42:34.912782907 CEST	53190	21	192.168.2.16	94.142.18.22
May 8, 2024 08:42:34.912843943 CEST	53191	2121	192.168.2.16	121.189.84.215
May 8, 2024 08:42:34.912877083 CEST	53192	2121	192.168.2.16	94.142.18.22
May 8, 2024 08:42:34.912884951 CEST	53193	21	192.168.2.16	27.64.230.117
May 8, 2024 08:42:34.913048983 CEST	53194	21	192.168.2.16	189.222.80.254
May 8, 2024 08:42:34.913070917 CEST	53195	2121	192.168.2.16	27.64.230.117
May 8, 2024 08:42:34.913141012 CEST	53196	2121	192.168.2.16	189.222.80.254
May 8, 2024 08:42:34.913177967 CEST	53197	21	192.168.2.16	151.229.219.57
May 8, 2024 08:42:34.913234949 CEST	53198	2121	192.168.2.16	151.229.219.57
May 8, 2024 08:42:34.913292885 CEST	53199	21	192.168.2.16	17.253.60.163
May 8, 2024 08:42:34.913413048 CEST	53201	21	192.168.2.16	84.105.87.174
May 8, 2024 08:42:34.913414001 CEST	53200	2121	192.168.2.16	17.253.60.163
May 8, 2024 08:42:34.913424015 CEST	53202	2121	192.168.2.16	84.105.87.174
May 8, 2024 08:42:34.913486958 CEST	53203	21	192.168.2.16	37.20.197.249
May 8, 2024 08:42:34.913634062 CEST	53204	21	192.168.2.16	189.133.90.43
May 8, 2024 08:42:34.913693905 CEST	53205	2121	192.168.2.16	37.20.197.249
May 8, 2024 08:42:34.913764954 CEST	53206	2121	192.168.2.16	189.133.90.43
May 8, 2024 08:42:34.913841963 CEST	53207	21	192.168.2.16	87.206.14.113
May 8, 2024 08:42:34.913867950 CEST	53208	2121	192.168.2.16	87.206.14.113
May 8, 2024 08:42:34.913913965 CEST	53209	21	192.168.2.16	121.139.242.180
May 8, 2024 08:42:34.914001942 CEST	53210	21	192.168.2.16	75.135.220.14
May 8, 2024 08:42:34.914048910 CEST	53211	2121	192.168.2.16	121.139.242.180
May 8, 2024 08:42:34.914170027 CEST	53212	2121	192.168.2.16	75.135.220.14
May 8, 2024 08:42:34.914191961 CEST	53213	21	192.168.2.16	42.119.153.154
May 8, 2024 08:42:34.914199114 CEST	53214	2121	192.168.2.16	42.119.153.154
May 8, 2024 08:42:34.914362907 CEST	53215	21	192.168.2.16	4.68.15.130
May 8, 2024 08:42:34.914407015 CEST	53216	2121	192.168.2.16	4.68.15.130
May 8, 2024 08:42:34.914449930 CEST	53217	21	192.168.2.16	81.100.234.50
May 8, 2024 08:42:34.914505959 CEST	53218	2121	192.168.2.16	81.100.234.50
May 8, 2024 08:42:34.914526939 CEST	53219	21	192.168.2.16	68.33.75.237
May 8, 2024 08:42:34.914547920 CEST	53220	2121	192.168.2.16	68.33.75.237
May 8, 2024 08:42:34.914681911 CEST	53221	21	192.168.2.16	36.161.237.83
May 8, 2024 08:42:34.914729118 CEST	53222	2121	192.168.2.16	36.161.237.83
May 8, 2024 08:42:34.914772034 CEST	53223	21	192.168.2.16	64.159.228.137
May 8, 2024 08:42:34.914849043 CEST	53224	2121	192.168.2.16	64.159.228.137
May 8, 2024 08:42:34.914901972 CEST	53225	21	192.168.2.16	115.230.183.40
May 8, 2024 08:42:34.914968967 CEST	53226	21	192.168.2.16	220.122.203.4
May 8, 2024 08:42:34.915004015 CEST	53227	2121	192.168.2.16	115.230.183.40
May 8, 2024 08:42:34.915080070 CEST	53228	2121	192.168.2.16	220.122.203.4
May 8, 2024 08:42:34.915128946 CEST	53229	21	192.168.2.16	41.225.74.220
May 8, 2024 08:42:34.915220976 CEST	53230	2121	192.168.2.16	41.225.74.220
May 8, 2024 08:42:34.915266991 CEST	53231	21	192.168.2.16	94.174.128.154
May 8, 2024 08:42:34.915303946 CEST	53232	2121	192.168.2.16	94.174.128.154
May 8, 2024 08:42:34.915402889 CEST	53233	2121	192.168.2.16	180.102.224.9
May 8, 2024 08:42:34.915453911 CEST	53234	21	192.168.2.16	180.102.224.9
May 8, 2024 08:42:34.915504932 CEST	53235	21	192.168.2.16	75.167.159.244
May 8, 2024 08:42:34.915571928 CEST	53236	2121	192.168.2.16	75.167.159.244
May 8, 2024 08:42:34.915637970 CEST	53237	21	192.168.2.16	121.179.190.212
May 8, 2024 08:42:34.915935993 CEST	53238	21	192.168.2.16	189.141.100.126
May 8, 2024 08:42:34.916006088 CEST	53239	2121	192.168.2.16	121.179.190.212
May 8, 2024 08:42:34.916039944 CEST	53240	2121	192.168.2.16	189.141.100.126
May 8, 2024 08:42:34.916169882 CEST	53241	21	192.168.2.16	112.186.203.157
May 8, 2024 08:42:34.916198969 CEST	53242	2121	192.168.2.16	112.186.203.157
May 8, 2024 08:42:34.916321039 CEST	53243	2121	192.168.2.16	60.53.52.149
May 8, 2024 08:42:34.916344881 CEST	53244	21	192.168.2.16	60.53.52.149
May 8, 2024 08:42:34.916420937 CEST	53245	21	192.168.2.16	136.239.122.65
May 8, 2024 08:42:34.916440010 CEST	53246	2121	192.168.2.16	136.239.122.65
May 8, 2024 08:42:34.916505098 CEST	53247	21	192.168.2.16	94.15.231.2
May 8, 2024 08:42:34.916610956 CEST	53248	2121	192.168.2.16	94.15.231.2
May 8, 2024 08:42:34.916680098 CEST	53249	2121	192.168.2.16	108.34.250.148
May 8, 2024 08:42:34.916702986 CEST	53250	21	192.168.2.16	108.34.250.148
May 8, 2024 08:42:34.916816950 CEST	53251	21	192.168.2.16	201.108.156.56
May 8, 2024 08:42:34.916860104 CEST	53252	2121	192.168.2.16	201.108.156.56
May 8, 2024 08:42:34.916915894 CEST	53253	21	192.168.2.16	123.109.161.86
May 8, 2024 08:42:34.916976929 CEST	53254	2121	192.168.2.16	123.109.161.86
May 8, 2024 08:42:34.917018890 CEST	53255	21	192.168.2.16	202.14.90.141
May 8, 2024 08:42:34.917092085 CEST	53256	2121	192.168.2.16	202.14.90.141
May 8, 2024 08:42:34.917152882 CEST	53257	21	192.168.2.16	69.245.57.207
May 8, 2024 08:42:34.917187929 CEST	53258	2121	192.168.2.16	69.245.57.207
May 8, 2024 08:42:34.917247057 CEST	53259	21	192.168.2.16	129.94.254.25
May 8, 2024 08:42:34.917310953 CEST	53260	2121	192.168.2.16	129.94.254.25
May 8, 2024 08:42:34.917359114 CEST	53261	21	192.168.2.16	66.78.9.249
May 8, 2024 08:42:34.917411089 CEST	53262	2121	192.168.2.16	66.78.9.249
May 8, 2024 08:42:34.917455912 CEST	53263	21	192.168.2.16	175.234.190.98
May 8, 2024 08:42:34.917511940 CEST	53264	2121	192.168.2.16	175.234.190.98
May 8, 2024 08:42:34.917566061 CEST	53265	21	192.168.2.16	109.164.35.221
May 8, 2024 08:42:34.917608976 CEST	53266	2121	192.168.2.16	109.164.35.221
May 8, 2024 08:42:34.917685032 CEST	53267	21	192.168.2.16	40.114.50.42
May 8, 2024 08:42:34.917725086 CEST	53268	2121	192.168.2.16	40.114.50.42
May 8, 2024 08:42:34.917784929 CEST	53269	21	192.168.2.16	68.49.215.89
May 8, 2024 08:42:34.917830944 CEST	53270	2121	192.168.2.16	68.49.215.89
May 8, 2024 08:42:34.917895079 CEST	53271	21	192.168.2.16	157.125.133.197
May 8, 2024 08:42:34.917941093 CEST	53272	2121	192.168.2.16	157.125.133.197
May 8, 2024 08:42:34.918040991 CEST	53273	21	192.168.2.16	194.208.143.224
May 8, 2024 08:42:34.918106079 CEST	53274	2121	192.168.2.16	194.208.143.224
May 8, 2024 08:42:34.918128967 CEST	53275	21	192.168.2.16	101.3.55.68
May 8, 2024 08:42:34.918154001 CEST	53276	2121	192.168.2.16	101.3.55.68
May 8, 2024 08:42:34.918253899 CEST	53277	21	192.168.2.16	171.239.194.133
May 8, 2024 08:42:34.918291092 CEST	53278	2121	192.168.2.16	171.239.194.133
May 8, 2024 08:42:34.918292999 CEST	53279	21	192.168.2.16	71.233.14.181
May 8, 2024 08:42:34.918397903 CEST	53280	21	192.168.2.16	171.14.96.40
May 8, 2024 08:42:34.918428898 CEST	53281	2121	192.168.2.16	71.233.14.181
May 8, 2024 08:42:34.918448925 CEST	53282	2121	192.168.2.16	171.14.96.40
May 8, 2024 08:42:34.918584108 CEST	53283	21	192.168.2.16	88.22.24.213
May 8, 2024 08:42:34.918626070 CEST	53284	2121	192.168.2.16	88.22.24.213
May 8, 2024 08:42:34.918648958 CEST	53285	21	192.168.2.16	107.12.137.134
May 8, 2024 08:42:34.918719053 CEST	53286	2121	192.168.2.16	107.12.137.134
May 8, 2024 08:42:34.918766022 CEST	53287	21	192.168.2.16	73.128.150.87
May 8, 2024 08:42:34.918792009 CEST	53288	2121	192.168.2.16	73.128.150.87
May 8, 2024 08:42:34.918910980 CEST	53289	21	192.168.2.16	145.126.30.12
May 8, 2024 08:42:34.918998003 CEST	53290	21	192.168.2.16	35.187.254.145
May 8, 2024 08:42:34.919044971 CEST	53291	2121	192.168.2.16	145.126.30.12
May 8, 2024 08:42:34.919068098 CEST	53292	2121	192.168.2.16	35.187.254.145
May 8, 2024 08:42:34.919131994 CEST	53293	21	192.168.2.16	173.70.214.62
May 8, 2024 08:42:34.919162035 CEST	53294	2121	192.168.2.16	173.70.214.62
May 8, 2024 08:42:34.919198990 CEST	53295	21	192.168.2.16	110.7.34.230
May 8, 2024 08:42:35.065658092 CEST	2121	53094	34.149.79.8	192.168.2.16
May 8, 2024 08:42:35.066328049 CEST	2121	53097	37.16.27.158	192.168.2.16
May 8, 2024 08:42:35.066714048 CEST	21	53095	37.16.27.158	192.168.2.16
May 8, 2024 08:42:35.066967964 CEST	21	53093	34.149.79.8	192.168.2.16
May 8, 2024 08:42:35.068583965 CEST	2121	53119	37.16.27.158	192.168.2.16
May 8, 2024 08:42:35.068650961 CEST	2121	53121	34.149.79.8	192.168.2.16
May 8, 2024 08:42:35.068662882 CEST	53119	2121	192.168.2.16	37.16.27.158
May 8, 2024 08:42:35.068702936 CEST	53121	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:35.069072962 CEST	21	53127	37.16.27.158	192.168.2.16
May 8, 2024 08:42:35.069114923 CEST	21	53124	34.149.79.8	192.168.2.16
May 8, 2024 08:42:35.069127083 CEST	53127	21	192.168.2.16	37.16.27.158
May 8, 2024 08:42:35.069164991 CEST	53124	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:35.085678101 CEST	21	53059	172.120.235.139	192.168.2.16
May 8, 2024 08:42:35.085730076 CEST	53059	21	192.168.2.16	172.120.235.139
May 8, 2024 08:42:35.087876081 CEST	21	53115	172.120.235.139	192.168.2.16
May 8, 2024 08:42:35.087955952 CEST	53115	21	192.168.2.16	172.120.235.139
May 8, 2024 08:42:35.090061903 CEST	21	53091	38.14.189.177	192.168.2.16
May 8, 2024 08:42:35.090132952 CEST	21	53091	38.14.189.177	192.168.2.16
May 8, 2024 08:42:35.090253115 CEST	53091	21	192.168.2.16	38.14.189.177
May 8, 2024 08:42:35.095081091 CEST	21	52821	38.38.120.85	192.168.2.16
May 8, 2024 08:42:35.095139980 CEST	52821	21	192.168.2.16	38.38.120.85
May 8, 2024 08:42:35.095475912 CEST	21	52821	38.38.120.85	192.168.2.16
May 8, 2024 08:42:35.095520020 CEST	52821	21	192.168.2.16	38.38.120.85
May 8, 2024 08:42:35.095851898 CEST	21	53117	38.38.120.85	192.168.2.16
May 8, 2024 08:42:35.096853018 CEST	21	52975	23.229.188.101	192.168.2.16
May 8, 2024 08:42:35.096982002 CEST	52975	21	192.168.2.16	23.229.188.101
May 8, 2024 08:42:35.097846985 CEST	21	52975	23.229.188.101	192.168.2.16
May 8, 2024 08:42:35.097877026 CEST	53117	21	192.168.2.16	38.38.120.85
May 8, 2024 08:42:35.097888947 CEST	52975	21	192.168.2.16	23.229.188.101
May 8, 2024 08:42:35.104034901 CEST	21	53010	96.126.118.190	192.168.2.16
May 8, 2024 08:42:35.105750084 CEST	21	53103	23.229.188.101	192.168.2.16
May 8, 2024 08:42:35.105824947 CEST	53103	21	192.168.2.16	23.229.188.101
May 8, 2024 08:42:35.109388113 CEST	2121	53013	96.126.118.190	192.168.2.16
May 8, 2024 08:42:35.110629082 CEST	2121	53013	96.126.118.190	192.168.2.16
May 8, 2024 08:42:35.110831022 CEST	21	53010	96.126.118.190	192.168.2.16
May 8, 2024 08:42:35.113014936 CEST	2121	53125	96.126.118.190	192.168.2.16
May 8, 2024 08:42:35.113080978 CEST	21	53126	96.126.118.190	192.168.2.16
May 8, 2024 08:42:35.113094091 CEST	53125	2121	192.168.2.16	96.126.118.190
May 8, 2024 08:42:35.113132954 CEST	53126	21	192.168.2.16	96.126.118.190
May 8, 2024 08:42:35.114124060 CEST	21	53099	142.11.215.85	192.168.2.16
May 8, 2024 08:42:35.114253044 CEST	53099	21	192.168.2.16	142.11.215.85
May 8, 2024 08:42:35.144670010 CEST	21	53185	173.231.211.98	192.168.2.16
May 8, 2024 08:42:35.144742966 CEST	53185	21	192.168.2.16	173.231.211.98
May 8, 2024 08:42:35.196624041 CEST	21	52990	23.106.228.71	192.168.2.16
May 8, 2024 08:42:35.196708918 CEST	52990	21	192.168.2.16	23.106.228.71
May 8, 2024 08:42:35.198673964 CEST	21	53112	23.106.228.71	192.168.2.16
May 8, 2024 08:42:35.198766947 CEST	53112	21	192.168.2.16	23.106.228.71
May 8, 2024 08:42:35.204715967 CEST	2121	53254	123.109.161.86	192.168.2.16
May 8, 2024 08:42:35.206759930 CEST	21	53096	38.239.154.176	192.168.2.16
May 8, 2024 08:42:35.206849098 CEST	21	53096	38.239.154.176	192.168.2.16
May 8, 2024 08:42:35.207020998 CEST	53096	21	192.168.2.16	38.239.154.176
May 8, 2024 08:42:35.220160007 CEST	21	52953	51.38.57.28	192.168.2.16
May 8, 2024 08:42:35.220231056 CEST	52953	21	192.168.2.16	51.38.57.28
May 8, 2024 08:42:35.220382929 CEST	21	53098	84.44.255.254	192.168.2.16
May 8, 2024 08:42:35.221031904 CEST	21	52953	51.38.57.28	192.168.2.16
May 8, 2024 08:42:35.221076965 CEST	52953	21	192.168.2.16	51.38.57.28
May 8, 2024 08:42:35.221148014 CEST	21	53116	51.38.57.28	192.168.2.16
May 8, 2024 08:42:35.221206903 CEST	53116	21	192.168.2.16	51.38.57.28
May 8, 2024 08:42:35.225908041 CEST	21	53122	84.44.255.254	192.168.2.16
May 8, 2024 08:42:35.226043940 CEST	53122	21	192.168.2.16	84.44.255.254
May 8, 2024 08:42:35.226413965 CEST	2121	53211	121.139.242.180	192.168.2.16
May 8, 2024 08:42:35.227535009 CEST	21	53253	123.109.161.86	192.168.2.16
May 8, 2024 08:42:35.230866909 CEST	2121	53121	34.149.79.8	192.168.2.16
May 8, 2024 08:42:35.230947018 CEST	53121	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:35.231008053 CEST	53121	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:35.231084108 CEST	2121	53119	37.16.27.158	192.168.2.16
May 8, 2024 08:42:35.231137991 CEST	53119	2121	192.168.2.16	37.16.27.158
May 8, 2024 08:42:35.231225014 CEST	53119	2121	192.168.2.16	37.16.27.158
May 8, 2024 08:42:35.231270075 CEST	53296	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:35.231293917 CEST	21	53109	62.140.135.146	192.168.2.16
May 8, 2024 08:42:35.231357098 CEST	53109	21	192.168.2.16	62.140.135.146
May 8, 2024 08:42:35.231399059 CEST	2121	53114	62.140.135.146	192.168.2.16
May 8, 2024 08:42:35.231460094 CEST	53297	2121	192.168.2.16	37.16.27.158
May 8, 2024 08:42:35.231461048 CEST	53114	2121	192.168.2.16	62.140.135.146
May 8, 2024 08:42:35.231466055 CEST	21	53127	37.16.27.158	192.168.2.16
May 8, 2024 08:42:35.231518984 CEST	53127	21	192.168.2.16	37.16.27.158
May 8, 2024 08:42:35.231560946 CEST	53127	21	192.168.2.16	37.16.27.158
May 8, 2024 08:42:35.231694937 CEST	53298	21	192.168.2.16	37.16.27.158
May 8, 2024 08:42:35.231816053 CEST	21	53124	34.149.79.8	192.168.2.16
May 8, 2024 08:42:35.231870890 CEST	53124	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:35.231905937 CEST	53124	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:35.232007980 CEST	53299	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:35.233123064 CEST	21	53209	121.139.242.180	192.168.2.16
May 8, 2024 08:42:35.235482931 CEST	2121	53264	175.234.190.98	192.168.2.16
May 8, 2024 08:42:35.235809088 CEST	21	53143	94.21.184.140	192.168.2.16
May 8, 2024 08:42:35.236498117 CEST	2121	53150	150.109.254.101	192.168.2.16
May 8, 2024 08:42:35.237116098 CEST	21	52960	46.34.34.117	192.168.2.16
May 8, 2024 08:42:35.237173080 CEST	21	53149	150.109.254.101	192.168.2.16
May 8, 2024 08:42:35.237184048 CEST	52960	21	192.168.2.16	46.34.34.117
May 8, 2024 08:42:35.238970995 CEST	21	53263	175.234.190.98	192.168.2.16
May 8, 2024 08:42:35.238982916 CEST	21	53102	46.34.34.117	192.168.2.16
May 8, 2024 08:42:35.239044905 CEST	53102	21	192.168.2.16	46.34.34.117
May 8, 2024 08:42:35.240118980 CEST	21	53101	79.98.26.88	192.168.2.16
May 8, 2024 08:42:35.240173101 CEST	53101	21	192.168.2.16	79.98.26.88
May 8, 2024 08:42:35.243813038 CEST	21	53088	160.121.41.198	192.168.2.16
May 8, 2024 08:42:35.243822098 CEST	21	53088	160.121.41.198	192.168.2.16
May 8, 2024 08:42:35.243932962 CEST	53088	21	192.168.2.16	160.121.41.198
May 8, 2024 08:42:35.247606039 CEST	21	53107	217.76.115.138	192.168.2.16
May 8, 2024 08:42:35.247680902 CEST	53107	21	192.168.2.16	217.76.115.138
May 8, 2024 08:42:35.249603987 CEST	2121	53266	109.164.35.221	192.168.2.16
May 8, 2024 08:42:35.249619007 CEST	21	53265	109.164.35.221	192.168.2.16
May 8, 2024 08:42:35.249912024 CEST	21	53108	120.24.160.35	192.168.2.16
May 8, 2024 08:42:35.249974966 CEST	53108	21	192.168.2.16	120.24.160.35
May 8, 2024 08:42:35.250206947 CEST	2121	53141	190.57.210.15	192.168.2.16
May 8, 2024 08:42:35.251117945 CEST	2121	53144	94.21.184.140	192.168.2.16
May 8, 2024 08:42:35.252305984 CEST	2121	53158	82.183.51.114	192.168.2.16
May 8, 2024 08:42:35.253067970 CEST	21	53157	82.183.51.114	192.168.2.16
May 8, 2024 08:42:35.254489899 CEST	21	53213	42.119.153.154	192.168.2.16
May 8, 2024 08:42:35.255556107 CEST	2121	53214	42.119.153.154	192.168.2.16
May 8, 2024 08:42:35.255568981 CEST	21	53023	171.244.37.116	192.168.2.16
May 8, 2024 08:42:35.255578995 CEST	21	53023	171.244.37.116	192.168.2.16
May 8, 2024 08:42:35.255623102 CEST	53023	21	192.168.2.16	171.244.37.116
May 8, 2024 08:42:35.274216890 CEST	21	53123	171.244.37.116	192.168.2.16
May 8, 2024 08:42:35.274291039 CEST	53123	21	192.168.2.16	171.244.37.116
May 8, 2024 08:42:35.276563883 CEST	2121	53178	178.205.184.119	192.168.2.16
May 8, 2024 08:42:35.285454035 CEST	21	53092	197.26.33.147	192.168.2.16
May 8, 2024 08:42:35.286978960 CEST	21	53091	38.14.189.177	192.168.2.16
May 8, 2024 08:42:35.287128925 CEST	53091	21	192.168.2.16	38.14.189.177
May 8, 2024 08:42:35.287211895 CEST	2121	53188	147.158.187.113	192.168.2.16
May 8, 2024 08:42:35.287374973 CEST	53300	21	192.168.2.16	38.14.189.177
May 8, 2024 08:42:35.287749052 CEST	21	53091	38.14.189.177	192.168.2.16
May 8, 2024 08:42:35.287797928 CEST	53091	21	192.168.2.16	38.14.189.177
May 8, 2024 08:42:35.288954020 CEST	21	53120	197.26.33.147	192.168.2.16
May 8, 2024 08:42:35.289016962 CEST	53120	21	192.168.2.16	197.26.33.147
May 8, 2024 08:42:35.289225101 CEST	21	53117	38.38.120.85	192.168.2.16
May 8, 2024 08:42:35.289355993 CEST	53117	21	192.168.2.16	38.38.120.85
May 8, 2024 08:42:35.290707111 CEST	21	53118	86.51.153.63	192.168.2.16
May 8, 2024 08:42:35.290760040 CEST	53118	21	192.168.2.16	86.51.153.63
May 8, 2024 08:42:35.292180061 CEST	21	52992	86.51.153.63	192.168.2.16
May 8, 2024 08:42:35.292232037 CEST	52992	21	192.168.2.16	86.51.153.63
May 8, 2024 08:42:35.301373005 CEST	21	53113	38.207.205.17	192.168.2.16
May 8, 2024 08:42:35.304722071 CEST	21	53115	172.120.235.139	192.168.2.16
May 8, 2024 08:42:35.304857016 CEST	53115	21	192.168.2.16	172.120.235.139
May 8, 2024 08:42:35.307465076 CEST	21	53103	23.229.188.101	192.168.2.16
May 8, 2024 08:42:35.307579994 CEST	53103	21	192.168.2.16	23.229.188.101
May 8, 2024 08:42:35.312386036 CEST	21	53229	41.225.74.220	192.168.2.16
May 8, 2024 08:42:35.312458992 CEST	53229	21	192.168.2.16	41.225.74.220
May 8, 2024 08:42:35.324053049 CEST	21	53099	142.11.215.85	192.168.2.16
May 8, 2024 08:42:35.324189901 CEST	53099	21	192.168.2.16	142.11.215.85
May 8, 2024 08:42:35.324358940 CEST	53301	21	192.168.2.16	142.11.215.85
May 8, 2024 08:42:35.359059095 CEST	2121	53182	5.232.137.30	192.168.2.16
May 8, 2024 08:42:35.383240938 CEST	21	53069	196.210.0.111	192.168.2.16
May 8, 2024 08:42:35.383256912 CEST	21	53069	196.210.0.111	192.168.2.16
May 8, 2024 08:42:35.383393049 CEST	53069	21	192.168.2.16	196.210.0.111
May 8, 2024 08:42:35.386461973 CEST	21	53185	173.231.211.98	192.168.2.16
May 8, 2024 08:42:35.386605024 CEST	53185	21	192.168.2.16	173.231.211.98
May 8, 2024 08:42:35.386869907 CEST	53302	2121	192.168.2.16	110.7.34.230
May 8, 2024 08:42:35.393125057 CEST	2121	53121	34.149.79.8	192.168.2.16
May 8, 2024 08:42:35.393311977 CEST	2121	53119	37.16.27.158	192.168.2.16
May 8, 2024 08:42:35.393613100 CEST	2121	53297	37.16.27.158	192.168.2.16
May 8, 2024 08:42:35.393625021 CEST	2121	53296	34.149.79.8	192.168.2.16
May 8, 2024 08:42:35.393634081 CEST	21	53127	37.16.27.158	192.168.2.16
May 8, 2024 08:42:35.393677950 CEST	53297	2121	192.168.2.16	37.16.27.158
May 8, 2024 08:42:35.393719912 CEST	53296	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:35.393795967 CEST	21	53298	37.16.27.158	192.168.2.16
May 8, 2024 08:42:35.393852949 CEST	53298	21	192.168.2.16	37.16.27.158
May 8, 2024 08:42:35.394242048 CEST	21	53299	34.149.79.8	192.168.2.16
May 8, 2024 08:42:35.394253969 CEST	21	53124	34.149.79.8	192.168.2.16
May 8, 2024 08:42:35.394311905 CEST	53299	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:35.470236063 CEST	21	53300	38.14.189.177	192.168.2.16
May 8, 2024 08:42:35.470304966 CEST	53300	21	192.168.2.16	38.14.189.177
May 8, 2024 08:42:35.472078085 CEST	21	53091	38.14.189.177	192.168.2.16
May 8, 2024 08:42:35.478856087 CEST	21	53117	38.38.120.85	192.168.2.16
May 8, 2024 08:42:35.478868008 CEST	21	53117	38.38.120.85	192.168.2.16
May 8, 2024 08:42:35.478980064 CEST	53117	21	192.168.2.16	38.38.120.85
May 8, 2024 08:42:35.486522913 CEST	21	53115	172.120.235.139	192.168.2.16
May 8, 2024 08:42:35.486859083 CEST	21	53115	172.120.235.139	192.168.2.16
May 8, 2024 08:42:35.486980915 CEST	53115	21	192.168.2.16	172.120.235.139
May 8, 2024 08:42:35.491803885 CEST	21	53112	23.106.228.71	192.168.2.16
May 8, 2024 08:42:35.491919994 CEST	53112	21	192.168.2.16	23.106.228.71
May 8, 2024 08:42:35.507886887 CEST	21	53103	23.229.188.101	192.168.2.16
May 8, 2024 08:42:35.508174896 CEST	21	53103	23.229.188.101	192.168.2.16
May 8, 2024 08:42:35.508332968 CEST	53103	21	192.168.2.16	23.229.188.101
May 8, 2024 08:42:35.512948036 CEST	21	53096	38.239.154.176	192.168.2.16
May 8, 2024 08:42:35.513088942 CEST	53096	21	192.168.2.16	38.239.154.176
May 8, 2024 08:42:35.513356924 CEST	53303	21	192.168.2.16	38.239.154.176
May 8, 2024 08:42:35.513613939 CEST	21	53096	38.239.154.176	192.168.2.16
May 8, 2024 08:42:35.513664961 CEST	53096	21	192.168.2.16	38.239.154.176
May 8, 2024 08:42:35.532936096 CEST	21	53099	142.11.215.85	192.168.2.16
May 8, 2024 08:42:35.533073902 CEST	21	53099	142.11.215.85	192.168.2.16
May 8, 2024 08:42:35.533126116 CEST	53099	21	192.168.2.16	142.11.215.85
May 8, 2024 08:42:35.533143044 CEST	21	53301	142.11.215.85	192.168.2.16
May 8, 2024 08:42:35.533298969 CEST	53301	21	192.168.2.16	142.11.215.85
May 8, 2024 08:42:35.537349939 CEST	21	53116	51.38.57.28	192.168.2.16
May 8, 2024 08:42:35.537518024 CEST	53116	21	192.168.2.16	51.38.57.28
May 8, 2024 08:42:35.548111916 CEST	21	53122	84.44.255.254	192.168.2.16
May 8, 2024 08:42:35.548180103 CEST	53122	21	192.168.2.16	84.44.255.254
May 8, 2024 08:42:35.548223972 CEST	53122	21	192.168.2.16	84.44.255.254
May 8, 2024 08:42:35.548408031 CEST	53304	21	192.168.2.16	84.44.255.254
May 8, 2024 08:42:35.557063103 CEST	2121	53296	34.149.79.8	192.168.2.16
May 8, 2024 08:42:35.557118893 CEST	53296	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:35.557199001 CEST	53296	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:35.557384014 CEST	53305	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:35.557542086 CEST	21	53299	34.149.79.8	192.168.2.16
May 8, 2024 08:42:35.557594061 CEST	53299	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:35.557646990 CEST	53299	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:35.557676077 CEST	2121	53297	37.16.27.158	192.168.2.16
May 8, 2024 08:42:35.557724953 CEST	53297	2121	192.168.2.16	37.16.27.158
May 8, 2024 08:42:35.557765007 CEST	53297	2121	192.168.2.16	37.16.27.158
May 8, 2024 08:42:35.557813883 CEST	53306	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:35.557849884 CEST	21	53298	37.16.27.158	192.168.2.16
May 8, 2024 08:42:35.557934999 CEST	53307	2121	192.168.2.16	37.16.27.158
May 8, 2024 08:42:35.558010101 CEST	53298	21	192.168.2.16	37.16.27.158
May 8, 2024 08:42:35.558010101 CEST	53298	21	192.168.2.16	37.16.27.158
May 8, 2024 08:42:35.558089972 CEST	53308	21	192.168.2.16	37.16.27.158
May 8, 2024 08:42:35.576637983 CEST	21	53101	79.98.26.88	192.168.2.16
May 8, 2024 08:42:35.576776981 CEST	53101	21	192.168.2.16	79.98.26.88
May 8, 2024 08:42:35.587589979 CEST	21	53088	160.121.41.198	192.168.2.16
May 8, 2024 08:42:35.587712049 CEST	53088	21	192.168.2.16	160.121.41.198
May 8, 2024 08:42:35.587861061 CEST	53309	21	192.168.2.16	160.121.41.198
May 8, 2024 08:42:35.588432074 CEST	21	53088	160.121.41.198	192.168.2.16
May 8, 2024 08:42:35.588474989 CEST	53088	21	192.168.2.16	160.121.41.198
May 8, 2024 08:42:35.590348005 CEST	21	53107	217.76.115.138	192.168.2.16
May 8, 2024 08:42:35.590471029 CEST	53107	21	192.168.2.16	217.76.115.138
May 8, 2024 08:42:35.592113018 CEST	21	53102	46.34.34.117	192.168.2.16
May 8, 2024 08:42:35.592204094 CEST	53102	21	192.168.2.16	46.34.34.117
May 8, 2024 08:42:35.596775055 CEST	21	53108	120.24.160.35	192.168.2.16
May 8, 2024 08:42:35.596889019 CEST	53108	21	192.168.2.16	120.24.160.35
May 8, 2024 08:42:35.612951994 CEST	52852	21	192.168.2.16	77.75.121.3
May 8, 2024 08:42:35.619734049 CEST	21	53185	173.231.211.98	192.168.2.16
May 8, 2024 08:42:35.619782925 CEST	53185	21	192.168.2.16	173.231.211.98
May 8, 2024 08:42:35.641021013 CEST	21	53123	171.244.37.116	192.168.2.16
May 8, 2024 08:42:35.641134024 CEST	53123	21	192.168.2.16	171.244.37.116
May 8, 2024 08:42:35.654954910 CEST	21	53300	38.14.189.177	192.168.2.16
May 8, 2024 08:42:35.655153036 CEST	53300	21	192.168.2.16	38.14.189.177
May 8, 2024 08:42:35.688899994 CEST	21	53118	86.51.153.63	192.168.2.16
May 8, 2024 08:42:35.689019918 CEST	53118	21	192.168.2.16	86.51.153.63
May 8, 2024 08:42:35.692485094 CEST	21	53120	197.26.33.147	192.168.2.16
May 8, 2024 08:42:35.692540884 CEST	53120	21	192.168.2.16	197.26.33.147
May 8, 2024 08:42:35.692585945 CEST	53120	21	192.168.2.16	197.26.33.147
May 8, 2024 08:42:35.692774057 CEST	53310	21	192.168.2.16	197.26.33.147
May 8, 2024 08:42:35.697442055 CEST	21	53115	172.120.235.139	192.168.2.16
May 8, 2024 08:42:35.697616100 CEST	53115	21	192.168.2.16	172.120.235.139
May 8, 2024 08:42:35.697815895 CEST	53311	21	192.168.2.16	172.120.235.139
May 8, 2024 08:42:35.707794905 CEST	21	53117	38.38.120.85	192.168.2.16
May 8, 2024 08:42:35.708986044 CEST	53254	2121	192.168.2.16	123.109.161.86
May 8, 2024 08:42:35.719491005 CEST	2121	53305	34.149.79.8	192.168.2.16
May 8, 2024 08:42:35.719505072 CEST	2121	53296	34.149.79.8	192.168.2.16
May 8, 2024 08:42:35.719552040 CEST	53305	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:35.719732046 CEST	21	53299	34.149.79.8	192.168.2.16
May 8, 2024 08:42:35.720036030 CEST	2121	53307	37.16.27.158	192.168.2.16
May 8, 2024 08:42:35.720093966 CEST	53307	2121	192.168.2.16	37.16.27.158
May 8, 2024 08:42:35.720197916 CEST	21	53298	37.16.27.158	192.168.2.16
May 8, 2024 08:42:35.720210075 CEST	21	53308	37.16.27.158	192.168.2.16
May 8, 2024 08:42:35.720222950 CEST	21	53306	34.149.79.8	192.168.2.16
May 8, 2024 08:42:35.720263958 CEST	53308	21	192.168.2.16	37.16.27.158
May 8, 2024 08:42:35.720324993 CEST	53306	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:35.725008011 CEST	52620	2121	192.168.2.16	62.140.135.146
May 8, 2024 08:42:35.740947008 CEST	53209	21	192.168.2.16	121.139.242.180
May 8, 2024 08:42:35.740963936 CEST	53150	2121	192.168.2.16	150.109.254.101
May 8, 2024 08:42:35.740963936 CEST	53149	21	192.168.2.16	150.109.254.101
May 8, 2024 08:42:35.740973949 CEST	53211	2121	192.168.2.16	121.139.242.180
May 8, 2024 08:42:35.740974903 CEST	53253	21	192.168.2.16	123.109.161.86
May 8, 2024 08:42:35.741096020 CEST	53264	2121	192.168.2.16	175.234.190.98
May 8, 2024 08:42:35.741094112 CEST	53263	21	192.168.2.16	175.234.190.98
May 8, 2024 08:42:35.741097927 CEST	53143	21	192.168.2.16	94.21.184.140
May 8, 2024 08:42:35.742343903 CEST	21	53301	142.11.215.85	192.168.2.16
May 8, 2024 08:42:35.749672890 CEST	21	53103	23.229.188.101	192.168.2.16
May 8, 2024 08:42:35.756947041 CEST	53266	2121	192.168.2.16	109.164.35.221
May 8, 2024 08:42:35.756963968 CEST	53265	21	192.168.2.16	109.164.35.221
May 8, 2024 08:42:35.756964922 CEST	53157	21	192.168.2.16	82.183.51.114
May 8, 2024 08:42:35.756967068 CEST	53144	2121	192.168.2.16	94.21.184.140
May 8, 2024 08:42:35.756978989 CEST	53158	2121	192.168.2.16	82.183.51.114
May 8, 2024 08:42:35.756979942 CEST	53141	2121	192.168.2.16	190.57.210.15
May 8, 2024 08:42:35.756980896 CEST	53214	2121	192.168.2.16	42.119.153.154
May 8, 2024 08:42:35.756985903 CEST	53213	21	192.168.2.16	42.119.153.154
May 8, 2024 08:42:35.772950888 CEST	52622	21	192.168.2.16	62.140.135.146
May 8, 2024 08:42:35.784631014 CEST	21	53112	23.106.228.71	192.168.2.16
May 8, 2024 08:42:35.784924984 CEST	21	53112	23.106.228.71	192.168.2.16
May 8, 2024 08:42:35.788955927 CEST	53301	21	192.168.2.16	142.11.215.85
May 8, 2024 08:42:35.788970947 CEST	53188	2121	192.168.2.16	147.158.187.113
May 8, 2024 08:42:35.788976908 CEST	53178	2121	192.168.2.16	178.205.184.119
May 8, 2024 08:42:35.805279016 CEST	53113	21	192.168.2.16	38.207.205.17
May 8, 2024 08:42:35.813287973 CEST	21	53096	38.239.154.176	192.168.2.16
May 8, 2024 08:42:35.813808918 CEST	21	53303	38.239.154.176	192.168.2.16
May 8, 2024 08:42:35.813883066 CEST	53303	21	192.168.2.16	38.239.154.176
May 8, 2024 08:42:35.833771944 CEST	21	53135	160.169.130.232	192.168.2.16
May 8, 2024 08:42:35.836950064 CEST	53112	21	192.168.2.16	23.106.228.71
May 8, 2024 08:42:35.838018894 CEST	21	53300	38.14.189.177	192.168.2.16
May 8, 2024 08:42:35.838102102 CEST	21	53300	38.14.189.177	192.168.2.16
May 8, 2024 08:42:35.841494083 CEST	2121	53136	160.169.130.232	192.168.2.16
May 8, 2024 08:42:35.852478027 CEST	21	53116	51.38.57.28	192.168.2.16
May 8, 2024 08:42:35.852590084 CEST	21	53116	51.38.57.28	192.168.2.16
May 8, 2024 08:42:35.864295006 CEST	21	53304	84.44.255.254	192.168.2.16
May 8, 2024 08:42:35.864367962 CEST	53304	21	192.168.2.16	84.44.255.254
May 8, 2024 08:42:35.867445946 CEST	21	53122	84.44.255.254	192.168.2.16
May 8, 2024 08:42:35.868957043 CEST	52915	2121	192.168.2.16	62.140.135.146
May 8, 2024 08:42:35.868963957 CEST	52916	21	192.168.2.16	62.140.135.146
May 8, 2024 08:42:35.868967056 CEST	53182	2121	192.168.2.16	5.232.137.30
May 8, 2024 08:42:35.879432917 CEST	21	53115	172.120.235.139	192.168.2.16
May 8, 2024 08:42:35.879482985 CEST	21	53311	172.120.235.139	192.168.2.16
May 8, 2024 08:42:35.879484892 CEST	53115	21	192.168.2.16	172.120.235.139
May 8, 2024 08:42:35.879547119 CEST	53311	21	192.168.2.16	172.120.235.139
May 8, 2024 08:42:35.881805897 CEST	2121	53305	34.149.79.8	192.168.2.16
May 8, 2024 08:42:35.881865978 CEST	53305	2121	192.168.2.16	34.149.79.8
May 8, 2024 08:42:35.882601976 CEST	21	53308	37.16.27.158	192.168.2.16
May 8, 2024 08:42:35.882648945 CEST	53308	21	192.168.2.16	37.16.27.158
May 8, 2024 08:42:35.882720947 CEST	2121	53307	37.16.27.158	192.168.2.16
May 8, 2024 08:42:35.882757902 CEST	21	53306	34.149.79.8	192.168.2.16
May 8, 2024 08:42:35.882771015 CEST	53307	2121	192.168.2.16	37.16.27.158
May 8, 2024 08:42:35.882801056 CEST	53306	21	192.168.2.16	34.149.79.8
May 8, 2024 08:42:35.884949923 CEST	53300	21	192.168.2.16	38.14.189.177
May 8, 2024 08:42:35.900960922 CEST	53116	21	192.168.2.16	51.38.57.28
May 8, 2024 08:42:35.903490067 CEST	21	53069	196.210.0.111	192.168.2.16
May 8, 2024 08:42:35.912039042 CEST	21	53101	79.98.26.88	192.168.2.16
May 8, 2024 08:42:35.912122011 CEST	21	53101	79.98.26.88	192.168.2.16
May 8, 2024 08:42:35.914153099 CEST	21	53309	160.121.41.198	192.168.2.16
May 8, 2024 08:42:35.914216042 CEST	53309	21	192.168.2.16	160.121.41.198
May 8, 2024 08:42:35.916963100 CEST	53139	21	192.168.2.16	73.51.251.56
May 8, 2024 08:42:35.916960001 CEST	53106	21	192.168.2.16	77.75.121.3
May 8, 2024 08:42:35.916960001 CEST	53111	21	192.168.2.16	115.17.145.232
May 8, 2024 08:42:35.916968107 CEST	53105	21	192.168.2.16	117.223.205.236
May 8, 2024 08:42:35.916970015 CEST	53142	21	192.168.2.16	190.57.210.15
May 8, 2024 08:42:35.916992903 CEST	53110	2121	192.168.2.16	38.207.205.17
May 8, 2024 08:42:35.916992903 CEST	53131	21	192.168.2.16	171.226.169.252
May 8, 2024 08:42:35.916996002 CEST	53130	2121	192.168.2.16	105.216.108.87
May 8, 2024 08:42:35.916996956 CEST	53129	21	192.168.2.16	105.216.108.87
May 8, 2024 08:42:35.916999102 CEST	53152	2121	192.168.2.16	95.158.183.229
May 8, 2024 08:42:35.916997910 CEST	53146	2121	192.168.2.16	114.84.185.193
May 8, 2024 08:42:35.916999102 CEST	53145	21	192.168.2.16	114.84.185.193
May 8, 2024 08:42:35.917004108 CEST	53104	21	192.168.2.16	91.146.97.65
May 8, 2024 08:42:35.917004108 CEST	53128	2121	192.168.2.16	115.17.145.232
May 8, 2024 08:42:35.917027950 CEST	53134	2121	192.168.2.16	150.147.112.54
May 8, 2024 08:42:35.917027950 CEST	53164	2121	192.168.2.16	50.47.186.20
May 8, 2024 08:42:35.917030096 CEST	53138	2121	192.168.2.16	211.21.23.232
May 8, 2024 08:42:35.917031050 CEST	53140	2121	192.168.2.16	73.51.251.56
May 8, 2024 08:42:35.917032003 CEST	53153	21	192.168.2.16	174.87.240.88
May 8, 2024 08:42:35.917032003 CEST	53156	2121	192.168.2.16	69.140.176.86
May 8, 2024 08:42:35.917032003 CEST	53148	2121	192.168.2.16	162.55.133.234
May 8, 2024 08:42:35.917032003 CEST	53161	21	192.168.2.16	75.80.230.16
May 8, 2024 08:42:35.917032003 CEST	53169	21	192.168.2.16	69.202.179.175
May 8, 2024 08:42:35.917032957 CEST	53133	21	192.168.2.16	150.147.112.54
May 8, 2024 08:42:35.917032003 CEST	53137	21	192.168.2.16	211.21.23.232
May 8, 2024 08:42:35.917032957 CEST	53151	21	192.168.2.16	95.158.183.229
May 8, 2024 08:42:35.917032003 CEST	53159	21	192.168.2.16	202.186.239.174
May 8, 2024 08:42:35.917032957 CEST	53147	21	192.168.2.16	162.55.133.234
May 8, 2024 08:42:35.917035103 CEST	53155	21	192.168.2.16	69.140.176.86
May 8, 2024 08:42:35.917032003 CEST	53166	2121	192.168.2.16	87.10.177.248
May 8, 2024 08:42:35.917041063 CEST	53132	2121	192.168.2.16	171.226.169.252
May 8, 2024 08:42:35.917041063 CEST	53163	21	192.168.2.16	50.47.186.20
May 8, 2024 08:42:35.917041063 CEST	53154	2121	192.168.2.16	174.87.240.88
May 8, 2024 08:42:35.917071104 CEST	53189	21	192.168.2.16	121.189.84.215
May 8, 2024 08:42:35.917071104 CEST	53180	2121	192.168.2.16	189.176.111.218
May 8, 2024 08:42:35.917073965 CEST	53174	21	192.168.2.16	47.41.226.216
May 8, 2024 08:42:35.917073965 CEST	53167	21	192.168.2.16	71.230.245.143
May 8, 2024 08:42:35.917073965 CEST	53187	21	192.168.2.16	147.158.187.113
May 8, 2024 08:42:35.917073965 CEST	53179	21	192.168.2.16	189.176.111.218
May 8, 2024 08:42:35.917074919 CEST	53186	2121	192.168.2.16	173.231.211.98
May 8, 2024 08:42:35.917074919 CEST	53190	21	192.168.2.16	94.142.18.22
May 8, 2024 08:42:35.917074919 CEST	53172	2121	192.168.2.16	187.214.174.56
May 8, 2024 08:42:35.917074919 CEST	53192	2121	192.168.2.16	94.142.18.22
May 8, 2024 08:42:35.917077065 CEST	53173	21	192.168.2.16	141.140.5.87
May 8, 2024 08:42:35.917077065 CEST	53165	21	192.168.2.16	87.10.177.248
May 8, 2024 08:42:35.917077065 CEST	53194	21	192.168.2.16	189.222.80.254
May 8, 2024 08:42:35.917078018 CEST	53160	2121	192.168.2.16	202.186.239.174
May 8, 2024 08:42:35.917077065 CEST	53170	2121	192.168.2.16	69.202.179.175
May 8, 2024 08:42:35.917078018 CEST	53177	21	192.168.2.16	178.205.184.119
May 8, 2024 08:42:35.917077065 CEST	53168	2121	192.168.2.16	71.230.245.143
May 8, 2024 08:42:35.917078018 CEST	53175	2121	192.168.2.16	141.140.5.87
May 8, 2024 08:42:35.917077065 CEST	53162	2121	192.168.2.16	75.80.230.16
May 8, 2024 08:42:35.917077065 CEST	53171	21	192.168.2.16	187.214.174.56
May 8, 2024 08:42:35.917098045 CEST	53183	21	192.168.2.16	77.56.187.179
May 8, 2024 08:42:35.917098045 CEST	53206	2121	192.168.2.16	189.133.90.43
May 8, 2024 08:42:35.917098045 CEST	53193	21	192.168.2.16	27.64.230.117
May 8, 2024 08:42:35.917098999 CEST	53203	21	192.168.2.16	37.20.197.249
May 8, 2024 08:42:35.917099953 CEST	53196	2121	192.168.2.16	189.222.80.254
May 8, 2024 08:42:35.917098045 CEST	53198	2121	192.168.2.16	151.229.219.57
May 8, 2024 08:42:35.917103052 CEST	53201	21	192.168.2.16	84.105.87.174
May 8, 2024 08:42:35.917104006 CEST	53184	2121	192.168.2.16	77.56.187.179
May 8, 2024 08:42:35.917104006 CEST	53176	2121	192.168.2.16	47.41.226.216
May 8, 2024 08:42:35.917104006 CEST	53197	21	192.168.2.16	151.229.219.57
May 8, 2024 08:42:35.917104006 CEST	53199	21	192.168.2.16	17.253.60.163
May 8, 2024 08:42:35.917104006 CEST	53207	21	192.168.2.16	87.206.14.113
May 8, 2024 08:42:35.917104006 CEST	53195	2121	192.168.2.16	27.64.230.117
May 8, 2024 08:42:35.917104006 CEST	53181	21	192.168.2.16	5.232.137.30
May 8, 2024 08:42:35.917104006 CEST	53191	2121	192.168.2.16	121.189.84.215
May 8, 2024 08:42:35.917119980 CEST	53215	21	192.168.2.16	4.68.15.130
May 8, 2024 08:42:35.917123079 CEST	53205	2121	192.168.2.16	37.20.197.249
May 8, 2024 08:42:35.917123079 CEST	53200	2121	192.168.2.16	17.253.60.163
May 8, 2024 08:42:35.917123079 CEST	53212	2121	192.168.2.16	75.135.220.14
May 8, 2024 08:42:35.917123079 CEST	53202	2121	192.168.2.16	84.105.87.174
May 8, 2024 08:42:35.917124033 CEST	53216	2121	192.168.2.16	4.68.15.130
May 8, 2024 08:42:35.917125940 CEST	53217	21	192.168.2.16	81.100.234.50
May 8, 2024 08:42:35.917125940 CEST	53208	2121	192.168.2.16	87.206.14.113
May 8, 2024 08:42:35.917125940 CEST	53223	21	192.168.2.16	64.159.228.137
May 8, 2024 08:42:35.917125940 CEST	53210	21	192.168.2.16	75.135.220.14
May 8, 2024 08:42:35.917125940 CEST	53218	2121	192.168.2.16	81.100.234.50
May 8, 2024 08:42:35.917152882 CEST	53234	21	192.168.2.16	180.102.224.9
May 8, 2024 08:42:35.917155027 CEST	53230	2121	192.168.2.16	41.225.74.220
May 8, 2024 08:42:35.917155027 CEST	53219	21	192.168.2.16	68.33.75.237
May 8, 2024 08:42:35.917155027 CEST	53245	21	192.168.2.16	136.239.122.65
May 8, 2024 08:42:35.917155027 CEST	53235	21	192.168.2.16	75.167.159.244
May 8, 2024 08:42:35.917155027 CEST	53232	2121	192.168.2.16	94.174.128.154
May 8, 2024 08:42:35.917155027 CEST	53220	2121	192.168.2.16	68.33.75.237
May 8, 2024 08:42:35.917155027 CEST	53224	2121	192.168.2.16	64.159.228.137
May 8, 2024 08:42:35.917156935 CEST	53244	21	192.168.2.16	60.53.52.149
May 8, 2024 08:42:35.917156935 CEST	53204	21	192.168.2.16	189.133.90.43
May 8, 2024 08:42:35.917157888 CEST	53221	21	192.168.2.16	36.161.237.83
May 8, 2024 08:42:35.917156935 CEST	53237	21	192.168.2.16	121.179.190.212
May 8, 2024 08:42:35.917164087 CEST	53222	2121	192.168.2.16	36.161.237.83
May 8, 2024 08:42:35.917164087 CEST	53225	21	192.168.2.16	115.230.183.40
May 8, 2024 08:42:35.917179108 CEST	53250	21	192.168.2.16	108.34.250.148
May 8, 2024 08:42:35.917180061 CEST	53227	2121	192.168.2.16	115.230.183.40
May 8, 2024 08:42:35.917180061 CEST	53231	21	192.168.2.16	94.174.128.154
May 8, 2024 08:42:35.917181969 CEST	53228	2121	192.168.2.16	220.122.203.4
May 8, 2024 08:42:35.917182922 CEST	53249	2121	192.168.2.16	108.34.250.148
May 8, 2024 08:42:35.917184114 CEST	53262	2121	192.168.2.16	66.78.9.249
May 8, 2024 08:42:35.917184114 CEST	53236	2121	192.168.2.16	75.167.159.244
May 8, 2024 08:42:35.917185068 CEST	53246	2121	192.168.2.16	136.239.122.65
May 8, 2024 08:42:35.917184114 CEST	53270	2121	192.168.2.16	68.49.215.89
May 8, 2024 08:42:35.917184114 CEST	53233	2121	192.168.2.16	180.102.224.9
May 8, 2024 08:42:35.917186975 CEST	53238	21	192.168.2.16	189.141.100.126
May 8, 2024 08:42:35.917186975 CEST	53226	21	192.168.2.16	220.122.203.4
May 8, 2024 08:42:35.917186975 CEST	53240	2121	192.168.2.16	189.141.100.126
May 8, 2024 08:42:35.917206049 CEST	53252	2121	192.168.2.16	201.108.156.56
May 8, 2024 08:42:35.917207956 CEST	53239	2121	192.168.2.16	121.179.190.212
May 8, 2024 08:42:35.917208910 CEST	53247	21	192.168.2.16	94.15.231.2
May 8, 2024 08:42:35.917210102 CEST	53243	2121	192.168.2.16	60.53.52.149
May 8, 2024 08:42:35.917207956 CEST	53242	2121	192.168.2.16	112.186.203.157
May 8, 2024 08:42:35.917210102 CEST	53251	21	192.168.2.16	201.108.156.56
May 8, 2024 08:42:35.917208910 CEST	53257	21	192.168.2.16	69.245.57.207
May 8, 2024 08:42:35.917208910 CEST	53248	2121	192.168.2.16	94.15.231.2
May 8, 2024 08:42:35.917222023 CEST	53241	21	192.168.2.16	112.186.203.157
May 8, 2024 08:42:35.917381048 CEST	53260	2121	192.168.2.16	129.94.254.25
May 8, 2024 08:42:35.923729897 CEST	21	53088	160.121.41.198	192.168.2.16
May 8, 2024 08:42:35.926562071 CEST	21	53102	46.34.34.117	192.168.2.16
May 8, 2024 08:42:35.927499056 CEST	21	53102	46.34.34.117	192.168.2.16
May 8, 2024 08:42:35.931576014 CEST	21	53107	217.76.115.138	192.168.2.16
May 8, 2024 08:42:35.931622982 CEST	21	53107	217.76.115.138	192.168.2.16
May 8, 2024 08:42:35.932948112 CEST	53255	21	192.168.2.16	202.14.90.141
May 8, 2024 08:42:35.932951927 CEST	53256	2121	192.168.2.16	202.14.90.141
May 8, 2024 08:42:35.932951927 CEST	53261	21	192.168.2.16	66.78.9.249
May 8, 2024 08:42:35.932955980 CEST	53289	21	192.168.2.16	145.126.30.12
May 8, 2024 08:42:35.932956934 CEST	53259	21	192.168.2.16	129.94.254.25
May 8, 2024 08:42:35.932956934 CEST	53272	2121	192.168.2.16	157.125.133.197
May 8, 2024 08:42:35.932956934 CEST	53268	2121	192.168.2.16	40.114.50.42
May 8, 2024 08:42:35.932966948 CEST	53274	2121	192.168.2.16	194.208.143.224
May 8, 2024 08:42:35.932970047 CEST	53267	21	192.168.2.16	40.114.50.42
May 8, 2024 08:42:35.932975054 CEST	53290	21	192.168.2.16	35.187.254.145
May 8, 2024 08:42:35.932976961 CEST	53269	21	192.168.2.16	68.49.215.89
May 8, 2024 08:42:35.932976961 CEST	53283	21	192.168.2.16	88.22.24.213
May 8, 2024 08:42:35.932976961 CEST	53284	2121	192.168.2.16	88.22.24.213
May 8, 2024 08:42:35.932976961 CEST	53292	2121	192.168.2.16	35.187.254.145
May 8, 2024 08:42:35.932981014 CEST	53258	2121	192.168.2.16	69.245.57.207
May 8, 2024 08:42:35.932981968 CEST	53282	2121	192.168.2.16	171.14.96.40
May 8, 2024 08:42:35.932981014 CEST	53271	21	192.168.2.16	157.125.133.197
May 8, 2024 08:42:35.932981968 CEST	53277	21	192.168.2.16	171.239.194.133
May 8, 2024 08:42:35.932981968 CEST	53294	2121	192.168.2.16	173.70.214.62
May 8, 2024 08:42:35.932981968 CEST	53275	21	192.168.2.16	101.3.55.68
May 8, 2024 08:42:35.932981968 CEST	53276	2121	192.168.2.16	101.3.55.68
May 8, 2024 08:42:35.932988882 CEST	53278	2121	192.168.2.16	171.239.194.133
May 8, 2024 08:42:35.932990074 CEST	53281	2121	192.168.2.16	71.233.14.181
May 8, 2024 08:42:35.932995081 CEST	53286	2121	192.168.2.16	107.12.137.134
May 8, 2024 08:42:35.932995081 CEST	53287	21	192.168.2.16	73.128.150.87
May 8, 2024 08:42:35.932997942 CEST	53280	21	192.168.2.16	171.14.96.40
May 8, 2024 08:42:35.933000088 CEST	53273	21	192.168.2.16	194.208.143.224
May 8, 2024 08:42:35.933000088 CEST	53279	21	192.168.2.16	71.233.14.181
May 8, 2024 08:42:35.933003902 CEST	53293	21	192.168.2.16	173.70.214.62
May 8, 2024 08:42:35.933003902 CEST	53285	21	192.168.2.16	107.12.137.134
May 8, 2024 08:42:35.933006048 CEST	53291	2121	192.168.2.16	145.126.30.12
May 8, 2024 08:42:35.933007956 CEST	53288	2121	192.168.2.16	73.128.150.87
May 8, 2024 08:42:35.933011055 CEST	53295	21	192.168.2.16	110.7.34.230
May 8, 2024 08:42:35.946594000 CEST	21	53108	120.24.160.35	192.168.2.16
May 8, 2024 08:42:35.946614981 CEST	21	53108	120.24.160.35	192.168.2.16
May 8, 2024 08:42:35.964948893 CEST	53101	21	192.168.2.16	79.98.26.88
May 8, 2024 08:42:35.980947971 CEST	53102	21	192.168.2.16	46.34.34.117
May 8, 2024 08:42:35.980954885 CEST	53107	21	192.168.2.16	217.76.115.138
May 8, 2024 08:42:35.996958017 CEST	53108	21	192.168.2.16	120.24.160.35
May 8, 2024 08:42:35.998821974 CEST	2121	53254	123.109.161.86	192.168.2.16
May 8, 2024 08:42:36.007770061 CEST	21	53123	171.244.37.116	192.168.2.16
May 8, 2024 08:42:36.044967890 CEST	53297	2121	192.168.2.16	37.16.27.158
May 8, 2024 08:42:36.051541090 CEST	21	53253	123.109.161.86	192.168.2.16
May 8, 2024 08:42:36.053539038 CEST	2121	53211	121.139.242.180	192.168.2.16
May 8, 2024 08:42:36.059246063 CEST	2121	53264	175.234.190.98	192.168.2.16
May 8, 2024 08:42:36.060168982 CEST	21	53209	121.139.242.180	192.168.2.16
May 8, 2024 08:42:36.060960054 CEST	53123	21	192.168.2.16	171.244.37.116
May 8, 2024 08:42:36.062776089 CEST	21	53263	175.234.190.98	192.168.2.16
May 8, 2024 08:42:36.066998959 CEST	2121	53150	150.109.254.101	192.168.2.16
May 8, 2024 08:42:36.067014933 CEST	21	53143	94.21.184.140	192.168.2.16
May 8, 2024 08:42:36.067707062 CEST	21	53149	150.109.254.101	192.168.2.16
May 8, 2024 08:42:36.073173046 CEST	21	53120	197.26.33.147	192.168.2.16
May 8, 2024 08:42:36.074055910 CEST	21	53118	86.51.153.63	192.168.2.16
May 8, 2024 08:42:36.074068069 CEST	21	53118	86.51.153.63	192.168.2.16
May 8, 2024 08:42:36.074919939 CEST	21	53310	197.26.33.147	192.168.2.16
May 8, 2024 08:42:36.074992895 CEST	53310	21	192.168.2.16	197.26.33.147
May 8, 2024 08:42:36.087275028 CEST	2121	53266	109.164.35.221	192.168.2.16
May 8, 2024 08:42:36.087512016 CEST	21	53265	109.164.35.221	192.168.2.16
May 8, 2024 08:42:36.096265078 CEST	2121	53141	190.57.210.15	192.168.2.16
May 8, 2024 08:42:36.096312046 CEST	21	53213	42.119.153.154	192.168.2.16
May 8, 2024 08:42:36.097162962 CEST	2121	53144	94.21.184.140	192.168.2.16
May 8, 2024 08:42:36.097752094 CEST	2121	53158	82.183.51.114	192.168.2.16
May 8, 2024 08:42:36.098004103 CEST	21	53157	82.183.51.114	192.168.2.16
May 8, 2024 08:42:36.098165989 CEST	2121	53214	42.119.153.154	192.168.2.16
May 8, 2024 08:42:36.103669882 CEST	21	53311	172.120.235.139	192.168.2.16
May 8, 2024 08:42:36.115984917 CEST	21	53303	38.239.154.176	192.168.2.16
May 8, 2024 08:42:36.124963999 CEST	53118	21	192.168.2.16	86.51.153.63
May 8, 2024 08:42:36.139967918 CEST	52933	21	192.168.2.16	117.223.205.236
May 8, 2024 08:42:36.152590036 CEST	2121	53178	178.205.184.119	192.168.2.16
May 8, 2024 08:42:36.155961037 CEST	53311	21	192.168.2.16	172.120.235.139
May 8, 2024 08:42:36.162095070 CEST	2121	53188	147.158.187.113	192.168.2.16
May 8, 2024 08:42:36.171941996 CEST	53303	21	192.168.2.16	38.239.154.176
May 8, 2024 08:42:36.180389881 CEST	21	53304	84.44.255.254	192.168.2.16
May 8, 2024 08:42:36.180454969 CEST	53304	21	192.168.2.16	84.44.255.254
May 8, 2024 08:42:36.207192898 CEST	2121	53297	37.16.27.158	192.168.2.16
May 8, 2024 08:42:36.242357969 CEST	21	53309	160.121.41.198	192.168.2.16
May 8, 2024 08:42:36.282968044 CEST	53309	21	192.168.2.16	160.121.41.198
May 8, 2024 08:42:36.310060978 CEST	2121	53182	5.232.137.30	192.168.2.16
May 8, 2024 08:42:36.346956968 CEST	53135	21	192.168.2.16	160.169.130.232
May 8, 2024 08:42:36.347038984 CEST	53136	2121	192.168.2.16	160.169.130.232
May 8, 2024 08:42:36.394975901 CEST	53302	2121	192.168.2.16	110.7.34.230
May 8, 2024 08:42:36.435905933 CEST	21	53105	117.223.205.236	192.168.2.16
May 8, 2024 08:42:36.435982943 CEST	53105	21	192.168.2.16	117.223.205.236
May 8, 2024 08:42:36.475090981 CEST	21	53310	197.26.33.147	192.168.2.16
May 8, 2024 08:42:36.475192070 CEST	53310	21	192.168.2.16	197.26.33.147
May 8, 2024 08:42:36.505968094 CEST	53254	2121	192.168.2.16	123.109.161.86
May 8, 2024 08:42:36.553961992 CEST	53253	21	192.168.2.16	123.109.161.86
May 8, 2024 08:42:36.568948030 CEST	53264	2121	192.168.2.16	175.234.190.98
May 8, 2024 08:42:36.568960905 CEST	53209	21	192.168.2.16	121.139.242.180
May 8, 2024 08:42:36.568960905 CEST	53263	21	192.168.2.16	175.234.190.98
May 8, 2024 08:42:36.568964005 CEST	53143	21	192.168.2.16	94.21.184.140
May 8, 2024 08:42:36.568964958 CEST	53150	2121	192.168.2.16	150.109.254.101
May 8, 2024 08:42:36.568969965 CEST	53211	2121	192.168.2.16	121.139.242.180
May 8, 2024 08:42:36.568984032 CEST	53149	21	192.168.2.16	150.109.254.101
May 8, 2024 08:42:36.600946903 CEST	53265	21	192.168.2.16	109.164.35.221
May 8, 2024 08:42:36.600949049 CEST	53266	2121	192.168.2.16	109.164.35.221
May 8, 2024 08:42:36.600970030 CEST	53213	21	192.168.2.16	42.119.153.154
May 8, 2024 08:42:36.600970984 CEST	53158	2121	192.168.2.16	82.183.51.114
May 8, 2024 08:42:36.600972891 CEST	53214	2121	192.168.2.16	42.119.153.154
May 8, 2024 08:42:36.600974083 CEST	53144	2121	192.168.2.16	94.21.184.140
May 8, 2024 08:42:36.600975990 CEST	53157	21	192.168.2.16	82.183.51.114
May 8, 2024 08:42:36.600975990 CEST	53141	2121	192.168.2.16	190.57.210.15
May 8, 2024 08:42:36.661031008 CEST	21	52933	117.223.205.236	192.168.2.16
May 8, 2024 08:42:36.661087990 CEST	52933	21	192.168.2.16	117.223.205.236
May 8, 2024 08:42:36.664958954 CEST	53178	2121	192.168.2.16	178.205.184.119
May 8, 2024 08:42:36.664972067 CEST	53188	2121	192.168.2.16	147.158.187.113
May 8, 2024 08:42:36.794756889 CEST	2121	53254	123.109.161.86	192.168.2.16
May 8, 2024 08:42:36.824958086 CEST	53182	2121	192.168.2.16	5.232.137.30
May 8, 2024 08:42:36.867575884 CEST	21	53253	123.109.161.86	192.168.2.16
May 8, 2024 08:42:36.871309042 CEST	21	53069	196.210.0.111	192.168.2.16
May 8, 2024 08:42:36.882003069 CEST	2121	53211	121.139.242.180	192.168.2.16
May 8, 2024 08:42:36.887142897 CEST	2121	53264	175.234.190.98	192.168.2.16
May 8, 2024 08:42:36.888901949 CEST	21	53209	121.139.242.180	192.168.2.16
May 8, 2024 08:42:36.890209913 CEST	21	53263	175.234.190.98	192.168.2.16
May 8, 2024 08:42:36.894830942 CEST	21	53143	94.21.184.140	192.168.2.16
May 8, 2024 08:42:36.895512104 CEST	2121	53150	150.109.254.101	192.168.2.16
May 8, 2024 08:42:36.896375895 CEST	21	53149	150.109.254.101	192.168.2.16

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 8, 2024 08:41:16.187247992 CEST	58473	53	192.168.2.16	1.1.1.1
May 8, 2024 08:41:16.264790058 CEST	55208	53	192.168.2.16	1.1.1.1
May 8, 2024 08:41:16.352533102 CEST	53	58473	1.1.1.1	192.168.2.16
May 8, 2024 08:41:16.355408907 CEST	1434	6881	192.168.2.16	87.98.162.88
May 8, 2024 08:41:16.355484962 CEST	1434	6881	192.168.2.16	212.129.33.59
May 8, 2024 08:41:16.356292963 CEST	60982	53	192.168.2.16	1.1.1.1
May 8, 2024 08:41:16.519459009 CEST	53	60982	1.1.1.1	192.168.2.16
May 8, 2024 08:41:16.520256042 CEST	1434	6881	192.168.2.16	67.215.246.10
May 8, 2024 08:41:16.520597935 CEST	52249	53	192.168.2.16	1.1.1.1
May 8, 2024 08:41:16.671508074 CEST	6881	1434	87.98.162.88	192.168.2.16
May 8, 2024 08:41:16.682606936 CEST	53	55208	1.1.1.1	192.168.2.16
May 8, 2024 08:41:16.684385061 CEST	53	52249	1.1.1.1	192.168.2.16
May 8, 2024 08:41:16.685254097 CEST	1434	6881	192.168.2.16	82.221.103.244
May 8, 2024 08:41:16.685615063 CEST	64503	53	192.168.2.16	1.1.1.1
May 8, 2024 08:41:16.711512089 CEST	6881	1434	67.215.246.10	192.168.2.16
May 8, 2024 08:41:17.027719021 CEST	53	64503	1.1.1.1	192.168.2.16
May 8, 2024 08:41:17.028681040 CEST	1434	6881	192.168.2.16	130.239.18.158
May 8, 2024 08:41:17.028753042 CEST	1434	6881	192.168.2.16	87.98.162.88
May 8, 2024 08:41:17.028877974 CEST	1434	6881	192.168.2.16	67.215.246.10
May 8, 2024 08:41:17.064862013 CEST	1434	6881	192.168.2.16	67.215.246.10
May 8, 2024 08:41:17.080881119 CEST	1434	6881	192.168.2.16	67.215.246.10
May 8, 2024 08:41:17.096849918 CEST	1434	6881	192.168.2.16	87.98.162.88
May 8, 2024 08:41:17.128866911 CEST	1434	6881	192.168.2.16	87.98.162.88
May 8, 2024 08:41:17.144902945 CEST	1434	6881	192.168.2.16	87.98.162.88
May 8, 2024 08:41:17.176915884 CEST	1434	6881	192.168.2.16	67.215.246.10
May 8, 2024 08:41:17.192893028 CEST	1434	6881	192.168.2.16	87.98.162.88
May 8, 2024 08:41:17.208859921 CEST	1434	6881	192.168.2.16	87.98.162.88
May 8, 2024 08:41:17.220098019 CEST	6881	1434	67.215.246.10	192.168.2.16
May 8, 2024 08:41:17.220475912 CEST	1434	44606	192.168.2.16	117.205.143.147
May 8, 2024 08:41:17.224977970 CEST	1434	38873	192.168.2.16	179.189.76.64
May 8, 2024 08:41:17.256179094 CEST	6881	1434	67.215.246.10	192.168.2.16
May 8, 2024 08:41:17.256455898 CEST	1434	14339	192.168.2.16	136.169.148.180
May 8, 2024 08:41:17.272130013 CEST	6881	1434	67.215.246.10	192.168.2.16
May 8, 2024 08:41:17.272468090 CEST	1434	1817	192.168.2.16	109.252.191.150
May 8, 2024 08:41:17.288922071 CEST	1434	59500	192.168.2.16	192.141.113.227
May 8, 2024 08:41:17.320950985 CEST	1434	31716	192.168.2.16	186.19.22.40
May 8, 2024 08:41:17.344954967 CEST	6881	1434	87.98.162.88	192.168.2.16
May 8, 2024 08:41:17.345204115 CEST	1434	6907	192.168.2.16	95.211.237.2
May 8, 2024 08:41:17.353979111 CEST	1434	26053	192.168.2.16	95.181.238.23
May 8, 2024 08:41:17.358742952 CEST	6881	1434	130.239.18.158	192.168.2.16
May 8, 2024 08:41:17.361991882 CEST	1434	8748	192.168.2.16	106.220.124.149
May 8, 2024 08:41:17.368249893 CEST	6881	1434	67.215.246.10	192.168.2.16
May 8, 2024 08:41:17.368299007 CEST	1434	14092	192.168.2.16	80.91.24.136
May 8, 2024 08:41:17.368508101 CEST	1434	48486	192.168.2.16	188.250.135.64
May 8, 2024 08:41:17.385988951 CEST	1434	13130	192.168.2.16	81.243.58.86
May 8, 2024 08:41:17.414294004 CEST	6881	1434	87.98.162.88	192.168.2.16
May 8, 2024 08:41:17.414764881 CEST	1434	58004	192.168.2.16	46.232.210.149
May 8, 2024 08:41:17.433991909 CEST	1434	6882	192.168.2.16	74.88.220.49
May 8, 2024 08:41:17.445132971 CEST	6881	1434	87.98.162.88	192.168.2.16
May 8, 2024 08:41:17.445977926 CEST	1434	58004	192.168.2.16	46.232.210.149
May 8, 2024 08:41:17.464485884 CEST	6881	1434	87.98.162.88	192.168.2.16
May 8, 2024 08:41:17.464665890 CEST	1434	58004	192.168.2.16	46.232.210.149
May 8, 2024 08:41:17.497706890 CEST	1434	55444	192.168.2.16	187.146.124.43
May 8, 2024 08:41:17.509282112 CEST	6881	1434	87.98.162.88	192.168.2.16
May 8, 2024 08:41:17.509452105 CEST	1434	58004	192.168.2.16	46.232.210.149
May 8, 2024 08:41:17.525085926 CEST	6881	1434	87.98.162.88	192.168.2.16
May 8, 2024 08:41:17.525238037 CEST	1434	58004	192.168.2.16	46.232.210.149
May 8, 2024 08:41:17.543958902 CEST	1434	10434	192.168.2.16	77.45.164.252
May 8, 2024 08:41:17.559902906 CEST	1434	21336	192.168.2.16	185.48.39.167
May 8, 2024 08:41:17.575905085 CEST	1434	51511	192.168.2.16	187.227.131.72
May 8, 2024 08:41:17.608239889 CEST	1434	49001	192.168.2.16	178.207.141.42
May 8, 2024 08:41:17.619787931 CEST	26053	1434	95.181.238.23	192.168.2.16
May 8, 2024 08:41:17.621979952 CEST	1434	50724	192.168.2.16	95.54.250.173
May 8, 2024 08:41:17.622844934 CEST	1434	31711	192.168.2.16	188.73.233.220
May 8, 2024 08:41:17.629435062 CEST	59500	1434	192.141.113.227	192.168.2.16
May 8, 2024 08:41:17.630532026 CEST	1434	6881	192.168.2.16	42.4.125.62
May 8, 2024 08:41:17.646459103 CEST	14339	1434	136.169.148.180	192.168.2.16
May 8, 2024 08:41:17.648052931 CEST	1434	7798	192.168.2.16	211.51.231.137
May 8, 2024 08:41:17.654668093 CEST	6907	1434	95.211.237.2	192.168.2.16
May 8, 2024 08:41:17.654870033 CEST	1434	28010	192.168.2.16	212.7.209.208
May 8, 2024 08:41:17.678523064 CEST	31716	1434	186.19.22.40	192.168.2.16
May 8, 2024 08:41:17.678870916 CEST	1434	45716	192.168.2.16	181.228.110.212
May 8, 2024 08:41:17.686891079 CEST	1434	15454	192.168.2.16	188.157.13.17
May 8, 2024 08:41:17.706021070 CEST	1434	36713	192.168.2.16	154.246.26.181
May 8, 2024 08:41:17.718880892 CEST	1434	33387	192.168.2.16	125.167.118.74
May 8, 2024 08:41:17.719492912 CEST	13130	1434	81.243.58.86	192.168.2.16
May 8, 2024 08:41:17.720287085 CEST	1434	6881	192.168.2.16	212.129.33.59
May 8, 2024 08:41:17.720288992 CEST	1434	6881	192.168.2.16	87.98.162.88
May 8, 2024 08:41:17.720932961 CEST	1434	6881	192.168.2.16	82.221.103.244
May 8, 2024 08:41:17.720933914 CEST	1434	6881	192.168.2.16	67.215.246.10
May 8, 2024 08:41:17.721304893 CEST	1434	5150	192.168.2.16	163.172.10.71
May 8, 2024 08:41:17.721314907 CEST	1434	6881	192.168.2.16	130.239.18.158
May 8, 2024 08:41:17.727124929 CEST	58004	1434	46.232.210.149	192.168.2.16
May 8, 2024 08:41:17.729437113 CEST	1434	6885	192.168.2.16	112.87.174.47
May 8, 2024 08:41:17.729437113 CEST	1434	37827	192.168.2.16	168.227.18.122
May 8, 2024 08:41:17.750504017 CEST	1434	61619	192.168.2.16	27.61.217.1
May 8, 2024 08:41:17.751069069 CEST	14092	1434	80.91.24.136	192.168.2.16
May 8, 2024 08:41:17.752291918 CEST	1434	30907	192.168.2.16	193.224.106.20
May 8, 2024 08:41:17.758152962 CEST	58004	1434	46.232.210.149	192.168.2.16
May 8, 2024 08:41:17.762017012 CEST	1434	6885	192.168.2.16	112.87.174.47
May 8, 2024 08:41:17.777429104 CEST	58004	1434	46.232.210.149	192.168.2.16
May 8, 2024 08:41:17.777580976 CEST	1434	6885	192.168.2.16	112.87.174.47
May 8, 2024 08:41:17.785012007 CEST	48486	1434	188.250.135.64	192.168.2.16
May 8, 2024 08:41:17.785985947 CEST	1434	5060	192.168.2.16	36.154.110.46
May 8, 2024 08:41:17.821641922 CEST	58004	1434	46.232.210.149	192.168.2.16
May 8, 2024 08:41:17.821985006 CEST	1434	6885	192.168.2.16	112.87.174.47
May 8, 2024 08:41:17.838052988 CEST	58004	1434	46.232.210.149	192.168.2.16
May 8, 2024 08:41:17.842030048 CEST	1434	6885	192.168.2.16	112.87.174.47
May 8, 2024 08:41:17.876933098 CEST	1434	31654	192.168.2.16	172.56.15.170
May 8, 2024 08:41:17.892575026 CEST	1434	59957	192.168.2.16	83.243.193.127
May 8, 2024 08:41:17.892601013 CEST	55444	1434	187.146.124.43	192.168.2.16
May 8, 2024 08:41:17.894135952 CEST	1434	49001	192.168.2.16	212.21.22.15
May 8, 2024 08:41:17.912648916 CEST	6881	1434	67.215.246.10	192.168.2.16
May 8, 2024 08:41:17.912668943 CEST	10434	1434	77.45.164.252	192.168.2.16
May 8, 2024 08:41:17.912940979 CEST	1434	32294	192.168.2.16	113.137.59.135
May 8, 2024 08:41:17.913990974 CEST	1434	62600	192.168.2.16	185.219.141.212
May 8, 2024 08:41:17.921864033 CEST	21336	1434	185.48.39.167	192.168.2.16
May 8, 2024 08:41:17.922228098 CEST	1434	45667	192.168.2.16	61.53.45.34
May 8, 2024 08:41:17.937984943 CEST	1434	12051	192.168.2.16	187.190.24.67
May 8, 2024 08:41:17.964787960 CEST	28010	1434	212.7.209.208	192.168.2.16
May 8, 2024 08:41:17.965089083 CEST	1434	35239	192.168.2.16	195.154.172.169
May 8, 2024 08:41:17.978039026 CEST	49001	1434	178.207.141.42	192.168.2.16
May 8, 2024 08:41:17.978384018 CEST	1434	12053	192.168.2.16	69.50.95.40
May 8, 2024 08:41:18.000154972 CEST	50724	1434	95.54.250.173	192.168.2.16
May 8, 2024 08:41:18.001983881 CEST	1434	22223	192.168.2.16	175.212.133.248
May 8, 2024 08:41:18.024255037 CEST	5150	1434	163.172.10.71	192.168.2.16
May 8, 2024 08:41:18.024480104 CEST	1434	51417	192.168.2.16	2.58.44.66
May 8, 2024 08:41:18.036494017 CEST	6881	1434	87.98.162.88	192.168.2.16
May 8, 2024 08:41:18.036684036 CEST	1434	704	192.168.2.16	62.148.226.71
May 8, 2024 08:41:18.049874067 CEST	1434	23731	192.168.2.16	96.43.195.63
May 8, 2024 08:41:18.051399946 CEST	6881	1434	130.239.18.158	192.168.2.16
May 8, 2024 08:41:18.051491976 CEST	1434	6881	192.168.2.16	87.98.162.88
May 8, 2024 08:41:18.051517963 CEST	1434	6881	192.168.2.16	67.215.246.10
May 8, 2024 08:41:18.051542044 CEST	1434	6881	192.168.2.16	130.239.18.158
May 8, 2024 08:41:18.051557064 CEST	1434	26053	192.168.2.16	95.181.238.23
May 8, 2024 08:41:18.051585913 CEST	1434	59500	192.168.2.16	192.141.113.227
May 8, 2024 08:41:18.051618099 CEST	1434	14339	192.168.2.16	136.169.148.180
May 8, 2024 08:41:18.051629066 CEST	1434	6907	192.168.2.16	95.211.237.2
May 8, 2024 08:41:18.051652908 CEST	1434	31716	192.168.2.16	186.19.22.40
May 8, 2024 08:41:18.051769972 CEST	1434	13859	192.168.2.16	185.176.245.45
May 8, 2024 08:41:18.081923962 CEST	1434	62882	192.168.2.16	176.126.33.142
May 8, 2024 08:41:18.113837004 CEST	1434	5060	192.168.2.16	119.185.168.76
May 8, 2024 08:41:18.145865917 CEST	1434	18719	192.168.2.16	123.5.157.82
May 8, 2024 08:41:18.161922932 CEST	1434	7511	192.168.2.16	1.10.212.35
May 8, 2024 08:41:18.177982092 CEST	1434	5353	192.168.2.16	5.188.64.229
May 8, 2024 08:41:18.208961964 CEST	1434	20517	192.168.2.16	71.89.182.39
May 8, 2024 08:41:18.214587927 CEST	59957	1434	83.243.193.127	192.168.2.16
May 8, 2024 08:41:18.214838982 CEST	1434	44390	192.168.2.16	204.8.98.55
May 8, 2024 08:41:18.240945101 CEST	1434	2064	192.168.2.16	117.214.98.23
May 8, 2024 08:41:18.242738962 CEST	6881	1434	67.215.246.10	192.168.2.16
May 8, 2024 08:41:18.242995024 CEST	1434	20589	192.168.2.16	190.0.122.140
May 8, 2024 08:41:18.253662109 CEST	49001	1434	212.21.22.15	192.168.2.16
May 8, 2024 08:41:18.253868103 CEST	1434	6881	192.168.2.16	68.14.31.63
May 8, 2024 08:41:18.268590927 CEST	35239	1434	195.154.172.169	192.168.2.16
May 8, 2024 08:41:18.268892050 CEST	1434	35513	192.168.2.16	195.154.172.169
May 8, 2024 08:41:18.276932955 CEST	23731	1434	96.43.195.63	192.168.2.16
May 8, 2024 08:41:18.277196884 CEST	1434	19010	192.168.2.16	46.120.229.47
May 8, 2024 08:41:18.295206070 CEST	61619	1434	27.61.217.1	192.168.2.16
May 8, 2024 08:41:18.295439959 CEST	1434	8082	192.168.2.16	27.204.237.69
May 8, 2024 08:41:18.317615032 CEST	26053	1434	95.181.238.23	192.168.2.16
May 8, 2024 08:41:18.317825079 CEST	1434	13859	192.168.2.16	185.176.245.45
May 8, 2024 08:41:18.350914955 CEST	1434	41112	192.168.2.16	218.152.233.51
May 8, 2024 08:41:18.359275103 CEST	13859	1434	185.176.245.45	192.168.2.16
May 8, 2024 08:41:18.359481096 CEST	1434	12763	192.168.2.16	73.162.184.44
May 8, 2024 08:41:18.361089945 CEST	6907	1434	95.211.237.2	192.168.2.16
May 8, 2024 08:41:18.361218929 CEST	1434	28010	192.168.2.16	212.7.209.208
May 8, 2024 08:41:18.367712975 CEST	6881	1434	87.98.162.88	192.168.2.16
May 8, 2024 08:41:18.367892981 CEST	1434	61879	192.168.2.16	198.27.65.124
May 8, 2024 08:41:18.381606102 CEST	6881	1434	130.239.18.158	192.168.2.16
May 8, 2024 08:41:18.381787062 CEST	1434	7201	192.168.2.16	121.207.77.143
May 8, 2024 08:41:18.396869898 CEST	1434	1027	192.168.2.16	42.224.114.113
May 8, 2024 08:41:18.409538984 CEST	31716	1434	186.19.22.40	192.168.2.16
May 8, 2024 08:41:18.409701109 CEST	1434	45716	192.168.2.16	181.228.110.212
May 8, 2024 08:41:18.413357973 CEST	704	1434	62.148.226.71	192.168.2.16
May 8, 2024 08:41:18.413516045 CEST	1434	60464	192.168.2.16	115.63.8.138
May 8, 2024 08:41:18.421433926 CEST	59500	1434	192.141.113.227	192.168.2.16
May 8, 2024 08:41:18.421565056 CEST	1434	2064	192.168.2.16	117.214.98.23
May 8, 2024 08:41:18.428951025 CEST	1434	64111	192.168.2.16	46.232.210.52
May 8, 2024 08:41:18.442497969 CEST	14339	1434	136.169.148.180	192.168.2.16
May 8, 2024 08:41:18.442713976 CEST	1434	19487	192.168.2.16	45.88.221.4
May 8, 2024 08:41:18.463340044 CEST	62882	1434	176.126.33.142	192.168.2.16

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
May 8, 2024 08:41:16.187247992 CEST	192.168.2.16	1.1.1.1	0xa810	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
May 8, 2024 08:41:16.264790058 CEST	192.168.2.16	1.1.1.1	0x1918	Standard query (0)	xmr.crypto-pool.fr	A (IP address)	IN (0x0001)	false
May 8, 2024 08:41:16.356292963 CEST	192.168.2.16	1.1.1.1	0x228c	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
May 8, 2024 08:41:16.520597935 CEST	192.168.2.16	1.1.1.1	0x56e6	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
May 8, 2024 08:41:16.685615063 CEST	192.168.2.16	1.1.1.1	0xa3c9	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
May 8, 2024 08:41:22.273577929 CEST	192.168.2.16	1.1.1.1	0xf6b0	Standard query (0)	xmr.crypto-pool.fr	A (IP address)	IN (0x0001)	false
May 8, 2024 08:41:28.318540096 CEST	192.168.2.16	1.1.1.1	0xb460	Standard query (0)	xmr.crypto-pool.fr	A (IP address)	IN (0x0001)	false
May 8, 2024 08:41:34.367568016 CEST	192.168.2.16	1.1.1.1	0xd685	Standard query (0)	xmr.crypto-pool.fr	A (IP address)	IN (0x0001)	false
May 8, 2024 08:41:40.399353981 CEST	192.168.2.16	1.1.1.1	0x2626	Standard query (0)	xmr.crypto-pool.fr	A (IP address)	IN (0x0001)	false
May 8, 2024 08:41:46.423533916 CEST	192.168.2.16	1.1.1.1	0x41dd	Standard query (0)	xmr.crypto-pool.fr	A (IP address)	IN (0x0001)	false
May 8, 2024 08:41:52.452491999 CEST	192.168.2.16	1.1.1.1	0x6224	Standard query (0)	xmr.crypto-pool.fr	A (IP address)	IN (0x0001)	false
May 8, 2024 08:41:58.499501944 CEST	192.168.2.16	1.1.1.1	0x41bc	Standard query (0)	xmr.crypto-pool.fr	A (IP address)	IN (0x0001)	false
May 8, 2024 08:42:04.532445908 CEST	192.168.2.16	1.1.1.1	0xfa27	Standard query (0)	xmr.crypto-pool.fr	A (IP address)	IN (0x0001)	false
May 8, 2024 08:42:10.565649986 CEST	192.168.2.16	1.1.1.1	0x2750	Standard query (0)	xmr.crypto-pool.fr	A (IP address)	IN (0x0001)	false
May 8, 2024 08:42:16.594588041 CEST	192.168.2.16	1.1.1.1	0xf61f	Standard query (0)	xmr.crypto-pool.fr	A (IP address)	IN (0x0001)	false
May 8, 2024 08:42:22.648135900 CEST	192.168.2.16	1.1.1.1	0xba93	Standard query (0)	xmr.crypto-pool.fr	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
May 8, 2024 08:41:16.352533102 CEST	1.1.1.1	192.168.2.16	0xa810	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
May 8, 2024 08:41:16.352533102 CEST	1.1.1.1	192.168.2.16	0xa810	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
May 8, 2024 08:41:16.519459009 CEST	1.1.1.1	192.168.2.16	0x228c	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
May 8, 2024 08:41:16.684385061 CEST	1.1.1.1	192.168.2.16	0x56e6	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
May 8, 2024 08:41:17.027719021 CEST	1.1.1.1	192.168.2.16	0xa3c9	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
May 8, 2024 08:41:17.027719021 CEST	1.1.1.1	192.168.2.16	0xa3c9	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.16	50008	34.149.79.8	2121	6996	C:\Users\user\HelpPane.exe

Timestamp	Bytes transferred	Direction	Data
May 8, 2024 08:41:24.855953932 CEST	18	OUT	GET / HTTP/1.1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.16	52668	37.16.27.158	2121	6996	C:\Users\user\HelpPane.exe

Timestamp	Bytes transferred	Direction	Data
May 8, 2024 08:42:17.177769899 CEST	18	OUT	GET / HTTP/1.1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.16	52995	206.51.242.132	2121	6996	C:\Users\user\HelpPane.exe

Timestamp	Bytes transferred	Direction	Data
May 8, 2024 08:42:22.766026020 CEST	18	OUT	GET / HTTP/1.1

Target ID:	0
Start time:	08:40:18
Start date:	08/05/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
Imagebase:	0x7ff6032c0000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	08:40:27
Start date:	08/05/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff62c440000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	08:40:34
Start date:	08/05/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k NetworkService -p
Imagebase:	0x7ff62c440000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	08:40:34
Start date:	08/05/2024
Path:	C:\Windows\System32\SgrmBroker.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\SgrmBroker.exe
Imagebase:	0x7ff7648e0000
File size:	329'504 bytes
MD5 hash:	3BA1A18A0DC30A0545E7765CB97D8E63
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	08:40:34
Start date:	08/05/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
Imagebase:	0x7ff62c440000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	08:40:34
Start date:	08/05/2024
Path:	C:\Program Files\7-Zip\7zG.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\" -ad -an -ai#7zMap21038:114:7zEvent22422
Imagebase:	0x9b0000
File size:	700'416 bytes
MD5 hash:	50F289DF0C19484E970849AAC4E6F977
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	08:40:34
Start date:	08/05/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc
Imagebase:	0x7ff62c440000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	11
Start time:	08:40:34
Start date:	08/05/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s wscsvc
Imagebase:	0x7ff62c440000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	12
Start time:	08:40:34
Start date:	08/05/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k UnistackSvcGroup
Imagebase:	0x7ff62c440000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	14
Start time:	08:40:50
Start date:	08/05/2024
Path:	C:\Program Files\7-Zip\7zG.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\" -an -ai#7zMap6425:244:7zEvent24752
Imagebase:	0x9b0000
File size:	700'416 bytes
MD5 hash:	50F289DF0C19484E970849AAC4E6F977
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	08:41:00
Start date:	08/05/2024
Path:	C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe"
Imagebase:	0x1000000
File size:	6'271'268 bytes
MD5 hash:	A9D4007C9419A6E8D55805B8F8F52DE0
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000010.00000003.1535330452.000000000264D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	08:41:01
Start date:	08/05/2024
Path:	C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe"
Imagebase:	0x1000000
File size:	6'271'268 bytes
MD5 hash:	A9D4007C9419A6E8D55805B8F8F52DE0
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	08:41:02
Start date:	08/05/2024
Path:	C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe"
Imagebase:	0x1000000
File size:	6'271'268 bytes
MD5 hash:	A9D4007C9419A6E8D55805B8F8F52DE0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	08:41:03
Start date:	08/05/2024
Path:	C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe"
Imagebase:	0x1000000
File size:	6'271'268 bytes
MD5 hash:	A9D4007C9419A6E8D55805B8F8F52DE0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	08:41:03
Start date:	08/05/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c copy /y C:\Users\user\Desktop\240506-b7lv1sfmcw_pw_infected\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe C:\Users\user\HelpPane.exe
Imagebase:	0xf20000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	08:41:03
Start date:	08/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6684c0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	08:41:03
Start date:	08/05/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c C:\Users\user\HelpPane.exe --startup auto install
Imagebase:	0xf20000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	08:41:03
Start date:	08/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6684c0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	08:41:04
Start date:	08/05/2024
Path:	C:\Users\user\HelpPane.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\HelpPane.exe --startup auto install
Imagebase:	0x910000
File size:	6'271'268 bytes
MD5 hash:	A9D4007C9419A6E8D55805B8F8F52DE0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	08:41:05
Start date:	08/05/2024
Path:	C:\Users\user\HelpPane.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\HelpPane.exe --startup auto install
Imagebase:	0x910000
File size:	6'271'268 bytes
MD5 hash:	A9D4007C9419A6E8D55805B8F8F52DE0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	08:41:07
Start date:	08/05/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c C:\Users\user\HelpPane.exe start
Imagebase:	0xf20000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	08:41:07
Start date:	08/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6684c0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	08:41:07
Start date:	08/05/2024
Path:	C:\Users\user\HelpPane.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\HelpPane.exe start
Imagebase:	0x910000
File size:	6'271'268 bytes
MD5 hash:	A9D4007C9419A6E8D55805B8F8F52DE0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	08:41:08
Start date:	08/05/2024
Path:	C:\Users\user\HelpPane.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\HelpPane.exe start
Imagebase:	0x910000
File size:	6'271'268 bytes
MD5 hash:	A9D4007C9419A6E8D55805B8F8F52DE0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	08:41:09
Start date:	08/05/2024
Path:	C:\Users\user\HelpPane.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\HelpPane.exe"
Imagebase:	0x910000
File size:	6'271'268 bytes
MD5 hash:	A9D4007C9419A6E8D55805B8F8F52DE0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	33
Start time:	08:41:10
Start date:	08/05/2024
Path:	C:\Users\user\HelpPane.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\HelpPane.exe"
Imagebase:	0x910000
File size:	6'271'268 bytes
MD5 hash:	A9D4007C9419A6E8D55805B8F8F52DE0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	34
Start time:	08:41:10
Start date:	08/05/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c taskkill /pid 2284 /f
Imagebase:	0xf20000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	08:41:10
Start date:	08/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6684c0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	08:41:10
Start date:	08/05/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /pid 2284 /f
Imagebase:	0x8a0000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	08:41:11
Start date:	08/05/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c copy /y C:\Windows\TEMP\_MEI29~1\xmrig.exe C:\Windows\TEMP\xmrig.exe
Imagebase:	0xf20000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000025.00000003.1637912498.00000000034D5000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	08:41:11
Start date:	08/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6684c0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	08:41:11
Start date:	08/05/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c copy /y C:\Windows\TEMP\_MEI29~1\config.json C:\Windows\TEMP\config.json
Imagebase:	0xf20000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000027.00000002.1640981815.00000000007E0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000027.00000002.1641380904.0000000000D1C000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	08:41:11
Start date:	08/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6684c0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	42
Start time:	08:41:14
Start date:	08/05/2024
Path:	C:\Windows\Temp\xmrig.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\TEMP\xmrig.exe
Imagebase:	0x400000
File size:	1'905'664 bytes
MD5 hash:	13BDD9CD9F7E51746172996262B5A873
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000002A.00000002.2400305234.00000000009B5000.00000004.00000001.01000000.0000004C.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000002A.00000002.2400932598.0000000000DA3000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000002A.00000002.2402253163.00000000018D2000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000002A.00000002.2400932598.0000000000D78000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000002A.00000000.1679670841.00000000009B0000.00000008.00000001.01000000.0000004C.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000002A.00000002.2400626776.0000000000D40000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000002A.00000002.2360410503.0000000000401000.00000040.00000001.01000000.0000004C.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: C:\Windows\Temp\xmrig.exe, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	43
Start time:	08:41:15
Start date:	08/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6684c0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	44
Start time:	08:41:15
Start date:	08/05/2024
Path:	C:\Windows\SysWOW64\netsh.exe
Wow64 process (32bit):	true
Commandline:	netsh firewall add allowedprogram C:\Users\user\HelpPane.exe "MyApp" ENABLE
Imagebase:	0x7ff66aaa0000
File size:	82'432 bytes
MD5 hash:	4E89A1A088BE715D6C946E55AB07C7DF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	45
Start time:	08:41:15
Start date:	08/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6684c0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	46
Start time:	08:41:16
Start date:	08/05/2024
Path:	C:\Windows\System32\spoolsv.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\spoolsv.exe
Imagebase:	0x7ff719eb0000
File size:	842'752 bytes
MD5 hash:	0D4B1E3E4488E9BDC035F23E1F4FE22F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	47
Start time:	08:41:34
Start date:	08/05/2024
Path:	C:\Program Files\Windows Defender\MpCmdRun.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
Imagebase:	0x7ff655bc0000
File size:	468'120 bytes
MD5 hash:	B3676839B2EE96983F9ED735CD044159
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	48
Start time:	08:41:34
Start date:	08/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6684c0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	49
Start time:	08:41:42
Start date:	08/05/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k SDRSVC
Imagebase:	0x7ff62c440000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	0.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	29.7%
Total number of Nodes:	209
Total number of Limit Nodes:	21

Executed Functions

Function 10002D19 Relevance: 28.4, APIs: 12, Strings: 4, Instructions: 394
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PyArg_Parse.PYTHON27(?,1000845C,?,?), ref: 10002D61

Part of subcall function 10002640: PyArg_Parse.PYTHON27(?,10008278,?,?), ref: 10002657

Strings

Input strings must be a multiple of %i in length, xrefs: 10002DB2
Input strings must be a multiple of the segment size %i in length, xrefs: 10002DEE
No memory available in _AES decrypt, xrefs: 10002E21
Unknown ciphertext feedback mode %i; this shouldn't happen, xrefs: 1000317B

Memory Dump Source

Source File: 00000011.00000002.1561745639.0000000010001000.00000040.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true

Associated: 00000011.00000002.1561633037.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000011.00000002.1561745639.0000000010008000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000011.00000002.1561745639.000000001000A000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000011.00000002.1561844929.000000001000B000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000011.00000002.1561870030.000000001000D000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_10000000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_Parse
String ID: Input strings must be a multiple of %i in length$Input strings must be a multiple of the segment size %i in length$No memory available in _AES decrypt$Unknown ciphertext feedback mode %i; this shouldn't happen
API String ID: 2808742207-4241125248
Opcode ID: 2c437d121ba1ec8d3907c33f08ba3072411fecc45d02418a6c230e76c9ae3ece
Instruction ID: 50dd2ec2cec88198311dfcbaffbbaa73ac7af56e5f088be47caa55b611f03536
Opcode Fuzzy Hash: 2c437d121ba1ec8d3907c33f08ba3072411fecc45d02418a6c230e76c9ae3ece
Instruction Fuzzy Hash: 47E1F4B55083929FD314CF28C88095BBBE5FFC9244F058A6DF8868731AE731E959CB91

Function 03412190 Relevance: 22.9, APIs: 9, Strings: 4, Instructions: 194
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PyList_New.PYTHON27 ref: 034121A7
PyErr_SetFromWindowsErr.PYTHON27(00000000), ref: 034121D5
PyErr_SetString.PYTHON27(?,GetSystemInfo() failed to retrieve CPU count), ref: 03412207
PyErr_NoMemory.PYTHON27 ref: 03412232
NtQuerySystemInformation.NTDLL(00000008,00000000,?,00000000), ref: 03412243
73BB3B4E.MSVCR90(?), ref: 034123A7

Strings

GetSystemInfo() failed to retrieve CPU count, xrefs: 03412201
NtQuerySystemInformation(SystemProcessorPerformanceInformation), xrefs: 0341224D
(ddddd), xrefs: 03412319
GetActiveProcessorCount() not available; using GetSystemInfo(), xrefs: 034121E3

Memory Dump Source

Source File: 00000011.00000002.1560676867.0000000003411000.00000040.00000001.01000000.0000000F.sdmp, Offset: 03410000, based on PE: true

Associated: 00000011.00000002.1560637646.0000000003410000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560676867.000000000341B000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560676867.000000000341F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560836323.0000000003423000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_3410000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Err_$FromInformationList_MemoryQueryStringSystemWindows
String ID: (ddddd)$GetActiveProcessorCount() not available; using GetSystemInfo()$GetSystemInfo() failed to retrieve CPU count$NtQuerySystemInformation(SystemProcessorPerformanceInformation)
API String ID: 744806155-2733789981
Opcode ID: 4dcc791a9873cf4ae1a3082c4fabc8fb8247631431f68ca6906a68b98fd51175
Instruction ID: b1e0889227f21e3abb94e290ae7169ef5f21c8dfea79d40aded62b34f7fc99ca
Opcode Fuzzy Hash: 4dcc791a9873cf4ae1a3082c4fabc8fb8247631431f68ca6906a68b98fd51175
Instruction Fuzzy Hash: 2B616772A00B0A9BD320EE51E85451BB7E4FB44750B240E1DE849EA255FB72D930CBC6

Function 03416F10 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 74
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LookupPrivilegeValueA.ADVAPI32 ref: 03416F23
AdjustTokenPrivileges.KERNELBASE ref: 03416F7E

Part of subcall function 03411090: GetLastError.KERNEL32 ref: 034110B2
Part of subcall function 03411090: PyErr_SetFromWindowsErrWithFilename.PYTHON27(00000000), ref: 034110B9

Strings

LookupPrivilegeValue, xrefs: 03416F2D
AdjustTokenPrivileges, xrefs: 03416FDD
AdjustTokenPrivileges, xrefs: 03416F84
SeDebugPrivilege, xrefs: 03416F18

Memory Dump Source

Source File: 00000011.00000002.1560676867.0000000003411000.00000040.00000001.01000000.0000000F.sdmp, Offset: 03410000, based on PE: true

Associated: 00000011.00000002.1560637646.0000000003410000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560676867.000000000341B000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560676867.000000000341F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560836323.0000000003423000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_3410000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: AdjustErr_ErrorFilenameFromLastLookupPrivilegePrivilegesTokenValueWindowsWith
String ID: AdjustTokenPrivileges$AdjustTokenPrivileges$LookupPrivilegeValue$SeDebugPrivilege
API String ID: 2462482343-530743942
Opcode ID: 948488bcce09cf46f9c8b5c2943322ea053433ddd366f7f07270ba142d29ade2
Instruction ID: 3331bab9cf136722c8bc818d040af7b21b036fea9f25a0f199c2d08f4fcaf683
Opcode Fuzzy Hash: 948488bcce09cf46f9c8b5c2943322ea053433ddd366f7f07270ba142d29ade2
Instruction Fuzzy Hash: 6C2198B5908301AFD304DF15DD91BABB7E4ABC4704F44491EF9988E280F3B5E6588B97

Function 034120B0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 69
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemTimes.KERNEL32(?,?,?), ref: 034120C2
PyErr_SetFromWindowsErr.PYTHON27(00000000,?,?,?), ref: 034120CC
Py_BuildValue.PYTHON27((ddd),?,?,?,?,?,?), ref: 0341217E

Strings

(ddd), xrefs: 03412179

Memory Dump Source

Source File: 00000011.00000002.1560676867.0000000003411000.00000040.00000001.01000000.0000000F.sdmp, Offset: 03410000, based on PE: true

Associated: 00000011.00000002.1560637646.0000000003410000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560676867.000000000341B000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560676867.000000000341F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560836323.0000000003423000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_3410000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: BuildErr_FromSystemTimesValueWindows
String ID: (ddd)
API String ID: 2325294781-2401937087
Opcode ID: 823747ed43a6d7e5941d069d66e668129738fb96a2368443098d63276ef0ffc9
Instruction ID: cf82f03613b8838293e88816f8ede08ba7aea1e5acb2bb34a515b1d4af3fa57c
Opcode Fuzzy Hash: 823747ed43a6d7e5941d069d66e668129738fb96a2368443098d63276ef0ffc9
Instruction Fuzzy Hash: D521B276B04F069BD340FE11E12455AB7F4FA9C780F618D4DE489A5165FB32C938CAC6

Function 029B7890 Relevance: 2.4, APIs: 1, Instructions: 891memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(-00001000,00001000,00000004,?,00000000), ref: 029B8443

Memory Dump Source

Source File: 00000011.00000002.1555973035.00000000029B6000.00000040.00000001.01000000.00000010.sdmp, Offset: 029B0000, based on PE: true

Associated: 00000011.00000002.1555921150.00000000029B0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000011.00000002.1555973035.00000000029B1000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000011.00000002.1556052326.00000000029B9000.00000004.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_29b0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 20ec0ecfd53947cace1c1679680243a5289b3a9f3bfd486d65aeb3c82877f839
Instruction ID: 1d29140fc92d955066774c6f219ffa2a33d9ae12c51393f929661e415ef35852
Opcode Fuzzy Hash: 20ec0ecfd53947cace1c1679680243a5289b3a9f3bfd486d65aeb3c82877f839
Instruction Fuzzy Hash: 2772CC325083558FD325CF28C9806AAFBE5FF89384F154A2DE9A5CB351E731E945CB82

Function 1E7C0FA0 Relevance: 2.4, APIs: 1, Instructions: 891memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(-00001000,00001000,00000004,?,00000000), ref: 1E7C1B53

Memory Dump Source

Source File: 00000011.00000002.1562197228.000000001E7C0000.00000080.00000001.01000000.00000012.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000011.00000002.1561891626.000000001E7A0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7A1000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7B9000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7BE000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562233172.000000001E7C2000.00000004.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e7a0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 6d262b0c71f9c015816c5508a544d64cbae02a1b5ee422ee9a3a9f2d910439d2
Instruction ID: 12bd7e40b6dfd77b3012bca56022bbc4e9473bc772901fbb0fb185de61f08eb0
Opcode Fuzzy Hash: 6d262b0c71f9c015816c5508a544d64cbae02a1b5ee422ee9a3a9f2d910439d2
Instruction Fuzzy Hash: 9D7269316183968FE314CF28C88069ABBF6EF85344F154A3DE9A58B361E771D945CF42

Function 1E8DF120 Relevance: 2.4, APIs: 1, Instructions: 885memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(-00001000,00001000,00000004,?,00000000), ref: 1E8DFCCA

Memory Dump Source

Source File: 00000011.00000002.1562702731.000000001E8DF000.00000080.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 00000011.00000002.1562469835.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8C1000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562730939.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: e3896eae8dbcb9b17e679b07a241242372fbc8b2553d0fb01bcdc42c31cda9f4
Instruction ID: b4903fa70e46c38d5f5413635802a70aef28782e4a3959fc976c48017fb7ad85
Opcode Fuzzy Hash: e3896eae8dbcb9b17e679b07a241242372fbc8b2553d0fb01bcdc42c31cda9f4
Instruction Fuzzy Hash: 63729E316083958FD314CF28C88069ABBE2FF89344F154A2DE9E5CB391E771D989DB42

Function 1E7DB690 Relevance: 2.4, APIs: 1, Instructions: 885memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(-00001000,00001000,00000004,?,00000000), ref: 1E7DC23A

Memory Dump Source

Source File: 00000011.00000002.1562391495.000000001E7DB000.00000080.00000001.01000000.00000015.sdmp, Offset: 1E7D0000, based on PE: true

Associated: 00000011.00000002.1562293036.000000001E7D0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000011.00000002.1562321143.000000001E7D1000.00000040.00000001.01000000.00000015.sdmpDownload File
Associated: 00000011.00000002.1562321143.000000001E7DA000.00000040.00000001.01000000.00000015.sdmpDownload File
Associated: 00000011.00000002.1562417397.000000001E7DD000.00000004.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e7d0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 9bc948fdda5b165c38df29802323b91b469eb35267962a1661ce76142fac560f
Instruction ID: 828b2c0d9c01f0a839a0f5a1475ada5bdd3b3ddaedd5b51ad723f9ff2392e3b3
Opcode Fuzzy Hash: 9bc948fdda5b165c38df29802323b91b469eb35267962a1661ce76142fac560f
Instruction Fuzzy Hash: 8A729C756083958FE314CF28C88066ABBE2FF85344F154A2DE9A5CB361E771E949CF42

Function 1E9BA490 Relevance: 2.4, APIs: 1, Instructions: 885memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(-00001000,00001000,00000004,?,00000000), ref: 1E9BB03A

Memory Dump Source

Source File: 00000011.00000002.1562880123.000000001E9BA000.00000080.00000001.01000000.00000014.sdmp, Offset: 1E9B0000, based on PE: true

Associated: 00000011.00000002.1562762621.000000001E9B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000011.00000002.1562784907.000000001E9B1000.00000040.00000001.01000000.00000014.sdmpDownload File
Associated: 00000011.00000002.1562784907.000000001E9B6000.00000040.00000001.01000000.00000014.sdmpDownload File
Associated: 00000011.00000002.1562784907.000000001E9B9000.00000040.00000001.01000000.00000014.sdmpDownload File
Associated: 00000011.00000002.1562906331.000000001E9BC000.00000004.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e9b0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: d6fe2c051e9207c9d65aa850eec9f39adf8cd91593811e8fdb3df9740fc50181
Instruction ID: 0ca98ba06f2fca5a4cb6b297f03cb1ba8bfab491c8d97ec4390fd3668d8d0b84
Opcode Fuzzy Hash: d6fe2c051e9207c9d65aa850eec9f39adf8cd91593811e8fdb3df9740fc50181
Instruction Fuzzy Hash: 9B72BC716083958FD324CF28C880A9ABBE2FF85345F154A2DE9A5CB350E7B5D985CF42

Function 03417FF0 Relevance: 1.5, APIs: 1, Instructions: 12
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemInfo.KERNEL32(0341DB80,034159E9), ref: 0341800D

Memory Dump Source

Source File: 00000011.00000002.1560676867.0000000003411000.00000040.00000001.01000000.0000000F.sdmp, Offset: 03410000, based on PE: true

Associated: 00000011.00000002.1560637646.0000000003410000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560676867.000000000341B000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560676867.000000000341F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560836323.0000000003423000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_3410000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: 4b010d8cf62daa3d0d8d37b9bd74e0aacbe14949a93e5cf0762c2157de9af749
Instruction ID: 52a5ceae7f4a64c00a1f7e5ed8e526cbd5a13601ab35e518606fbb11a66a95ae
Opcode Fuzzy Hash: 4b010d8cf62daa3d0d8d37b9bd74e0aacbe14949a93e5cf0762c2157de9af749
Instruction Fuzzy Hash: 7AC04C79340F021DEA60F676491822B2DC59B44586F9404A6E911DC145FE44C460855C

Function 1E8CB540 Relevance: 313.7, APIs: 92, Strings: 87, Instructions: 409
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Py_InitModule4.PYTHON27(win32api,1E8D70B8,00000000,00000000,000003F5), ref: 1E8CB563
PyModule_GetDict.PYTHON27(00000000), ref: 1E8CB578
PyDict_SetItemString.PYTHON27(00000000,error), ref: 1E8CB5A1
PyInt_FromLong.PYTHON27(000000F6), ref: 1E8CB5AB
PyDict_SetItemString.PYTHON27(00000000,STD_INPUT_HANDLE,00000000), ref: 1E8CB5B4
PyInt_FromLong.PYTHON27(000000F5), ref: 1E8CB5B8
PyDict_SetItemString.PYTHON27(00000000,STD_OUTPUT_HANDLE,00000000), ref: 1E8CB5C1
PyInt_FromLong.PYTHON27(000000F4), ref: 1E8CB5C5
PyDict_SetItemString.PYTHON27(00000000,STD_ERROR_HANDLE,00000000), ref: 1E8CB5CE
PyType_Ready.PYTHON27(?), ref: 1E8CB5D5
PyDict_SetItemString.PYTHON27(00000000,PyDISPLAY_DEVICEType,?), ref: 1E8CB5F2
PyModule_AddIntConstant.PYTHON27(00000000,NameUnknown,00000000), ref: 1E8CB60E
PyModule_AddIntConstant.PYTHON27(00000000,NameFullyQualifiedDN,00000001), ref: 1E8CB618
PyModule_AddIntConstant.PYTHON27(00000000,NameSamCompatible,00000002), ref: 1E8CB622
PyModule_AddIntConstant.PYTHON27(00000000,NameDisplay,00000003), ref: 1E8CB62C
PyModule_AddIntConstant.PYTHON27(00000000,NameUniqueId,00000006), ref: 1E8CB636
PyModule_AddIntConstant.PYTHON27(00000000,NameCanonical,00000007), ref: 1E8CB640
PyModule_AddIntConstant.PYTHON27(00000000,NameUserPrincipal,00000008), ref: 1E8CB64D
PyModule_AddIntConstant.PYTHON27(00000000,NameCanonicalEx,00000009), ref: 1E8CB657
PyModule_AddIntConstant.PYTHON27(00000000,NameServicePrincipal,0000000A), ref: 1E8CB661
PyModule_AddIntConstant.PYTHON27(00000000,REG_NOTIFY_CHANGE_NAME,00000001), ref: 1E8CB66B
PyModule_AddIntConstant.PYTHON27(00000000,REG_NOTIFY_CHANGE_ATTRIBUTES,00000002), ref: 1E8CB675
PyModule_AddIntConstant.PYTHON27(00000000,REG_NOTIFY_CHANGE_LAST_SET,00000004), ref: 1E8CB67F
PyModule_AddIntConstant.PYTHON27(00000000,REG_NOTIFY_CHANGE_SECURITY,00000008), ref: 1E8CB68C
PyModule_AddIntConstant.PYTHON27(00000000,VOS_DOS,00010000), ref: 1E8CB699
PyModule_AddIntConstant.PYTHON27(00000000,VOS_NT,00040000), ref: 1E8CB6A6
PyModule_AddIntConstant.PYTHON27(00000000,VOS__WINDOWS16,00000001), ref: 1E8CB6B0
PyModule_AddIntConstant.PYTHON27(00000000,VOS__WINDOWS32,00000004), ref: 1E8CB6BA
PyModule_AddIntConstant.PYTHON27(00000000,VOS_OS216,00020000), ref: 1E8CB6C7
PyModule_AddIntConstant.PYTHON27(00000000,VOS_OS232,00030000), ref: 1E8CB6D7
PyModule_AddIntConstant.PYTHON27(00000000,VOS__PM16,00000002), ref: 1E8CB6E1
PyModule_AddIntConstant.PYTHON27(00000000,VOS__PM32,00000003), ref: 1E8CB6EB
PyModule_AddIntConstant.PYTHON27(00000000,VOS_UNKNOWN,00000000), ref: 1E8CB6F5
PyModule_AddIntConstant.PYTHON27(00000000,VOS_DOS_WINDOWS16,00010001), ref: 1E8CB702
PyModule_AddIntConstant.PYTHON27(00000000,VOS_DOS_WINDOWS32,00010004), ref: 1E8CB70F
PyModule_AddIntConstant.PYTHON27(00000000,VOS_NT_WINDOWS32,00040004), ref: 1E8CB71F
PyModule_AddIntConstant.PYTHON27(00000000,VOS_OS216_PM16,00020002), ref: 1E8CB72C
PyModule_AddIntConstant.PYTHON27(00000000,VOS_OS232_PM32,00030003), ref: 1E8CB739
PyModule_AddIntConstant.PYTHON27(00000000,VFT_UNKNOWN,00000000), ref: 1E8CB743
PyModule_AddIntConstant.PYTHON27(00000000,VFT_APP,00000001), ref: 1E8CB74D
PyModule_AddIntConstant.PYTHON27(00000000,VFT_DLL,00000002), ref: 1E8CB757
PyModule_AddIntConstant.PYTHON27(00000000,VFT_DRV,00000003), ref: 1E8CB764
PyModule_AddIntConstant.PYTHON27(00000000,VFT_FONT,00000004), ref: 1E8CB76E
PyModule_AddIntConstant.PYTHON27(00000000,VFT_VXD,00000005), ref: 1E8CB778
PyModule_AddIntConstant.PYTHON27(00000000,VFT_STATIC_LIB,00000007), ref: 1E8CB782
PyModule_AddIntConstant.PYTHON27(00000000,VS_FF_DEBUG,00000001), ref: 1E8CB78C
PyModule_AddIntConstant.PYTHON27(00000000,VS_FF_INFOINFERRED,00000010), ref: 1E8CB796
PyModule_AddIntConstant.PYTHON27(00000000,VS_FF_PATCHED,00000004), ref: 1E8CB7A3
PyModule_AddIntConstant.PYTHON27(00000000,VS_FF_PRERELEASE,00000002), ref: 1E8CB7AD
PyModule_AddIntConstant.PYTHON27(00000000,VS_FF_PRIVATEBUILD,00000008), ref: 1E8CB7B7
PyModule_AddIntConstant.PYTHON27(00000000,VS_FF_SPECIALBUILD,00000020), ref: 1E8CB7C1
GetModuleHandleA.KERNEL32(secur32.dll), ref: 1E8CB7D1
LoadLibraryA.KERNEL32(secur32.dll), ref: 1E8CB7EA
GetProcAddress.KERNEL32(00000000,GetUserNameExW), ref: 1E8CB7F8
GetProcAddress.KERNEL32(00000000,GetComputerObjectNameW), ref: 1E8CB805
GetModuleHandleA.KERNEL32(kernel32.dll), ref: 1E8CB811
LoadLibraryA.KERNEL32(kernel32.dll), ref: 1E8CB81E
GetProcAddress.KERNEL32(00000000,GetComputerNameExW), ref: 1E8CB830
GetProcAddress.KERNEL32(00000000,GetLongPathNameA), ref: 1E8CB83D
GetProcAddress.KERNEL32(00000000,GetLongPathNameW), ref: 1E8CB84A
GetProcAddress.KERNEL32(00000000,GetHandleInformation), ref: 1E8CB857
GetProcAddress.KERNEL32(00000000,SetHandleInformation), ref: 1E8CB864
GetProcAddress.KERNEL32(00000000,GlobalMemoryStatusEx), ref: 1E8CB871
GetProcAddress.KERNEL32(00000000,GetSystemFileCacheSize), ref: 1E8CB87E
GetProcAddress.KERNEL32(00000000,SetSystemFileCacheSize), ref: 1E8CB88B
GetProcAddress.KERNEL32(00000000,GetDllDirectoryW), ref: 1E8CB898
GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 1E8CB8A5
GetProcAddress.KERNEL32(00000000,SetSystemPowerState), ref: 1E8CB8B2
GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 1E8CB8BF
GetModuleHandleA.KERNEL32(user32.dll), ref: 1E8CB8CB
LoadLibraryA.KERNEL32(user32.dll), ref: 1E8CB8D8
GetProcAddress.KERNEL32(00000000,EnumDisplayMonitors), ref: 1E8CB8E6
GetProcAddress.KERNEL32(00000000,EnumDisplayDevicesA), ref: 1E8CB8F3
GetProcAddress.KERNEL32(00000000,ChangeDisplaySettingsExA), ref: 1E8CB900
GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 1E8CB90D
GetProcAddress.KERNEL32(00000000,MonitorFromRect), ref: 1E8CB91A
GetProcAddress.KERNEL32(00000000,MonitorFromPoint), ref: 1E8CB927
GetProcAddress.KERNEL32(00000000,GetMonitorInfoA), ref: 1E8CB934
GetProcAddress.KERNEL32(00000000,EnumDisplaySettingsExA), ref: 1E8CB941
GetProcAddress.KERNEL32(00000000,GetLastInputInfo), ref: 1E8CB94E
GetModuleHandleA.KERNEL32(Advapi32.dll), ref: 1E8CB95A
LoadLibraryA.KERNEL32(Advapi32.dll), ref: 1E8CB967
GetProcAddress.KERNEL32(00000000,RegRestoreKeyW), ref: 1E8CB979
GetProcAddress.KERNEL32(00000000,RegSaveKeyExW), ref: 1E8CB986
GetProcAddress.KERNEL32(00000000,RegCreateKeyTransactedW), ref: 1E8CB993
GetProcAddress.KERNEL32(00000000,RegOpenKeyTransactedW), ref: 1E8CB9A0
GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 1E8CB9AD
GetProcAddress.KERNEL32(00000000,RegDeleteKeyTransactedW), ref: 1E8CB9BA
GetProcAddress.KERNEL32(00000000,RegCopyTreeW), ref: 1E8CB9C7
GetProcAddress.KERNEL32(00000000,RegDeleteTreeW), ref: 1E8CB9D4
GetProcAddress.KERNEL32(00000000,RegOpenCurrentUser), ref: 1E8CB9E1
GetProcAddress.KERNEL32(00000000,RegOverridePredefKey), ref: 1E8CB9EE

Strings

NameSamCompatible, xrefs: 1E8CB61C
RegCopyTreeW, xrefs: 1E8CB9BC
GetUserNameExW, xrefs: 1E8CB7F2
VFT_UNKNOWN, xrefs: 1E8CB73D
NameUniqueId, xrefs: 1E8CB630
VS_FF_PATCHED, xrefs: 1E8CB79D
STD_OUTPUT_HANDLE, xrefs: 1E8CB5BB
PyDISPLAY_DEVICEType, xrefs: 1E8CB5EC
VS_FF_DEBUG, xrefs: 1E8CB786
RegCreateKeyTransactedW, xrefs: 1E8CB988
EnumDisplayMonitors, xrefs: 1E8CB8E0
REG_NOTIFY_CHANGE_NAME, xrefs: 1E8CB665
VOS_OS232, xrefs: 1E8CB6D1
Advapi32.dll, xrefs: 1E8CB955
Advapi32.dll, xrefs: 1E8CB962
secur32.dll, xrefs: 1E8CB7E5
RegDeleteKeyExW, xrefs: 1E8CB9A2
SetSystemPowerState, xrefs: 1E8CB8A7
VOS__WINDOWS16, xrefs: 1E8CB6AA
MonitorFromPoint, xrefs: 1E8CB91C
VFT_STATIC_LIB, xrefs: 1E8CB77C
VOS_NT_WINDOWS32, xrefs: 1E8CB719
SetDllDirectoryW, xrefs: 1E8CB89A
STD_INPUT_HANDLE, xrefs: 1E8CB5AE
RegSaveKeyExW, xrefs: 1E8CB97B
NameServicePrincipal, xrefs: 1E8CB65B
VFT_FONT, xrefs: 1E8CB768
RegOverridePredefKey, xrefs: 1E8CB9E3
GetHandleInformation, xrefs: 1E8CB84C
user32.dll, xrefs: 1E8CB8D3
GlobalMemoryStatusEx, xrefs: 1E8CB866
RegDeleteTreeW, xrefs: 1E8CB9C9
REG_NOTIFY_CHANGE_LAST_SET, xrefs: 1E8CB679
user32.dll, xrefs: 1E8CB8C6
VOS_OS216, xrefs: 1E8CB6C1
RegRestoreKeyW, xrefs: 1E8CB973
VS_FF_INFOINFERRED, xrefs: 1E8CB790
STD_ERROR_HANDLE, xrefs: 1E8CB5C8
VS_FF_PRIVATEBUILD, xrefs: 1E8CB7B1
VOS__WINDOWS32, xrefs: 1E8CB6B4
VOS__PM32, xrefs: 1E8CB6E5
GetLastInputInfo, xrefs: 1E8CB943
VFT_DLL, xrefs: 1E8CB751
GetNativeSystemInfo, xrefs: 1E8CB8B4
NameUnknown, xrefs: 1E8CB608
NameCanonical, xrefs: 1E8CB63A
MonitorFromWindow, xrefs: 1E8CB902
kernel32.dll, xrefs: 1E8CB80C
GetComputerNameExW, xrefs: 1E8CB82A
GetMonitorInfoA, xrefs: 1E8CB929
secur32.dll, xrefs: 1E8CB7CC
kernel32.dll, xrefs: 1E8CB819
NameUserPrincipal, xrefs: 1E8CB647
GetSystemFileCacheSize, xrefs: 1E8CB873
NameCanonicalEx, xrefs: 1E8CB651
NameFullyQualifiedDN, xrefs: 1E8CB612
error, xrefs: 1E8CB59B
REG_NOTIFY_CHANGE_ATTRIBUTES, xrefs: 1E8CB66F
RegDeleteKeyTransactedW, xrefs: 1E8CB9AF
GetLongPathNameA, xrefs: 1E8CB832
VOS_DOS_WINDOWS32, xrefs: 1E8CB709
win32api, xrefs: 1E8CB55E
VFT_VXD, xrefs: 1E8CB772
ChangeDisplaySettingsExA, xrefs: 1E8CB8F5
SetHandleInformation, xrefs: 1E8CB859
VOS_UNKNOWN, xrefs: 1E8CB6EF
REG_NOTIFY_CHANGE_SECURITY, xrefs: 1E8CB686
NameDisplay, xrefs: 1E8CB626
RegOpenCurrentUser, xrefs: 1E8CB9D6
EnumDisplayDevicesA, xrefs: 1E8CB8E8
VS_FF_PRERELEASE, xrefs: 1E8CB7A7
VOS_OS216_PM16, xrefs: 1E8CB726
VOS_NT, xrefs: 1E8CB6A0
GetComputerObjectNameW, xrefs: 1E8CB7FA
SetSystemFileCacheSize, xrefs: 1E8CB880
RegOpenKeyTransactedW, xrefs: 1E8CB995
GetLongPathNameW, xrefs: 1E8CB83F
EnumDisplaySettingsExA, xrefs: 1E8CB936
VOS__PM16, xrefs: 1E8CB6DB
MonitorFromRect, xrefs: 1E8CB90F
VS_FF_SPECIALBUILD, xrefs: 1E8CB7BB
VOS_DOS, xrefs: 1E8CB693
VFT_DRV, xrefs: 1E8CB75E
VOS_DOS_WINDOWS16, xrefs: 1E8CB6FC
GetDllDirectoryW, xrefs: 1E8CB88D
VOS_OS232_PM32, xrefs: 1E8CB733
VFT_APP, xrefs: 1E8CB747

Memory Dump Source

Source File: 00000011.00000002.1562490344.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 00000011.00000002.1562469835.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562702731.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562730939.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Module_$Constant$AddressProc$Dict_ItemString$HandleLibraryLoadModule$FromInt_Long$DictInitModule4ReadyType_
String ID: Advapi32.dll$Advapi32.dll$ChangeDisplaySettingsExA$EnumDisplayDevicesA$EnumDisplayMonitors$EnumDisplaySettingsExA$GetComputerNameExW$GetComputerObjectNameW$GetDllDirectoryW$GetHandleInformation$GetLastInputInfo$GetLongPathNameA$GetLongPathNameW$GetMonitorInfoA$GetNativeSystemInfo$GetSystemFileCacheSize$GetUserNameExW$GlobalMemoryStatusEx$MonitorFromPoint$MonitorFromRect$MonitorFromWindow$NameCanonical$NameCanonicalEx$NameDisplay$NameFullyQualifiedDN$NameSamCompatible$NameServicePrincipal$NameUniqueId$NameUnknown$NameUserPrincipal$PyDISPLAY_DEVICEType$REG_NOTIFY_CHANGE_ATTRIBUTES$REG_NOTIFY_CHANGE_LAST_SET$REG_NOTIFY_CHANGE_NAME$REG_NOTIFY_CHANGE_SECURITY$RegCopyTreeW$RegCreateKeyTransactedW$RegDeleteKeyExW$RegDeleteKeyTransactedW$RegDeleteTreeW$RegOpenCurrentUser$RegOpenKeyTransactedW$RegOverridePredefKey$RegRestoreKeyW$RegSaveKeyExW$STD_ERROR_HANDLE$STD_INPUT_HANDLE$STD_OUTPUT_HANDLE$SetDllDirectoryW$SetHandleInformation$SetSystemFileCacheSize$SetSystemPowerState$VFT_APP$VFT_DLL$VFT_DRV$VFT_FONT$VFT_STATIC_LIB$VFT_UNKNOWN$VFT_VXD$VOS_DOS$VOS_DOS_WINDOWS16$VOS_DOS_WINDOWS32$VOS_NT$VOS_NT_WINDOWS32$VOS_OS216$VOS_OS216_PM16$VOS_OS232$VOS_OS232_PM32$VOS_UNKNOWN$VOS__PM16$VOS__PM32$VOS__WINDOWS16$VOS__WINDOWS32$VS_FF_DEBUG$VS_FF_INFOINFERRED$VS_FF_PATCHED$VS_FF_PRERELEASE$VS_FF_PRIVATEBUILD$VS_FF_SPECIALBUILD$error$kernel32.dll$kernel32.dll$secur32.dll$secur32.dll$user32.dll$user32.dll$win32api
API String ID: 2582702285-985789483
Opcode ID: ead2e87ef3a4f544397b7777cb638994a51bd0e8cfd7cb7cab4ddda1ef9f3e25
Instruction ID: 1f9d42c9a3b336967154572d110ad678d9a1698f697250cb1efe152d7487b895
Opcode Fuzzy Hash: ead2e87ef3a4f544397b7777cb638994a51bd0e8cfd7cb7cab4ddda1ef9f3e25
Instruction Fuzzy Hash: E8B19571941B6876D22237764C89FDFBDA9FFD2B64F010326F508B2381DE78850989A9

Function 1ECB3D00 Relevance: 22.8, APIs: 11, Strings: 2, Instructions: 99
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PyArg_ParseTuple.PYTHON27(?,OOl:OpenSCManager,?,?,?), ref: 1ECB3D2F
?PyWinObject_AsWCHAR@@YAHPAU_object@@PAPA_WHPAK@Z.PYWINTYPES27(?,?,00000001,00000000), ref: 1ECB3D55
?PyWinObject_AsWCHAR@@YAHPAU_object@@PAPA_WHPAK@Z.PYWINTYPES27(?,?,00000001,00000000), ref: 1ECB3D6B

Strings

OpenSCManager, xrefs: 1ECB3DBF
OOl:OpenSCManager, xrefs: 1ECB3D19

Memory Dump Source

Source File: 00000011.00000002.1562974427.000000001ECB1000.00000040.00000001.01000000.00000011.sdmp, Offset: 1ECB0000, based on PE: true

Associated: 00000011.00000002.1562937771.000000001ECB0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.1562974427.000000001ECBA000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.1562974427.000000001ECBD000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.1563084050.000000001ECBF000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000011.00000002.1563108682.000000001ECC0000.00000004.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1ecb0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Object_U_object@@$Arg_ParseTuple
String ID: OOl:OpenSCManager$OpenSCManager
API String ID: 1248562531-1952627657
Opcode ID: 66dcbcb519fdc23cccf6af2a444bd2ed14421ae6063d3bb570269975d64d819c
Instruction ID: b3a073d5f566fc5d7ae25265f7a5d5f3a984a049d57e3083ca290d963a08920a
Opcode Fuzzy Hash: 66dcbcb519fdc23cccf6af2a444bd2ed14421ae6063d3bb570269975d64d819c
Instruction Fuzzy Hash: FB2161B25142119FD300DF68DDC089BB7A8EFC8A90F444A6DFD4593201E635D9098BA3

Function 034170D0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 35
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 03417000: GetCurrentProcess.KERNEL32(?,00000000,?,034170D6), ref: 0341700B
Part of subcall function 03417000: OpenProcessToken.ADVAPI32(00000000,00000028,00000000,?,00000000,?,034170D6), ref: 03417021
Part of subcall function 03417000: GetLastError.KERNEL32(?,00000000,?,034170D6), ref: 03417027
Part of subcall function 03417000: ImpersonateSelf.ADVAPI32(00000002,?,00000000,?,034170D6), ref: 03417036

GetLastError.KERNEL32(034159F6), ref: 034170E9
PyErr_WarnEx.PYTHON27(?,psutil module couldn't set SE DEBUG mode for this process; please file an issue against psutil bug tracker,00000001), ref: 03417103
PyErr_Clear.PYTHON27 ref: 0341710C
RevertToSelf.KERNELBASE(034159F6), ref: 0341712E
FindCloseChangeNotification.KERNEL32(00000000), ref: 03417135

Strings

psutil module couldn't set SE DEBUG mode for this process; please file an issue against psutil bug tracker, xrefs: 034170DC, 034170FD
SeDebugPrivilege, xrefs: 03417118

Memory Dump Source

Source File: 00000011.00000002.1560676867.0000000003411000.00000040.00000001.01000000.0000000F.sdmp, Offset: 03410000, based on PE: true

Associated: 00000011.00000002.1560637646.0000000003410000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560676867.000000000341B000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560676867.000000000341F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560836323.0000000003423000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_3410000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Err_ErrorLastProcessSelf$ChangeClearCloseCurrentFindImpersonateNotificationOpenRevertTokenWarn
String ID: SeDebugPrivilege$psutil module couldn't set SE DEBUG mode for this process; please file an issue against psutil bug tracker
API String ID: 10321130-1858787864
Opcode ID: 1df314fc5f425811d8fa1b593c6bc899358187dd3571bdc89aed68b9d4c49b3e
Instruction ID: bce809cdc81384ce8400e1d15d1ca957352c962aef93abb0b4fa2d1eb02f4e79
Opcode Fuzzy Hash: 1df314fc5f425811d8fa1b593c6bc899358187dd3571bdc89aed68b9d4c49b3e
Instruction Fuzzy Hash: 0DF08279A00E005FD692F774BC5D62E7BA19F8A640B19042AF902DD34AEFA1D460C65E

Function 03417BE0 Relevance: 10.5, APIs: 7, Instructions: 40
librarythreadloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PyEval_SaveThread.PYTHON27(?,00000000,?,03417CAF,ntdll.dll,NtQuerySystemInformation,03417FF5,034159E9), ref: 03417BE3
LoadLibraryA.KERNEL32(?,?,00000000,?,03417CAF,ntdll.dll,NtQuerySystemInformation,03417FF5,034159E9), ref: 03417BF0
PyEval_RestoreThread.PYTHON27(00000000,?,00000000,?,03417CAF,ntdll.dll,NtQuerySystemInformation,03417FF5,034159E9), ref: 03417BF9
PyErr_SetFromWindowsErrWithFilename.PYTHON27(00000000,?,034159E9), ref: 03417C08
GetProcAddress.KERNEL32(00000000,?), ref: 03417C1D
PyErr_SetFromWindowsErrWithFilename.PYTHON27(00000000,?), ref: 03417C29
FreeLibrary.KERNEL32(00000000), ref: 03417C33

Memory Dump Source

Source File: 00000011.00000002.1560676867.0000000003411000.00000040.00000001.01000000.0000000F.sdmp, Offset: 03410000, based on PE: true

Associated: 00000011.00000002.1560637646.0000000003410000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560676867.000000000341B000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560676867.000000000341F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560836323.0000000003423000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_3410000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Err_Eval_FilenameFromLibraryThreadWindowsWith$AddressFreeLoadProcRestoreSave
String ID:
API String ID: 568911590-0
Opcode ID: 6ce7fbeb7e04416bd3bdab298fb13f36c17f3d7ee3aab062d395f88ac5ec783e
Instruction ID: c7c8a3402dbafaddb6e39e835363cde4dccd3488d4cbc621befd0a84756d0b47
Opcode Fuzzy Hash: 6ce7fbeb7e04416bd3bdab298fb13f36c17f3d7ee3aab062d395f88ac5ec783e
Instruction Fuzzy Hash: 0BF0E272A01920ABDB10BBB5BC5C95F7BECEEC52627080C39F905EB201E724881586F6

Non-executed Functions

Function 03412CC0 Relevance: 109.4, APIs: 50, Strings: 12, Instructions: 885COMMON

Download Yara Rule

APIs

PyLong_FromLong.PYTHON27(00000002), ref: 03412CE6
PyLong_FromLong.PYTHON27(00000017), ref: 03412CF0
PyLong_FromLong.PYTHON27(00000001), ref: 03412CF8
PyLong_FromLong.PYTHON27(00000002), ref: 03412D00
PyArg_ParseTuple.PYTHON27(?,lOO,?,?,?), ref: 03412D24
PySequence_Check.PYTHON27(?), ref: 03412D40
PySequence_Check.PYTHON27(?), ref: 03412D52
PyList_New.PYTHON27(00000000), ref: 03412E41
PySequence_Contains.PYTHON27(?,00000000), ref: 03412E5E
PySequence_Contains.PYTHON27(?,?), ref: 03412E76
PyTuple_New.PYTHON27(?), ref: 03412EEA
RtlIpv4AddressToStringA.NTDLL(?,?), ref: 03412F06
Py_BuildValue.PYTHON27((si),?,00000000), ref: 03412F2D
RtlIpv4AddressToStringA.NTDLL(?,?), ref: 03412F63
Py_BuildValue.PYTHON27((si),?,00000002), ref: 03412F8B
PyTuple_New.PYTHON27(00000000), ref: 03412F98
Py_BuildValue.PYTHON27((iiiNNiI),000000FF,00000002,00000001,00000000,?,00000002,?), ref: 03412FC6
PyList_Append.PYTHON27(?,00000000), ref: 03412FDF
73BB3B4E.MSVCR90(?), ref: 03413017
PySequence_Contains.PYTHON27(?,?), ref: 03413040
PySequence_Contains.PYTHON27(?,?), ref: 03413058
RtlIpv6AddressToStringA.NTDLL(?,?), ref: 03413138
Py_BuildValue.PYTHON27((si),?,00000000), ref: 0341315F
RtlIpv6AddressToStringA.NTDLL(?,?), ref: 034131DA
Py_BuildValue.PYTHON27((si),?,?), ref: 03413202
PyTuple_New.PYTHON27(00000000), ref: 0341320F
Py_BuildValue.PYTHON27((iiiNNiI),000000FF,00000017,00000001,00000000,?,00000002,?), ref: 0341323D
PyList_Append.PYTHON27(?,00000000), ref: 03413256
73BB3B4E.MSVCR90(?), ref: 0341329A
PySequence_Contains.PYTHON27(?,00000000), ref: 034132C3
PySequence_Contains.PYTHON27(?,00000000), ref: 034132D7
PyTuple_New.PYTHON27(?), ref: 0341334A
PyTuple_New.PYTHON27(00000000,00000080,?), ref: 034133AB
Py_BuildValue.PYTHON27((iiiNNiI),000000FF,00000002,00000002,00000000,00000000), ref: 034133C1
PyList_Append.PYTHON27(?,00000000), ref: 034133DA
73BB3B4E.MSVCR90(?), ref: 03413412
PySequence_Contains.PYTHON27(?,?), ref: 0341343B
PySequence_Contains.PYTHON27(?,00000000), ref: 0341344F
73BB3B4E.MSVCR90(?), ref: 03413707
PyErr_SetString.PYTHON27(?,arg 2 or 3 is not a sequence), ref: 03413777

Strings

(si), xrefs: 03413388
lOO, xrefs: 03412D1A
(iiiNNiI), xrefs: 034133BC
(si), xrefs: 0341315A
(iiiNNiI), xrefs: 0341357B
(si), xrefs: 03412F28
(si), xrefs: 034131FD
arg 2 or 3 is not a sequence, xrefs: 03413771
(si), xrefs: 03412F86
(iiiNNiI), xrefs: 03413238
(si), xrefs: 0341353A
(iiiNNiI), xrefs: 03412FC1

Memory Dump Source

Source File: 00000011.00000002.1560676867.0000000003411000.00000040.00000001.01000000.0000000F.sdmp, Offset: 03410000, based on PE: true

Associated: 00000011.00000002.1560637646.0000000003410000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560676867.000000000341B000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560676867.000000000341F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560836323.0000000003423000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_3410000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Sequence_$Contains$BuildValue$StringTuple_$AddressFromList_LongLong_$Append$CheckIpv4Ipv6$Arg_Err_ParseTuple
String ID: (iiiNNiI)$(iiiNNiI)$(iiiNNiI)$(iiiNNiI)$(si)$(si)$(si)$(si)$(si)$(si)$arg 2 or 3 is not a sequence$lOO
API String ID: 881133558-215568841
Opcode ID: 2eb38caf1e304197e7c966cd431f7080ee959e224622540bc478c36985493e91
Instruction ID: 74476bed290d45f3f59717da58ff827fd212f231919ad02cddea0ba9361a072f
Opcode Fuzzy Hash: 2eb38caf1e304197e7c966cd431f7080ee959e224622540bc478c36985493e91
Instruction Fuzzy Hash: 7262E3B5A047019FDB20DF64D884A6BB7E4FF84324F044A2AF9658F390D734E925CB96

Function 03416100 Relevance: 52.8, APIs: 14, Strings: 16, Instructions: 280COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00001410,00000000,00000001,?,00000000,?,00000000), ref: 03416130
GetCurrentProcess.KERNEL32(?,?,00000000), ref: 0341614F
IsWow64Process.KERNEL32(00000000,?,00000000), ref: 0341615C
IsWow64Process.KERNEL32(00000000,?,?,00000000), ref: 0341616C
PyErr_Clear.PYTHON27(?,?,?,00000000), ref: 034161AE
PyErr_Clear.PYTHON27(?,?,?,00000000), ref: 034161E6
CloseHandle.KERNEL32(00000000,?,?,00000000), ref: 03416488
73BB3B4E.MSVCR90(00000000,?,?,00000000), ref: 03416493

Part of subcall function 034110D0: PyObject_CallFunction.PYTHON27(?,(is),0000000D,00000000,0341D7E0), ref: 0341110A
Part of subcall function 034110D0: PyErr_SetObject.PYTHON27(00000000,00000000,?,(is),0000000D,00000000,0341D7E0), ref: 0341111C

Part of subcall function 03417BE0: PyEval_SaveThread.PYTHON27(?,00000000,?,03417CAF,ntdll.dll,NtQuerySystemInformation,03417FF5,034159E9), ref: 03417BE3
Part of subcall function 03417BE0: LoadLibraryA.KERNEL32(?,?,00000000,?,03417CAF,ntdll.dll,NtQuerySystemInformation,03417FF5,034159E9), ref: 03417BF0
Part of subcall function 03417BE0: PyEval_RestoreThread.PYTHON27(00000000,?,00000000,?,03417CAF,ntdll.dll,NtQuerySystemInformation,03417FF5,034159E9), ref: 03417BF9
Part of subcall function 03417BE0: PyErr_SetFromWindowsErrWithFilename.PYTHON27(00000000,?,034159E9), ref: 03417C08

Strings

ReadProcessMemory, xrefs: 03416342
NtWow64ReadVirtualMemory64(ProcessParameters), xrefs: 0341627E
ntdll.dll, xrefs: 034161D0
IsWow64Process, xrefs: 0341647A
ReadProcessMemory(ProcessParameters), xrefs: 03416361
NtWow64QueryInformationProcess64, xrefs: 03416193
can't query 64-bit process in 32-bit-WoW mode, xrefs: 034163BE
NtWow64ReadVirtualMemory64, xrefs: 03416432
NtWow64ReadVirtualMemory64, xrefs: 03416248
NtQueryInformationProcess(ProcessBasicInformation), xrefs: 03416314
ntdll.dll, xrefs: 03416198
NtWow64QueryInformationProcess64(ProcessBasicInformation), xrefs: 03416215
ReadProcessMemory, xrefs: 0341644D
can't query 64-bit process in 32-bit-WoW mode, xrefs: 034161B4
can't query 64-bit process in 32-bit-WoW mode, xrefs: 034161EC
NtWow64ReadVirtualMemory64, xrefs: 034161CB

Memory Dump Source

Source File: 00000011.00000002.1560676867.0000000003411000.00000040.00000001.01000000.0000000F.sdmp, Offset: 03410000, based on PE: true

Associated: 00000011.00000002.1560637646.0000000003410000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560676867.000000000341B000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560676867.000000000341F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560836323.0000000003423000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_3410000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Err_Process$ClearEval_ThreadWow64$CallCloseCurrentFilenameFromFunctionHandleLibraryLoadObjectObject_OpenRestoreSaveWindowsWith
String ID: IsWow64Process$NtQueryInformationProcess(ProcessBasicInformation)$NtWow64QueryInformationProcess64$NtWow64QueryInformationProcess64(ProcessBasicInformation)$NtWow64ReadVirtualMemory64$NtWow64ReadVirtualMemory64$NtWow64ReadVirtualMemory64$NtWow64ReadVirtualMemory64(ProcessParameters)$ReadProcessMemory$ReadProcessMemory$ReadProcessMemory(ProcessParameters)$can't query 64-bit process in 32-bit-WoW mode$can't query 64-bit process in 32-bit-WoW mode$can't query 64-bit process in 32-bit-WoW mode$ntdll.dll$ntdll.dll
API String ID: 586966080-721633947
Opcode ID: d8da6395ef58f63a15ad3fe142dbb035e6f05f53acbc00387e89b3a18d2268cf
Instruction ID: 7fc2bc43047e60e8e43f6b491feebaaca54c32b7d3498ecf1ced46939918dd2e
Opcode Fuzzy Hash: d8da6395ef58f63a15ad3fe142dbb035e6f05f53acbc00387e89b3a18d2268cf
Instruction Fuzzy Hash: 4591E371644B01AFD720EF519C84F7BB7E8AB80B00F05452FFD949E284E778D82587AA

Function 03416970 Relevance: 52.7, APIs: 29, Strings: 1, Instructions: 243memorynativeCOMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 0341699E
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 034169A9
RtlInitializeCriticalSection.NTDLL(0341DBC0), ref: 034169B5
RtlEnterCriticalSection.NTDLL(0341DBC0), ref: 034169CA
PyList_New.PYTHON27(00000000), ref: 034169EF
GetProcessHeap.KERNEL32(00000000,00000000), ref: 03416A0A
HeapFree.KERNEL32(00000000), ref: 03416A0D
GetProcessHeap.KERNEL32(00000008,00010000), ref: 03416A18
RtlAllocateHeap.NTDLL(00000000), ref: 03416A1B
NtQuerySystemInformation.NTDLL(00000040,00000000,00010000,?), ref: 03416A30
PyErr_NoMemory.PYTHON27 ref: 03416A54
GetProcessHeap.KERNEL32(00000000,00000000), ref: 03416BFF
HeapFree.KERNEL32(00000000), ref: 03416C02
CloseHandle.KERNEL32(00000000), ref: 03416C24
GetProcessHeap.KERNEL32(00000000,00000000), ref: 03416C36
HeapFree.KERNEL32(00000000), ref: 03416C39
RtlLeaveCriticalSection.NTDLL(0341DBC0), ref: 03416C67

Strings

NtQuerySystemInformation(SystemExtendedHandleInformation), xrefs: 03416A41

Memory Dump Source

Source File: 00000011.00000002.1560676867.0000000003411000.00000040.00000001.01000000.0000000F.sdmp, Offset: 03410000, based on PE: true

Associated: 00000011.00000002.1560637646.0000000003410000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560676867.000000000341B000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560676867.000000000341F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560836323.0000000003423000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_3410000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Heap$Process$CriticalFreeSection$CreateEvent$AllocateCloseEnterErr_HandleInformationInitializeLeaveList_MemoryQuerySystem
String ID: NtQuerySystemInformation(SystemExtendedHandleInformation)
API String ID: 1998073440-3808510385
Opcode ID: b1466c626f9b35b543e410901169d51e96b47f9e4145aa4b54fb76b6334aec7e
Instruction ID: 2b71d109bea40b9116ec6e0cfd072dfe8923c1eab2fd2176118d4e8a7de62299
Opcode Fuzzy Hash: b1466c626f9b35b543e410901169d51e96b47f9e4145aa4b54fb76b6334aec7e
Instruction Fuzzy Hash: F281A1F0A00A119FC710FF64989893B7BE8EB45314F0A442EE956AF314D778D954CBA5

Function 1E7AACE0 Relevance: 49.1, APIs: 16, Strings: 12, Instructions: 93libraryloadermemoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(AdvAPI32.dll), ref: 1E7AACE6
LoadLibraryA.KERNEL32(AdvAPI32.dll), ref: 1E7AACF7
GetProcAddress.KERNEL32(00000000,AddAccessAllowedAce), ref: 1E7AAD14
GetProcAddress.KERNEL32(00000000,AddAccessDeniedAce), ref: 1E7AAD25
GetProcAddress.KERNEL32(00000000,AddAccessAllowedAceEx), ref: 1E7AAD36
GetProcAddress.KERNEL32(00000000,AddMandatoryAce), ref: 1E7AAD47
GetProcAddress.KERNEL32(00000000,AddAccessAllowedObjectAce), ref: 1E7AAD58
GetProcAddress.KERNEL32(00000000,AddAccessDeniedAceEx), ref: 1E7AAD69
GetProcAddress.KERNEL32(00000000,AddAccessDeniedObjectAce), ref: 1E7AAD7A
GetProcAddress.KERNEL32(00000000,AddAuditAccessAceEx), ref: 1E7AAD8B
GetProcAddress.KERNEL32(00000000,AddAuditAccessObjectAce), ref: 1E7AAD9C
GetProcAddress.KERNEL32(00000000,SetSecurityDescriptorControl), ref: 1E7AADAD
RtlInitializeCriticalSection.NTDLL(1E7BA82C), ref: 1E7AADCD
TlsAlloc.KERNEL32 ref: 1E7AADD3
RtlDeleteCriticalSection.NTDLL(1E7BA82C), ref: 1E7AADEB
TlsFree.KERNEL32(00000012), ref: 1E7AADF7

Strings

AdvAPI32.dll, xrefs: 1E7AACF2
AddAuditAccessObjectAce, xrefs: 1E7AAD96
AddMandatoryAce, xrefs: 1E7AAD41
AddAuditAccessAceEx, xrefs: 1E7AAD85
AddAccessDeniedAceEx, xrefs: 1E7AAD63
AddAccessDeniedAce, xrefs: 1E7AAD1F
AddAccessAllowedObjectAce, xrefs: 1E7AAD52
AddAccessAllowedAce, xrefs: 1E7AAD0E
AdvAPI32.dll, xrefs: 1E7AACE1
AddAccessDeniedObjectAce, xrefs: 1E7AAD74
AddAccessAllowedAceEx, xrefs: 1E7AAD30
SetSecurityDescriptorControl, xrefs: 1E7AADA7

Memory Dump Source

Source File: 00000011.00000002.1561923280.000000001E7A1000.00000040.00000001.01000000.00000012.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000011.00000002.1561891626.000000001E7A0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7B9000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7BE000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562197228.000000001E7C0000.00000080.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562233172.000000001E7C2000.00000004.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e7a0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: AddressProc$CriticalSection$AllocDeleteFreeHandleInitializeLibraryLoadModule
String ID: AddAccessAllowedAce$AddAccessAllowedAceEx$AddAccessAllowedObjectAce$AddAccessDeniedAce$AddAccessDeniedAceEx$AddAccessDeniedObjectAce$AddAuditAccessAceEx$AddAuditAccessObjectAce$AddMandatoryAce$AdvAPI32.dll$AdvAPI32.dll$SetSecurityDescriptorControl
API String ID: 3842108915-2837477449
Opcode ID: 6a85e54d232ae245f90c38ea5591fad26924d9114178a61a040f1352046b848e
Instruction ID: e4b007d19bfe567fcd06646b113f23806bbe094c5fc45cf829de93aa7fb5f3b3
Opcode Fuzzy Hash: 6a85e54d232ae245f90c38ea5591fad26924d9114178a61a040f1352046b848e
Instruction Fuzzy Hash: C72121719016266BF301BB359C54EAB36EDEF99783B064325E940D2628EB25C502CFB5

Function 034141B0 Relevance: 47.6, APIs: 23, Strings: 4, Instructions: 307threadCOMMON

Download Yara Rule

APIs

PyList_New.PYTHON27(00000000), ref: 034141E6
SetErrorMode.KERNEL32(00000001,?,00000410), ref: 03414208
PyArg_ParseTuple.PYTHON27(?,0341B728,?,?,00000410), ref: 03414224
PyObject_IsTrue.PYTHON27(?), ref: 0341423A
PyEval_SaveThread.PYTHON27 ref: 03414247
GetLogicalDriveStringsA.KERNEL32(000000FE,?), ref: 03414259
PyEval_RestoreThread.PYTHON27(00000000), ref: 03414262
PyErr_SetFromWindowsErr.PYTHON27(00000000), ref: 03414270
SetErrorMode.KERNEL32(?), ref: 0341454A

Strings

A:\, xrefs: 034142EE
,compressed, xrefs: 03414398
(ssss), xrefs: 034144D0
(ssss), xrefs: 03414421

Memory Dump Source

Source File: 00000011.00000002.1560676867.0000000003411000.00000040.00000001.01000000.0000000F.sdmp, Offset: 03410000, based on PE: true

Associated: 00000011.00000002.1560637646.0000000003410000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560676867.000000000341B000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560676867.000000000341F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560836323.0000000003423000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_3410000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: ErrorEval_ModeThread$Arg_DriveErr_FromList_LogicalObject_ParseRestoreSaveStringsTrueTupleWindows
String ID: (ssss)$(ssss)$,compressed$A:\
API String ID: 1855366723-68049997
Opcode ID: fea87f47b3f26f49ed1478d490ddfb8ca3fcd176b8aeba8684c61d9f1e1da20d
Instruction ID: b79700bdad59a8e46e0603dce71677dee4a5c8eeca4b6b299f1930b692973230
Opcode Fuzzy Hash: fea87f47b3f26f49ed1478d490ddfb8ca3fcd176b8aeba8684c61d9f1e1da20d
Instruction Fuzzy Hash: CAA11571504B019FC320DB61DC88FABB7F8AB84714F080A1EFA999E380E775D519CB96

Function 1E7A7760 Relevance: 42.2, APIs: 15, Strings: 9, Instructions: 188memoryCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27 ref: 1E7A778B
PyErr_Clear.PYTHON27 ref: 1E7A779E
PyArg_ParseTuple.PYTHON27(?,s#:SID,?,?), ref: 1E7A77B0
PyErr_Clear.PYTHON27 ref: 1E7A77BD
PyArg_ParseTuple.PYTHON27(?,(bbbbbb)O:SID,?,?,?,?,?,?,?), ref: 1E7A77E8
PySequence_Check.PYTHON27(?), ref: 1E7A77F6
PyErr_SetString.PYTHON27(00000000,sub authorities sequence size must be <= 8), ref: 1E7A7811
PySequence_Size.PYTHON27(?), ref: 1E7A7828
PySequence_Tuple.PYTHON27(?), ref: 1E7A7844
PyArg_ParseTuple.PYTHON27(00000000,|llllllll:SID,?,?,?,?,?,?,?,?), ref: 1E7A7881
PyErr_SetString.PYTHON27(?,sub authorities must be a sequence of integers.), ref: 1E7A78AA
AllocateAndInitializeSid.ADVAPI32(?,00000000,?,?,?,?,?,?,?,?,?), ref: 1E7A78EF
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(AllocateAndInitializeSid,00000000), ref: 1E7A78FF

Part of subcall function 1E7A9F20: GetLastError.KERNEL32(00000000,?,1E7A5F68,MakeSelfRelativeSD,00000000), ref: 1E7A9F2A
Part of subcall function 1E7A9F20: ?PyWin_GetErrorMessageModule@@YAPAUHINSTANCE__@@K@Z.PYWINTYPES27(00000000,00000000,?,1E7A5F68,MakeSelfRelativeSD,00000000), ref: 1E7A9F38
Part of subcall function 1E7A9F20: FormatMessageA.KERNEL32(00001300,00000000,00000000,00000000,?,00000000,00000000), ref: 1E7A9F69
Part of subcall function 1E7A9F20: ?PyWinObject_FromTCHAR@@YAPAU_object@@PBDH@Z.PYWINTYPES27(No error message is available,000000FF,?,?,?,?,?,?,?,?,?,?,00000000), ref: 1E7A9FC7
Part of subcall function 1E7A9F20: ?PyWinCoreString_FromString@@YAPAU_object@@PBDH@Z.PYWINTYPES27(?,000000FF,00000000,?,73BB3D3F), ref: 1E7A9FD7
Part of subcall function 1E7A9F20: Py_BuildValue.PYTHON27((iNN),00000000,00000000,?,00000000,?,73BB3D3F), ref: 1E7A9FE6
Part of subcall function 1E7A9F20: LocalFree.KERNEL32(?), ref: 1E7A9FFF
Part of subcall function 1E7A9F20: PyErr_SetObject.PYTHON27(031BEB40,00000000), ref: 1E7AA010

??0PySID@@QAE@PAX@Z.PYWINTYPES27(?), ref: 1E7A7927
??0PySID@@QAE@HPAX@Z.PYWINTYPES27(?,?), ref: 1E7A7951

Strings

(bbbbbb)O:SID, xrefs: 1E7A77E2
|i:SID, xrefs: 1E7A7775
AllocateAndInitializeSid, xrefs: 1E7A78FA
sub authorities sequence size must be <= 8, xrefs: 1E7A7838
, xrefs: 1E7A7783
|llllllll:SID, xrefs: 1E7A787B
sub authorities must be a sequence of integers., xrefs: 1E7A78A4
sub authorities must be a sequence of integers., xrefs: 1E7A7803
s#:SID, xrefs: 1E7A77AA

Memory Dump Source

Source File: 00000011.00000002.1561923280.000000001E7A1000.00000040.00000001.01000000.00000012.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000011.00000002.1561891626.000000001E7A0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7B9000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7BE000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562197228.000000001E7C0000.00000080.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562233172.000000001E7C2000.00000004.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e7a0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Err_Tuple$Arg_Parse$Sequence_U_object@@$ClearErrorFromMessageStringWin_$AllocateBuildCheckCoreE__@@Error@@FormatFreeInitializeLastLocalModule@@ObjectObject_SizeString@@String_Value
String ID: $(bbbbbb)O:SID$AllocateAndInitializeSid$s#:SID$sub authorities must be a sequence of integers.$sub authorities must be a sequence of integers.$sub authorities sequence size must be <= 8$|i:SID$|llllllll:SID
API String ID: 3930113695-2159023040
Opcode ID: 62e4bf38b69474a7b4bc0764591f66a26398c3a547c6a95a7976340fc45e5968
Instruction ID: 028371bcb55190a90e016fd9607be3886910ebd3da858fc0b76b4ee8474cc587
Opcode Fuzzy Hash: 62e4bf38b69474a7b4bc0764591f66a26398c3a547c6a95a7976340fc45e5968
Instruction Fuzzy Hash: 0C5142B6614245ABE305DB94DC80DDFB7EDAFC8314F084B1DFA4687250E635E909CBA2

Function 03416C80 Relevance: 38.7, APIs: 21, Strings: 1, Instructions: 201memoryfilenativeCOMMON

Download Yara Rule

APIs

PyList_New.PYTHON27(00000000), ref: 03416CB7
GetProcessHeap.KERNEL32(00000000,00000000), ref: 03416CDE
HeapFree.KERNEL32(00000000), ref: 03416CE5
GetProcessHeap.KERNEL32(00000008,00010000), ref: 03416CF0
RtlAllocateHeap.NTDLL(00000000), ref: 03416CF7
NtQuerySystemInformation.NTDLL(00000040,00000000,00010000,?), ref: 03416D0C
CloseHandle.KERNEL32(?), ref: 03416D3D
GetProcessHeap.KERNEL32(00000000,00000000), ref: 03416D56
HeapFree.KERNEL32(00000000), ref: 03416D5D
PyErr_NoMemory.PYTHON27 ref: 03416D94
GetCurrentProcess.KERNEL32(?,00000000,00000001,00000002), ref: 03416DD5
DuplicateHandle.KERNEL32(?,00000000,00000000), ref: 03416DE4
CreateFileMappingA.KERNEL32(?,00000000,00000002,00000000,00000000,00000000), ref: 03416E01
MapViewOfFile.KERNEL32(00000000,00000004,00000000,00000000,00000001), ref: 03416E1A
GetCurrentProcess.KERNEL32(00000000,?,00000104), ref: 03416E31
GetMappedFileNameA.PSAPI(00000000), ref: 03416E34
PyUnicodeUCS2_FromWideChar.PYTHON27(?,00000000,00000000), ref: 03416E4A
PyList_Append.PYTHON27(?,00000000), ref: 03416E5F

Strings

NtQuerySystemInformation(SystemExtendedHandleInformation), xrefs: 03416D1D

Memory Dump Source

Source File: 00000011.00000002.1560676867.0000000003411000.00000040.00000001.01000000.0000000F.sdmp, Offset: 03410000, based on PE: true

Associated: 00000011.00000002.1560637646.0000000003410000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560676867.000000000341B000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560676867.000000000341F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560836323.0000000003423000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_3410000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Heap$Process$File$CurrentFreeHandleList_$AllocateAppendCharCloseCreateDuplicateErr_FromInformationMappedMappingMemoryNameQuerySystemUnicodeViewWide
String ID: NtQuerySystemInformation(SystemExtendedHandleInformation)
API String ID: 3366806375-3808510385
Opcode ID: 79b46f29d273e3b5328b37fe222aaf8dac991ef6519ce17968c6c434783b30a5
Instruction ID: b875ceba6551b60cc57bceaeee84a04511054be723eb267d8c67555e16b23022
Opcode Fuzzy Hash: 79b46f29d273e3b5328b37fe222aaf8dac991ef6519ce17968c6c434783b30a5
Instruction Fuzzy Hash: CF610570944B01ABE720EF64D948B6BBBE8AF84710F09051DFD45AF380D778D854CBAA

Function 03415650 Relevance: 36.9, APIs: 15, Strings: 6, Instructions: 192nativeCOMMON

Download Yara Rule

APIs

PyErr_SetFromWindowsErr.PYTHON27(00000000), ref: 03415680
PyErr_SetString.PYTHON27(?,GetSystemInfo() failed to retrieve CPU count), ref: 034156B7
PyErr_NoMemory.PYTHON27 ref: 034156E4
NtQuerySystemInformation.NTDLL(00000002,00000000,00000004,00000000), ref: 034156F5
73BB3B4E.MSVCR90(?), ref: 034157AD
73BB3B4E.MSVCR90(?), ref: 034157BB
73BB3B4E.MSVCR90(00000000), ref: 034157C5
73BB3B4E.MSVCR90(?), ref: 0341581A
73BB3B4E.MSVCR90(?), ref: 03415821
73BB3B4E.MSVCR90(00000000), ref: 03415824
Py_BuildValue.PYTHON27(kkkk,?,?,?,?), ref: 03415849

Strings

GetSystemInfo() failed to retrieve CPU count, xrefs: 034156B1
NtQuerySystemInformation(SystemInterruptInformation), xrefs: 0341573C
NtQuerySystemInformation(SystemProcessorPerformanceInformation), xrefs: 03415790
kkkk, xrefs: 03415844
GetActiveProcessorCount() not available; using GetSystemInfo(), xrefs: 03415693
NtQuerySystemInformation(SystemPerformanceInformation), xrefs: 034156FF

Memory Dump Source

Source File: 00000011.00000002.1560676867.0000000003411000.00000040.00000001.01000000.0000000F.sdmp, Offset: 03410000, based on PE: true

Associated: 00000011.00000002.1560637646.0000000003410000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560676867.000000000341B000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560676867.000000000341F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560836323.0000000003423000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_3410000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Err_$BuildFromInformationMemoryQueryStringSystemValueWindows
String ID: GetActiveProcessorCount() not available; using GetSystemInfo()$GetSystemInfo() failed to retrieve CPU count$NtQuerySystemInformation(SystemInterruptInformation)$NtQuerySystemInformation(SystemPerformanceInformation)$NtQuerySystemInformation(SystemProcessorPerformanceInformation)$kkkk
API String ID: 918436300-3520883961
Opcode ID: 75dd92535d6322ab213d58f1ed8e5ce56a816c1ca43c7de08e858692d605ea1c
Instruction ID: ed372fb40741962a2a08ec7edb1a502dd7c8db69bef3c51324797e6a34e6f09c
Opcode Fuzzy Hash: 75dd92535d6322ab213d58f1ed8e5ce56a816c1ca43c7de08e858692d605ea1c
Instruction Fuzzy Hash: 09512E72A44B048FD310EF58DC859AFB7E8EFC1614F09046EE8669F200D774E5158BEA

Function 1E7D2D10 Relevance: 35.2, APIs: 8, Strings: 12, Instructions: 191COMMON

Download Yara Rule

APIs

GetCommandLineW.KERNEL32(?), ref: 1E7D2D1F
CommandLineToArgvW.SHELL32(00000000), ref: 1E7D2D26
GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 1E7D2D55
GetModuleHandleW.KERNEL32(00000000,000003F8,?,00000100), ref: 1E7D2E14
LoadStringW.USER32(00000000), ref: 1E7D2E1B
PythonService_PrepareToHostSingle.SERVICEMANAGER(00000000), ref: 1E7D2E6E

Strings

debug, xrefs: 1E7D2DEB
%s - Python Service Manager, xrefs: 1E7D2F22
-debug servicename [parms] - debug the Python service., xrefs: 1E7D2F37
-register - register the EXE - this should generally not be necessary., xrefs: 1E7D2F30
Debugging service %s - press Ctrl+C to stop., xrefs: 1E7D2E57
service using Control Panel, or 'net start service_name', xrefs: 1E7D2F45
Options:, xrefs: 1E7D2F29
register, xrefs: 1E7D2DB9
-debug requires a service name, xrefs: 1E7D2E33
NOTE: You do not start the service using this program - start the, xrefs: 1E7D2F3E
install, xrefs: 1E7D2DD2
Could not start the service - error %d, xrefs: 1E7D2F6C

Memory Dump Source

Source File: 00000011.00000002.1562321143.000000001E7D1000.00000040.00000001.01000000.00000015.sdmp, Offset: 1E7D0000, based on PE: true

Associated: 00000011.00000002.1562293036.000000001E7D0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000011.00000002.1562321143.000000001E7DA000.00000040.00000001.01000000.00000015.sdmpDownload File
Associated: 00000011.00000002.1562391495.000000001E7DB000.00000080.00000001.01000000.00000015.sdmpDownload File
Associated: 00000011.00000002.1562417397.000000001E7DD000.00000004.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e7d0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: CommandLineModule$ArgvFileHandleHostLoadNamePreparePythonService_SingleString
String ID: NOTE: You do not start the service using this program - start the$ -debug servicename [parms] - debug the Python service.$ -register - register the EXE - this should generally not be necessary.$%s - Python Service Manager$-debug requires a service name$Could not start the service - error %d$Debugging service %s - press Ctrl+C to stop.$Options:$debug$install$register$service using Control Panel, or 'net start service_name'
API String ID: 2141616646-3465821732
Opcode ID: 0c209cb0a07809eac29ffe921249373ea5d861b9ab09d69a4b0f3f8510fb3ed4
Instruction ID: 2d81218cd37cf45ac419674f32153682bfb02e2f244039142e5b6c8237a5b481
Opcode Fuzzy Hash: 0c209cb0a07809eac29ffe921249373ea5d861b9ab09d69a4b0f3f8510fb3ed4
Instruction Fuzzy Hash: 9951D671A003659FF7109BA4EC88BEB3BADFB48B21F444625ED44D6254E731940DCBA2

Function 03413F40 Relevance: 33.4, APIs: 14, Strings: 5, Instructions: 181fileCOMMON

Download Yara Rule

APIs

PyDict_New.PYTHON27 ref: 03413F46
CreateFileA.KERNEL32(?,00000000,00000003,00000000,00000003,00000000,00000000), ref: 03413F8D
DeviceIoControl.KERNEL32(00000000,00070020,00000000,00000000,?,00000058,?,00000000), ref: 03413FBD
GetLastError.KERNEL32 ref: 03413FC7
DeviceIoControl.KERNEL32(00000000,00070020,00000000,00000000,?,00000058,?,00000000), ref: 03413FFC
__aulldiv.LIBCMT ref: 03414033
__aulldiv.LIBCMT ref: 0341404B
Py_BuildValue.PYTHON27((IILLKK),?,?,?,?,00000000,?,00000000,?,?,?,00989680,00000000,00000000,?,?), ref: 03414075

Strings

\\.\PhysicalDrive%d, xrefs: 03413F61
PhysicalDrive%i, xrefs: 03414007
DeviceIoControl -> ERROR_INVALID_FUNCTION; ignore PhysicalDrive%i, xrefs: 034140C4
DeviceIoControl -> ERROR_NOT_SUPPORTED; ignore PhysicalDrive%i, xrefs: 034140D3
(IILLKK), xrefs: 03414070

Memory Dump Source

Source File: 00000011.00000002.1560676867.0000000003411000.00000040.00000001.01000000.0000000F.sdmp, Offset: 03410000, based on PE: true

Associated: 00000011.00000002.1560637646.0000000003410000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560676867.000000000341B000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560676867.000000000341F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560836323.0000000003423000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_3410000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: ControlDevice__aulldiv$BuildCreateDict_ErrorFileLastValue
String ID: (IILLKK)$DeviceIoControl -> ERROR_INVALID_FUNCTION; ignore PhysicalDrive%i$DeviceIoControl -> ERROR_NOT_SUPPORTED; ignore PhysicalDrive%i$PhysicalDrive%i$\\.\PhysicalDrive%d
API String ID: 2026795684-2668205038
Opcode ID: 19f3ff9ce2381945ef11ce7fe3504c9496443aa59f1eb669be329def0a797e95
Instruction ID: 49cd6bc2187925712a381083a92cb54b7991bc0e3b3926acc74e33f72beec2e0
Opcode Fuzzy Hash: 19f3ff9ce2381945ef11ce7fe3504c9496443aa59f1eb669be329def0a797e95
Instruction Fuzzy Hash: F4513871640B006FE260DB55DC49FABB7FCEB88B10F144A09F655AA380D771E911C7AA

Function 03417320 Relevance: 30.0, APIs: 14, Strings: 3, Instructions: 234serviceCOMMON

Download Yara Rule

APIs

PyList_New.PYTHON27(00000000), ref: 03417337
OpenSCManagerA.ADVAPI32(00000000,00000000,00000004), ref: 03417352
EnumServicesStatusExW.ADVAPI32(00000000,00000000,00000030,00000003,00000000,00000000,?,?,?,00000000), ref: 03417395
GetLastError.KERNEL32 ref: 034173A1
73BB3B4E.MSVCR90(00000000), ref: 034173B3
EnumServicesStatusExW.ADVAPI32(?,00000000,00000030,00000003,00000000,?,?,?,?,00000000), ref: 034173EA
PyUnicodeUCS2_FromWideChar.PYTHON27 ref: 03417437
PyUnicodeUCS2_FromWideChar.PYTHON27(?,?), ref: 03417461
Py_BuildValue.PYTHON27((OO),00000000,00000000), ref: 03417477

Part of subcall function 03411090: GetLastError.KERNEL32 ref: 034110B2
Part of subcall function 03411090: PyErr_SetFromWindowsErrWithFilename.PYTHON27(00000000), ref: 034110B9

Strings

OpenSCManager, xrefs: 03417360
,, xrefs: 034174D9
(OO), xrefs: 03417472

Memory Dump Source

Source File: 00000011.00000002.1560676867.0000000003411000.00000040.00000001.01000000.0000000F.sdmp, Offset: 03410000, based on PE: true

Associated: 00000011.00000002.1560637646.0000000003410000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560676867.000000000341B000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560676867.000000000341F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560836323.0000000003423000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_3410000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: From$CharEnumErrorLastServicesStatusUnicodeWide$BuildErr_FilenameList_ManagerOpenValueWindowsWith
String ID: (OO)$,$OpenSCManager
API String ID: 2902223218-1263985291
Opcode ID: 06c14ec98ab0d5a3f913b3550da03f9444daf2da50bb502c9facb104c1dd0f16
Instruction ID: 5495c1a752c7e02b296e76ea456deda39d66de6d1e0e7d1214f9f2d429fca042
Opcode Fuzzy Hash: 06c14ec98ab0d5a3f913b3550da03f9444daf2da50bb502c9facb104c1dd0f16
Instruction Fuzzy Hash: 1D71E5B19047019FC710DF64DC8095BBBE8FF88764F084A29F9599B344E734EA16CBA6

Function 1E8C1F60 Relevance: 28.1, APIs: 13, Strings: 3, Instructions: 125COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,O:FindFiles,?), ref: 1E8C1F75
?PyWinObject_AsString@@YAHPAU_object@@PAPADHPAK@Z.PYWINTYPES27(?,?,00000000,00000000), ref: 1E8C1F99
PyList_New.PYTHON27 ref: 1E8C1FB7
?PyWinObject_FreeString@@YAXPAD@Z.PYWINTYPES27(?), ref: 1E8C208A
FindClose.KERNEL32(?), ref: 1E8C209D

Strings

FindFirstFile, xrefs: 1E8C1FF6
FindNextFile, xrefs: 1E8C2075
O:FindFiles, xrefs: 1E8C1F6F

Memory Dump Source

Source File: 00000011.00000002.1562490344.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 00000011.00000002.1562469835.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562702731.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562730939.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Object_String@@$Arg_CloseFindFreeList_ParseTupleU_object@@
String ID: FindFirstFile$FindNextFile$O:FindFiles
API String ID: 1030437005-788299552
Opcode ID: 21308af24752199fb33d0477603f47a091fb1e2b9e50280e2d892cee74a3afaf
Instruction ID: 7832f641b0813a2d1f5ea9ccd50728e1d996f1b9bbf45b80869664246e8996d9
Opcode Fuzzy Hash: 21308af24752199fb33d0477603f47a091fb1e2b9e50280e2d892cee74a3afaf
Instruction Fuzzy Hash: E341A371500712AFE2109B74DCC8ADB37E9EF86724F008729F96D832D0EB35D945CA92

Function 03411E30 Relevance: 28.1, APIs: 12, Strings: 4, Instructions: 107memorynativeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,00008000), ref: 03411E42
RtlAllocateHeap.NTDLL(00000000), ref: 03411E45
NtQueryVirtualMemory.NTDLL(?,00000000,00000001,00000000,00008000,00000000), ref: 03411E5A
GetProcessHeap.KERNEL32(00000000,00000000), ref: 03411E73
HeapFree.KERNEL32(00000000), ref: 03411E76
GetProcessHeap.KERNEL32(00000008,00008000), ref: 03411E97
RtlAllocateHeap.NTDLL(00000000), ref: 03411E9A
NtQueryVirtualMemory.NTDLL(?,00000000,00000001,00000000,00008000,00000000), ref: 03411EAF
PyErr_SetString.PYTHON27(00000000,NtQueryVirtualMemory bufsize is too large), ref: 03411EEC
PyErr_Clear.PYTHON27 ref: 03411F1F

Part of subcall function 03417C40: PyErr_SetFromWindowsErrWithFilename.PYTHON27(00000000,?), ref: 03417C87

GetProcessHeap.KERNEL32(00000000,00000000), ref: 03411F36
HeapFree.KERNEL32(00000000), ref: 03411F39

Strings

", xrefs: 03411EC7
NtQueryVirtualMemory increase bufsize %zd, xrefs: 03411E7F
NtQueryVirtualMemory(MemoryWorkingSetInformation), xrefs: 03411F25
NtQueryVirtualMemory bufsize is too large, xrefs: 03411EE6

Memory Dump Source

Source File: 00000011.00000002.1560676867.0000000003411000.00000040.00000001.01000000.0000000F.sdmp, Offset: 03410000, based on PE: true

Associated: 00000011.00000002.1560637646.0000000003410000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560676867.000000000341B000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560676867.000000000341F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560836323.0000000003423000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_3410000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Heap$Process$Err_$AllocateFreeMemoryQueryVirtual$ClearFilenameFromStringWindowsWith
String ID: "$NtQueryVirtualMemory bufsize is too large$NtQueryVirtualMemory increase bufsize %zd$NtQueryVirtualMemory(MemoryWorkingSetInformation)
API String ID: 1319032550-4102764982
Opcode ID: 5c1cb703a7a67cb496daded551b0a15e97a42276f2aa9ba0c7c2bfeb565d1507
Instruction ID: 90884cecfc65ea666e6bde1106f34f1f3f991f21e9f9711164970a00f4fec30d
Opcode Fuzzy Hash: 5c1cb703a7a67cb496daded551b0a15e97a42276f2aa9ba0c7c2bfeb565d1507
Instruction Fuzzy Hash: 5F314DB6B40B007FE720F7B6AC4DF5B7B9CDB85751F140426F7059E241DBA2946082BA

Function 034164B0 Relevance: 22.9, APIs: 9, Strings: 4, Instructions: 137nativeCOMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON27(?,requires Windows 8.1+,?,00000000,?,00000000,?,03416674,?,?), ref: 034164D5
NtQueryInformationProcess.NTDLL(00000000,0000003C,00000000,00000000,?), ref: 03416528
CloseHandle.KERNEL32(00000000,?,?,?,?,03411B15,?,00000000), ref: 034165E9
73BB3B4E.MSVCR90(00000000,?,?,?,?,?,?,03411B15,?,00000000), ref: 03416614
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,03411B15,?,00000000), ref: 0341661E

Strings

NtQueryInformationProcess(ProcessCommandLineInformation), xrefs: 03416599
NtQueryInformationProcess(ProcessBasicInformation) -> STATUS_NOT_FOUND translated into PermissionError, xrefs: 03416535
NtQueryInformationProcess(ProcessBasicInformation), xrefs: 03416559
requires Windows 8.1+, xrefs: 034164CF

Memory Dump Source

Source File: 00000011.00000002.1560676867.0000000003411000.00000040.00000001.01000000.0000000F.sdmp, Offset: 03410000, based on PE: true

Associated: 00000011.00000002.1560637646.0000000003410000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560676867.000000000341B000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560676867.000000000341F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560836323.0000000003423000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_3410000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: CloseHandle$Err_InformationProcessQueryString
String ID: NtQueryInformationProcess(ProcessBasicInformation)$NtQueryInformationProcess(ProcessBasicInformation) -> STATUS_NOT_FOUND translated into PermissionError$NtQueryInformationProcess(ProcessCommandLineInformation)$requires Windows 8.1+
API String ID: 3724660651-279392319
Opcode ID: a23438fefd84d49a9d7ef8c36fca7296f6dab3aace1e7865014cc4c6fba9caec
Instruction ID: 3f38cb7d0370c2079bd0a3335a9e4ef0ea95b85e08e51f97288171548e5f4398
Opcode Fuzzy Hash: a23438fefd84d49a9d7ef8c36fca7296f6dab3aace1e7865014cc4c6fba9caec
Instruction Fuzzy Hash: AE418BB5600B019FDB50EF64EC48F2BBBECEB41255F05041AFD06AF24DD768D560C6A9

Function 03413C20 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 80threadCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,0341B5E4,?), ref: 03413C3A
PyEval_SaveThread.PYTHON27 ref: 03413C43
GetDiskFreeSpaceExW.KERNEL32(?,?,?,?), ref: 03413C5F
PyErr_Clear.PYTHON27 ref: 03413C67
PyArg_ParseTuple.PYTHON27(?,0341B5E8,?), ref: 03413C78
PyEval_SaveThread.PYTHON27 ref: 03413C81
GetDiskFreeSpaceExA.KERNEL32(?,?,?,?), ref: 03413C9D
PyEval_RestoreThread.PYTHON27(00000000), ref: 03413CA6
PyErr_SetFromWindowsErrWithFilename.PYTHON27(00000000,?), ref: 03413CB9
Py_BuildValue.PYTHON27((LL),?,?,?,?), ref: 03413CE1

Strings

(LL), xrefs: 03413CDC

Memory Dump Source

Source File: 00000011.00000002.1560676867.0000000003411000.00000040.00000001.01000000.0000000F.sdmp, Offset: 03410000, based on PE: true

Associated: 00000011.00000002.1560637646.0000000003410000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560676867.000000000341B000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560676867.000000000341F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560836323.0000000003423000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_3410000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Eval_Thread$Arg_DiskErr_FreeParseSaveSpaceTuple$BuildClearFilenameFromRestoreValueWindowsWith
String ID: (LL)
API String ID: 379473955-591180812
Opcode ID: 33a7022b062dfd45ef3db18acfa788cd3c6491d056b5af4a276b5dace94e95ea
Instruction ID: 969e5f213e2097c8aef7f18eb1f1498e8d2de3dae431260ce99236328b28ad84
Opcode Fuzzy Hash: 33a7022b062dfd45ef3db18acfa788cd3c6491d056b5af4a276b5dace94e95ea
Instruction Fuzzy Hash: B6216076604601AFC600EB58EC54CAFB7ECEEC4614F48491AF849D7215E730EA598BE3

Function 1E7A6310 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 110COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,iOi:SetSecurityDescriptorDacl,?,?,?), ref: 1E7A633A
?PyWinObject_AsACL@@YAHPAU_object@@PAPAU_ACL@@H@Z.PYWINTYPES27(?,?,00000001), ref: 1E7A635B
?_MakeAbsoluteSD@@YAHPAXPAPAX@Z.PYWINTYPES27(?,?), ref: 1E7A6375

Strings

iOi:SetSecurityDescriptorDacl, xrefs: 1E7A632A
SetSecurityDescriptorDacl, xrefs: 1E7A63B1

Memory Dump Source

Source File: 00000011.00000002.1561923280.000000001E7A1000.00000040.00000001.01000000.00000012.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000011.00000002.1561891626.000000001E7A0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7B9000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7BE000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562197228.000000001E7C0000.00000080.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562233172.000000001E7C2000.00000004.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e7a0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: AbsoluteArg_MakeObject_ParseTupleU_object@@
String ID: SetSecurityDescriptorDacl$iOi:SetSecurityDescriptorDacl
API String ID: 2560617679-554422340
Opcode ID: c9801bf321c7f5ab8ffa0e8a6a622b7bf682ccf80a09c85f09187c280728d902
Instruction ID: ac729c91cddca0da4223e337283610bf57eab2c0c1a86eec61a6cf552d20c157
Opcode Fuzzy Hash: c9801bf321c7f5ab8ffa0e8a6a622b7bf682ccf80a09c85f09187c280728d902
Instruction Fuzzy Hash: 61318175504345ABB200DF55EC849AB73EDAEC8615F480B1DFE4492221E725E60ACAA6

Function 1E7A9F20 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 102windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,?,1E7A5F68,MakeSelfRelativeSD,00000000), ref: 1E7A9F2A
?PyWin_GetErrorMessageModule@@YAPAUHINSTANCE__@@K@Z.PYWINTYPES27(00000000,00000000,?,1E7A5F68,MakeSelfRelativeSD,00000000), ref: 1E7A9F38
FormatMessageA.KERNEL32(00001300,00000000,00000000,00000000,?,00000000,00000000), ref: 1E7A9F69
?PyWinObject_FromTCHAR@@YAPAU_object@@PBDH@Z.PYWINTYPES27(No error message is available,000000FF,?,?,?,?,?,?,?,?,?,?,00000000), ref: 1E7A9FC7
?PyWinCoreString_FromString@@YAPAU_object@@PBDH@Z.PYWINTYPES27(?,000000FF,00000000,?,73BB3D3F), ref: 1E7A9FD7
Py_BuildValue.PYTHON27((iNN),00000000,00000000,?,00000000,?,73BB3D3F), ref: 1E7A9FE6
LocalFree.KERNEL32(?), ref: 1E7A9FFF
PyErr_SetObject.PYTHON27(031BEB40,00000000), ref: 1E7AA010

Strings

No error message is available, xrefs: 1E7A9F77, 1E7A9FC6
(iNN), xrefs: 1E7A9FE1

Memory Dump Source

Source File: 00000011.00000002.1561923280.000000001E7A1000.00000040.00000001.01000000.00000012.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000011.00000002.1561891626.000000001E7A0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7B9000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7BE000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562197228.000000001E7C0000.00000080.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562233172.000000001E7C2000.00000004.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e7a0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: ErrorFromMessageU_object@@$BuildCoreE__@@Err_FormatFreeLastLocalModule@@ObjectObject_String@@String_ValueWin_
String ID: (iNN)$No error message is available
API String ID: 1016398995-2901411318
Opcode ID: fd15295e8b0b2f3e45a84b055d750fd798942f50572a0d7a2f47600e62dfa25e
Instruction ID: eae0b148dc3e0ae807cd1ceaa3a61eadbde5b3fc662e7639123a391587f0cd89
Opcode Fuzzy Hash: fd15295e8b0b2f3e45a84b055d750fd798942f50572a0d7a2f47600e62dfa25e
Instruction Fuzzy Hash: DD3104356083525BF3109E24BC58F6777AE9FC5714F0D4B1CFA91872A1EB22D809CBA2

Function 03411C70 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 79processCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,0341B300), ref: 03411C84
CreateToolhelp32Snapshot.KERNEL32(00000002), ref: 03411C9F

Strings

CreateToolhelp32Snapshot, xrefs: 03411CAB
Process32FirstW, xrefs: 03411CD7

Memory Dump Source

Source File: 00000011.00000002.1560676867.0000000003411000.00000040.00000001.01000000.0000000F.sdmp, Offset: 03410000, based on PE: true

Associated: 00000011.00000002.1560637646.0000000003410000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560676867.000000000341B000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560676867.000000000341F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560836323.0000000003423000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_3410000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_CreateParseSnapshotToolhelp32Tuple
String ID: CreateToolhelp32Snapshot$Process32FirstW
API String ID: 1338670803-1839410257
Opcode ID: add097fd0cf83ac0db867ea5c10864bab97ff5c259d32ad1dcb30c5c4f4f1182
Instruction ID: 2277c5c48245ccb03ef9215a6b2ba1c74f255beb32a891198d39fea898d57f38
Opcode Fuzzy Hash: add097fd0cf83ac0db867ea5c10864bab97ff5c259d32ad1dcb30c5c4f4f1182
Instruction Fuzzy Hash: 7B212975800B056FE710FB74EC99AEF77ACAF85344F48452AE9598E240F734922486E6

Function 1E7A7AD0 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 125timeCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27 ref: 1E7A7AF0
?PyWinObject_AsString@@YAHPAU_object@@PAPADHPAK@Z.PYWINTYPES27(?,00000000,00000000,00000000), ref: 1E7A7B26
VariantTimeToSystemTime.OLEAUT32(?), ref: 1E7A7B4B
GetTimeZoneInformation.KERNEL32(?), ref: 1E7A7BD1
?PyWinCoreString_FromString@@YAPAU_object@@PBDH@Z.PYWINTYPES27(?,000000FF), ref: 1E7A7C4F

Strings

can't format dates this early, xrefs: 1E7A7C7D
|O:Format, xrefs: 1E7A7AE2

Memory Dump Source

Source File: 00000011.00000002.1561923280.000000001E7A1000.00000040.00000001.01000000.00000012.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000011.00000002.1561891626.000000001E7A0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7B9000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7BE000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562197228.000000001E7C0000.00000080.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562233172.000000001E7C2000.00000004.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e7a0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Time$String@@U_object@@$Arg_CoreFromInformationObject_ParseString_SystemTupleVariantZone
String ID: can't format dates this early$|O:Format
API String ID: 658385599-910026153
Opcode ID: 56012715c4e1481b18765ee3a6a18a53a6b969f6b9fc979e7d1a8b9b3db7ec7a
Instruction ID: 5b809916de64c610e5b80cf48d53561713d71abd8ad09d50ba63416188bd6bd4
Opcode Fuzzy Hash: 56012715c4e1481b18765ee3a6a18a53a6b969f6b9fc979e7d1a8b9b3db7ec7a
Instruction Fuzzy Hash: AB415AB1908351ABE350DF29D894A6FF7E8EBC8704F444A2EFA99C2290E735C504CB52

Function 1E8C36D0 Relevance: 14.0, APIs: 6, Strings: 2, Instructions: 38threadCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,:GetKeyboardState), ref: 1E8C36E0
PyEval_SaveThread.PYTHON27 ref: 1E8C36F6
GetKeyboardState.USER32(?), ref: 1E8C3703
PyEval_RestoreThread.PYTHON27(00000000), ref: 1E8C370C
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(GetKeyboardState,00000000), ref: 1E8C3722

Strings

:GetKeyboardState, xrefs: 1E8C36DA
GetKeyboardState, xrefs: 1E8C371D

Memory Dump Source

Source File: 00000011.00000002.1562490344.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 00000011.00000002.1562469835.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562702731.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562730939.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Eval_Thread$Arg_Error@@KeyboardParseRestoreSaveStateTupleU_object@@Win_
String ID: :GetKeyboardState$GetKeyboardState
API String ID: 1157968067-1769397567
Opcode ID: 1f1bd790c7372c09806477578173d050df1f93d1c4d7ccecc80fd94c8bee8187
Instruction ID: 48ad963fa3774aaeb1fcec795a9a6fc6922ccef167c4dcb3e8d0ebca6e7ff971
Opcode Fuzzy Hash: 1f1bd790c7372c09806477578173d050df1f93d1c4d7ccecc80fd94c8bee8187
Instruction Fuzzy Hash: 91F02BB58101106FF7115778DC4DBD936E4AFCA342F444028F94DC3250F67992D9C6A6

Function 1E8C3FA0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 43threadshutdownCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27 ref: 1E8C3FBE
PyEval_SaveThread.PYTHON27 ref: 1E8C3FD1
ExitWindowsEx.USER32(?,?), ref: 1E8C3FE3
PyEval_RestoreThread.PYTHON27(00000000), ref: 1E8C3FEC
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(ExitWindowsEx,00000000), ref: 1E8C4002

Strings

ExitWindowsEx, xrefs: 1E8C3FFD
l|l:ExitWindowsEx, xrefs: 1E8C3FB0

Memory Dump Source

Source File: 00000011.00000002.1562490344.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 00000011.00000002.1562469835.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562702731.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562730939.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Eval_Thread$Arg_Error@@ExitParseRestoreSaveTupleU_object@@Win_Windows
String ID: ExitWindowsEx$l|l:ExitWindowsEx
API String ID: 3021837756-971244237
Opcode ID: 2436d2e7006b9566f82b069f2262604896c8fbdf75b42250d489b91fa1415abf
Instruction ID: a34edb42c5f777f0cf17c5f07cc594015ebbe24b4ca3b149641c7582bcbdce91
Opcode Fuzzy Hash: 2436d2e7006b9566f82b069f2262604896c8fbdf75b42250d489b91fa1415abf
Instruction Fuzzy Hash: 7F016D79510211AFE710AB68EC89A9A77E5FF8A246F444528F90DC3311E730965ACBA2

Function 1E8C3F10 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 42threadshutdownCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27 ref: 1E8C3F36
PyEval_SaveThread.PYTHON27 ref: 1E8C3F49
ExitWindowsEx.USER32(00000000,000000FF), ref: 1E8C3F55
PyEval_RestoreThread.PYTHON27(00000000), ref: 1E8C3F5E
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(ExitWindows,00000000), ref: 1E8C3F74

Strings

|ll:ExitWindows, xrefs: 1E8C3F20
ExitWindows, xrefs: 1E8C3F6F

Memory Dump Source

Source File: 00000011.00000002.1562490344.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 00000011.00000002.1562469835.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562702731.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562730939.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Eval_Thread$Arg_Error@@ExitParseRestoreSaveTupleU_object@@Win_Windows
String ID: ExitWindows$|ll:ExitWindows
API String ID: 3021837756-1358875516
Opcode ID: 0186c55a2f9f1139ce75f1dcb95c2bfc9a55c86e2fc380342bf209ede13b6a87
Instruction ID: e7e7743ccd33f2baab1a28fbcf05ddcecb0fd66027da7c1c11bb924a5c9ce6ed
Opcode Fuzzy Hash: 0186c55a2f9f1139ce75f1dcb95c2bfc9a55c86e2fc380342bf209ede13b6a87
Instruction Fuzzy Hash: A001D1758002116FE700AB68DC8DB8A3AE4BF86756F400628F91DC3290E731925ECBA2

Function 03415CD0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 93nativeCOMMON

Download Yara Rule

APIs

PyErr_NoMemory.PYTHON27 ref: 03415CEF
NtQuerySystemInformation.NTDLL(00000005,00000000,?,?), ref: 03415D0F
73BB3B4E.MSVCR90(00000000), ref: 03415D24
PyErr_NoMemory.PYTHON27 ref: 03415D36

Strings

NtQuerySystemInformation(SystemProcessInformation), xrefs: 03415D47

Memory Dump Source

Source File: 00000011.00000002.1560676867.0000000003411000.00000040.00000001.01000000.0000000F.sdmp, Offset: 03410000, based on PE: true

Associated: 00000011.00000002.1560637646.0000000003410000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560676867.000000000341B000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560676867.000000000341F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560836323.0000000003423000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_3410000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Err_Memory$InformationQuerySystem
String ID: NtQuerySystemInformation(SystemProcessInformation)
API String ID: 3727291697-862403119
Opcode ID: 8a30c8211582701e221b7588a648257f2704cfa54b5abb6b4e9c60b07479fc41
Instruction ID: 299d66f83ddffe3194256766b004a60930dc7ca6dbcc55758e5761d9f25fb9d4
Opcode Fuzzy Hash: 8a30c8211582701e221b7588a648257f2704cfa54b5abb6b4e9c60b07479fc41
Instruction Fuzzy Hash: 4F21DBB2A05A105FD710DB64EC44A9FB3D8EBC6625F1885AFF806DF300E734D45587A5

Function 03412420 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 57COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,0341B43C,?,?), ref: 03412437

Strings

NtSuspend|ResumeProcess, xrefs: 03412494

Memory Dump Source

Source File: 00000011.00000002.1560676867.0000000003411000.00000040.00000001.01000000.0000000F.sdmp, Offset: 03410000, based on PE: true

Associated: 00000011.00000002.1560637646.0000000003410000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560676867.000000000341B000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560676867.000000000341F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560836323.0000000003423000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_3410000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_ParseTuple
String ID: NtSuspend|ResumeProcess
API String ID: 3371842430-3321992817
Opcode ID: 6bead09adbbb04a624da3b6761c01b6ed0149e737766b4da40227d4dbed842e4
Instruction ID: e09811876ddc94dce3d628625ba66ae2d0f85e5edb02fc2b8c6b6893290f2d3b
Opcode Fuzzy Hash: 6bead09adbbb04a624da3b6761c01b6ed0149e737766b4da40227d4dbed842e4
Instruction Fuzzy Hash: 64014E39940A106BC700F764FC599DF37E8EE84512F48486AF809DE200F774D429D6F6

Function 1E8C2D40 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 31COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,:GetUserName), ref: 1E8C2D50
GetUserNameA.ADVAPI32 ref: 1E8C2D75
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(GetUserName,00000000), ref: 1E8C2D85

Strings

:GetUserName, xrefs: 1E8C2D4A
GetUserName, xrefs: 1E8C2D80

Memory Dump Source

Source File: 00000011.00000002.1562490344.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 00000011.00000002.1562469835.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562702731.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562730939.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_Error@@NameParseTupleU_object@@UserWin_
String ID: :GetUserName$GetUserName
API String ID: 227983221-2566890583
Opcode ID: 9fcf0182d18e245e3f5bf2e1aa2d7164acfe41034bc371446cb18904c53e2238
Instruction ID: 86f7e91d86ead72dd97089816f274bb070d853e311f0d6cc3c8e827e4ef91a95
Opcode Fuzzy Hash: 9fcf0182d18e245e3f5bf2e1aa2d7164acfe41034bc371446cb18904c53e2238
Instruction Fuzzy Hash: 0AF054B18042116BE7109764DD4DADA37E87F92705F444718FD5DC3290F67982988993

Function 03411F60 Relevance: 9.1, APIs: 6, Instructions: 75COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,0341B3D0), ref: 03411F71
CloseHandle.KERNEL32(00000000), ref: 03411FB2

Memory Dump Source

Source File: 00000011.00000002.1560676867.0000000003411000.00000040.00000001.01000000.0000000F.sdmp, Offset: 03410000, based on PE: true

Associated: 00000011.00000002.1560637646.0000000003410000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560676867.000000000341B000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560676867.000000000341F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560836323.0000000003423000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_3410000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_CloseHandleParseTuple
String ID:
API String ID: 860947779-0
Opcode ID: 3ebc8fd89d50e66791ba81bf3648185434c3ddaadfc12e46b041d927edc0407f
Instruction ID: dbb1f3edba77724ad66f8e36cd7d80568475e4a06c0e3e64f0fafae554430e13
Opcode Fuzzy Hash: 3ebc8fd89d50e66791ba81bf3648185434c3ddaadfc12e46b041d927edc0407f
Instruction Fuzzy Hash: 1F11D571600A016FE750EB74DC88B5BB7D8EB44644F48042AFE49DA305E775D524C7A5

Function 03413890 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,0341B584), ref: 034138A1

Strings

NtQueryInformationProcess, xrefs: 034138EF

Memory Dump Source

Source File: 00000011.00000002.1560676867.0000000003411000.00000040.00000001.01000000.0000000F.sdmp, Offset: 03410000, based on PE: true

Associated: 00000011.00000002.1560637646.0000000003410000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560676867.000000000341B000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560676867.000000000341F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560836323.0000000003423000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_3410000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_ParseTuple
String ID: NtQueryInformationProcess
API String ID: 3371842430-2781105232
Opcode ID: 6780e395f0d22c6994d2cf693c9407276d4dc0a9abc0fd9d3b17d2917aa5d80a
Instruction ID: 66f1e0c23f0e5ba7b2b7c8c11b51a63cf2f97b3fa4364a2e29464d9953288bff
Opcode Fuzzy Hash: 6780e395f0d22c6994d2cf693c9407276d4dc0a9abc0fd9d3b17d2917aa5d80a
Instruction Fuzzy Hash: 6D0128399806002BD510FB24BC4AF9F37989F80A16F440469FD449D204F365812CC2EA

Function 1E8CAC20 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 46threadCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,iii|ii:mouse_event,?,?,?,?,00000000), ref: 1E8CAC4E
PyEval_SaveThread.PYTHON27 ref: 1E8CAC60
mouse_event.USER32(?,?,?,?,?), ref: 1E8CAC81
PyEval_RestoreThread.PYTHON27(00000000), ref: 1E8CAC88

Strings

iii|ii:mouse_event, xrefs: 1E8CAC48

Memory Dump Source

Source File: 00000011.00000002.1562490344.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 00000011.00000002.1562469835.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562702731.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562730939.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Eval_Thread$Arg_ParseRestoreSaveTuplemouse_event
String ID: iii|ii:mouse_event
API String ID: 4142462086-1652421241
Opcode ID: ff9e408f9d5683d0f1e40c81926191970d4f1d532a43076ca3a7909c1845b389
Instruction ID: aa16ff061ef39b80c041c10c26fde0e194b2e1682255fb014bbb3da9c71a1abd
Opcode Fuzzy Hash: ff9e408f9d5683d0f1e40c81926191970d4f1d532a43076ca3a7909c1845b389
Instruction Fuzzy Hash: 6201E9B5114211AFD304DF68C884CDBB7E8BF89644F408A5DF98AC3221E730DA498BA2

Function 1E8CABA0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 42threadkeyboardCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,ii|ii:keybd_event,?,?,?,00000000), ref: 1E8CABC9
PyEval_SaveThread.PYTHON27 ref: 1E8CABDB
keybd_event.USER32(?,?,?,?), ref: 1E8CABF7
PyEval_RestoreThread.PYTHON27(00000000), ref: 1E8CABFE

Strings

ii|ii:keybd_event, xrefs: 1E8CABC3

Memory Dump Source

Source File: 00000011.00000002.1562490344.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 00000011.00000002.1562469835.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562702731.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562730939.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Eval_Thread$Arg_ParseRestoreSaveTuplekeybd_event
String ID: ii|ii:keybd_event
API String ID: 4180502297-3699675051
Opcode ID: 500b97fe0f8c6e0c2e5846bffd81f578796a14595d97af1f9cfcfe93af5543b3
Instruction ID: 0037d59b6443572b68409b2efae1b077a229377bd7f96aee561783e2a34d68b6
Opcode Fuzzy Hash: 500b97fe0f8c6e0c2e5846bffd81f578796a14595d97af1f9cfcfe93af5543b3
Instruction Fuzzy Hash: 48012CB5504211AFE300EF68C888CEB77E9FF89205F40895DF98DC3211E730D9458B92

Function 1E7D1C30 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 23threadCOMMON

Download Yara Rule

APIs

PyEval_SaveThread.PYTHON27 ref: 1E7D1C32
StartServiceCtrlDispatcherW.ADVAPI32(1E7D6668), ref: 1E7D1C3F
PyEval_RestoreThread.PYTHON27(00000000), ref: 1E7D1C48
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(StartServiceCtrlDispatcher,00000000), ref: 1E7D1C5E

Strings

StartServiceCtrlDispatcher, xrefs: 1E7D1C59

Memory Dump Source

Source File: 00000011.00000002.1562321143.000000001E7D1000.00000040.00000001.01000000.00000015.sdmp, Offset: 1E7D0000, based on PE: true

Associated: 00000011.00000002.1562293036.000000001E7D0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000011.00000002.1562321143.000000001E7DA000.00000040.00000001.01000000.00000015.sdmpDownload File
Associated: 00000011.00000002.1562391495.000000001E7DB000.00000080.00000001.01000000.00000015.sdmpDownload File
Associated: 00000011.00000002.1562417397.000000001E7DD000.00000004.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e7d0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Eval_Thread$CtrlDispatcherError@@RestoreSaveServiceStartU_object@@Win_
String ID: StartServiceCtrlDispatcher
API String ID: 2400602890-2621514527
Opcode ID: 8b72551999f2f67c814e2b0c824661ca917f85b4c348ab544d32a2e2d19575b5
Instruction ID: ce7e3b0e78a959fc0d8fc7300b472d482542af8c477bb02bc493ce7c1982daab
Opcode Fuzzy Hash: 8b72551999f2f67c814e2b0c824661ca917f85b4c348ab544d32a2e2d19575b5
Instruction Fuzzy Hash: 3BE04F3A6002309BEB105768EDCCBD937B8FB9D352F040165EE05E3310E6359509CB65

Function 03413920 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 53COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,0341B5A8,?,?), ref: 03413937

Strings

NtSetInformationProcess, xrefs: 03413983

Memory Dump Source

Source File: 00000011.00000002.1560676867.0000000003411000.00000040.00000001.01000000.0000000F.sdmp, Offset: 03410000, based on PE: true

Associated: 00000011.00000002.1560637646.0000000003410000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560676867.000000000341B000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560676867.000000000341F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560836323.0000000003423000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_3410000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_ParseTuple
String ID: NtSetInformationProcess
API String ID: 3371842430-1892905377
Opcode ID: 201d92d573d831560baa0a05c2cd5aa1cf7020817182eb445afdd9a5990dd153
Instruction ID: 4ebe890dd6b3ec876e9fc34c86fb17e2d5f43faba4a4714b1a68cc3026fc1adb
Opcode Fuzzy Hash: 201d92d573d831560baa0a05c2cd5aa1cf7020817182eb445afdd9a5990dd153
Instruction Fuzzy Hash: B101DD795406106FCB00FB28FC49DDF37A8EB85A12F440459F9449E204F7759559C6E6

Function 03417AA0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 43serviceCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,0341D4B0), ref: 03417AAF
StartServiceA.ADVAPI32(00000000,00000000,00000000), ref: 03417ADD
CloseServiceHandle.ADVAPI32(00000000), ref: 03417AF5

Strings

StartService, xrefs: 03417AE7

Memory Dump Source

Source File: 00000011.00000002.1560676867.0000000003411000.00000040.00000001.01000000.0000000F.sdmp, Offset: 03410000, based on PE: true

Associated: 00000011.00000002.1560637646.0000000003410000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560676867.000000000341B000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560676867.000000000341F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560836323.0000000003423000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_3410000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Service$Arg_CloseHandleParseStartTuple
String ID: StartService
API String ID: 2343249381-99420325
Opcode ID: ca79101f918de1553301d21f718d1f126e5c3d9b2d01597be74187dfb8d2b382
Instruction ID: 0816cc04970748111aed49fc2eb8b58daaec3c4508b5ba7172e3c9cb9f74f2ef
Opcode Fuzzy Hash: ca79101f918de1553301d21f718d1f126e5c3d9b2d01597be74187dfb8d2b382
Instruction Fuzzy Hash: DEF0F670701A106FC224E720BC11FAF77E8DF04765F24041AFA06EE245D764E52096DE

Function 03416880 Relevance: 4.5, APIs: 3, Instructions: 23nativesynchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 03416898
NtQueryObject.NTDLL(00000000,00000001,00000000,00000000,0341D820), ref: 034168B5
SetEvent.KERNEL32(00000000), ref: 034168C7

Memory Dump Source

Source File: 00000011.00000002.1560676867.0000000003411000.00000040.00000001.01000000.0000000F.sdmp, Offset: 03410000, based on PE: true

Associated: 00000011.00000002.1560637646.0000000003410000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560676867.000000000341B000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560676867.000000000341F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560836323.0000000003423000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_3410000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Object$EventQuerySingleWait
String ID:
API String ID: 263510574-0
Opcode ID: e20ec4272270931579fd2de271e8c2c758ce14b92f4d1ac4fd46336eb7609477
Instruction ID: 13a26b227e6b094c214a7adee5bf2d401ec560d0cf19f2d96f2792567224a499
Opcode Fuzzy Hash: e20ec4272270931579fd2de271e8c2c758ce14b92f4d1ac4fd46336eb7609477
Instruction Fuzzy Hash: AFE0C9F5E14A10AFC600FB54E844D7673E9A78E320311811AA921BB2A8C7F4A8418BA0

Function 03421ED0 Relevance: 2.1, Strings: 1, Instructions: 891COMMON

Download Yara Rule

Strings

y(ProcessParameters), xrefs: 03421EDC, 03421F0A, 03421F18

Memory Dump Source

Source File: 00000011.00000002.1560676867.000000000341F000.00000040.00000001.01000000.0000000F.sdmp, Offset: 03410000, based on PE: true

Associated: 00000011.00000002.1560637646.0000000003410000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560676867.0000000003411000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560676867.000000000341B000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560836323.0000000003423000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_3410000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID:
String ID: y(ProcessParameters)
API String ID: 0-2902218424
Opcode ID: ca814da14200d7df6a1f5bf94c8eefb1d610b42c1faa19704c6f5aee050c0898
Instruction ID: 6a2c05885c3a569e7de97b66c610b8eb71725af5f2a184558571ed795a3a3f17
Opcode Fuzzy Hash: ca814da14200d7df6a1f5bf94c8eefb1d610b42c1faa19704c6f5aee050c0898
Instruction Fuzzy Hash: CE72CB316083658FD364CF28C88066ABBE1FF89344F594A2EE9E5DB350E3B1D945CB46

Function 03417EE0 Relevance: 1.6, APIs: 1, Instructions: 61COMMON

Download Yara Rule

APIs

RtlGetVersion.NTDLL ref: 03417EFE

Memory Dump Source

Source File: 00000011.00000002.1560676867.0000000003411000.00000040.00000001.01000000.0000000F.sdmp, Offset: 03410000, based on PE: true

Associated: 00000011.00000002.1560637646.0000000003410000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560676867.000000000341B000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560676867.000000000341F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560836323.0000000003423000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_3410000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Version
String ID:
API String ID: 1889659487-0
Opcode ID: ff819e412a01f0893bf904dc792ee690bf4a5c81c03d00ce17f831e9c88094d9
Instruction ID: f1888409ef82af7d1548510ad19ae970dde701584bec7289e09fe7a7d415a67d
Opcode Fuzzy Hash: ff819e412a01f0893bf904dc792ee690bf4a5c81c03d00ce17f831e9c88094d9
Instruction Fuzzy Hash: 9C1194F0D40E059BD724DA20E9867F73FD8A742750F980D55E525DE3D0E3BEC2A88686

Function 1E7D15A0 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

StartServiceCtrlDispatcherW.ADVAPI32(1E7D6668), ref: 1E7D15A5

Memory Dump Source

Source File: 00000011.00000002.1562321143.000000001E7D1000.00000040.00000001.01000000.00000015.sdmp, Offset: 1E7D0000, based on PE: true

Associated: 00000011.00000002.1562293036.000000001E7D0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000011.00000002.1562321143.000000001E7DA000.00000040.00000001.01000000.00000015.sdmpDownload File
Associated: 00000011.00000002.1562391495.000000001E7DB000.00000080.00000001.01000000.00000015.sdmpDownload File
Associated: 00000011.00000002.1562417397.000000001E7DD000.00000004.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e7d0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: CtrlDispatcherServiceStart
String ID:
API String ID: 3789849863-0
Opcode ID: a043a6b7e736b7813249c9d26f281d7e54b2f6c9450f8e3fae4b26e8fab88533
Instruction ID: 6db4fe0cd53c7df4022da3d2787cea3136ee9f5d0a364c697b61e7f73f6b75c5
Opcode Fuzzy Hash: a043a6b7e736b7813249c9d26f281d7e54b2f6c9450f8e3fae4b26e8fab88533
Instruction Fuzzy Hash:

Function 10001000 Relevance: .3, Instructions: 336COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.1561745639.0000000010001000.00000040.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true

Associated: 00000011.00000002.1561633037.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000011.00000002.1561745639.0000000010008000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000011.00000002.1561745639.000000001000A000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000011.00000002.1561844929.000000001000B000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000011.00000002.1561870030.000000001000D000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_10000000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 594ef7e67c01d919bf4fc7286508aa467622f5db09c7b770d5ef3fd01f7f7221
Instruction ID: f4e3b8f9e827dd86513a4fa11d9e28d9b063c25390b6f1c9420f875f8d6ec778
Opcode Fuzzy Hash: 594ef7e67c01d919bf4fc7286508aa467622f5db09c7b770d5ef3fd01f7f7221
Instruction Fuzzy Hash: DFD15172A259214FE31CCF19CC51B667793EFCD311B5BC1B9C90A9B36ACA35D8029B84

Function 1E7AA5B0 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.1561923280.000000001E7A1000.00000040.00000001.01000000.00000012.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000011.00000002.1561891626.000000001E7A0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7B9000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7BE000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562197228.000000001E7C0000.00000080.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562233172.000000001E7C2000.00000004.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e7a0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ea599b362749ced62664b87eac7c729192e15c9ff3d8314c84a86bab60ad823
Instruction ID: 59322ac201180b450d13c431d05fee05d63add1ccf581f043069f1be97ecfaad
Opcode Fuzzy Hash: 0ea599b362749ced62664b87eac7c729192e15c9ff3d8314c84a86bab60ad823
Instruction Fuzzy Hash: 74B09B30608301E67744AE358510226B1D56FC0540F844B5DE545C127CD330D800EB69

Function 034159B0 Relevance: 140.2, APIs: 40, Strings: 40, Instructions: 211COMMON

Download Yara Rule

APIs

Py_InitModule4.PYTHON27(_psutil_windows,0341C600,00000000,00000000,000003F5), ref: 034159C4

Part of subcall function 034170D0: GetLastError.KERNEL32(034159F6), ref: 034170E9
Part of subcall function 034170D0: PyErr_WarnEx.PYTHON27(?,psutil module couldn't set SE DEBUG mode for this process; please file an issue against psutil bug tracker,00000001), ref: 03417103
Part of subcall function 034170D0: PyErr_Clear.PYTHON27 ref: 0341710C

PyErr_NewException.PYTHON27(_psutil_windows.Error,00000000,00000000), ref: 03415A0C
PyErr_NewException.PYTHON27(_psutil_windows.TimeoutExpired,00000000,00000000), ref: 03415A3C
PyModule_AddObject.PYTHON27(00000000,TimeoutExpired,00000001), ref: 03415A52
PyErr_NewException.PYTHON27(_psutil_windows.TimeoutAbandoned,00000000,00000000), ref: 03415A5D
PyModule_AddObject.PYTHON27(00000000,TimeoutAbandoned,00000001), ref: 03415A6D
PyModule_AddIntConstant.PYTHON27(00000000,version,00000233), ref: 03415A80
PyModule_AddIntConstant.PYTHON27(00000000,ABOVE_NORMAL_PRIORITY_CLASS,00008000), ref: 03415A8D
PyModule_AddIntConstant.PYTHON27(00000000,BELOW_NORMAL_PRIORITY_CLASS,00004000), ref: 03415A9D
PyModule_AddIntConstant.PYTHON27(00000000,HIGH_PRIORITY_CLASS,00000080), ref: 03415AAA
PyModule_AddIntConstant.PYTHON27(00000000,IDLE_PRIORITY_CLASS,00000040), ref: 03415AB4
PyModule_AddIntConstant.PYTHON27(00000000,NORMAL_PRIORITY_CLASS,00000020), ref: 03415ABE
PyModule_AddIntConstant.PYTHON27(00000000,REALTIME_PRIORITY_CLASS,00000100), ref: 03415ACB
PyModule_AddIntConstant.PYTHON27(00000000,MIB_TCP_STATE_CLOSED,00000001), ref: 03415AD5
PyModule_AddIntConstant.PYTHON27(00000000,MIB_TCP_STATE_CLOSING,00000009), ref: 03415AE2
PyModule_AddIntConstant.PYTHON27(00000000,MIB_TCP_STATE_CLOSE_WAIT,00000008), ref: 03415AEC
PyModule_AddIntConstant.PYTHON27(00000000,MIB_TCP_STATE_LISTEN,00000002), ref: 03415AF6
PyModule_AddIntConstant.PYTHON27(00000000,MIB_TCP_STATE_ESTAB,00000005), ref: 03415B00
PyModule_AddIntConstant.PYTHON27(00000000,MIB_TCP_STATE_SYN_SENT,00000003), ref: 03415B0A
PyModule_AddIntConstant.PYTHON27(00000000,MIB_TCP_STATE_SYN_RCVD,00000004), ref: 03415B14
PyModule_AddIntConstant.PYTHON27(00000000,MIB_TCP_STATE_FIN_WAIT1,00000006), ref: 03415B21
PyModule_AddIntConstant.PYTHON27(00000000,MIB_TCP_STATE_FIN_WAIT2,00000007), ref: 03415B2B
PyModule_AddIntConstant.PYTHON27(00000000,MIB_TCP_STATE_LAST_ACK,0000000A), ref: 03415B35
PyModule_AddIntConstant.PYTHON27(00000000,MIB_TCP_STATE_TIME_WAIT,0000000B), ref: 03415B3F

Strings

WINVER, xrefs: 03415BA7
MIB_TCP_STATE_TIME_WAIT, xrefs: 03415B39
MIB_TCP_STATE_SYN_RCVD, xrefs: 03415B0E
NORMAL_PRIORITY_CLASS, xrefs: 03415AB8
TimeoutAbandoned, xrefs: 03415A62
_psutil_windows.TimeoutAbandoned, xrefs: 03415A58
MIB_TCP_STATE_CLOSE_WAIT, xrefs: 03415AE6
ERROR_INVALID_NAME, xrefs: 03415B7B
WINDOWS_XP, xrefs: 03415BB1
WINDOWS_10, xrefs: 03415BF0
MIB_TCP_STATE_CLOSED, xrefs: 03415ACF
MIB_TCP_STATE_DELETE_TCB, xrefs: 03415B4D
INFINITE, xrefs: 03415B67
MIB_TCP_STATE_LISTEN, xrefs: 03415AF0
IDLE_PRIORITY_CLASS, xrefs: 03415AAE
MIB_TCP_STATE_SYN_SENT, xrefs: 03415B04
MIB_TCP_STATE_LAST_ACK, xrefs: 03415B2F
HIGH_PRIORITY_CLASS, xrefs: 03415AA4
TimeoutExpired, xrefs: 03415A47
MIB_TCP_STATE_ESTAB, xrefs: 03415AFA
ABOVE_NORMAL_PRIORITY_CLASS, xrefs: 03415A87
MIB_TCP_STATE_CLOSING, xrefs: 03415ADC
MIB_TCP_STATE_FIN_WAIT2, xrefs: 03415B25
BELOW_NORMAL_PRIORITY_CLASS, xrefs: 03415A97
ERROR_SERVICE_DOES_NOT_EXIST, xrefs: 03415B88
ERROR_PRIVILEGE_NOT_HELD, xrefs: 03415B95
WINDOWS_VISTA, xrefs: 03415BC5
ERROR_ACCESS_DENIED, xrefs: 03415B71
version, xrefs: 03415A7A
MIB_TCP_STATE_FIN_WAIT1, xrefs: 03415B1B
_psutil_windows.TimeoutExpired, xrefs: 03415A37
WINDOWS_SERVER_2003, xrefs: 03415BBB
MIB_TCP_STATE_TIME_WAIT, xrefs: 03415B43
_psutil_windows, xrefs: 034159BF
WINDOWS_8_1, xrefs: 03415BE6
WINDOWS_7, xrefs: 03415BCF
REALTIME_PRIORITY_CLASS, xrefs: 03415AC5
_psutil_windows.Error, xrefs: 03415A07
PSUTIL_CONN_NONE, xrefs: 03415B5D
WINDOWS_8, xrefs: 03415BD9

Memory Dump Source

Source File: 00000011.00000002.1560676867.0000000003411000.00000040.00000001.01000000.0000000F.sdmp, Offset: 03410000, based on PE: true

Associated: 00000011.00000002.1560637646.0000000003410000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560676867.000000000341B000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560676867.000000000341F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560836323.0000000003423000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_3410000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Module_$Constant$Err_$Exception$Object$ClearErrorInitLastModule4Warn
String ID: ABOVE_NORMAL_PRIORITY_CLASS$BELOW_NORMAL_PRIORITY_CLASS$ERROR_ACCESS_DENIED$ERROR_INVALID_NAME$ERROR_PRIVILEGE_NOT_HELD$ERROR_SERVICE_DOES_NOT_EXIST$HIGH_PRIORITY_CLASS$IDLE_PRIORITY_CLASS$INFINITE$MIB_TCP_STATE_CLOSED$MIB_TCP_STATE_CLOSE_WAIT$MIB_TCP_STATE_CLOSING$MIB_TCP_STATE_DELETE_TCB$MIB_TCP_STATE_ESTAB$MIB_TCP_STATE_FIN_WAIT1$MIB_TCP_STATE_FIN_WAIT2$MIB_TCP_STATE_LAST_ACK$MIB_TCP_STATE_LISTEN$MIB_TCP_STATE_SYN_RCVD$MIB_TCP_STATE_SYN_SENT$MIB_TCP_STATE_TIME_WAIT$MIB_TCP_STATE_TIME_WAIT$NORMAL_PRIORITY_CLASS$PSUTIL_CONN_NONE$REALTIME_PRIORITY_CLASS$TimeoutAbandoned$TimeoutExpired$WINDOWS_10$WINDOWS_7$WINDOWS_8$WINDOWS_8_1$WINDOWS_SERVER_2003$WINDOWS_VISTA$WINDOWS_XP$WINVER$_psutil_windows$_psutil_windows.Error$_psutil_windows.TimeoutAbandoned$_psutil_windows.TimeoutExpired$version
API String ID: 3572930849-2349806778
Opcode ID: 210ef9a1c4a54c6bbfc75c7d3211de89444687a6b3caf19e777b4857975641ec
Instruction ID: b15296f6d918c9954bfd824e6325d0a156b1e6608c1688638660a714c447b8cb
Opcode Fuzzy Hash: 210ef9a1c4a54c6bbfc75c7d3211de89444687a6b3caf19e777b4857975641ec
Instruction Fuzzy Hash: 20510F707C1F643EE122F6255D97F9F25489FD2F55F220103F6207D1C2AAD85E2289AE

Function 1E8CB250 Relevance: 128.0, APIs: 38, Strings: 35, Instructions: 245COMMON

Download Yara Rule

APIs

?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(GetPwrCapabilities,00000000,?), ref: 1E8CB268
PyLong_FromUnsignedLong.PYTHON27(?,?,?,?,?,?), ref: 1E8CB284
PyLong_FromUnsignedLong.PYTHON27(?,Capacity,00000000,?), ref: 1E8CB294
Py_BuildValue.PYTHON27({s:N, s:N},Granularity,00000000), ref: 1E8CB2AA
PyLong_FromUnsignedLong.PYTHON27(?), ref: 1E8CB2B3
PyLong_FromUnsignedLong.PYTHON27(?,Capacity,00000000), ref: 1E8CB2C3
Py_BuildValue.PYTHON27({s:N, s:N},Granularity,00000000), ref: 1E8CB2D3
PyLong_FromUnsignedLong.PYTHON27(?), ref: 1E8CB2DE
PyLong_FromUnsignedLong.PYTHON27(?,Capacity,00000000), ref: 1E8CB2EE
Py_BuildValue.PYTHON27({s:N, s:N},Granularity,00000000), ref: 1E8CB2FE
PyInt_FromLong.PYTHON27(?), ref: 1E8CB30D
PyInt_FromLong.PYTHON27(?,DefaultLowLatencyWake,00000000), ref: 1E8CB31D
PyInt_FromLong.PYTHON27(?,MinDeviceWakeState,00000000), ref: 1E8CB32D
PyInt_FromLong.PYTHON27(?,RtcWake,00000000), ref: 1E8CB33D
PyInt_FromLong.PYTHON27(?,SoftLidWake,00000000), ref: 1E8CB34D
Py_BuildValue.PYTHON27(NNN,00000000,?,00000000,AcOnLineWake,00000000), ref: 1E8CB364
PyBool_FromLong.PYTHON27(?,BatteryScale,00000000), ref: 1E8CB37B

Strings

SystemS2, xrefs: 1E8CB4D7
LidPresent, xrefs: 1E8CB4FF
SystemBatteriesPresent, xrefs: 1E8CB39C
SystemS5, xrefs: 1E8CB49B
VideoDimPresent, xrefs: 1E8CB45F
ThermalControl, xrefs: 1E8CB423
spare2, xrefs: 1E8CB3BF
MinDeviceWakeState, xrefs: 1E8CB327
{s:N, s:N}, xrefs: 1E8CB2A5, 1E8CB2CE, 1E8CB2F9
SystemS1, xrefs: 1E8CB4EB
spare3, xrefs: 1E8CB3A2
FastSystemS4, xrefs: 1E8CB3D3
{s:N, s:N, s:N, s:N, s:N, s:N, s:N, s:N, s:N, s:N, s:N, s:N, s:N, s:N, s:N, s:N, s:N, s:N, s:O, s:N, s:O, s:N, s:N, s:O, s:N, s:N, s:N, s:N, s:N}, xrefs: 1E8CB524
ProcessorThrottle, xrefs: 1E8CB40F
Capacity, xrefs: 1E8CB28E, 1E8CB2BD, 1E8CB2E8
HiberFilePresent, xrefs: 1E8CB487
SystemS4, xrefs: 1E8CB4AF
ApmPresent, xrefs: 1E8CB44B
PowerButtonPresent, xrefs: 1E8CB51F
Granularity, xrefs: 1E8CB2A0, 1E8CB2C9, 1E8CB2F4
ProcessorMaxThrottle, xrefs: 1E8CB3E7
BatteryScale, xrefs: 1E8CB375
BatteriesAreShortTerm, xrefs: 1E8CB386
RtcWake, xrefs: 1E8CB337
UpsPresent, xrefs: 1E8CB437
DiskSpinDown, xrefs: 1E8CB3B9
NNN, xrefs: 1E8CB35F
ProcessorMinThrottle, xrefs: 1E8CB3FB
SystemS3, xrefs: 1E8CB4C3
GetPwrCapabilities, xrefs: 1E8CB263
SoftLidWake, xrefs: 1E8CB347
SleepButtonPresent, xrefs: 1E8CB513
DefaultLowLatencyWake, xrefs: 1E8CB317
AcOnLineWake, xrefs: 1E8CB357
FullWake, xrefs: 1E8CB473

Memory Dump Source

Source File: 00000011.00000002.1562490344.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 00000011.00000002.1562469835.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562702731.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562730939.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: FromLong$Long_Unsigned$Int_$BuildValue$Bool_Error@@U_object@@Win_
String ID: AcOnLineWake$ApmPresent$BatteriesAreShortTerm$BatteryScale$Capacity$DefaultLowLatencyWake$DiskSpinDown$FastSystemS4$FullWake$GetPwrCapabilities$Granularity$HiberFilePresent$LidPresent$MinDeviceWakeState$NNN$PowerButtonPresent$ProcessorMaxThrottle$ProcessorMinThrottle$ProcessorThrottle$RtcWake$SleepButtonPresent$SoftLidWake$SystemBatteriesPresent$SystemS1$SystemS2$SystemS3$SystemS4$SystemS5$ThermalControl$UpsPresent$VideoDimPresent$spare2$spare3${s:N, s:N, s:N, s:N, s:N, s:N, s:N, s:N, s:N, s:N, s:N, s:N, s:N, s:N, s:N, s:N, s:N, s:N, s:O, s:N, s:O, s:N, s:N, s:O, s:N, s:N, s:N, s:N, s:N}${s:N, s:N}
API String ID: 3791411757-3975806661
Opcode ID: 325b512e5e23083aab4f39e2a315ceee7c4453a264b930062d8ccf9dbf65e2e1
Instruction ID: fe4623a950b00ab38fe6e83f5c1b7273cba0da8d9e1c641f58765eac47cee08c
Opcode Fuzzy Hash: 325b512e5e23083aab4f39e2a315ceee7c4453a264b930062d8ccf9dbf65e2e1
Instruction Fuzzy Hash: 1661C9D08083A07BE115637D5C50DFB7ADDAF85829F044A2AFDC9E2312D429D6185BB7

Function 1E7AA9F0 Relevance: 87.7, APIs: 31, Strings: 19, Instructions: 218COMMON

Download Yara Rule

APIs

Part of subcall function 1E7AA790: PyEval_InitThreads.PYTHON27 ref: 1E7AA793
Part of subcall function 1E7AA790: PyDict_New.PYTHON27 ref: 1E7AA7AB
Part of subcall function 1E7AA790: ?PyWinCoreString_FromString@@YAPAU_object@@PBDH@Z.PYWINTYPES27(pywintypes,000000FF), ref: 1E7AA7BE

Py_InitModule4.PYTHON27(pywintypes,1E7BA6A0,00000000,00000000,000003F5), ref: 1E7AAA12
PyModule_GetDict.PYTHON27(00000000), ref: 1E7AAA27
PyDict_SetItemString.PYTHON27(00000000,error,031BEB40), ref: 1E7AAA62
PyDict_SetItemString.PYTHON27(00000000,com_error,031BED18), ref: 1E7AAA7C
PyDict_SetItemString.PYTHON27(00000000,TRUE,6D193454), ref: 1E7AAA97
PyDict_SetItemString.PYTHON27(00000000,FALSE,6D193384), ref: 1E7AAAB2
PyModule_AddIntConstant.PYTHON27(00000000,WAVE_FORMAT_PCM,00000001), ref: 1E7AAAC8
PyDict_SetItemString.PYTHON27(00000000,UnicodeType,6D17F288), ref: 1E7AAAE6

Part of subcall function 1E7A8770: PyType_Ready.PYTHON27(?,1E7AAAFA,00000000), ref: 1E7A8775
Part of subcall function 1E7A8770: PyDict_SetItemString.PYTHON27(?,TimeType,?), ref: 1E7A8792

PyType_Ready.PYTHON27(?), ref: 1E7AAB10
PyDict_SetItemString.PYTHON27(00000000,IIDType,?), ref: 1E7AAB29
PyType_Ready.PYTHON27(?), ref: 1E7AAB3C
PyDict_SetItemString.PYTHON27(00000000,SECURITY_DESCRIPTORType,?), ref: 1E7AAB55
PyType_Ready.PYTHON27(?), ref: 1E7AAB68
PyDict_SetItemString.PYTHON27(00000000,SECURITY_ATTRIBUTESType,?), ref: 1E7AAB81
PyType_Ready.PYTHON27(?), ref: 1E7AAB94
PyDict_SetItemString.PYTHON27(00000000,SIDType,?), ref: 1E7AABAD
PyType_Ready.PYTHON27(?), ref: 1E7AABC0
PyDict_SetItemString.PYTHON27(00000000,ACLType,?), ref: 1E7AABD9
PyType_Ready.PYTHON27(?), ref: 1E7AABEC
PyDict_SetItemString.PYTHON27(00000000,HANDLEType,?), ref: 1E7AAC05
PyType_Ready.PYTHON27(?), ref: 1E7AAC18
PyDict_SetItemString.PYTHON27(00000000,OVERLAPPEDType,?), ref: 1E7AAC31
PyType_Ready.PYTHON27(?), ref: 1E7AAC40
PyDict_SetItemString.PYTHON27(00000000,DEVMODEAType,?), ref: 1E7AAC55
PyType_Ready.PYTHON27(?), ref: 1E7AAC64
PyDict_SetItemString.PYTHON27(00000000,DEVMODEWType,?), ref: 1E7AAC79
PyDict_SetItemString.PYTHON27(00000000,DEVMODEType,?), ref: 1E7AAC8E
PyType_Ready.PYTHON27(?), ref: 1E7AAC9D
PyDict_SetItemString.PYTHON27(00000000,WAVEFORMATEXType,?), ref: 1E7AACB2
PyErr_SetString.PYTHON27(?,Could not initialise the error objects), ref: 1E7AACC9

Strings

error, xrefs: 1E7AAA5C
IIDType, xrefs: 1E7AAB23
UnicodeType, xrefs: 1E7AAAE0
SECURITY_DESCRIPTORType, xrefs: 1E7AAB4F
DEVMODEType, xrefs: 1E7AAC88
SIDType, xrefs: 1E7AABA7
DEVMODEWType, xrefs: 1E7AAC73
Could not initialise the error objects, xrefs: 1E7AACC3
pywintypes, xrefs: 1E7AAA0D
OVERLAPPEDType, xrefs: 1E7AAC2B
TRUE, xrefs: 1E7AAA91
FALSE, xrefs: 1E7AAAAC
DEVMODEAType, xrefs: 1E7AAC4F
ACLType, xrefs: 1E7AABD3
WAVEFORMATEXType, xrefs: 1E7AACAC
com_error, xrefs: 1E7AAA76
SECURITY_ATTRIBUTESType, xrefs: 1E7AAB7B
HANDLEType, xrefs: 1E7AABFF
WAVE_FORMAT_PCM, xrefs: 1E7AAAC2

Memory Dump Source

Source File: 00000011.00000002.1561923280.000000001E7A1000.00000040.00000001.01000000.00000012.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000011.00000002.1561891626.000000001E7A0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7B9000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7BE000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562197228.000000001E7C0000.00000080.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562233172.000000001E7C2000.00000004.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e7a0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Dict_String$Item$ReadyType_$InitModule_$ConstantCoreDictErr_Eval_FromModule4String@@String_ThreadsU_object@@
String ID: ACLType$Could not initialise the error objects$DEVMODEAType$DEVMODEType$DEVMODEWType$FALSE$HANDLEType$IIDType$OVERLAPPEDType$SECURITY_ATTRIBUTESType$SECURITY_DESCRIPTORType$SIDType$TRUE$UnicodeType$WAVEFORMATEXType$WAVE_FORMAT_PCM$com_error$error$pywintypes
API String ID: 3659302480-1306541161
Opcode ID: 04d75ba4369f624dc0d7d4b3c8164a8568bc094ea5c0c00cafa2e993e4c2c7b4
Instruction ID: a3cd2f8afdb65668ff0279b1e6ad5e85d09e45cb41d74c6f41b70fc01a7c2a32
Opcode Fuzzy Hash: 04d75ba4369f624dc0d7d4b3c8164a8568bc094ea5c0c00cafa2e993e4c2c7b4
Instruction Fuzzy Hash: 0F514F7090156423F51072786D91DEE31494DD2339F2D0721FEBAE13F0E61A916BCBA7

Function 1E8CA870 Relevance: 80.8, APIs: 25, Strings: 21, Instructions: 271threadCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,OO:GetFileVersionInfo,?,?), ref: 1E8CA8AA
?PyWinObject_AsWCHAR@@YAHPAU_object@@PAPA_WHPAK@Z.PYWINTYPES27(?,?,00000000,00000000), ref: 1E8CA8CF
?PyWinObject_AsWCHAR@@YAHPAU_object@@PAPA_WHPAK@Z.PYWINTYPES27(?,?,00000000,00000000), ref: 1E8CA8E8
PyEval_SaveThread.PYTHON27 ref: 1E8CA8FD
PyEval_RestoreThread.PYTHON27(00000000,?,?), ref: 1E8CA919
GetLastError.KERNEL32 ref: 1E8CA922
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(GetFileVersionInfo:VerQueryValue,00000000), ref: 1E8CAB4B
?PyWinObject_FreeWCHAR@@YAXPA_W@Z.PYWINTYPES27(?), ref: 1E8CAB65
?PyWinObject_FreeWCHAR@@YAXPA_W@Z.PYWINTYPES27(?), ref: 1E8CAB73
73BB3B4E.MSVCR90(?), ref: 1E8CAB82

Strings

StrucVersion, xrefs: 1E8CAA6B
GetFileVersionInfo, xrefs: 1E8CA981
\VarFileInfo\Translation, xrefs: 1E8CAA93
FileFlagsMask, xrefs: 1E8CAA45
FileVersionMS, xrefs: 1E8CAA65
GetFileVersionInfo:VerQueryValue, xrefs: 1E8CAB46
OO:GetFileVersionInfo, xrefs: 1E8CA884
ProductVersionLS, xrefs: 1E8CAA4E
FileSubtype, xrefs: 1E8CAA21
FileOS, xrefs: 1E8CAA33
FileType, xrefs: 1E8CAA2A
Signature, xrefs: 1E8CAA71
FileVersionLS, xrefs: 1E8CAA5F
FileDate, xrefs: 1E8CAA18
GetFileVersionInfo:VerQueryValue, xrefs: 1E8CAAB4
{u:l,u:l,u:l,u:l,u:l,u:l,u:l,u:l,u:l,u:l,u:l,u:N}, xrefs: 1E8CAA76
GetFileVersionInfo:VerQueryValue, xrefs: 1E8CA9D3
GetFileVersionInfo, xrefs: 1E8CA94E
GetFileVersionInfo:GetFileVersionInfoSize, xrefs: 1E8CA929
FileFlags, xrefs: 1E8CAA3C
ProductVersionMS, xrefs: 1E8CAA57

Memory Dump Source

Source File: 00000011.00000002.1562490344.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 00000011.00000002.1562469835.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562702731.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562730939.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Object_$U_object@@$Eval_FreeThread$Arg_ErrorError@@LastParseRestoreSaveTupleWin_
String ID: FileDate$FileFlags$FileFlagsMask$FileOS$FileSubtype$FileType$FileVersionLS$FileVersionMS$GetFileVersionInfo$GetFileVersionInfo$GetFileVersionInfo:GetFileVersionInfoSize$GetFileVersionInfo:VerQueryValue$GetFileVersionInfo:VerQueryValue$GetFileVersionInfo:VerQueryValue$OO:GetFileVersionInfo$ProductVersionLS$ProductVersionMS$Signature$StrucVersion$\VarFileInfo\Translation${u:l,u:l,u:l,u:l,u:l,u:l,u:l,u:l,u:l,u:l,u:l,u:N}
API String ID: 970476554-2183921110
Opcode ID: ba923d75c1137d56856e311f5d3f9c612986a419d3d027ef258ca7351dfc7324
Instruction ID: 5b275fd66b0ec0943417363ba66f8e038fdfc02222d3c9b4e664b40811026da9
Opcode Fuzzy Hash: ba923d75c1137d56856e311f5d3f9c612986a419d3d027ef258ca7351dfc7324
Instruction Fuzzy Hash: 1C914BB1504312AFE310DF69CD84D9BB7E9BF8A644F004B19FA8A93351D730E949CB62

Function 03417CA0 Relevance: 71.9, APIs: 7, Strings: 34, Instructions: 151COMMON

Download Yara Rule

APIs

Part of subcall function 03417BE0: PyEval_SaveThread.PYTHON27(?,00000000,?,03417CAF,ntdll.dll,NtQuerySystemInformation,03417FF5,034159E9), ref: 03417BE3
Part of subcall function 03417BE0: LoadLibraryA.KERNEL32(?,?,00000000,?,03417CAF,ntdll.dll,NtQuerySystemInformation,03417FF5,034159E9), ref: 03417BF0
Part of subcall function 03417BE0: PyEval_RestoreThread.PYTHON27(00000000,?,00000000,?,03417CAF,ntdll.dll,NtQuerySystemInformation,03417FF5,034159E9), ref: 03417BF9
Part of subcall function 03417BE0: PyErr_SetFromWindowsErrWithFilename.PYTHON27(00000000,?,034159E9), ref: 03417C08

GetModuleHandleA.KERNEL32(ntdll.dll,?,00000000,?,03417FF5,034159E9), ref: 03417CCF
PyErr_SetFromWindowsErrWithFilename.PYTHON27(00000000,NtQueryInformationProcess,?,00000000,?,03417FF5,034159E9), ref: 03417CFB
GetModuleHandleA.KERNEL32(ntdll.dll,?,00000000,?,03417FF5,034159E9), ref: 03417D14
PyErr_SetFromWindowsErrWithFilename.PYTHON27(00000000,NtSetInformationProcess,?,00000000,?,03417FF5,034159E9), ref: 03417D34

Strings

ntdll, xrefs: 03417E39
GetTickCount64, xrefs: 03417E82
NtSuspendProcess, xrefs: 03417DFE
NtQueryInformationProcess, xrefs: 03417CE8, 03417CF4
GetExtendedTcpTable, xrefs: 03417DA5
RtlGetVersion, xrefs: 03417DE3
WinStationQueryInformationW, xrefs: 03417D48
ntdll.dll, xrefs: 03417CA5
NtResumeProcess, xrefs: 03417E19
NtQueryVirtualMemory, xrefs: 03417E34
iphlpapi.dll, xrefs: 03417DAA
NtQuerySystemInformation, xrefs: 03417CA0
ntdll.dll, xrefs: 03417D8B
ntdll.dll, xrefs: 03417D6C
RtlIpv4AddressToStringA, xrefs: 03417D86
ntdll, xrefs: 03417E54
NtSetInformationProcess, xrefs: 03417D21, 03417D2D
ntdll.dll, xrefs: 03417CCA, 03417CE1
GetActiveProcessorCount, xrefs: 03417E96
ntdll, xrefs: 03417E1E
GetLogicalProcessorInformationEx, xrefs: 03417EAA
kernel32, xrefs: 03417E9B
winsta.dll, xrefs: 03417D4D
ntdll.dll, xrefs: 03417D0F, 03417D1A
ntdll, xrefs: 03417E03
ntdll.dll, xrefs: 03417E78
NtQueryObject, xrefs: 03417D67
RtlIpv6AddressToStringA, xrefs: 03417E73
ntdll.dll, xrefs: 03417DE8
GetExtendedUdpTable, xrefs: 03417DC4
kernel32, xrefs: 03417EAF
iphlpapi.dll, xrefs: 03417DC9
RtlNtStatusToDosErrorNoTeb, xrefs: 03417E4F
kernel32, xrefs: 03417E87

Memory Dump Source

Source File: 00000011.00000002.1560676867.0000000003411000.00000040.00000001.01000000.0000000F.sdmp, Offset: 03410000, based on PE: true

Associated: 00000011.00000002.1560637646.0000000003410000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560676867.000000000341B000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560676867.000000000341F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560836323.0000000003423000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_3410000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Err_FilenameFromWindowsWith$Eval_HandleModuleThread$LibraryLoadRestoreSave
String ID: GetActiveProcessorCount$GetExtendedTcpTable$GetExtendedUdpTable$GetLogicalProcessorInformationEx$GetTickCount64$NtQueryInformationProcess$NtQueryObject$NtQuerySystemInformation$NtQueryVirtualMemory$NtResumeProcess$NtSetInformationProcess$NtSuspendProcess$RtlGetVersion$RtlIpv4AddressToStringA$RtlIpv6AddressToStringA$RtlNtStatusToDosErrorNoTeb$WinStationQueryInformationW$iphlpapi.dll$iphlpapi.dll$kernel32$kernel32$kernel32$ntdll$ntdll$ntdll$ntdll$ntdll.dll$ntdll.dll$ntdll.dll$ntdll.dll$ntdll.dll$ntdll.dll$ntdll.dll$winsta.dll
API String ID: 3545709012-3537588484
Opcode ID: fb3077c27c0baf6ef0b3760eb14f841caeb88fc03e1450aa4f6f380ca43bc86e
Instruction ID: 7866970876f1da7e61ac70772a7236c75b9ce14615eb806d726ec4c48186593f
Opcode Fuzzy Hash: fb3077c27c0baf6ef0b3760eb14f841caeb88fc03e1450aa4f6f380ca43bc86e
Instruction Fuzzy Hash: D34152F8F94F126EC650FA766C52A3F2EC4561394AB240427E425FE30AFFA0C130466D

Function 1E7D11E0 Relevance: 64.9, APIs: 19, Strings: 18, Instructions: 139libraryloaderCOMMON

Download Yara Rule

APIs

Py_InitModule4.PYTHON27(servicemanager,1E7D6280,00000000,00000000,000003F5), ref: 1E7D1203
PyModule_GetDict.PYTHON27(00000000), ref: 1E7D1218
PyErr_NewException.PYTHON27(servicemanager.startup_error,00000000,00000000), ref: 1E7D1234
PyDict_SetItemString.PYTHON27(00000000,startup_error,00000000), ref: 1E7D1251
PyModule_AddIntConstant.PYTHON27(00000000,COINIT_MULTITHREADED,00000000), ref: 1E7D1265
PyModule_AddIntConstant.PYTHON27(00000000,COINIT_APARTMENTTHREADED,00000002), ref: 1E7D127B
PyModule_AddIntConstant.PYTHON27(00000000,COINIT_DISABLE_OLE1DDE,00000004), ref: 1E7D1291
PyModule_AddIntConstant.PYTHON27(00000000,COINIT_SPEED_OVER_MEMORY,00000008), ref: 1E7D12A7
PyModule_AddIntConstant.PYTHON27(00000000,PYS_SERVICE_STARTING,40001000), ref: 1E7D12C0
PyModule_AddIntConstant.PYTHON27(00000000,PYS_SERVICE_STARTED,40001002), ref: 1E7D12D9
PyModule_AddIntConstant.PYTHON27(00000000,PYS_SERVICE_STOPPING,40001003), ref: 1E7D12F2
PyModule_AddIntConstant.PYTHON27(00000000,PYS_SERVICE_STOPPED,40001004), ref: 1E7D130B
PyModule_AddIntConstant.PYTHON27(00000000,EVENTLOG_ERROR_TYPE,00000001), ref: 1E7D1321
PyModule_AddIntConstant.PYTHON27(00000000,EVENTLOG_INFORMATION_TYPE,00000004), ref: 1E7D1333
PyModule_AddIntConstant.PYTHON27(00000000,EVENTLOG_WARNING_TYPE,00000002), ref: 1E7D1345
PyModule_AddIntConstant.PYTHON27(00000000,EVENTLOG_AUDIT_SUCCESS,00000008), ref: 1E7D1357
PyModule_AddIntConstant.PYTHON27(00000000,EVENTLOG_AUDIT_FAILURE,00000010), ref: 1E7D1369
LoadLibraryW.KERNEL32(advapi32), ref: 1E7D1378
GetProcAddress.KERNEL32(00000000,RegisterServiceCtrlHandlerExW), ref: 1E7D1388

Strings

EVENTLOG_WARNING_TYPE, xrefs: 1E7D133F
advapi32, xrefs: 1E7D1373
COINIT_SPEED_OVER_MEMORY, xrefs: 1E7D12A1
EVENTLOG_ERROR_TYPE, xrefs: 1E7D131B
servicemanager, xrefs: 1E7D11FE
COINIT_MULTITHREADED, xrefs: 1E7D125F
EVENTLOG_AUDIT_SUCCESS, xrefs: 1E7D1351
PYS_SERVICE_STOPPED, xrefs: 1E7D1305
startup_error, xrefs: 1E7D124B
PYS_SERVICE_STOPPING, xrefs: 1E7D12EC
PYS_SERVICE_STARTED, xrefs: 1E7D12D3
COINIT_APARTMENTTHREADED, xrefs: 1E7D1275
PYS_SERVICE_STARTING, xrefs: 1E7D12BA
COINIT_DISABLE_OLE1DDE, xrefs: 1E7D128B
EVENTLOG_INFORMATION_TYPE, xrefs: 1E7D132D
RegisterServiceCtrlHandlerExW, xrefs: 1E7D1382
EVENTLOG_AUDIT_FAILURE, xrefs: 1E7D1363
servicemanager.startup_error, xrefs: 1E7D122F

Memory Dump Source

Source File: 00000011.00000002.1562321143.000000001E7D1000.00000040.00000001.01000000.00000015.sdmp, Offset: 1E7D0000, based on PE: true

Associated: 00000011.00000002.1562293036.000000001E7D0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000011.00000002.1562321143.000000001E7DA000.00000040.00000001.01000000.00000015.sdmpDownload File
Associated: 00000011.00000002.1562391495.000000001E7DB000.00000080.00000001.01000000.00000015.sdmpDownload File
Associated: 00000011.00000002.1562417397.000000001E7DD000.00000004.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e7d0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Module_$Constant$AddressDictDict_Err_ExceptionInitItemLibraryLoadModule4ProcString
String ID: COINIT_APARTMENTTHREADED$COINIT_DISABLE_OLE1DDE$COINIT_MULTITHREADED$COINIT_SPEED_OVER_MEMORY$EVENTLOG_AUDIT_FAILURE$EVENTLOG_AUDIT_SUCCESS$EVENTLOG_ERROR_TYPE$EVENTLOG_INFORMATION_TYPE$EVENTLOG_WARNING_TYPE$PYS_SERVICE_STARTED$PYS_SERVICE_STARTING$PYS_SERVICE_STOPPED$PYS_SERVICE_STOPPING$RegisterServiceCtrlHandlerExW$advapi32$servicemanager$servicemanager.startup_error$startup_error
API String ID: 4250939807-1999790513
Opcode ID: 269920bb323bdf795eaf6d09170fb44872a7b05e6f3c487e5184d03f28a8e6e9
Instruction ID: 5903a4d7448f47a931db4ae6b242e3ba41dc8ee4dc82b40455f72c6f67718f31
Opcode Fuzzy Hash: 269920bb323bdf795eaf6d09170fb44872a7b05e6f3c487e5184d03f28a8e6e9
Instruction Fuzzy Hash: 8F315EA0D4171036F8212229ED95FDD3159BF86739F260310FDBAF1AF0F765826E189A

Function 1E7AA790 Relevance: 50.9, APIs: 21, Strings: 8, Instructions: 186threadCOMMON

Download Yara Rule

APIs

PyEval_InitThreads.PYTHON27 ref: 1E7AA793

Part of subcall function 1E7A9D00: PyThreadState_Swap.PYTHON27(00000000,?,?,?,1E7AA79E), ref: 1E7A9D1A
Part of subcall function 1E7A9D00: Py_FatalError.PYTHON27(pywintypes: can not setup interpreter state, as current state is invalid), ref: 1E7A9D2A
Part of subcall function 1E7A9D00: PyThreadState_Swap.PYTHON27(00000000), ref: 1E7A9D38
Part of subcall function 1E7A9D00: LocalAlloc.KERNEL32(00000040,00000008,?,?,?,1E7AA79E), ref: 1E7A9D41
Part of subcall function 1E7A9D00: Py_FatalError.PYTHON27(Out of memory allocating thread state.,?,?,?,1E7AA79E), ref: 1E7A9D52
Part of subcall function 1E7A9D00: TlsSetValue.KERNEL32(00000012,00000000,?,?,?,1E7AA79E), ref: 1E7A9D5F
Part of subcall function 1E7A9D00: PyThreadState_Swap.PYTHON27(00000000,?,?,?,1E7AA79E), ref: 1E7A9D67
Part of subcall function 1E7A9D00: PyThreadState_Swap.PYTHON27(00000000,?,?,?,1E7AA79E), ref: 1E7A9D6C

PyDict_New.PYTHON27 ref: 1E7AA7AB
?PyWinCoreString_FromString@@YAPAU_object@@PBDH@Z.PYWINTYPES27(pywintypes,000000FF), ref: 1E7AA7BE

Part of subcall function 1E7A8D50: PyString_FromStringAndSize.PYTHON27(000000FF,000000FF,?,1E7A9FDC,?,000000FF,00000000,?,73BB3D3F), ref: 1E7A8D6E

PyDict_SetItemString.PYTHON27(00000000,Exception,00000000), ref: 1E7AA7F9
PyDict_SetItemString.PYTHON27(00000000,__name__,00000000), ref: 1E7AA802
PyImport_ImportModule.PYTHON27(__builtin__), ref: 1E7AA81D
PyDict_SetItemString.PYTHON27(00000000,__builtins__,00000000), ref: 1E7AA833
PyRun_StringFlags.PYTHON27(class error(Exception): def __init__(self, *args, **kw): nargs = len(args) if nargs > 0: self.winerror = args[0] else: self.winerror = None if nargs > 1: self.funcname = args[1] else: self.funcname = None if nargs > 2: self.strerror =,00000101,00000000,00000000,00000000), ref: 1E7AA860
PyDict_GetItemString.PYTHON27(00000000,error), ref: 1E7AA88E
PyDict_GetItemString.PYTHON27(00000000,com_error), ref: 1E7AA8A4
PyType_Ready.PYTHON27(?), ref: 1E7AA8D0
PyType_Ready.PYTHON27(?), ref: 1E7AA8E3
PyType_Ready.PYTHON27(?), ref: 1E7AA8F6
PyType_Ready.PYTHON27(?), ref: 1E7AA909
PyType_Ready.PYTHON27(?), ref: 1E7AA91C
PyType_Ready.PYTHON27(?), ref: 1E7AA92F
PyType_Ready.PYTHON27(?), ref: 1E7AA942
PyType_Ready.PYTHON27(?), ref: 1E7AA955
PyType_Ready.PYTHON27(?), ref: 1E7AA968
PyType_Ready.PYTHON27(?), ref: 1E7AA97B
PyType_Ready.PYTHON27(?), ref: 1E7AA98E

Strings

__builtin__, xrefs: 1E7AA818
class error(Exception): def __init__(self, *args, **kw): nargs = len(args) if nargs > 0: self.winerror = args[0] else: self.winerror = None if nargs > 1: self.funcname = args[1] else: self.funcname = None if nargs > 2: self.strerror =, xrefs: 1E7AA85B
com_error, xrefs: 1E7AA89E
Exception, xrefs: 1E7AA7F3
pywintypes, xrefs: 1E7AA7B9
__builtins__, xrefs: 1E7AA82D
__name__, xrefs: 1E7AA7FC
error, xrefs: 1E7AA888

Memory Dump Source

Source File: 00000011.00000002.1561923280.000000001E7A1000.00000040.00000001.01000000.00000012.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000011.00000002.1561891626.000000001E7A0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7B9000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7BE000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562197228.000000001E7C0000.00000080.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562233172.000000001E7C2000.00000004.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e7a0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: ReadyType_$String$Dict_$Item$State_SwapThread$ErrorFatalFromString_$AllocCoreEval_FlagsImportImport_InitLocalModuleRun_SizeString@@ThreadsU_object@@Value
String ID: Exception$__builtin__$__builtins__$__name__$class error(Exception): def __init__(self, *args, **kw): nargs = len(args) if nargs > 0: self.winerror = args[0] else: self.winerror = None if nargs > 1: self.funcname = args[1] else: self.funcname = None if nargs > 2: self.strerror =$com_error$error$pywintypes
API String ID: 1769851706-100239833
Opcode ID: 4bdb7af5074901396f889b8c10163665d59be213996f8c28125b465a0a36a165
Instruction ID: fcf6e59f88b5f32409d955829cca162579bd6834f10d8d1bb6bf9f40d63551b7
Opcode Fuzzy Hash: 4bdb7af5074901396f889b8c10163665d59be213996f8c28125b465a0a36a165
Instruction Fuzzy Hash: CB51B0718015115BF101BA78AC908EB32659EC5338F280322EA7B926F1FB24D957DF93

Function 1E8C22A0 Relevance: 49.3, APIs: 23, Strings: 5, Instructions: 270windowCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,|k:FormatMessageA,?), ref: 1E8C22E1
GetLastError.KERNEL32 ref: 1E8C22F5
?PyWin_GetErrorMessageModule@@YAPAUHINSTANCE__@@K@Z.PYWINTYPES27(?), ref: 1E8C2304
FormatMessageA.KERNEL32(00001200,00000000,?,00000000,?,00000200,00000000), ref: 1E8C232A
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(FormatMessage,00000000), ref: 1E8C233A
PyString_FromString.PYTHON27(?), ref: 1E8C235B
PyErr_Clear.PYTHON27 ref: 1E8C2375
PyArg_ParseTuple.PYTHON27(?,kOkkO:FormatMessageA,?,?,?,?,?), ref: 1E8C23A7
?PyWinObject_AsHANDLE@@YAHPAU_object@@PAPAX@Z.PYWINTYPES27(?,?), ref: 1E8C23C6
?PyWinSequence_Tuple@@YAPAU_object@@PAU1@PAK@Z.PYWINTYPES27(?,?), ref: 1E8C241A
PyErr_NoMemory.PYTHON27 ref: 1E8C244B
?PyWinObject_FreeString@@YAXPAD@Z.PYWINTYPES27 ref: 1E8C2574
73BB3B4E.MSVCR90(?), ref: 1E8C2584
?PyWinObject_FreeString@@YAXPAD@Z.PYWINTYPES27(?), ref: 1E8C2591
LocalFree.KERNEL32(?), ref: 1E8C25A2

Strings

FormatMessage, xrefs: 1E8C2335
Access violation (probably due to missing string inserts), xrefs: 1E8C251E
kOkkO:FormatMessageA, xrefs: 1E8C23A1
|k:FormatMessageA, xrefs: 1E8C22D2
FormatMessageA, xrefs: 1E8C253D

Memory Dump Source

Source File: 00000011.00000002.1562490344.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 00000011.00000002.1562469835.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562702731.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562730939.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: FreeObject_U_object@@$Arg_Err_ErrorMessageParseString@@TupleWin_$ClearE__@@Error@@FormatFromLastLocalMemoryModule@@Sequence_StringString_Tuple@@
String ID: Access violation (probably due to missing string inserts)$FormatMessage$FormatMessageA$kOkkO:FormatMessageA$|k:FormatMessageA
API String ID: 1473980708-3451784028
Opcode ID: 0730011bb21f8ad9fedbdc8bc4b238ce8b6026eacf1902867429009cf6a16e9f
Instruction ID: 91bdc100aeeefbecb065028d99f9e2b3a8c3ba916e58ab92beff2b696f31c99a
Opcode Fuzzy Hash: 0730011bb21f8ad9fedbdc8bc4b238ce8b6026eacf1902867429009cf6a16e9f
Instruction Fuzzy Hash: 64A150B1D00619AFDB00CFD8DDD4AEEB7B9FB4A715F104229E909A3280E735E945CB61

Function 1E8C25E0 Relevance: 49.3, APIs: 23, Strings: 5, Instructions: 270windowCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,|k:FormatMessageW,?), ref: 1E8C2621
GetLastError.KERNEL32 ref: 1E8C2635
?PyWin_GetErrorMessageModule@@YAPAUHINSTANCE__@@K@Z.PYWINTYPES27(?), ref: 1E8C2644
FormatMessageW.KERNEL32(00001200,00000000,?,00000000,?,00000200,00000000), ref: 1E8C266A
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(FormatMessageW,00000000), ref: 1E8C267A
?PyWinObject_FromOLECHAR@@YAPAU_object@@PB_W@Z.PYWINTYPES27(?), ref: 1E8C269B
PyErr_Clear.PYTHON27 ref: 1E8C26B5
PyArg_ParseTuple.PYTHON27(?,kOkkO:FormatMessageW,?,?,?,?,?), ref: 1E8C26E7
?PyWinObject_AsHANDLE@@YAHPAU_object@@PAPAX@Z.PYWINTYPES27(?,?), ref: 1E8C2706
?PyWinSequence_Tuple@@YAPAU_object@@PAU1@PAK@Z.PYWINTYPES27(?,?), ref: 1E8C275A
PyErr_NoMemory.PYTHON27 ref: 1E8C278B
?PyWinObject_FreeWCHAR@@YAXPA_W@Z.PYWINTYPES27 ref: 1E8C28B4
73BB3B4E.MSVCR90(?), ref: 1E8C28C4
?PyWinObject_FreeWCHAR@@YAXPA_W@Z.PYWINTYPES27(?), ref: 1E8C28D1
LocalFree.KERNEL32(?), ref: 1E8C28E2

Strings

FormatMessageW, xrefs: 1E8C2675
FormatMessageW, xrefs: 1E8C287D
|k:FormatMessageW, xrefs: 1E8C2612
kOkkO:FormatMessageW, xrefs: 1E8C26E1
Access violation (probably due to missing string inserts), xrefs: 1E8C285E

Memory Dump Source

Source File: 00000011.00000002.1562490344.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 00000011.00000002.1562469835.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562702731.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562730939.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Object_U_object@@$Free$Arg_Err_ErrorMessageParseTupleWin_$ClearE__@@Error@@FormatFromLastLocalMemoryModule@@Sequence_Tuple@@
String ID: Access violation (probably due to missing string inserts)$FormatMessageW$FormatMessageW$kOkkO:FormatMessageW$|k:FormatMessageW
API String ID: 652389039-1434402131
Opcode ID: cbe3b316b06982b133cb3bf2466ebf138717d64250bd9f18bd7724153822be9f
Instruction ID: fe210d190c1b17abc1063bd217850ede2ee94dc8c4077c859cb28b5469b0122f
Opcode Fuzzy Hash: cbe3b316b06982b133cb3bf2466ebf138717d64250bd9f18bd7724153822be9f
Instruction Fuzzy Hash: F8A13CB1D00619AFDB00DFD8DCC8ADEB7B9FF49715F148229E90AA3280D735A945CB61

Function 1E8C7BE0 Relevance: 49.2, APIs: 13, Strings: 15, Instructions: 196COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27 ref: 1E8C7C02
?PyWinObject_AsHKEY@@YAHPAU_object@@PAPAUHKEY__@@@Z.PYWINTYPES27(?,?), ref: 1E8C7C1F
PyErr_Format.PYTHON27(?,Unable to allocate %d bytes,?,?,?,?,?,?,?), ref: 1E8C7C5C

Strings

cbSecurityDescriptor, xrefs: 1E8C7D81
MaxClassLen, xrefs: 1E8C7DAB
SubKeys, xrefs: 1E8C7DBB
Class, xrefs: 1E8C7DD2
{s:N,s:O,s:k,s:k,s:k,s:k,s:k,s:k,s:k,s:N}, xrefs: 1E8C7DD7
MaxSubKeyLen, xrefs: 1E8C7DB5
Unable to allocate %d bytes, xrefs: 1E8C7C56
MaxValueLen, xrefs: 1E8C7D8B
MaxValueNameLen, xrefs: 1E8C7D95
O:RegQueryInfoKeyW, xrefs: 1E8C7BEC
RegQueryInfoKeyW, xrefs: 1E8C7D3A
Values, xrefs: 1E8C7D9F
Unable to allocate %d bytes, xrefs: 1E8C7CE7
LastWriteTime, xrefs: 1E8C7D77
Reserved, xrefs: 1E8C7DC1

Memory Dump Source

Source File: 00000011.00000002.1562490344.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 00000011.00000002.1562469835.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562702731.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562730939.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_Err_FormatObject_ParseTupleU_object@@Y__@@@
String ID: Class$LastWriteTime$MaxClassLen$MaxSubKeyLen$MaxValueLen$MaxValueNameLen$O:RegQueryInfoKeyW$RegQueryInfoKeyW$Reserved$SubKeys$Unable to allocate %d bytes$Unable to allocate %d bytes$Values$cbSecurityDescriptor${s:N,s:O,s:k,s:k,s:k,s:k,s:k,s:k,s:k,s:N}
API String ID: 274238381-1446190885
Opcode ID: f7148374d31ccb5bb8de1875cddfbd1e4d64d273bf8a8d7315229dd23639e3f3
Instruction ID: 662718d085845bf8f0eed041ac1736266c3e259192c3984da04671fec559da94
Opcode Fuzzy Hash: f7148374d31ccb5bb8de1875cddfbd1e4d64d273bf8a8d7315229dd23639e3f3
Instruction Fuzzy Hash: 0C513DB2104301AFD304DB94DC84DEBB3E9EFC9615F444A1DF94AD3210E675EA498BA6

Function 1E8C4A80 Relevance: 49.2, APIs: 21, Strings: 7, Instructions: 161threadCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,O:GetShortPathName,?), ref: 1E8C4A95
?PyWinObject_AsString@@YAHPAU_object@@PAPADHPAK@Z.PYWINTYPES27(?,00000000,00000000,00000000), ref: 1E8C4AC9
PyEval_SaveThread.PYTHON27 ref: 1E8C4ADA
GetShortPathNameA.KERNEL32(?,?,00000105), ref: 1E8C4AF1
PyEval_RestoreThread.PYTHON27(00000000), ref: 1E8C4AFA
?PyWinObject_FreeString@@YAXPAD@Z.PYWINTYPES27(?), ref: 1E8C4B05
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(GetShortPathName,00000000), ref: 1E8C4B18

Strings

GetShortPathNameW, xrefs: 1E8C4C17
GetShortPathNameW, xrefs: 1E8C4BB6
Short path name changed between calls, xrefs: 1E8C4C1C
The pathname would be too big!!!, xrefs: 1E8C4B34
GetShortPathName, xrefs: 1E8C4B13
O:GetShortPathName, xrefs: 1E8C4A8F
GetShortPathNameW, xrefs: 1E8C4C04

Memory Dump Source

Source File: 00000011.00000002.1562490344.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 00000011.00000002.1562469835.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562702731.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562730939.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Eval_Object_String@@ThreadU_object@@$Arg_Error@@FreeNameParsePathRestoreSaveShortTupleWin_
String ID: GetShortPathName$GetShortPathNameW$GetShortPathNameW$GetShortPathNameW$O:GetShortPathName$Short path name changed between calls$The pathname would be too big!!!
API String ID: 3904419379-2788351225
Opcode ID: 563944333bc86684f6cc98ea2c43ea83b26193e953867e591ec0208d0ce7bc0f
Instruction ID: d07dbab827821a420eb10c67b48e37fe3b03978bc4099b52c525bfbe2ac54379
Opcode Fuzzy Hash: 563944333bc86684f6cc98ea2c43ea83b26193e953867e591ec0208d0ce7bc0f
Instruction Fuzzy Hash: E141F275900211AFE3109BADDC8DEDB7BE9FFC6351F404628F949D3210EA34D589CAA6

Function 034128B0 Relevance: 47.5, APIs: 24, Strings: 3, Instructions: 264COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,0341B4B0,?), ref: 034128D7
OpenProcessToken.ADVAPI32(00000000,00000008,?), ref: 03412910
CloseHandle.KERNEL32(00000000), ref: 03412928
CloseHandle.KERNEL32(?), ref: 03412937
73BB3B4E.MSVCR90(00000000), ref: 0341294C
73BB3B4E.MSVCR90(00000000), ref: 03412B47
73BB3B4E.MSVCR90(00000000), ref: 03412B51

Strings

LookupAccountSidW, xrefs: 03412A70
OpenProcessToken, xrefs: 0341291A
GetTokenInformation, xrefs: 034129C9

Memory Dump Source

Source File: 00000011.00000002.1560676867.0000000003411000.00000040.00000001.01000000.0000000F.sdmp, Offset: 03410000, based on PE: true

Associated: 00000011.00000002.1560637646.0000000003410000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560676867.000000000341B000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560676867.000000000341F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560836323.0000000003423000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_3410000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: CloseHandle$Arg_OpenParseProcessTokenTuple
String ID: GetTokenInformation$LookupAccountSidW$OpenProcessToken
API String ID: 1358469895-966322916
Opcode ID: 5b2fe5b8a38999f4e7764720186e355283601fa398415c8de3bdf26cf65c27cf
Instruction ID: 879ee1867b4daef813ffe4445bd73631cd127eac43545a9faa6efed24e431d1b
Opcode Fuzzy Hash: 5b2fe5b8a38999f4e7764720186e355283601fa398415c8de3bdf26cf65c27cf
Instruction Fuzzy Hash: 6581F571A006055BD710EFA4AC84A6BB7ECEF84610F09492AF845EF344E7B4E915CBE6

Function 1E8C4420 Relevance: 47.4, APIs: 25, Strings: 2, Instructions: 195COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,OOO|O,?,?,?,?), ref: 1E8C4467
PyInt_AsLong.PYTHON27(?), ref: 1E8C4484
PyErr_Occurred.PYTHON27 ref: 1E8C449E
PyErr_Clear.PYTHON27 ref: 1E8C44AE
?PyWinObject_AsString@@YAHPAU_object@@PAPADHPAK@Z.PYWINTYPES27(?,?,00000001,00000000), ref: 1E8C44BF
PyErr_Clear.PYTHON27 ref: 1E8C44C8
PyErr_SetString.PYTHON27(?,Default value must be a string or int), ref: 1E8C44D7

Strings

Default value must be a string or int, xrefs: 1E8C44D1
OOO|O, xrefs: 1E8C444E

Memory Dump Source

Source File: 00000011.00000002.1562490344.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 00000011.00000002.1562469835.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562702731.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562730939.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Err_$Clear$Arg_Int_LongObject_OccurredParseStringString@@TupleU_object@@
String ID: Default value must be a string or int$OOO|O
API String ID: 314853312-3533590036
Opcode ID: 0c630ff95b386399c63bcc1be2bcdf483acd4842cf2beacb50568fa6e1c1b080
Instruction ID: 866c6d57171c27d6dae183ee5ffcdf551c87006d0c6f6c3732bb3b9c1619fe65
Opcode Fuzzy Hash: 0c630ff95b386399c63bcc1be2bcdf483acd4842cf2beacb50568fa6e1c1b080
Instruction Fuzzy Hash: 15516172504311AFE300DBA9CC88CAB77E9EFC9714F004A1DF999C3250E635E985CBA2

Function 1E7AAE10 Relevance: 45.7, APIs: 10, Strings: 16, Instructions: 217COMMON

Download Yara Rule

APIs

PyImport_ImportModule.PYTHON27(cStringIO), ref: 1E7AAE34
PyImport_ImportModule.PYTHON27(traceback), ref: 1E7AAE50

Strings

<Error getting traceback - cant find traceback.print_exception>, xrefs: 1E7AAEC1
<Error getting traceback - cant import cStringIO>, xrefs: 1E7AAE41
cStringIO, xrefs: 1E7AAE1F
<Error getting traceback - cant find getvalue function>, xrefs: 1E7AAF5E
print_exception, xrefs: 1E7AAEAE
<Error getting traceback - cStringIO.StringIO() failed>, xrefs: 1E7AAEA0
traceback, xrefs: 1E7AAE4B
<Error getting traceback - traceback.print_exception() failed>, xrefs: 1E7AAF2D
StringIO, xrefs: 1E7AAE71
<Error getting traceback - getvalue() did not return a string>, xrefs: 1E7AAFAB, 1E7AAFB0
<Error getting traceback - cant find cStringIO.StringIO>, xrefs: 1E7AAE82
getvalue, xrefs: 1E7AAF49
<Error getting traceback - getvalue() failed.>, xrefs: 1E7AAF85
<Error getting traceback - cant make print_exception arguments>, xrefs: 1E7AAF0C
<Error getting traceback - cant import traceback>, xrefs: 1E7AAE5D
OOOOO, xrefs: 1E7AAEF8

Memory Dump Source

Source File: 00000011.00000002.1561923280.000000001E7A1000.00000040.00000001.01000000.00000012.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000011.00000002.1561891626.000000001E7A0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7B9000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7BE000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562197228.000000001E7C0000.00000080.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562233172.000000001E7C2000.00000004.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e7a0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: ImportImport_Module
String ID: <Error getting traceback - cStringIO.StringIO() failed>$<Error getting traceback - cant find cStringIO.StringIO>$<Error getting traceback - cant find getvalue function>$<Error getting traceback - cant find traceback.print_exception>$<Error getting traceback - cant import cStringIO>$<Error getting traceback - cant import traceback>$<Error getting traceback - cant make print_exception arguments>$<Error getting traceback - getvalue() did not return a string>$<Error getting traceback - getvalue() failed.>$<Error getting traceback - traceback.print_exception() failed>$OOOOO$StringIO$cStringIO$getvalue$print_exception$traceback
API String ID: 412506365-3429250191
Opcode ID: adeed30468a0fbb902207386f9411573f413d46fbce1c6f30c0706fc300fa978
Instruction ID: d28ac7db67e61839472774f554eb88f8ec2d6256ca934247604e3635ab6134cc
Opcode Fuzzy Hash: adeed30468a0fbb902207386f9411573f413d46fbce1c6f30c0706fc300fa978
Instruction Fuzzy Hash: 1271A3B16043469FF314EF65DC4099B73A9AFC4624F094718FA558B3A4E734EC46CB92

Function 1E8C55D0 Relevance: 45.7, APIs: 19, Strings: 7, Instructions: 180COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27 ref: 1E8C55EF
PyTuple_Size.PYTHON27(?,?,?,?,OO:SetSysColors,?,?), ref: 1E8C562E
PyTuple_Size.PYTHON27(?,?,?,?,OO:SetSysColors,?,?), ref: 1E8C5637
PyErr_Format.PYTHON27(?,SetSysColors: Unable to allocate array of %d ints,00000000,?,?,?,?,OO:SetSysColors,?,?), ref: 1E8C5672

Strings

Color element must be an int, xrefs: 1E8C575F
OO:SetSysColors, xrefs: 1E8C55E1
SetSysColors: Unable to allocate array of %d COLORREF's, xrefs: 1E8C569F
SetSysColors: Unable to allocate array of %d ints, xrefs: 1E8C566C
RGB value must be an int, xrefs: 1E8C57A6
SetSysColors, xrefs: 1E8C5742
SetSysColors: Arguments must be equal length tuples of ints, xrefs: 1E8C57C9

Memory Dump Source

Source File: 00000011.00000002.1562490344.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 00000011.00000002.1562469835.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562702731.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562730939.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: SizeTuple_$Arg_Err_FormatParseTuple
String ID: Color element must be an int$OO:SetSysColors$RGB value must be an int$SetSysColors$SetSysColors: Arguments must be equal length tuples of ints$SetSysColors: Unable to allocate array of %d COLORREF's$SetSysColors: Unable to allocate array of %d ints
API String ID: 1720882371-50870979
Opcode ID: 3b02fabd3a1577af96772786c9eba540fda36b64e5fd2993400b88cb223379ef
Instruction ID: ca18ab362921ee1c0bb8cb6bb856d94585df45f2b3c165249c0ed05c6bd143ab
Opcode Fuzzy Hash: 3b02fabd3a1577af96772786c9eba540fda36b64e5fd2993400b88cb223379ef
Instruction Fuzzy Hash: 5151BE74600312AFE700DF68CCC89DBB7E9FF86658F144629EC4993350E731E5968BA2

Function 1E7A81D0 Relevance: 40.5, APIs: 14, Strings: 9, Instructions: 283timeCOMMON

Download Yara Rule

APIs

PyObject_GenericGetAttr.PYTHON27(?,?), ref: 1E7A81DF
PyErr_Clear.PYTHON27 ref: 1E7A81F0
VariantTimeToSystemTime.OLEAUT32 ref: 1E7A8204
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(VariantTimeToSystemTime,00000000), ref: 1E7A8214

Part of subcall function 1E7A9F20: GetLastError.KERNEL32(00000000,?,1E7A5F68,MakeSelfRelativeSD,00000000), ref: 1E7A9F2A
Part of subcall function 1E7A9F20: ?PyWin_GetErrorMessageModule@@YAPAUHINSTANCE__@@K@Z.PYWINTYPES27(00000000,00000000,?,1E7A5F68,MakeSelfRelativeSD,00000000), ref: 1E7A9F38
Part of subcall function 1E7A9F20: FormatMessageA.KERNEL32(00001300,00000000,00000000,00000000,?,00000000,00000000), ref: 1E7A9F69
Part of subcall function 1E7A9F20: ?PyWinObject_FromTCHAR@@YAPAU_object@@PBDH@Z.PYWINTYPES27(No error message is available,000000FF,?,?,?,?,?,?,?,?,?,?,00000000), ref: 1E7A9FC7
Part of subcall function 1E7A9F20: ?PyWinCoreString_FromString@@YAPAU_object@@PBDH@Z.PYWINTYPES27(?,000000FF,00000000,?,73BB3D3F), ref: 1E7A9FD7
Part of subcall function 1E7A9F20: Py_BuildValue.PYTHON27((iNN),00000000,00000000,?,00000000,?,73BB3D3F), ref: 1E7A9FE6
Part of subcall function 1E7A9F20: LocalFree.KERNEL32(?), ref: 1E7A9FFF
Part of subcall function 1E7A9F20: PyErr_SetObject.PYTHON27(031BEB40,00000000), ref: 1E7AA010

PyString_AsString.PYTHON27(?), ref: 1E7A8225
PyInt_FromLong.PYTHON27(?), ref: 1E7A826F

Strings

day, xrefs: 1E7A830F
weekday, xrefs: 1E7A82C5
month, xrefs: 1E7A827F
second, xrefs: 1E7A83E5
hour, xrefs: 1E7A8355
year, xrefs: 1E7A8232
minute, xrefs: 1E7A839F
VariantTimeToSystemTime, xrefs: 1E7A820F
msec, xrefs: 1E7A842F

Memory Dump Source

Source File: 00000011.00000002.1561923280.000000001E7A1000.00000040.00000001.01000000.00000012.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000011.00000002.1561891626.000000001E7A0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7B9000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7BE000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562197228.000000001E7C0000.00000080.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562233172.000000001E7C2000.00000004.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e7a0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: FromU_object@@$Err_ErrorMessageObject_String_TimeWin_$AttrBuildClearCoreE__@@Error@@FormatFreeGenericInt_LastLocalLongModule@@ObjectStringString@@SystemValueVariant
String ID: VariantTimeToSystemTime$day$hour$minute$month$msec$second$weekday$year
API String ID: 2393066126-3503056508
Opcode ID: c3c50b6d3b0f8c10a91c1cba1fa94a41083fb50cc474bbd2406e12e11965c3b7
Instruction ID: 959b95b1a63b1d32923384136a40d6f519256286dfa74b230d52cbc1f5c25eaf
Opcode Fuzzy Hash: c3c50b6d3b0f8c10a91c1cba1fa94a41083fb50cc474bbd2406e12e11965c3b7
Instruction Fuzzy Hash: 5B816B72B5A1D147F7095F3858782BEFB53ADD6125B8C03ACEAC6861E5F322C409C701

Function 1E8CC020 Relevance: 38.8, APIs: 14, Strings: 8, Instructions: 283COMMON

Download Yara Rule

APIs

PyString_AsString.PYTHON27(?), ref: 1E8CC029
?PyWinObject_AsString@@YAHPAU_object@@PAPADHPAK@Z.PYWINTYPES27(?,?,00000000,?), ref: 1E8CC08D
PyErr_Format.PYTHON27(?,DeviceName must be a string of length %d or less,00000020), ref: 1E8CC0B2
?PyWinObject_FreeString@@YAXPAD@Z.PYWINTYPES27(?,?,DeviceName must be a string of length %d or less,00000020), ref: 1E8CC0BD

Strings

DeviceString must be a string of length %d or less, xrefs: 1E8CC170
DeviceString, xrefs: 1E8CC10D
DeviceName must be a string of length %d or less, xrefs: 1E8CC0AC
DeviceKey, xrefs: 1E8CC246
DeviceID, xrefs: 1E8CC1A8
DeviceID must be a string of length %d or less, xrefs: 1E8CC20B
DeviceName, xrefs: 1E8CC046
DeviceKey must be a string of length %d or less, xrefs: 1E8CC2AC

Memory Dump Source

Source File: 00000011.00000002.1562490344.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 00000011.00000002.1562469835.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562702731.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562730939.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Object_String@@$Err_FormatFreeStringString_U_object@@
String ID: DeviceID$DeviceID must be a string of length %d or less$DeviceKey$DeviceKey must be a string of length %d or less$DeviceName$DeviceName must be a string of length %d or less$DeviceString$DeviceString must be a string of length %d or less
API String ID: 1691780610-851127861
Opcode ID: e7d362bbee63d23e9cb31101050fd120032209054b2c46cafae86f6d8d420e83
Instruction ID: 57839b9d2b3b03c60261ac5d534e8de085662155be3af66b6b6f98416df89dce
Opcode Fuzzy Hash: e7d362bbee63d23e9cb31101050fd120032209054b2c46cafae86f6d8d420e83
Instruction Fuzzy Hash: 6F9148326142425FD308DF389C94AEB77AAAFC3624F484B5DF899972C1E731E409C792

Function 1E8C8FE0 Relevance: 38.7, APIs: 19, Strings: 3, Instructions: 175COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,OOO|O:WriteProfileVal,?,?,?,?), ref: 1E8C9021
PyInt_AsLong.PYTHON27(?), ref: 1E8C903B
PyErr_Occurred.PYTHON27 ref: 1E8C9055
PyErr_Clear.PYTHON27 ref: 1E8C9065
?PyWinObject_AsString@@YAHPAU_object@@PAPADHPAK@Z.PYWINTYPES27(?,?,00000001,00000000), ref: 1E8C9076
PyErr_Clear.PYTHON27 ref: 1E8C907F
PyErr_SetString.PYTHON27(?,Value must be a string or int), ref: 1E8C908E

Strings

Write[Private]ProfileString, xrefs: 1E8C9150
OOO|O:WriteProfileVal, xrefs: 1E8C9008
Value must be a string or int, xrefs: 1E8C9088

Memory Dump Source

Source File: 00000011.00000002.1562490344.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 00000011.00000002.1562469835.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562702731.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562730939.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Err_$Clear$Arg_Int_LongObject_OccurredParseStringString@@TupleU_object@@
String ID: OOO|O:WriteProfileVal$Value must be a string or int$Write[Private]ProfileString
API String ID: 314853312-3239610536
Opcode ID: 9bd543fb0bb2693b964fb08c13214587cd983dcca678592682d8ceddf79342d1
Instruction ID: c5a87d8024d727e32bf20f6b3a51110f7dc20915d0f630dff585575a9b1fe9f0
Opcode Fuzzy Hash: 9bd543fb0bb2693b964fb08c13214587cd983dcca678592682d8ceddf79342d1
Instruction Fuzzy Hash: 8F517FB2504305AFD300DFA5DC88C9BB7E9FFC9254F444A5EF949C3250E636E9498BA2

Function 1E8C6CD0 Relevance: 37.0, APIs: 15, Strings: 6, Instructions: 203registryCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,O:RegEnumKeyExW,?), ref: 1E8C6CED
?PyWinObject_AsHKEY@@YAHPAU_object@@PAPAUHKEY__@@@Z.PYWINTYPES27(?,?), ref: 1E8C6D0B
RegQueryInfoKeyA.ADVAPI32(?,00000000,00000000,00000000,?,?,?,00000000,00000000,00000000,00000000,00000000), ref: 1E8C6D34
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(RegEnumKeyExW:RegQueryInfoKey,00000000), ref: 1E8C6D44

Strings

RegEnumKeyExW, xrefs: 1E8C6EA6
RegEnumKeyExW:RegQueryInfoKey, xrefs: 1E8C6D3F
NiNN, xrefs: 1E8C6E64
RegEnumKeyExW: Unable to allocate %d bytes, xrefs: 1E8C6D7F
O:RegEnumKeyExW, xrefs: 1E8C6CDF
RegEnumKeyExW: Unable to allocate %d bytes, xrefs: 1E8C6DBE

Memory Dump Source

Source File: 00000011.00000002.1562490344.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 00000011.00000002.1562469835.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562702731.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562730939.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: U_object@@$Arg_Error@@InfoObject_ParseQueryTupleWin_Y__@@@
String ID: NiNN$O:RegEnumKeyExW$RegEnumKeyExW$RegEnumKeyExW: Unable to allocate %d bytes$RegEnumKeyExW: Unable to allocate %d bytes$RegEnumKeyExW:RegQueryInfoKey
API String ID: 1520217418-704844618
Opcode ID: e5026f728197450dbd1f8ece34f7a60e625618ad7478c080a045ac77d56d35ed
Instruction ID: 203f10f3e30f06ca2bd27b151b061ca228ac92a8f133e8578242330bfe9de6d4
Opcode Fuzzy Hash: e5026f728197450dbd1f8ece34f7a60e625618ad7478c080a045ac77d56d35ed
Instruction Fuzzy Hash: EF514AB1504315AFD300DF64DC88DABB7E9FBC5658F144A2DF94A87240E731E94A8BA2

Function 1E8C6AA0 Relevance: 37.0, APIs: 15, Strings: 6, Instructions: 201registryCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,O:RegEnumKeyEx,?), ref: 1E8C6AC1
?PyWinObject_AsHKEY@@YAHPAU_object@@PAPAUHKEY__@@@Z.PYWINTYPES27(?,?), ref: 1E8C6ADF
RegQueryInfoKeyA.ADVAPI32(?,00000000,00000000,00000000,?,?,?,00000000,00000000,00000000,00000000,00000000), ref: 1E8C6B08
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(RegEnumKeyEx:RegQueryInfoKey,00000000), ref: 1E8C6B18

Strings

RegEnumKeyEx, xrefs: 1E8C6C76
RegEnumKeyEx: Unable to allocate %d bytes, xrefs: 1E8C6B8B
O:RegEnumKeyEx, xrefs: 1E8C6AAF
NiNN, xrefs: 1E8C6C34
RegEnumKeyEx: Unable to allocate %d bytes, xrefs: 1E8C6B4F
RegEnumKeyEx:RegQueryInfoKey, xrefs: 1E8C6B13

Memory Dump Source

Source File: 00000011.00000002.1562490344.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 00000011.00000002.1562469835.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562702731.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562730939.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: U_object@@$Arg_Error@@InfoObject_ParseQueryTupleWin_Y__@@@
String ID: NiNN$O:RegEnumKeyEx$RegEnumKeyEx$RegEnumKeyEx: Unable to allocate %d bytes$RegEnumKeyEx: Unable to allocate %d bytes$RegEnumKeyEx:RegQueryInfoKey
API String ID: 1520217418-2384111254
Opcode ID: ee31b4cc67bc9afb9ee70da214bfdb31a56435eac02c5bfadcc92d4e3a19b566
Instruction ID: 089519cba3826a4f619de2f5f5c6f83fe1b23fee422071a5a33a251ff1b42960
Opcode Fuzzy Hash: ee31b4cc67bc9afb9ee70da214bfdb31a56435eac02c5bfadcc92d4e3a19b566
Instruction Fuzzy Hash: 7F517AB1514305AFD300DF64DC88DAB77E9FBC9658F044A2DF84A83340D731EA4A8BA2

Function 03414590 Relevance: 35.3, APIs: 14, Strings: 6, Instructions: 281COMMON

Download Yara Rule

APIs

PyList_New.PYTHON27(00000000), ref: 034145AF
74CF24A0.WTSAPI32(?,00000000,00000000,00000001,?,?), ref: 03414619
74CF24A0.WTSAPI32(?,00000000,00000000,00000001,?,?), ref: 03414627
Py_BuildValue.PYTHON27(0341B7B4,?), ref: 034146BD
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 03414730

Part of subcall function 03411090: GetLastError.KERNEL32 ref: 034110B2
Part of subcall function 03411090: PyErr_SetFromWindowsErrWithFilename.PYTHON27(00000000), ref: 034110B9

74CF24A0.WTSAPI32(?,?), ref: 0341489A
74CF24A0.WTSAPI32(?,?), ref: 034148A8
74CF24A0.WTSAPI32(?,?), ref: 034148B6

Strings

WTSQuerySessionInformation, xrefs: 03414828
WinStationQueryInformationW, xrefs: 0341482F
OOd, xrefs: 03414776
WTSEnumerateSessions, xrefs: 034145DD
WTSQuerySessionInformationW, xrefs: 03414821
%u.%u.%u.%u, xrefs: 034146A1

Memory Dump Source

Source File: 00000011.00000002.1560676867.0000000003411000.00000040.00000001.01000000.0000000F.sdmp, Offset: 03410000, based on PE: true

Associated: 00000011.00000002.1560637646.0000000003410000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560676867.000000000341B000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560676867.000000000341F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560836323.0000000003423000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_3410000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: BuildErr_ErrorFilenameFromLastList_Unothrow_t@std@@@ValueWindowsWith__ehfuncinfo$??2@
String ID: %u.%u.%u.%u$OOd$WTSEnumerateSessions$WTSQuerySessionInformation$WTSQuerySessionInformationW$WinStationQueryInformationW
API String ID: 1817856899-3117540829
Opcode ID: e9acad0336d46f411ef3944d369c6ecb16e75cbe74d4de079f1d1b7b44e440d8
Instruction ID: 6a05b5b10959c218b74de76c04107640164f8962e21d7d7f07482e81c63ffe05
Opcode Fuzzy Hash: e9acad0336d46f411ef3944d369c6ecb16e75cbe74d4de079f1d1b7b44e440d8
Instruction Fuzzy Hash: 5391B276604B40AFC750DB66CC44E6BB3F8AB85714F084A1EF9689F340DB74E921CB96

Function 1E8CBB30 Relevance: 35.2, APIs: 15, Strings: 5, Instructions: 167COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27 ref: 1E8CBB4F
SetConsoleCtrlHandler.KERNEL32(00000000,?,?,?,?,?), ref: 1E8CBB74
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(SetConsoleCtrlHandler,00000000,?,?,?,?), ref: 1E8CBB84

Strings

SetConsoleCtrlHandler, xrefs: 1E8CBB7F
First argument must be callable (got %s), xrefs: 1E8CBBC1
The object has not been registered, xrefs: 1E8CBC93
O|i:SetConsoleCtrlHandler, xrefs: 1E8CBB41
SetConsoleCtrlHandler, xrefs: 1E8CBCE8

Memory Dump Source

Source File: 00000011.00000002.1562490344.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 00000011.00000002.1562469835.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562702731.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562730939.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_ConsoleCtrlError@@HandlerParseTupleU_object@@Win_
String ID: First argument must be callable (got %s)$O|i:SetConsoleCtrlHandler$SetConsoleCtrlHandler$SetConsoleCtrlHandler$The object has not been registered
API String ID: 628897916-820431104
Opcode ID: 9bc43f1b5c3b73ed6c2c37a6b1a6523064a4992dc93caa579c767c0489a31f3a
Instruction ID: 91de0b2463e222ddfe8cd3e6d8326673b75cf1884fa0ce1eba8fa71716bd2b5d
Opcode Fuzzy Hash: 9bc43f1b5c3b73ed6c2c37a6b1a6523064a4992dc93caa579c767c0489a31f3a
Instruction Fuzzy Hash: 7751F675610616AFE700DB25DCC8AD673E9FB82206F408925ED0EC3344E735E949DB72

Function 034177E0 Relevance: 35.1, APIs: 17, Strings: 3, Instructions: 126serviceCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,0341D434,?), ref: 034177F9
QueryServiceStatusEx.ADVAPI32(00000000,00000000,00000000,00000000,?), ref: 03417838
GetLastError.KERNEL32 ref: 03417840
CloseServiceHandle.ADVAPI32(00000000), ref: 0341784A
Py_BuildValue.PYTHON27(0341D438,0341D824), ref: 0341785A

Strings

(sk), xrefs: 034178D5
QueryServiceStatusEx, xrefs: 03417878
QueryServiceStatusEx, xrefs: 034178B9

Memory Dump Source

Source File: 00000011.00000002.1560676867.0000000003411000.00000040.00000001.01000000.0000000F.sdmp, Offset: 03410000, based on PE: true

Associated: 00000011.00000002.1560637646.0000000003410000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560676867.000000000341B000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560676867.000000000341F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560836323.0000000003423000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_3410000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Service$Arg_BuildCloseErrorHandleLastParseQueryStatusTupleValue
String ID: (sk)$QueryServiceStatusEx$QueryServiceStatusEx
API String ID: 740867558-3645801062
Opcode ID: 14ce56cbc89aaa54470c1e6e092c70d0c17c5983b4543b1629d1bd95a99ef35a
Instruction ID: 247dcb6073ee66598eb4e1e4089cdaf562f60ef3c15dbb2ff977e892d414710b
Opcode Fuzzy Hash: 14ce56cbc89aaa54470c1e6e092c70d0c17c5983b4543b1629d1bd95a99ef35a
Instruction Fuzzy Hash: EB313B71A00B016FD210FB65BC99E7FBFACEF81A55F04042AF9059E200E765D525C6FA

Function 03411580 Relevance: 35.1, APIs: 15, Strings: 5, Instructions: 121COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,0341B160,?,?), ref: 03411597

Strings

WaitForSingleObject() -> WAIT_ABANDONED, xrefs: 03411664
WaitForSingleObject, xrefs: 03411628
GetExitCodeProcess, xrefs: 034116A3
WaitForSingleObject() returned WAIT_TIMEOUT, xrefs: 0341163D
WaitForSingleObject() returned WAIT_ABANDONED, xrefs: 03411674

Memory Dump Source

Source File: 00000011.00000002.1560676867.0000000003411000.00000040.00000001.01000000.0000000F.sdmp, Offset: 03410000, based on PE: true

Associated: 00000011.00000002.1560637646.0000000003410000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560676867.000000000341B000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560676867.000000000341F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560836323.0000000003423000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_3410000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_ParseTuple
String ID: GetExitCodeProcess$WaitForSingleObject$WaitForSingleObject() -> WAIT_ABANDONED$WaitForSingleObject() returned WAIT_ABANDONED$WaitForSingleObject() returned WAIT_TIMEOUT
API String ID: 3371842430-19038427
Opcode ID: 6db1f8fb691788e378056bb90e31d350348864c0d9f17c84aef68217080703e6
Instruction ID: 2b1fb1f57453a0c907d18506aeba7fe9ddbe5d27e7e08eeaacd1fd65ca2ec3ca
Opcode Fuzzy Hash: 6db1f8fb691788e378056bb90e31d350348864c0d9f17c84aef68217080703e6
Instruction Fuzzy Hash: D7312A76A00A005FE780FB68FC59AAF73D8EF45625F480526F90AED205E731952886DB

Function 1E8C9DD0 Relevance: 35.1, APIs: 15, Strings: 5, Instructions: 118COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,OOO|H:LoadResource,?,?,?,?), ref: 1E8C9E00
?PyWinObject_AsHANDLE@@YAHPAU_object@@PAPAX@Z.PYWINTYPES27(?,?), ref: 1E8C9E1D
?PyWinObject_AsResourceIdA@@YAHPAU_object@@PAPADH@Z.PYWINTYPES27(?,?,00000000), ref: 1E8C9E3F
?PyWinObject_AsResourceIdA@@YAHPAU_object@@PAPADH@Z.PYWINTYPES27(?,?,00000000), ref: 1E8C9E57
FindResourceExA.KERNEL32(?,?,?,?), ref: 1E8C9E78
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(FindResourceEx,00000000), ref: 1E8C9E8A
?PyWinObject_FreeResourceId@@YAXPAD@Z.PYWINTYPES27(?), ref: 1E8C9F06
?PyWinObject_FreeResourceId@@YAXPAD@Z.PYWINTYPES27(?), ref: 1E8C9F0D

Strings

FindResourceEx, xrefs: 1E8C9E85
SizeofResource, xrefs: 1E8C9EA9
LockResource, xrefs: 1E8C9EE0
OOO|H:LoadResource, xrefs: 1E8C9DEE
LoadResource, xrefs: 1E8C9EC7

Memory Dump Source

Source File: 00000011.00000002.1562490344.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 00000011.00000002.1562469835.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562702731.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562730939.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Object_Resource$U_object@@$FreeId@@$Arg_Error@@FindParseTupleWin_
String ID: FindResourceEx$LoadResource$LockResource$OOO|H:LoadResource$SizeofResource
API String ID: 3720592045-4237740394
Opcode ID: ccdf75f54e6ebd645b8ea34059a997779c0bc2fe34197433e032d3ac8ab5ae6d
Instruction ID: 8909144d7fb4481530d47d56e535d535b342abd9dbd638d9673b933075a04785
Opcode Fuzzy Hash: ccdf75f54e6ebd645b8ea34059a997779c0bc2fe34197433e032d3ac8ab5ae6d
Instruction Fuzzy Hash: 81314DB1504251ABD300DFA9CDC8CEB77EDBA89245F088A5EF98DD3200E674D948CB72

Function 1E7A5F80 Relevance: 33.5, APIs: 12, Strings: 7, Instructions: 230COMMON

Download Yara Rule

APIs

PyErr_Format.PYTHON27(?,Unable to allocate %d bytes,00000014), ref: 1E7A5FD9
MakeAbsoluteSD.ADVAPI32(?,00000000,?,00000000,?,00000000,?,00000000,?,00000000,?), ref: 1E7A6014
73BB3B4E.MSVCR90(00000000), ref: 1E7A619B
73BB3B4E.MSVCR90(?), ref: 1E7A61B1
73BB3B4E.MSVCR90(?), ref: 1E7A61BF
73BB3B4E.MSVCR90(?), ref: 1E7A61CD
73BB3B4E.MSVCR90(?), ref: 1E7A61DB

Strings

Unable to allocate %d bytes, xrefs: 1E7A610F
Unable to allocate %d bytes, xrefs: 1E7A5FD3
Unable to allocate %d bytes, xrefs: 1E7A60ED
Unable to allocate %d bytes, xrefs: 1E7A6061
MakeAbsoluteSD, xrefs: 1E7A617D
Unable to allocate %d bytes, xrefs: 1E7A609F
Unable to allocate %d bytes, xrefs: 1E7A60C6

Memory Dump Source

Source File: 00000011.00000002.1561923280.000000001E7A1000.00000040.00000001.01000000.00000012.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000011.00000002.1561891626.000000001E7A0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7B9000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7BE000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562197228.000000001E7C0000.00000080.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562233172.000000001E7C2000.00000004.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e7a0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: AbsoluteErr_FormatMake
String ID: MakeAbsoluteSD$Unable to allocate %d bytes$Unable to allocate %d bytes$Unable to allocate %d bytes$Unable to allocate %d bytes$Unable to allocate %d bytes$Unable to allocate %d bytes
API String ID: 3618859740-2910537859
Opcode ID: 9f1ccbac9aa649bfaf89661b73884631742b8aa0e71684b551b4ee9d103b3ae8
Instruction ID: 872bd1fba5debf73104548c5245e2a0b25c68875dd35a8be78e1a6109cbc127a
Opcode Fuzzy Hash: 9f1ccbac9aa649bfaf89661b73884631742b8aa0e71684b551b4ee9d103b3ae8
Instruction Fuzzy Hash: 747160B1604254AFE204DF99EC80D9BB7E9EBC8604F484B2DF645D3251D771E948CFA2

Function 1E7A2940 Relevance: 33.5, APIs: 14, Strings: 5, Instructions: 203COMMON

Download Yara Rule

APIs

PyErr_Format.PYTHON27(?,AddAuditAccessObjectAce not supported by this version of Windows), ref: 1E7A296C
PyArg_ParseTuple.PYTHON27(?,lllOOOii:AddAuditAccessObjectAce,?,?,?,?,?,?,?,?), ref: 1E7A29AD

Strings

AddAuditAccessObjectAce, xrefs: 1E7A2A6C
AddAuditAccessObjectAce not supported by this version of Windows, xrefs: 1E7A2966
AddAuditAccessObjectAce, xrefs: 1E7A2B2A
lllOOOii:AddAuditAccessObjectAce, xrefs: 1E7A29A7
AddAuditAccessObjectAce: unable to allocated %d bytes, xrefs: 1E7A2AB3

Memory Dump Source

Source File: 00000011.00000002.1561923280.000000001E7A1000.00000040.00000001.01000000.00000012.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000011.00000002.1561891626.000000001E7A0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7B9000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7BE000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562197228.000000001E7C0000.00000080.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562233172.000000001E7C2000.00000004.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e7a0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_Err_FormatParseTuple
String ID: AddAuditAccessObjectAce$AddAuditAccessObjectAce$AddAuditAccessObjectAce not supported by this version of Windows$AddAuditAccessObjectAce: unable to allocated %d bytes$lllOOOii:AddAuditAccessObjectAce
API String ID: 361908667-1791919988
Opcode ID: 21f88ae7c74250cbb5cbe4dd3749c28d02e1c4c4f44ffba07d24f2c9bcde9558
Instruction ID: 15dbd50618c8256c558199eb2124cceb3b3ad284fe9d8ae152a7e8a5ecd6b54a
Opcode Fuzzy Hash: 21f88ae7c74250cbb5cbe4dd3749c28d02e1c4c4f44ffba07d24f2c9bcde9558
Instruction Fuzzy Hash: C5513AB6504250AFE304DB58DC95DABB3EDAFC8655F484B1DFA8582220E731E905CBA2

Function 1E7D21A0 Relevance: 33.4, APIs: 16, Strings: 3, Instructions: 171COMMON

Download Yara Rule

APIs

SetServiceStatus.ADVAPI32(?,1E7D6228), ref: 1E7D21D6
PyGILState_Ensure.PYTHON27 ref: 1E7D21F4
Py_BuildValue.PYTHON27((llN),?,?,6D18CB15), ref: 1E7D2243
Py_BuildValue.PYTHON27((i),?), ref: 1E7D225C
Py_BuildValue.PYTHON27((llN),?,?,00000000), ref: 1E7D2269
PyObject_CallObject.PYTHON27(?,00000000), ref: 1E7D22F3
PyInt_AsUnsignedLongMask.PYTHON27(00000000), ref: 1E7D2333
PyErr_Occurred.PYTHON27 ref: 1E7D2343
PyGILState_Release.PYTHON27(?), ref: 1E7D2375

Strings

(llN), xrefs: 1E7D223E, 1E7D2264, 1E7D22A8, 1E7D22C7
(l), xrefs: 1E7D22DA
(i), xrefs: 1E7D2257

Memory Dump Source

Source File: 00000011.00000002.1562321143.000000001E7D1000.00000040.00000001.01000000.00000015.sdmp, Offset: 1E7D0000, based on PE: true

Associated: 00000011.00000002.1562293036.000000001E7D0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000011.00000002.1562321143.000000001E7DA000.00000040.00000001.01000000.00000015.sdmpDownload File
Associated: 00000011.00000002.1562391495.000000001E7DB000.00000080.00000001.01000000.00000015.sdmpDownload File
Associated: 00000011.00000002.1562417397.000000001E7DD000.00000004.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e7d0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: BuildValue$State_$CallEnsureErr_Int_LongMaskObjectObject_OccurredReleaseServiceStatusUnsigned
String ID: (i)$(l)$(llN)
API String ID: 353108861-2099564678
Opcode ID: c22da60e3abb207b7781e4e564e769513ff537d039e32d990128fd4e91b29f88
Instruction ID: 472300e13a080c01584ac1e1882b629ff7e6bc43829210bdd771ab312945060e
Opcode Fuzzy Hash: c22da60e3abb207b7781e4e564e769513ff537d039e32d990128fd4e91b29f88
Instruction Fuzzy Hash: F451F971900351ABF2009B58DC849AB77ACFB89734F064719F89593760E736A81ACFA2

Function 1E7A2C30 Relevance: 33.4, APIs: 14, Strings: 5, Instructions: 145COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,l:GetAce), ref: 1E7A2C41
GetAce.ADVAPI32(?,?,?), ref: 1E7A2C63
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(GetAce,00000000), ref: 1E7A2C73

Strings

(ll)lNNN, xrefs: 1E7A2D78
l:GetAce, xrefs: 1E7A2C3B
GetAce, xrefs: 1E7A2C6E
Ace type %d is not supported yet, xrefs: 1E7A2D97
(ll)lN, xrefs: 1E7A2CB8

Memory Dump Source

Source File: 00000011.00000002.1561923280.000000001E7A1000.00000040.00000001.01000000.00000012.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000011.00000002.1561891626.000000001E7A0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7B9000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7BE000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562197228.000000001E7C0000.00000080.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562233172.000000001E7C2000.00000004.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e7a0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_Error@@ParseTupleU_object@@Win_
String ID: (ll)lN$(ll)lNNN$Ace type %d is not supported yet$GetAce$l:GetAce
API String ID: 1264128360-3095649356
Opcode ID: 3eb159a42316d6eeb1a5856a51d8252658cac453ee5293fc8bdfd4c0dc0cfbf5
Instruction ID: 8e5186c6508ec32f3a5701dd15e8e7db4c433007b123aa95ecd302705a0dcd88
Opcode Fuzzy Hash: 3eb159a42316d6eeb1a5856a51d8252658cac453ee5293fc8bdfd4c0dc0cfbf5
Instruction Fuzzy Hash: D741C6B95042A5AFE300DB64DC84CA777EDAFC8514B4C8B69EB8683221F775E504CBA1

Function 1E8C2EC0 Relevance: 33.3, APIs: 14, Strings: 5, Instructions: 99threadCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,:GetDomainName), ref: 1E8C2ED0
GetCurrentThread.KERNEL32 ref: 1E8C2EF4
OpenThreadToken.ADVAPI32(00000000), ref: 1E8C2EFB
GetLastError.KERNEL32 ref: 1E8C2F05
GetCurrentProcess.KERNEL32(00000008), ref: 1E8C2F18
OpenProcessToken.ADVAPI32(00000000), ref: 1E8C2F1F
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(OpenProcessToken,00000000), ref: 1E8C2F2F

Strings

LookupAccountSid, xrefs: 1E8C2FDD
:GetDomainName, xrefs: 1E8C2ECA
OpenThreadToken, xrefs: 1E8C2F41
GetTokenInformation, xrefs: 1E8C2F8A
OpenProcessToken, xrefs: 1E8C2F2A

Memory Dump Source

Source File: 00000011.00000002.1562490344.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 00000011.00000002.1562469835.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562702731.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562730939.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: CurrentOpenProcessThreadToken$Arg_ErrorError@@LastParseTupleU_object@@Win_
String ID: :GetDomainName$GetTokenInformation$LookupAccountSid$OpenProcessToken$OpenThreadToken
API String ID: 523223422-430469702
Opcode ID: c786ee46c3823ce1ecae8b8924c1ad02153a4b773f7e1407ca050f1d828ea19b
Instruction ID: cec89cd6ca320d9d74611b11b2082b91bc7462ed5c4f7b20a2c515c98e8d94b3
Opcode Fuzzy Hash: c786ee46c3823ce1ecae8b8924c1ad02153a4b773f7e1407ca050f1d828ea19b
Instruction Fuzzy Hash: 5B31A4F15143116BF720CB54DC8DBDA76E8BB86B05F448928F65DC3280E734C5888B76

Function 03415390 Relevance: 31.7, APIs: 15, Strings: 3, Instructions: 234COMMON

Download Yara Rule

APIs

PyDict_New.PYTHON27 ref: 0341539D
PyErr_NoMemory.PYTHON27 ref: 034153E9
73BB3B4E.MSVCR90(?), ref: 03415620
73BB3B4E.MSVCR90(00000000), ref: 0341562E

Strings

(Oikk), xrefs: 03415530
%wS, xrefs: 03415484
GetIfTable() syscall failed, xrefs: 0341544C

Memory Dump Source

Source File: 00000011.00000002.1560676867.0000000003411000.00000040.00000001.01000000.0000000F.sdmp, Offset: 03410000, based on PE: true

Associated: 00000011.00000002.1560637646.0000000003410000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560676867.000000000341B000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560676867.000000000341F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560836323.0000000003423000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_3410000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Dict_Err_Memory
String ID: %wS$(Oikk)$GetIfTable() syscall failed
API String ID: 197259469-3214263222
Opcode ID: 73f890e369035b7aab592271060536c10dd10cf66f5202aef36c020317980417
Instruction ID: 787e22cf14bc5f204a9497632d7f3c225ef1ee7b1a3485d49eddabef83ecd3a3
Opcode Fuzzy Hash: 73f890e369035b7aab592271060536c10dd10cf66f5202aef36c020317980417
Instruction Fuzzy Hash: C2810471500B018FC750DF54D880AABB3E8EBC5720F080AAAE9599F349D734E911CBDA

Function 1E8C63F0 Relevance: 31.7, APIs: 14, Strings: 4, Instructions: 172COMMON

Download Yara Rule

APIs

PyArg_ParseTupleAndKeywords.PYTHON27(?,?,OOk|OkOO:RegCreateKeyEx,1E8D7024,?,?,?,?,?,?,?), ref: 1E8C644A
?PyWinObject_AsHANDLE@@YAHPAU_object@@PAPAX@Z.PYWINTYPES27(?,?), ref: 1E8C6468
PyErr_Format.PYTHON27(00000000,%s is not available on this platform,RegCreateKeyTransacted), ref: 1E8C6496

Strings

%s is not available on this platform, xrefs: 1E8C6490
RegCreateKeyTransacted, xrefs: 1E8C648B
RegCreateKeyEx, xrefs: 1E8C6586
OOk|OkOO:RegCreateKeyEx, xrefs: 1E8C6435

Memory Dump Source

Source File: 00000011.00000002.1562490344.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 00000011.00000002.1562469835.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562702731.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562730939.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_Err_FormatKeywordsObject_ParseTupleU_object@@
String ID: %s is not available on this platform$OOk|OkOO:RegCreateKeyEx$RegCreateKeyEx$RegCreateKeyTransacted
API String ID: 1905867990-921574732
Opcode ID: 5270a35b58e3dfdc766ef352397476d1cefe16119fd617b17e9e7bee3b439746
Instruction ID: 350c97792ece29acdeb826aa7db6dddbb9f173b162a6ed54a0a1d9faa4857387
Opcode Fuzzy Hash: 5270a35b58e3dfdc766ef352397476d1cefe16119fd617b17e9e7bee3b439746
Instruction Fuzzy Hash: 995107B2518341AFD304CB58CD94DABB7E9FFC9608F144A1DF589C3240E631E949CBA2

Function 1E7A8810 Relevance: 31.7, APIs: 15, Strings: 3, Instructions: 171COMMON

Download Yara Rule

APIs

PyObject_GetAttrString.PYTHON27(?,timetuple,?,?,?,?,?,?,1E7A8A37), ref: 1E7A8837
PyErr_Clear.PYTHON27(?,?,?,?,1E7A8A37), ref: 1E7A8846
PyNumber_Check.PYTHON27(00000000,?,?,?,?,?,?,?,1E7A8A37), ref: 1E7A8880
PyInt_AsLong.PYTHON27(00000000,?,?,?,?,?,?,?,?,1E7A8A37), ref: 1E7A888E
PyErr_Occurred.PYTHON27(?,?,?,?,?,?,?,?,?,1E7A8A37), ref: 1E7A889C
PyErr_BadArgument.PYTHON27(?,?,?,?,?,?,?,?,?,1E7A8A37), ref: 1E7A88AA

Strings

time tuple must have at least 6 elements, xrefs: 1E7A8906
Objects of type '%s' can not be used as a time object, xrefs: 1E7A89D4
timetuple, xrefs: 1E7A882D

Memory Dump Source

Source File: 00000011.00000002.1561923280.000000001E7A1000.00000040.00000001.01000000.00000012.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000011.00000002.1561891626.000000001E7A0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7B9000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7BE000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562197228.000000001E7C0000.00000080.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562233172.000000001E7C2000.00000004.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e7a0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Err_$ArgumentAttrCheckClearInt_LongNumber_Object_OccurredString
String ID: Objects of type '%s' can not be used as a time object$time tuple must have at least 6 elements$timetuple
API String ID: 3803439046-1685405869
Opcode ID: 6b5c8684bcb05c7ee9f31d8556bd1791dcc5b9eeff401f92c14b4c26a90ca583
Instruction ID: a7102e858c545e6d1e95597bce98bd757d31f6199c33cd5f112e356a1a143e01
Opcode Fuzzy Hash: 6b5c8684bcb05c7ee9f31d8556bd1791dcc5b9eeff401f92c14b4c26a90ca583
Instruction Fuzzy Hash: EF51E475A102519BF7009F68AC8C65FB369AFC4224F0C0B29EA15C7365EB35D905CBD7

Function 1E8C4D70 Relevance: 31.6, APIs: 14, Strings: 4, Instructions: 127COMMON

Download Yara Rule

APIs

PyErr_Format.PYTHON27(?,%s is not available on this platform,GetLongPathNameW), ref: 1E8C4D91
PyArg_ParseTuple.PYTHON27(?,O:GetLongPathNameW,?), ref: 1E8C4DB6
?PyWinObject_AsWCHAR@@YAHPAU_object@@PAPA_WHPAK@Z.PYWINTYPES27(?,?,00000000,00000000), ref: 1E8C4DCF

Strings

O:GetLongPathNameW, xrefs: 1E8C4DAE
GetLongPathNameW, xrefs: 1E8C4D86
GetLongPathNameW, xrefs: 1E8C4EB0
%s is not available on this platform, xrefs: 1E8C4D8B

Memory Dump Source

Source File: 00000011.00000002.1562490344.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 00000011.00000002.1562469835.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562702731.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562730939.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_Err_FormatObject_ParseTupleU_object@@
String ID: %s is not available on this platform$GetLongPathNameW$GetLongPathNameW$O:GetLongPathNameW
API String ID: 3520361810-999288016
Opcode ID: 6bccab308cc14544dc1475ab989cee1e4cd93be6a2a162d1a257fbd13561d60e
Instruction ID: 796143202428d10c09289d72c96e463178e7843b961ae6ee41ac2552e725eccc
Opcode Fuzzy Hash: 6bccab308cc14544dc1475ab989cee1e4cd93be6a2a162d1a257fbd13561d60e
Instruction Fuzzy Hash: 2A31C3B25002156FE310DBA8ECC89EBB3A5FFC5325F454A28F919C3250EB35E599C792

Function 034124C0 Relevance: 29.9, APIs: 13, Strings: 4, Instructions: 197threadCOMMON

Download Yara Rule

APIs

PyList_New.PYTHON27(00000000), ref: 034124F4
PyArg_ParseTuple.PYTHON27(?,0341B458,?), ref: 03412515
CloseHandle.KERNEL32(?), ref: 0341258E
CloseHandle.KERNEL32(?), ref: 0341259D
Thread32First.KERNEL32 ref: 034125BA

Part of subcall function 034110D0: PyObject_CallFunction.PYTHON27(?,(is),0000000D,00000000,0341D7E0), ref: 0341110A
Part of subcall function 034110D0: PyErr_SetObject.PYTHON27(00000000,00000000,?,(is),0000000D,00000000,0341D7E0), ref: 0341111C

Strings

GetThreadTimes, xrefs: 034126EF
Thread32First, xrefs: 034125C3
kdd, xrefs: 03412689
CreateToolhelp32Snapshot, xrefs: 03412567

Memory Dump Source

Source File: 00000011.00000002.1560676867.0000000003411000.00000040.00000001.01000000.0000000F.sdmp, Offset: 03410000, based on PE: true

Associated: 00000011.00000002.1560637646.0000000003410000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560676867.000000000341B000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560676867.000000000341F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560836323.0000000003423000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_3410000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: CloseHandle$Arg_CallErr_FirstFunctionList_ObjectObject_ParseThread32Tuple
String ID: CreateToolhelp32Snapshot$GetThreadTimes$Thread32First$kdd
API String ID: 3534724291-1357220548
Opcode ID: ab92f03a3267dfd36da62a3f13d82bd63e673e01a82093d255337a32b6ffc147
Instruction ID: 44281e3d07acea457702dffb4a2afa5f80f2a7792d1bcaf29b38c7b99d1d51c5
Opcode Fuzzy Hash: ab92f03a3267dfd36da62a3f13d82bd63e673e01a82093d255337a32b6ffc147
Instruction Fuzzy Hash: 9F614671A04F009FD350EB65D85466BB7E8EB89710F144E1EF954DA344E7B0D821CBDA

Function 1E8C51B0 Relevance: 29.9, APIs: 13, Strings: 4, Instructions: 170COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,(iOOiOOi):SetTimeZoneInformation,?,?,?,?,?,?,?), ref: 1E8C51E9
?PyWinObject_AsWCHAR@@YAHPAU_object@@PAPA_WHPAK@Z.PYWINTYPES27(?,00000000,00000000,00000000), ref: 1E8C5212

Strings

Time zone names must be < 32 chars long, xrefs: 1E8C52CF
Time zone names must be < 32 chars long, xrefs: 1E8C5253
SetTimeZoneInformation, xrefs: 1E8C5361
(iOOiOOi):SetTimeZoneInformation, xrefs: 1E8C51E3

Memory Dump Source

Source File: 00000011.00000002.1562490344.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 00000011.00000002.1562469835.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562702731.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562730939.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_Object_ParseTupleU_object@@
String ID: (iOOiOOi):SetTimeZoneInformation$SetTimeZoneInformation$Time zone names must be < 32 chars long$Time zone names must be < 32 chars long
API String ID: 71531768-1674137198
Opcode ID: b6a2a68e8cb20b9b3e9ff0aa10af51562eb87591f3cc8888342cad2f150d5dfd
Instruction ID: 3d1c8bb9f6ab3507ad6e95e30ea568b8388f9c47f1938b10207c314bdb640152
Opcode Fuzzy Hash: b6a2a68e8cb20b9b3e9ff0aa10af51562eb87591f3cc8888342cad2f150d5dfd
Instruction Fuzzy Hash: 3A51B376500212AFE7009B68DC85FDB73E9EFC9350F444A19FD49C7250E638E64ACBA1

Function 1E7A2790 Relevance: 29.9, APIs: 12, Strings: 5, Instructions: 162COMMON

Download Yara Rule

APIs

PyErr_Format.PYTHON27(?,AddAuditAccessAceEx not supported by this version of Windows), ref: 1E7A27B2
PyArg_ParseTuple.PYTHON27(?,lllOii:AddAuditAccessAceEx,?,?,?,?,?,?), ref: 1E7A27E8

Strings

AddAuditAccessAceEx, xrefs: 1E7A2906
AddAuditAccessAceEx: unable to allocated %d bytes, xrefs: 1E7A2899
AddAuditAccessAceEx, xrefs: 1E7A2852
AddAuditAccessAceEx not supported by this version of Windows, xrefs: 1E7A27AC
lllOii:AddAuditAccessAceEx, xrefs: 1E7A27E2

Memory Dump Source

Source File: 00000011.00000002.1561923280.000000001E7A1000.00000040.00000001.01000000.00000012.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000011.00000002.1561891626.000000001E7A0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7B9000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7BE000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562197228.000000001E7C0000.00000080.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562233172.000000001E7C2000.00000004.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e7a0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_Err_FormatParseTuple
String ID: AddAuditAccessAceEx$AddAuditAccessAceEx$AddAuditAccessAceEx not supported by this version of Windows$AddAuditAccessAceEx: unable to allocated %d bytes$lllOii:AddAuditAccessAceEx
API String ID: 361908667-1218672124
Opcode ID: 4f62646f4e95f1a3952be76998af2c15969b37605dc3e002b4711e8f296c3bed
Instruction ID: b79f4ae6a07f63d5b2327b5eb58c32ca723c03ca4d522f823c49ec7e8341b20d
Opcode Fuzzy Hash: 4f62646f4e95f1a3952be76998af2c15969b37605dc3e002b4711e8f296c3bed
Instruction Fuzzy Hash: 6B416876604251AFE200DB58DC85DBBB3ADEFC8619F484B1DF74583220E731E905CBA2

Function 1E8C1B60 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,1E8CE3D2), ref: 1E8C1BA1
?PyWinObject_FreeWCHAR@@YAXPA_W@Z.PYWINTYPES27(?,?,?), ref: 1E8C1BBD
?PyWinObject_FreeWCHAR@@YAXPA_W@Z.PYWINTYPES27 ref: 1E8C1BCC
?PyWinObject_AsWCHAR@@YAHPAU_object@@PAPA_WHPAK@Z.PYWINTYPES27(?,?,00000000,00000000,?,?), ref: 1E8C1BF6
?PyWinObject_FreeWCHAR@@YAXPA_W@Z.PYWINTYPES27(?), ref: 1E8C1C0E
?PyWinObject_FreeWCHAR@@YAXPA_W@Z.PYWINTYPES27 ref: 1E8C1C1D

Strings

SetEnvironmentVariableW, xrefs: 1E8C1C97
OO:SetEnvironmentVariableW, xrefs: 1E8C1B96

Memory Dump Source

Source File: 00000011.00000002.1562490344.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 00000011.00000002.1562469835.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562702731.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562730939.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Object_$Free$Arg_ParseTupleU_object@@
String ID: OO:SetEnvironmentVariableW$SetEnvironmentVariableW
API String ID: 3146972167-2010370912
Opcode ID: 7e55d165c8177a914faf9a89ee4a05ea3789db3809a21190d99602bf33380086
Instruction ID: cade0de36ecd0d172a5f72f8b1b52bda8f81e84c357b456cfea51791bdfbbf6f
Opcode Fuzzy Hash: 7e55d165c8177a914faf9a89ee4a05ea3789db3809a21190d99602bf33380086
Instruction Fuzzy Hash: 64514E72518351AFD300DF6CCD80A9BB7E8FB89624F444A5DF9A8D3390D734D9458B62

Function 1E8C73C0 Relevance: 29.9, APIs: 13, Strings: 4, Instructions: 146registrythreadCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,Oi:PyRegEnumValue,?,?), ref: 1E8C73DA
?PyWinObject_AsHKEY@@YAHPAU_object@@PAPAUHKEY__@@@Z.PYWINTYPES27(?,?), ref: 1E8C73F3
RegQueryInfoKeyA.ADVAPI32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000000,00000000), ref: 1E8C7422
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(RegQueryInfoKey,00000000), ref: 1E8C7432
__alloca_probe_16.LIBCMT ref: 1E8C7453
__alloca_probe_16.LIBCMT ref: 1E8C745C
PyEval_SaveThread.PYTHON27 ref: 1E8C7473
RegEnumValueA.ADVAPI32(?,?,?,?,00000000,?,?,?), ref: 1E8C7494
PyEval_RestoreThread.PYTHON27(?,?,?,00000000,?,?,?), ref: 1E8C74A0
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(PyRegEnumValue,00000000,?), ref: 1E8C74B3

Strings

RegQueryInfoKey, xrefs: 1E8C742D
NOi, xrefs: 1E8C74EB
PyRegEnumValue, xrefs: 1E8C74AE
Oi:PyRegEnumValue, xrefs: 1E8C73D4

Memory Dump Source

Source File: 00000011.00000002.1562490344.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 00000011.00000002.1562469835.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562702731.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562730939.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: U_object@@$Error@@Eval_ThreadWin___alloca_probe_16$Arg_EnumInfoObject_ParseQueryRestoreSaveTupleValueY__@@@
String ID: NOi$Oi:PyRegEnumValue$PyRegEnumValue$RegQueryInfoKey
API String ID: 1596361088-4198447784
Opcode ID: 003ba76e537e111e5478a75f3bc3de86e6704c1d2df93d58009ce453d705e44e
Instruction ID: 58a4952741fde5f485a66da1bcfa748129611d6944648a5e2366bd2a31f829d1
Opcode Fuzzy Hash: 003ba76e537e111e5478a75f3bc3de86e6704c1d2df93d58009ce453d705e44e
Instruction Fuzzy Hash: 5E41D876E00118AFDB10DBE8DD859EEB7B9EF49221F004255E909E3240DB31DA55C7E1

Function 1E8C8C30 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 141threadCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,OOOOOi:ShellExecute,?,?,?,?,?,?), ref: 1E8C8C76
?PyWinObject_AsHANDLE@@YAHPAU_object@@PAPAX@Z.PYWINTYPES27(?,?), ref: 1E8C8C94
?PyWinObject_AsString@@YAHPAU_object@@PAPADHPAK@Z.PYWINTYPES27(?,?,00000001,00000000), ref: 1E8C8CB8
?PyWinObject_AsString@@YAHPAU_object@@PAPADHPAK@Z.PYWINTYPES27(?,?,00000000,00000000), ref: 1E8C8CD1
?PyWinObject_AsString@@YAHPAU_object@@PAPADHPAK@Z.PYWINTYPES27(?,?,00000001,00000000), ref: 1E8C8CEB
?PyWinObject_AsString@@YAHPAU_object@@PAPADHPAK@Z.PYWINTYPES27(?,?,00000001,00000000), ref: 1E8C8D05
PyEval_SaveThread.PYTHON27 ref: 1E8C8D1F
ShellExecuteA.SHELL32(?,?,?,?,?,?), ref: 1E8C8D45
PyEval_RestoreThread.PYTHON27(00000000), ref: 1E8C8D4E
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(ShellExecute,00000000), ref: 1E8C8D63
?PyWinObject_FreeString@@YAXPAD@Z.PYWINTYPES27(?), ref: 1E8C8D86
?PyWinObject_FreeString@@YAXPAD@Z.PYWINTYPES27(?), ref: 1E8C8D8D
?PyWinObject_FreeString@@YAXPAD@Z.PYWINTYPES27(?), ref: 1E8C8D94
?PyWinObject_FreeString@@YAXPAD@Z.PYWINTYPES27(?), ref: 1E8C8DA2

Strings

OOOOOi:ShellExecute, xrefs: 1E8C8C59
ShellExecute, xrefs: 1E8C8D5E

Memory Dump Source

Source File: 00000011.00000002.1562490344.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 00000011.00000002.1562469835.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562702731.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562730939.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Object_$String@@$U_object@@$Free$Eval_Thread$Arg_Error@@ExecuteParseRestoreSaveShellTupleWin_
String ID: OOOOOi:ShellExecute$ShellExecute
API String ID: 86544676-3224373903
Opcode ID: 5b5daf74092e52be2527da0e2e33d70288ec19bd96e034f1b12261fe1ba315cd
Instruction ID: c58441b899affe96471c5f85c3054cfa6bb5bf819111beb0179f2eb3a17248c1
Opcode Fuzzy Hash: 5b5daf74092e52be2527da0e2e33d70288ec19bd96e034f1b12261fe1ba315cd
Instruction Fuzzy Hash: 2F416CB2514341AFD300DB69CC84DABB7E9FFC9214F448A1DFA99C3244E631E549CBA2

Function 1E8C6690 Relevance: 29.9, APIs: 11, Strings: 6, Instructions: 125COMMON

Download Yara Rule

APIs

PyArg_ParseTupleAndKeywords.PYTHON27(?,?,OO|kO:RegDeleteKeyEx,1E8D7044,?,?,?,?), ref: 1E8C66CF
?PyWinObject_AsHANDLE@@YAHPAU_object@@PAPAX@Z.PYWINTYPES27(?,?), ref: 1E8C66ED
PyErr_Format.PYTHON27(?,%s is not available on this platform,RegDeleteKeyTransacted), ref: 1E8C671A

Strings

%s is not available on this platform, xrefs: 1E8C673D
RegDeleteKeyEx, xrefs: 1E8C67B5
RegDeleteKeyEx, xrefs: 1E8C6738
RegDeleteKeyTransacted, xrefs: 1E8C670F
%s is not available on this platform, xrefs: 1E8C6714
OO|kO:RegDeleteKeyEx, xrefs: 1E8C66BE

Memory Dump Source

Source File: 00000011.00000002.1562490344.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 00000011.00000002.1562469835.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562702731.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562730939.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_Err_FormatKeywordsObject_ParseTupleU_object@@
String ID: %s is not available on this platform$%s is not available on this platform$OO|kO:RegDeleteKeyEx$RegDeleteKeyEx$RegDeleteKeyEx$RegDeleteKeyTransacted
API String ID: 1905867990-810132254
Opcode ID: 5f4f6a968b40c5003cac1cbd05ac4c847c841ee097f59cd0a6561d95e283f1e6
Instruction ID: 5b23a5a42907900050b26b9de9b4be83742e10d6a063a3e6f0ea04af8024e34c
Opcode Fuzzy Hash: 5f4f6a968b40c5003cac1cbd05ac4c847c841ee097f59cd0a6561d95e283f1e6
Instruction Fuzzy Hash: 354121B5514211AFD210DF68CC88DAB77E9FF85649F408A19F94DC3210E631E959CBA2

Function 1E8C8680 Relevance: 29.9, APIs: 14, Strings: 3, Instructions: 110threadregistryCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,Ol:RegGetKeySecurity,?,?), ref: 1E8C8697
?PyWinObject_AsHKEY@@YAHPAU_object@@PAPAUHKEY__@@@Z.PYWINTYPES27(?,?), ref: 1E8C86B4
PyEval_SaveThread.PYTHON27 ref: 1E8C86D3
RegGetKeySecurity.ADVAPI32(?,?,00000000,00000000), ref: 1E8C86EE
PyEval_RestoreThread.PYTHON27(00000000), ref: 1E8C86F3
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(RegGetKeySecurity,00000000), ref: 1E8C8707

Strings

Ol:RegGetKeySecurity, xrefs: 1E8C8691
RegGetKeySecurity, xrefs: 1E8C8702
RegGetKeySecurity, xrefs: 1E8C8768

Memory Dump Source

Source File: 00000011.00000002.1562490344.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 00000011.00000002.1562469835.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562702731.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562730939.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Eval_ThreadU_object@@$Arg_Error@@Object_ParseRestoreSaveSecurityTupleWin_Y__@@@
String ID: Ol:RegGetKeySecurity$RegGetKeySecurity$RegGetKeySecurity
API String ID: 2929093490-397777079
Opcode ID: 634486cad53a4ed39618046cf6e52d7fd3a9805e2214d1dc1cfd6f4a22d8a303
Instruction ID: 93198accc984056b6e02dea87ec784334bf7f08e1d990d9dbda758d68c62ddaa
Opcode Fuzzy Hash: 634486cad53a4ed39618046cf6e52d7fd3a9805e2214d1dc1cfd6f4a22d8a303
Instruction Fuzzy Hash: 3531D7766002216FD300DBA9DC8D9EBB7E8FFC6265F440929FD09C3211E739E55986B2

Function 1E8C1E00 Relevance: 29.9, APIs: 13, Strings: 4, Instructions: 109threadCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27 ref: 1E8C1E44
?PyWinObject_AsString@@YAHPAU_object@@PAPADHPAK@Z.PYWINTYPES27(?,?,00000000,00000000,?,O|O:FindExecutable,?,?), ref: 1E8C1E6E
?PyWinObject_AsString@@YAHPAU_object@@PAPADHPAK@Z.PYWINTYPES27(?,?,00000001,00000000), ref: 1E8C1E89
PyEval_SaveThread.PYTHON27 ref: 1E8C1EA8
FindExecutableA.SHELL32(?,?,?), ref: 1E8C1EBF
PyEval_RestoreThread.PYTHON27(00000000), ref: 1E8C1EC8
PyErr_SetString.PYTHON27(00000000,FindExecutable: There is no association for the file), ref: 1E8C1EEA
?PyWinObject_FreeString@@YAXPAD@Z.PYWINTYPES27(?), ref: 1E8C1F3F
?PyWinObject_FreeString@@YAXPAD@Z.PYWINTYPES27(?), ref: 1E8C1F4D

Strings

(NN), xrefs: 1E8C1F22
FindExecutable, xrefs: 1E8C1EF6
O|O:FindExecutable, xrefs: 1E8C1E21
FindExecutable: There is no association for the file, xrefs: 1E8C1EE4

Memory Dump Source

Source File: 00000011.00000002.1562490344.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 00000011.00000002.1562469835.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562702731.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562730939.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Object_String@@$Eval_FreeThreadU_object@@$Arg_Err_ExecutableFindParseRestoreSaveStringTuple
String ID: (NN)$FindExecutable$FindExecutable: There is no association for the file$O|O:FindExecutable
API String ID: 3782625144-2336032024
Opcode ID: 7e57adeedc3c4d787cec3261d8fe7b5010847584e04a6b2b0c2a6c656835cdf7
Instruction ID: 00dead42f69c419d153b98a266a1f6c5c4d20c5b169ad28c58b669a4f56ed8f6
Opcode Fuzzy Hash: 7e57adeedc3c4d787cec3261d8fe7b5010847584e04a6b2b0c2a6c656835cdf7
Instruction Fuzzy Hash: 4D315171514311AFE310DF64DCC9BDB77E8EF8A214F404519FA9993280E735D589CBA2

Function 1E8C2B20 Relevance: 29.8, APIs: 12, Strings: 5, Instructions: 99COMMON

Download Yara Rule

APIs

PyErr_Format.PYTHON27(?,%s is not available on this platform,GetComputerNameEx), ref: 1E8C2B40
PyArg_ParseTuple.PYTHON27(?,i:GetComputerNameEx,?), ref: 1E8C2B61

Strings

%s is not available on this platform, xrefs: 1E8C2B3A
GetComputerNameEx, xrefs: 1E8C2B35
i:GetComputerNameEx, xrefs: 1E8C2B57
GetComputerNameExW, xrefs: 1E8C2B8D
GetComputerNameEx, xrefs: 1E8C2BED

Memory Dump Source

Source File: 00000011.00000002.1562490344.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 00000011.00000002.1562469835.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562702731.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562730939.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_Err_FormatParseTuple
String ID: %s is not available on this platform$GetComputerNameEx$GetComputerNameEx$GetComputerNameExW$i:GetComputerNameEx
API String ID: 361908667-1141911926
Opcode ID: e1192246da95919d947fb106ae5e610f31ae641fdfeb7b905632769c24848e49
Instruction ID: ad189e1f1af9a46008e41d87ec65636e06700883792d5e3c3dcdb4365da9761c
Opcode Fuzzy Hash: e1192246da95919d947fb106ae5e610f31ae641fdfeb7b905632769c24848e49
Instruction Fuzzy Hash: 4421A575500115AFD600AF64EC8DCEA77E8EB82616F444529FD0EC3300E736E69DC6A6

Function 1E8CCA70 Relevance: 29.8, APIs: 7, Strings: 10, Instructions: 76COMMON

Download Yara Rule

APIs

PyErr_Format.PYTHON27(?,%s is not available on this platform,GetMonitorInfo), ref: 1E8CCA8E
PyArg_ParseTupleAndKeywords.PYTHON27(?,?,O:GetMonitorInfo,1E8D7F9C), ref: 1E8CCAB3
?PyWinObject_AsHANDLE@@YAHPAU_object@@PAPAX@Z.PYWINTYPES27(00000000,?), ref: 1E8CCAC9
GetMonitorInfoA.USER32 ref: 1E8CCAF9
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(GetMonitorInfo,00000000), ref: 1E8CCB09

Strings

{s:O&,s:O&,s:k,s:N}, xrefs: 1E8CCB50
Monitor, xrefs: 1E8CCB4B
%s is not available on this platform, xrefs: 1E8CCA88
Flags, xrefs: 1E8CCB30
Device, xrefs: 1E8CCB2A
Work, xrefs: 1E8CCB40
O:GetMonitorInfo, xrefs: 1E8CCAAC
GetMonitorInfo, xrefs: 1E8CCB04
GetMonitorInfo, xrefs: 1E8CCA83
H, xrefs: 1E8CCAF1

Memory Dump Source

Source File: 00000011.00000002.1562490344.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 00000011.00000002.1562469835.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562702731.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562730939.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: U_object@@$Arg_Err_Error@@FormatInfoKeywordsMonitorObject_ParseTupleWin_
String ID: %s is not available on this platform$Device$Flags$GetMonitorInfo$GetMonitorInfo$H$Monitor$O:GetMonitorInfo$Work${s:O&,s:O&,s:k,s:N}
API String ID: 971695816-1907508076
Opcode ID: ada97584b9a4851728e03fbebe617f7d3ebc0dd1425393cc3e42e59f6f4775e9
Instruction ID: 5446124e3c06822213fce2dc56840008d908c8d2a0ee33fde4ac4ca0c6f31229
Opcode Fuzzy Hash: ada97584b9a4851728e03fbebe617f7d3ebc0dd1425393cc3e42e59f6f4775e9
Instruction Fuzzy Hash: C22179B0114345BFE700EBA8CD89EAA73F9BB84605F404A08F949C3380E735E918CB66

Function 03414F90 Relevance: 28.3, APIs: 12, Strings: 4, Instructions: 330COMMON

Download Yara Rule

APIs

PyList_New.PYTHON27(00000000), ref: 03414F9C

Part of subcall function 03411200: GetAdaptersAddresses.IPHLPAPI(00000000,00000000,00000000,00000000,?), ref: 0341123C
Part of subcall function 03411200: 73BB3B4E.MSVCR90(00000000), ref: 03411247
Part of subcall function 03411200: PyErr_SetString.PYTHON27(00000000,GetAdaptersAddresses() syscall failed.), ref: 03411274

PyUnicodeUCS2_FromWideChar.PYTHON27(?,?), ref: 03415011
Py_BuildValue.PYTHON27(0341B840,00000000), ref: 0341509B
Py_BuildValue.PYTHON27((OiOOOO),00000000,000000FF,00000000,6D18CB14,6D18CB14,6D18CB14), ref: 034150D0
PyList_Append.PYTHON27(?,00000000), ref: 034150E5

Strings

%.2X-, xrefs: 03415064
(OiOOOO), xrefs: 03415229
%.2X, xrefs: 03415057
(OiOOOO), xrefs: 034150CB

Memory Dump Source

Source File: 00000011.00000002.1560676867.0000000003411000.00000040.00000001.01000000.0000000F.sdmp, Offset: 03410000, based on PE: true

Associated: 00000011.00000002.1560637646.0000000003410000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560676867.000000000341B000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560676867.000000000341F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560836323.0000000003423000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_3410000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: BuildList_Value$AdaptersAddressesAppendCharErr_FromStringUnicodeWide
String ID: %.2X$%.2X-$(OiOOOO)$(OiOOOO)
API String ID: 3530921289-1333837927
Opcode ID: ee2a45bf32f962551588385e9863078a8faed26700686c97536f1ce5dea5ceca
Instruction ID: 8509e2768ca6c7b8ec99684272c031ec7a9ab4943944022725fcadc6560bd32f
Opcode Fuzzy Hash: ee2a45bf32f962551588385e9863078a8faed26700686c97536f1ce5dea5ceca
Instruction Fuzzy Hash: 18C1E2B1904B019FC710DF64D880AABB3E8EFC5324F08469AE9559F391D774E912CBE6

Function 1E7A2E30 Relevance: 28.2, APIs: 12, Strings: 4, Instructions: 151COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,O:SetEntriesInAcl,?), ref: 1E7A2E51
PySequence_Check.PYTHON27(?), ref: 1E7A2E63
PyErr_SetString.PYTHON27(?,Parm must be a list of EXPLICIT_ACCESS dictionaries), ref: 1E7A2E7D
PySequence_Size.PYTHON27(?), ref: 1E7A2E95
PyErr_SetString.PYTHON27(?,SetEntriesInAcl: unable to allocate EXPLICIT_ACCESS_W), ref: 1E7A2ECC
PySequence_GetItem.PYTHON27(?,00000000), ref: 1E7A2EE6
SetEntriesInAclW.ADVAPI32(00000000,?,?,?), ref: 1E7A2F28
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(SetEntriesInAcl,00000000), ref: 1E7A2F38
?SetACL@PyACL@@QAEHPAU_ACL@@@Z.PYWINTYPES27(?), ref: 1E7A2F5C
73BB3B4E.MSVCR90(?), ref: 1E7A2FA2
LocalFree.KERNEL32(?), ref: 1E7A2FBB

Strings

SetEntriesInAcl: unable to allocate EXPLICIT_ACCESS_W, xrefs: 1E7A2EC6
O:SetEntriesInAcl, xrefs: 1E7A2E3F
Parm must be a list of EXPLICIT_ACCESS dictionaries, xrefs: 1E7A2E77
SetEntriesInAcl, xrefs: 1E7A2F33

Memory Dump Source

Source File: 00000011.00000002.1561923280.000000001E7A1000.00000040.00000001.01000000.00000012.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000011.00000002.1561891626.000000001E7A0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7B9000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7BE000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562197228.000000001E7C0000.00000080.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562233172.000000001E7C2000.00000004.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e7a0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Sequence_$Err_String$Arg_CheckEntriesError@@FreeItemL@@@LocalParseSizeTupleU_object@@Win_
String ID: O:SetEntriesInAcl$Parm must be a list of EXPLICIT_ACCESS dictionaries$SetEntriesInAcl$SetEntriesInAcl: unable to allocate EXPLICIT_ACCESS_W
API String ID: 3749428248-1459552432
Opcode ID: 2f9dff3ff7eade62a6879fa07455848b30b2370f16acd7e2e048021bba1992dd
Instruction ID: cf69c38f65629dd6241c17fa22d27af6ce8797e046f21fdc19a5b90b569ee7bb
Opcode Fuzzy Hash: 2f9dff3ff7eade62a6879fa07455848b30b2370f16acd7e2e048021bba1992dd
Instruction Fuzzy Hash: DE4180B56042A29BF300DF28DC8495B77E9EFC9654F0D0B28FB4583225E731E905CBA2

Function 03417930 Relevance: 28.1, APIs: 14, Strings: 2, Instructions: 130serviceCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27 ref: 0341794A
QueryServiceConfig2W.ADVAPI32 ref: 03417993
GetLastError.KERNEL32 ref: 0341799B
CloseServiceHandle.ADVAPI32(00000000), ref: 034179A5
Py_BuildValue.PYTHON27(0341D478,0341D825), ref: 034179B5

Strings

QueryServiceConfig2W, xrefs: 03417A0D
QueryServiceConfig2W, xrefs: 034179CC

Memory Dump Source

Source File: 00000011.00000002.1560676867.0000000003411000.00000040.00000001.01000000.0000000F.sdmp, Offset: 03410000, based on PE: true

Associated: 00000011.00000002.1560637646.0000000003410000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560676867.000000000341B000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560676867.000000000341F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560836323.0000000003423000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_3410000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Service$Arg_BuildCloseConfig2ErrorHandleLastParseQueryTupleValue
String ID: QueryServiceConfig2W$QueryServiceConfig2W
API String ID: 40459686-1180059196
Opcode ID: f680075d4f1dbd0ef21b3bf60e611eaf7aa1204aaea712a1ea187d96780d5b7f
Instruction ID: c0b0018cca0a8e0e27748f6b80f15e8c70ede9d98b54b7e93f62c6eadcf4d1f8
Opcode Fuzzy Hash: f680075d4f1dbd0ef21b3bf60e611eaf7aa1204aaea712a1ea187d96780d5b7f
Instruction Fuzzy Hash: E6313B75A406006FD700F724BC45B6F7BF8EB84A65F18442AFD09DE204E379962986E6

Function 1E8C4790 Relevance: 28.1, APIs: 13, Strings: 3, Instructions: 123COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,OO|O:WriteProfileSection,?,?,?), ref: 1E8C47C4
?PyWinObject_AsString@@YAHPAU_object@@PAPADHPAK@Z.PYWINTYPES27(?,?,00000001,00000000), ref: 1E8C47EA
?PyWinObject_AsString@@YAHPAU_object@@PAPADHPAK@Z.PYWINTYPES27(?,?,00000001,?), ref: 1E8C4808
?PyWinObject_AsString@@YAHPAU_object@@PAPADHPAK@Z.PYWINTYPES27(?,?,00000001,00000000), ref: 1E8C4822
PyErr_SetString.PYTHON27(?,Section data must be terminated by double null), ref: 1E8C4859
?PyWinObject_FreeString@@YAXPAD@Z.PYWINTYPES27(?), ref: 1E8C48D2
?PyWinObject_FreeString@@YAXPAD@Z.PYWINTYPES27(?), ref: 1E8C48D9
?PyWinObject_FreeString@@YAXPAD@Z.PYWINTYPES27(?), ref: 1E8C48E0

Strings

Section data must be terminated by double null, xrefs: 1E8C4853
WriteProfileSection, xrefs: 1E8C48AA
OO|O:WriteProfileSection, xrefs: 1E8C47B2

Memory Dump Source

Source File: 00000011.00000002.1562490344.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 00000011.00000002.1562469835.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562702731.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562730939.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Object_String@@$FreeU_object@@$Arg_Err_ParseStringTuple
String ID: OO|O:WriteProfileSection$Section data must be terminated by double null$WriteProfileSection
API String ID: 1819261588-3105349092
Opcode ID: 12216613bd653e384157a2120117019dc6cedcdbb7ca3cc00ba139fd1e1373fb
Instruction ID: d6c2441bad9cad4afe000966e9f645c6b79d027a81f9809c112e0d6a2f66d322
Opcode Fuzzy Hash: 12216613bd653e384157a2120117019dc6cedcdbb7ca3cc00ba139fd1e1373fb
Instruction Fuzzy Hash: AB416E71904352AFE700DF68CCD4DAB77E9EBC9204F408A1DF98993251E731D989CBA2

Function 1E7A5E50 Relevance: 28.1, APIs: 11, Strings: 5, Instructions: 122COMMON

Download Yara Rule

APIs

IsValidSecurityDescriptor.ADVAPI32(1E7A6E07,?,?,1E7A626B,?,00000000,?,?,?,1E7A6E07,00000000), ref: 1E7A5E57
PyErr_SetString.PYTHON27(?,Invalid Security descriptor,?,1E7A626B,?,00000000,?,?,?,1E7A6E07,00000000), ref: 1E7A5E6E
GetSecurityDescriptorLength.ADVAPI32(1E7A6E07,00000000,00000000,?,?,1E7A626B,?,00000000,?,?,?,1E7A6E07,00000000), ref: 1E7A5E80
PyErr_Format.PYTHON27(?,Unable to allocate %d bytes,?), ref: 1E7A5EB4

Strings

Unable to allocate %d bytes, xrefs: 1E7A5EAE
Invalid Security descriptor, xrefs: 1E7A5E68
MakeSelfRelativeSD, xrefs: 1E7A5EEC
Unable to allocate %d bytes, xrefs: 1E7A5F1A
MakeSelfRelativeSD, xrefs: 1E7A5F58

Memory Dump Source

Source File: 00000011.00000002.1561923280.000000001E7A1000.00000040.00000001.01000000.00000012.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000011.00000002.1561891626.000000001E7A0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7B9000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7BE000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562197228.000000001E7C0000.00000080.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562233172.000000001E7C2000.00000004.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e7a0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: DescriptorErr_Security$FormatLengthStringValid
String ID: Invalid Security descriptor$MakeSelfRelativeSD$MakeSelfRelativeSD$Unable to allocate %d bytes$Unable to allocate %d bytes
API String ID: 712389088-4056593182
Opcode ID: 305b1f0768c27f0d1c1d22a6f1e7471e66103e9702ae4bf2fe7e039bdac7efbd
Instruction ID: 17edb81762a3096f7d4f060327e2122fab25f4bfd510d1166808941269418b5f
Opcode Fuzzy Hash: 305b1f0768c27f0d1c1d22a6f1e7471e66103e9702ae4bf2fe7e039bdac7efbd
Instruction Fuzzy Hash: A73194B62152159FF704DF68EC88E57B3ADEBC821AF1C0A2AF745C6250EB31E454CB61

Function 1E8C8840 Relevance: 28.1, APIs: 14, Strings: 2, Instructions: 116threadCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,OO|O:SearchPath,?,?,?), ref: 1E8C887A
?PyWinObject_AsString@@YAHPAU_object@@PAPADHPAK@Z.PYWINTYPES27(?,?,00000001,00000000), ref: 1E8C88A3
?PyWinObject_AsString@@YAHPAU_object@@PAPADHPAK@Z.PYWINTYPES27(?,?,00000000,00000000), ref: 1E8C88BC
?PyWinObject_AsString@@YAHPAU_object@@PAPADHPAK@Z.PYWINTYPES27(?,?,00000001,00000000), ref: 1E8C88D6
PyEval_SaveThread.PYTHON27 ref: 1E8C88E4
SearchPathA.KERNEL32(?,?,?,00000200,?,?), ref: 1E8C890A
PyEval_RestoreThread.PYTHON27(00000000), ref: 1E8C8913
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(SearchPath,00000000), ref: 1E8C8927
?PyWinObject_FreeString@@YAXPAD@Z.PYWINTYPES27(?), ref: 1E8C8973
?PyWinObject_FreeString@@YAXPAD@Z.PYWINTYPES27(?), ref: 1E8C897A
?PyWinObject_FreeString@@YAXPAD@Z.PYWINTYPES27(?), ref: 1E8C8981

Strings

OO|O:SearchPath, xrefs: 1E8C8868
SearchPath, xrefs: 1E8C8922

Memory Dump Source

Source File: 00000011.00000002.1562490344.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 00000011.00000002.1562469835.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562702731.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562730939.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Object_String@@$U_object@@$Free$Eval_Thread$Arg_Error@@ParsePathRestoreSaveSearchTupleWin_
String ID: OO|O:SearchPath$SearchPath
API String ID: 1904503595-3479636443
Opcode ID: c7ea4f920c2bda0c0d33bae72982bf1cbf6df60f72143dbb9814e067db52642d
Instruction ID: 43e4729b964bcb02ead033175c4076db584848b4d7b91a76b44f62a52127da42
Opcode Fuzzy Hash: c7ea4f920c2bda0c0d33bae72982bf1cbf6df60f72143dbb9814e067db52642d
Instruction Fuzzy Hash: 40315EB15543116FE300DFA8CCC8DABB7ECEF89214F044A1DF54993241E634E9498BA3

Function 1E8C59C0 Relevance: 28.1, APIs: 10, Strings: 6, Instructions: 98COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27 ref: 1E8C59DF
GetVersionExA.KERNEL32 ref: 1E8C5A07
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(GetVersionEx,00000000), ref: 1E8C5A17

Strings

iiiiN, xrefs: 1E8C5A49
iiiiNiiiii, xrefs: 1E8C5AE6
format must be 0 or 1 (got %d), xrefs: 1E8C5B04
GetVersionEx, xrefs: 1E8C5A7F
GetVersionEx, xrefs: 1E8C5A12
|i:GetVersionEx, xrefs: 1E8C59D1

Memory Dump Source

Source File: 00000011.00000002.1562490344.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 00000011.00000002.1562469835.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562702731.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562730939.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_Error@@ParseTupleU_object@@VersionWin_
String ID: GetVersionEx$GetVersionEx$format must be 0 or 1 (got %d)$iiiiN$iiiiNiiiii$|i:GetVersionEx
API String ID: 2077112091-775768606
Opcode ID: d2729c43f573c087483a218408676203822ea4e806b495b59e05b83cc1997b7b
Instruction ID: 80792d530958f64933975d9b84be49680978ed2399fce0fc183d744f78130808
Opcode Fuzzy Hash: d2729c43f573c087483a218408676203822ea4e806b495b59e05b83cc1997b7b
Instruction Fuzzy Hash: 0B313CB5508251AFE310CB65CC88FAB77E9BBC9315F84861CF89DC2291E23496598B63

Function 1E8CB060 Relevance: 28.1, APIs: 3, Strings: 13, Instructions: 72COMMON

Download Yara Rule

APIs

PyErr_Format.PYTHON27(?,%s is not available on this platform,GlobalMemoryStatusEx), ref: 1E8CB07E
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(GlobalMemoryStatusEx,00000000), ref: 1E8CB0A3

Strings

AvailVirtual, xrefs: 1E8CB0D5
MemoryLoad, xrefs: 1E8CB128
TotalPhys, xrefs: 1E8CB122
GlobalMemoryStatusEx, xrefs: 1E8CB073
GlobalMemoryStatusEx, xrefs: 1E8CB09E
TotalPageFile, xrefs: 1E8CB102
AvailPhys, xrefs: 1E8CB111
Length, xrefs: 1E8CB12E
@, xrefs: 1E8CB08F
AvailExtendedVirtual, xrefs: 1E8CB0C6
TotalVirtual, xrefs: 1E8CB0E4
%s is not available on this platform, xrefs: 1E8CB078
AvailPageFile, xrefs: 1E8CB0F3

Memory Dump Source

Source File: 00000011.00000002.1562490344.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 00000011.00000002.1562469835.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562702731.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562730939.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Err_Error@@FormatU_object@@Win_
String ID: %s is not available on this platform$@$AvailExtendedVirtual$AvailPageFile$AvailPhys$AvailVirtual$GlobalMemoryStatusEx$GlobalMemoryStatusEx$Length$MemoryLoad$TotalPageFile$TotalPhys$TotalVirtual
API String ID: 1771588633-3205011328
Opcode ID: 9c960fb4037b89461c09805d8a8b189e8d2cab074f8ca2fb7799ae646d21142a
Instruction ID: 58493382babc2d529cf7e75ad7c818845a8fde163a9d764bf4e0cf200f7593f2
Opcode Fuzzy Hash: 9c960fb4037b89461c09805d8a8b189e8d2cab074f8ca2fb7799ae646d21142a
Instruction Fuzzy Hash: A621CCB2108350BFD244DB58DC84D9BB7F9BBC9A54F40960CF699D3310D631E908CB66

Function 03417590 Relevance: 26.5, APIs: 12, Strings: 3, Instructions: 220serviceCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,0341D400,?), ref: 034175B1
QueryServiceConfigW.ADVAPI32(00000000,00000000,00000000,?), ref: 034175F7
GetLastError.KERNEL32 ref: 034175F9
CloseServiceHandle.ADVAPI32(00000000), ref: 034177BB
73BB3B4E.MSVCR90(?), ref: 034177CA

Strings

(OOOs), xrefs: 034176F0
QueryServiceConfigW, xrefs: 0341763C
QueryServiceConfigW, xrefs: 03417604

Memory Dump Source

Source File: 00000011.00000002.1560676867.0000000003411000.00000040.00000001.01000000.0000000F.sdmp, Offset: 03410000, based on PE: true

Associated: 00000011.00000002.1560637646.0000000003410000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560676867.000000000341B000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560676867.000000000341F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560836323.0000000003423000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_3410000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Service$Arg_CloseConfigErrorHandleLastParseQueryTuple
String ID: (OOOs)$QueryServiceConfigW$QueryServiceConfigW
API String ID: 2875933263-2285709846
Opcode ID: 866fcef47bdb04cbcd5c4b7e5c63037410f0b90c73b55f20bc0406c0260a498c
Instruction ID: 764740d541c05c5f1a0e7b539cc9a34ae967731bb9a19c9731f9a3af8d369504
Opcode Fuzzy Hash: 866fcef47bdb04cbcd5c4b7e5c63037410f0b90c73b55f20bc0406c0260a498c
Instruction Fuzzy Hash: DF61D6B69007069FC710EF64DC8096BB7E9EF84620F184659E9258F341D734F926C7EA

Function 1E7D1930 Relevance: 26.4, APIs: 11, Strings: 4, Instructions: 158threadCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,il|O:LogMsg,?,?,?), ref: 1E7D1956
?PyWinObject_FreeWCHAR@@YAXPA_W@Z.PYWINTYPES27(6D18CB14), ref: 1E7D19F4
PyEval_SaveThread.PYTHON27 ref: 1E7D1A80
PyEval_RestoreThread.PYTHON27(00000000,?,?), ref: 1E7D1A9A

Strings

RegisterEventSource/ReportEvent, xrefs: 1E7D1ABF
il|O:LogMsg, xrefs: 1E7D1948
strings must be None or a sequence, xrefs: 1E7D1AD9
Allocating string arrays, xrefs: 1E7D19C8

Memory Dump Source

Source File: 00000011.00000002.1562321143.000000001E7D1000.00000040.00000001.01000000.00000015.sdmp, Offset: 1E7D0000, based on PE: true

Associated: 00000011.00000002.1562293036.000000001E7D0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000011.00000002.1562321143.000000001E7DA000.00000040.00000001.01000000.00000015.sdmpDownload File
Associated: 00000011.00000002.1562391495.000000001E7DB000.00000080.00000001.01000000.00000015.sdmpDownload File
Associated: 00000011.00000002.1562417397.000000001E7DD000.00000004.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e7d0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Eval_Thread$Arg_FreeObject_ParseRestoreSaveTuple
String ID: Allocating string arrays$RegisterEventSource/ReportEvent$il|O:LogMsg$strings must be None or a sequence
API String ID: 715270677-2263833891
Opcode ID: 40aa4e241577b29e4ce9751ad365563a5b70aac3a11ac9608c415343b62425e3
Instruction ID: 98a5e5bb5567575b6d775909243e88dfa7043eda63c36672b0407e2250aec0b1
Opcode Fuzzy Hash: 40aa4e241577b29e4ce9751ad365563a5b70aac3a11ac9608c415343b62425e3
Instruction Fuzzy Hash: BC5191755043519FE300DFA9EC88A9B77E9FFD8214F040A29FD8697211E736E90D8B92

Function 1E7A2610 Relevance: 26.4, APIs: 11, Strings: 4, Instructions: 145COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,llOii:AddAuditAccessAce,?,?,?,?,?), ref: 1E7A263E
?PyWinObject_AsSID@@YAHPAU_object@@PAPAXH@Z.PYWINTYPES27(?,?,00000000), ref: 1E7A265E
AddAuditAccessAce.ADVAPI32(?,?,?,?,?,?), ref: 1E7A2687
GetLastError.KERNEL32 ref: 1E7A2695
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(AddAuditAccessAce,00000000), ref: 1E7A26A8

Strings

AddAuditAccessAce, xrefs: 1E7A2751
AddAuditAccessAce, xrefs: 1E7A26A3
AddAuditAccessAce: unable to allocated %d bytes, xrefs: 1E7A26E9
llOii:AddAuditAccessAce, xrefs: 1E7A2638

Memory Dump Source

Source File: 00000011.00000002.1561923280.000000001E7A1000.00000040.00000001.01000000.00000012.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000011.00000002.1561891626.000000001E7A0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7B9000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7BE000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562197228.000000001E7C0000.00000080.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562233172.000000001E7C2000.00000004.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e7a0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: U_object@@$AccessArg_AuditErrorError@@LastObject_ParseTupleWin_
String ID: AddAuditAccessAce$AddAuditAccessAce$AddAuditAccessAce: unable to allocated %d bytes$llOii:AddAuditAccessAce
API String ID: 3198050918-1933714757
Opcode ID: d3c80c5d548a53114e100bcc17054038a53c8ca5df8bbb6703c58d3c9f3cbd90
Instruction ID: 1e9607b3087256ae39eef41c9b1eab66a69c9a7f1ccb14f1f10f143602094285
Opcode Fuzzy Hash: d3c80c5d548a53114e100bcc17054038a53c8ca5df8bbb6703c58d3c9f3cbd90
Instruction Fuzzy Hash: 83414276604251AFE200DB58EC85DBBB3A9EFC8659F4C4B1DF74983221E731E905C7A2

Function 1E7A91A0 Relevance: 26.4, APIs: 10, Strings: 5, Instructions: 140COMMON

Download Yara Rule

APIs

PyString_Size.PYTHON27(?,?,?,?,?,?,1E7A1A6E), ref: 1E7A91C4
PyString_AsString.PYTHON27(?,?,?,?,?,?,1E7A1A6E), ref: 1E7A91CD
PyMem_Malloc.PYTHON27(00000002), ref: 1E7A91E1
PyErr_SetString.PYTHON27(?,No memory for wide string buffer), ref: 1E7A9202
MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000), ref: 1E7A9219
PyMem_Malloc.PYTHON27(?,?,?,?,?,?,1E7A1A6E), ref: 1E7A924D
PyErr_SetString.PYTHON27(00000000,Allocating WCHAR array), ref: 1E7A926F
PyUnicodeUCS2_AsUnicode.PYTHON27(?,?), ref: 1E7A9282
PyErr_SetString.PYTHON27(?,None is not a valid string in this context,?,?,?,?,?,1E7A1A6E), ref: 1E7A92C0
PyErr_Format.PYTHON27(<NULL!!>,Objects of type '%s' can not be converted to Unicode.,<NULL!!>,?,?,?,?,?,1E7A1A6E), ref: 1E7A92F2

Strings

No memory for wide string buffer, xrefs: 1E7A91FC
Objects of type '%s' can not be converted to Unicode., xrefs: 1E7A92EC
Allocating WCHAR array, xrefs: 1E7A9269
None is not a valid string in this context, xrefs: 1E7A92BA
<NULL!!>, xrefs: 1E7A92DE, 1E7A92E9, 1E7A92F1

Memory Dump Source

Source File: 00000011.00000002.1561923280.000000001E7A1000.00000040.00000001.01000000.00000012.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000011.00000002.1561891626.000000001E7A0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7B9000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7BE000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562197228.000000001E7C0000.00000080.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562233172.000000001E7C2000.00000004.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e7a0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Err_String$MallocMem_String_Unicode$ByteCharFormatMultiSizeWide
String ID: <NULL!!>$Allocating WCHAR array$No memory for wide string buffer$None is not a valid string in this context$Objects of type '%s' can not be converted to Unicode.
API String ID: 2927283933-1696457029
Opcode ID: 03183311d98d97e749aef2f15ba5281159c8563f64f148a115b6503f79771bb8
Instruction ID: 682fff84946e489c4c5c7d2f28bafac10f959d86b9f4317343dfa6aa3f277c72
Opcode Fuzzy Hash: 03183311d98d97e749aef2f15ba5281159c8563f64f148a115b6503f79771bb8
Instruction Fuzzy Hash: 3D4195B6605218DFF2148F58EC8495BB7ADFBCD319B18472AFA06C7250DB71E414CBA1

Function 1E7A6E60 Relevance: 26.4, APIs: 10, Strings: 5, Instructions: 123COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,?,?,?,?,?,?,?,?,?,1E7AC5DA,000000FF), ref: 1E7A6E97
??0PySECURITY_DESCRIPTOR@@QAE@H@Z.PYWINTYPES27(?), ref: 1E7A6EC5

Part of subcall function 1E7A6DC0: InitializeSecurityDescriptor.ADVAPI32(00000000), ref: 1E7A6DF5
Part of subcall function 1E7A6DC0: ?SetSD@PySECURITY_DESCRIPTOR@@QAEHPAX@Z.PYWINTYPES27(00000000), ref: 1E7A6E02
Part of subcall function 1E7A6DC0: 73BB3B4E.MSVCR90(00000000), ref: 1E7A6E08

Part of subcall function 1E7A5D70: GetSecurityDescriptorControl.ADVAPI32(?,?,?,1E7A6FA7,?,?,?,?,?,?,?,?), ref: 1E7A5D82

PyErr_Occurred.PYTHON27(?), ref: 1E7A6EE0
PyErr_SetString.PYTHON27(00000000,Security descriptors are not supported on this platform), ref: 1E7A6EF8
PyErr_Clear.PYTHON27(?), ref: 1E7A6F25
PyArg_ParseTuple.PYTHON27(?,?,?,?,?,?,?,?,?,?,?,?,?,?,1E7AC5DA,000000FF), ref: 1E7A6F3E
PyObject_AsReadBuffer.PYTHON27(?,?,?,?,?,O:SECURITY_DESCRIPTOR,?), ref: 1E7A6F56
IsValidSecurityDescriptor.ADVAPI32(?,?,?,?,?,?,?,?), ref: 1E7A6F69
PyErr_SetString.PYTHON27(00000000,Security descriptor created from a buffer must be self relative,?,?,?,?,?,?,?,?), ref: 1E7A6F81
??0PySECURITY_DESCRIPTOR@@QAE@PAX@Z.PYWINTYPES27(?), ref: 1E7A6FDA

Strings

Security descriptors are not supported on this platform, xrefs: 1E7A6EF2
Data is not a valid security descriptor, xrefs: 1E7A6F73
O:SECURITY_DESCRIPTOR, xrefs: 1E7A6F30
|l:SECURITY_DESCRIPTOR, xrefs: 1E7A6E89
Security descriptor created from a buffer must be self relative, xrefs: 1E7A6FAE

Memory Dump Source

Source File: 00000011.00000002.1561923280.000000001E7A1000.00000040.00000001.01000000.00000012.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000011.00000002.1561891626.000000001E7A0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7B9000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7BE000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562197228.000000001E7C0000.00000080.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562233172.000000001E7C2000.00000004.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e7a0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Err_$DescriptorSecurity$Arg_ParseStringTuple$BufferClearControlInitializeObject_OccurredReadValid
String ID: Data is not a valid security descriptor$O:SECURITY_DESCRIPTOR$Security descriptor created from a buffer must be self relative$Security descriptors are not supported on this platform$|l:SECURITY_DESCRIPTOR
API String ID: 3145180011-3716056180
Opcode ID: ed4d6683539e5deb6ddb043652d959efed584379f2d8c73f570bac8180c37d26
Instruction ID: bb83f29601ebd25aae6479fac1bdae0c38eb57efe24bbeb7ce84f2a2d22a7d88
Opcode Fuzzy Hash: ed4d6683539e5deb6ddb043652d959efed584379f2d8c73f570bac8180c37d26
Instruction Fuzzy Hash: C6419FB1604242ABF704DFA4DD44B5BB7E9BBC8314F084B2DFA5583290E734E445CBA2

Function 1E8C1930 Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 115threadCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,O:GetEnvironmentVariableW,?), ref: 1E8C1962
?PyWinObject_FreeWCHAR@@YAXPA_W@Z.PYWINTYPES27 ref: 1E8C197C
?PyWinObject_AsWCHAR@@YAHPAU_object@@PAPA_WHPAK@Z.PYWINTYPES27(?,?,00000000,00000000), ref: 1E8C19A3
73BB3B4E.MSVCR90(00000000), ref: 1E8C19C5
PyEval_SaveThread.PYTHON27 ref: 1E8C19E5
GetEnvironmentVariableW.KERNEL32(?,00000000,00000000), ref: 1E8C19F4
PyEval_RestoreThread.PYTHON27(00000000), ref: 1E8C19FD
PyErr_NoMemory.PYTHON27 ref: 1E8C1A12
73BB3B4E.MSVCR90(00000000), ref: 1E8C1A5F
?PyWinObject_FreeWCHAR@@YAXPA_W@Z.PYWINTYPES27 ref: 1E8C1A75

Strings

GetEnvironmentVariableW, xrefs: 1E8C1A3B
O:GetEnvironmentVariableW, xrefs: 1E8C1958

Memory Dump Source

Source File: 00000011.00000002.1562490344.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 00000011.00000002.1562469835.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562702731.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562730939.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Object_$Eval_FreeThread$Arg_EnvironmentErr_MemoryParseRestoreSaveTupleU_object@@Variable
String ID: GetEnvironmentVariableW$O:GetEnvironmentVariableW
API String ID: 1404223751-3021908484
Opcode ID: b7873e29068bd6b59accb7d880737cf624b76f4b8138ac1846ab1c05421706f4
Instruction ID: 0b277e2d0e05dd76b76160c082395264c4d181868aa5b5e67e0a83095a03f14d
Opcode Fuzzy Hash: b7873e29068bd6b59accb7d880737cf624b76f4b8138ac1846ab1c05421706f4
Instruction Fuzzy Hash: BD41ABB5404251AFE300DFA9D9C8AABB7F9FF86610F408629F85AC3340D734D949CB62

Function 1E7A7580 Relevance: 26.4, APIs: 11, Strings: 4, Instructions: 110COMMON

Download Yara Rule

APIs

IsValidSid.ADVAPI32(?,?,?,1E7A76BD,?,?,?,00000000,?), ref: 1E7A7587
GetSidIdentifierAuthority.ADVAPI32(?,?,?,?,?,00000000,?), ref: 1E7A7596
GetSidSubAuthorityCount.ADVAPI32(?,?,?,?,?,00000000,?), ref: 1E7A759F
SetLastError.KERNEL32(0000007A,?,?,?,?,00000000,?), ref: 1E7A75C2

Strings

S-%lu-, xrefs: 1E7A75DC
0x%02hx%02hx%02hx%02hx%02hx%02hx, xrefs: 1E7A7647
%lu, xrefs: 1E7A7614
-%lu, xrefs: 1E7A7677

Memory Dump Source

Source File: 00000011.00000002.1561923280.000000001E7A1000.00000040.00000001.01000000.00000012.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000011.00000002.1561891626.000000001E7A0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7B9000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7BE000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562197228.000000001E7C0000.00000080.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562233172.000000001E7C2000.00000004.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e7a0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Authority$CountErrorIdentifierLastValid
String ID: %lu$-%lu$0x%02hx%02hx%02hx%02hx%02hx%02hx$S-%lu-
API String ID: 228009767-531523367
Opcode ID: 9d5deb592823902d88391b1e74c5053d9f7839c49c9340a69e7821f9e9226c9c
Instruction ID: e8fee798af060d982c36da517dbd36eec126814a2bf0e6da092bfcfe89bd727c
Opcode Fuzzy Hash: 9d5deb592823902d88391b1e74c5053d9f7839c49c9340a69e7821f9e9226c9c
Instruction Fuzzy Hash: 7E315AB2404260ABF3104B399C859B7BBEDDFC9206B088A6EF6D7C3211E234D106DB70

Function 1E8C8350 Relevance: 26.4, APIs: 12, Strings: 3, Instructions: 108threadregistryCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27 ref: 1E8C8381
?PyWinObject_AsHKEY@@YAHPAU_object@@PAPAUHKEY__@@@Z.PYWINTYPES27(?,?,?,?,?,?,?,?), ref: 1E8C8398
PyErr_SetString.PYTHON27(?,Type must be win32con.REG_SZ), ref: 1E8C83BA
?PyWinObject_AsString@@YAHPAU_object@@PAPADHPAK@Z.PYWINTYPES27(?,00000001,00000000,?), ref: 1E8C83E1
?PyWinObject_AsString@@YAHPAU_object@@PAPADHPAK@Z.PYWINTYPES27(?,?,00000001,00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 1E8C83F8
?PyWinObject_FreeString@@YAXPAD@Z.PYWINTYPES27(?), ref: 1E8C8406
PyEval_SaveThread.PYTHON27 ref: 1E8C8417
RegSetValueA.ADVAPI32(?,?,00000001,?,?), ref: 1E8C8435
PyEval_RestoreThread.PYTHON27(00000000), ref: 1E8C843E
?PyWinObject_FreeString@@YAXPAD@Z.PYWINTYPES27(?), ref: 1E8C844F
?PyWinObject_FreeString@@YAXPAD@Z.PYWINTYPES27(?), ref: 1E8C8456
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(RegSetValue,00000000), ref: 1E8C8466

Strings

OOiO:RegSetValue, xrefs: 1E8C836B
Type must be win32con.REG_SZ, xrefs: 1E8C83B4
RegSetValue, xrefs: 1E8C8461

Memory Dump Source

Source File: 00000011.00000002.1562490344.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 00000011.00000002.1562469835.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562702731.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562730939.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Object_$String@@$U_object@@$Free$Eval_Thread$Arg_Err_Error@@ParseRestoreSaveStringTupleValueWin_Y__@@@
String ID: OOiO:RegSetValue$RegSetValue$Type must be win32con.REG_SZ
API String ID: 1484770148-3406249925
Opcode ID: 0e4fb1833e8b0944be1a4ea4e2194983af0ed8eb9e5df0d79345b01ac9c99293
Instruction ID: 37198442e5767c3b3db720c88e256688d916c103a00f8daac45072dc59d5b6f3
Opcode Fuzzy Hash: 0e4fb1833e8b0944be1a4ea4e2194983af0ed8eb9e5df0d79345b01ac9c99293
Instruction Fuzzy Hash: D2315C71514311AFE304DBA8CC98EEBB3E9BFC9614F448918F95983250E734E589CBA2

Function 1E7A1840 Relevance: 26.3, APIs: 12, Strings: 3, Instructions: 99COMMON

Download Yara Rule

APIs

PyMapping_Check.PYTHON27(00000000,00000000), ref: 1E7A1858
PyErr_SetString.PYTHON27(?,Object must be a mapping (dictionary, class instance, etc,00000000), ref: 1E7A1873

Strings

__dict__, xrefs: 1E7A1930
Object must be a mapping (dictionary, class instance, etc, xrefs: 1E7A186D
items, xrefs: 1E7A1883

Memory Dump Source

Source File: 00000011.00000002.1561923280.000000001E7A1000.00000040.00000001.01000000.00000012.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000011.00000002.1561891626.000000001E7A0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7B9000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7BE000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562197228.000000001E7C0000.00000080.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562233172.000000001E7C2000.00000004.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e7a0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: CheckErr_Mapping_String
String ID: Object must be a mapping (dictionary, class instance, etc$__dict__$items
API String ID: 1486305882-1644530579
Opcode ID: 61cbe18f4fa327ec86f61432c5574680c94bfa20f69c7e99842f5c189c501219
Instruction ID: 8bfeeae496f1584da9bd46df83f9da6e356ede05bed0486eb78aae9af68767dd
Opcode Fuzzy Hash: 61cbe18f4fa327ec86f61432c5574680c94bfa20f69c7e99842f5c189c501219
Instruction Fuzzy Hash: 5E21F571500221ABF3005B28BC84ADB73ADEFC8669F094328FF1582351D735E952CBA6

Function 1E8C2C30 Relevance: 26.3, APIs: 10, Strings: 5, Instructions: 99COMMON

Download Yara Rule

APIs

PyErr_Format.PYTHON27(?,%s is not available on this platform,GetComputerObjectName), ref: 1E8C2C50
PyArg_ParseTuple.PYTHON27(?,i:GetComputerObjectName,?), ref: 1E8C2C71

Strings

GetComputerObjectName, xrefs: 1E8C2C45
%s is not available on this platform, xrefs: 1E8C2C4A
GetComputerObjectName, xrefs: 1E8C2C9D
i:GetComputerObjectName, xrefs: 1E8C2C67
GetComputerObjectName, xrefs: 1E8C2CFE

Memory Dump Source

Source File: 00000011.00000002.1562490344.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 00000011.00000002.1562469835.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562702731.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562730939.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_Err_FormatParseTuple
String ID: %s is not available on this platform$GetComputerObjectName$GetComputerObjectName$GetComputerObjectName$i:GetComputerObjectName
API String ID: 361908667-738876011
Opcode ID: 565ac351e6b566c003bf358833ebbd5d30c4f6ee2a39853b8196c1ac47c1aba1
Instruction ID: 1377436846e20d5c88a01d2b5412e8fc247d6411cf6e65db4beabb29361a6f41
Opcode Fuzzy Hash: 565ac351e6b566c003bf358833ebbd5d30c4f6ee2a39853b8196c1ac47c1aba1
Instruction Fuzzy Hash: 6821E671510129AFD600AB68EC8D8EB77E8EB82516F444129FC0EC3300E636E69DD6B6

Function 1E8C2DB0 Relevance: 26.3, APIs: 10, Strings: 5, Instructions: 99COMMON

Download Yara Rule

APIs

PyErr_Format.PYTHON27(?,%s is not available on this platform,GetUserNameEx), ref: 1E8C2DD0
PyArg_ParseTuple.PYTHON27(?,i:GetUserNameEx,?), ref: 1E8C2DF1

Strings

GetUserNameEx, xrefs: 1E8C2DC5
i:GetUserNameEx, xrefs: 1E8C2DE7
GetUserNameEx, xrefs: 1E8C2E7E
%s is not available on this platform, xrefs: 1E8C2DCA
GetUserNameExW, xrefs: 1E8C2E1D

Memory Dump Source

Source File: 00000011.00000002.1562490344.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 00000011.00000002.1562469835.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562702731.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562730939.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_Err_FormatParseTuple
String ID: %s is not available on this platform$GetUserNameEx$GetUserNameEx$GetUserNameExW$i:GetUserNameEx
API String ID: 361908667-2181525025
Opcode ID: e8e96063e89c3f4aff41cbe69608225173f791040a9830340ff7ef3838d7625d
Instruction ID: 24be49119b52eee284ce1f95427ff48e58ed1df9fb5cc11fbf9c17e64b90bd3f
Opcode Fuzzy Hash: e8e96063e89c3f4aff41cbe69608225173f791040a9830340ff7ef3838d7625d
Instruction Fuzzy Hash: 5F21D675510129AFD600AB68EC8D8EB77E8FF82516F444129FC0EC3301E636E69DD6A6

Function 1E8C4C70 Relevance: 26.3, APIs: 10, Strings: 5, Instructions: 95COMMON

Download Yara Rule

APIs

PyErr_Format.PYTHON27(?,%s is not available on this platform,GetLongPathNameA), ref: 1E8C4C90
PyArg_ParseTuple.PYTHON27(?,s:GetLongPathName,?), ref: 1E8C4CB7

Strings

GetLongPathName, xrefs: 1E8C4D3E
%s is not available on this platform, xrefs: 1E8C4C8A
GetLongPathNameA, xrefs: 1E8C4C85
s:GetLongPathName, xrefs: 1E8C4CA8
Unable to allocate %d bytes, xrefs: 1E8C4D25

Memory Dump Source

Source File: 00000011.00000002.1562490344.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 00000011.00000002.1562469835.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562702731.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562730939.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_Err_FormatParseTuple
String ID: %s is not available on this platform$GetLongPathName$GetLongPathNameA$Unable to allocate %d bytes$s:GetLongPathName
API String ID: 361908667-2741634594
Opcode ID: bcbf2c6fcb84620b4abb7079a0e799bbb152fb91de9b8c8d8d4ad9b315c76f8a
Instruction ID: 30b7ba01699f3ea5dc06cfba7b30505fbdf348210ea9ffaaac0e2ba624bd4ddd
Opcode Fuzzy Hash: bcbf2c6fcb84620b4abb7079a0e799bbb152fb91de9b8c8d8d4ad9b315c76f8a
Instruction Fuzzy Hash: 9321A376500221AFD311AB68AC889CB77AABF82755F044225FD0993310E736E599CAE6

Function 1E8CBE60 Relevance: 24.7, APIs: 10, Strings: 4, Instructions: 181COMMON

Download Yara Rule

APIs

PyString_AsString.PYTHON27(?), ref: 1E8CBE6B
?PyWinObject_FromTCHAR@@YAPAU_object@@PBDH@Z.PYWINTYPES27(?,000000FF), ref: 1E8CBEB7

Strings

DeviceKey, xrefs: 1E8CBFA1
DeviceString, xrefs: 1E8CBED7
DeviceID, xrefs: 1E8CBF3A
DeviceName, xrefs: 1E8CBE7B

Memory Dump Source

Source File: 00000011.00000002.1562490344.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 00000011.00000002.1562469835.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562702731.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562730939.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: FromObject_StringString_U_object@@
String ID: DeviceID$DeviceKey$DeviceName$DeviceString
API String ID: 1511502740-1635029413
Opcode ID: f5b51a0f38e787e99a7c68749799043d7dd8300e44dde7908592e4787ea2718e
Instruction ID: 2d52eaaaae14393f9ce1e5ccd28030320e608ee961fbaeed575294a800acd404
Opcode Fuzzy Hash: f5b51a0f38e787e99a7c68749799043d7dd8300e44dde7908592e4787ea2718e
Instruction Fuzzy Hash: 46416C33B6E9E216E70106383C607EE7B479F93039B4C4769ED9B8B2D6E203C58A5351

Function 1E7D27C0 Relevance: 24.6, APIs: 10, Strings: 4, Instructions: 135registryCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27 ref: 1E7D27E4
PyCallable_Check.PYTHON27(?,?,?,?,?,?), ref: 1E7D27F5
PyErr_SetString.PYTHON27(00000000,Second argument must be a callable object,?,?,?,?,?,?), ref: 1E7D2810
?PyWinObject_AsWCHAR@@YAHPAU_object@@PAPA_WHPAK@Z.PYWINTYPES27(?,?,00000000,00000000,?,?,?,?,?,?), ref: 1E7D282D
PyErr_SetString.PYTHON27(?,The service name is not hosted by this process,?,?,?,?,?,?,?,?,?,?,?,?), ref: 1E7D2858
?PyWinObject_FreeWCHAR@@YAXPA_W@Z.PYWINTYPES27(?,?,The service name is not hosted by this process,?,?,?,?,?,?,?,?,?,?,?,?), ref: 1E7D2863
RegisterServiceCtrlHandlerW.ADVAPI32(?,Function_000023B0,?,?,?,?,?,?,?,?,?,?,?,?), ref: 1E7D28E2
?PyWinObject_FreeWCHAR@@YAXPA_W@Z.PYWINTYPES27(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 1E7D28F0
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27 ref: 1E7D2929
?PyWinLong_FromHANDLE@@YAPAU_object@@PAX@Z.PYWINTYPES27(?,?,?,?,?,?,?,?,?,?,?,?), ref: 1E7D2939

Strings

The service name is not hosted by this process, xrefs: 1E7D2852
OO|i, xrefs: 1E7D27D6
RegisterServiceCtrlHandlerEx, xrefs: 1E7D291C
Second argument must be a callable object, xrefs: 1E7D280A

Memory Dump Source

Source File: 00000011.00000002.1562321143.000000001E7D1000.00000040.00000001.01000000.00000015.sdmp, Offset: 1E7D0000, based on PE: true

Associated: 00000011.00000002.1562293036.000000001E7D0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000011.00000002.1562321143.000000001E7DA000.00000040.00000001.01000000.00000015.sdmpDownload File
Associated: 00000011.00000002.1562391495.000000001E7DB000.00000080.00000001.01000000.00000015.sdmpDownload File
Associated: 00000011.00000002.1562417397.000000001E7DD000.00000004.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e7d0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Object_U_object@@$Err_FreeString$Arg_Callable_CheckCtrlError@@FromHandlerLong_ParseRegisterServiceTupleWin_
String ID: OO|i$RegisterServiceCtrlHandlerEx$Second argument must be a callable object$The service name is not hosted by this process
API String ID: 2228332292-2207870682
Opcode ID: c2e17d6a6a44dd70480fb3b280b68feff1f86b69b2f2e4337e17cf976b2b899b
Instruction ID: 1f9dc4e5dc9dd537e8a2d6ec313060b4f63501be62f7fbcf9e17bc041402a3e6
Opcode Fuzzy Hash: c2e17d6a6a44dd70480fb3b280b68feff1f86b69b2f2e4337e17cf976b2b899b
Instruction Fuzzy Hash: 09418C75604351AFE300DF98C884A9B77E8FB88720F408958FD5997321E735E85ACFA2

Function 1E7A4D40 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 121COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27 ref: 1E7A4D5F
PyObject_CheckReadBuffer.PYTHON27(00000000), ref: 1E7A4D81
PyErr_Format.PYTHON27(?,object must be a read-buffer to read the CLSID bytes,?,?,?,?,?), ref: 1E7A4D9C

Strings

string too small - must be at least %d bytes (got %d), xrefs: 1E7A4DD7
object must be a read-buffer to read the CLSID bytes, xrefs: 1E7A4D96
O|i, xrefs: 1E7A4D51

Memory Dump Source

Source File: 00000011.00000002.1561923280.000000001E7A1000.00000040.00000001.01000000.00000012.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000011.00000002.1561891626.000000001E7A0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7B9000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7BE000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562197228.000000001E7C0000.00000080.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562233172.000000001E7C2000.00000004.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e7a0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_BufferCheckErr_FormatObject_ParseReadTuple
String ID: O|i$object must be a read-buffer to read the CLSID bytes$string too small - must be at least %d bytes (got %d)
API String ID: 194250459-70904074
Opcode ID: bef2c5fa0fc3afa4ee7979cb4280a48fb68b3a89c52a080ba2e9e7b08acac79c
Instruction ID: 67e14e4880527d0e801e6fba9653fa000284457320bcc955386055de5d97fb65
Opcode Fuzzy Hash: bef2c5fa0fc3afa4ee7979cb4280a48fb68b3a89c52a080ba2e9e7b08acac79c
Instruction Fuzzy Hash: 5A4194B9514202AFE308DF64D885E5B77E9AFC8304F488F18FA4983261F731E554CB96

Function 1E8CA590 Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 117threadCOMMON

Download Yara Rule

APIs

PyThreadState_Swap.PYTHON27(00000000), ref: 1E8CA59C
PyThreadState_Swap.PYTHON27(00000000), ref: 1E8CA5A1
?PyWinThreadState_Ensure@@YAHXZ.PYWINTYPES27 ref: 1E8CA5AE
?PyWinInterpreterLock_Acquire@@YAXXZ.PYWINTYPES27 ref: 1E8CA5B9
Py_BuildValue.PYTHON27(i(OO),?,00000000,6D18CB14), ref: 1E8CA5DF
PyObject_CallObject.PYTHON27(?,00000000), ref: 1E8CA605
PyInt_AsLong.PYTHON27(00000000), ref: 1E8CA638
PyObject_IsSubclass.PYTHON27(00000000), ref: 1E8CA64F
PySequence_Check.PYTHON27(00000000), ref: 1E8CA66D
PySequence_GetItem.PYTHON27(00000000,00000000), ref: 1E8CA683
PySequence_GetItem.PYTHON27(00000000,00000001), ref: 1E8CA68E
?PyWinInterpreterLock_Release@@YAXXZ.PYWINTYPES27 ref: 1E8CA6B3
?PyWinThreadState_Free@@YAXXZ.PYWINTYPES27 ref: 1E8CA6BD

Strings

i(OO), xrefs: 1E8CA5DA

Memory Dump Source

Source File: 00000011.00000002.1562490344.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 00000011.00000002.1562469835.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562702731.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562730939.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: State_Thread$Sequence_$InterpreterItemLock_Object_Swap$Acquire@@BuildCallCheckEnsure@@Free@@Int_LongObjectRelease@@SubclassValue
String ID: i(OO)
API String ID: 3009821372-2031314091
Opcode ID: 1a6c49850dc0de776762b4286ae1f6dab4ca442a85580e2fa685412d38254857
Instruction ID: ece8b00d006cce45e548db9df1cac9afc86007f4ff7a7fbd246210c5ddb811fe
Opcode Fuzzy Hash: 1a6c49850dc0de776762b4286ae1f6dab4ca442a85580e2fa685412d38254857
Instruction Fuzzy Hash: 1B41A0716006119FD3109FA4DC88DDBB3E6AF86724F114368F95A87390EB31E946CBA2

Function 1E7D1D60 Relevance: 24.6, APIs: 8, Strings: 6, Instructions: 117registryCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000105), ref: 1E7D1D98
GetLastError.KERNEL32 ref: 1E7D1DA2
PyGILState_Ensure.PYTHON27(?,00000000), ref: 1E7D1DCD
PySys_GetObject.PYTHON27 ref: 1E7D1DF1
PyString_AsString.PYTHON27(00000000), ref: 1E7D1E15
wsprintfW.USER32 ref: 1E7D1E3F
RegSetValueW.ADVAPI32(80000002,?,00000001,?,?), ref: 1E7D1E74

Strings

Registering the Python Service Manager..., xrefs: 1E7D1D82
Registration failed due to RegSetValue() of service EXE - error %d, xrefs: 1E7D1E7F
Registration failed due to GetModuleFileName() failing (error %d), xrefs: 1E7D1DA9
winver, xrefs: 1E7D1DE1
Software\Python\PythonService\%hs, xrefs: 1E7D1E39
Registration failed as sys.winver is not available or not a string, xrefs: 1E7D1EC8

Memory Dump Source

Source File: 00000011.00000002.1562321143.000000001E7D1000.00000040.00000001.01000000.00000015.sdmp, Offset: 1E7D0000, based on PE: true

Associated: 00000011.00000002.1562293036.000000001E7D0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000011.00000002.1562321143.000000001E7DA000.00000040.00000001.01000000.00000015.sdmpDownload File
Associated: 00000011.00000002.1562391495.000000001E7DB000.00000080.00000001.01000000.00000015.sdmpDownload File
Associated: 00000011.00000002.1562417397.000000001E7DD000.00000004.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e7d0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: EnsureErrorFileLastModuleNameObjectState_StringString_Sys_Valuewsprintf
String ID: Registering the Python Service Manager...$Registration failed as sys.winver is not available or not a string$Registration failed due to GetModuleFileName() failing (error %d)$Registration failed due to RegSetValue() of service EXE - error %d$Software\Python\PythonService\%hs$winver
API String ID: 2187450830-2799430497
Opcode ID: 5f89df80ed307d3c79789a95e7f64700c8b69935aeaf3aae4ebf9122850c3aa1
Instruction ID: 9d5be4f4b1b50138bf3a97763f075546987ae75cfc6311b596dabd65a8da1f60
Opcode Fuzzy Hash: 5f89df80ed307d3c79789a95e7f64700c8b69935aeaf3aae4ebf9122850c3aa1
Instruction Fuzzy Hash: CB410571500351ABF320DF64EC45BEA73E9FB84721F444728F95982290E738A50DCBA6

Function 1E8C7910 Relevance: 24.6, APIs: 10, Strings: 4, Instructions: 107COMMON

Download Yara Rule

APIs

PyErr_Format.PYTHON27(?,%s is not available on this platform,RegOpenKeyTransacted), ref: 1E8C7930
PyArg_ParseTupleAndKeywords.PYTHON27(?,?,OOkO|k:RegOpenKeyTransacted,1E8D7064,?,?,?,?,?), ref: 1E8C7973

Strings

%s is not available on this platform, xrefs: 1E8C792A
RegOpenKeyTransacted, xrefs: 1E8C79FB
OOkO|k:RegOpenKeyTransacted, xrefs: 1E8C7964
RegOpenKeyTransacted, xrefs: 1E8C7925

Memory Dump Source

Source File: 00000011.00000002.1562490344.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 00000011.00000002.1562469835.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562702731.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562730939.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_Err_FormatKeywordsParseTuple
String ID: %s is not available on this platform$OOkO|k:RegOpenKeyTransacted$RegOpenKeyTransacted$RegOpenKeyTransacted
API String ID: 223827023-3216062451
Opcode ID: 96458b4445a962a848d21e9d857b18f7d91fe55e95370a3f79c657aaa78c516b
Instruction ID: ce2fc416dff5f990ff51d9772673f82cf8b1031ea0e3426ebd306b0197a267d2
Opcode Fuzzy Hash: 96458b4445a962a848d21e9d857b18f7d91fe55e95370a3f79c657aaa78c516b
Instruction Fuzzy Hash: 1E318DB1508211AFD714DB68CC88D9BB7E9BF89609F044A1CF54DC3200E631EA99CBA2

Function 1E8C7E00 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 98registryCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,OO:RegQueryValue,?,?), ref: 1E8C7E22
?PyWinObject_AsHKEY@@YAHPAU_object@@PAPAUHKEY__@@@Z.PYWINTYPES27(?,?), ref: 1E8C7E41
?PyWinObject_AsString@@YAHPAU_object@@PAPADHPAK@Z.PYWINTYPES27(?,?,00000001,00000000), ref: 1E8C7E5D
RegQueryValueA.ADVAPI32(?,?,00000000,?), ref: 1E8C7E7D
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(RegQueryValue,00000000), ref: 1E8C7E89
?PyWinObject_FreeString@@YAXPAD@Z.PYWINTYPES27(?), ref: 1E8C7EDA

Strings

RegQueryValue, xrefs: 1E8C7EBB
OO:RegQueryValue, xrefs: 1E8C7E16
RegQueryValue, xrefs: 1E8C7E84

Memory Dump Source

Source File: 00000011.00000002.1562490344.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 00000011.00000002.1562469835.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562702731.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562730939.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Object_U_object@@$String@@$Arg_Error@@FreeParseQueryTupleValueWin_Y__@@@
String ID: OO:RegQueryValue$RegQueryValue$RegQueryValue
API String ID: 1119018263-3043149522
Opcode ID: 5466167c444d972d2f66830f46f97243278f92543d0f4d9d3efde8fe82d3edc5
Instruction ID: f7005b942fc446a8a372d7cbd68b8cb1d97c1daf8d6bd93c672faa54a740e5ab
Opcode Fuzzy Hash: 5466167c444d972d2f66830f46f97243278f92543d0f4d9d3efde8fe82d3edc5
Instruction Fuzzy Hash: D0317F76A00119EBDB14EBA8CD88CEEB7B9EB45215B104268E909A3240E7319E548BA1

Function 1E8C4FB0 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 92threadCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,OO|i:GetTempFileName,?,?,?), ref: 1E8C4FE1
?PyWinObject_AsString@@YAHPAU_object@@PAPADHPAK@Z.PYWINTYPES27(?,?,00000000,00000000), ref: 1E8C5009
?PyWinObject_AsString@@YAHPAU_object@@PAPADHPAK@Z.PYWINTYPES27(?,?,00000000,00000000), ref: 1E8C501E
PyEval_SaveThread.PYTHON27 ref: 1E8C5028
GetTempFileNameA.KERNEL32(?,?,?,?), ref: 1E8C5044
PyEval_RestoreThread.PYTHON27(00000000), ref: 1E8C504D
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(GetTempFileName,00000000), ref: 1E8C5061
?PyWinObject_FreeString@@YAXPAD@Z.PYWINTYPES27(?), ref: 1E8C5099
?PyWinObject_FreeString@@YAXPAD@Z.PYWINTYPES27(?), ref: 1E8C50A0

Strings

OO|i:GetTempFileName, xrefs: 1E8C4FCF
GetTempFileName, xrefs: 1E8C505C
(Ni), xrefs: 1E8C507E

Memory Dump Source

Source File: 00000011.00000002.1562490344.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 00000011.00000002.1562469835.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562702731.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562730939.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Object_String@@$U_object@@$Eval_FreeThread$Arg_Error@@FileNameParseRestoreSaveTempTupleWin_
String ID: (Ni)$GetTempFileName$OO|i:GetTempFileName
API String ID: 3415277092-3597938607
Opcode ID: 594d8e3bfbd98ff37d45c84c7555e12c7d8bc5021fe8b9d9e810e8436eece282
Instruction ID: fd9089542891bb9b423ed1937ae24c168eb2ff2f12b6f580d2a7689ea6adb7dd
Opcode Fuzzy Hash: 594d8e3bfbd98ff37d45c84c7555e12c7d8bc5021fe8b9d9e810e8436eece282
Instruction Fuzzy Hash: 0F213AB2504315AFE310DF68DCC4CEB77EDBB89214F044A2DF999D3241E635D9498BA2

Function 1E8C3820 Relevance: 24.6, APIs: 10, Strings: 4, Instructions: 89COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,OO:VkKeyScanEx,?,?), ref: 1E8C3837
?PyWinObject_AsHANDLE@@YAHPAU_object@@PAPAX@Z.PYWINTYPES27(?,?), ref: 1E8C3854
PyErr_SetString.PYTHON27(?,must be a byte string of length 1), ref: 1E8C3886

Strings

OO:VkKeyScanEx, xrefs: 1E8C3831
must be a byte string of length 1, xrefs: 1E8C3880
must be a unicode or byte string of length 1, xrefs: 1E8C3904
must be a unicode string of length 1, xrefs: 1E8C38C2

Memory Dump Source

Source File: 00000011.00000002.1562490344.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 00000011.00000002.1562469835.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562702731.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562730939.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_Err_Object_ParseStringTupleU_object@@
String ID: OO:VkKeyScanEx$must be a byte string of length 1$must be a unicode or byte string of length 1$must be a unicode string of length 1
API String ID: 2332810667-3442240018
Opcode ID: 23de94490bda52380355a156d0ac491852025d51af6bdd6d5dc6b335e823fdf8
Instruction ID: 590ee1446a018ab948a50419a2ca79e7017aafe3bffb213e9b36f8e5d724c7d9
Opcode Fuzzy Hash: 23de94490bda52380355a156d0ac491852025d51af6bdd6d5dc6b335e823fdf8
Instruction Fuzzy Hash: 7521AE75500210AFE300CB68D8989EB77E5FF86615F048668FC4983360E635DA8ACB92

Function 1E7AA390 Relevance: 24.6, APIs: 7, Strings: 7, Instructions: 58COMMON

Download Yara Rule

APIs

PyLong_FromUnsignedLongLong.PYTHON27(?,?), ref: 1E7AA3A4
PyLong_FromUnsignedLongLong.PYTHON27(?,?,OtherTransferCount,00000000), ref: 1E7AA3B7
PyLong_FromUnsignedLongLong.PYTHON27(?,?,WriteTransferCount,00000000), ref: 1E7AA3CA
PyLong_FromUnsignedLongLong.PYTHON27(?,?,ReadTransferCount,00000000), ref: 1E7AA3DD
PyLong_FromUnsignedLongLong.PYTHON27(?,?,OtherOperationCount,00000000), ref: 1E7AA3F0
PyLong_FromUnsignedLongLong.PYTHON27(?,?,WriteOperationCount,00000000), ref: 1E7AA402
Py_BuildValue.PYTHON27({s:N,s:N,s:N,s:N,s:N,s:N},ReadOperationCount,00000000,WriteOperationCount,00000000), ref: 1E7AA412

Strings

WriteOperationCount, xrefs: 1E7AA3FB
OtherTransferCount, xrefs: 1E7AA3B0
ReadTransferCount, xrefs: 1E7AA3D6
ReadOperationCount, xrefs: 1E7AA408
WriteTransferCount, xrefs: 1E7AA3C3
OtherOperationCount, xrefs: 1E7AA3E9
{s:N,s:N,s:N,s:N,s:N,s:N}, xrefs: 1E7AA40D

Memory Dump Source

Source File: 00000011.00000002.1561923280.000000001E7A1000.00000040.00000001.01000000.00000012.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000011.00000002.1561891626.000000001E7A0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7B9000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7BE000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562197228.000000001E7C0000.00000080.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562233172.000000001E7C2000.00000004.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e7a0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Long$FromLong_Unsigned$BuildValue
String ID: OtherOperationCount$OtherTransferCount$ReadOperationCount$ReadTransferCount$WriteOperationCount$WriteTransferCount${s:N,s:N,s:N,s:N,s:N,s:N}
API String ID: 3891383402-408589094
Opcode ID: 01fad60f596ebc4432011e6e440dcec8a783428b4620d7956182109e8bdf5ee9
Instruction ID: f481a21ebffab7642f7e5d416ae1c2962f5af44333eb59375e71acafc8a34d69
Opcode Fuzzy Hash: 01fad60f596ebc4432011e6e440dcec8a783428b4620d7956182109e8bdf5ee9
Instruction Fuzzy Hash: B301DBB56006007FE624DB69EC81CA7F3EDAFD82057054B19F98AD3720D571F8158AB5

Function 03414FD8 Relevance: 23.0, APIs: 10, Strings: 3, Instructions: 231COMMON

Download Yara Rule

APIs

PyUnicodeUCS2_FromWideChar.PYTHON27(?,?), ref: 03415011
Py_BuildValue.PYTHON27(0341B840,00000000), ref: 0341509B
Py_BuildValue.PYTHON27((OiOOOO),00000000,000000FF,00000000,6D18CB14,6D18CB14,6D18CB14), ref: 034150D0
PyList_Append.PYTHON27(?,00000000), ref: 034150E5

Strings

%.2X, xrefs: 03415057
(OiOOOO), xrefs: 03415229
(OiOOOO), xrefs: 034150CB

Memory Dump Source

Source File: 00000011.00000002.1560676867.0000000003411000.00000040.00000001.01000000.0000000F.sdmp, Offset: 03410000, based on PE: true

Associated: 00000011.00000002.1560637646.0000000003410000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560676867.000000000341B000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560676867.000000000341F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560836323.0000000003423000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_3410000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: BuildValue$AppendCharFromList_UnicodeWide
String ID: %.2X$(OiOOOO)$(OiOOOO)
API String ID: 3269264928-2842833335
Opcode ID: 38832e6c36883f4e94566f45e4eaac5837b84aa6b99998f7df1053d395949458
Instruction ID: a684a03af67fb7232d6ae85149b0d6482bc38487a5804ba643e0f140886df4a9
Opcode Fuzzy Hash: 38832e6c36883f4e94566f45e4eaac5837b84aa6b99998f7df1053d395949458
Instruction Fuzzy Hash: 4681CFB1604B019FC710DF58D840AABB3E8EF89324F084A9AF9559F351D774E912CBE6

Function 1E7A2320 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 191COMMON

Download Yara Rule

APIs

PyErr_Format.PYTHON27(?,%s not supported by this version of Windows,?,?,?,?,?,1E7A257E,77613D50,AddAccessAllowedObjectAce,?,?,?,?,?,?), ref: 1E7A2352
?PyWinObject_AsIID@@YAHPAU_object@@PAU_GUID@@@Z.PYWINTYPES27(?,?,?,?,?,?,1E7A257E,77613D50,AddAccessAllowedObjectAce,?,?,?,?,?,?), ref: 1E7A2374

Strings

%s not supported by this version of Windows, xrefs: 1E7A234C
%s: unable to allocated %d bytes, xrefs: 1E7A245B

Memory Dump Source

Source File: 00000011.00000002.1561923280.000000001E7A1000.00000040.00000001.01000000.00000012.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000011.00000002.1561891626.000000001E7A0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7B9000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7BE000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562197228.000000001E7C0000.00000080.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562233172.000000001E7C2000.00000004.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e7a0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: D@@@Err_FormatObject_U_object@@
String ID: %s not supported by this version of Windows$%s: unable to allocated %d bytes
API String ID: 3079635983-968908422
Opcode ID: 32d5c42ab4b9bf43798e95ae4d3dbdd57271ab5a65dbd74ad5d72008931cc97d
Instruction ID: a57e880279c712d9a570825e7e2f887947dcc9e33f41079b0b2308ab1e365b1c
Opcode Fuzzy Hash: 32d5c42ab4b9bf43798e95ae4d3dbdd57271ab5a65dbd74ad5d72008931cc97d
Instruction Fuzzy Hash: B651C5B6504250AFE304DF54EC84DABB3E9EFC8655F480B1DFA4583220E775E945CBA2

Function 03413D00 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 185COMMON

Download Yara Rule

APIs

PyDict_New.PYTHON27 ref: 03413D07
GetIfEntry2.IPHLPAPI(00000000), ref: 03413D71
Py_BuildValue.PYTHON27((KKKKKKKK),?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 03413E0B
PyUnicodeUCS2_FromWideChar.PYTHON27(?,?), ref: 03413E37
PyDict_SetItem.PYTHON27(?,00000000,00000000), ref: 03413E51

Strings

GetIfEntry() or GetIfEntry2() syscalls failed., xrefs: 03413EBF
(KKKKKKKK), xrefs: 03413E06

Memory Dump Source

Source File: 00000011.00000002.1560676867.0000000003411000.00000040.00000001.01000000.0000000F.sdmp, Offset: 03410000, based on PE: true

Associated: 00000011.00000002.1560637646.0000000003410000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560676867.000000000341B000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560676867.000000000341F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560836323.0000000003423000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_3410000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Dict_$BuildCharEntry2FromItemUnicodeValueWide
String ID: (KKKKKKKK)$GetIfEntry() or GetIfEntry2() syscalls failed.
API String ID: 3218330116-1738093298
Opcode ID: 3bfd80abf2763ab5502513ebd7a05a4b2916406b418a12aeb50209569b10e395
Instruction ID: 991a0020eefcc6ae4d585ff0e72bd85fdaa9177c25ff7f54d1544cacd0a13d67
Opcode Fuzzy Hash: 3bfd80abf2763ab5502513ebd7a05a4b2916406b418a12aeb50209569b10e395
Instruction Fuzzy Hash: 4751A4B5600F019FC760DF68DC80EA7B3E9EF84725F084619E96A8B345D734E825CBA5

Function 1E7A6730 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 116COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,Oi:SetSecurityDescriptorOwner,?,?), ref: 1E7A675D
?PyWinObject_AsSID@@YAHPAU_object@@PAPAXH@Z.PYWINTYPES27(?,?,00000001), ref: 1E7A677E
IsValidSid.ADVAPI32(?), ref: 1E7A678F
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(SetSecurityDescriptorGroup - invalid sid,00000000), ref: 1E7A679F

Strings

SetSecurityDescriptorGroup, xrefs: 1E7A67EB
SetSecurityDescriptorGroup - invalid sid, xrefs: 1E7A679A
Oi:SetSecurityDescriptorOwner, xrefs: 1E7A6745

Memory Dump Source

Source File: 00000011.00000002.1561923280.000000001E7A1000.00000040.00000001.01000000.00000012.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000011.00000002.1561891626.000000001E7A0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7B9000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7BE000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562197228.000000001E7C0000.00000080.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562233172.000000001E7C2000.00000004.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e7a0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: U_object@@$Arg_Error@@Object_ParseTupleValidWin_
String ID: Oi:SetSecurityDescriptorOwner$SetSecurityDescriptorGroup$SetSecurityDescriptorGroup - invalid sid
API String ID: 56846361-540673021
Opcode ID: 5eacbe10dfdeda512770b6cb96075fd038ebcede153f4d70495e77fd15793a06
Instruction ID: 642eaac127fc8a2bdcaf2ad5000e87cf4360b7d1a1884a9e58ab2694e65d144d
Opcode Fuzzy Hash: 5eacbe10dfdeda512770b6cb96075fd038ebcede153f4d70495e77fd15793a06
Instruction Fuzzy Hash: CE31E475604205ABF200DFA5AC84D6B739DEEC4614F8C4B2CFE4592221E735E919CAB7

Function 1E8C4650 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 115threadCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,O|O:GetProfileSection,?,?), ref: 1E8C467F
?PyWinObject_AsString@@YAHPAU_object@@PAPADHPAK@Z.PYWINTYPES27(?,?,00000000,00000000), ref: 1E8C46A4
?PyWinObject_AsString@@YAHPAU_object@@PAPADHPAK@Z.PYWINTYPES27(?,?,00000001,00000000), ref: 1E8C46BE
PyEval_SaveThread.PYTHON27 ref: 1E8C46F2
GetPrivateProfileSectionA.KERNEL32(?,00000000,00000100,?), ref: 1E8C470A
PyEval_RestoreThread.PYTHON27(00000000), ref: 1E8C4722
?PyWinObject_FromMultipleString@@YAPAU_object@@PAD@Z.PYWINTYPES27(00000000), ref: 1E8C4733
?PyWinObject_FreeString@@YAXPAD@Z.PYWINTYPES27(?), ref: 1E8C474D
?PyWinObject_FreeString@@YAXPAD@Z.PYWINTYPES27(?), ref: 1E8C4754

Strings

O|O:GetProfileSection, xrefs: 1E8C466D
Error allocating space for return buffer, xrefs: 1E8C4778

Memory Dump Source

Source File: 00000011.00000002.1562490344.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 00000011.00000002.1562469835.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562702731.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562730939.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Object_String@@$U_object@@$Eval_FreeThread$Arg_FromMultipleParsePrivateProfileRestoreSaveSectionTuple
String ID: Error allocating space for return buffer$O|O:GetProfileSection
API String ID: 751482902-2414598846
Opcode ID: 4f50df2ad9ead24bd95235cca58548cf9ff99a5234bdbbc9afc430dbe6fb1e28
Instruction ID: 96d833fdebf80fc2e5e84dd39127f04babc3a828e241d4988ce002cea2fd8c0e
Opcode Fuzzy Hash: 4f50df2ad9ead24bd95235cca58548cf9ff99a5234bdbbc9afc430dbe6fb1e28
Instruction Fuzzy Hash: 1B318FB25043116BD300EF6DDC88DEB77E9AF86650F450A18F98993200E735E999CBA2

Function 1E7D1750 Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 114registrywindowCOMMON

Download Yara Rule

APIs

FormatMessageW.KERNEL32(00002900,1E7D0000,?,00000000,?,00000000,?,?,00000000,00000000,?,1E7D1FE9), ref: 1E7D17BE
LocalFree.KERNEL32(?,?,?,?,00000001), ref: 1E7D181A

Part of subcall function 1E7D1620: GetModuleFileNameW.KERNEL32(1E7D0000,1E7D6448,00000104), ref: 1E7D164D
Part of subcall function 1E7D1620: RegCreateKeyExW.ADVAPI32(80000002,?,00000000,00000000,00000000,00020006,00000000,00000000,00000000,00000000,00000000), ref: 1E7D16D0
Part of subcall function 1E7D1620: RegSetValueExW.ADVAPI32(?,EventMessageFile,00000000,00000001,1E7D6448,00000000), ref: 1E7D170F
Part of subcall function 1E7D1620: RegSetValueExW.ADVAPI32(?,?,?,TypesSupported,00000000,00000004,?,00000004), ref: 1E7D172E
Part of subcall function 1E7D1620: RegCloseKey.ADVAPI32(?), ref: 1E7D1735

RegisterEventSourceW.ADVAPI32(00000000,Python Service), ref: 1E7D1836
ReportEventW.ADVAPI32(00000000,?,00000000,?,00000000,00000000,00000000,?,00000000), ref: 1E7D1858
DeregisterEventSource.ADVAPI32(00000000), ref: 1E7D1861

Strings

%s 0x%X - No message availableMessage inserts were, xrefs: 1E7D17D0
Info, xrefs: 1E7D1794
Message, xrefs: 1E7D178D
Error, xrefs: 1E7D17A2, 1E7D1806
'%s',, xrefs: 1E7D17E7
%s 0x%X - %s, xrefs: 1E7D1807
Python Service, xrefs: 1E7D182F
Warning, xrefs: 1E7D179B, 1E7D17CF

Memory Dump Source

Source File: 00000011.00000002.1562321143.000000001E7D1000.00000040.00000001.01000000.00000015.sdmp, Offset: 1E7D0000, based on PE: true

Associated: 00000011.00000002.1562293036.000000001E7D0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000011.00000002.1562321143.000000001E7DA000.00000040.00000001.01000000.00000015.sdmpDownload File
Associated: 00000011.00000002.1562391495.000000001E7DB000.00000080.00000001.01000000.00000015.sdmpDownload File
Associated: 00000011.00000002.1562417397.000000001E7DD000.00000004.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e7d0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Event$SourceValue$CloseCreateDeregisterFileFormatFreeLocalMessageModuleNameRegisterReport
String ID: %s 0x%X - %s$%s 0x%X - No message availableMessage inserts were$'%s',$Error$Info$Message$Python Service$Warning
API String ID: 1291031356-1119858224
Opcode ID: 681144f03a66e9611f18a05e8588019f9d75f3c869e0668e6a6fa29dbf1cc80b
Instruction ID: c79a2acd9aa300f4ca30d2f385512c3588b0003da70e9513d8842060bbd87cba
Opcode Fuzzy Hash: 681144f03a66e9611f18a05e8588019f9d75f3c869e0668e6a6fa29dbf1cc80b
Instruction Fuzzy Hash: E73129766003246BF2104A9AFC48FE737DDFBC5672F1103A5F945962A0EA61AC0987B5

Function 1E8CAD40 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 111COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,:GetKeyboardLayoutList), ref: 1E8CAD53
GetKeyboardLayoutList.USER32(00000000,00000000), ref: 1E8CAD70
PyErr_Format.PYTHON27(?,Unable to allocate %d bytes), ref: 1E8CAD9A

Strings

Unable to allocate %d bytes, xrefs: 1E8CAD94
:GetKeyboardLayoutList, xrefs: 1E8CAD45
GetKeyboardLayoutList, xrefs: 1E8CADB4

Memory Dump Source

Source File: 00000011.00000002.1562490344.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 00000011.00000002.1562469835.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562702731.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562730939.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_Err_FormatKeyboardLayoutListParseTuple
String ID: :GetKeyboardLayoutList$GetKeyboardLayoutList$Unable to allocate %d bytes
API String ID: 3099271929-1085947540
Opcode ID: 653af72c4f1df466b24584eb381ba838f3b87f97ed6fc44797cc945408104f11
Instruction ID: 54969757222495b53e7b4d7adaa5c3da16df307bb0fe940cd5979beec2b03ba1
Opcode Fuzzy Hash: 653af72c4f1df466b24584eb381ba838f3b87f97ed6fc44797cc945408104f11
Instruction Fuzzy Hash: B131D3766002115BE3019B68EC88BDBB7E9FFC622AF104669F90BC7240DB35D855C6A2

Function 1E8C8220 Relevance: 22.9, APIs: 9, Strings: 4, Instructions: 101COMMON

Download Yara Rule

APIs

PyErr_Format.PYTHON27(?,%s is not available on this platform,RegSaveKeyEx), ref: 1E8C8240
PyArg_ParseTupleAndKeywords.PYTHON27 ref: 1E8C828C

Strings

RegSaveKeyEx, xrefs: 1E8C830A
%s is not available on this platform, xrefs: 1E8C823A
OO|Ok:RegSaveKeyEx, xrefs: 1E8C8279
RegSaveKeyEx, xrefs: 1E8C8235

Memory Dump Source

Source File: 00000011.00000002.1562490344.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 00000011.00000002.1562469835.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562702731.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562730939.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_Err_FormatKeywordsParseTuple
String ID: %s is not available on this platform$OO|Ok:RegSaveKeyEx$RegSaveKeyEx$RegSaveKeyEx
API String ID: 223827023-1259186164
Opcode ID: c2645fa61a656834efdff443b0c05885f0ec4c0e6755791e725a26701c316b1d
Instruction ID: 6c4ef5ac84a8bb8a691da766c14d6203bbcbd749a5487d12e2334a6e887fb3cb
Opcode Fuzzy Hash: c2645fa61a656834efdff443b0c05885f0ec4c0e6755791e725a26701c316b1d
Instruction Fuzzy Hash: 47317AB1514211AFD300DB68CD88DABB3EAFF89215F408918F94DC3251E630E95ACBA2

Function 1E7A1CC0 Relevance: 22.8, APIs: 7, Strings: 6, Instructions: 94COMMON

Download Yara Rule

APIs

GetExplicitEntriesFromAclA.ADVAPI32(?,?,?), ref: 1E7A1CE0
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(GetExplicitEntriesFromAcl,00000000), ref: 1E7A1CF0

Part of subcall function 1E7A9F20: GetLastError.KERNEL32(00000000,?,1E7A5F68,MakeSelfRelativeSD,00000000), ref: 1E7A9F2A
Part of subcall function 1E7A9F20: ?PyWin_GetErrorMessageModule@@YAPAUHINSTANCE__@@K@Z.PYWINTYPES27(00000000,00000000,?,1E7A5F68,MakeSelfRelativeSD,00000000), ref: 1E7A9F38
Part of subcall function 1E7A9F20: FormatMessageA.KERNEL32(00001300,00000000,00000000,00000000,?,00000000,00000000), ref: 1E7A9F69
Part of subcall function 1E7A9F20: ?PyWinObject_FromTCHAR@@YAPAU_object@@PBDH@Z.PYWINTYPES27(No error message is available,000000FF,?,?,?,?,?,?,?,?,?,?,00000000), ref: 1E7A9FC7
Part of subcall function 1E7A9F20: ?PyWinCoreString_FromString@@YAPAU_object@@PBDH@Z.PYWINTYPES27(?,000000FF,00000000,?,73BB3D3F), ref: 1E7A9FD7
Part of subcall function 1E7A9F20: Py_BuildValue.PYTHON27((iNN),00000000,00000000,?,00000000,?,73BB3D3F), ref: 1E7A9FE6
Part of subcall function 1E7A9F20: LocalFree.KERNEL32(?), ref: 1E7A9FFF
Part of subcall function 1E7A9F20: PyErr_SetObject.PYTHON27(031BEB40,00000000), ref: 1E7AA010

PyTuple_New.PYTHON27(?), ref: 1E7A1D03
Py_BuildValue.PYTHON27({s:l,s:l,s:l,s:N},AccessPermissions,?,AccessMode,?,Inheritance,?,Trustee,00000000,?), ref: 1E7A1D5E
PyTuple_SetItem.PYTHON27(00000000,00000000,00000000), ref: 1E7A1D6A
LocalFree.KERNEL32(?), ref: 1E7A1D84

Strings

GetExplicitEntriesFromAcl, xrefs: 1E7A1CEB
Inheritance, xrefs: 1E7A1D48
{s:l,s:l,s:l,s:N}, xrefs: 1E7A1D59
Trustee, xrefs: 1E7A1D42
AccessMode, xrefs: 1E7A1D4E
AccessPermissions, xrefs: 1E7A1D54

Memory Dump Source

Source File: 00000011.00000002.1561923280.000000001E7A1000.00000040.00000001.01000000.00000012.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000011.00000002.1561891626.000000001E7A0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7B9000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7BE000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562197228.000000001E7C0000.00000080.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562233172.000000001E7C2000.00000004.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e7a0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: FromU_object@@$BuildErrorFreeLocalMessageTuple_ValueWin_$CoreE__@@EntriesErr_Error@@ExplicitFormatItemLastModule@@ObjectObject_String@@String_
String ID: AccessMode$AccessPermissions$GetExplicitEntriesFromAcl$Inheritance$Trustee${s:l,s:l,s:l,s:N}
API String ID: 1412758497-3023593127
Opcode ID: 286906dcf239ac6a49b5a9fd6ec233a4c748a32526a5bada161a81add0e2e30d
Instruction ID: 902f6c62e0c212248d9c1d9f92dae9ac4c45c51cff427e9a75f093d6b17e5d42
Opcode Fuzzy Hash: 286906dcf239ac6a49b5a9fd6ec233a4c748a32526a5bada161a81add0e2e30d
Instruction Fuzzy Hash: AE21B976600205AFE200DF58EC84C9BB7EDEFC8215F094719FB8993310D632E845CBA2

Function 1E8C1840 Relevance: 22.8, APIs: 12, Strings: 1, Instructions: 87threadCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27 ref: 1E8C185A
?PyWinObject_AsString@@YAHPAU_object@@PAPADHPAK@Z.PYWINTYPES27(?,00000000,00000000,00000000,?,?,?), ref: 1E8C187B
PyEval_SaveThread.PYTHON27 ref: 1E8C1892
GetEnvironmentVariableA.KERNEL32(?,00000000,00000000), ref: 1E8C18A5
PyEval_RestoreThread.PYTHON27(00000000), ref: 1E8C18AA
?PyWinObject_FreeString@@YAXPAD@Z.PYWINTYPES27(?), ref: 1E8C190D
73BB3B4E.MSVCR90(00000000), ref: 1E8C191B

Strings

O:GetEnvironmentVariable, xrefs: 1E8C184C

Memory Dump Source

Source File: 00000011.00000002.1562490344.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 00000011.00000002.1562469835.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562702731.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562730939.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Eval_Object_String@@Thread$Arg_EnvironmentFreeParseRestoreSaveTupleU_object@@Variable
String ID: O:GetEnvironmentVariable
API String ID: 2175569948-3344723964
Opcode ID: 91800f26b6cc0bb89b82e3fc8629ff86154290a0cae5c8a237f81655dde15e72
Instruction ID: 4e6b5d66eff904c701821f54e5425f416212c7459308f03729f1a644831683c2
Opcode Fuzzy Hash: 91800f26b6cc0bb89b82e3fc8629ff86154290a0cae5c8a237f81655dde15e72
Instruction Fuzzy Hash: FB219F75504222AFE300DB65DDC8B9B77E8EF86655F000628F90DD3250D734D959C7A7

Function 1E8C5B20 Relevance: 22.8, APIs: 10, Strings: 3, Instructions: 85threadCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,O:GetVolumeInformation,?), ref: 1E8C5B35
?PyWinObject_AsString@@YAHPAU_object@@PAPADHPAK@Z.PYWINTYPES27(?,00000000,00000000,00000000), ref: 1E8C5B59
PyEval_SaveThread.PYTHON27 ref: 1E8C5B68
GetVolumeInformationA.KERNEL32(?,?,00000105,?,?,?,?,00000105), ref: 1E8C5B9B
PyEval_RestoreThread.PYTHON27(00000000), ref: 1E8C5BA4
?PyWinObject_FreeString@@YAXPAD@Z.PYWINTYPES27(?), ref: 1E8C5BAF
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(GetVolumeInformation,00000000), ref: 1E8C5BC2

Strings

GetVolumeInformation, xrefs: 1E8C5BBD
O:GetVolumeInformation, xrefs: 1E8C5B2F
NlllN, xrefs: 1E8C5C06

Memory Dump Source

Source File: 00000011.00000002.1562490344.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 00000011.00000002.1562469835.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562702731.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562730939.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Eval_Object_String@@ThreadU_object@@$Arg_Error@@FreeInformationParseRestoreSaveTupleVolumeWin_
String ID: GetVolumeInformation$NlllN$O:GetVolumeInformation
API String ID: 1421789331-666831025
Opcode ID: e7906ca7c3c987ac10274442d5f4883f6be1f20c91e4a47fb294281eb45e9218
Instruction ID: 4d58ad8699403ca73ebb80b53c6f01b67f0b4c1e96997fad01a7ec056afa05a5
Opcode Fuzzy Hash: e7906ca7c3c987ac10274442d5f4883f6be1f20c91e4a47fb294281eb45e9218
Instruction Fuzzy Hash: 52217C715042126FE710DBA8DC88EEB77E9ABC5315F444A19FA58C3280E634E649CBA2

Function 1E8C1D20 Relevance: 22.8, APIs: 11, Strings: 2, Instructions: 82COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,O:ExpandEnvironmentStrings,?), ref: 1E8C1D35
?PyWinObject_AsString@@YAHPAU_object@@PAPADHPAK@Z.PYWINTYPES27(?,?,00000000,00000000), ref: 1E8C1D57
ExpandEnvironmentStringsA.KERNEL32(?,00000000,00000000), ref: 1E8C1D76
PyErr_NoMemory.PYTHON27 ref: 1E8C1D8A
?PyWinObject_FreeString@@YAXPAD@Z.PYWINTYPES27(?), ref: 1E8C1DD4
73BB3B4E.MSVCR90(00000000), ref: 1E8C1DE2

Strings

O:ExpandEnvironmentStrings, xrefs: 1E8C1D2D
ExpandEnvironmentStrings, xrefs: 1E8C1DB4

Memory Dump Source

Source File: 00000011.00000002.1562490344.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 00000011.00000002.1562469835.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562702731.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562730939.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Object_String@@$Arg_EnvironmentErr_ExpandFreeMemoryParseStringsTupleU_object@@
String ID: ExpandEnvironmentStrings$O:ExpandEnvironmentStrings
API String ID: 2639400853-3304109119
Opcode ID: 3831131ed1c799d34183b23389898cb55415f9745ddbd7970a2fdd003a551f5d
Instruction ID: 8fbc278cb61d54a424f6610fc0c3a5b1264b01d5af4a544e694a28db6117e8e8
Opcode Fuzzy Hash: 3831131ed1c799d34183b23389898cb55415f9745ddbd7970a2fdd003a551f5d
Instruction Fuzzy Hash: 732104315002116BE3109BB59CCCFDB3BF8EF82665F004528FE4AC3240EB34E448C666

Function 1E7A80E0 Relevance: 22.8, APIs: 9, Strings: 4, Instructions: 74timeCOMMON

Download Yara Rule

APIs

VariantTimeToSystemTime.OLEAUT32 ref: 1E7A80F6
GetDateFormatA.KERNEL32(00000400,00000001,?,00000000,?,00000080), ref: 1E7A8136
GetLastError.KERNEL32 ref: 1E7A8146
wsprintfA.USER32 ref: 1E7A8156
GetTimeFormatA.KERNEL32(00000400,00000000,?,00000000,?,00000080), ref: 1E7A8173
GetLastError.KERNEL32 ref: 1E7A817D
wsprintfA.USER32 ref: 1E7A818A
wsprintfA.USER32 ref: 1E7A81A9
?PyWinCoreString_FromString@@YAPAU_object@@PBDH@Z.PYWINTYPES27(?,000000FF), ref: 1E7A81B5

Strings

!illegal internal value!, xrefs: 1E7A810C
!GetDateFormat failed (%ld)!, xrefs: 1E7A8150
<PyTime:%s %s>, xrefs: 1E7A81A3
!GetTimeFormat failed (%ld)!, xrefs: 1E7A8184

Memory Dump Source

Source File: 00000011.00000002.1561923280.000000001E7A1000.00000040.00000001.01000000.00000012.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000011.00000002.1561891626.000000001E7A0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7B9000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7BE000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562197228.000000001E7C0000.00000080.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562233172.000000001E7C2000.00000004.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e7a0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Timewsprintf$ErrorFormatLast$CoreDateFromString@@String_SystemU_object@@Variant
String ID: !GetDateFormat failed (%ld)!$!GetTimeFormat failed (%ld)!$!illegal internal value!$<PyTime:%s %s>
API String ID: 3719763702-3588756600
Opcode ID: f95cc197d1464a3c8d6fc7a534e8aca17259f3a787dfc313e00603af36c51e5e
Instruction ID: 9099e477c08cce546bc260467c09b80325289a91fcb84c059db33b4550109663
Opcode Fuzzy Hash: f95cc197d1464a3c8d6fc7a534e8aca17259f3a787dfc313e00603af36c51e5e
Instruction Fuzzy Hash: 8B218172554304ABF311DA60DC89FDBB7ACEBD8710F044A1DFB44961D0EB75A509C7A2

Function 1E8C3750 Relevance: 22.8, APIs: 9, Strings: 4, Instructions: 74COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,O:VkKeyScan), ref: 1E8C375F
PyErr_SetString.PYTHON27(?,must be a unicode or byte string of length 1), ref: 1E8C3811

Strings

O:VkKeyScan, xrefs: 1E8C3759
must be a unicode or byte string of length 1, xrefs: 1E8C3804
must be a unicode string of length 1, xrefs: 1E8C37BB
must be a byte string of length 1, xrefs: 1E8C3786

Memory Dump Source

Source File: 00000011.00000002.1562490344.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 00000011.00000002.1562469835.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562702731.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562730939.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_Err_ParseStringTuple
String ID: O:VkKeyScan$must be a byte string of length 1$must be a unicode or byte string of length 1$must be a unicode string of length 1
API String ID: 385655187-4003332352
Opcode ID: 833370418f8d0fad3f391e8732fc0c41a076cd610ad0679169767ce5987f3080
Instruction ID: eea33b6af47465d55447caea648a68a4ecc0577738f8e5b72fe891f2040d5f15
Opcode Fuzzy Hash: 833370418f8d0fad3f391e8732fc0c41a076cd610ad0679169767ce5987f3080
Instruction Fuzzy Hash: FD21C0B5110210AFE3049B79D89C9DA77E5EF8B226F248169F80AC7360CB35E5D3CB51

Function 1E7A1AF0 Relevance: 22.8, APIs: 5, Strings: 8, Instructions: 52COMMON

Download Yara Rule

APIs

?PyWinObject_FromSID@@YAPAU_object@@PAX@Z.PYWINTYPES27(?,?,1E7A1D39,?), ref: 1E7A1B08
?PyWinObject_FromOLECHAR@@YAPAU_object@@PB_W@Z.PYWINTYPES27(?), ref: 1E7A1B13
Py_BuildValue.PYTHON27({s:O,s:l,s:l,s:l,s:N},MultipleTrustee,6D18CB14,MultipleTrusteeOperation,00000000,TrusteeForm,?,TrusteeType,?,Identifier,00000000), ref: 1E7A1B4F
PyErr_SetString.PYTHON27(00000000,TrusteeForm not yet supported), ref: 1E7A1B68
PyErr_SetString.PYTHON27(?,Invalid value for TrusteeForm,?,1E7A1D39,?), ref: 1E7A1B83

Strings

Invalid value for TrusteeForm, xrefs: 1E7A1B7D
TrusteeForm, xrefs: 1E7A1B38
MultipleTrustee, xrefs: 1E7A1B45
TrusteeType, xrefs: 1E7A1B32
{s:O,s:l,s:l,s:l,s:N}, xrefs: 1E7A1B4A
TrusteeForm not yet supported, xrefs: 1E7A1B62
MultipleTrusteeOperation, xrefs: 1E7A1B3F
Identifier, xrefs: 1E7A1B2C

Memory Dump Source

Source File: 00000011.00000002.1561923280.000000001E7A1000.00000040.00000001.01000000.00000012.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000011.00000002.1561891626.000000001E7A0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7B9000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7BE000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562197228.000000001E7C0000.00000080.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562233172.000000001E7C2000.00000004.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e7a0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Err_FromObject_StringU_object@@$BuildValue
String ID: Identifier$Invalid value for TrusteeForm$MultipleTrustee$MultipleTrusteeOperation$TrusteeForm$TrusteeForm not yet supported$TrusteeType${s:O,s:l,s:l,s:l,s:N}
API String ID: 2152576507-1816636059
Opcode ID: cdeeb76e36ceb581e74750b30203ec7169f0aac68b7e1b5d962bb9aa99cea7a2
Instruction ID: 21f83105d0af840428b938a51315adf12e7ae12f214347932ef7f81565744649
Opcode Fuzzy Hash: cdeeb76e36ceb581e74750b30203ec7169f0aac68b7e1b5d962bb9aa99cea7a2
Instruction Fuzzy Hash: 340169B5600210ABF214DB68EC84CE6B3A9ABCC349F0C4B18FB0593364E630E840CB55

Function 1E7A1650 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 155COMMON

Download Yara Rule

APIs

PyErr_Format.PYTHON27(?,Error reordering ACL: Unable to allocate acl of size %d,?,?,?,?,?,?,?,?,1E7A1EDA,00000000), ref: 1E7A16BC

Strings

Error reordering ACL: Unable to allocate acl of size %d, xrefs: 1E7A16B6
ReorderACL, xrefs: 1E7A17CD
ReorderACL, xrefs: 1E7A17E6
Ace type %d is not supported yet, xrefs: 1E7A1809

Memory Dump Source

Source File: 00000011.00000002.1561923280.000000001E7A1000.00000040.00000001.01000000.00000012.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000011.00000002.1561891626.000000001E7A0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7B9000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7BE000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562197228.000000001E7C0000.00000080.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562233172.000000001E7C2000.00000004.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e7a0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Err_Format
String ID: Ace type %d is not supported yet$Error reordering ACL: Unable to allocate acl of size %d$ReorderACL$ReorderACL
API String ID: 376477240-390946493
Opcode ID: ec8d0a2449a343158576c38169e3294aa5a1d412ac3ae28f82fa058b4c78a6ca
Instruction ID: ed6dcb7f9c60558c4d46b6b7f24c3b68719e0245464f1588f300acf2863d1ab4
Opcode Fuzzy Hash: ec8d0a2449a343158576c38169e3294aa5a1d412ac3ae28f82fa058b4c78a6ca
Instruction Fuzzy Hash: 735170B86083519FF304CF25E884A3BB7E9EBC8749F084B1DFA9586250D734D946CB62

Function 1E8C7EF0 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 112registryCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27 ref: 1E8C7F21
?PyWinObject_AsHKEY@@YAHPAU_object@@PAPAUHKEY__@@@Z.PYWINTYPES27(?,?,?,?), ref: 1E8C7F40
?PyWinObject_AsString@@YAHPAU_object@@PAPADHPAK@Z.PYWINTYPES27(?,?,00000001,00000000), ref: 1E8C7F5B
RegQueryValueExA.ADVAPI32(?,?,00000000,?,00000000,?), ref: 1E8C7F87
Py_BuildValue.PYTHON27(1E8D13D0,00000000,?), ref: 1E8C7FA7
73BB3B4E.MSVCR90(00000000), ref: 1E8C800D
?PyWinObject_FreeString@@YAXPAD@Z.PYWINTYPES27(?), ref: 1E8C801B

Strings

OO:RegQueryValueEx, xrefs: 1E8C7F03
RegQueryValueEx, xrefs: 1E8C7FF9

Memory Dump Source

Source File: 00000011.00000002.1562490344.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 00000011.00000002.1562469835.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562702731.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562730939.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Object_$String@@U_object@@Value$Arg_BuildFreeParseQueryTupleY__@@@
String ID: OO:RegQueryValueEx$RegQueryValueEx
API String ID: 2099248246-1921053433
Opcode ID: 4a7a1aa8182ae7015301109fcecf135db65ce4d09849cb5578d5795d36535af4
Instruction ID: 306eee98499ccb731e353381e3fbc38d9541e788477bbed4304465d9ea89da96
Opcode Fuzzy Hash: 4a7a1aa8182ae7015301109fcecf135db65ce4d09849cb5578d5795d36535af4
Instruction Fuzzy Hash: B131D672514311AFE310DF29DC88ADBB7E9EF89714F004A18F84993240E735EA45CBA7

Function 1E8CA420 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 99COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,OOO:EnumResourceLanguages,?,?,?), ref: 1E8CA456
?PyWinObject_AsHANDLE@@YAHPAU_object@@PAPAX@Z.PYWINTYPES27(?,?), ref: 1E8CA474
?PyWinObject_AsResourceIdW@@YAHPAU_object@@PAPA_WH@Z.PYWINTYPES27(?,?,00000000), ref: 1E8CA496
?PyWinObject_AsResourceIdW@@YAHPAU_object@@PAPA_WH@Z.PYWINTYPES27(?,?,00000000), ref: 1E8CA4AA
PyList_New.PYTHON27(00000000), ref: 1E8CA4B4
EnumResourceLanguagesW.KERNEL32(?,?,?,Function_0000A3C0,00000000), ref: 1E8CA4D8
GetLastError.KERNEL32 ref: 1E8CA4F5
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(EnumResourceLanguages,00000000), ref: 1E8CA501
?PyWinObject_FreeResourceId@@YAXPA_W@Z.PYWINTYPES27(?), ref: 1E8CA515
?PyWinObject_FreeResourceId@@YAXPA_W@Z.PYWINTYPES27(?), ref: 1E8CA51C

Strings

OOO:EnumResourceLanguages, xrefs: 1E8CA43A
EnumResourceLanguages, xrefs: 1E8CA4FC

Memory Dump Source

Source File: 00000011.00000002.1562490344.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 00000011.00000002.1562469835.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562702731.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562730939.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Object_Resource$U_object@@$FreeId@@$Arg_EnumErrorError@@LanguagesLastList_ParseTupleWin_
String ID: EnumResourceLanguages$OOO:EnumResourceLanguages
API String ID: 734881567-861562290
Opcode ID: bad675ad59e1b4f3cdcd7aa72b3459a27dbeb2fa18f97708cf32a1754811467a
Instruction ID: c0774c2638d42c6cd68c8e8b35c75f2045a8551a174f4e929a104f744a97a602
Opcode Fuzzy Hash: bad675ad59e1b4f3cdcd7aa72b3459a27dbeb2fa18f97708cf32a1754811467a
Instruction Fuzzy Hash: B73150B65043119FD300DFA8DC94CDBB7EDFE89214F058A1DF98A93241E634E949CBA2

Function 1E8C8EC0 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 94threadCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,OOi|O:WinHelp,?,?,?,?), ref: 1E8C8EEA
?PyWinObject_AsHANDLE@@YAHPAU_object@@PAPAX@Z.PYWINTYPES27(?,?), ref: 1E8C8F07
?PyWinObject_AsString@@YAHPAU_object@@PAPADHPAK@Z.PYWINTYPES27(?,?,00000000,00000000), ref: 1E8C8F64
PyEval_SaveThread.PYTHON27 ref: 1E8C8F73
WinHelpA.USER32(?,?,?,?), ref: 1E8C8F8F
PyEval_RestoreThread.PYTHON27(00000000), ref: 1E8C8F98
?PyWinObject_FreeString@@YAXPAD@Z.PYWINTYPES27(?), ref: 1E8C8FA3
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(WinHelp,00000000), ref: 1E8C8FB9

Strings

OOi|O:WinHelp, xrefs: 1E8C8EE4
WinHelp, xrefs: 1E8C8FB4

Memory Dump Source

Source File: 00000011.00000002.1562490344.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 00000011.00000002.1562469835.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562702731.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562730939.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Object_U_object@@$Eval_String@@Thread$Arg_Error@@FreeHelpParseRestoreSaveTupleWin_
String ID: OOi|O:WinHelp$WinHelp
API String ID: 2453526005-3128034683
Opcode ID: 1d9c47eac0c275099b39d94e1ce04d0603552ebc67847f8fc685256d39673581
Instruction ID: 9d519815855b33ee89cc602196df56b2860816fcdacfcc6ce97c58ae3aaf2e3d
Opcode Fuzzy Hash: 1d9c47eac0c275099b39d94e1ce04d0603552ebc67847f8fc685256d39673581
Instruction Fuzzy Hash: 69318F70124242AFD300DF68CD88EABB7E9BF89255F44891CF94DC3251E734E559CB66

Function 1E8C3E10 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 91COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,OOlll:InitiateSystemShutdown,?,?,?,?,?), ref: 1E8C3E36
?PyWinObject_AsString@@YAHPAU_object@@PAPADHPAK@Z.PYWINTYPES27(?,00000001,00000001,00000000), ref: 1E8C3E5C
?PyWinObject_AsString@@YAHPAU_object@@PAPADHPAK@Z.PYWINTYPES27(?,?,00000001,00000000), ref: 1E8C3E73
?PyWinObject_FreeString@@YAXPAD@Z.PYWINTYPES27(?), ref: 1E8C3E81

Strings

InitiateSystemShutdown, xrefs: 1E8C3EE0
OOlll:InitiateSystemShutdown, xrefs: 1E8C3E30

Memory Dump Source

Source File: 00000011.00000002.1562490344.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 00000011.00000002.1562469835.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562702731.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562730939.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Object_String@@$U_object@@$Arg_FreeParseTuple
String ID: InitiateSystemShutdown$OOlll:InitiateSystemShutdown
API String ID: 3103853464-804409923
Opcode ID: 96ad772f2f3f91269950edf204f5dc55568f3a471627ced70e2375cca16bfaf6
Instruction ID: 312bb687a3e4b6c24a55875ec7546afeaadea95344f896822874532197890f3a
Opcode Fuzzy Hash: 96ad772f2f3f91269950edf204f5dc55568f3a471627ced70e2375cca16bfaf6
Instruction Fuzzy Hash: 5A214A76514311AFD300DB68CC89EEB73E9FFC9204F84494DFA8993251E734E6498BA2

Function 1E8C6230 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 89COMMON

Download Yara Rule

APIs

PyErr_Format.PYTHON27(?,%s is not available on this platform,RegCopyTree), ref: 1E8C6250
PyArg_ParseTupleAndKeywords.PYTHON27(?,?,OOO:RegCopyTree,1E8D7014,?,?,?), ref: 1E8C6285

Strings

RegCopyTree, xrefs: 1E8C62F8
RegCopyTree, xrefs: 1E8C6245
%s is not available on this platform, xrefs: 1E8C624A
OOO:RegCopyTree, xrefs: 1E8C627A

Memory Dump Source

Source File: 00000011.00000002.1562490344.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 00000011.00000002.1562469835.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562702731.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562730939.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_Err_FormatKeywordsParseTuple
String ID: %s is not available on this platform$OOO:RegCopyTree$RegCopyTree$RegCopyTree
API String ID: 223827023-3951061800
Opcode ID: f6da3e202515ed75e992b77df770d76144eb07fc6488c06f22be3db4ef3cb937
Instruction ID: 0982ed2fd7570e109c5b7dfbab82c95aa3b7c237e9d778a7a5a00602a13ee555
Opcode Fuzzy Hash: f6da3e202515ed75e992b77df770d76144eb07fc6488c06f22be3db4ef3cb937
Instruction Fuzzy Hash: 35215EB1504312AFD200DF68CC94DABB7E9BFC5649F044A18F889C3251E730E94ACBA2

Function 1E8C75C0 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 89threadregistryCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,OOO:RegLoadKey,?,?,?), ref: 1E8C75E7
?PyWinObject_AsHKEY@@YAHPAU_object@@PAPAUHKEY__@@@Z.PYWINTYPES27(?,?), ref: 1E8C7604
?PyWinObject_AsString@@YAHPAU_object@@PAPADHPAK@Z.PYWINTYPES27(?,?,00000000,00000000), ref: 1E8C7623
?PyWinObject_AsString@@YAHPAU_object@@PAPADHPAK@Z.PYWINTYPES27(?,?,00000000,00000000), ref: 1E8C7638
PyEval_SaveThread.PYTHON27 ref: 1E8C7642
RegLoadKeyA.ADVAPI32(?,?,?), ref: 1E8C7659
PyEval_RestoreThread.PYTHON27(00000000), ref: 1E8C7662
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(RegLoadKey,00000000), ref: 1E8C7676
?PyWinObject_FreeString@@YAXPAD@Z.PYWINTYPES27(?), ref: 1E8C7699
?PyWinObject_FreeString@@YAXPAD@Z.PYWINTYPES27(?), ref: 1E8C76A0

Strings

RegLoadKey, xrefs: 1E8C7671
OOO:RegLoadKey, xrefs: 1E8C75D9

Memory Dump Source

Source File: 00000011.00000002.1562490344.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 00000011.00000002.1562469835.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562702731.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562730939.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Object_$String@@U_object@@$Eval_FreeThread$Arg_Error@@LoadParseRestoreSaveTupleWin_Y__@@@
String ID: OOO:RegLoadKey$RegLoadKey
API String ID: 3033533871-1174909360
Opcode ID: 8652c88fa7ee4dcd08550c00fa0d9839e84c6e7ab9836332b9de4efceaa55a91
Instruction ID: db769196a775b7d40aa12ac4039b55a1420bc7a0fae478c4ca9803d7bbc214b5
Opcode Fuzzy Hash: 8652c88fa7ee4dcd08550c00fa0d9839e84c6e7ab9836332b9de4efceaa55a91
Instruction Fuzzy Hash: 4E215EB2504311AFE700EF68DDC4CAB77EDAE89254F444A1DF949D3201E631E949CBB2

Function 03415860 Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 88memoryCOMMON

Download Yara Rule

APIs

PyErr_SetFromWindowsErr.PYTHON27(00000000), ref: 0341587F
PyErr_SetString.PYTHON27(?,GetSystemInfo() failed to retrieve CPU count), ref: 034158B1
LocalAlloc.KERNEL32(00000040), ref: 034158CC
PyErr_SetFromWindowsErr.PYTHON27(00000000), ref: 034158D9

Strings

GetSystemInfo() failed to retrieve CPU count, xrefs: 034158AB
CallNtPowerInformation syscall failed, xrefs: 034158FF
GetActiveProcessorCount() not available; using GetSystemInfo(), xrefs: 0341588D

Memory Dump Source

Source File: 00000011.00000002.1560676867.0000000003411000.00000040.00000001.01000000.0000000F.sdmp, Offset: 03410000, based on PE: true

Associated: 00000011.00000002.1560637646.0000000003410000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560676867.000000000341B000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560676867.000000000341F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560836323.0000000003423000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_3410000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Err_$FromWindows$AllocLocalString
String ID: CallNtPowerInformation syscall failed$GetActiveProcessorCount() not available; using GetSystemInfo()$GetSystemInfo() failed to retrieve CPU count
API String ID: 1553409448-865213082
Opcode ID: 0520ae995e32c1950a55a1df0230455cea6727f5139cad3c6b7e3c006aaf8e41
Instruction ID: 56479da784cb1d025c7b9d3ba89af360b05c21adf0e750d85d5fbd4eb0ac2d89
Opcode Fuzzy Hash: 0520ae995e32c1950a55a1df0230455cea6727f5139cad3c6b7e3c006aaf8e41
Instruction Fuzzy Hash: 1421F672A42E105BD720A7A8AC54ECB77A8DFC5762F180462FD05EF344D760E424C6ED

Function 1E8C8030 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 86COMMON

Download Yara Rule

APIs

PyErr_Format.PYTHON27(?,%s is not available on this platform,RegRestoreKey), ref: 1E8C8050
PyArg_ParseTupleAndKeywords.PYTHON27(?,?,OO|k:RegRestoreKey,1E8D7088,?,?,?), ref: 1E8C8089

Strings

RegRestoreKey, xrefs: 1E8C8045
RegRestoreKey, xrefs: 1E8C80E5
OO|k:RegRestoreKey, xrefs: 1E8C807A
%s is not available on this platform, xrefs: 1E8C804A

Memory Dump Source

Source File: 00000011.00000002.1562490344.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 00000011.00000002.1562469835.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562702731.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562730939.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_Err_FormatKeywordsParseTuple
String ID: %s is not available on this platform$OO|k:RegRestoreKey$RegRestoreKey$RegRestoreKey
API String ID: 223827023-2315993601
Opcode ID: 34767345ae3486f3f1005ad0ceb3aedce25f7ebefa6af06e1068dbd61f4711da
Instruction ID: 1d57f0b7dc2aa30f1588a0fa50cc106ba422c4a5bdb0fce39d4f22198050bbf6
Opcode Fuzzy Hash: 34767345ae3486f3f1005ad0ceb3aedce25f7ebefa6af06e1068dbd61f4711da
Instruction Fuzzy Hash: 01216DB1514221AFD204DF18CD889DBB3E9FF89A15F448618F84DD3311E631E959CBA6

Function 1E8C1510 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 84COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27 ref: 1E8C1534
?PyWinObject_AsString@@YAHPAU_object@@PAPADHPAK@Z.PYWINTYPES27(?,00000000,00000000,00000000,?,?,?,?,?,?), ref: 1E8C155A
?PyWinObject_AsString@@YAHPAU_object@@PAPADHPAK@Z.PYWINTYPES27(?,?,00000000,00000000,?,?,?,?,?,?,?,?,?), ref: 1E8C1571
?PyWinObject_FreeString@@YAXPAD@Z.PYWINTYPES27(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 1E8C157F

Strings

CopyFile, xrefs: 1E8C15D4
OO|i:CopyFile, xrefs: 1E8C1526

Memory Dump Source

Source File: 00000011.00000002.1562490344.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 00000011.00000002.1562469835.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562702731.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562730939.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Object_String@@$U_object@@$Arg_FreeParseTuple
String ID: CopyFile$OO|i:CopyFile
API String ID: 3103853464-317066227
Opcode ID: 746ddc09d9fa6dc34148626cf1ff41e6febbb03f3fe9b5fd226b44c5bbb2fbbb
Instruction ID: b84d3b3e2b9da1d41e1f228d1f595a2875256bb4020c8dbf0bd581cffc15d9cf
Opcode Fuzzy Hash: 746ddc09d9fa6dc34148626cf1ff41e6febbb03f3fe9b5fd226b44c5bbb2fbbb
Instruction Fuzzy Hash: C5218175514211AFE304DB68CCC9FEB73E8EF89604F848959F94DD3241E630E9488BA2

Function 1E8C3B70 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 84threadCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,O:GetModuleFileNameW,?), ref: 1E8C3B8F
?PyWinObject_AsHANDLE@@YAHPAU_object@@PAPAX@Z.PYWINTYPES27(?,?), ref: 1E8C3BAE
73BB3B4E.MSVCR90(00000000), ref: 1E8C3BC5
PyEval_SaveThread.PYTHON27 ref: 1E8C3BE3
GetModuleFileNameW.KERNEL32(?,00000000,00000104), ref: 1E8C3BF2
PyEval_RestoreThread.PYTHON27(00000000), ref: 1E8C3BFB
PyErr_NoMemory.PYTHON27 ref: 1E8C3C0F
73BB3B4E.MSVCR90(00000000), ref: 1E8C3C3C

Strings

O:GetModuleFileNameW, xrefs: 1E8C3B7E
GetModuleFileNameW, xrefs: 1E8C3C19

Memory Dump Source

Source File: 00000011.00000002.1562490344.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 00000011.00000002.1562469835.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562702731.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562730939.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Eval_Thread$Arg_Err_FileMemoryModuleNameObject_ParseRestoreSaveTupleU_object@@
String ID: GetModuleFileNameW$O:GetModuleFileNameW
API String ID: 1490344696-2665633720
Opcode ID: fec24e89418b3e6215c2b628e49a699350bf77b7e5af282600bda65151863be3
Instruction ID: aa566293252cca3b485a453cc5da0aa43dd39225ecac4241e7e382b6000414a9
Opcode Fuzzy Hash: fec24e89418b3e6215c2b628e49a699350bf77b7e5af282600bda65151863be3
Instruction Fuzzy Hash: B521B376500211AFE3109B65ED8C9EB7BE9AFC2711F004668FC4EC3200E735D65AC6A2

Function 03415E90 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 84COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000410,00000000,0341253C,00000000,?,0341253C,?), ref: 03415EA7
GetLastError.KERNEL32(?,0341253C,?), ref: 03415EB3

Strings

OpenProcess(PROCESS_VM_READ), xrefs: 03415EE2
pir: GetExitCodeProcess() -> ERROR_ACCESS_DENIED, xrefs: 03415F3F
pir: OpenProcess() -> INVALID_PARAMETER, xrefs: 03415EBE
pir: GetExitCodeProcess() -> STILL_ACTIVE, xrefs: 03415F16
pir: OpenProcess() ACCESS_DENIED, xrefs: 03415EDB
GetExitCodeProcess, xrefs: 03415F58

Memory Dump Source

Source File: 00000011.00000002.1560676867.0000000003411000.00000040.00000001.01000000.0000000F.sdmp, Offset: 03410000, based on PE: true

Associated: 00000011.00000002.1560637646.0000000003410000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560676867.000000000341B000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560676867.000000000341F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560836323.0000000003423000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_3410000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: ErrorLastOpenProcess
String ID: GetExitCodeProcess$OpenProcess(PROCESS_VM_READ)$pir: GetExitCodeProcess() -> ERROR_ACCESS_DENIED$pir: GetExitCodeProcess() -> STILL_ACTIVE$pir: OpenProcess() -> INVALID_PARAMETER$pir: OpenProcess() ACCESS_DENIED
API String ID: 919517065-509861091
Opcode ID: 6024f74a7663c152e7397384c129767d55034cc0939589019e77bc971e2315ba
Instruction ID: 6a133f7c0158dc414128dc157e34f8f381312dbaadb0da08a176b478db9816c2
Opcode Fuzzy Hash: 6024f74a7663c152e7397384c129767d55034cc0939589019e77bc971e2315ba
Instruction Fuzzy Hash: 47113A76A88F002ED560E638BC899EF37988BC3631B5442E7F124DC284E76084E0819E

Function 1E8C3A90 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 83threadCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,O:GetModuleFileName,?), ref: 1E8C3AAF
?PyWinObject_AsHANDLE@@YAHPAU_object@@PAPAX@Z.PYWINTYPES27(?,?), ref: 1E8C3ACE
73BB3B4E.MSVCR90(00000000), ref: 1E8C3AE5
PyEval_SaveThread.PYTHON27 ref: 1E8C3B00
GetModuleFileNameA.KERNEL32(?,00000000,00000104), ref: 1E8C3B0F
PyEval_RestoreThread.PYTHON27(00000000), ref: 1E8C3B18
PyErr_NoMemory.PYTHON27 ref: 1E8C3B2C
73BB3B4E.MSVCR90(00000000), ref: 1E8C3B5B

Strings

GetModuleFileName, xrefs: 1E8C3B36
O:GetModuleFileName, xrefs: 1E8C3A9E

Memory Dump Source

Source File: 00000011.00000002.1562490344.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 00000011.00000002.1562469835.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562702731.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562730939.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Eval_Thread$Arg_Err_FileMemoryModuleNameObject_ParseRestoreSaveTupleU_object@@
String ID: GetModuleFileName$O:GetModuleFileName
API String ID: 1490344696-2842272935
Opcode ID: 03d403be442bc3eed99ebb5c07f02df8a46e78307f5bda0b06023e0ec0911065
Instruction ID: 53940a33e794e5847157e4a735daf2c544b7d082e00d4bc445c4151c0c8c9cb8
Opcode Fuzzy Hash: 03d403be442bc3eed99ebb5c07f02df8a46e78307f5bda0b06023e0ec0911065
Instruction Fuzzy Hash: E321C575404211AFE300DB69AC8C9DBB7E9BFC2615F040668FD4EC3201E731D65AC6A7

Function 1E8C6800 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 81COMMON

Download Yara Rule

APIs

PyErr_Format.PYTHON27(?,%s is not available on this platform,RegDeleteTree), ref: 1E8C6820
PyArg_ParseTupleAndKeywords.PYTHON27(?,?,OO:RegDeleteTree,1E8D7058,?,?), ref: 1E8C6850

Strings

%s is not available on this platform, xrefs: 1E8C681A
RegDeleteTree, xrefs: 1E8C6815
OO:RegDeleteTree, xrefs: 1E8C6845
RegDeleteTree, xrefs: 1E8C68A8

Memory Dump Source

Source File: 00000011.00000002.1562490344.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 00000011.00000002.1562469835.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562702731.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562730939.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_Err_FormatKeywordsParseTuple
String ID: %s is not available on this platform$OO:RegDeleteTree$RegDeleteTree$RegDeleteTree
API String ID: 223827023-1985079115
Opcode ID: e086dc3ab64c79f64efc9e6e5591929dc87e1a73162660bd0920310d61f102e5
Instruction ID: 040caf5378a44e35a8b4502c4df40e7e10b3274990dc3c32fb4c763f1d9a927c
Opcode Fuzzy Hash: e086dc3ab64c79f64efc9e6e5591929dc87e1a73162660bd0920310d61f102e5
Instruction Fuzzy Hash: 762160B5500221AFE700DB58CC889EB73E9FF85749F848918F85DD3351E231E959CBA2

Function 1E8C29E0 Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 79COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,:GetConsoleTitle), ref: 1E8C29F8
SetLastError.KERNEL32(00000000), ref: 1E8C2A0B
73BB3B4E.MSVCR90(00000000), ref: 1E8C2A1D
GetConsoleTitleA.KERNEL32(00000000,00000400), ref: 1E8C2A3D
GetLastError.KERNEL32 ref: 1E8C2A45
?PyWinObject_FromTCHAR@@YAPAU_object@@PBDH@Z.PYWINTYPES27(00000000,000000FF), ref: 1E8C2A57
73BB3B4E.MSVCR90(00000000), ref: 1E8C2A63

Strings

:GetConsoleTitle, xrefs: 1E8C29E7
GetConsoleTitle, xrefs: 1E8C2A93
GetConsoleTitle: unable to allocate %d bytes, xrefs: 1E8C2A7C

Memory Dump Source

Source File: 00000011.00000002.1562490344.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 00000011.00000002.1562469835.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562702731.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562730939.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: ErrorLast$Arg_ConsoleFromObject_ParseTitleTupleU_object@@
String ID: :GetConsoleTitle$GetConsoleTitle$GetConsoleTitle: unable to allocate %d bytes
API String ID: 221919973-4097672822
Opcode ID: ae87bfdaff589fe9f2782dacb00f6526f95543153cea977352e9ab3ed3f39dac
Instruction ID: 56e757ac0e8889e62d4ddda27037944d67db03f8b04a98897218bd30d371e9b0
Opcode Fuzzy Hash: ae87bfdaff589fe9f2782dacb00f6526f95543153cea977352e9ab3ed3f39dac
Instruction Fuzzy Hash: A3112C766416315FE2119769AC8CACB77D5EFC7B76F140225F90EC3380D730D44186A6

Function 1E8C35C0 Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 66threadCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,O:GetFileAttributes), ref: 1E8C35CF
PyEval_SaveThread.PYTHON27 ref: 1E8C35F0
GetFileAttributesA.KERNEL32(?), ref: 1E8C3600
PyEval_RestoreThread.PYTHON27(00000000), ref: 1E8C3628
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(GetFileAttributes,00000000), ref: 1E8C363D

Strings

O:GetFileAttributes, xrefs: 1E8C35C9
GetFileAttributes, xrefs: 1E8C3638
pathName arg must be string or unicode, xrefs: 1E8C3665

Memory Dump Source

Source File: 00000011.00000002.1562490344.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 00000011.00000002.1562469835.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562702731.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562730939.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Eval_Thread$Arg_AttributesError@@FileParseRestoreSaveTupleU_object@@Win_
String ID: GetFileAttributes$O:GetFileAttributes$pathName arg must be string or unicode
API String ID: 1146278787-533566742
Opcode ID: b07d0bd861b3969a7672670ed8560af901903c2490bdf57cd8034a3fb870de05
Instruction ID: d80e112462cd3708e11500b21013632e73c2a4cbc39ff36c3ddb443d9e22c4fb
Opcode Fuzzy Hash: b07d0bd861b3969a7672670ed8560af901903c2490bdf57cd8034a3fb870de05
Instruction Fuzzy Hash: A811C471600110AFE30097B9EC8CECA77E9EF86266F108269F94EC3391CB30D592DA61

Function 1E8CB150 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 63COMMON

Download Yara Rule

APIs

PyErr_Format.PYTHON27(?,%s is not available on this platform,SetSystemPowerState), ref: 1E8CB16E
PyArg_ParseTuple.PYTHON27(?,OO:SetSystemPowerState,?,?), ref: 1E8CB18F

Strings

OO:SetSystemPowerState, xrefs: 1E8CB189
%s is not available on this platform, xrefs: 1E8CB168
SetSystemPowerState, xrefs: 1E8CB163
SetSystemPowerState, xrefs: 1E8CB1E2

Memory Dump Source

Source File: 00000011.00000002.1562490344.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 00000011.00000002.1562469835.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562702731.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562730939.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_Err_FormatParseTuple
String ID: %s is not available on this platform$OO:SetSystemPowerState$SetSystemPowerState$SetSystemPowerState
API String ID: 361908667-2688284745
Opcode ID: 63fd1ccc1beff96c6f4c27cfac612e23d304cc30666ad37b5d667cd7ee0893b7
Instruction ID: 9c863ff3ff59c01caebb4d4c16716117c1d5b00355675fee60fa775778c3c95b
Opcode Fuzzy Hash: 63fd1ccc1beff96c6f4c27cfac612e23d304cc30666ad37b5d667cd7ee0893b7
Instruction Fuzzy Hash: CF110AB2900221AFD710DB78ECCCD8677E8BF85615F444525F94DD3300E235D959CBA1

Function 1E8C7050 Relevance: 19.7, APIs: 13, Instructions: 159COMMON

Download Yara Rule

APIs

PyErr_NoMemory.PYTHON27 ref: 1E8C708A
?PyWinObject_FromTCHAR@@YAPAU_object@@PBDH@Z.PYWINTYPES27(1E8CF587,000000FF), ref: 1E8C718C
?PyWinObject_AsMultipleString@@YAHPAU_object@@PAPADHPAK@Z.PYWINTYPES27(?,?,00000001), ref: 1E8C71D3
?PyWinObject_AsReadBuffer@@YAHPAU_object@@PAPAXPAKH@Z.PYWINTYPES27(?,?,?,00000001), ref: 1E8C71EB

Memory Dump Source

Source File: 00000011.00000002.1562490344.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 00000011.00000002.1562469835.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562702731.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562730939.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Object_U_object@@$Buffer@@Err_FromMemoryMultipleReadString@@
String ID:
API String ID: 3829625989-0
Opcode ID: 077a660928327377741a5378f25fb64cf86d25a3f417acdde52cc903b11eed7b
Instruction ID: 8275b145f2a1b815e64553742487605387e77bf2e640b7dc9a2f97e5a6ab76f9
Opcode Fuzzy Hash: 077a660928327377741a5378f25fb64cf86d25a3f417acdde52cc903b11eed7b
Instruction Fuzzy Hash: 49414FB52001129FE710AFBCE8C87D977E5EF86331F20426AE559CB290D772D492DB61

Function 03414BC7 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 234COMMON

Download Yara Rule

APIs

PyList_New.PYTHON27(00000000), ref: 03414C5B
PyArg_ParseTuple.PYTHON27(?,0341B81C,?), ref: 03414C8B
VirtualQueryEx.KERNEL32(00000000,00000000,?,0000001C), ref: 03414CCC
GetMappedFileNameW.PSAPI(00000000,?,?,00000208), ref: 03414CF6
PyUnicodeUCS2_FromWideChar.PYTHON27(?,?,00000000,?,?,00000208), ref: 03414D25
Py_BuildValue.PYTHON27((ksOI),?,00000000,?), ref: 03414D52
PyList_Append.PYTHON27(?,00000000), ref: 03414D67

Strings

(ksOI), xrefs: 03414D4D

Memory Dump Source

Source File: 00000011.00000002.1560676867.0000000003411000.00000040.00000001.01000000.0000000F.sdmp, Offset: 03410000, based on PE: true

Associated: 00000011.00000002.1560637646.0000000003410000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560676867.000000000341B000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560676867.000000000341F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560836323.0000000003423000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_3410000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: List_$AppendArg_BuildCharFileFromMappedNameParseQueryTupleUnicodeValueVirtualWide
String ID: (ksOI)
API String ID: 1590903978-3583691019
Opcode ID: 3b61468b4f37aaecc1a01e80e948fcae84f1f2d27d2eb23a3012e6e121227324
Instruction ID: 5bd932565920d518d89f948853a62c48b856e6012233cd219ec5c63930ca5108
Opcode Fuzzy Hash: 3b61468b4f37aaecc1a01e80e948fcae84f1f2d27d2eb23a3012e6e121227324
Instruction Fuzzy Hash: B0511671500705AFDB10DF61DC84AAB77F8EF81320F094A69E9558F341E334E915CBA6

Function 1E7A2050 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 152COMMON

Download Yara Rule

APIs

PyErr_Format.PYTHON27(?,%s not supported by this version of Windows,?,?,775FFC90,1E7A222A,775FFC90,AddAccessAllowedAceEx,?,?,?,?), ref: 1E7A206D
?PyWinObject_AsSID@@YAHPAU_object@@PAPAXH@Z.PYWINTYPES27(775FFC90,?,00000000,?,?,775FFC90,1E7A222A,775FFC90,AddAccessAllowedAceEx,?,?,?,?), ref: 1E7A208D

Strings

%s: unable to allocated %d bytes, xrefs: 1E7A211F
%s not supported by this version of Windows, xrefs: 1E7A2067

Memory Dump Source

Source File: 00000011.00000002.1561923280.000000001E7A1000.00000040.00000001.01000000.00000012.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000011.00000002.1561891626.000000001E7A0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7B9000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7BE000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562197228.000000001E7C0000.00000080.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562233172.000000001E7C2000.00000004.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e7a0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Err_FormatObject_U_object@@
String ID: %s not supported by this version of Windows$%s: unable to allocated %d bytes
API String ID: 4084493908-968908422
Opcode ID: 3f0d23ceea1720557240d84416233b3f703dc2bc2ef8c790a8380ea647540491
Instruction ID: fa47d4dcbd80a48fd2b92525f47c634ed64b342c86fd3c6888121501751d20f8
Opcode Fuzzy Hash: 3f0d23ceea1720557240d84416233b3f703dc2bc2ef8c790a8380ea647540491
Instruction Fuzzy Hash: 594186B6605250AFF204DB54EC84D7B73A9EFC8665F184B1DFB4587250DB31E811CBA2

Function 1E7A1DC0 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 149COMMON

Download Yara Rule

APIs

PyErr_Format.PYTHON27(?,%s not supported by this version of Windows,?,6D071680,?,?,1E7A1F84,775FF170,AddAccesAllowedAce,?,?,?,?), ref: 1E7A1DE5
?PyWinObject_AsSID@@YAHPAU_object@@PAPAXH@Z.PYWINTYPES27(?,?,00000000,6D071680,?,?,1E7A1F84,775FF170,AddAccesAllowedAce,?,?,?,?), ref: 1E7A1DFE

Strings

%s not supported by this version of Windows, xrefs: 1E7A1DDF
%s: unable to allocated %d bytes, xrefs: 1E7A1E8A

Memory Dump Source

Source File: 00000011.00000002.1561923280.000000001E7A1000.00000040.00000001.01000000.00000012.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000011.00000002.1561891626.000000001E7A0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7B9000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7BE000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562197228.000000001E7C0000.00000080.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562233172.000000001E7C2000.00000004.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e7a0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Err_FormatObject_U_object@@
String ID: %s not supported by this version of Windows$%s: unable to allocated %d bytes
API String ID: 4084493908-968908422
Opcode ID: 83aeed25d9db77235033ee2e336a72271786b7f81dbf0ec382abc557527055ca
Instruction ID: 65c702a6374c165e0ca3dd9a0efee3b3ffc7f703bab10d4263cb4f8cb546ebc3
Opcode Fuzzy Hash: 83aeed25d9db77235033ee2e336a72271786b7f81dbf0ec382abc557527055ca
Instruction Fuzzy Hash: 8641A6B6605251AFF2049B14FC84D6BB3E9EFC8666F1C0B19F74587250EB31E801C7A1

Function 1E7A1970 Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 125COMMON

Download Yara Rule

APIs

PyTuple_New.PYTHON27(00000000,-000000FF,-0000000C,00000000,00000000,?,?,1E7A1C5A,?,-0000000C), ref: 1E7A19BB
PyArg_ParseTupleAndKeywords.PYTHON27(00000000,?,llO|Ol,1E7B9270,?,?,?,?,?,?,1E7A1C5A,?,-0000000C), ref: 1E7A19E6
PyErr_SetString.PYTHON27(?,1E7AD558), ref: 1E7A1A1B

Strings

Invalid value for TrusteeForm, xrefs: 1E7A1A9C
Identifier must be string/unicode when TrusteeForm = TRUSTEE_IS_NAME, xrefs: 1E7A1A7C
TrusteeForm not yet supported, xrefs: 1E7A1A8C
llO|Ol, xrefs: 1E7A19DF
Identifier must be PySID object when TrusteeForm = TRUSTEE_IS_SID, xrefs: 1E7A1A56

Memory Dump Source

Source File: 00000011.00000002.1561923280.000000001E7A1000.00000040.00000001.01000000.00000012.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000011.00000002.1561891626.000000001E7A0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7B9000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7BE000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562197228.000000001E7C0000.00000080.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562233172.000000001E7C2000.00000004.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e7a0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_Err_KeywordsParseStringTupleTuple_
String ID: Identifier must be PySID object when TrusteeForm = TRUSTEE_IS_SID$Identifier must be string/unicode when TrusteeForm = TRUSTEE_IS_NAME$Invalid value for TrusteeForm$TrusteeForm not yet supported$llO|Ol
API String ID: 3950017715-2902864406
Opcode ID: eea8340ebd8b0c5952024028433a9462b6d69b1e4de841774672c433f218f2f2
Instruction ID: 56eddf4b76f30b41488cb9f019ce5fa7e382ec5594df802fca3f9e569981e972
Opcode Fuzzy Hash: eea8340ebd8b0c5952024028433a9462b6d69b1e4de841774672c433f218f2f2
Instruction Fuzzy Hash: 0C415EB59002029FF304DF15DC80D97B7E9FBC9654B088B59FA5987360E730E905CB91

Function 03411970 Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 106COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 034119B0
73BB3B4E.MSVCR90(00000000), ref: 034119C0
GetLogicalProcessorInformationEx.KERNELBASE(0000FFFF,00000000,?), ref: 034119E8
73BB3B4E.MSVCR90(00000000), ref: 03411A14
Py_BuildValue.PYTHON27(0341B284,00000000), ref: 03411A27

Strings

GetLogicalProcessorInformationEx() returned , xrefs: 03411A4B
GetLogicalProcessorInformationEx() count was 0, xrefs: 03411A65
Win < 7; cpu_count_phys() forced to None, xrefs: 0341198C

Memory Dump Source

Source File: 00000011.00000002.1560676867.0000000003411000.00000040.00000001.01000000.0000000F.sdmp, Offset: 03410000, based on PE: true

Associated: 00000011.00000002.1560637646.0000000003410000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560676867.000000000341B000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560676867.000000000341F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560836323.0000000003423000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_3410000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: BuildErrorInformationLastLogicalProcessorValue
String ID: GetLogicalProcessorInformationEx() count was 0$GetLogicalProcessorInformationEx() returned $Win < 7; cpu_count_phys() forced to None
API String ID: 2362883678-2290087675
Opcode ID: ef862d7921a979ea9a8b02e1d33d028fe2fa52cafd6bce92c8dd14a0deb3bcfd
Instruction ID: 4c9bfb238750081b7ec6913e87063cc2bcd123cf2c434af8a80620a1800904d7
Opcode Fuzzy Hash: ef862d7921a979ea9a8b02e1d33d028fe2fa52cafd6bce92c8dd14a0deb3bcfd
Instruction Fuzzy Hash: 20314935A40A055FC310EB94FC4497FFB98EF81691B1C053AEE169E304EB619529C7EA

Function 1E8C9FB0 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 101COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,OOOO|H:UpdateResource,?,?,?,?,?), ref: 1E8C9FE5
?PyWinObject_AsHANDLE@@YAHPAU_object@@PAPAX@Z.PYWINTYPES27(?,?), ref: 1E8CA002
?PyWinObject_AsResourceIdW@@YAHPAU_object@@PAPA_WH@Z.PYWINTYPES27(?,?,00000000), ref: 1E8CA024
?PyWinObject_AsResourceIdW@@YAHPAU_object@@PAPA_WH@Z.PYWINTYPES27(?,?,00000000), ref: 1E8CA038
?PyWinObject_AsReadBuffer@@YAHPAU_object@@PAPAXPAKH@Z.PYWINTYPES27(?,?,?,00000001), ref: 1E8CA052
UpdateResourceW.KERNEL32(?,?,?,?,?,?), ref: 1E8CA07D
?PyWinObject_FreeResourceId@@YAXPA_W@Z.PYWINTYPES27(?), ref: 1E8CA0B0
?PyWinObject_FreeResourceId@@YAXPA_W@Z.PYWINTYPES27(?), ref: 1E8CA0B7

Strings

UpdateResource, xrefs: 1E8CA097
OOOO|H:UpdateResource, xrefs: 1E8C9FD3

Memory Dump Source

Source File: 00000011.00000002.1562490344.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 00000011.00000002.1562469835.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562702731.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562730939.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Object_$Resource$U_object@@$FreeId@@$Arg_Buffer@@ParseReadTupleUpdate
String ID: OOOO|H:UpdateResource$UpdateResource
API String ID: 132849400-879542628
Opcode ID: 0cd9e45aa350622be9a3e14041c4ede15daaaeb799517808782204baf7c2d153
Instruction ID: fd8078a47d40d457e9ba2da89bd67ec3d6951b53395f9d389f6f4cdec9179e88
Opcode Fuzzy Hash: 0cd9e45aa350622be9a3e14041c4ede15daaaeb799517808782204baf7c2d153
Instruction Fuzzy Hash: BF3119B6514341AFD304DF59CC94DABB7E9BFC9244F048A0DF989D3240EA31EA44CBA2

Function 1E8CBA00 Relevance: 19.3, APIs: 9, Strings: 2, Instructions: 97COMMON

Download Yara Rule

APIs

PyGILState_Ensure.PYTHON27 ref: 1E8CBA1B
Py_BuildValue.PYTHON27((i),?), ref: 1E8CBA3B
PyGILState_Release.PYTHON27(00000000), ref: 1E8CBA4B
PyObject_Call.PYTHON27(?,00000000,00000000), ref: 1E8CBA9F
PySys_WriteStderr.PYTHON27(ConsoleCtrlHandler function failed), ref: 1E8CBAAF
PyErr_Print.PYTHON27 ref: 1E8CBAB8
PyErr_Clear.PYTHON27 ref: 1E8CBABE
PyGILState_Release.PYTHON27(?), ref: 1E8CBB01

Strings

(i), xrefs: 1E8CBA32
ConsoleCtrlHandler function failed, xrefs: 1E8CBAAA

Memory Dump Source

Source File: 00000011.00000002.1562490344.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 00000011.00000002.1562469835.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562702731.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562730939.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: State_$Err_Release$BuildCallClearEnsureObject_PrintStderrSys_ValueWrite
String ID: (i)$ConsoleCtrlHandler function failed
API String ID: 4176950722-3292405424
Opcode ID: e604332fc568f453b9d3cd10b08c4b301b17788021c8d800f8076ecd8a80aeaa
Instruction ID: 97a5726d800a9ee6c9b267abc8ac720d6e1804a5f7b231dfc411550cc3870f6d
Opcode Fuzzy Hash: e604332fc568f453b9d3cd10b08c4b301b17788021c8d800f8076ecd8a80aeaa
Instruction Fuzzy Hash: 933106B2540B519FD300DF58D888A8BB7E4FB46724F044B29F84A87750D739ED81CB92

Function 1E8C9220 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 94threadwindowCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27 ref: 1E8C926A
?PyWinObject_AsHANDLE@@YAHPAU_object@@PAPAX@Z.PYWINTYPES27(?,?,?,?,?,?,?,?,?), ref: 1E8C9287
?PyWinObject_AsString@@YAHPAU_object@@PAPADHPAK@Z.PYWINTYPES27(?,?,00000000,00000000,?,?,?,?,?,?,?,?), ref: 1E8C92A6
?PyWinObject_AsString@@YAHPAU_object@@PAPADHPAK@Z.PYWINTYPES27(?,?,00000001,00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 1E8C92BC
PyEval_SaveThread.PYTHON27(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 1E8C92C5
MessageBoxExA.USER32(?,?,?,?,?), ref: 1E8C92E6
PyEval_RestoreThread.PYTHON27(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 1E8C92EF
Py_BuildValue.PYTHON27(1E8D1780,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 1E8C92FB
?PyWinObject_FreeString@@YAXPAD@Z.PYWINTYPES27(?,?,?,?,?,?,?,?,?), ref: 1E8C9311
?PyWinObject_FreeString@@YAXPAD@Z.PYWINTYPES27(?,?,?,?,?,?,?,?,?), ref: 1E8C9318

Strings

OO|Oli:MessageBox(Ex), xrefs: 1E8C924C

Memory Dump Source

Source File: 00000011.00000002.1562490344.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 00000011.00000002.1562469835.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562702731.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562730939.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Object_$String@@$U_object@@$Eval_FreeThread$Arg_BuildMessageParseRestoreSaveTupleValue
String ID: OO|Oli:MessageBox(Ex)
API String ID: 619529236-3619530671
Opcode ID: 1bbc5ed398ed5761120f78669298df9200f0a1989dbffead5a3db7215f20e15e
Instruction ID: a04408fa2644c845f173f4c730ed22b115f0f5b651eb1b3156f58a6fdb298661
Opcode Fuzzy Hash: 1bbc5ed398ed5761120f78669298df9200f0a1989dbffead5a3db7215f20e15e
Instruction Fuzzy Hash: 9B314EB2504311AFD304DFA9DD84C9BB7E9AFC9614F044A0DF989D3250E730D949CBA2

Function 1E8C69C0 Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 93registryCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,Oi:RegEnumKey,?,?), ref: 1E8C69D9
?PyWinObject_AsHKEY@@YAHPAU_object@@PAPAUHKEY__@@@Z.PYWINTYPES27(?,?), ref: 1E8C69F9
RegQueryInfoKeyA.ADVAPI32(?,00000000,00000000,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000), ref: 1E8C6A22
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(RegQueryInfoKey,00000000), ref: 1E8C6A32

Strings

Oi:RegEnumKey, xrefs: 1E8C69D3
RegQueryInfoKey, xrefs: 1E8C6A2D
RegEnumKey, xrefs: 1E8C6A69

Memory Dump Source

Source File: 00000011.00000002.1562490344.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 00000011.00000002.1562469835.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562702731.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562730939.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: U_object@@$Arg_Error@@InfoObject_ParseQueryTupleWin_Y__@@@
String ID: Oi:RegEnumKey$RegEnumKey$RegQueryInfoKey
API String ID: 1520217418-336487990
Opcode ID: f5aacfa418798ca1b384e398378a0eda06950a28b611639fb3efa39e33725bef
Instruction ID: 37cf65dfacb88f3f2d66db031d035c8689c27e9f145bb02fa306ddb16131ae5a
Opcode Fuzzy Hash: f5aacfa418798ca1b384e398378a0eda06950a28b611639fb3efa39e33725bef
Instruction Fuzzy Hash: FB21B835A00118ABDB10DB99DC4ABFF777DEB85625F004265FE18D3240EB30A565D7E1

Function 1E8CC7D0 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 87COMMON

Download Yara Rule

APIs

PyErr_Format.PYTHON27(?,%s is not available on this platform,EnumDisplaySettingsEx), ref: 1E8CC7F3
PyArg_ParseTupleAndKeywords.PYTHON27(?,?,|Okk:EnumDisplaySettingsEx,1E8D7F80,?,?,?), ref: 1E8CC843

Strings

EnumDisplaySettingsEx, xrefs: 1E8CC7E8
%s is not available on this platform, xrefs: 1E8CC7ED
EnumDisplaySettingsEx, xrefs: 1E8CC8B0
|Okk:EnumDisplaySettingsEx, xrefs: 1E8CC830

Memory Dump Source

Source File: 00000011.00000002.1562490344.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 00000011.00000002.1562469835.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562702731.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562730939.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_Err_FormatKeywordsParseTuple
String ID: %s is not available on this platform$EnumDisplaySettingsEx$EnumDisplaySettingsEx$|Okk:EnumDisplaySettingsEx
API String ID: 223827023-1665988883
Opcode ID: 59bf1633497b1cd8ca634a5840f14c559329578e8ea7eba20c916d213a056d8e
Instruction ID: 7eb45e5e3b26c37f8ff8979245972a44c19be8e58934fc529b4c2dbc2d2ac67b
Opcode Fuzzy Hash: 59bf1633497b1cd8ca634a5840f14c559329578e8ea7eba20c916d213a056d8e
Instruction Fuzzy Hash: B63147B1514311ABE214DB28DC88FAB7BE8FF89644F404A28F48993241E334D958CBA6

Function 1E8CA1C0 Relevance: 19.3, APIs: 9, Strings: 2, Instructions: 84COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27 ref: 1E8CA1DF
?PyWinObject_AsHANDLE@@YAHPAU_object@@PAPAX@Z.PYWINTYPES27(?,?), ref: 1E8CA1FC
?PyWinObject_AsResourceIdA@@YAHPAU_object@@PAPADH@Z.PYWINTYPES27(?,00000000,00000000), ref: 1E8CA215
PyList_New.PYTHON27(00000000), ref: 1E8CA225
EnumResourceNamesA.KERNEL32(?,?,Function_0000A150,00000000), ref: 1E8CA244
PyErr_Occurred.PYTHON27 ref: 1E8CA24E
?PyWinObject_FreeResourceId@@YAXPAD@Z.PYWINTYPES27(?), ref: 1E8CA2A0

Strings

EnumResourceNames, xrefs: 1E8CA27A
OO:EnumResourceNames, xrefs: 1E8CA1D1

Memory Dump Source

Source File: 00000011.00000002.1562490344.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 00000011.00000002.1562469835.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562702731.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562730939.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Object_Resource$U_object@@$Arg_EnumErr_FreeId@@List_NamesOccurredParseTuple
String ID: EnumResourceNames$OO:EnumResourceNames
API String ID: 1632480692-2028383064
Opcode ID: d962eb60ba70a29a62c4f3619c56ab9a1a567397f324369c3388793ed8431768
Instruction ID: 1a21ba4367a68eda478ebbd9f826bae8ad56db6ae5c82ea57088a47b18ab3c35
Opcode Fuzzy Hash: d962eb60ba70a29a62c4f3619c56ab9a1a567397f324369c3388793ed8431768
Instruction Fuzzy Hash: E4219474500222AFE310DBB4CD88ADBB7E9BF82615F004B59F95EC3290E735D945CB92

Function 1E8C5E10 Relevance: 19.3, APIs: 9, Strings: 2, Instructions: 83threadCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,OOi:MoveFileEx,?,?,?), ref: 1E8C5E40
?PyWinObject_AsString@@YAHPAU_object@@PAPADHPAK@Z.PYWINTYPES27(?,?,00000000,00000000), ref: 1E8C5E65
?PyWinObject_AsString@@YAHPAU_object@@PAPADHPAK@Z.PYWINTYPES27(?,?,00000001,00000000), ref: 1E8C5E7B
PyEval_SaveThread.PYTHON27 ref: 1E8C5E85
MoveFileExA.KERNEL32(?,?,?), ref: 1E8C5E9C
PyEval_RestoreThread.PYTHON27(00000000), ref: 1E8C5EA5
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(MoveFileEx,00000000), ref: 1E8C5EB9
?PyWinObject_FreeString@@YAXPAD@Z.PYWINTYPES27(?), ref: 1E8C5EDC
?PyWinObject_FreeString@@YAXPAD@Z.PYWINTYPES27(?), ref: 1E8C5EE3

Strings

MoveFileEx, xrefs: 1E8C5EB4
OOi:MoveFileEx, xrefs: 1E8C5E32

Memory Dump Source

Source File: 00000011.00000002.1562490344.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 00000011.00000002.1562469835.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562702731.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562730939.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Object_String@@$U_object@@$Eval_FreeThread$Arg_Error@@FileMoveParseRestoreSaveTupleWin_
String ID: MoveFileEx$OOi:MoveFileEx
API String ID: 89984253-2883942482
Opcode ID: b984fb99cb5dbb6b12cce05005d1ffec4fdb9675b059858311653e19e7322bde
Instruction ID: f0a65ab3573a85b271c616647f5610e6dad7bd9527d889b3995a486c4b6877fa
Opcode Fuzzy Hash: b984fb99cb5dbb6b12cce05005d1ffec4fdb9675b059858311653e19e7322bde
Instruction Fuzzy Hash: 84213CB2514316AFE704DF68CCC8CAB77E9FB89644F44491EF949C3211E634E9498BB2

Function 1E8C8130 Relevance: 19.3, APIs: 9, Strings: 2, Instructions: 82threadregistryCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27 ref: 1E8C815D
?PyWinObject_AsHKEY@@YAHPAU_object@@PAPAUHKEY__@@@Z.PYWINTYPES27(?,?), ref: 1E8C817A
?PyWinObject_AsSECURITY_ATTRIBUTES@@YAHPAU_object@@PAPAU_SECURITY_ATTRIBUTES@@H@Z.PYWINTYPES27(?,?,00000001), ref: 1E8C8193
?PyWinObject_AsString@@YAHPAU_object@@PAPADHPAK@Z.PYWINTYPES27(?,00000000,00000000,00000000), ref: 1E8C81AE
PyEval_SaveThread.PYTHON27 ref: 1E8C81BD
RegSaveKeyA.ADVAPI32(?,?,?), ref: 1E8C81D4
PyEval_RestoreThread.PYTHON27(00000000), ref: 1E8C81DD
?PyWinObject_FreeString@@YAXPAD@Z.PYWINTYPES27(?), ref: 1E8C81E8
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(RegSaveKey,00000000), ref: 1E8C81FB

Strings

OO|O:RegSaveKey, xrefs: 1E8C814F
RegSaveKey, xrefs: 1E8C81F6

Memory Dump Source

Source File: 00000011.00000002.1562490344.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 00000011.00000002.1562469835.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562702731.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562730939.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Object_U_object@@$Eval_SaveString@@Thread$Arg_Error@@FreeParseRestoreTupleWin_Y__@@@
String ID: OO|O:RegSaveKey$RegSaveKey
API String ID: 497894695-1787471006
Opcode ID: 8f929bc1a6a23f9987848283011fe351170270dde950e4b464a113069d8df947
Instruction ID: 5c893bcb892c8ac3ed177132e6091f66094d148ebb941e1b2b79f0b0b6879ece
Opcode Fuzzy Hash: 8f929bc1a6a23f9987848283011fe351170270dde950e4b464a113069d8df947
Instruction Fuzzy Hash: 63218B75514312AFE300DB68CD88AEBB7E9EFC5615F408919F94DC3251E730E949CBA2

Function 1E8C50B0 Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 80timeCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27 ref: 1E8C50CF
GetTimeZoneInformation.KERNEL32(?), ref: 1E8C50E9
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(GetTimeZoneInformation,00000000), ref: 1E8C50FD

Strings

i,(lNNlNNl), xrefs: 1E8C518B
|i:GetTimeZoneInformation, xrefs: 1E8C50C1
GetTimeZoneInformation, xrefs: 1E8C50F8

Memory Dump Source

Source File: 00000011.00000002.1562490344.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 00000011.00000002.1562469835.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562702731.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562730939.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_Error@@InformationParseTimeTupleU_object@@Win_Zone
String ID: GetTimeZoneInformation$i,(lNNlNNl)$|i:GetTimeZoneInformation
API String ID: 964415491-3450524445
Opcode ID: a1f87bed195bc0ea6df67117905399b7c4b1cb089babefed9294ee77dd3cfb15
Instruction ID: 10fb71efeaef5aa3d3aaa8682fefefe93d61082b38ceafc91edbb58e4ccda36d
Opcode Fuzzy Hash: a1f87bed195bc0ea6df67117905399b7c4b1cb089babefed9294ee77dd3cfb15
Instruction Fuzzy Hash: 4B217171504304ABE6209765DC88FEB73EDAFC5364F448A2AF54D83240E779E5588BA3

Function 1E8C7820 Relevance: 19.3, APIs: 9, Strings: 2, Instructions: 80threadregistryCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27 ref: 1E8C7859
?PyWinObject_AsHKEY@@YAHPAU_object@@PAPAUHKEY__@@@Z.PYWINTYPES27(?,?,?,?,?,?,?,?), ref: 1E8C7876
?PyWinObject_AsString@@YAHPAU_object@@PAPADHPAK@Z.PYWINTYPES27(?,00000001,00000001,00000000,?,?,?,?,?,?,?,?), ref: 1E8C7891
PyEval_SaveThread.PYTHON27(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 1E8C78A0
RegOpenKeyExA.ADVAPI32(?,?,?,?,?), ref: 1E8C78C1
PyEval_RestoreThread.PYTHON27(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 1E8C78CA
?PyWinObject_FreeString@@YAXPAD@Z.PYWINTYPES27(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 1E8C78D5
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(RegOpenKeyEx,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 1E8C78E8

Strings

OO|ii:RegOpenKey, xrefs: 1E8C783B
RegOpenKeyEx, xrefs: 1E8C78E3

Memory Dump Source

Source File: 00000011.00000002.1562490344.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 00000011.00000002.1562469835.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562702731.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562730939.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Object_U_object@@$Eval_String@@Thread$Arg_Error@@FreeOpenParseRestoreSaveTupleWin_Y__@@@
String ID: OO|ii:RegOpenKey$RegOpenKeyEx
API String ID: 3232511256-2694016402
Opcode ID: 70e2d97c4afcf28e4b94b41bf58667ee37d8104f41d881504cb8ac338e23deb0
Instruction ID: 32dce3f2eaf2d03c8efc364cc67ad8f30cbc112fb9b9832833d0b9210998b13c
Opcode Fuzzy Hash: 70e2d97c4afcf28e4b94b41bf58667ee37d8104f41d881504cb8ac338e23deb0
Instruction Fuzzy Hash: 43214B75504311AFD300DB68CC88AAB77E8EFC9605F448A1CF94993241E735E659CBA6

Function 1E8C5D40 Relevance: 19.3, APIs: 9, Strings: 2, Instructions: 77threadfileCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,OO:MoveFile,?,?), ref: 1E8C5D62
?PyWinObject_AsString@@YAHPAU_object@@PAPADHPAK@Z.PYWINTYPES27(?,?,00000000,00000000), ref: 1E8C5D87
?PyWinObject_AsString@@YAHPAU_object@@PAPADHPAK@Z.PYWINTYPES27(?,?,00000000,00000000), ref: 1E8C5D9C
PyEval_SaveThread.PYTHON27 ref: 1E8C5DA6
MoveFileA.KERNEL32(?,?), ref: 1E8C5DB8
PyEval_RestoreThread.PYTHON27(00000000), ref: 1E8C5DC1
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(MoveFile,00000000), ref: 1E8C5DD5
?PyWinObject_FreeString@@YAXPAD@Z.PYWINTYPES27(?), ref: 1E8C5DF8
?PyWinObject_FreeString@@YAXPAD@Z.PYWINTYPES27(?), ref: 1E8C5DFF

Strings

MoveFile, xrefs: 1E8C5DD0
OO:MoveFile, xrefs: 1E8C5D54

Memory Dump Source

Source File: 00000011.00000002.1562490344.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 00000011.00000002.1562469835.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562702731.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562730939.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Object_String@@$U_object@@$Eval_FreeThread$Arg_Error@@FileMoveParseRestoreSaveTupleWin_
String ID: MoveFile$OO:MoveFile
API String ID: 89984253-3697850492
Opcode ID: 488293a4cee9346afdabaef14be2418f07dfde66277484133d710e699e757b01
Instruction ID: 07580c6aa7460514eb05c7fdd73e91482d8b2de71d95353e58043f2f23f191a2
Opcode Fuzzy Hash: 488293a4cee9346afdabaef14be2418f07dfde66277484133d710e699e757b01
Instruction Fuzzy Hash: 242180725043116FE700DF68CCC88AB73ECFE89244F44492EFA4983211E630EA498BB2

Function 1E8C3490 Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 73threadCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27 ref: 1E8C34B3
?PyWinObject_AsString@@YAHPAU_object@@PAPADHPAK@Z.PYWINTYPES27(?,00000001,00000001,00000000), ref: 1E8C34D4
PyEval_SaveThread.PYTHON27 ref: 1E8C34E3
GetDiskFreeSpaceExA.KERNEL32(?,?,?,?), ref: 1E8C34FF
PyEval_RestoreThread.PYTHON27(00000000), ref: 1E8C3508
?PyWinObject_FreeString@@YAXPAD@Z.PYWINTYPES27(?), ref: 1E8C3513
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(GetDiskSpaceFreeEx,00000000), ref: 1E8C3529

Strings

GetDiskSpaceFreeEx, xrefs: 1E8C3524
|O:GetDiskFreeSpaceEx, xrefs: 1E8C34A1
LLL, xrefs: 1E8C3554

Memory Dump Source

Source File: 00000011.00000002.1562490344.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 00000011.00000002.1562469835.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562702731.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562730939.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Eval_FreeObject_String@@ThreadU_object@@$Arg_DiskError@@ParseRestoreSaveSpaceTupleWin_
String ID: GetDiskSpaceFreeEx$LLL$|O:GetDiskFreeSpaceEx
API String ID: 2423468851-1562949391
Opcode ID: 5a173eee4af35ab75be0b959351217a3d524f8ba8fd3c20215730fe30630348c
Instruction ID: bb88ae2d1c52611ff98d0636c29635e54f5d75a69918f2fccea0bd7e8743a893
Opcode Fuzzy Hash: 5a173eee4af35ab75be0b959351217a3d524f8ba8fd3c20215730fe30630348c
Instruction Fuzzy Hash: F6216D75504211BFE300CBA5CD88E9BB7E8AFC9615F448A0CF94DC3240E730EA85CB62

Function 1E8C16E0 Relevance: 19.3, APIs: 9, Strings: 2, Instructions: 71fileCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27 ref: 1E8C1704
?PyWinObject_AsHANDLE@@YAHPAU_object@@PAPAX@Z.PYWINTYPES27(?,?), ref: 1E8C1724
DragQueryFile.SHELL32(?,000000FF,00000000,00000000), ref: 1E8C1742
Py_BuildValue.PYTHON27(1E8CF754,00000000), ref: 1E8C174E

Strings

O|i:DragQueryFile, xrefs: 1E8C16F6
DragQueryFile, xrefs: 1E8C1796

Memory Dump Source

Source File: 00000011.00000002.1562490344.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 00000011.00000002.1562469835.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562702731.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562730939.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_BuildDragFileObject_ParseQueryTupleU_object@@Value
String ID: DragQueryFile$O|i:DragQueryFile
API String ID: 1170003328-4176030986
Opcode ID: cf84baf4f7cb553f2315c8198ce27056a18c430d6a122e40438565ca5875514a
Instruction ID: a0672eba7f82cc965d7f98df8014b784467443d94df7ebe7f4d4e57ffecd2ede
Opcode Fuzzy Hash: cf84baf4f7cb553f2315c8198ce27056a18c430d6a122e40438565ca5875514a
Instruction Fuzzy Hash: 1021A1B55042016FE7108B64CC89FDB77E8AF86321F004A28FA6D832D0E775D1D58AA2

Function 1E8C33B0 Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 71threadCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27 ref: 1E8C33D3
?PyWinObject_AsString@@YAHPAU_object@@PAPADHPAK@Z.PYWINTYPES27(?,00000001,00000001,00000000), ref: 1E8C33F4
PyEval_SaveThread.PYTHON27 ref: 1E8C3403
GetDiskFreeSpaceA.KERNEL32(?,?,?,?,?), ref: 1E8C3424
PyEval_RestoreThread.PYTHON27(00000000), ref: 1E8C342D
?PyWinObject_FreeString@@YAXPAD@Z.PYWINTYPES27(?), ref: 1E8C3438
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(GetDiskSpaceFree,00000000), ref: 1E8C344E

Strings

(iiii), xrefs: 1E8C346F
GetDiskSpaceFree, xrefs: 1E8C3449
|O:GetDiskFreeSpace, xrefs: 1E8C33C1

Memory Dump Source

Source File: 00000011.00000002.1562490344.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 00000011.00000002.1562469835.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562702731.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562730939.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Eval_FreeObject_String@@ThreadU_object@@$Arg_DiskError@@ParseRestoreSaveSpaceTupleWin_
String ID: (iiii)$GetDiskSpaceFree$|O:GetDiskFreeSpace
API String ID: 2423468851-3240110619
Opcode ID: cf74ea3fb0b384af92f51f12907a686cd0bb0cad235224c32ed5ab4dcbe0252d
Instruction ID: 00c4c8651a69bba7fc2e630e5ae722c79234188095a7c49ec141697e07d4cef4
Opcode Fuzzy Hash: cf74ea3fb0b384af92f51f12907a686cd0bb0cad235224c32ed5ab4dcbe0252d
Instruction Fuzzy Hash: 2C2149B5504301AFE300DB68CC89EDB77E8BFC9605F448A1CFA4983251E735E649CBA2

Function 1E8C40C0 Relevance: 19.3, APIs: 9, Strings: 2, Instructions: 70threadlibraryCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,OOl:LoadLibraryEx,?,?,?), ref: 1E8C40DC
?PyWinObject_AsHANDLE@@YAHPAU_object@@PAPAX@Z.PYWINTYPES27(?,?), ref: 1E8C40F9
?PyWinObject_AsString@@YAHPAU_object@@PAPADHPAK@Z.PYWINTYPES27(?,00000000,00000000,00000000), ref: 1E8C4114
PyEval_SaveThread.PYTHON27 ref: 1E8C4123
LoadLibraryExA.KERNEL32(?,?,?), ref: 1E8C413A
PyEval_RestoreThread.PYTHON27(00000000), ref: 1E8C4143
?PyWinObject_FreeString@@YAXPAD@Z.PYWINTYPES27(?), ref: 1E8C414E
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(LoadLibraryEx,00000000), ref: 1E8C4161

Strings

OOl:LoadLibraryEx, xrefs: 1E8C40D6
LoadLibraryEx, xrefs: 1E8C415C

Memory Dump Source

Source File: 00000011.00000002.1562490344.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 00000011.00000002.1562469835.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562702731.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562730939.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Object_U_object@@$Eval_String@@Thread$Arg_Error@@FreeLibraryLoadParseRestoreSaveTupleWin_
String ID: LoadLibraryEx$OOl:LoadLibraryEx
API String ID: 3157523754-510471668
Opcode ID: 1b8ddbec2f13538f9f78068a7b5ea0f14f877a6e0c0f46db488acf4b1ca062cd
Instruction ID: d6bb3c43ea84c97e318eba1ac07e3508fec979947abf7383d2110c8f94039bf4
Opcode Fuzzy Hash: 1b8ddbec2f13538f9f78068a7b5ea0f14f877a6e0c0f46db488acf4b1ca062cd
Instruction Fuzzy Hash: 3611AFB9500211AFD300EB68CC88AEB37E8BFC5655F848928F94EC3201E734D599C7B2

Function 1E8C32C0 Relevance: 19.3, APIs: 9, Strings: 2, Instructions: 62threadCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27 ref: 1E8C32DF
?PyWinObject_AsHANDLE@@YAHPAU_object@@PAPAX@Z.PYWINTYPES27(?,?), ref: 1E8C32FC
?PyWinObject_AsResourceIdA@@YAHPAU_object@@PAPADH@Z.PYWINTYPES27(?,00000000,00000000), ref: 1E8C3315
PyEval_SaveThread.PYTHON27 ref: 1E8C3324
LoadCursorA.USER32(?,?), ref: 1E8C3337
PyEval_RestoreThread.PYTHON27(00000000), ref: 1E8C3340
?PyWinObject_FreeResourceId@@YAXPAD@Z.PYWINTYPES27(?), ref: 1E8C334B
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(LoadCursor,00000000), ref: 1E8C335E
?PyWinLong_FromHANDLE@@YAPAU_object@@PAX@Z.PYWINTYPES27(00000000), ref: 1E8C3368

Strings

LoadCursor, xrefs: 1E8C3359
OO:LoadCursor, xrefs: 1E8C32D1

Memory Dump Source

Source File: 00000011.00000002.1562490344.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 00000011.00000002.1562469835.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562702731.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562730939.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: U_object@@$Object_$Eval_ResourceThread$Arg_CursorError@@FreeFromId@@LoadLong_ParseRestoreSaveTupleWin_
String ID: LoadCursor$OO:LoadCursor
API String ID: 3847829699-2215962681
Opcode ID: 68fa3e804fbb55c0ba6ce98fd9439a542221466be20e0c0d371649aeb8893884
Instruction ID: 65708e05925c36e8386b3b81513c449a0015e823e93752e127d9018f53439a98
Opcode Fuzzy Hash: 68fa3e804fbb55c0ba6ce98fd9439a542221466be20e0c0d371649aeb8893884
Instruction Fuzzy Hash: 601194755002216FE700ABA8CD8DDDB7BECEF86646F404918F94DC3251E734D699C7A2

Function 1E8C4980 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 62COMMON

Download Yara Rule

APIs

PyErr_Format.PYTHON27(?,%s is not available on this platform,GetNativeSystemInfo), ref: 1E8C499E
PyArg_ParseTuple.PYTHON27(?,:GetNativeSystemInfo), ref: 1E8C49B5

Strings

%s is not available on this platform, xrefs: 1E8C4998
iiNNNiii(HH), xrefs: 1E8C4A25
GetNativeSystemInfo, xrefs: 1E8C4993
:GetNativeSystemInfo, xrefs: 1E8C49AF

Memory Dump Source

Source File: 00000011.00000002.1562490344.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 00000011.00000002.1562469835.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562702731.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562730939.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_Err_FormatParseTuple
String ID: %s is not available on this platform$:GetNativeSystemInfo$GetNativeSystemInfo$iiNNNiii(HH)
API String ID: 361908667-387961642
Opcode ID: e980adeecaca180ad0829cc39d25928e351ca304743d84886ef2d8b5cacd1ebb
Instruction ID: 7a66f0c4dfadbcac7cd5148ed897dbb2aa1bcfb58ee23ec4d7e034b94e684868
Opcode Fuzzy Hash: e980adeecaca180ad0829cc39d25928e351ca304743d84886ef2d8b5cacd1ebb
Instruction Fuzzy Hash: DD1160B1414210AFD2049B69CD89D6B73EABBCC70DF04461CF98D93310E234EA958BA7

Function 1E8C7770 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 55COMMON

Download Yara Rule

APIs

PyErr_Format.PYTHON27(?,%s is not available on this platform,RegOpenCurrentUser), ref: 1E8C778E
PyArg_ParseTuple.PYTHON27 ref: 1E8C77B1

Strings

RegOpenCurrentUser, xrefs: 1E8C7783
RegOpenCurrentUser, xrefs: 1E8C77ED
|k:RegOpenCurrentUser, xrefs: 1E8C77A3
%s is not available on this platform, xrefs: 1E8C7788

Memory Dump Source

Source File: 00000011.00000002.1562490344.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 00000011.00000002.1562469835.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562702731.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562730939.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_Err_FormatParseTuple
String ID: %s is not available on this platform$RegOpenCurrentUser$RegOpenCurrentUser$|k:RegOpenCurrentUser
API String ID: 361908667-1731294590
Opcode ID: 7fec31a9b4ab2ffbff1a1db6f9d6d3f2473e5fcaf950c7a821f234fabb9ade6f
Instruction ID: 230226a715b9e0855de4c233db2c9e900a576ded76b0a498b02a61e5b4deaae9
Opcode Fuzzy Hash: 7fec31a9b4ab2ffbff1a1db6f9d6d3f2473e5fcaf950c7a821f234fabb9ade6f
Instruction Fuzzy Hash: 4A01C075910214AFD710AB69EC8DACB37E4BF81616F448628F80DC3310E635999DCBA2

Function 1E7D2950 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 181registryCOMMON

Download Yara Rule

APIs

SetConsoleCtrlHandler.KERNEL32(1E7D23D0,00000001,?,00000002,00000000,?), ref: 1E7D2990
PyGILState_Ensure.PYTHON27(?,00000002,00000000,?), ref: 1E7D2996
RegisterServiceCtrlHandlerW.ADVAPI32(?,1E7D23B0), ref: 1E7D2AAB
SetServiceStatus.ADVAPI32(?,1E7D620C), ref: 1E7D2ACF
SetServiceStatus.ADVAPI32(?,1E7D6244), ref: 1E7D2AEA
PyObject_GetAttrString.PYTHON27(00000000,SvcRun), ref: 1E7D2B03
PyObject_CallObject.PYTHON27(00000000,00000000), ref: 1E7D2B21

Part of subcall function 1E7D1F00: GetLastError.KERNEL32(00000000,?), ref: 1E7D1F0E
Part of subcall function 1E7D1F00: FormatMessageW.KERNEL32(00001000,00000000,00000000,00000000,?,00000200,00000000,00000000,?), ref: 1E7D1F2C
Part of subcall function 1E7D1F00: wsprintfW.USER32 ref: 1E7D1FB8

SetServiceStatus.ADVAPI32(?,1E7D6260), ref: 1E7D2B80
PyGILState_Release.PYTHON27(?), ref: 1E7D2B98

Strings

SvcRun, xrefs: 1E7D2AFD

Memory Dump Source

Source File: 00000011.00000002.1562321143.000000001E7D1000.00000040.00000001.01000000.00000015.sdmp, Offset: 1E7D0000, based on PE: true

Associated: 00000011.00000002.1562293036.000000001E7D0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000011.00000002.1562321143.000000001E7DA000.00000040.00000001.01000000.00000015.sdmpDownload File
Associated: 00000011.00000002.1562391495.000000001E7DB000.00000080.00000001.01000000.00000015.sdmpDownload File
Associated: 00000011.00000002.1562417397.000000001E7DD000.00000004.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e7d0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Service$Status$CtrlHandlerObject_State_$AttrCallConsoleEnsureErrorFormatLastMessageObjectRegisterReleaseStringwsprintf
String ID: SvcRun
API String ID: 2607542345-4087590218
Opcode ID: a9ff2d058d0f3b545622c7cf91ecafadd5e28e79d72e5ffc4d6d818ba245cd66
Instruction ID: bd58b4309c9d3fc151f05a69bc044f97fa358b27aec673f544e188db4cac6625
Opcode Fuzzy Hash: a9ff2d058d0f3b545622c7cf91ecafadd5e28e79d72e5ffc4d6d818ba245cd66
Instruction Fuzzy Hash: 7551D1749003D29BF321DF54DD84A9A73AAFB88B30F004729E84497264E775E94ACBD2

Function 1E7A53D0 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 166COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON27(?,can't delete OVERLAPPED attributes), ref: 1E7A53E6
PyString_AsString.PYTHON27(?), ref: 1E7A53FA

Strings

hEvent, xrefs: 1E7A540C
can't delete OVERLAPPED attributes, xrefs: 1E7A53E0
InternalHigh, xrefs: 1E7A54EF
Internal, xrefs: 1E7A549C

Memory Dump Source

Source File: 00000011.00000002.1561923280.000000001E7A1000.00000040.00000001.01000000.00000012.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000011.00000002.1561891626.000000001E7A0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7B9000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7BE000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562197228.000000001E7C0000.00000080.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562233172.000000001E7C2000.00000004.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e7a0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: String$Err_String_
String ID: Internal$InternalHigh$can't delete OVERLAPPED attributes$hEvent
API String ID: 2652372976-1618803428
Opcode ID: 749dbed479fc1568d374b21f823f9f37aa662c21e85c6b6fedaffdd2f5280080
Instruction ID: 5988df478947c963048895f1e5f938e83873d200ed34794aae8392db7981c020
Opcode Fuzzy Hash: 749dbed479fc1568d374b21f823f9f37aa662c21e85c6b6fedaffdd2f5280080
Instruction Fuzzy Hash: 165128726182814FF304DF38B8506ABBBE7AFC5125B5C476DEA85C72A5E322D447CB40

Function 1E7A9070 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 105memoryCOMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON27(000211EB,Allocating BSTR,?,?,?,00000000,1E7A496F,?,?,00000000,00000000), ref: 1E7A90B9
SysAllocStringLen.OLEAUT32(00000000,?), ref: 1E7A90D7
PyUnicodeUCS2_AsWideChar.PYTHON27(?,00000000,?,?,00000000,1E7A496F,?,?,00000000,00000000,?,1E7A23A8,?,?), ref: 1E7A90EA

Part of subcall function 1E7A8FD0: PyString_Size.PYTHON27(?,?,?,00000001,1E7A23A8,1E7A9097,1E7A23A8,?,?,?,00000000,1E7A496F,?,?,00000000,00000000), ref: 1E7A8FDB
Part of subcall function 1E7A8FD0: PyString_AsString.PYTHON27(?,?,00000000,1E7A496F,?,?,00000000,00000000,?,1E7A23A8,?,?), ref: 1E7A8FE4
Part of subcall function 1E7A8FD0: PyErr_SetString.PYTHON27(?,No memory for wide string buffer,?,?,?,?,1E7A257E,77613D50,AddAccessAllowedObjectAce,?,?,?,?,?,?), ref: 1E7A9014

PyErr_SetString.PYTHON27(1E7B9D10,None is not a valid string in this context,?,?,?,00000000,1E7A496F,?,?,00000000,00000000), ref: 1E7A912B
PyErr_Format.PYTHON27(77613D50,Objects of type '%s' can not be converted to Unicode.,<NULL!!>,?,?,?,00000000,1E7A496F,?,?,00000000,00000000,?,1E7A23A8,?,?), ref: 1E7A915A
SysStringLen.OLEAUT32(77613D50), ref: 1E7A9177

Strings

Allocating BSTR, xrefs: 1E7A90B3
<NULL!!>, xrefs: 1E7A9146, 1E7A9153
Objects of type '%s' can not be converted to Unicode., xrefs: 1E7A9154
None is not a valid string in this context, xrefs: 1E7A9125

Memory Dump Source

Source File: 00000011.00000002.1561923280.000000001E7A1000.00000040.00000001.01000000.00000012.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000011.00000002.1561891626.000000001E7A0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7B9000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7BE000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562197228.000000001E7C0000.00000080.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562233172.000000001E7C2000.00000004.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e7a0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: String$Err_$String_$AllocCharFormatSizeUnicodeWide
String ID: <NULL!!>$Allocating BSTR$None is not a valid string in this context$Objects of type '%s' can not be converted to Unicode.
API String ID: 1423582126-3325733078
Opcode ID: e087026a8f3b1ca00dfec179d3fee7b4d37fd2a401e062937e5ec9e9c5cf1617
Instruction ID: 8b5a2b0479d2311b8d0b1c5652a9c6a5f277fffd32a7f26ac95e76327ca82a71
Opcode Fuzzy Hash: e087026a8f3b1ca00dfec179d3fee7b4d37fd2a401e062937e5ec9e9c5cf1617
Instruction Fuzzy Hash: 4731A1796012158BE7009F59EC94A6773A9EBC9329F0C0769FB41C7360DB72E850CFA1

Function 1E7A6430 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 105COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,iOi:SetSacl,?,?,?), ref: 1E7A645A
?PyWinObject_AsACL@@YAHPAU_object@@PAPAU_ACL@@H@Z.PYWINTYPES27(?,?,00000001), ref: 1E7A647B
?_MakeAbsoluteSD@@YAHPAXPAPAX@Z.PYWINTYPES27(?,?), ref: 1E7A6496
SetSecurityDescriptorSacl.ADVAPI32(?,?,?,?), ref: 1E7A64BF
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(SetSecurityDescriptorSacl,00000000), ref: 1E7A64CF
73BB3B4E.MSVCR90(?,?,?,?), ref: 1E7A651E
73BB3B4E.MSVCR90(00000000), ref: 1E7A6528

Strings

SetSecurityDescriptorSacl, xrefs: 1E7A64CA
iOi:SetSacl, xrefs: 1E7A6448

Memory Dump Source

Source File: 00000011.00000002.1561923280.000000001E7A1000.00000040.00000001.01000000.00000012.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000011.00000002.1561891626.000000001E7A0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7B9000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7BE000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562197228.000000001E7C0000.00000080.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562233172.000000001E7C2000.00000004.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e7a0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: U_object@@$AbsoluteArg_DescriptorError@@MakeObject_ParseSaclSecurityTupleWin_
String ID: SetSecurityDescriptorSacl$iOi:SetSacl
API String ID: 2594461519-1391232748
Opcode ID: ed7719a7cfc9c1c34f9e6981eb24c2d3d83ffb704be4b795f5e25a8218a76ea3
Instruction ID: 343c3e17d4965c57da3af951ddef9f7501efb1e23144741b146d9f374b92e1bb
Opcode Fuzzy Hash: ed7719a7cfc9c1c34f9e6981eb24c2d3d83ffb704be4b795f5e25a8218a76ea3
Instruction Fuzzy Hash: AA316F756043056FB600EFA4AC9496B739DAEC8618F494B1CFE4492215FB35EA09CAA3

Function 1E7A6620 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 103COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,Oi:SetSecurityDescriptorOwner,?,?), ref: 1E7A6645
?PyWinObject_AsSID@@YAHPAU_object@@PAPAXH@Z.PYWINTYPES27(?,?,00000001), ref: 1E7A6666
?_MakeAbsoluteSD@@YAHPAXPAPAX@Z.PYWINTYPES27(?,?), ref: 1E7A6689
SetSecurityDescriptorOwner.ADVAPI32(?,?,?), ref: 1E7A66AD
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(SetSecurityDescriptorOwner,00000000), ref: 1E7A66BD
73BB3B4E.MSVCR90(?,?,?,?), ref: 1E7A670C
73BB3B4E.MSVCR90(00000000), ref: 1E7A6716

Strings

SetSecurityDescriptorOwner, xrefs: 1E7A66B8
Oi:SetSecurityDescriptorOwner, xrefs: 1E7A6635

Memory Dump Source

Source File: 00000011.00000002.1561923280.000000001E7A1000.00000040.00000001.01000000.00000012.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000011.00000002.1561891626.000000001E7A0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7B9000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7BE000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562197228.000000001E7C0000.00000080.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562233172.000000001E7C2000.00000004.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e7a0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: U_object@@$AbsoluteArg_DescriptorError@@MakeObject_OwnerParseSecurityTupleWin_
String ID: Oi:SetSecurityDescriptorOwner$SetSecurityDescriptorOwner
API String ID: 2658209126-3086791579
Opcode ID: d6a4dc625f88e8a4bf033ee59f552e162ed2f2a6dce3a111a9801c8c4e33e5f2
Instruction ID: 6cf7014af77b3beac51e9aa74c0ab62d1d4049cf98abdf6c029a0188492a141e
Opcode Fuzzy Hash: d6a4dc625f88e8a4bf033ee59f552e162ed2f2a6dce3a111a9801c8c4e33e5f2
Instruction Fuzzy Hash: 623191B5504341ABA300DF55EC949AB73EDEFC8604F480B1DFE4992225E735E605CBA6

Function 1E8C8490 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 101threadregistryCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27 ref: 1E8C84C6
?PyWinObject_AsHKEY@@YAHPAU_object@@PAPAUHKEY__@@@Z.PYWINTYPES27(?,?,?,?,?,?,?,?,?), ref: 1E8C84DD
?PyWinObject_AsString@@YAHPAU_object@@PAPADHPAK@Z.PYWINTYPES27(?,?,00000001,00000000,?,?,?,?,?,?,?,?,?,?), ref: 1E8C8515
PyEval_SaveThread.PYTHON27(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 1E8C853B
RegSetValueExA.ADVAPI32(?,?,00000000,?,?,?), ref: 1E8C855E
PyEval_RestoreThread.PYTHON27(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 1E8C8567
?PyWinObject_FreeString@@YAXPAD@Z.PYWINTYPES27(?,?,?), ref: 1E8C8581
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(RegSetValueEx,00000000), ref: 1E8C8594

Strings

OOOiO:RegSetValueEx, xrefs: 1E8C84B0
RegSetValueEx, xrefs: 1E8C858F

Memory Dump Source

Source File: 00000011.00000002.1562490344.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 00000011.00000002.1562469835.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562702731.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562730939.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Object_U_object@@$Eval_String@@Thread$Arg_Error@@FreeParseRestoreSaveTupleValueWin_Y__@@@
String ID: OOOiO:RegSetValueEx$RegSetValueEx
API String ID: 968808361-1011897307
Opcode ID: 498f16a28b0dc91fc3b834a5f9238bfd8b31534c7a2ae3a005b5e5829f14c458
Instruction ID: 97441c23c34c42aa387d0e4e335bf02e0dd5db0e8a81773bd95343cd9ec0b272
Opcode Fuzzy Hash: 498f16a28b0dc91fc3b834a5f9238bfd8b31534c7a2ae3a005b5e5829f14c458
Instruction Fuzzy Hash: C03130B5514301AFD304DB59DC84EABB3E9EFC9744F448A1CF94983250E774E949CB62

Function 1E8C5EF0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 86COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27 ref: 1E8C5F2D
?PyWinObject_AsHANDLE@@YAHPAU_object@@PAPAX@Z.PYWINTYPES27(?,?,?,?,?,?,?,?), ref: 1E8C5F4A
?PyWinObject_AsPARAM@@YAHPAU_object@@PAI@Z.PYWINTYPES27(?,?,?,?,?,?,?,?,?,?,?), ref: 1E8C5F67
?PyWinObject_AsPARAM@@YAHPAU_object@@PAI@Z.PYWINTYPES27(?,?,?,?,?,?,?,?,?,?,?,?), ref: 1E8C5F7A

Strings

OI|OO:PostMessage, xrefs: 1E8C5F17
PostMessage, xrefs: 1E8C5FC0

Memory Dump Source

Source File: 00000011.00000002.1562490344.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 00000011.00000002.1562469835.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562702731.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562730939.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Object_U_object@@$Arg_ParseTuple
String ID: OI|OO:PostMessage$PostMessage
API String ID: 1248562531-2393048322
Opcode ID: 38c00d130359cdbb39636801a46feb9cf7ccdb142de9ace731748fd0aa679d90
Instruction ID: 26bf24229c85a2fa613f2c6c9d0a0e967e1aca7e03669ac9d4dd4ea73f283b75
Opcode Fuzzy Hash: 38c00d130359cdbb39636801a46feb9cf7ccdb142de9ace731748fd0aa679d90
Instruction Fuzzy Hash: 47214175514212AFD700DF68CC84ADB73E9EFC9209F44495DF889C3250E730E6498BA2

Function 1E8CC5D0 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 86COMMON

Download Yara Rule

APIs

PyErr_Format.PYTHON27(?,%s is not available on this platform,EnumDisplayDevices), ref: 1E8CC5F3
PyArg_ParseTupleAndKeywords.PYTHON27(?,?,|Okk:EnumDisplayDevices,1E8D7F64,?,?,?), ref: 1E8CC643

Strings

EnumDisplayDevices, xrefs: 1E8CC6AE
|Okk:EnumDisplayDevices, xrefs: 1E8CC630
%s is not available on this platform, xrefs: 1E8CC5ED
EnumDisplayDevices, xrefs: 1E8CC5E8

Memory Dump Source

Source File: 00000011.00000002.1562490344.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 00000011.00000002.1562469835.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562702731.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562730939.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_Err_FormatKeywordsParseTuple
String ID: %s is not available on this platform$EnumDisplayDevices$EnumDisplayDevices$|Okk:EnumDisplayDevices
API String ID: 223827023-1002584741
Opcode ID: 5c55174ee9b1255d10824cf7e5bcce9062b9702ec90c525ec58c7d46bb5053f9
Instruction ID: 316a10fb34c0979385bf05bacb5445eb8342d90b13edda04d331a52d403746b9
Opcode Fuzzy Hash: 5c55174ee9b1255d10824cf7e5bcce9062b9702ec90c525ec58c7d46bb5053f9
Instruction Fuzzy Hash: 5A2189B1504352ABE214DF18DC84EDBBBE8AF85744F004A1CF88D93241E731D949CBA6

Function 1E8CC4F0 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 78COMMON

Download Yara Rule

APIs

PyErr_Format.PYTHON27(?,%s is not available on this platform,ChangeDisplaySettingsEx), ref: 1E8CC510
PyArg_ParseTupleAndKeywords.PYTHON27(?,?,|OOk:ChangeDisplaySettingsEx,1E8D7F54,?,?,?), ref: 1E8CC556

Strings

|OOk:ChangeDisplaySettingsEx, xrefs: 1E8CC547
%s is not available on this platform, xrefs: 1E8CC50A
ChangeDisplaySettingsEx, xrefs: 1E8CC505

Memory Dump Source

Source File: 00000011.00000002.1562490344.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 00000011.00000002.1562469835.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562702731.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562730939.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_Err_FormatKeywordsParseTuple
String ID: %s is not available on this platform$ChangeDisplaySettingsEx$|OOk:ChangeDisplaySettingsEx
API String ID: 223827023-2087358017
Opcode ID: 8df334ca78facc268b7e6df591aeb36029b80a9083ac18d501200d55fdd35a24
Instruction ID: b27f1001493b57bd9de01df9de0b36f62e79fa1959cb84eb32a57b83e76aefe2
Opcode Fuzzy Hash: 8df334ca78facc268b7e6df591aeb36029b80a9083ac18d501200d55fdd35a24
Instruction Fuzzy Hash: 9D2148B5514321AFD214DF68CD88DDBBBE8BF89A54F408A19F94DC3211E234D949CBA2

Function 1E8C9D00 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 74COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27 ref: 1E8C9D23
?PyWinObject_AsHANDLE@@YAHPAU_object@@PAPAX@Z.PYWINTYPES27(?,?), ref: 1E8C9D40
PyErr_Format.PYTHON27(?,Allocating buffer of %d bytes for LoadString,?), ref: 1E8C9D73

Strings

LoadString, xrefs: 1E8C9D9D
Allocating buffer of %d bytes for LoadString, xrefs: 1E8C9D6D
Oi|i:LoadString, xrefs: 1E8C9D15

Memory Dump Source

Source File: 00000011.00000002.1562490344.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 00000011.00000002.1562469835.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562702731.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562730939.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_Err_FormatObject_ParseTupleU_object@@
String ID: Allocating buffer of %d bytes for LoadString$LoadString$Oi|i:LoadString
API String ID: 3520361810-709151105
Opcode ID: 8a32e6313b5a7bcbb0aeb500659e0127973efd3239abbf7a618b35ed14fd9b69
Instruction ID: 5f3974d1b42e7b2407e2290833bdf3e33621a2848b7664c9f06d01da9c60b0ec
Opcode Fuzzy Hash: 8a32e6313b5a7bcbb0aeb500659e0127973efd3239abbf7a618b35ed14fd9b69
Instruction Fuzzy Hash: 2E11C075200221BFE301DB69CC88DEB37E8FFC2259F484958F94ED3200E630D959C6A2

Function 034114B0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 72COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,0341B104), ref: 034114BF

Strings

OpenProcess -> ERROR_INVALID_PARAMETER turned into NoSuchProcess, xrefs: 03411501
TerminateProcess, xrefs: 03411545

Memory Dump Source

Source File: 00000011.00000002.1560676867.0000000003411000.00000040.00000001.01000000.0000000F.sdmp, Offset: 03410000, based on PE: true

Associated: 00000011.00000002.1560637646.0000000003410000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560676867.000000000341B000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560676867.000000000341F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560836323.0000000003423000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_3410000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_ParseTuple
String ID: OpenProcess -> ERROR_INVALID_PARAMETER turned into NoSuchProcess$TerminateProcess
API String ID: 3371842430-2687439338
Opcode ID: 418d9c1d4d98512c55dc6dbebf69be788e7d662c3752ab1b75359e8b4e1ade97
Instruction ID: 33c4e4881fd5db72d363da488c9454a4f88c512a2cf2921c2ecb31d39c8f7079
Opcode Fuzzy Hash: 418d9c1d4d98512c55dc6dbebf69be788e7d662c3752ab1b75359e8b4e1ade97
Instruction Fuzzy Hash: 2C11E2B1A00E106FE690F764AC0DBDE73D8DB01666F240067FA07ED649EB608060969A

Function 1E8C7A50 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 70COMMON

Download Yara Rule

APIs

PyErr_Format.PYTHON27(?,%s is not available on this platform,RegOverridePredefKey), ref: 1E8C7A6E
PyArg_ParseTupleAndKeywords.PYTHON27(?,?,OO:RegOverridePredefKey,1E8D707C,?,?), ref: 1E8C7A99

Strings

RegOverridePredefKey, xrefs: 1E8C7A63
%s is not available on this platform, xrefs: 1E8C7A68
RegOverridePredefKey, xrefs: 1E8C7AF2
OO:RegOverridePredefKey, xrefs: 1E8C7A92

Memory Dump Source

Source File: 00000011.00000002.1562490344.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 00000011.00000002.1562469835.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562702731.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562730939.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_Err_FormatKeywordsParseTuple
String ID: %s is not available on this platform$OO:RegOverridePredefKey$RegOverridePredefKey$RegOverridePredefKey
API String ID: 223827023-9875006
Opcode ID: fc65ce8f20fe0f4c4c67d99dd7a98e86b283ea27fc8631791300f1f5ff2b4076
Instruction ID: 556c4b43c863ef4003f0d7ae91f6d195aa362526275ec928491b34fb1823ef74
Opcode Fuzzy Hash: fc65ce8f20fe0f4c4c67d99dd7a98e86b283ea27fc8631791300f1f5ff2b4076
Instruction Fuzzy Hash: FF117275510216AFE700EB68CC85DEB73E9FF85205F848959F85CC3351F235E9198BA2

Function 1E8C68F0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 69threadregistryCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27 ref: 1E8C6918
?PyWinObject_AsHKEY@@YAHPAU_object@@PAPAUHKEY__@@@Z.PYWINTYPES27(?,?), ref: 1E8C6935
?PyWinObject_AsString@@YAHPAU_object@@PAPADHPAK@Z.PYWINTYPES27(?,00000001,00000001,00000000), ref: 1E8C6950
PyEval_SaveThread.PYTHON27 ref: 1E8C695F
RegDeleteValueA.ADVAPI32(?,?), ref: 1E8C6971
PyEval_RestoreThread.PYTHON27(00000000), ref: 1E8C697A
?PyWinObject_FreeString@@YAXPAD@Z.PYWINTYPES27(?), ref: 1E8C6985
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(RegDeleteValue,00000000), ref: 1E8C6998

Strings

RegDeleteValue, xrefs: 1E8C6993
OO:RegDeleteValue, xrefs: 1E8C690A

Memory Dump Source

Source File: 00000011.00000002.1562490344.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 00000011.00000002.1562469835.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562702731.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562730939.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Object_U_object@@$Eval_String@@Thread$Arg_DeleteError@@FreeParseRestoreSaveTupleValueWin_Y__@@@
String ID: OO:RegDeleteValue$RegDeleteValue
API String ID: 193626020-1782645334
Opcode ID: 5c7234767f9338ad1533f928e5dcc9c01fd6c6d0502e729fbec34b049e87ac25
Instruction ID: e1bfe98b07e83c614c24771e7c80368a6593409dbb3c73483f48c18e5bfd793d
Opcode Fuzzy Hash: 5c7234767f9338ad1533f928e5dcc9c01fd6c6d0502e729fbec34b049e87ac25
Instruction Fuzzy Hash: 58219075500211AFE300DB68CD88AAB77E8FFCA655F408918F94DC3251E734E549CB63

Function 1E8C76B0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 67threadregistryCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27 ref: 1E8C76CF
?PyWinObject_AsHKEY@@YAHPAU_object@@PAPAUHKEY__@@@Z.PYWINTYPES27(?,?), ref: 1E8C76EC
?PyWinObject_AsString@@YAHPAU_object@@PAPADHPAK@Z.PYWINTYPES27(?,00000000,00000000,00000000), ref: 1E8C7707
PyEval_SaveThread.PYTHON27 ref: 1E8C7716
RegUnLoadKeyA.ADVAPI32(?,?), ref: 1E8C7728
PyEval_RestoreThread.PYTHON27(00000000), ref: 1E8C7731
?PyWinObject_FreeString@@YAXPAD@Z.PYWINTYPES27(?), ref: 1E8C773C
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(RegUnLoadKey,00000000), ref: 1E8C774F

Strings

OO:RegUnLoadKey, xrefs: 1E8C76C1
RegUnLoadKey, xrefs: 1E8C774A

Memory Dump Source

Source File: 00000011.00000002.1562490344.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 00000011.00000002.1562469835.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562702731.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562730939.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Object_U_object@@$Eval_String@@Thread$Arg_Error@@FreeLoadParseRestoreSaveTupleWin_Y__@@@
String ID: OO:RegUnLoadKey$RegUnLoadKey
API String ID: 1849577564-1964549283
Opcode ID: bd7a78c44746c8dd3e164888707f3439dcdbb1fa62584d016c6d8aaef67600c2
Instruction ID: 1b4573b64d191d5ccb3b0ab82ae08e8b468e7245339e54f77c665a9c3291c2b4
Opcode Fuzzy Hash: bd7a78c44746c8dd3e164888707f3439dcdbb1fa62584d016c6d8aaef67600c2
Instruction Fuzzy Hash: 11119D75604211AFE300EB68CC8CEEB77E8EF85255F408918F94DC3211E730D589CBA2

Function 1E8C42C0 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 66COMMON

Download Yara Rule

APIs

PyErr_Format.PYTHON27(?,%s is not available on this platform,GetDllDirectory), ref: 1E8C42DE
73BB3B4E.MSVCR90(00000000), ref: 1E8C4305
GetDllDirectoryW.KERNEL32(00000100,00000000), ref: 1E8C4321
?PyWinObject_FromOLECHAR@@YAPAU_object@@PB_WH@Z.PYWINTYPES27(00000000,00000000), ref: 1E8C4333
73BB3B4E.MSVCR90(00000000), ref: 1E8C4348

Strings

%s is not available on this platform, xrefs: 1E8C42D8
GetDllDirectory, xrefs: 1E8C42D3
GetDllDirectory, xrefs: 1E8C4362

Memory Dump Source

Source File: 00000011.00000002.1562490344.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 00000011.00000002.1562469835.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562702731.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562730939.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: DirectoryErr_FormatFromObject_U_object@@
String ID: %s is not available on this platform$GetDllDirectory$GetDllDirectory
API String ID: 4005545441-244808744
Opcode ID: 19a80307655a444f6c6939128087d7eb2aef259e563fd1fa95f24b576b4d0858
Instruction ID: 73add1e402b718b39919f1e5875fd0992ff4bc3db0d7d3048ba172c578819d3c
Opcode Fuzzy Hash: 19a80307655a444f6c6939128087d7eb2aef259e563fd1fa95f24b576b4d0858
Instruction Fuzzy Hash: 9511C476500325AFD3018B699C88EDB77B5FBC2751F100229F85A83210D734D8D686A5

Function 1E8C20D0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 64threadCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,Oil:FindFirstChangeNotification,?,?,?), ref: 1E8C20EC
?PyWinObject_AsString@@YAHPAU_object@@PAPADHPAK@Z.PYWINTYPES27(?,00000000,00000000,00000000), ref: 1E8C210D
PyEval_SaveThread.PYTHON27 ref: 1E8C211C
FindFirstChangeNotificationA.KERNEL32(?,?,?), ref: 1E8C2133
PyEval_RestoreThread.PYTHON27(00000000), ref: 1E8C213C
?PyWinObject_FreeString@@YAXPAD@Z.PYWINTYPES27(?), ref: 1E8C2147
?PyWinLong_FromHANDLE@@YAPAU_object@@PAX@Z.PYWINTYPES27(00000000), ref: 1E8C215A

Strings

FindFirstChangeNotification, xrefs: 1E8C216B
Oil:FindFirstChangeNotification, xrefs: 1E8C20E6

Memory Dump Source

Source File: 00000011.00000002.1562490344.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 00000011.00000002.1562469835.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562702731.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562730939.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Eval_Object_String@@ThreadU_object@@$Arg_ChangeFindFirstFreeFromLong_NotificationParseRestoreSaveTuple
String ID: FindFirstChangeNotification$Oil:FindFirstChangeNotification
API String ID: 3035025450-3656035498
Opcode ID: e32afe06f6f049b2e311a97c25c2ead155b5e185607daae1cf76adec442f014e
Instruction ID: 1645cda2b55b607ce60c162096edf9511bf8b64eaedaeafb65774d97ecb9f306
Opcode Fuzzy Hash: e32afe06f6f049b2e311a97c25c2ead155b5e185607daae1cf76adec442f014e
Instruction Fuzzy Hash: 7D1182755002216FE300DB68CC8DAEB77E8EF85615F848A28F95DC3291E734D559C6A2

Function 1E8C3A00 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 62COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,:GetLogicalDriveStrings), ref: 1E8C3A0F
GetLogicalDriveStringsA.KERNEL32(00000000,00000000), ref: 1E8C3A2E
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(GetLogicalDriveStrings,00000000), ref: 1E8C3A3C

Strings

GetLogicalDriveStrings, xrefs: 1E8C3A5D
GetLogicalDriveStrings, xrefs: 1E8C3A37
:GetLogicalDriveStrings, xrefs: 1E8C3A09

Memory Dump Source

Source File: 00000011.00000002.1562490344.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 00000011.00000002.1562469835.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562702731.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562730939.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_DriveError@@LogicalParseStringsTupleU_object@@Win_
String ID: :GetLogicalDriveStrings$GetLogicalDriveStrings$GetLogicalDriveStrings
API String ID: 3159777487-1660296831
Opcode ID: 23fe7b9b30ccd2c4f5bec634b705a096fa415f603f715fb02e5943b751a728bc
Instruction ID: 0de6204f0511d253a4a7aa7f3c23de3ce8858000d48c025be3eba2638a1c3957
Opcode Fuzzy Hash: 23fe7b9b30ccd2c4f5bec634b705a096fa415f603f715fb02e5943b751a728bc
Instruction Fuzzy Hash: F9012836A00115BFEA105799BC89DDEB76CEB8227AF000172FB0CD3201D731963682F5

Function 1E8C5C20 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 59threadCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,O:GetFullPathName,?), ref: 1E8C5C35
?PyWinObject_AsString@@YAHPAU_object@@PAPADHPAK@Z.PYWINTYPES27(?,00000000,00000000,00000000), ref: 1E8C5C59
PyEval_SaveThread.PYTHON27 ref: 1E8C5C68
GetFullPathNameA.KERNEL32(?,00000104,?,?), ref: 1E8C5C84
PyEval_RestoreThread.PYTHON27(00000000), ref: 1E8C5C8D
?PyWinObject_FreeString@@YAXPAD@Z.PYWINTYPES27(?), ref: 1E8C5C98
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(GetFullPathName,00000000), ref: 1E8C5CAE

Strings

O:GetFullPathName, xrefs: 1E8C5C2F
GetFullPathName, xrefs: 1E8C5CA9

Memory Dump Source

Source File: 00000011.00000002.1562490344.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 00000011.00000002.1562469835.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562702731.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562730939.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Eval_Object_String@@ThreadU_object@@$Arg_Error@@FreeFullNameParsePathRestoreSaveTupleWin_
String ID: GetFullPathName$O:GetFullPathName
API String ID: 1895604217-1004454013
Opcode ID: b1ca3cdb206b3fdfd55914c8570acefb9ca115afa9de5226629a9f8bccd599da
Instruction ID: 52f28faae06c7efd4a13237f92817e9f4db7047c9379704ee39e2635c781e64d
Opcode Fuzzy Hash: b1ca3cdb206b3fdfd55914c8570acefb9ca115afa9de5226629a9f8bccd599da
Instruction Fuzzy Hash: 1F1191B55003116BE714CB64CD8DFEA37E9AFC5315F448918FA1DC32D0E675D1988B62

Function 1E8C4370 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 57COMMON

Download Yara Rule

APIs

PyErr_Format.PYTHON27(?,%s is not available on this platform,SetDllDirectory), ref: 1E8C438E
PyArg_ParseTuple.PYTHON27(?,O:SetDllDirectory,?), ref: 1E8C43AA

Strings

%s is not available on this platform, xrefs: 1E8C4388
SetDllDirectory, xrefs: 1E8C43FA
SetDllDirectory, xrefs: 1E8C4383
O:SetDllDirectory, xrefs: 1E8C43A4

Memory Dump Source

Source File: 00000011.00000002.1562490344.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 00000011.00000002.1562469835.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562702731.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562730939.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_Err_FormatParseTuple
String ID: %s is not available on this platform$O:SetDllDirectory$SetDllDirectory$SetDllDirectory
API String ID: 361908667-1607095756
Opcode ID: cddcf4f98871f80c3dae3bd17c083762a314475a384c440711551c91e302f5bf
Instruction ID: 6cc971b3f8694d759328a52b230b34422f5bf8414ef8a0999bce0a81a6cb27d7
Opcode Fuzzy Hash: cddcf4f98871f80c3dae3bd17c083762a314475a384c440711551c91e302f5bf
Instruction Fuzzy Hash: 28119A75910311ABE7049B68DC89F8A33E1FB85746F448514F90DC3361E234D9AACAA6

Function 1E8C87A0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 55threadregistryclipboardCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,O:RegisterWindowMessage,?), ref: 1E8C87B2
?PyWinObject_AsString@@YAHPAU_object@@PAPADHPAK@Z.PYWINTYPES27(?,00000000,00000000,00000000), ref: 1E8C87D3
PyEval_SaveThread.PYTHON27 ref: 1E8C87E2
RegisterClipboardFormatA.USER32(?), ref: 1E8C87EF
PyEval_RestoreThread.PYTHON27(00000000), ref: 1E8C87F8
?PyWinObject_FreeString@@YAXPAD@Z.PYWINTYPES27(?), ref: 1E8C8803
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(RegisterWindowMessage,00000000), ref: 1E8C8816

Strings

RegisterWindowMessage, xrefs: 1E8C8811
O:RegisterWindowMessage, xrefs: 1E8C87AC

Memory Dump Source

Source File: 00000011.00000002.1562490344.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 00000011.00000002.1562469835.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562702731.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562730939.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Eval_Object_String@@ThreadU_object@@$Arg_ClipboardError@@FormatFreeParseRegisterRestoreSaveTupleWin_
String ID: O:RegisterWindowMessage$RegisterWindowMessage
API String ID: 4176757481-3515438174
Opcode ID: 79b61061e756ccbe671b3de8b14d4ee1dcac148547cab7cb88757cf085f486f1
Instruction ID: e9742d92bda9fde6cbd8875f3140e7f062253279fa11c7ffe28248d9b275e3b6
Opcode Fuzzy Hash: 79b61061e756ccbe671b3de8b14d4ee1dcac148547cab7cb88757cf085f486f1
Instruction Fuzzy Hash: 8F01D6395102107FD60057B8ED8DADB7BE8AFC1656F448528FD0DC3240E634D599C6B2

Function 1E8C4020 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 54threadlibraryCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,O:LoadLibrary,?), ref: 1E8C4032
?PyWinObject_AsString@@YAHPAU_object@@PAPADHPAK@Z.PYWINTYPES27(?,00000000,00000000,00000000), ref: 1E8C4053
PyEval_SaveThread.PYTHON27 ref: 1E8C4062
LoadLibraryA.KERNEL32(?), ref: 1E8C406F
PyEval_RestoreThread.PYTHON27(00000000), ref: 1E8C4078
?PyWinObject_FreeString@@YAXPAD@Z.PYWINTYPES27(?), ref: 1E8C4083
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(LoadLibrary,00000000), ref: 1E8C4096

Strings

LoadLibrary, xrefs: 1E8C4091
O:LoadLibrary, xrefs: 1E8C402C

Memory Dump Source

Source File: 00000011.00000002.1562490344.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 00000011.00000002.1562469835.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562702731.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562730939.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Eval_Object_String@@ThreadU_object@@$Arg_Error@@FreeLibraryLoadParseRestoreSaveTupleWin_
String ID: LoadLibrary$O:LoadLibrary
API String ID: 1508038121-2271714166
Opcode ID: 040756d8fbe13fbfa50eb7bcaf2d07c556e7e1bc92d3eb8f0d4b1d0bf88604ac
Instruction ID: 34abc1f4e1494cb67574e1fccd4a35e612180d2b4f06c1a97db0df1d86aba10b
Opcode Fuzzy Hash: 040756d8fbe13fbfa50eb7bcaf2d07c556e7e1bc92d3eb8f0d4b1d0bf88604ac
Instruction Fuzzy Hash: 5601B5359002107FE6109778DD8DADB3BE9AFC6766F848528FA4DC3200E734D599C6A6

Function 1E8C5840 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 53COMMON

Download Yara Rule

APIs

PyErr_Format.PYTHON27(?,%s is not available on this platform,GetSystemFileCacheSize), ref: 1E8C585E
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(GetSystemFileCacheSize,00000000), ref: 1E8C5885

Strings

GetSystemFileCacheSize, xrefs: 1E8C5853
NNN, xrefs: 1E8C58C1
GetSystemFileCacheSize, xrefs: 1E8C5880
%s is not available on this platform, xrefs: 1E8C5858

Memory Dump Source

Source File: 00000011.00000002.1562490344.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 00000011.00000002.1562469835.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562702731.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562730939.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Err_Error@@FormatU_object@@Win_
String ID: %s is not available on this platform$GetSystemFileCacheSize$GetSystemFileCacheSize$NNN
API String ID: 1771588633-94199171
Opcode ID: fd3b36131d9282b35e82db1b5c110b01ac8bd27e455d43245f4bfd3601474aed
Instruction ID: 0f15e2e025335361572222ae5b7acb01f9a88880eeed20a8a48ce732dcf852e6
Opcode Fuzzy Hash: fd3b36131d9282b35e82db1b5c110b01ac8bd27e455d43245f4bfd3601474aed
Instruction Fuzzy Hash: 4F019EB58003107FE200DB68DC89FEB37A9FF85605F448518FC4993301E631E66DCAA2

Function 1E7A6BB0 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 51COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27 ref: 1E7A6BCD
IsValidSecurityDescriptor.ADVAPI32(?,?,?,:GetSecurityDescriptorControl), ref: 1E7A6BE7
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(GetSecurityDescriptorControl - invalid sd,00000000,?,?,:GetSecurityDescriptorControl), ref: 1E7A6BF7

Strings

(ii), xrefs: 1E7A6C37
:GetSecurityDescriptorControl, xrefs: 1E7A6BB7
GetSecurityDescriptorControl, xrefs: 1E7A6C1A
GetSecurityDescriptorControl - invalid sd, xrefs: 1E7A6BF2

Memory Dump Source

Source File: 00000011.00000002.1561923280.000000001E7A1000.00000040.00000001.01000000.00000012.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000011.00000002.1561891626.000000001E7A0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7B9000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7BE000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562197228.000000001E7C0000.00000080.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562233172.000000001E7C2000.00000004.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e7a0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_DescriptorError@@ParseSecurityTupleU_object@@ValidWin_
String ID: (ii)$:GetSecurityDescriptorControl$GetSecurityDescriptorControl$GetSecurityDescriptorControl - invalid sd
API String ID: 2327843493-2499011972
Opcode ID: 6d6ba0ffaff844843e57d73d15357c9269305c4ba18cf1fec7f283c1e28e3407
Instruction ID: 9a10039ff0b0842cb621287ffdace2ac61019780952da1e9fe8875bc3a369c83
Opcode Fuzzy Hash: 6d6ba0ffaff844843e57d73d15357c9269305c4ba18cf1fec7f283c1e28e3407
Instruction Fuzzy Hash: DF01217A514111BBF600AB54FC45ADB77EDAFC871AF8C8618FA4981210F735E518CBA2

Function 1E8C13C0 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 51COMMON

Download Yara Rule

APIs

PyErr_Format.PYTHON27(?,%s is not available on this platform,GetHandleInformation), ref: 1E8C13DE
PyArg_ParseTuple.PYTHON27(?,O:GetHandleInformation), ref: 1E8C13F9

Strings

GetHandleInformation, xrefs: 1E8C1437
GetHandleInformation, xrefs: 1E8C13D3
%s is not available on this platform, xrefs: 1E8C13D8
O:GetHandleInformation, xrefs: 1E8C13F3

Memory Dump Source

Source File: 00000011.00000002.1562490344.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 00000011.00000002.1562469835.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562702731.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562730939.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_Err_FormatParseTuple
String ID: %s is not available on this platform$GetHandleInformation$GetHandleInformation$O:GetHandleInformation
API String ID: 361908667-3788333353
Opcode ID: 6f7c0ff3cca502408d35d3e7f65da728e159d36b139045739267e567cb3eab4a
Instruction ID: 8623642ceada62434d08cc5f8fa8b826c3cc8aa3ae7958f3a8cc8e249336f8a7
Opcode Fuzzy Hash: 6f7c0ff3cca502408d35d3e7f65da728e159d36b139045739267e567cb3eab4a
Instruction Fuzzy Hash: D40140B4500202AFE610DB70EDC9EAA33E9BB85609F444528FC4D83354E635D69DCB67

Function 1E7A9D00 Relevance: 17.5, APIs: 8, Strings: 2, Instructions: 45threadmemoryCOMMON

Download Yara Rule

APIs

PyThreadState_Swap.PYTHON27(00000000,?,?,?,1E7AA79E), ref: 1E7A9D1A
Py_FatalError.PYTHON27(pywintypes: can not setup interpreter state, as current state is invalid), ref: 1E7A9D2A
PyThreadState_Swap.PYTHON27(00000000), ref: 1E7A9D38
LocalAlloc.KERNEL32(00000040,00000008,?,?,?,1E7AA79E), ref: 1E7A9D41
Py_FatalError.PYTHON27(Out of memory allocating thread state.,?,?,?,1E7AA79E), ref: 1E7A9D52
TlsSetValue.KERNEL32(00000012,00000000,?,?,?,1E7AA79E), ref: 1E7A9D5F
PyThreadState_Swap.PYTHON27(00000000,?,?,?,1E7AA79E), ref: 1E7A9D67
PyThreadState_Swap.PYTHON27(00000000,?,?,?,1E7AA79E), ref: 1E7A9D6C

Strings

Out of memory allocating thread state., xrefs: 1E7A9D4D
pywintypes: can not setup interpreter state, as current state is invalid, xrefs: 1E7A9D25

Memory Dump Source

Source File: 00000011.00000002.1561923280.000000001E7A1000.00000040.00000001.01000000.00000012.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000011.00000002.1561891626.000000001E7A0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7B9000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7BE000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562197228.000000001E7C0000.00000080.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562233172.000000001E7C2000.00000004.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e7a0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: State_SwapThread$ErrorFatal$AllocLocalValue
String ID: Out of memory allocating thread state.$pywintypes: can not setup interpreter state, as current state is invalid
API String ID: 2375178977-487933566
Opcode ID: ccc8623ac03a732d56cb195d25eb6cafb6f1c8b7f35509e46b4b40c67853ea88
Instruction ID: 100c2e5f5432e3dbe638b868fd84337567aef9e0b2b5778f7011f306665f535c
Opcode Fuzzy Hash: ccc8623ac03a732d56cb195d25eb6cafb6f1c8b7f35509e46b4b40c67853ea88
Instruction Fuzzy Hash: 6EF0D6B1980325A7F22167A4ACC5FC777DCDF8C725F1D0624EA4897250D674E445CBA2

Function 1E8CAFF0 Relevance: 17.5, APIs: 2, Strings: 8, Instructions: 33COMMON

Download Yara Rule

APIs

GlobalMemoryStatus.KERNEL32 ref: 1E8CAFF7
Py_BuildValue.PYTHON27(1E8D20EC,Length,?,MemoryLoad,?,TotalPhys,?,AvailPhys,?,TotalPageFile,?,AvailPageFile,?,TotalVirtual,?,AvailVirtual), ref: 1E8CB053

Strings

TotalPhys, xrefs: 1E8CB041
AvailPhys, xrefs: 1E8CB036
TotalVirtual, xrefs: 1E8CB018
TotalPageFile, xrefs: 1E8CB02C
AvailPageFile, xrefs: 1E8CB022
MemoryLoad, xrefs: 1E8CB047
AvailVirtual, xrefs: 1E8CB00E
Length, xrefs: 1E8CB04D

Memory Dump Source

Source File: 00000011.00000002.1562490344.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 00000011.00000002.1562469835.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562702731.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562730939.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: BuildGlobalMemoryStatusValue
String ID: AvailPageFile$AvailPhys$AvailVirtual$Length$MemoryLoad$TotalPageFile$TotalPhys$TotalVirtual
API String ID: 866325862-3466484070
Opcode ID: 170894b851bd81d58d458be23e74ec6b5add3d71c88a29d91d58a86cfb426db8
Instruction ID: b5a587bb71ccd411de42389e3ca28b7c92c37b7eabc73ef75f9d0c326a21ef6b
Opcode Fuzzy Hash: 170894b851bd81d58d458be23e74ec6b5add3d71c88a29d91d58a86cfb426db8
Instruction Fuzzy Hash: 40F0A9B1504301BBDA05DA99CC84D9BB7F9BBDCA10F008A0CB649A3310D230F8498B66

Function 1E7D2000 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 138COMMON

Download Yara Rule

APIs

PyErr_Occurred.PYTHON27(776004E0,?,?,?,?,?,?,1E7D2B38,C0000003), ref: 1E7D2004
PyErr_Fetch.PYTHON27(?,?,?,00000000,00000000,?,?,?,?,?,?,1E7D2B38,C0000003), ref: 1E7D2035
?GetPythonTraceback@@YAPADPAU_object@@00@Z.PYWINTYPES27 ref: 1E7D2054
MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000002,00000000,00000002,?,?,?,?,?,?,?), ref: 1E7D2090
73BB3B4E.MSVCR90(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,1E7D2B38,C0000003), ref: 1E7D20A3
73BB3B4E.MSVCR90(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,1E7D2B38), ref: 1E7D20CD
PyErr_Restore.PYTHON27(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,1E7D2B38), ref: 1E7D20F0

Strings

<No memory!>, xrefs: 1E7D204A
<No Python Error!>, xrefs: 1E7D2164

Memory Dump Source

Source File: 00000011.00000002.1562321143.000000001E7D1000.00000040.00000001.01000000.00000015.sdmp, Offset: 1E7D0000, based on PE: true

Associated: 00000011.00000002.1562293036.000000001E7D0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000011.00000002.1562321143.000000001E7DA000.00000040.00000001.01000000.00000015.sdmpDownload File
Associated: 00000011.00000002.1562391495.000000001E7DB000.00000080.00000001.01000000.00000015.sdmpDownload File
Associated: 00000011.00000002.1562417397.000000001E7DD000.00000004.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e7d0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Err_$ByteCharFetchMultiOccurredPythonRestoreTraceback@@U_object@@00@Wide
String ID: <No Python Error!>$<No memory!>
API String ID: 1333398504-21959789
Opcode ID: 043dd64ddae35b3f7e966d7a3ae95548ca388ecf1d006655b467b9af9660b30c
Instruction ID: c73423ecc75e0b1d340371beeb1729f8e9e8ce8440a217c044e76d15084c0d51
Opcode Fuzzy Hash: 043dd64ddae35b3f7e966d7a3ae95548ca388ecf1d006655b467b9af9660b30c
Instruction Fuzzy Hash: C941A171504345AFE300CF55D884A9BB7E9FF88710F41861DF94997220E736E94ACFA2

Function 034116E0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 94timeCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,0341B210), ref: 034116F1
GetProcessTimes.KERNEL32(00000000,?,?,?,?), ref: 0341172F
GetLastError.KERNEL32 ref: 03411739
CloseHandle.KERNEL32(00000000), ref: 03411752

Strings

(dd), xrefs: 034117EB

Memory Dump Source

Source File: 00000011.00000002.1560676867.0000000003411000.00000040.00000001.01000000.0000000F.sdmp, Offset: 03410000, based on PE: true

Associated: 00000011.00000002.1560637646.0000000003410000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560676867.000000000341B000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560676867.000000000341F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560836323.0000000003423000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_3410000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_CloseErrorHandleLastParseProcessTimesTuple
String ID: (dd)
API String ID: 459457561-1212091902
Opcode ID: b6d3deb34f669dcbf3c74187fb93e9d3e9de14b25f1bd588eb36ba41c7444f59
Instruction ID: fcf17ee3edd830483bfc5de03f55607749a6c5c40cb0babb75b73da57232f666
Opcode Fuzzy Hash: b6d3deb34f669dcbf3c74187fb93e9d3e9de14b25f1bd588eb36ba41c7444f59
Instruction Fuzzy Hash: CB312372A04A009BD300FF11E86899BB7E8FF4C744F45490DF84AA9204FB318564CBC7

Function 1E8C6F00 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 91threadregistryCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,OiiOi,?,?,?,?,?), ref: 1E8C6F40
?PyWinObject_AsHKEY@@YAHPAU_object@@PAPAUHKEY__@@@Z.PYWINTYPES27(?,?), ref: 1E8C6F5F
?PyWinObject_AsHANDLE@@YAHPAU_object@@PAPAX@Z.PYWINTYPES27(?,?), ref: 1E8C6F76
PyEval_SaveThread.PYTHON27 ref: 1E8C6F85
RegNotifyChangeKeyValue.ADVAPI32(?,?,?,?,?), ref: 1E8C6FA6
PyEval_RestoreThread.PYTHON27(00000000), ref: 1E8C6FAF

Strings

RegNotifyChangeKeyValue, xrefs: 1E8C6FD3
OiiOi, xrefs: 1E8C6F24

Memory Dump Source

Source File: 00000011.00000002.1562490344.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 00000011.00000002.1562469835.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562702731.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562730939.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Eval_Object_ThreadU_object@@$Arg_ChangeNotifyParseRestoreSaveTupleValueY__@@@
String ID: OiiOi$RegNotifyChangeKeyValue
API String ID: 3139844297-3658889070
Opcode ID: 01c136a3df25d09ed3e4b5861f6c2dadeb513a047621ef91571892eb4a0135d0
Instruction ID: f56565d22df40ec24c7b347191942098c9965372b66d78a256c1c6bdc90a8268
Opcode Fuzzy Hash: 01c136a3df25d09ed3e4b5861f6c2dadeb513a047621ef91571892eb4a0135d0
Instruction Fuzzy Hash: E72161B2518305AFD300DF5ACC88CABB7E9FFC9649F444A1DF949C3211D631EA498B62

Function 1E8CC970 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 90COMMON

Download Yara Rule

APIs

PyErr_Format.PYTHON27(?,%s is not available on this platform,EnumDisplayMonitors), ref: 1E8CC98E
PyArg_ParseTupleAndKeywords.PYTHON27 ref: 1E8CC9CE

Strings

%s is not available on this platform, xrefs: 1E8CC988
|OO:EnumDisplayMonitors, xrefs: 1E8CC9BF
EnumDisplayMonitors, xrefs: 1E8CC983

Memory Dump Source

Source File: 00000011.00000002.1562490344.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 00000011.00000002.1562469835.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562702731.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562730939.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_Err_FormatKeywordsParseTuple
String ID: %s is not available on this platform$EnumDisplayMonitors$|OO:EnumDisplayMonitors
API String ID: 223827023-1327370137
Opcode ID: b4946e72167414f735cfca7bb92e72a441d40804d697e28412e22d4a4e842604
Instruction ID: 67c82112063126f9026cf94efc8d975fc64564a107c009f5ea219a49e89bc148
Opcode Fuzzy Hash: b4946e72167414f735cfca7bb92e72a441d40804d697e28412e22d4a4e842604
Instruction Fuzzy Hash: BE218FB1614611ABD304DF69CC88ADB77E9BF86255F444A68F84DC3250E334DA49CBA2

Function 1E7A6A90 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 86COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,:GetSecurityDescriptorSacl), ref: 1E7A6AB2
IsValidSecurityDescriptor.ADVAPI32(?), ref: 1E7A6AD7
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(GetSecurityDescriptorSacl - invalid sd,00000000), ref: 1E7A6AE7

Strings

:GetSecurityDescriptorSacl, xrefs: 1E7A6AAC
GetSecurityDescriptorSacl, xrefs: 1E7A6B1A
GetSecurityDescriptorSacl - invalid sd, xrefs: 1E7A6AE2

Memory Dump Source

Source File: 00000011.00000002.1561923280.000000001E7A1000.00000040.00000001.01000000.00000012.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000011.00000002.1561891626.000000001E7A0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7B9000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7BE000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562197228.000000001E7C0000.00000080.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562233172.000000001E7C2000.00000004.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e7a0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_DescriptorError@@ParseSecurityTupleU_object@@ValidWin_
String ID: :GetSecurityDescriptorSacl$GetSecurityDescriptorSacl$GetSecurityDescriptorSacl - invalid sd
API String ID: 2327843493-3167575759
Opcode ID: 417c61ce9459df1f9022dc32d93360b0fe7123740467c1014f5c167f8f60b21b
Instruction ID: e7f34754e416fc2e343944d892b2c1f42aa59186ed79187a2b0c88e26f3d06d5
Opcode Fuzzy Hash: 417c61ce9459df1f9022dc32d93360b0fe7123740467c1014f5c167f8f60b21b
Instruction Fuzzy Hash: D5317176904640EFE305DF54DC41B9AB7E9FBC8710F488A2EE94A83760E7389504CA92

Function 1E7A6970 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 86COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,:GetSecurityDescriptorDacl), ref: 1E7A6992
IsValidSecurityDescriptor.ADVAPI32(?), ref: 1E7A69B7
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(SetSecurityDescriptorGroup - invalid sd,00000000), ref: 1E7A69C7

Strings

GetSecurityDescriptorDacl, xrefs: 1E7A69FA
SetSecurityDescriptorGroup - invalid sd, xrefs: 1E7A69C2
:GetSecurityDescriptorDacl, xrefs: 1E7A698C

Memory Dump Source

Source File: 00000011.00000002.1561923280.000000001E7A1000.00000040.00000001.01000000.00000012.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000011.00000002.1561891626.000000001E7A0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7B9000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7BE000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562197228.000000001E7C0000.00000080.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562233172.000000001E7C2000.00000004.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e7a0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_DescriptorError@@ParseSecurityTupleU_object@@ValidWin_
String ID: :GetSecurityDescriptorDacl$GetSecurityDescriptorDacl$SetSecurityDescriptorGroup - invalid sd
API String ID: 2327843493-161903415
Opcode ID: faa7b87edf4101114b97707301425c68d227c583b709021e99710b439150441a
Instruction ID: 464028e9080966ce77f36c9a9edada041dc890cda6297aff7ffd755070a99b59
Opcode Fuzzy Hash: faa7b87edf4101114b97707301425c68d227c583b709021e99710b439150441a
Instruction Fuzzy Hash: 2931527A944640EFF305DF54DC45B9AB3E9FBC8710F488B2DE94983760E7389505CA92

Function 1E8C12E0 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 83COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,OOOiii:DuplicateHandle,?,?,?,?,?,?), ref: 1E8C130B
?PyWinObject_AsHANDLE@@YAHPAU_object@@PAPAX@Z.PYWINTYPES27(?,?), ref: 1E8C132C
?PyWinObject_AsHANDLE@@YAHPAU_object@@PAPAX@Z.PYWINTYPES27(?,?), ref: 1E8C133F
?PyWinObject_AsHANDLE@@YAHPAU_object@@PAPAX@Z.PYWINTYPES27(?,?), ref: 1E8C1352

Strings

OOOiii:DuplicateHandle, xrefs: 1E8C1305
DuplicateHandle, xrefs: 1E8C1390

Memory Dump Source

Source File: 00000011.00000002.1562490344.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 00000011.00000002.1562469835.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562702731.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562730939.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Object_U_object@@$Arg_ParseTuple
String ID: DuplicateHandle$OOOiii:DuplicateHandle
API String ID: 1248562531-540718549
Opcode ID: a57080ec3c3728e07c99d3f998911132e306799c38cdd439b11c4bef7a5f6406
Instruction ID: 8d8c034a2c598071e4b69cb89a372e7fb2ac853a402b44f5587e301baf1dfe2a
Opcode Fuzzy Hash: a57080ec3c3728e07c99d3f998911132e306799c38cdd439b11c4bef7a5f6406
Instruction Fuzzy Hash: E2213EB1504202AFD604DB69DDD4CEB73FDAEC9608F444A1DF98993200F634EA598BA2

Function 1E7A6860 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 82COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,:GetSecurityDescriptorGroup), ref: 1E7A6882
IsValidSecurityDescriptor.ADVAPI32(?), ref: 1E7A68A7
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(GetSecurityDescriptorGroup - invalid sd,00000000), ref: 1E7A68B7

Strings

GetSecurityDescriptorGroup - invalid sd, xrefs: 1E7A68B2
GetSecurityDescriptorGroup, xrefs: 1E7A68E5
:GetSecurityDescriptorGroup, xrefs: 1E7A687C

Memory Dump Source

Source File: 00000011.00000002.1561923280.000000001E7A1000.00000040.00000001.01000000.00000012.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000011.00000002.1561891626.000000001E7A0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7B9000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7BE000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562197228.000000001E7C0000.00000080.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562233172.000000001E7C2000.00000004.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e7a0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_DescriptorError@@ParseSecurityTupleU_object@@ValidWin_
String ID: :GetSecurityDescriptorGroup$GetSecurityDescriptorGroup$GetSecurityDescriptorGroup - invalid sd
API String ID: 2327843493-1740808346
Opcode ID: 82317031113f2c08136d236d2381dc5a7e9a5801a018e1e3697159a299708a87
Instruction ID: 37a5aec56829149e2f2c4d167871f9ff58752d8161ddba288dd890a348b97405
Opcode Fuzzy Hash: 82317031113f2c08136d236d2381dc5a7e9a5801a018e1e3697159a299708a87
Instruction Fuzzy Hash: AC21A5B5954641EFE304DF58D841B9A77E9FBC8B10F888A2DE94A83360E738A404CA52

Function 1E8C5490 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 82COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27 ref: 1E8C54C8
?PyWinObject_AsSYSTEMTIME@@YAHPAU_object@@PAU_SYSTEMTIME@@@Z.PYWINTYPES27(?,?), ref: 1E8C54F1
?PyWinObject_AsString@@YAHPAU_object@@PAPADHPAK@Z.PYWINTYPES27(?,00000001,00000001,00000000), ref: 1E8C5510

Strings

iiO|O:GetTimeFormat, xrefs: 1E8C54BA
GetTimeFormat, xrefs: 1E8C555C

Memory Dump Source

Source File: 00000011.00000002.1562490344.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 00000011.00000002.1562469835.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562702731.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562730939.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Object_U_object@@$Arg_E@@@ParseString@@Tuple
String ID: GetTimeFormat$iiO|O:GetTimeFormat
API String ID: 2448270514-1815775382
Opcode ID: 1e7706ead334d1208c31677c11155ba746f441963d574c9494cdedcfb83db56c
Instruction ID: 43c9b9df9f4404c621f99cf8c57207f56cc31a63ba92bfe2faee2b7646d4e947
Opcode Fuzzy Hash: 1e7706ead334d1208c31677c11155ba746f441963d574c9494cdedcfb83db56c
Instruction Fuzzy Hash: 6F21AE71514312AFE710DBA4DD89EDB77E8AF85354F408918F94DC3240E634E648CBE2

Function 1E8C5390 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 82COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27 ref: 1E8C53C8
?PyWinObject_AsSYSTEMTIME@@YAHPAU_object@@PAU_SYSTEMTIME@@@Z.PYWINTYPES27(?,?), ref: 1E8C53F1
?PyWinObject_AsString@@YAHPAU_object@@PAPADHPAK@Z.PYWINTYPES27(?,00000001,00000001,00000000), ref: 1E8C5410

Strings

iiO|O:GetDateFormat, xrefs: 1E8C53BA
GetDateFormat, xrefs: 1E8C545C

Memory Dump Source

Source File: 00000011.00000002.1562490344.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 00000011.00000002.1562469835.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562702731.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562730939.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Object_U_object@@$Arg_E@@@ParseString@@Tuple
String ID: GetDateFormat$iiO|O:GetDateFormat
API String ID: 2448270514-1523432675
Opcode ID: 805856440e01bce6b9f1a592770dec48595dab8c6330e3a9cf6160e127c4a3ed
Instruction ID: 8fbccf6edc6030a595d36f21ee5390794f16633623c6f37bfc6c20ade26d7ea0
Opcode Fuzzy Hash: 805856440e01bce6b9f1a592770dec48595dab8c6330e3a9cf6160e127c4a3ed
Instruction Fuzzy Hash: 9F219CB2414311AFE710DBA4DD89ADB77E8AF85355F408918F94DC3251E234E649CBE2

Function 1E8C89A0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 77COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,OI|OO:SendMessage,?,?,?,?), ref: 1E8C89D7
?PyWinObject_AsHANDLE@@YAHPAU_object@@PAPAX@Z.PYWINTYPES27(?,?), ref: 1E8C89F4
?PyWinObject_AsPARAM@@YAHPAU_object@@PAI@Z.PYWINTYPES27(?,?), ref: 1E8C8A11
?PyWinObject_AsPARAM@@YAHPAU_object@@PAI@Z.PYWINTYPES27(?,?), ref: 1E8C8A24

Strings

OI|OO:SendMessage, xrefs: 1E8C89D1

Memory Dump Source

Source File: 00000011.00000002.1562490344.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 00000011.00000002.1562469835.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562702731.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562730939.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Object_U_object@@$Arg_ParseTuple
String ID: OI|OO:SendMessage
API String ID: 1248562531-1672979447
Opcode ID: 4316ac0989473d0a19e9a678a626ebc64ee85e673e1c30ba908e3537ce7e89cb
Instruction ID: 5f381af56ab5f93a6d7fca6181419d5c36775a2a5e4ab63516b1321efb855708
Opcode Fuzzy Hash: 4316ac0989473d0a19e9a678a626ebc64ee85e673e1c30ba908e3537ce7e89cb
Instruction Fuzzy Hash: 30211D75514212AFD700DF68CC849ABB7E9AFC9205F44891DF989C3211E634E559CBA2

Function 1E8C5FF0 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 77COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27 ref: 1E8C602D
?PyWinObject_AsPARAM@@YAHPAU_object@@PAI@Z.PYWINTYPES27(00000000,?,?,?,?,?,?,?,?), ref: 1E8C604E
?PyWinObject_AsPARAM@@YAHPAU_object@@PAI@Z.PYWINTYPES27(?,?,?,?,?,?,?,?,?,?), ref: 1E8C6061

Strings

PostThreadMessage, xrefs: 1E8C60A7
iI|OO:PostThreadMessage, xrefs: 1E8C6017

Memory Dump Source

Source File: 00000011.00000002.1562490344.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 00000011.00000002.1562469835.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562702731.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562730939.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Object_U_object@@$Arg_ParseTuple
String ID: PostThreadMessage$iI|OO:PostThreadMessage
API String ID: 1248562531-2629939695
Opcode ID: 3e73b6577046baeaa16ae45936f458097c79a212e52c54bdb8e8474024e218aa
Instruction ID: 7b49a9f00394045e8badcaafc670d7769d98234d8dd218b301be51515478d8a8
Opcode Fuzzy Hash: 3e73b6577046baeaa16ae45936f458097c79a212e52c54bdb8e8474024e218aa
Instruction Fuzzy Hash: 4F216075504211AFE300EB68CC88EEB77E9BFC9649F44495DF88DD3211E730E9498BA2

Function 1E8C1AA0 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 69COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,OO:SetEnvironmentVariable,?,?), ref: 1E8C1AC2
?PyWinObject_AsString@@YAHPAU_object@@PAPADHPAK@Z.PYWINTYPES27(?,?,00000000,00000000), ref: 1E8C1AE7
?PyWinObject_AsString@@YAHPAU_object@@PAPADHPAK@Z.PYWINTYPES27(?,?,00000001,00000000), ref: 1E8C1AFD
SetEnvironmentVariableA.KERNEL32(?,?), ref: 1E8C1B10
?PyWinObject_FreeString@@YAXPAD@Z.PYWINTYPES27(?), ref: 1E8C1B43
?PyWinObject_FreeString@@YAXPAD@Z.PYWINTYPES27(?), ref: 1E8C1B4A

Strings

SetEnvironmentVariable, xrefs: 1E8C1B2A
OO:SetEnvironmentVariable, xrefs: 1E8C1AB4

Memory Dump Source

Source File: 00000011.00000002.1562490344.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 00000011.00000002.1562469835.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562702731.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562730939.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Object_String@@$FreeU_object@@$Arg_EnvironmentParseTupleVariable
String ID: OO:SetEnvironmentVariable$SetEnvironmentVariable
API String ID: 3715059473-1236800792
Opcode ID: ff964f64653956fabb7ed36c1522f48f432f8a0566922608358a01bff9807fa4
Instruction ID: 1fb2cdec8ff39287f0ad5e88da3b47df7763529c0fdaa4bb2adeda2070a04232
Opcode Fuzzy Hash: ff964f64653956fabb7ed36c1522f48f432f8a0566922608358a01bff9807fa4
Instruction Fuzzy Hash: 82112C76614212ABE304DB59CC94CEB77F9EBC6600F844A0EFA5893250E630D559CBA2

Function 1E7AB070 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 67COMMON

Download Yara Rule

APIs

PyObject_GetAttrString.PYTHON27(?,fileno), ref: 1E7AB07D
PyErr_Clear.PYTHON27 ref: 1E7AB092
PyCallable_Check.PYTHON27(00000000), ref: 1E7AB099
PyObject_CallObject.PYTHON27(00000000,00000000), ref: 1E7AB0A9
?PyWinLong_AsVoidPtr@@YAHPAU_object@@PAPAX@Z.PYWINTYPES27(00000000,?), ref: 1E7AB0D7

Part of subcall function 1E7AA420: PyInt_AsLong.PYTHON27(?,?,?,?,1E7A40BF,?,?), ref: 1E7AA428
Part of subcall function 1E7AA420: PyErr_Occurred.PYTHON27 ref: 1E7AA442
Part of subcall function 1E7AA420: PyErr_Clear.PYTHON27 ref: 1E7AA448
Part of subcall function 1E7AA420: PyLong_AsUnsignedLong.PYTHON27(?), ref: 1E7AA44F
Part of subcall function 1E7AA420: PyErr_Occurred.PYTHON27 ref: 1E7AA45F
Part of subcall function 1E7AA420: PyErr_Format.PYTHON27(?,Unable to convert %s to pointer-sized value,?), ref: 1E7AA47A

PyErr_Clear.PYTHON27 ref: 1E7AB0F6
PyErr_SetString.PYTHON27(00000000,Expected a socket object or numeric socket handle), ref: 1E7AB106

Strings

Expected a socket object or numeric socket handle, xrefs: 1E7AB100
fileno, xrefs: 1E7AB077

Memory Dump Source

Source File: 00000011.00000002.1561923280.000000001E7A1000.00000040.00000001.01000000.00000012.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000011.00000002.1561891626.000000001E7A0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7B9000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7BE000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562197228.000000001E7C0000.00000080.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562233172.000000001E7C2000.00000004.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e7a0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Err_$Clear$LongLong_Object_OccurredString$AttrCallCallable_CheckFormatInt_ObjectPtr@@U_object@@UnsignedVoid
String ID: Expected a socket object or numeric socket handle$fileno
API String ID: 4239578665-511972153
Opcode ID: 9e5837ca91369d5dbeedda40b3dde642a381b64af3708a3e3b5dcedda7538b5b
Instruction ID: bfc32dffc34b7f4841331fec98d251c22faa771f25e0eea7832e0a809b45d00a
Opcode Fuzzy Hash: 9e5837ca91369d5dbeedda40b3dde642a381b64af3708a3e3b5dcedda7538b5b
Instruction Fuzzy Hash: 9A11ABB25001515BE3219F68AC8496BB3A9EFC5675B190714FE1583360D724DC16CBE2

Function 1E8C85C0 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 66threadregistryCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,OlO:RegSetKeySecurity,?,?,?), ref: 1E8C85DC
?PyWinObject_AsHKEY@@YAHPAU_object@@PAPAUHKEY__@@@Z.PYWINTYPES27(?,?), ref: 1E8C85F8
?PyWinObject_AsSECURITY_DESCRIPTOR@@YAHPAU_object@@PAPAXH@Z.PYWINTYPES27(?,?,00000000), ref: 1E8C8611
PyEval_SaveThread.PYTHON27 ref: 1E8C8620
RegSetKeySecurity.ADVAPI32(?,?,?), ref: 1E8C8637
PyEval_RestoreThread.PYTHON27(00000000), ref: 1E8C8640
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(RegSetKeySecurity,00000000), ref: 1E8C8653

Strings

OlO:RegSetKeySecurity, xrefs: 1E8C85D6
RegSetKeySecurity, xrefs: 1E8C864E

Memory Dump Source

Source File: 00000011.00000002.1562490344.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 00000011.00000002.1562469835.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562702731.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562730939.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: U_object@@$Eval_Object_Thread$Arg_Error@@ParseRestoreSaveSecurityTupleWin_Y__@@@
String ID: OlO:RegSetKeySecurity$RegSetKeySecurity
API String ID: 2150150574-3249879953
Opcode ID: 53c21e8c8ffeec5e3793e349735ff9428433be570529571b5414a80f33bb7d72
Instruction ID: 0f9da83946dd72e9c95b21acb852344fcd71e4dee6ab97ecb2ad99e7bfbfaa8e
Opcode Fuzzy Hash: 53c21e8c8ffeec5e3793e349735ff9428433be570529571b5414a80f33bb7d72
Instruction Fuzzy Hash: DD115EB5510211AFD300DBA8CC89DEB77E8FFC5655F844928F94AC3211E734EA59CBA2

Function 1E8C6330 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 65registryCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27 ref: 1E8C6358
?PyWinObject_AsHKEY@@YAHPAU_object@@PAPAUHKEY__@@@Z.PYWINTYPES27(?,?), ref: 1E8C6375
?PyWinObject_AsString@@YAHPAU_object@@PAPADHPAK@Z.PYWINTYPES27(?,00000001,00000001,00000000), ref: 1E8C6390
RegCreateKeyA.ADVAPI32(?,00000000,?), ref: 1E8C63AC
?PyWinObject_FreeString@@YAXPAD@Z.PYWINTYPES27(?), ref: 1E8C63B9
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(RegCreateKey,00000000), ref: 1E8C63CC

Strings

RegCreateKey, xrefs: 1E8C63C7
OO:RegCreateKey, xrefs: 1E8C634A

Memory Dump Source

Source File: 00000011.00000002.1562490344.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 00000011.00000002.1562469835.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562702731.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562730939.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Object_U_object@@$String@@$Arg_CreateError@@FreeParseTupleWin_Y__@@@
String ID: OO:RegCreateKey$RegCreateKey
API String ID: 3520019962-1835961249
Opcode ID: 2ef7af8fc587ef27979fe8c8af31c2b79ba071a68908dc41aff9ba82a1c25b93
Instruction ID: 7fcc516665a3835327092dfdb9c93c1ec968e3c93c7568302aed1131d0096eda
Opcode Fuzzy Hash: 2ef7af8fc587ef27979fe8c8af31c2b79ba071a68908dc41aff9ba82a1c25b93
Instruction Fuzzy Hash: A81193B5514311AFE314DB68CD88E9B77E9FF85A09F408928F94EC3250E730E559CBA2

Function 1E7A8FD0 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

PyString_Size.PYTHON27(?,?,?,00000001,1E7A23A8,1E7A9097,1E7A23A8,?,?,?,00000000,1E7A496F,?,?,00000000,00000000), ref: 1E7A8FDB
PyString_AsString.PYTHON27(?,?,00000000,1E7A496F,?,?,00000000,00000000,?,1E7A23A8,?,?), ref: 1E7A8FE4
PyErr_SetString.PYTHON27(?,No memory for wide string buffer,?,?,?,?,1E7A257E,77613D50,AddAccessAllowedObjectAce,?,?,?,?,?,?), ref: 1E7A9014
MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,?,1E7A257E,77613D50,AddAccessAllowedObjectAce,?,?,?), ref: 1E7A902C
SysAllocStringLen.OLEAUT32(00000000,00000000), ref: 1E7A9034
PyErr_SetString.PYTHON27(?,allocating BSTR,?,?,?,?,1E7A257E,77613D50,AddAccessAllowedObjectAce,?,?,?,?,?,?), ref: 1E7A904E
73BB3B4E.MSVCR90(00000000,?,?,?,?,1E7A257E,77613D50,AddAccessAllowedObjectAce,?,?,?,?,?,?), ref: 1E7A9058

Strings

No memory for wide string buffer, xrefs: 1E7A900E
allocating BSTR, xrefs: 1E7A9048

Memory Dump Source

Source File: 00000011.00000002.1561923280.000000001E7A1000.00000040.00000001.01000000.00000012.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000011.00000002.1561891626.000000001E7A0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7B9000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7BE000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562197228.000000001E7C0000.00000080.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562233172.000000001E7C2000.00000004.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e7a0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: String$Err_String_$AllocByteCharMultiSizeWide
String ID: No memory for wide string buffer$allocating BSTR
API String ID: 1994588576-1816726438
Opcode ID: be0a2a47d5cff7089e8e9a3b43e01c08c3965bb9de940b5c1439d5655334c603
Instruction ID: e7a47a172ca24772e3385fb284d0ba88eab744d07d90ed9ea89e88dee56d4eb1
Opcode Fuzzy Hash: be0a2a47d5cff7089e8e9a3b43e01c08c3965bb9de940b5c1439d5655334c603
Instruction Fuzzy Hash: 1C115E75611229EFF7105BA4AD88E9B37ACEFC936AF094135FA05C6200E7759910CAA1

Function 1E8C7B20 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 63registryCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,O:RegQueryInfoKey), ref: 1E8C7B31
?PyWinObject_AsHKEY@@YAHPAU_object@@PAPAUHKEY__@@@Z.PYWINTYPES27(00000000,?), ref: 1E8C7B4D
RegQueryInfoKeyA.ADVAPI32(?,00000000,00000000,00000000,?,00000000,00000000,?,00000000,00000000,00000000,?), ref: 1E8C7B7E
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(RegQueryInfoKey,00000000), ref: 1E8C7B8E

Strings

O:RegQueryInfoKey, xrefs: 1E8C7B2B
RegQueryInfoKey, xrefs: 1E8C7B89
iiN, xrefs: 1E8C7BC1

Memory Dump Source

Source File: 00000011.00000002.1562490344.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 00000011.00000002.1562469835.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562702731.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562730939.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: U_object@@$Arg_Error@@InfoObject_ParseQueryTupleWin_Y__@@@
String ID: O:RegQueryInfoKey$RegQueryInfoKey$iiN
API String ID: 1520217418-3767673079
Opcode ID: f92101b87baaa58ba158f020ab9bcdbb323b388ba0008b8c6fe9cc1b0af4551e
Instruction ID: 9fbb9a7b52fdaba7fe553a3f3ca3973878c966cd5e3249f6bcf2cc04ff2c7037
Opcode Fuzzy Hash: f92101b87baaa58ba158f020ab9bcdbb323b388ba0008b8c6fe9cc1b0af4551e
Instruction Fuzzy Hash: E9111FB0504301AFE714DB64CC85FABB7E9BF88704F404918F698D3280E671D558CB66

Function 1E8C6170 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 63registryCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27 ref: 1E8C618F
?PyWinObject_AsHKEY@@YAHPAU_object@@PAPAUHKEY__@@@Z.PYWINTYPES27(?,?), ref: 1E8C61AC
?PyWinObject_AsString@@YAHPAU_object@@PAPADHPAK@Z.PYWINTYPES27(?,00000001,00000001,00000000), ref: 1E8C61C7
RegConnectRegistryA.ADVAPI32(00000000,?,?), ref: 1E8C61E3
?PyWinObject_FreeString@@YAXPAD@Z.PYWINTYPES27(?), ref: 1E8C61F0
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(RegConnectRegistry,00000000), ref: 1E8C6203

Strings

RegConnectRegistry, xrefs: 1E8C61FE
OO:RegConnectRegistry, xrefs: 1E8C6181

Memory Dump Source

Source File: 00000011.00000002.1562490344.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 00000011.00000002.1562469835.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562702731.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562730939.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Object_U_object@@$String@@$Arg_ConnectError@@FreeParseRegistryTupleWin_Y__@@@
String ID: OO:RegConnectRegistry$RegConnectRegistry
API String ID: 1593304330-4053257052
Opcode ID: e92e32b8a94e607ce761276b8c56ef85a3a6ba8b4b56f799f336fe3dd2d327bd
Instruction ID: 81001f45075be667e6412b1e29349ea4ac79673746cd09531edd4a0370faa73b
Opcode Fuzzy Hash: e92e32b8a94e607ce761276b8c56ef85a3a6ba8b4b56f799f336fe3dd2d327bd
Instruction Fuzzy Hash: 2411B2B5504211AFE600DB68CD89EDB73E9EFC5A09F448928F94DC3241E731E958CBA7

Function 1E8C4210 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 59libraryloaderCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27 ref: 1E8C422F
?PyWinObject_AsHANDLE@@YAHPAU_object@@PAPAX@Z.PYWINTYPES27(?,?), ref: 1E8C424C
?PyWinObject_AsResourceIdA@@YAHPAU_object@@PAPADH@Z.PYWINTYPES27(?,00000000,00000000), ref: 1E8C4265
GetProcAddress.KERNEL32(?), ref: 1E8C427C
?PyWinObject_FreeResourceId@@YAXPAD@Z.PYWINTYPES27(?), ref: 1E8C4289
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(GetProcAddress,00000000), ref: 1E8C429C

Strings

GetProcAddress, xrefs: 1E8C4297
OO:GetProcAddress, xrefs: 1E8C4221

Memory Dump Source

Source File: 00000011.00000002.1562490344.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 00000011.00000002.1562469835.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562702731.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562730939.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Object_U_object@@$Resource$AddressArg_Error@@FreeId@@ParseProcTupleWin_
String ID: GetProcAddress$OO:GetProcAddress
API String ID: 2070942437-1932483860
Opcode ID: ad6da6f3cac10a4c9f868802923917457701d011b009e35efdad0055511e5de2
Instruction ID: 4ca27b447c9b2fc01e5d42690da257960eb92f777495014b62f6d7d964871e53
Opcode Fuzzy Hash: ad6da6f3cac10a4c9f868802923917457701d011b009e35efdad0055511e5de2
Instruction Fuzzy Hash: 2511A0755042116FE300EB68CD8AADB3BE8EF85245F804918F94DC3251E730D598C7A2

Function 1E8C1460 Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 56COMMON

Download Yara Rule

APIs

PyErr_Format.PYTHON27(?,%s is not available on this platform,SetHandleInformation), ref: 1E8C147E
PyArg_ParseTuple.PYTHON27(?,Okk:SetHandleInformation,?,?,?), ref: 1E8C14A4

Strings

%s is not available on this platform, xrefs: 1E8C1478
SetHandleInformation, xrefs: 1E8C14E7
SetHandleInformation, xrefs: 1E8C1473
Okk:SetHandleInformation, xrefs: 1E8C149E

Memory Dump Source

Source File: 00000011.00000002.1562490344.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 00000011.00000002.1562469835.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562702731.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562730939.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_Err_FormatParseTuple
String ID: %s is not available on this platform$Okk:SetHandleInformation$SetHandleInformation$SetHandleInformation
API String ID: 361908667-1298775441
Opcode ID: 2efaea8d4860490fc697b61386f2ff988010e963a4b6843afa684460c68c73b0
Instruction ID: fe1766e325c506101042777a94bea95d1d80880727e6ce4800cbbb54a38ef7cd
Opcode Fuzzy Hash: 2efaea8d4860490fc697b61386f2ff988010e963a4b6843afa684460c68c73b0
Instruction Fuzzy Hash: 041170B8510212AFE700DB28CCC8DA673F9FB86205F848A58F85DC3361E635D599CB52

Function 1E8C9330 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 56threadCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,Oi:SetFileAttributes,?,?), ref: 1E8C9347
?PyWinObject_AsString@@YAHPAU_object@@PAPADHPAK@Z.PYWINTYPES27(?,00000000,00000000,00000000), ref: 1E8C9368
PyEval_SaveThread.PYTHON27 ref: 1E8C9377
SetFileAttributesA.KERNEL32(?,?), ref: 1E8C9389
PyEval_RestoreThread.PYTHON27(00000000), ref: 1E8C9392
?PyWinObject_FreeString@@YAXPAD@Z.PYWINTYPES27(?), ref: 1E8C939D
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(SetFileAttributes,00000000), ref: 1E8C93B3

Strings

Oi:SetFileAttributes, xrefs: 1E8C9341
SetFileAttributes, xrefs: 1E8C93AE

Memory Dump Source

Source File: 00000011.00000002.1562490344.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 00000011.00000002.1562469835.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562702731.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562730939.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Eval_Object_String@@ThreadU_object@@$Arg_AttributesError@@FileFreeParseRestoreSaveTupleWin_
String ID: Oi:SetFileAttributes$SetFileAttributes
API String ID: 3610538708-1768512846
Opcode ID: b773c16b9ab34725824124abb7d7a6b590dfeb5b359db13981e008a70d3e1f1e
Instruction ID: 28c513b1b87589ddfa7f215263c0889c34471b427e8e1d4e61f3c69cc67e8488
Opcode Fuzzy Hash: b773c16b9ab34725824124abb7d7a6b590dfeb5b359db13981e008a70d3e1f1e
Instruction Fuzzy Hash: D3113079510211AFE310DB78DC8DBEA37E8AF85655F448518FA0DC3250E734D559CBA2

Function 1E8C1640 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 52threadfileCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,O:DeleteFile,?), ref: 1E8C1652
?PyWinObject_AsString@@YAHPAU_object@@PAPADHPAK@Z.PYWINTYPES27(?,00000000,00000000,00000000), ref: 1E8C1673
PyEval_SaveThread.PYTHON27 ref: 1E8C1682
DeleteFileA.KERNEL32(?), ref: 1E8C168F
PyEval_RestoreThread.PYTHON27(00000000), ref: 1E8C1698
?PyWinObject_FreeString@@YAXPAD@Z.PYWINTYPES27(?), ref: 1E8C16A3
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(DeleteFile,00000000), ref: 1E8C16B9

Strings

DeleteFile, xrefs: 1E8C16B4
O:DeleteFile, xrefs: 1E8C164C

Memory Dump Source

Source File: 00000011.00000002.1562490344.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 00000011.00000002.1562469835.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562702731.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562730939.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Eval_Object_String@@ThreadU_object@@$Arg_DeleteError@@FileFreeParseRestoreSaveTupleWin_
String ID: DeleteFile$O:DeleteFile
API String ID: 3580031932-1169856613
Opcode ID: efff25156973c8738df8a8e2cbfa9780a7759b3de42862ade3bfd13503303295
Instruction ID: 0c020ab8722f410430d835d4b06f61bbb3775530ca325cbfaa1ab5741c2c1cba
Opcode Fuzzy Hash: efff25156973c8738df8a8e2cbfa9780a7759b3de42862ade3bfd13503303295
Instruction Fuzzy Hash: 60019279500211BFE7009B74DC8DEDA37F8AFC6746F448528FA0DC3251E634D599CAA6

Function 1E8C8A70 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 52threadCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,O:SetConsoleTitle,?), ref: 1E8C8A82
?PyWinObject_AsString@@YAHPAU_object@@PAPADHPAK@Z.PYWINTYPES27(?,00000000,00000000,00000000), ref: 1E8C8AA3
PyEval_SaveThread.PYTHON27 ref: 1E8C8AB2
SetConsoleTitleA.KERNEL32(?), ref: 1E8C8ABF
PyEval_RestoreThread.PYTHON27(00000000), ref: 1E8C8AC8
?PyWinObject_FreeString@@YAXPAD@Z.PYWINTYPES27(?), ref: 1E8C8AD3
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(SetConsoleTitle,00000000), ref: 1E8C8AE9

Strings

O:SetConsoleTitle, xrefs: 1E8C8A7C
SetConsoleTitle, xrefs: 1E8C8AE4

Memory Dump Source

Source File: 00000011.00000002.1562490344.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 00000011.00000002.1562469835.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562702731.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562730939.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Eval_Object_String@@ThreadU_object@@$Arg_ConsoleError@@FreeParseRestoreSaveTitleTupleWin_
String ID: O:SetConsoleTitle$SetConsoleTitle
API String ID: 1171155573-358701353
Opcode ID: 31e4524fb1d42c22c9182ee6acb77623473d95a6ab49ce5076c69c05980cffec
Instruction ID: b2999665c28ac694a174f86dc0f3312bd8a3613d2403d23b208708aee577fba6
Opcode Fuzzy Hash: 31e4524fb1d42c22c9182ee6acb77623473d95a6ab49ce5076c69c05980cffec
Instruction Fuzzy Hash: 300122395102117FE7009B74EC8DADA37E8AFC5242F448428FA0CC3200E730D559CB62

Function 1E8C3D70 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 52threadCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,O:AbortSystemShutdown,?), ref: 1E8C3D82
?PyWinObject_AsString@@YAHPAU_object@@PAPADHPAK@Z.PYWINTYPES27(?,00000001,00000001,00000000), ref: 1E8C3DA3
PyEval_SaveThread.PYTHON27 ref: 1E8C3DB2
AbortSystemShutdownA.ADVAPI32(?), ref: 1E8C3DBF
PyEval_RestoreThread.PYTHON27(00000000), ref: 1E8C3DC8
?PyWinObject_FreeString@@YAXPAD@Z.PYWINTYPES27(?), ref: 1E8C3DD3
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(AbortSystemShutdown,00000000), ref: 1E8C3DE9

Strings

AbortSystemShutdown, xrefs: 1E8C3DE4
O:AbortSystemShutdown, xrefs: 1E8C3D7C

Memory Dump Source

Source File: 00000011.00000002.1562490344.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 00000011.00000002.1562469835.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562702731.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562730939.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Eval_Object_String@@ThreadU_object@@$AbortArg_Error@@FreeParseRestoreSaveShutdownSystemTupleWin_
String ID: AbortSystemShutdown$O:AbortSystemShutdown
API String ID: 4230516972-797590645
Opcode ID: d04b490d777bee1fef717eac13c973017b353d54cbacb63de957b78173ccf6e0
Instruction ID: 3da26bba223cd0098e4e4f0556025184ee49c8f4f60150ec8c72e1a10ab42402
Opcode Fuzzy Hash: d04b490d777bee1fef717eac13c973017b353d54cbacb63de957b78173ccf6e0
Instruction Fuzzy Hash: AF01D239500311BFE700AB74DC8DA9A37E9EFC6746F448528FA0DC3240E734D65ACAA6

Function 1E7AA240 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

PyLong_FromUnsignedLong.PYTHON27(?,?,?), ref: 1E7AA25B
PyLong_FromUnsignedLong.PYTHON27(?,00000000), ref: 1E7AA265
PyLong_FromUnsignedLong.PYTHON27(?,00000000), ref: 1E7AA26F
PyLong_FromUnsignedLong.PYTHON27(?,00000000), ref: 1E7AA279
?PyWinObject_FromFILETIME@@YAPAU_object@@ABU_FILETIME@@@Z.PYWINTYPES27(00000000,00000000), ref: 1E7AA283

Part of subcall function 1E7A8670: FileTimeToSystemTime.KERNEL32(?,?), ref: 1E7A86A4
Part of subcall function 1E7A8670: SystemTimeToVariantTime.OLEAUT32(?,00000008), ref: 1E7A86B0

?PyWinObject_FromFILETIME@@YAPAU_object@@ABU_FILETIME@@@Z.PYWINTYPES27(?,00000000,00000000), ref: 1E7AA290
?PyWinObject_FromFILETIME@@YAPAU_object@@ABU_FILETIME@@@Z.PYWINTYPES27(?,00000000,00000000,00000000), ref: 1E7AA29D
Py_BuildValue.PYTHON27(lNNNNNNNss,00000000,00000000,00000000,00000000,00000000), ref: 1E7AA2AE

Strings

lNNNNNNNss, xrefs: 1E7AA2A9

Memory Dump Source

Source File: 00000011.00000002.1561923280.000000001E7A1000.00000040.00000001.01000000.00000012.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000011.00000002.1561891626.000000001E7A0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7B9000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7BE000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562197228.000000001E7C0000.00000080.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562233172.000000001E7C2000.00000004.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e7a0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: From$LongLong_TimeUnsigned$E@@@Object_U_object@@$System$BuildFileValueVariant
String ID: lNNNNNNNss
API String ID: 226951647-140673701
Opcode ID: 29c7b9fb93da712869211954bc8f8307b174198e128e6b182aca9ef11228c3d2
Instruction ID: 8d7559af46dc0984322f29bbf1d0321cf9bf0cd692bd74063bf3c80f8244369f
Opcode Fuzzy Hash: 29c7b9fb93da712869211954bc8f8307b174198e128e6b182aca9ef11228c3d2
Instruction Fuzzy Hash: 9501E5F69006047BF210DB64EC85C97B3ED9FD82187054B29F58BD3611E531F5598BB2

Function 1E7AA2C0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

PyLong_FromUnsignedLong.PYTHON27(?,?,?), ref: 1E7AA2DB
PyLong_FromUnsignedLong.PYTHON27(?,00000000), ref: 1E7AA2E5
PyLong_FromUnsignedLong.PYTHON27(?,00000000), ref: 1E7AA2EF
PyLong_FromUnsignedLong.PYTHON27(?,00000000), ref: 1E7AA2F9
?PyWinObject_FromFILETIME@@YAPAU_object@@ABU_FILETIME@@@Z.PYWINTYPES27(00000000,00000000), ref: 1E7AA303

Part of subcall function 1E7A8670: FileTimeToSystemTime.KERNEL32(?,?), ref: 1E7A86A4
Part of subcall function 1E7A8670: SystemTimeToVariantTime.OLEAUT32(?,00000008), ref: 1E7A86B0

?PyWinObject_FromFILETIME@@YAPAU_object@@ABU_FILETIME@@@Z.PYWINTYPES27(?,00000000,00000000), ref: 1E7AA310
?PyWinObject_FromFILETIME@@YAPAU_object@@ABU_FILETIME@@@Z.PYWINTYPES27(?,00000000,00000000,00000000), ref: 1E7AA31D
Py_BuildValue.PYTHON27(lNNNNNNNuu,00000000,00000000,00000000,00000000,00000000), ref: 1E7AA32E

Strings

lNNNNNNNuu, xrefs: 1E7AA329

Memory Dump Source

Source File: 00000011.00000002.1561923280.000000001E7A1000.00000040.00000001.01000000.00000012.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000011.00000002.1561891626.000000001E7A0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7B9000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7BE000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562197228.000000001E7C0000.00000080.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562233172.000000001E7C2000.00000004.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e7a0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: From$LongLong_TimeUnsigned$E@@@Object_U_object@@$System$BuildFileValueVariant
String ID: lNNNNNNNuu
API String ID: 226951647-3076227094
Opcode ID: ea6d8460fc3f1a93d30d1f7e53a5c5a37ade5cb1a484eb73bb9de0b6123212c6
Instruction ID: 783277239b02f11cc4275b66ae2b8763e9dd7c712c34bfc3979158c81df6efe5
Opcode Fuzzy Hash: ea6d8460fc3f1a93d30d1f7e53a5c5a37ade5cb1a484eb73bb9de0b6123212c6
Instruction Fuzzy Hash: 370121F69006047BF210DB64EC85C97B3AD9F882187054B29F58BD3611EA31F5198BB2

Function 03414E20 Relevance: 15.1, APIs: 10, Instructions: 140processCOMMON

Download Yara Rule

APIs

PyDict_New.PYTHON27 ref: 03414E2A
CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 03414E61
PyErr_SetFromWindowsErr.PYTHON27(00000000,00000002,00000000), ref: 03414E73

Memory Dump Source

Source File: 00000011.00000002.1560676867.0000000003411000.00000040.00000001.01000000.0000000F.sdmp, Offset: 03410000, based on PE: true

Associated: 00000011.00000002.1560637646.0000000003410000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560676867.000000000341B000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560676867.000000000341F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560836323.0000000003423000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_3410000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: CreateDict_Err_FromSnapshotToolhelp32Windows
String ID:
API String ID: 4291761330-0
Opcode ID: 9765a497ddae76b57121cdf3537518bb16cd9b531b898eac6ca3a6aa8bff460c
Instruction ID: 3496fcd39a0d4eb03d4584ee182a97ff46e084e80903044953fa13a3f4bd7614
Opcode Fuzzy Hash: 9765a497ddae76b57121cdf3537518bb16cd9b531b898eac6ca3a6aa8bff460c
Instruction Fuzzy Hash: DF41A7726007015FD710DA65EC41AABB3E8EB85730F184769E9258F380E739E926C7D6

Function 1E7D2430 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 159COMMON

Download Yara Rule

APIs

Part of subcall function 1E7D1400: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,?), ref: 1E7D1469
Part of subcall function 1E7D1400: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000000), ref: 1E7D148E
Part of subcall function 1E7D1400: Py_SetProgramName.PYTHON27(?,?), ref: 1E7D14AE
Part of subcall function 1E7D1400: Py_Initialize.PYTHON27(?), ref: 1E7D14B7
Part of subcall function 1E7D1400: PyEval_InitThreads.PYTHON27(?,?), ref: 1E7D14BD
Part of subcall function 1E7D1400: PySys_SetArgv.PYTHON27(00000000,00000000), ref: 1E7D14C9
Part of subcall function 1E7D1400: initservicemanager.SERVICEMANAGER ref: 1E7D14D2
Part of subcall function 1E7D1400: 73BB3B4E.MSVCR90 ref: 1E7D14E7
Part of subcall function 1E7D1400: 73BB3B4E.MSVCR90(00000000), ref: 1E7D14F2

PySys_GetObject.PYTHON27(path), ref: 1E7D2482
?PyWinObject_FromOLECHAR@@YAPAU_object@@PB_W@Z.PYWINTYPES27(?), ref: 1E7D24B0

Part of subcall function 1E7D2000: PyErr_Occurred.PYTHON27(776004E0,?,?,?,?,?,?,1E7D2B38,C0000003), ref: 1E7D2004
Part of subcall function 1E7D2000: PyErr_Fetch.PYTHON27(?,?,?,00000000,00000000,?,?,?,?,?,?,1E7D2B38,C0000003), ref: 1E7D2035
Part of subcall function 1E7D2000: ?GetPythonTraceback@@YAPADPAU_object@@00@Z.PYWINTYPES27 ref: 1E7D2054
Part of subcall function 1E7D2000: MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000002,00000000,00000002,?,?,?,?,?,?,?), ref: 1E7D2090
Part of subcall function 1E7D2000: 73BB3B4E.MSVCR90(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,1E7D2B38,C0000003), ref: 1E7D20A3
Part of subcall function 1E7D2000: 73BB3B4E.MSVCR90(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,1E7D2B38), ref: 1E7D20CD
Part of subcall function 1E7D2000: PyErr_Restore.PYTHON27(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,1E7D2B38), ref: 1E7D20F0

Strings

path, xrefs: 1E7D2477

Memory Dump Source

Source File: 00000011.00000002.1562321143.000000001E7D1000.00000040.00000001.01000000.00000015.sdmp, Offset: 1E7D0000, based on PE: true

Associated: 00000011.00000002.1562293036.000000001E7D0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000011.00000002.1562321143.000000001E7DA000.00000040.00000001.01000000.00000015.sdmpDownload File
Associated: 00000011.00000002.1562391495.000000001E7DB000.00000080.00000001.01000000.00000015.sdmpDownload File
Associated: 00000011.00000002.1562417397.000000001E7DD000.00000004.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e7d0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: ByteCharErr_MultiWide$Sys_$ArgvEval_FetchFromInitInitializeNameObjectObject_OccurredProgramPythonRestoreThreadsTraceback@@U_object@@U_object@@00@initservicemanager
String ID: path
API String ID: 2776858932-190089999
Opcode ID: 26239ddff2df7d7167a8f024cadb0282f09da6fa94adb9e84379d58ed97f0b08
Instruction ID: a0dad073360c693050753c08007b20f091d996a6e6000b6fc62071cc923a0f61
Opcode Fuzzy Hash: 26239ddff2df7d7167a8f024cadb0282f09da6fa94adb9e84379d58ed97f0b08
Instruction Fuzzy Hash: B74127B6A403419BF3109B74FC81BD77395FB80635F054635EE5982250FB39E90F96A2

Function 1E7A8B50 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 132COMMON

Download Yara Rule

APIs

PyString_Size.PYTHON27(?), ref: 1E7A8B70
PyString_AsString.PYTHON27(?), ref: 1E7A8B79
MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000001,00000000,00000001), ref: 1E7A8BB3

Strings

None is not a valid string in this context, xrefs: 1E7A8C5B
Objects of type '%s' can not be converted to Unicode., xrefs: 1E7A8C93
<NULL!!>, xrefs: 1E7A8C85, 1E7A8C92

Memory Dump Source

Source File: 00000011.00000002.1561923280.000000001E7A1000.00000040.00000001.01000000.00000012.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000011.00000002.1561891626.000000001E7A0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7B9000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7BE000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562197228.000000001E7C0000.00000080.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562233172.000000001E7C2000.00000004.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e7a0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: String_$ByteCharMultiSizeStringWide
String ID: <NULL!!>$None is not a valid string in this context$Objects of type '%s' can not be converted to Unicode.
API String ID: 3620505828-2588796395
Opcode ID: 9695196e308920f2d9711e818f48ee156ec3717358ce3a87fb36060f4d2a2ff3
Instruction ID: 816fdea7d5f86ff04bd9560b81f2b39bc5147ff453ca0d401097f5181598cbf4
Opcode Fuzzy Hash: 9695196e308920f2d9711e818f48ee156ec3717358ce3a87fb36060f4d2a2ff3
Instruction Fuzzy Hash: 7C416D72605315DBF700CB15D898B6AF3E9FBC862AF184B6AFA4687250D771E804CF51

Function 1E7A52C0 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 111COMMON

Download Yara Rule

APIs

PyString_AsString.PYTHON27(?), ref: 1E7A52C6

Strings

hEvent, xrefs: 1E7A52D7
InternalHigh, xrefs: 1E7A5371
Internal, xrefs: 1E7A532E

Memory Dump Source

Source File: 00000011.00000002.1561923280.000000001E7A1000.00000040.00000001.01000000.00000012.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000011.00000002.1561891626.000000001E7A0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7B9000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7BE000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562197228.000000001E7C0000.00000080.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562233172.000000001E7C2000.00000004.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e7a0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: StringString_
String ID: Internal$InternalHigh$hEvent
API String ID: 2379771998-1769053571
Opcode ID: f1d4e81b57f43aedc0361992f2b635869fbbb8344ae69cdbb6c6c4903ebfc143
Instruction ID: be37ab9247fd3a51731e11c0354bb10621c715aed4dcb6765d6b6edd2dd1584e
Opcode Fuzzy Hash: f1d4e81b57f43aedc0361992f2b635869fbbb8344ae69cdbb6c6c4903ebfc143
Instruction Fuzzy Hash: E3314CB2B191C14FF3048F3474705AA7B635ED613C75D8398EAC58B2A6E323D445CB00

Function 1E7AB1F0 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 108COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON27(?,Sequence of dwords cannot be None), ref: 1E7AB239
?PyWinSequence_Tuple@@YAPAU_object@@PAU1@PAK@Z.PYWINTYPES27(?,?), ref: 1E7AB24B

Strings

Unable to allocate %d bytes, xrefs: 1E7AB283
Sequence of dwords cannot be None, xrefs: 1E7AB233

Memory Dump Source

Source File: 00000011.00000002.1561923280.000000001E7A1000.00000040.00000001.01000000.00000012.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000011.00000002.1561891626.000000001E7A0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7B9000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7BE000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562197228.000000001E7C0000.00000080.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562233172.000000001E7C2000.00000004.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e7a0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Err_Sequence_StringTuple@@U_object@@
String ID: Sequence of dwords cannot be None$Unable to allocate %d bytes
API String ID: 2371632171-651347692
Opcode ID: 2a249800d83bd6d6c84c4d92078d754bbfe1dd71311d196c1bd58276d53e47cf
Instruction ID: ddbb6eb8447afaead330f2fd2352a1f31a3e85ffda3fb85ce7135e679b8562f3
Opcode Fuzzy Hash: 2a249800d83bd6d6c84c4d92078d754bbfe1dd71311d196c1bd58276d53e47cf
Instruction Fuzzy Hash: F23183B15002169FF700CF18EC8465AB7AAFFC9325F184B26FA4687390D775E855CB91

Function 1E7A8DC0 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 100COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON27(?,None is not a valid string in this context,?,?,1E7A7B2B,?,00000000,00000000,00000000), ref: 1E7A8DE3
PyUnicode_EncodeMBCS.PYTHON27(?,?,00000000,?,?,1E7A7B2B,?,00000000,00000000,00000000), ref: 1E7A8E1F
PyErr_Format.PYTHON27(00000000,The object must be a string or unicode object (got '%s'),?,?,?,1E7A7B2B,?,00000000,00000000,00000000), ref: 1E7A8E4E

Strings

The object must be a string or unicode object (got '%s'), xrefs: 1E7A8E48
None is not a valid string in this context, xrefs: 1E7A8DDD

Memory Dump Source

Source File: 00000011.00000002.1561923280.000000001E7A1000.00000040.00000001.01000000.00000012.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000011.00000002.1561891626.000000001E7A0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7B9000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7BE000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562197228.000000001E7C0000.00000080.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562233172.000000001E7C2000.00000004.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e7a0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Err_$EncodeFormatStringUnicode_
String ID: None is not a valid string in this context$The object must be a string or unicode object (got '%s')
API String ID: 1174541588-510607355
Opcode ID: 7e6484846559ed9676a426b62976600644b7884e14c572ecdeb284ea673d4b26
Instruction ID: 836f9818a87c38968307443dd06bbac2c8c7422a9732f638d15edd3a1af459a4
Opcode Fuzzy Hash: 7e6484846559ed9676a426b62976600644b7884e14c572ecdeb284ea673d4b26
Instruction Fuzzy Hash: B9318C7561431ADFE310DF64D888A97B7E9EFC8328F094A19FA198B250D771EC50CB90

Function 0341740C Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 94serviceCOMMON

Download Yara Rule

APIs

PyUnicodeUCS2_FromWideChar.PYTHON27 ref: 03417437
PyUnicodeUCS2_FromWideChar.PYTHON27(?,?), ref: 03417461
Py_BuildValue.PYTHON27((OO),00000000,00000000), ref: 03417477
PyList_Append.PYTHON27(?,00000000), ref: 03417494
CloseServiceHandle.ADVAPI32(?), ref: 034174F6
73BB3B4E.MSVCR90(00000000), ref: 034174FD

Strings

,, xrefs: 034174D9
(OO), xrefs: 03417472

Memory Dump Source

Source File: 00000011.00000002.1560676867.0000000003411000.00000040.00000001.01000000.0000000F.sdmp, Offset: 03410000, based on PE: true

Associated: 00000011.00000002.1560637646.0000000003410000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560676867.000000000341B000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560676867.000000000341F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560836323.0000000003423000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_3410000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: CharFromUnicodeWide$AppendBuildCloseHandleList_ServiceValue
String ID: (OO)$,
API String ID: 556702654-3074773281
Opcode ID: 5e84dbafd2f50afa3104c4ccf3a1578d0a108e9d7672e6e752c2479e3400ee5a
Instruction ID: fc0400684c8542ace91196d442eeb22c65442272008f8ec7ae52b7aa30fa7178
Opcode Fuzzy Hash: 5e84dbafd2f50afa3104c4ccf3a1578d0a108e9d7672e6e752c2479e3400ee5a
Instruction Fuzzy Hash: 9C31D1719006019FC700DF28DD4085BBBE5FF88264F184A19ED999B344D734EA22CBD6

Function 1E7D1620 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 90registryCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(1E7D0000,1E7D6448,00000104), ref: 1E7D164D
RegCreateKeyExW.ADVAPI32(80000002,?,00000000,00000000,00000000,00020006,00000000,00000000,00000000,00000000,00000000), ref: 1E7D16D0
RegSetValueExW.ADVAPI32(?,EventMessageFile,00000000,00000001,1E7D6448,00000000), ref: 1E7D170F
RegSetValueExW.ADVAPI32(?,?,?,TypesSupported,00000000,00000004,?,00000004), ref: 1E7D172E
RegCloseKey.ADVAPI32(?), ref: 1E7D1735

Strings

TypesSupported, xrefs: 1E7D1720
Python Service, xrefs: 1E7D1674
EventMessageFile, xrefs: 1E7D1709

Memory Dump Source

Source File: 00000011.00000002.1562321143.000000001E7D1000.00000040.00000001.01000000.00000015.sdmp, Offset: 1E7D0000, based on PE: true

Associated: 00000011.00000002.1562293036.000000001E7D0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000011.00000002.1562321143.000000001E7DA000.00000040.00000001.01000000.00000015.sdmpDownload File
Associated: 00000011.00000002.1562391495.000000001E7DB000.00000080.00000001.01000000.00000015.sdmpDownload File
Associated: 00000011.00000002.1562417397.000000001E7DD000.00000004.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e7d0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Value$CloseCreateFileModuleName
String ID: EventMessageFile$Python Service$TypesSupported
API String ID: 3045805707-2879936719
Opcode ID: 5e4c88f888cf83aa022e1fc8f0c0d2040b376688563c4dd23e26047f5ea31456
Instruction ID: b5c2bf9ad9d169c6600898d0995fa9170baeab6da0eb9e85a9eb099a34f91c07
Opcode Fuzzy Hash: 5e4c88f888cf83aa022e1fc8f0c0d2040b376688563c4dd23e26047f5ea31456
Instruction Fuzzy Hash: 1731D571610315ABF3209B94DC96F9772E9FB88750F048A08FA46DB2E4E7B4A548C751

Function 1E7A4EB0 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 84COMMON

Download Yara Rule

APIs

PyErr_Occurred.PYTHON27 ref: 1E7A4ECB
PyLong_AsLongLong.PYTHON27(?), ref: 1E7A4EFA
PyErr_Occurred.PYTHON27 ref: 1E7A4F16
PyErr_WarnEx.PYTHON27(?,Support for passing 2 integers to create a 64bit value is deprecated - pass a long instead,00000001), ref: 1E7A4F34
PyArg_ParseTuple.PYTHON27(?,1E7AFA7C,?,?,?,Support for passing 2 integers to create a 64bit value is deprecated - pass a long instead,00000001), ref: 1E7A4F4A
PyErr_SetString.PYTHON27(?,LARGE_INTEGER must be 'int', or '(int, int)'), ref: 1E7A4F65

Strings

LARGE_INTEGER must be 'int', or '(int, int)', xrefs: 1E7A4F5F
Support for passing 2 integers to create a 64bit value is deprecated - pass a long instead, xrefs: 1E7A4F2E

Memory Dump Source

Source File: 00000011.00000002.1561923280.000000001E7A1000.00000040.00000001.01000000.00000012.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000011.00000002.1561891626.000000001E7A0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7B9000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7BE000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562197228.000000001E7C0000.00000080.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562233172.000000001E7C2000.00000004.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e7a0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Err_$LongOccurred$Arg_Long_ParseStringTupleWarn
String ID: LARGE_INTEGER must be 'int', or '(int, int)'$Support for passing 2 integers to create a 64bit value is deprecated - pass a long instead
API String ID: 3544998768-3919795897
Opcode ID: d510148f98b7f15728554e47958c78d2a4a0d984e46d79f40d2536b307b7aacb
Instruction ID: d8e89d22f514e25b652b45e2bb8b4b9b86f064c7e8e8e27e4d419d61f380355b
Opcode Fuzzy Hash: d510148f98b7f15728554e47958c78d2a4a0d984e46d79f40d2536b307b7aacb
Instruction Fuzzy Hash: 0C2171716152219FE304CF28D884A8AB7E9EFC8316F1D866DFA56D72A4E731D800CB91

Function 1E7A4FA0 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 81COMMON

Download Yara Rule

APIs

PyErr_Occurred.PYTHON27 ref: 1E7A4FBC
PyLong_AsUnsignedLongLong.PYTHON27(?), ref: 1E7A4FE4
PyErr_Occurred.PYTHON27 ref: 1E7A5000
PyArg_ParseTuple.PYTHON27(?,1E7AFAB0,?,?), ref: 1E7A501F
PyErr_SetString.PYTHON27(?,ULARGE_INTEGER must be 'int', or '(int, int)'), ref: 1E7A5039
PyErr_WarnEx.PYTHON27(00000000,Support for passing 2 integers to create a 64bit value is deprecated - pass a long instead,00000001), ref: 1E7A5057

Strings

Support for passing 2 integers to create a 64bit value is deprecated - pass a long instead, xrefs: 1E7A5051
ULARGE_INTEGER must be 'int', or '(int, int)', xrefs: 1E7A5033

Memory Dump Source

Source File: 00000011.00000002.1561923280.000000001E7A1000.00000040.00000001.01000000.00000012.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000011.00000002.1561891626.000000001E7A0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7B9000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7BE000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562197228.000000001E7C0000.00000080.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562233172.000000001E7C2000.00000004.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e7a0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Err_$LongOccurred$Arg_Long_ParseStringTupleUnsignedWarn
String ID: Support for passing 2 integers to create a 64bit value is deprecated - pass a long instead$ULARGE_INTEGER must be 'int', or '(int, int)'
API String ID: 2892213224-1767028231
Opcode ID: 83e59002ea492aa35b6152b88c5022c3e6aff0c371c5813f0fc0c515e6770b64
Instruction ID: 68d9fa392a60176a49fac1aba7b9bb414ee7ce8e08f8e52357d26724eabf7afb
Opcode Fuzzy Hash: 83e59002ea492aa35b6152b88c5022c3e6aff0c371c5813f0fc0c515e6770b64
Instruction Fuzzy Hash: A2219F716012119FE304CF68D884A96B7E5ABC8319F188769FA16C72E0E731D840CB91

Function 1E8CA7A4 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 78threadCOMMON

Download Yara Rule

APIs

PyThreadState_Swap.PYTHON27(00000000), ref: 1E8CA7B0
PyThreadState_Swap.PYTHON27(00000000), ref: 1E8CA7BD
PyObject_IsSubclass.PYTHON27(?), ref: 1E8CA7CB
PyErr_SetObject.PYTHON27(?,?), ref: 1E8CA7F8
PyErr_SetString.PYTHON27(?,exception handler must return a valid object which can be raised as an exception (eg (exc_type, exc_value) or exc_class_instance)), ref: 1E8CA820

Strings

instance exception returned from exception handler may not have a separate value, xrefs: 1E8CA7DF
exception handler must return a valid object which can be raised as an exception (eg (exc_type, exc_value) or exc_class_instance), xrefs: 1E8CA812

Memory Dump Source

Source File: 00000011.00000002.1562490344.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 00000011.00000002.1562469835.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562702731.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562730939.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Err_State_SwapThread$ObjectObject_StringSubclass
String ID: exception handler must return a valid object which can be raised as an exception (eg (exc_type, exc_value) or exc_class_instance)$instance exception returned from exception handler may not have a separate value
API String ID: 591502950-790970431
Opcode ID: ca4452cd228b764df8c62bf98e757a8f4d7bb3d3d163f9a4b600ce3b3a0d2f5a
Instruction ID: 5857ef73c1b05dc43e0a3d71909422ab730530249a8b09304649a3d72bb56c85
Opcode Fuzzy Hash: ca4452cd228b764df8c62bf98e757a8f4d7bb3d3d163f9a4b600ce3b3a0d2f5a
Instruction Fuzzy Hash: E82160729001159BDB10DFA8D8D48DAB3F5FF4A220B1143B9E96AA3290D731EC82CB91

Function 03415F70 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 78COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00001000,?,03416070,00001000,00001000,00001000,034160F2,00000000,00001000,?,03411711,?,00001000), ref: 03415F82
PyErr_SetString.PYTHON27(?,iphr: exit fun), ref: 03415FBD
GetExitCodeProcess.KERNEL32(?,00000000), ref: 03415FD4
CloseHandle.KERNEL32(?), ref: 0341601D
CloseHandle.KERNEL32(?,?,03416070,00001000,00001000,00001000,034160F2,00000000,00001000,?,03411711,?,00001000), ref: 03416029

Part of subcall function 03415DC0: 73BB3B4E.MSVCR90(00000000,00000000,?), ref: 03415DEF

Strings

iphr: GetExitCodeProcess() -> STILL_ACTIVE, xrefs: 03415FEC
iphr: exit fun, xrefs: 0341604A
iphr: OpenProcess() -> ERROR_INVALID_PARAMETER, xrefs: 03415FAF

Memory Dump Source

Source File: 00000011.00000002.1560676867.0000000003411000.00000040.00000001.01000000.0000000F.sdmp, Offset: 03410000, based on PE: true

Associated: 00000011.00000002.1560637646.0000000003410000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560676867.000000000341B000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560676867.000000000341F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560836323.0000000003423000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_3410000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: CloseHandle$CodeErr_ErrorExitLastProcessString
String ID: iphr: GetExitCodeProcess() -> STILL_ACTIVE$iphr: OpenProcess() -> ERROR_INVALID_PARAMETER$iphr: exit fun
API String ID: 1037456587-1526647775
Opcode ID: ff344999ac32e2cbd1275514d80d6e73804a0a5cffa9bcad61a271d3373d1c3a
Instruction ID: 87ad76a3aec57608012bd883462ab9749d84c58ce22c82ff519c55db01559563
Opcode Fuzzy Hash: ff344999ac32e2cbd1275514d80d6e73804a0a5cffa9bcad61a271d3373d1c3a
Instruction Fuzzy Hash: D8213BB2901F005BDA10EB68E84859F77D8EF83625F19495FF812CE280C734D4648786

Function 1E8CA6D0 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 75threadCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,OOO,?,?,?), ref: 1E8CA713
PyCallable_Check.PYTHON27(?), ref: 1E8CA724
PyErr_SetString.PYTHON27(00000000,First argument must be an exception handler which accepts 2 arguments.), ref: 1E8CA73F
PyThreadState_Swap.PYTHON27(00000000), ref: 1E8CA762
PyThreadState_Swap.PYTHON27(00000000), ref: 1E8CA768
PyObject_CallObject.PYTHON27(?,?), ref: 1E8CA778

Strings

First argument must be an exception handler which accepts 2 arguments., xrefs: 1E8CA731
OOO, xrefs: 1E8CA70A

Memory Dump Source

Source File: 00000011.00000002.1562490344.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 00000011.00000002.1562469835.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562702731.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562730939.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: State_SwapThread$Arg_CallCallable_CheckErr_ObjectObject_ParseStringTuple
String ID: First argument must be an exception handler which accepts 2 arguments.$OOO
API String ID: 2129682363-1352449461
Opcode ID: 5ad5063a2e17e72756d4b8b16bdd48641aef8846f2c2d5cba09f47427f7024da
Instruction ID: c53357eb086760f4ef39b2d2badc3e70e87fa9638f2343554b1ab4568ca9031e
Opcode Fuzzy Hash: 5ad5063a2e17e72756d4b8b16bdd48641aef8846f2c2d5cba09f47427f7024da
Instruction Fuzzy Hash: E52165B2D00218AFDB00DFE9DC84ADEF7B8FB49625F40466AF919E3340E73595458BA0

Function 1E8CC6F0 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 70COMMON

Download Yara Rule

APIs

PyArg_ParseTupleAndKeywords.PYTHON27(?,?,|Ok:EnumDisplaySettings,1E8D7F74,?,?), ref: 1E8CC72E
?PyWinObject_AsString@@YAHPAU_object@@PAPADHPAK@Z.PYWINTYPES27(?,?,00000001,00000000), ref: 1E8CC752
EnumDisplaySettingsA.USER32(?,?,?), ref: 1E8CC78B
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(EnumDisplaySettings,00000000), ref: 1E8CC79B
?PyWinObject_FreeString@@YAXPAD@Z.PYWINTYPES27(?), ref: 1E8CC7BB

Strings

|Ok:EnumDisplaySettings, xrefs: 1E8CC71D
EnumDisplaySettings, xrefs: 1E8CC796

Memory Dump Source

Source File: 00000011.00000002.1562490344.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 00000011.00000002.1562469835.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562702731.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562730939.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Object_String@@U_object@@$Arg_DisplayEnumError@@FreeKeywordsParseSettingsTupleWin_
String ID: EnumDisplaySettings$|Ok:EnumDisplaySettings
API String ID: 262557981-2957657313
Opcode ID: 2161efe2338b2dff6147b6d7170a97a0b2985dd725a99f9ac41cff99ce3d7fc3
Instruction ID: 38dcdfd4769f531a5122e9445e71a23eabdd5d1adbf577628cd5e0f2432abae7
Opcode Fuzzy Hash: 2161efe2338b2dff6147b6d7170a97a0b2985dd725a99f9ac41cff99ce3d7fc3
Instruction Fuzzy Hash: 45213BB1504351ABE224DB68DC88E9B7BE8EF85644F408A2CF58DC3241E734D558CBA7

Function 034180A0 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 68registryCOMMON

Download Yara Rule

APIs

73AA68D0.PDH(00000000,00000000,?), ref: 034180AD
CreateEventW.KERNEL32(00000000,00000000,00000000,LoadUpdateEvent,?,\System\Processor Queue Length,00000000,?,00000000,00000000,?), ref: 034180D7
GetLastError.KERNEL32 ref: 034180E3
PyErr_SetFromWindowsErr.PYTHON27(00000000), ref: 034180EA
PyErr_SetExcFromWindowsErr.PYTHON27(?,00000000,00000000,00000000,?), ref: 03418116
RegisterWaitForSingleObject.KERNEL32(?,00000000,Function_00008020,00000000,000000FF,00000000), ref: 0341813A

Strings

LoadUpdateEvent, xrefs: 034180CF
\System\Processor Queue Length, xrefs: 034180C0

Memory Dump Source

Source File: 00000011.00000002.1560676867.0000000003411000.00000040.00000001.01000000.0000000F.sdmp, Offset: 03410000, based on PE: true

Associated: 00000011.00000002.1560637646.0000000003410000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560676867.000000000341B000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560676867.000000000341F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560836323.0000000003423000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_3410000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Err_FromWindows$CreateErrorEventLastObjectRegisterSingleWait
String ID: LoadUpdateEvent$\System\Processor Queue Length
API String ID: 3912169399-2418050192
Opcode ID: 87466c782e72f64904e1942d49ffa4c3b2b5e6f0c5864a7b6dbeb71a47d2400b
Instruction ID: d014b92c9b09764f485509230c9b4aa90efdd693d83fe77d1718b15e35595dc0
Opcode Fuzzy Hash: 87466c782e72f64904e1942d49ffa4c3b2b5e6f0c5864a7b6dbeb71a47d2400b
Instruction Fuzzy Hash: 5B11EFB6600B006FE650F624EC59FAB77ECEB48610F144919FD05EE284E760D914C6AA

Function 1E7D1C80 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 66COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,|OO,?,?), ref: 1E7D1CA4
?PyWinObject_AsWCHAR@@YAHPAU_object@@PAPA_WHPAK@Z.PYWINTYPES27(?,00000001,00000001,00000000), ref: 1E7D1CCA
?PyWinObject_AsWCHAR@@YAHPAU_object@@PAPA_WHPAK@Z.PYWINTYPES27(?,?,00000001,00000000), ref: 1E7D1CE1
?PyWinObject_FreeWCHAR@@YAXPA_W@Z.PYWINTYPES27(?), ref: 1E7D1CEF

Strings

|OO, xrefs: 1E7D1C9E

Memory Dump Source

Source File: 00000011.00000002.1562321143.000000001E7D1000.00000040.00000001.01000000.00000015.sdmp, Offset: 1E7D0000, based on PE: true

Associated: 00000011.00000002.1562293036.000000001E7D0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000011.00000002.1562321143.000000001E7DA000.00000040.00000001.01000000.00000015.sdmpDownload File
Associated: 00000011.00000002.1562391495.000000001E7DB000.00000080.00000001.01000000.00000015.sdmpDownload File
Associated: 00000011.00000002.1562417397.000000001E7DD000.00000004.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e7d0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Object_$U_object@@$Arg_FreeParseTuple
String ID: |OO
API String ID: 2955467632-858277869
Opcode ID: 2ab5521879703652a986c9e19c091e67a91ed52ededb46e3cc035d55ab295149
Instruction ID: d4c6b3d349695d5b39f1da46f1b206ee0d7602d8a9ee09f6d1441eb2cb494f48
Opcode Fuzzy Hash: 2ab5521879703652a986c9e19c091e67a91ed52ededb46e3cc035d55ab295149
Instruction Fuzzy Hash: 1F117275904321AFE300DB68CC85AEB77E8FF88200F408D49FA5983251F635E9088B92

Function 1E8C65E0 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 60registryCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27 ref: 1E8C65FF
?PyWinObject_AsHKEY@@YAHPAU_object@@PAPAUHKEY__@@@Z.PYWINTYPES27(?,?), ref: 1E8C661C
?PyWinObject_AsString@@YAHPAU_object@@PAPADHPAK@Z.PYWINTYPES27(?,00000000,00000000,00000000), ref: 1E8C6637
RegDeleteKeyA.ADVAPI32(?), ref: 1E8C664E
?PyWinObject_FreeString@@YAXPAD@Z.PYWINTYPES27(?), ref: 1E8C665B
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(RegDeleteKey,00000000), ref: 1E8C666E

Strings

RegDeleteKey, xrefs: 1E8C6669
OO:RegDeleteKey, xrefs: 1E8C65F1

Memory Dump Source

Source File: 00000011.00000002.1562490344.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 00000011.00000002.1562469835.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562702731.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562730939.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Object_U_object@@$String@@$Arg_DeleteError@@FreeParseTupleWin_Y__@@@
String ID: OO:RegDeleteKey$RegDeleteKey
API String ID: 3487491845-662082429
Opcode ID: cf69b9c7668b60515a10c24e7241fb0c4b88b600747e696c5d6e3419488a5974
Instruction ID: 305fa623a94ae26b3216b272c4620c6f215a0a9d338a3e034bdf798d67866d93
Opcode Fuzzy Hash: cf69b9c7668b60515a10c24e7241fb0c4b88b600747e696c5d6e3419488a5974
Instruction Fuzzy Hash: B41194B4504211AFE300DB68CC89ED777E9EF85649F404918F94DC3251E731E555CB92

Function 1E8CCB70 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 57COMMON

Download Yara Rule

APIs

PyErr_Format.PYTHON27(?,%s is not available on this platform,MonitorFromPoint), ref: 1E8CCB8E
PyArg_ParseTupleAndKeywords.PYTHON27 ref: 1E8CCBC0

Strings

MonitorFromPoint, xrefs: 1E8CCB83
O|k:MonitorFromPoint, xrefs: 1E8CCBB1
%s is not available on this platform, xrefs: 1E8CCB88

Memory Dump Source

Source File: 00000011.00000002.1562490344.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 00000011.00000002.1562469835.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562702731.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562730939.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_Err_FormatKeywordsParseTuple
String ID: %s is not available on this platform$MonitorFromPoint$O|k:MonitorFromPoint
API String ID: 223827023-2665864658
Opcode ID: e81b411af2d2fb8a3e3df6fecce4ae42c5a020a724138a98708ba83fd6aaa64d
Instruction ID: 797cc66606d9ea52f593164cbe17febcf9bbc13001d9d8d9f5226fa4cb463402
Opcode Fuzzy Hash: e81b411af2d2fb8a3e3df6fecce4ae42c5a020a724138a98708ba83fd6aaa64d
Instruction Fuzzy Hash: 3F11A0B4514216AFE304EB68CC88EA673F9FF81205F808958F94DC3311E335E599CB52

Function 03417000 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 57COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,00000000,?,034170D6), ref: 0341700B
OpenProcessToken.ADVAPI32(00000000,00000028,00000000,?,00000000,?,034170D6), ref: 03417021
GetLastError.KERNEL32(?,00000000,?,034170D6), ref: 03417027
ImpersonateSelf.ADVAPI32(00000002,?,00000000,?,034170D6), ref: 03417036
OpenProcessToken.ADVAPI32(00000000,00000028,00000000,?,00000000,?,034170D6), ref: 0341705B

Part of subcall function 03411090: GetLastError.KERNEL32 ref: 034110B2
Part of subcall function 03411090: PyErr_SetFromWindowsErrWithFilename.PYTHON27(00000000), ref: 034110B9

Strings

ImpersonateSelf, xrefs: 03417040
OpenProcessToken, xrefs: 03417074
OpenProcessToken, xrefs: 03417061

Memory Dump Source

Source File: 00000011.00000002.1560676867.0000000003411000.00000040.00000001.01000000.0000000F.sdmp, Offset: 03410000, based on PE: true

Associated: 00000011.00000002.1560637646.0000000003410000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560676867.000000000341B000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560676867.000000000341F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560836323.0000000003423000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_3410000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Process$ErrorLastOpenToken$CurrentErr_FilenameFromImpersonateSelfWindowsWith
String ID: ImpersonateSelf$OpenProcessToken$OpenProcessToken
API String ID: 2863890154-2646372828
Opcode ID: bee8e6d51cfcbe1cef632e9fbe3452e36c56234ac7254bd932b5872dce466bc6
Instruction ID: 95058fbf6cbdbf12b27510f48d140a5d43256ff1d0b8e2db0ef8ac76011d4588
Opcode Fuzzy Hash: bee8e6d51cfcbe1cef632e9fbe3452e36c56234ac7254bd932b5872dce466bc6
Instruction Fuzzy Hash: 8901B5B6A40A102EE310E7A9FC05BAFAFD8DB815A6F18007BF606DD144FB60C56042A6

Function 1E8CA320 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 56COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27 ref: 1E8CA339
?PyWinObject_AsHANDLE@@YAHPAU_object@@PAPAX@Z.PYWINTYPES27(00000000,?), ref: 1E8CA355
PyList_New.PYTHON27(00000000), ref: 1E8CA365

Strings

EnumResourceTypes, xrefs: 1E8CA3A8
O:EnumResourceTypes, xrefs: 1E8CA32B

Memory Dump Source

Source File: 00000011.00000002.1562490344.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 00000011.00000002.1562469835.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562702731.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562730939.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_List_Object_ParseTupleU_object@@
String ID: EnumResourceTypes$O:EnumResourceTypes
API String ID: 2673777529-4281011403
Opcode ID: c5d678750caadd43ac5bbd6d890d14bd7dbb60326b5afa3b282b38cd1967d983
Instruction ID: 4d6846d25a09bb338a415a7abd01405960e63a55a7fdb4bcef1f60b7580893c6
Opcode Fuzzy Hash: c5d678750caadd43ac5bbd6d890d14bd7dbb60326b5afa3b282b38cd1967d983
Instruction Fuzzy Hash: E401C8716002115BD210ABB4EC58ACB77E9BF42656F440614FC4DC3340E334D559C7A2

Function 1E8CCCD0 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 55COMMON

Download Yara Rule

APIs

PyErr_Format.PYTHON27(?,%s is not available on this platform,MonitorFromWindow), ref: 1E8CCCEE
PyArg_ParseTupleAndKeywords.PYTHON27 ref: 1E8CCD20

Strings

%s is not available on this platform, xrefs: 1E8CCCE8
O|k:MonitorFromWindow, xrefs: 1E8CCD11
MonitorFromWindow, xrefs: 1E8CCCE3

Memory Dump Source

Source File: 00000011.00000002.1562490344.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 00000011.00000002.1562469835.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562702731.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562730939.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_Err_FormatKeywordsParseTuple
String ID: %s is not available on this platform$MonitorFromWindow$O|k:MonitorFromWindow
API String ID: 223827023-3164843671
Opcode ID: 25324d5f7a8ffb9dab251f0e6472fc7fc057bd6ab9ff661e5b7b333824aaed43
Instruction ID: 97962056412182635b6da1506115ca3bb0cd8e33f242d9c389ab40465cddeaaf
Opcode Fuzzy Hash: 25324d5f7a8ffb9dab251f0e6472fc7fc057bd6ab9ff661e5b7b333824aaed43
Instruction Fuzzy Hash: 001182B4510206AFD710DB28DC88E9677E9FB85649F448618F94DC3321E335DA5DCB92

Function 1E8CCC20 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 55COMMON

Download Yara Rule

APIs

PyErr_Format.PYTHON27(?,%s is not available on this platform,MonitorFromRect), ref: 1E8CCC3E
PyArg_ParseTupleAndKeywords.PYTHON27 ref: 1E8CCC70

Strings

O|k:MonitorFromRect, xrefs: 1E8CCC61
%s is not available on this platform, xrefs: 1E8CCC38
MonitorFromRect, xrefs: 1E8CCC33

Memory Dump Source

Source File: 00000011.00000002.1562490344.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 00000011.00000002.1562469835.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562702731.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562730939.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_Err_FormatKeywordsParseTuple
String ID: %s is not available on this platform$MonitorFromRect$O|k:MonitorFromRect
API String ID: 223827023-1141344094
Opcode ID: c1ba122fcf73b6d4cec234cf5cdf7efc09bf810ee3b0819a59a0a641860fb890
Instruction ID: fb1dfa74742429da72e84d301b0f39155f64cbfa30947fc61c199224611fefd3
Opcode Fuzzy Hash: c1ba122fcf73b6d4cec234cf5cdf7efc09bf810ee3b0819a59a0a641860fb890
Instruction Fuzzy Hash: BD1182B4514606AFE704EB68CC89A8777E9BB85205F848558F80DC3311E334DA59CB92

Function 1E8C9A60 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 55threadtimeCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,hhhhhhhh:SetSystemTime,?,?,?,?,?,?,?,?), ref: 1E8C9A95
PyEval_SaveThread.PYTHON27 ref: 1E8C9AA8
SetSystemTime.KERNEL32(?), ref: 1E8C9AB5
PyEval_RestoreThread.PYTHON27(00000000), ref: 1E8C9ABE
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(SetSystemTime,00000000), ref: 1E8C9AD1

Strings

SetSystemTime, xrefs: 1E8C9ACC
hhhhhhhh:SetSystemTime, xrefs: 1E8C9A8F

Memory Dump Source

Source File: 00000011.00000002.1562490344.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 00000011.00000002.1562469835.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562702731.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562730939.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Eval_Thread$Arg_Error@@ParseRestoreSaveSystemTimeTupleU_object@@Win_
String ID: SetSystemTime$hhhhhhhh:SetSystemTime
API String ID: 3654231324-3782942145
Opcode ID: ce5b30e74a65f7a89dd888dae692b275c4533abe6778426cf6c60565d09fdc53
Instruction ID: 5d946574f1b1154512aaab02837e468e82a330523052d790e160cc26799fb718
Opcode Fuzzy Hash: ce5b30e74a65f7a89dd888dae692b275c4533abe6778426cf6c60565d09fdc53
Instruction Fuzzy Hash: 5C0184774042217BD301DB59CC88CDB77ECEEC5255F844A5AF94A83211FA30D25DCBA2

Function 1E8C9450 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 54threadCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,OiO:SetWindowLong,?,?,?), ref: 1E8C946C
?PyWinObject_AsHANDLE@@YAHPAU_object@@PAPAX@Z.PYWINTYPES27(?,?), ref: 1E8C9488
?PyWinLong_AsVoidPtr@@YAHPAU_object@@PAPAX@Z.PYWINTYPES27(?,?), ref: 1E8C949F
PyEval_SaveThread.PYTHON27 ref: 1E8C94AE
SetWindowLongA.USER32(?,?,?), ref: 1E8C94C5
PyEval_RestoreThread.PYTHON27(00000000), ref: 1E8C94CE
?PyWinLong_FromVoidPtr@@YAPAU_object@@PBX@Z.PYWINTYPES27(00000000), ref: 1E8C94D5

Strings

OiO:SetWindowLong, xrefs: 1E8C9466

Memory Dump Source

Source File: 00000011.00000002.1562490344.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 00000011.00000002.1562469835.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562702731.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562730939.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: U_object@@$Eval_Long_Ptr@@ThreadVoid$Arg_FromLongObject_ParseRestoreSaveTupleWindow
String ID: OiO:SetWindowLong
API String ID: 3773251432-48778103
Opcode ID: 866c9d79fec775ba0bd2ac97d75be929aa62a36f2f670f292608685b5a0715b9
Instruction ID: 8fb4125ead357f9b32eb986a03b01d147d0fae1f48b7a79c8a8b851d1b49f03f
Opcode Fuzzy Hash: 866c9d79fec775ba0bd2ac97d75be929aa62a36f2f670f292608685b5a0715b9
Instruction Fuzzy Hash: 2A015BB5514212AFD700EB68CD888AB77E8BEC5605F44496CF98AC3211E734D959CBB2

Function 1E8C9580 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 54threadCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,OiO:SetClassLong,?,?,?), ref: 1E8C959C
?PyWinObject_AsHANDLE@@YAHPAU_object@@PAPAX@Z.PYWINTYPES27(?,?), ref: 1E8C95B8
?PyWinLong_AsVoidPtr@@YAHPAU_object@@PAPAX@Z.PYWINTYPES27(?,?), ref: 1E8C95CF
PyEval_SaveThread.PYTHON27 ref: 1E8C95DE
SetClassLongA.USER32(?,?,?), ref: 1E8C95F5
PyEval_RestoreThread.PYTHON27(00000000), ref: 1E8C95FE
?PyWinLong_FromVoidPtr@@YAPAU_object@@PBX@Z.PYWINTYPES27(00000000), ref: 1E8C9605

Strings

OiO:SetClassLong, xrefs: 1E8C9596

Memory Dump Source

Source File: 00000011.00000002.1562490344.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 00000011.00000002.1562469835.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562702731.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562730939.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: U_object@@$Eval_Long_Ptr@@ThreadVoid$Arg_ClassFromLongObject_ParseRestoreSaveTuple
String ID: OiO:SetClassLong
API String ID: 789884394-51586606
Opcode ID: c88b99324ab71fb4544443bfbd7dc46bf0e1eb255344ac8eec8197cc9fb5c7e7
Instruction ID: 02410e2f948a0705c0780211a2642ef19cdec132b7311aa235b064dd4f324e02
Opcode Fuzzy Hash: c88b99324ab71fb4544443bfbd7dc46bf0e1eb255344ac8eec8197cc9fb5c7e7
Instruction Fuzzy Hash: 85018BB5110212AFD700EBA8CC888AB37E8BEC5605F44492CF949C3200EB35D959CBB2

Function 1E8C48F0 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 51COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,:GetSystemInfo), ref: 1E8C48FD
GetSystemInfo.KERNEL32(?), ref: 1E8C4914
PyLong_FromUnsignedLongLong.PYTHON27(?,00000000,?,?,?,?,?), ref: 1E8C493C
?PyWinLong_FromVoidPtr@@YAPAU_object@@PBX@Z.PYWINTYPES27(?,00000000), ref: 1E8C4951
?PyWinLong_FromVoidPtr@@YAPAU_object@@PBX@Z.PYWINTYPES27(?,00000000), ref: 1E8C495C
Py_BuildValue.PYTHON27(iiNNNiii(HH),?,?,00000000), ref: 1E8C4972

Strings

:GetSystemInfo, xrefs: 1E8C48F7
iiNNNiii(HH), xrefs: 1E8C496D

Memory Dump Source

Source File: 00000011.00000002.1562490344.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 00000011.00000002.1562469835.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562702731.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562730939.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: FromLong_$LongPtr@@U_object@@Void$Arg_BuildInfoParseSystemTupleUnsignedValue
String ID: :GetSystemInfo$iiNNNiii(HH)
API String ID: 1993707043-3631835655
Opcode ID: aa6295b7887f643f2ed2158fe94bfb534e43364dd5bceb777d9a5e74cd4abd33
Instruction ID: c6012ef18fc0839e24b16b5b9d2ede3c8c9897f9409de8ec886d3a859f63f472
Opcode Fuzzy Hash: aa6295b7887f643f2ed2158fe94bfb534e43364dd5bceb777d9a5e74cd4abd33
Instruction Fuzzy Hash: 800121B55082106BD2049B69CC89DBB77E9FFCC609F04461CF98DA3240E635EA94CB62

Function 1E8C9C70 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 51threadCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,Oi:TerminateProcess,?,?), ref: 1E8C9C87
?PyWinObject_AsHANDLE@@YAHPAU_object@@PAPAX@Z.PYWINTYPES27(?,?), ref: 1E8C9CA3
PyEval_SaveThread.PYTHON27 ref: 1E8C9CB2
TerminateProcess.KERNEL32(?,?), ref: 1E8C9CC4
PyEval_RestoreThread.PYTHON27(00000000), ref: 1E8C9CCD
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(TerminateProcess,00000000), ref: 1E8C9CE3

Strings

Oi:TerminateProcess, xrefs: 1E8C9C81
TerminateProcess, xrefs: 1E8C9CDE

Memory Dump Source

Source File: 00000011.00000002.1562490344.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 00000011.00000002.1562469835.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562702731.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562730939.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Eval_ThreadU_object@@$Arg_Error@@Object_ParseProcessRestoreSaveTerminateTupleWin_
String ID: Oi:TerminateProcess$TerminateProcess
API String ID: 458641537-979489166
Opcode ID: 349fa0efb5c1701ed6f1887a4b23fecb1336853a262b535deca19666c83626b0
Instruction ID: 2a57874a2c82853ab7e7197ea9c7398848d6892afcf63e3c383df7279f775f5d
Opcode Fuzzy Hash: 349fa0efb5c1701ed6f1887a4b23fecb1336853a262b535deca19666c83626b0
Instruction Fuzzy Hash: 33014C79510211AFE300DB78DD8DAAA37E8AF86655F844529FD0DC3210E634D659CAA2

Function 1E8C9F20 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 51COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,Oi:BeginUpdateResource,?,?), ref: 1E8C9F37
?PyWinObject_AsString@@YAHPAU_object@@PAPADHPAK@Z.PYWINTYPES27(?,00000000,00000000,00000000), ref: 1E8C9F58
BeginUpdateResourceA.KERNEL32(00000000,?), ref: 1E8C9F6F
?PyWinObject_FreeString@@YAXPAD@Z.PYWINTYPES27(?), ref: 1E8C9F7C
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(BeginUpdateResource,00000000), ref: 1E8C9F8F

Strings

Oi:BeginUpdateResource, xrefs: 1E8C9F31
BeginUpdateResource, xrefs: 1E8C9F8A

Memory Dump Source

Source File: 00000011.00000002.1562490344.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 00000011.00000002.1562469835.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562702731.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562730939.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Object_String@@U_object@@$Arg_BeginError@@FreeParseResourceTupleUpdateWin_
String ID: BeginUpdateResource$Oi:BeginUpdateResource
API String ID: 11052547-1342297044
Opcode ID: cc5fae3dcbaae9d46e153c664a9f30eaac0d4ac2d04a5810d4d2a4608227ac05
Instruction ID: f786ee84dfff3cd4d367e3849182a5381eb65e8521d21c3505b67c0831b0f4dc
Opcode Fuzzy Hash: cc5fae3dcbaae9d46e153c664a9f30eaac0d4ac2d04a5810d4d2a4608227ac05
Instruction Fuzzy Hash: 2401FC745102217BE310D768DD8DEEB3BE8AF89240F848928FD4DC3240E630E698C7A3

Function 1E8C3C50 Relevance: 14.0, APIs: 6, Strings: 2, Instructions: 50COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27 ref: 1E8C3C73
?PyWinObject_AsString@@YAHPAU_object@@PAPADHPAK@Z.PYWINTYPES27(?,00000001,00000001,00000000), ref: 1E8C3C94
GetModuleHandleA.KERNEL32 ref: 1E8C3CA6
?PyWinObject_FreeString@@YAXPAD@Z.PYWINTYPES27(?), ref: 1E8C3CB3
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(GetModuleHandle,00000000), ref: 1E8C3CC6

Strings

|O:GetModuleHandle, xrefs: 1E8C3C61
GetModuleHandle, xrefs: 1E8C3CC1

Memory Dump Source

Source File: 00000011.00000002.1562490344.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 00000011.00000002.1562469835.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562702731.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562730939.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Object_String@@U_object@@$Arg_Error@@FreeHandleModuleParseTupleWin_
String ID: GetModuleHandle$|O:GetModuleHandle
API String ID: 3638201006-1447205508
Opcode ID: fc7bea19f4521c8b3012d317108db8c0872ee261aa9c414bccd4088dc24832f7
Instruction ID: 2cd3e7766a20d6e4620a5da226db86af2a4a3b2952faf5c10377487ab8b2627c
Opcode Fuzzy Hash: fc7bea19f4521c8b3012d317108db8c0872ee261aa9c414bccd4088dc24832f7
Instruction Fuzzy Hash: A0019E74500321ABE6109B28DD8DACB37E8AF85655F848928F94DC3240E335D659CBA2

Function 1E8C7530 Relevance: 14.0, APIs: 6, Strings: 2, Instructions: 49threadregistryCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,O:RegFlushKey), ref: 1E8C7541
?PyWinObject_AsHKEY@@YAHPAU_object@@PAPAUHKEY__@@@Z.PYWINTYPES27(00000000,?), ref: 1E8C755D
PyEval_SaveThread.PYTHON27 ref: 1E8C756C
RegFlushKey.ADVAPI32(?), ref: 1E8C7579
PyEval_RestoreThread.PYTHON27(00000000), ref: 1E8C7582
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(RegFlushKey,00000000), ref: 1E8C7595

Strings

O:RegFlushKey, xrefs: 1E8C753B
RegFlushKey, xrefs: 1E8C7590

Memory Dump Source

Source File: 00000011.00000002.1562490344.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 00000011.00000002.1562469835.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562702731.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562730939.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Eval_ThreadU_object@@$Arg_Error@@FlushObject_ParseRestoreSaveTupleWin_Y__@@@
String ID: O:RegFlushKey$RegFlushKey
API String ID: 3186596235-1521764102
Opcode ID: e0b6c61ae805448989b6957489ac7c3617f6ed7ab6de44981ce1a9dfb6eba14b
Instruction ID: 398266e0ffa90eb823e157563a434eaaf19a1d1b70a459b98ae4438f37876b7c
Opcode Fuzzy Hash: e0b6c61ae805448989b6957489ac7c3617f6ed7ab6de44981ce1a9dfb6eba14b
Instruction Fuzzy Hash: 2B01A235900220AFD710ABB8EC8C9DA37E9FF86656F444528FC4DC3210E735D599CAA2

Function 1E8C9BF0 Relevance: 14.0, APIs: 6, Strings: 2, Instructions: 48threadCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,iil:OpenProcess,?,?), ref: 1E8C9C0B
PyEval_SaveThread.PYTHON27 ref: 1E8C9C1E
OpenProcess.KERNEL32(?,?,?), ref: 1E8C9C35
PyEval_RestoreThread.PYTHON27(00000000), ref: 1E8C9C3E
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(OpenProcess,00000000), ref: 1E8C9C51

Strings

OpenProcess, xrefs: 1E8C9C4C
iil:OpenProcess, xrefs: 1E8C9C05

Memory Dump Source

Source File: 00000011.00000002.1562490344.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 00000011.00000002.1562469835.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562702731.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562730939.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Eval_Thread$Arg_Error@@OpenParseProcessRestoreSaveTupleU_object@@Win_
String ID: OpenProcess$iil:OpenProcess
API String ID: 90074578-2189161723
Opcode ID: 3ad0fd452d9d6d72b050a79ba5a326567632004b0b7969a847ea26c87cf9be64
Instruction ID: 4ba70e1dccb70cd8fd8fcc4dc3e81a66243a79e0be3dac0460834a4afeeb15c0
Opcode Fuzzy Hash: 3ad0fd452d9d6d72b050a79ba5a326567632004b0b7969a847ea26c87cf9be64
Instruction Fuzzy Hash: 5B018FB59002116BD200DB68EC8C9DB3BE8AEC6615F844528F94DD3211E230969DC6A3

Function 1E8C2210 Relevance: 14.0, APIs: 6, Strings: 2, Instructions: 47threadCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,O:FindCloseChangeNotification), ref: 1E8C2221
?PyWinObject_AsHANDLE@@YAHPAU_object@@PAPAX@Z.PYWINTYPES27(00000000,?), ref: 1E8C223D
PyEval_SaveThread.PYTHON27 ref: 1E8C224C
FindCloseChangeNotification.KERNEL32(?), ref: 1E8C2259
PyEval_RestoreThread.PYTHON27(00000000), ref: 1E8C2262
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(FindCloseChangeNotification,00000000), ref: 1E8C2278

Strings

O:FindCloseChangeNotification, xrefs: 1E8C221B
FindCloseChangeNotification, xrefs: 1E8C2273

Memory Dump Source

Source File: 00000011.00000002.1562490344.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 00000011.00000002.1562469835.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562702731.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562730939.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Eval_ThreadU_object@@$Arg_ChangeCloseError@@FindNotificationObject_ParseRestoreSaveTupleWin_
String ID: FindCloseChangeNotification$O:FindCloseChangeNotification
API String ID: 2570197897-4193707565
Opcode ID: 1d0d89c131936cd51cd971f8463684be1000c53e92039bf7edd5cd371cc44bc9
Instruction ID: 6e82c7b2ab214671bb1d8334c29f7fb728f7e2fef596e16dd3e55384dc3137b4
Opcode Fuzzy Hash: 1d0d89c131936cd51cd971f8463684be1000c53e92039bf7edd5cd371cc44bc9
Instruction Fuzzy Hash: EF01A2795002116FEB009B78EC8CADA37E9BFC6606F444528F80DC3250E735D6A9CA62

Function 1E8C4180 Relevance: 14.0, APIs: 6, Strings: 2, Instructions: 47threadCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,O:FreeLibrary), ref: 1E8C4191
?PyWinObject_AsHANDLE@@YAHPAU_object@@PAPAX@Z.PYWINTYPES27(00000000,?), ref: 1E8C41AD
PyEval_SaveThread.PYTHON27 ref: 1E8C41BC
FreeLibrary.KERNEL32(?), ref: 1E8C41C9
PyEval_RestoreThread.PYTHON27(00000000), ref: 1E8C41D2
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(FreeLibrary,00000000), ref: 1E8C41E8

Strings

O:FreeLibrary, xrefs: 1E8C418B
FreeLibrary, xrefs: 1E8C41E3

Memory Dump Source

Source File: 00000011.00000002.1562490344.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 00000011.00000002.1562469835.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562702731.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562730939.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Eval_ThreadU_object@@$Arg_Error@@FreeLibraryObject_ParseRestoreSaveTupleWin_
String ID: FreeLibrary$O:FreeLibrary
API String ID: 1794003482-3363983482
Opcode ID: b38620576044066e78b3bd98cede809cd702ab9c8bfe47b811e37416d9910afc
Instruction ID: 0d1e0c0a7fef23a10bc91aaaa913e5d98f6b086b36226ed70b3c5f3562f8ace0
Opcode Fuzzy Hash: b38620576044066e78b3bd98cede809cd702ab9c8bfe47b811e37416d9910afc
Instruction Fuzzy Hash: EC01D6755002116FE700AB79ED8C99A37E9FFC6346F444528F84DC3311EA34D59ACA62

Function 1E8C2180 Relevance: 14.0, APIs: 6, Strings: 2, Instructions: 47threadCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,O:FindNextChangeNotification), ref: 1E8C2191
?PyWinObject_AsHANDLE@@YAHPAU_object@@PAPAX@Z.PYWINTYPES27(00000000,?), ref: 1E8C21AD
PyEval_SaveThread.PYTHON27 ref: 1E8C21BC
FindNextChangeNotification.KERNEL32(?), ref: 1E8C21C9
PyEval_RestoreThread.PYTHON27(00000000), ref: 1E8C21D2
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(FindNextChangeNotification,00000000), ref: 1E8C21E8

Strings

O:FindNextChangeNotification, xrefs: 1E8C218B
FindNextChangeNotification, xrefs: 1E8C21E3

Memory Dump Source

Source File: 00000011.00000002.1562490344.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 00000011.00000002.1562469835.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562702731.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562730939.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Eval_ThreadU_object@@$Arg_ChangeError@@FindNextNotificationObject_ParseRestoreSaveTupleWin_
String ID: FindNextChangeNotification$O:FindNextChangeNotification
API String ID: 3286478268-580746906
Opcode ID: f3738be183ec305cdb917eac349472293375d39cbac3a635671df5178872fee6
Instruction ID: 40c4164ad846c6473cca01bd3b6e46b7898887aa0f4486bba1c168b778b630e3
Opcode Fuzzy Hash: f3738be183ec305cdb917eac349472293375d39cbac3a635671df5178872fee6
Instruction Fuzzy Hash: 7301A275500211BFEB00AB78DD8C9DA37E9BFC6606F444528F90DC3250E634D559CA62

Function 1E8C31D0 Relevance: 14.0, APIs: 6, Strings: 2, Instructions: 40threadCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,:GetCursorPos), ref: 1E8C31DD
PyEval_SaveThread.PYTHON27 ref: 1E8C31F0
GetCursorPos.USER32(?), ref: 1E8C31FD
PyEval_RestoreThread.PYTHON27(00000000), ref: 1E8C3206
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(GetCursorPos,00000000), ref: 1E8C321C

Strings

GetCursorPos, xrefs: 1E8C3217
:GetCursorPos, xrefs: 1E8C31D7

Memory Dump Source

Source File: 00000011.00000002.1562490344.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 00000011.00000002.1562469835.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562702731.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562730939.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Eval_Thread$Arg_CursorError@@ParseRestoreSaveTupleU_object@@Win_
String ID: :GetCursorPos$GetCursorPos
API String ID: 647088857-1774093815
Opcode ID: 00c938739524955ca3c231708cf2e0d335633b594cc60f2a8acad4ec40d4e874
Instruction ID: 70a2905b7f1b115a9371997d843d0bc99cc983abbcace6b6b86f1973b7bb9384
Opcode Fuzzy Hash: 00c938739524955ca3c231708cf2e0d335633b594cc60f2a8acad4ec40d4e874
Instruction Fuzzy Hash: ACF090B99001107FEB0067B9FD4D9CA3BE4AF86657F444128F80DD3311E635D6AACAB2

Function 1E8C4F30 Relevance: 14.0, APIs: 6, Strings: 2, Instructions: 39threadCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,:GetTempPath), ref: 1E8C4F40
PyEval_SaveThread.PYTHON27 ref: 1E8C4F56
GetTempPathA.KERNEL32(00000105,?), ref: 1E8C4F68
PyEval_RestoreThread.PYTHON27(00000000), ref: 1E8C4F71
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(GetTempPath,00000000), ref: 1E8C4F87

Strings

GetTempPath, xrefs: 1E8C4F82
:GetTempPath, xrefs: 1E8C4F3A

Memory Dump Source

Source File: 00000011.00000002.1562490344.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 00000011.00000002.1562469835.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562702731.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562730939.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Eval_Thread$Arg_Error@@ParsePathRestoreSaveTempTupleU_object@@Win_
String ID: :GetTempPath$GetTempPath
API String ID: 689123710-4064704458
Opcode ID: cb5cfe7630794040458aef6fe8b3897d57edcdf5905c034f8dfdcafabed87f82
Instruction ID: ec9b0c37c9c15aa1177c207abce75c96a152e8008d6f03eb264f486c14088af1
Opcode Fuzzy Hash: cb5cfe7630794040458aef6fe8b3897d57edcdf5905c034f8dfdcafabed87f82
Instruction Fuzzy Hash: D6F04CB58043116FEB102778EC4DADA3695BFC1312F440124F89DC3290FA798198C652

Function 1E7A9D80 Relevance: 14.0, APIs: 6, Strings: 2, Instructions: 38memorythreadCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000012), ref: 1E7A9D86
Py_FatalError.PYTHON27(Can not setup thread state, as have no interpreter state), ref: 1E7A9DA5
LocalAlloc.KERNEL32(00000040,00000008), ref: 1E7A9DAE
Py_FatalError.PYTHON27(Out of memory allocating thread state.), ref: 1E7A9DBF
TlsSetValue.KERNEL32(00000012,00000000), ref: 1E7A9DCC
PyThreadState_New.PYTHON27(029710F8), ref: 1E7A9DD9

Strings

Out of memory allocating thread state., xrefs: 1E7A9DBA
Can not setup thread state, as have no interpreter state, xrefs: 1E7A9DA0

Memory Dump Source

Source File: 00000011.00000002.1561923280.000000001E7A1000.00000040.00000001.01000000.00000012.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000011.00000002.1561891626.000000001E7A0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7B9000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7BE000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562197228.000000001E7C0000.00000080.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562233172.000000001E7C2000.00000004.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e7a0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: ErrorFatalValue$AllocLocalState_Thread
String ID: Can not setup thread state, as have no interpreter state$Out of memory allocating thread state.
API String ID: 3600802575-1986847906
Opcode ID: 42593f1696647a1e39e34ad80d04acaacefa0ea70ee96c376192e1d4e8205d7d
Instruction ID: 02c821237aed1d2be1ce2a8a87b801ef64a015cd8954d7c4338948cbec037909
Opcode Fuzzy Hash: 42593f1696647a1e39e34ad80d04acaacefa0ea70ee96c376192e1d4e8205d7d
Instruction Fuzzy Hash: A6F062B1600225ABF311AB68FCC4A8737ADEFCC256B1D0624F645D6654E631D892CB91

Function 03411800 Relevance: 13.6, APIs: 9, Instructions: 94timeCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,0341B21C), ref: 03411811
GetProcessTimes.KERNEL32(00000000,?,?,?,?), ref: 03411860
GetLastError.KERNEL32 ref: 0341186A
CloseHandle.KERNEL32(00000000), ref: 03411883

Memory Dump Source

Source File: 00000011.00000002.1560676867.0000000003411000.00000040.00000001.01000000.0000000F.sdmp, Offset: 03410000, based on PE: true

Associated: 00000011.00000002.1560637646.0000000003410000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560676867.000000000341B000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560676867.000000000341F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560836323.0000000003423000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_3410000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_CloseErrorHandleLastParseProcessTimesTuple
String ID:
API String ID: 459457561-0
Opcode ID: cc973a22b406900bd97ceb03c3fe8b4af9242daee75f0e80f51261c6241104c5
Instruction ID: 5aacae0e31d1c62e5835ca49ff07eb20ba10311b300ab3ff1a097a41150d2549
Opcode Fuzzy Hash: cc973a22b406900bd97ceb03c3fe8b4af9242daee75f0e80f51261c6241104c5
Instruction Fuzzy Hash: 86212671900B006BE610FB749C49BAFB7D8AF85605F48481AF949ED244E7A49268C7DB

Function 1E7D1400 Relevance: 13.6, APIs: 9, Instructions: 94threadCOMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,?), ref: 1E7D1469
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000000), ref: 1E7D148E
Py_SetProgramName.PYTHON27(?,?), ref: 1E7D14AE
Py_Initialize.PYTHON27(?), ref: 1E7D14B7
PyEval_InitThreads.PYTHON27(?,?), ref: 1E7D14BD
PySys_SetArgv.PYTHON27(00000000,00000000), ref: 1E7D14C9
initservicemanager.SERVICEMANAGER ref: 1E7D14D2
73BB3B4E.MSVCR90 ref: 1E7D14E7
73BB3B4E.MSVCR90(00000000), ref: 1E7D14F2

Memory Dump Source

Source File: 00000011.00000002.1562321143.000000001E7D1000.00000040.00000001.01000000.00000015.sdmp, Offset: 1E7D0000, based on PE: true

Associated: 00000011.00000002.1562293036.000000001E7D0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000011.00000002.1562321143.000000001E7DA000.00000040.00000001.01000000.00000015.sdmpDownload File
Associated: 00000011.00000002.1562391495.000000001E7DB000.00000080.00000001.01000000.00000015.sdmpDownload File
Associated: 00000011.00000002.1562417397.000000001E7DD000.00000004.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e7d0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: ByteCharMultiWide$ArgvEval_InitInitializeNameProgramSys_Threadsinitservicemanager
String ID:
API String ID: 2042743612-0
Opcode ID: 7a39ccf0efd7e3df8d5da2f0d499ea75c594747fbb452e623b0ded86c42f309b
Instruction ID: a0392e3e3e2a76a9845a165dc6b7268a72a51679ae9da2b5d78a42f6fab579ec
Opcode Fuzzy Hash: 7a39ccf0efd7e3df8d5da2f0d499ea75c594747fbb452e623b0ded86c42f309b
Instruction Fuzzy Hash: 4431D071200329AFF3118F94ECC5FA637ADFB49714F114368FE465B294E771AC0A8AA1

Function 1E7A5C80 Relevance: 13.6, APIs: 9, Instructions: 76COMMON

Download Yara Rule

APIs

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 1E7A5C99
73BB3B4E.MSVCR90(?), ref: 1E7A5CB9
GetSecurityDescriptorSacl.ADVAPI32(?,?,?,?), ref: 1E7A5CCE
73BB3B4E.MSVCR90(?), ref: 1E7A5CE8
GetSecurityDescriptorOwner.ADVAPI32(?,?,?), ref: 1E7A5CF8
73BB3B4E.MSVCR90(?), ref: 1E7A5D0B
GetSecurityDescriptorGroup.ADVAPI32(?,?,?), ref: 1E7A5D1B
73BB3B4E.MSVCR90(?), ref: 1E7A5D2E
73BB3B4E.MSVCR90(?), ref: 1E7A5D34

Memory Dump Source

Source File: 00000011.00000002.1561923280.000000001E7A1000.00000040.00000001.01000000.00000012.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000011.00000002.1561891626.000000001E7A0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7B9000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7BE000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562197228.000000001E7C0000.00000080.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562233172.000000001E7C2000.00000004.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e7a0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: DescriptorSecurity$DaclGroupOwnerSacl
String ID:
API String ID: 788894859-0
Opcode ID: 5a1ce0a8762c85eb06294ef2ed9528e8ccf8a3cdc27f7cb8a98f24e3d4c5b1be
Instruction ID: 222309c54225b00aab60f7211085585789880f875b30bbe1ee63aa097882f385
Opcode Fuzzy Hash: 5a1ce0a8762c85eb06294ef2ed9528e8ccf8a3cdc27f7cb8a98f24e3d4c5b1be
Instruction Fuzzy Hash: DA211871604306ABE704DE65DD94AAB77ADBEC4A54F094E2DFA95C2150EB30E108CFA2

Function 1E7D1449 Relevance: 13.6, APIs: 9, Instructions: 71threadCOMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,?), ref: 1E7D1469
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000000), ref: 1E7D148E
Py_SetProgramName.PYTHON27(?,?), ref: 1E7D14AE
Py_Initialize.PYTHON27(?), ref: 1E7D14B7
PyEval_InitThreads.PYTHON27(?,?), ref: 1E7D14BD
PySys_SetArgv.PYTHON27(00000000,00000000), ref: 1E7D14C9
initservicemanager.SERVICEMANAGER ref: 1E7D14D2
73BB3B4E.MSVCR90 ref: 1E7D14E7
73BB3B4E.MSVCR90(00000000), ref: 1E7D14F2

Memory Dump Source

Source File: 00000011.00000002.1562321143.000000001E7D1000.00000040.00000001.01000000.00000015.sdmp, Offset: 1E7D0000, based on PE: true

Associated: 00000011.00000002.1562293036.000000001E7D0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000011.00000002.1562321143.000000001E7DA000.00000040.00000001.01000000.00000015.sdmpDownload File
Associated: 00000011.00000002.1562391495.000000001E7DB000.00000080.00000001.01000000.00000015.sdmpDownload File
Associated: 00000011.00000002.1562417397.000000001E7DD000.00000004.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e7d0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: ByteCharMultiWide$ArgvEval_InitInitializeNameProgramSys_Threadsinitservicemanager
String ID:
API String ID: 2042743612-0
Opcode ID: e425585aeffd8f1277e7e1446690ffc79acafd4b4fe3c46fc2f7537bd46c7ded
Instruction ID: 99f6ec0bafa58afc0e72521e30d67f33e2ea0aa508dae55fd677d2d357cd758b
Opcode Fuzzy Hash: e425585aeffd8f1277e7e1446690ffc79acafd4b4fe3c46fc2f7537bd46c7ded
Instruction Fuzzy Hash: 6911E6716003246FF2205F94FCC5F563768FF48B15F104364FE166B2D1E721AC058AA6

Function 03415127 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 129COMMON

Download Yara Rule

APIs

ConvertLengthToIpv4Mask.IPHLPAPI(?,?), ref: 03415168
PyString_FromString.PYTHON27(?,?,?,?,00000400), ref: 034151CD
PyString_FromString.PYTHON27(?), ref: 034151ED
Py_BuildValue.PYTHON27((OiOOOO),00000000,?,?,?,6D18CB14,6D18CB14), ref: 0341522E
PyList_Append.PYTHON27(?,00000000), ref: 03415247
73BB3B4E.MSVCR90(?), ref: 034152DC

Part of subcall function 03417140: WSAAddressToStringA.WS2_32(?,?,00000000,?,?), ref: 034171BF
Part of subcall function 03417140: WSAGetLastError.WS2_32 ref: 034171C9
Part of subcall function 03417140: PyErr_SetExcFromWindowsErr.PYTHON27(?,00000000), ref: 034171D9

73BB3B4E.MSVCR90(?), ref: 034152F9

Strings

(OiOOOO), xrefs: 03415229

Memory Dump Source

Source File: 00000011.00000002.1560676867.0000000003411000.00000040.00000001.01000000.0000000F.sdmp, Offset: 03410000, based on PE: true

Associated: 00000011.00000002.1560637646.0000000003410000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560676867.000000000341B000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560676867.000000000341F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560836323.0000000003423000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_3410000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: FromString$String_$AddressAppendBuildConvertErr_ErrorIpv4LastLengthList_MaskValueWindows
String ID: (OiOOOO)
API String ID: 2950778551-2236119840
Opcode ID: 72a6a2806a19a00800d74110e461427638e83e9bb2d9e37dd42079b75b6d996c
Instruction ID: 1be1c9d5706e1f959836eaae46aadc5ae02c9ae2dff521b4601ce1f92af3f33b
Opcode Fuzzy Hash: 72a6a2806a19a00800d74110e461427638e83e9bb2d9e37dd42079b75b6d996c
Instruction Fuzzy Hash: 03419DB55047019FDB10DF54D8409ABB3E8EFC5224F084A9AF9558F380D734E916CFA6

Function 03415129 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 129COMMON

Download Yara Rule

APIs

ConvertLengthToIpv4Mask.IPHLPAPI(?,?), ref: 03415168
PyString_FromString.PYTHON27(?,?,?,?,00000400), ref: 034151CD
PyString_FromString.PYTHON27(?), ref: 034151ED
Py_BuildValue.PYTHON27((OiOOOO),00000000,?,?,?,6D18CB14,6D18CB14), ref: 0341522E
PyList_Append.PYTHON27(?,00000000), ref: 03415247
73BB3B4E.MSVCR90(?), ref: 034152DC

Part of subcall function 03417140: WSAAddressToStringA.WS2_32(?,?,00000000,?,?), ref: 034171BF
Part of subcall function 03417140: WSAGetLastError.WS2_32 ref: 034171C9
Part of subcall function 03417140: PyErr_SetExcFromWindowsErr.PYTHON27(?,00000000), ref: 034171D9

73BB3B4E.MSVCR90(?), ref: 034152F9

Strings

(OiOOOO), xrefs: 03415229

Memory Dump Source

Source File: 00000011.00000002.1560676867.0000000003411000.00000040.00000001.01000000.0000000F.sdmp, Offset: 03410000, based on PE: true

Associated: 00000011.00000002.1560637646.0000000003410000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560676867.000000000341B000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560676867.000000000341F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560836323.0000000003423000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_3410000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: FromString$String_$AddressAppendBuildConvertErr_ErrorIpv4LastLengthList_MaskValueWindows
String ID: (OiOOOO)
API String ID: 2950778551-2236119840
Opcode ID: 02d1780d2d7b38bb66e50415f1d1b97d565b00e611c741b29c59b3145198fe82
Instruction ID: 6bc27ebd66c8d91fb9d62a893820ef23bb20db1eb1101acecb49cdcbe5436e51
Opcode Fuzzy Hash: 02d1780d2d7b38bb66e50415f1d1b97d565b00e611c741b29c59b3145198fe82
Instruction Fuzzy Hash: A6417CB55047019FDB10DF54D8409ABB3E8EFC9224F084A9AF9558F380E774E916CFA6

Function 03413D36 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 117COMMON

Download Yara Rule

APIs

GetIfEntry2.IPHLPAPI(00000000), ref: 03413D71
Py_BuildValue.PYTHON27((KKKKKKKK),?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 03413E0B
PyUnicodeUCS2_FromWideChar.PYTHON27(?,?), ref: 03413E37
PyDict_SetItem.PYTHON27(?,00000000,00000000), ref: 03413E51
73BB3B4E.MSVCR90(00000000), ref: 03413E81
73BB3B4E.MSVCR90(?), ref: 03413E9A
PyErr_NoMemory.PYTHON27 ref: 03413EAF
73BB3B4E.MSVCR90(?), ref: 03413F10
73BB3B4E.MSVCR90(00000000), ref: 03413F1E

Strings

(KKKKKKKK), xrefs: 03413E06

Memory Dump Source

Source File: 00000011.00000002.1560676867.0000000003411000.00000040.00000001.01000000.0000000F.sdmp, Offset: 03410000, based on PE: true

Associated: 00000011.00000002.1560637646.0000000003410000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560676867.000000000341B000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560676867.000000000341F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560836323.0000000003423000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_3410000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: BuildCharDict_Entry2Err_FromItemMemoryUnicodeValueWide
String ID: (KKKKKKKK)
API String ID: 1551035170-4200950264
Opcode ID: 3f51fc4b3c14b00c4639226c5f055530f0208e773ec43314c1acf775161ea312
Instruction ID: 9414ec088b5ae4dd6067612d1f87771bf943bcac07ff50c796350c1fb70b2472
Opcode Fuzzy Hash: 3f51fc4b3c14b00c4639226c5f055530f0208e773ec43314c1acf775161ea312
Instruction Fuzzy Hash: 85416DB5600B019FC760DF68DD80EA7B3E9AF88315F08491DEA6A8B340D730F811CBA5

Function 03413D34 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

GetIfEntry2.IPHLPAPI(00000000), ref: 03413D71
Py_BuildValue.PYTHON27((KKKKKKKK),?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 03413E0B
PyUnicodeUCS2_FromWideChar.PYTHON27(?,?), ref: 03413E37
PyDict_SetItem.PYTHON27(?,00000000,00000000), ref: 03413E51
73BB3B4E.MSVCR90(00000000), ref: 03413E81
73BB3B4E.MSVCR90(?), ref: 03413E9A
PyErr_NoMemory.PYTHON27 ref: 03413EAF
73BB3B4E.MSVCR90(?), ref: 03413F10
73BB3B4E.MSVCR90(00000000), ref: 03413F1E

Strings

(KKKKKKKK), xrefs: 03413E06

Memory Dump Source

Source File: 00000011.00000002.1560676867.0000000003411000.00000040.00000001.01000000.0000000F.sdmp, Offset: 03410000, based on PE: true

Associated: 00000011.00000002.1560637646.0000000003410000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560676867.000000000341B000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560676867.000000000341F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560836323.0000000003423000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_3410000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: BuildCharDict_Entry2Err_FromItemMemoryUnicodeValueWide
String ID: (KKKKKKKK)
API String ID: 1551035170-4200950264
Opcode ID: c522031046f80457e7867e68abbf3aebb7bd6d13f10de9bd6e1898e4a60ca1ca
Instruction ID: c431c0b5b6c82848f7a01b26ea69a9daad6813f81f4ee3e373a73f2fc69cd928
Opcode Fuzzy Hash: c522031046f80457e7867e68abbf3aebb7bd6d13f10de9bd6e1898e4a60ca1ca
Instruction Fuzzy Hash: CB415CB5600B019BD760DF68DD80EA7B3E9AF88715F08491DEA6A8B344D730F811CBA5

Function 034127A0 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 86COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27 ref: 034127BD
QueryDosDeviceA.KERNEL32(?,?,000001FF), ref: 03412817
Py_BuildValue.PYTHON27(0341B4AC,0341D7E2,?,?,?,?,?), ref: 03412866

Strings

A, xrefs: 034127B8
%c:, xrefs: 0341287E
:, xrefs: 034127F3

Memory Dump Source

Source File: 00000011.00000002.1560676867.0000000003411000.00000040.00000001.01000000.0000000F.sdmp, Offset: 03410000, based on PE: true

Associated: 00000011.00000002.1560637646.0000000003410000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560676867.000000000341B000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560676867.000000000341F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560836323.0000000003423000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_3410000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_BuildDeviceParseQueryTupleValue
String ID: %c:$:$A
API String ID: 1455332766-2475154457
Opcode ID: 6936c354661db54caab0b858d1a4a469502c64d214c4aebeb4d745cea6e9ec86
Instruction ID: d0e9f5e0f440848f226c9141130246e9aca355c4fc5116c2120ba7be604d4376
Opcode Fuzzy Hash: 6936c354661db54caab0b858d1a4a469502c64d214c4aebeb4d745cea6e9ec86
Instruction Fuzzy Hash: 83218932148B859FC310DB249C91ABFBBD98F54204F4C8D5EF4E9CE242E2A5C11DC36A

Function 1E7D1657 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 80registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExW.ADVAPI32(80000002,?,00000000,00000000,00000000,00020006,00000000,00000000,00000000,00000000,00000000), ref: 1E7D16D0
RegSetValueExW.ADVAPI32(?,EventMessageFile,00000000,00000001,1E7D6448,00000000), ref: 1E7D170F
RegSetValueExW.ADVAPI32(?,?,?,TypesSupported,00000000,00000004,?,00000004), ref: 1E7D172E
RegCloseKey.ADVAPI32(?), ref: 1E7D1735

Strings

TypesSupported, xrefs: 1E7D1720
Python Service, xrefs: 1E7D1674
EventMessageFile, xrefs: 1E7D1709

Memory Dump Source

Source File: 00000011.00000002.1562321143.000000001E7D1000.00000040.00000001.01000000.00000015.sdmp, Offset: 1E7D0000, based on PE: true

Associated: 00000011.00000002.1562293036.000000001E7D0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000011.00000002.1562321143.000000001E7DA000.00000040.00000001.01000000.00000015.sdmpDownload File
Associated: 00000011.00000002.1562391495.000000001E7DB000.00000080.00000001.01000000.00000015.sdmpDownload File
Associated: 00000011.00000002.1562417397.000000001E7DD000.00000004.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e7d0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Value$CloseCreate
String ID: EventMessageFile$Python Service$TypesSupported
API String ID: 390822645-2879936719
Opcode ID: fe5685efc27950c2a276f6cf6786660ac442da45ae8e0b7223b40184b48f251e
Instruction ID: d56bdcff274a61134d157c363338a037fdce2dc2d8520dbb6766495f3734e1c9
Opcode Fuzzy Hash: fe5685efc27950c2a276f6cf6786660ac442da45ae8e0b7223b40184b48f251e
Instruction Fuzzy Hash: 6C21B631214315ABE3249B98DC56FEB73E5FBC8750F048A08FA46DB2E4E7B4A504C741

Function 1E7A3A40 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 74COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON27(?,Attributes of PyDEVMODEW can't be deleted), ref: 1E7A3A56
?PyWinObject_AsWCHAR@@YAHPAU_object@@PAPA_WHPAK@Z.PYWINTYPES27(?,?,00000000), ref: 1E7A3A70
PyErr_Format.PYTHON27(00000000,FormName must be a string of length %d or less,00000020), ref: 1E7A3A96

Strings

Attributes of PyDEVMODEW can't be deleted, xrefs: 1E7A3A50
FormName must be a string of length %d or less, xrefs: 1E7A3A90

Memory Dump Source

Source File: 00000011.00000002.1561923280.000000001E7A1000.00000040.00000001.01000000.00000012.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000011.00000002.1561891626.000000001E7A0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7B9000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7BE000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562197228.000000001E7C0000.00000080.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562233172.000000001E7C2000.00000004.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e7a0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Err_$FormatObject_StringU_object@@
String ID: Attributes of PyDEVMODEW can't be deleted$FormName must be a string of length %d or less
API String ID: 3091456408-1246865284
Opcode ID: b0b2a621e3cd29fbb1ef48cac05c5b3783e16b13afcbe363158ff246f65906c2
Instruction ID: 34147de5273fc6723aa3a43a422c84ae5e74b115463889f16f71a8b1b0baf932
Opcode Fuzzy Hash: b0b2a621e3cd29fbb1ef48cac05c5b3783e16b13afcbe363158ff246f65906c2
Instruction Fuzzy Hash: 5F118176510245ABE614DE64EC84E6B73A9EBC9724F184F0CF7558B290D771F900C761

Function 1E7A3940 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 71COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON27(?,Attributes of PyDEVMODEW can't be deleted), ref: 1E7A3956
?PyWinObject_AsWCHAR@@YAHPAU_object@@PAPA_WHPAK@Z.PYWINTYPES27(?,?,00000000), ref: 1E7A3970
PyErr_Format.PYTHON27(00000000,DeviceName must be a string of length %d or less,00000020), ref: 1E7A3996

Strings

DeviceName must be a string of length %d or less, xrefs: 1E7A3990
Attributes of PyDEVMODEW can't be deleted, xrefs: 1E7A3950

Memory Dump Source

Source File: 00000011.00000002.1561923280.000000001E7A1000.00000040.00000001.01000000.00000012.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000011.00000002.1561891626.000000001E7A0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7B9000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7BE000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562197228.000000001E7C0000.00000080.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562233172.000000001E7C2000.00000004.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e7a0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Err_$FormatObject_StringU_object@@
String ID: Attributes of PyDEVMODEW can't be deleted$DeviceName must be a string of length %d or less
API String ID: 3091456408-3347017950
Opcode ID: fbeec3aa1ef59b10993b6cc58d0de261b607339bdc525ef397c4bc7c09ef7dc6
Instruction ID: 0cef02498d37982372ec0ecdf2db14641c33a1677961140129b389083f78e686
Opcode Fuzzy Hash: fbeec3aa1ef59b10993b6cc58d0de261b607339bdc525ef397c4bc7c09ef7dc6
Instruction Fuzzy Hash: 6911AFB5614201ABF214DF68ECC4E6BB3A9ABC9724F184F08F755972A0D770E800C762

Function 1E7A4590 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 70registryCOMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON27(?,HANDLE must be a PyHKEY), ref: 1E7A45E6
?PyWinObject_AsHANDLE@@YAHPAU_object@@PAPAX@Z.PYWINTYPES27(?,?), ref: 1E7A4605
RegCloseKey.ADVAPI32(?), ref: 1E7A4618
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(RegCloseKey,00000000), ref: 1E7A4631

Strings

PyHKEY, xrefs: 1E7A45A9
HANDLE must be a PyHKEY, xrefs: 1E7A45E0
RegCloseKey, xrefs: 1E7A462C

Memory Dump Source

Source File: 00000011.00000002.1561923280.000000001E7A1000.00000040.00000001.01000000.00000012.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000011.00000002.1561891626.000000001E7A0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7B9000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7BE000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562197228.000000001E7C0000.00000080.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562233172.000000001E7C2000.00000004.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e7a0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: U_object@@$CloseErr_Error@@Object_StringWin_
String ID: HANDLE must be a PyHKEY$PyHKEY$RegCloseKey
API String ID: 2805645888-2645764861
Opcode ID: 987432d869663844b0d89ac1746268ec3931707aa5c3cfc2f28da87d96c7a3d9
Instruction ID: f1db0c4d011a0f6fc9e900068e1735880040ca1d671a60f2e96175c49714b797
Opcode Fuzzy Hash: 987432d869663844b0d89ac1746268ec3931707aa5c3cfc2f28da87d96c7a3d9
Instruction Fuzzy Hash: 6C11013A7141529BE300DB38FC64A9BB7E69FD9220B0D8765EA45C7264F732EC40CB90

Function 034139B0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,0341B5C4), ref: 034139C1
GetProcessIoCounters.KERNEL32(00000000,?), ref: 034139F0
PyErr_SetFromWindowsErr.PYTHON27(00000000), ref: 034139FB
CloseHandle.KERNEL32(00000000), ref: 03413A05

Strings

(KKKKKK), xrefs: 03413A55

Memory Dump Source

Source File: 00000011.00000002.1560676867.0000000003411000.00000040.00000001.01000000.0000000F.sdmp, Offset: 03410000, based on PE: true

Associated: 00000011.00000002.1560637646.0000000003410000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560676867.000000000341B000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560676867.000000000341F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560836323.0000000003423000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_3410000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_CloseCountersErr_FromHandleParseProcessTupleWindows
String ID: (KKKKKK)
API String ID: 1109189336-585410369
Opcode ID: 0420187b233b3888b27db0ca3a79102a50b4cbb9d2b7caf0ad6872ba09e96f8a
Instruction ID: f04b00870329ace3efb3b563eccced6473f697fecdff8cac7eb9e8394da73e42
Opcode Fuzzy Hash: 0420187b233b3888b27db0ca3a79102a50b4cbb9d2b7caf0ad6872ba09e96f8a
Instruction Fuzzy Hash: 2F116AB1605600AFD244EB68DC94D5BB7ECAF88614F84891CF99AD6204E330E915CBAA

Function 03411D70 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 67COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,0341B330), ref: 03411D81
GetProcessMemoryInfo.PSAPI(00000000,?,0000002C), ref: 03411DB2
PyErr_SetFromWindowsErr.PYTHON27(00000000,00000000,?,0000002C), ref: 03411DBC
CloseHandle.KERNEL32(00000000), ref: 03411DC6

Strings

(kIIIIIIIII), xrefs: 03411E0D

Memory Dump Source

Source File: 00000011.00000002.1560676867.0000000003411000.00000040.00000001.01000000.0000000F.sdmp, Offset: 03410000, based on PE: true

Associated: 00000011.00000002.1560637646.0000000003410000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560676867.000000000341B000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560676867.000000000341F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560836323.0000000003423000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_3410000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_CloseErr_FromHandleInfoMemoryParseProcessTupleWindows
String ID: (kIIIIIIIII)
API String ID: 708189517-1713939979
Opcode ID: 809f27e5aef39411b41d447a5a9628c253332ec0f5d45854d90133458e2c2cfb
Instruction ID: 7b41e97c4ad4bf55615b00c94cd808c8714790af2334203e21f302aaf19785eb
Opcode Fuzzy Hash: 809f27e5aef39411b41d447a5a9628c253332ec0f5d45854d90133458e2c2cfb
Instruction Fuzzy Hash: 4811B275504600AFD240EB68DC54E6FB7ECEFCC614F448A0DF958EB204E734EA1187A6

Function 1E7A3080 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 64COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27 ref: 1E7A30A9
GetAuditedPermissionsFromAclW.ADVAPI32(?,?,?,?), ref: 1E7A30EA
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(GetAuditedPermissionsFromAcl,00000000,?,?,O:GetAuditedPermissionsFromAcl,?), ref: 1E7A30FA

Strings

O:GetAuditedPermissionsFromAcl, xrefs: 1E7A308D
GetAuditedPermissionsFromAcl, xrefs: 1E7A30F5

Memory Dump Source

Source File: 00000011.00000002.1561923280.000000001E7A1000.00000040.00000001.01000000.00000012.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000011.00000002.1561891626.000000001E7A0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7B9000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7BE000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562197228.000000001E7C0000.00000080.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562233172.000000001E7C2000.00000004.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e7a0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_AuditedError@@FromParsePermissionsTupleU_object@@Win_
String ID: GetAuditedPermissionsFromAcl$O:GetAuditedPermissionsFromAcl
API String ID: 2147966734-1982696749
Opcode ID: 7714b92a0cdc9d005bb66542875e89c115f1878d5ba1c9d63f78d414e4827b7f
Instruction ID: c4f18576218ae6804327aa9726f9425cb5ecc7599c50e0eda25f5c54d574b6ce
Opcode Fuzzy Hash: 7714b92a0cdc9d005bb66542875e89c115f1878d5ba1c9d63f78d414e4827b7f
Instruction Fuzzy Hash: 511154B5608342ABF704CF54EC84D6FB7E9ABD8248F0C4B1CF64886210E771D958CBA2

Function 1E7AA030 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 62windowCOMMON

Download Yara Rule

APIs

FormatMessageA.KERNEL32(00001000,00000000,?,00000000,000000FF,000000FF,00000000,00000000), ref: 1E7AA054
wsprintfA.USER32 ref: 1E7AA08C
?PyWinObject_FromTCHAR@@YAPAU_object@@PBDH@Z.PYWINTYPES27(?,000000FF,00000000,00000000), ref: 1E7AA0A0
Py_BuildValue.PYTHON27(iNzz,?,00000000,00000000,00000000), ref: 1E7AA0AF
PyErr_SetObject.PYTHON27(031BED18,00000000), ref: 1E7AA0BE

Strings

COM Error 0x%x, xrefs: 1E7AA086
iNzz, xrefs: 1E7AA0AA

Memory Dump Source

Source File: 00000011.00000002.1561923280.000000001E7A1000.00000040.00000001.01000000.00000012.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000011.00000002.1561891626.000000001E7A0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7B9000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7BE000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562197228.000000001E7C0000.00000080.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562233172.000000001E7C2000.00000004.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e7a0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: BuildErr_FormatFromMessageObjectObject_U_object@@Valuewsprintf
String ID: COM Error 0x%x$iNzz
API String ID: 60735323-4252557710
Opcode ID: a3c648bfcf81bac529f6b0567fb43abe28ccf27cf6fdbb888a015219b6dd71ae
Instruction ID: f0e86ceb99118a10541042c735f86cbe4f9f30c90d6a00c77e24161a6f2e127f
Opcode Fuzzy Hash: a3c648bfcf81bac529f6b0567fb43abe28ccf27cf6fdbb888a015219b6dd71ae
Instruction Fuzzy Hash: C1112331540311AFF221AA24AC49FD7779D9F88324F284B14FB98C61D1E630E444CB92

Function 1E8C24F9 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 62threadCOMMON

Download Yara Rule

APIs

PyEval_RestoreThread.PYTHON27(?), ref: 1E8C2510
PyErr_SetString.PYTHON27(?,Access violation (probably due to missing string inserts)), ref: 1E8C252C
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(FormatMessageA,00000000), ref: 1E8C2542
?PyWinObject_FreeString@@YAXPAD@Z.PYWINTYPES27 ref: 1E8C2574
73BB3B4E.MSVCR90(?), ref: 1E8C2584
?PyWinObject_FreeString@@YAXPAD@Z.PYWINTYPES27(?), ref: 1E8C2591
LocalFree.KERNEL32(?), ref: 1E8C25A2

Strings

Access violation (probably due to missing string inserts), xrefs: 1E8C251E

Memory Dump Source

Source File: 00000011.00000002.1562490344.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 00000011.00000002.1562469835.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562702731.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562730939.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Free$Object_String@@$Err_Error@@Eval_LocalRestoreStringThreadU_object@@Win_
String ID: Access violation (probably due to missing string inserts)
API String ID: 1800408334-128206310
Opcode ID: fc50f3304528f3ec3b313973029f8afe6eb78674cf561145a0c0c8fa9dad79d2
Instruction ID: 12733c964b43730b4ea4540a08a2a93448caa703ae141151f4c283cd149d8228
Opcode Fuzzy Hash: fc50f3304528f3ec3b313973029f8afe6eb78674cf561145a0c0c8fa9dad79d2
Instruction Fuzzy Hash: C2116DB5D00515DFDB00CFE8D8D88EEB7B2BB46715F108228E91AA3380E735E956CB91

Function 1E8C2839 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 62threadCOMMON

Download Yara Rule

APIs

PyEval_RestoreThread.PYTHON27(?), ref: 1E8C2850
PyErr_SetString.PYTHON27(?,Access violation (probably due to missing string inserts)), ref: 1E8C286C
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(FormatMessageW,00000000), ref: 1E8C2882
?PyWinObject_FreeWCHAR@@YAXPA_W@Z.PYWINTYPES27 ref: 1E8C28B4
73BB3B4E.MSVCR90(?), ref: 1E8C28C4
?PyWinObject_FreeWCHAR@@YAXPA_W@Z.PYWINTYPES27(?), ref: 1E8C28D1
LocalFree.KERNEL32(?), ref: 1E8C28E2

Strings

Access violation (probably due to missing string inserts), xrefs: 1E8C285E

Memory Dump Source

Source File: 00000011.00000002.1562490344.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 00000011.00000002.1562469835.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562702731.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562730939.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Free$Object_$Err_Error@@Eval_LocalRestoreStringThreadU_object@@Win_
String ID: Access violation (probably due to missing string inserts)
API String ID: 994519068-128206310
Opcode ID: bfed4550160334b2ed93617aecd1105052835a2012531f5148b5a9d792fa24f1
Instruction ID: 6b44f014c853838e1f6fb425279690adb7f5054058f44e2681a430f98a0b634a
Opcode Fuzzy Hash: bfed4550160334b2ed93617aecd1105052835a2012531f5148b5a9d792fa24f1
Instruction Fuzzy Hash: C7113AB5D00519DBDB00DFE8D8C88DEB7B2FB46725F114229E92AA3280C735E856CB91

Function 1E7A2FD0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 58COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27 ref: 1E7A2FF1
GetEffectiveRightsFromAclW.ADVAPI32(?,?,?), ref: 1E7A302D
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(GetEffectiveRightsFromAcl,00000000,?,?,?,?), ref: 1E7A303D

Strings

GetEffectiveRightsFromAcl, xrefs: 1E7A3038
O:GetEffectiveRightsFromAcl, xrefs: 1E7A2FDD

Memory Dump Source

Source File: 00000011.00000002.1561923280.000000001E7A1000.00000040.00000001.01000000.00000012.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000011.00000002.1561891626.000000001E7A0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7B9000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7BE000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562197228.000000001E7C0000.00000080.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562233172.000000001E7C2000.00000004.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e7a0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_EffectiveError@@FromParseRightsTupleU_object@@Win_
String ID: GetEffectiveRightsFromAcl$O:GetEffectiveRightsFromAcl
API String ID: 3145827223-568366055
Opcode ID: c979590103764327e58578692737bee23e941248b4c1faa435c4c38914f5d788
Instruction ID: d23dee967f536961babcdbd243f78c18e039a4e2ca86f22673c8f9d79ef03046
Opcode Fuzzy Hash: c979590103764327e58578692737bee23e941248b4c1faa435c4c38914f5d788
Instruction Fuzzy Hash: 1F117379608242ABF600CF64ED4496F73EAABD4608F4C4B1CFA4882224E771D909CB63

Function 03417B10 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 56servicethreadCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,0341D4C4), ref: 03417B21
PyEval_SaveThread.PYTHON27 ref: 03417B4E
ControlService.ADVAPI32(00000000,00000001,?), ref: 03417B5E
PyEval_RestoreThread.PYTHON27(00000000), ref: 03417B67
CloseServiceHandle.ADVAPI32(00000000), ref: 03417B84

Strings

ControlService, xrefs: 03417B76

Memory Dump Source

Source File: 00000011.00000002.1560676867.0000000003411000.00000040.00000001.01000000.0000000F.sdmp, Offset: 03410000, based on PE: true

Associated: 00000011.00000002.1560637646.0000000003410000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560676867.000000000341B000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560676867.000000000341F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560836323.0000000003423000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_3410000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Eval_ServiceThread$Arg_CloseControlHandleParseRestoreSaveTuple
String ID: ControlService
API String ID: 1908151670-253159669
Opcode ID: 650f1642c4bd00107d2561bd8f1dbe485819f2dd258f597c8ad7b071036c2a3c
Instruction ID: 6a5c5359435ad2889ef0b4f9ff712dbc4472322bedd648d85abfd40bb73f2640
Opcode Fuzzy Hash: 650f1642c4bd00107d2561bd8f1dbe485819f2dd258f597c8ad7b071036c2a3c
Instruction Fuzzy Hash: 4D014975900B106FD320FB64AC85FBFBBF8AF48214F080519F909EE205E765855486D6

Function 1E8C3130 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 54threadCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,|(iiii):ClipCursor,?,?,?,?), ref: 1E8C3151
PyEval_SaveThread.PYTHON27 ref: 1E8C3187
ClipCursor.USER32(?), ref: 1E8C3190
PyEval_RestoreThread.PYTHON27(00000000), ref: 1E8C3199
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(ClipCursor,00000000), ref: 1E8C31AF

Strings

ClipCursor, xrefs: 1E8C31AA
|(iiii):ClipCursor, xrefs: 1E8C314B

Memory Dump Source

Source File: 00000011.00000002.1562490344.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 00000011.00000002.1562469835.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562702731.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562730939.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Eval_Thread$Arg_ClipCursorError@@ParseRestoreSaveTupleU_object@@Win_
String ID: ClipCursor$|(iiii):ClipCursor
API String ID: 3994240143-1885644412
Opcode ID: 03bae3ebc2b35febff9c1898678d1086ebe4077f449b1886c00a363d64718a5d
Instruction ID: 082b9c66e0d82db8c99b73d8702172ceed4d5839f0ab54d4645fb57af49c3345
Opcode Fuzzy Hash: 03bae3ebc2b35febff9c1898678d1086ebe4077f449b1886c00a363d64718a5d
Instruction Fuzzy Hash: 8F119A79414351FFE300AB68CC48BCA77E9EBC6355F84895EF95D83251E334D28A8B92

Function 1E8C58E0 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 52COMMON

Download Yara Rule

APIs

PyErr_Format.PYTHON27(?,%s is not available on this platform,SetSystemFileCacheSize), ref: 1E8C58FE
PyArg_ParseTupleAndKeywords.PYTHON27 ref: 1E8C5937

Strings

%s is not available on this platform, xrefs: 1E8C58F8
SetSystemFileCacheSize, xrefs: 1E8C5961
SetSystemFileCacheSize, xrefs: 1E8C58F3

Memory Dump Source

Source File: 00000011.00000002.1562490344.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 00000011.00000002.1562469835.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562702731.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562730939.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_Err_FormatKeywordsParseTuple
String ID: %s is not available on this platform$SetSystemFileCacheSize$SetSystemFileCacheSize
API String ID: 223827023-2598241473
Opcode ID: bc6d2715eaa3e589252fb0dacca9e7eecf476bd4067585dc77295466f82830f6
Instruction ID: 080d5c9a79d2c53f7e7599484dfd1590d1ee20e5f8fb7f27ef648be3c58d6010
Opcode Fuzzy Hash: bc6d2715eaa3e589252fb0dacca9e7eecf476bd4067585dc77295466f82830f6
Instruction Fuzzy Hash: 051139B5514205AFE700DB18EC84EAA73E9FBC9749F448A18F84DC3350E2359A5ECB66

Function 1E8C94F0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 47threadCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,OiH:SetWindowWord,?,?,?), ref: 1E8C950C
?PyWinObject_AsHANDLE@@YAHPAU_object@@PAPAX@Z.PYWINTYPES27(?,?), ref: 1E8C9528
PyEval_SaveThread.PYTHON27 ref: 1E8C9537
SetWindowWord.USER32(?,?,?), ref: 1E8C954E
PyEval_RestoreThread.PYTHON27(00000000), ref: 1E8C9558
Py_BuildValue.PYTHON27(1E8D17EC), ref: 1E8C9564

Strings

OiH:SetWindowWord, xrefs: 1E8C9506

Memory Dump Source

Source File: 00000011.00000002.1562490344.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 00000011.00000002.1562469835.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562702731.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562730939.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Eval_Thread$Arg_BuildObject_ParseRestoreSaveTupleU_object@@ValueWindowWord
String ID: OiH:SetWindowWord
API String ID: 3386090183-1636800532
Opcode ID: 693b13e680d05a84d006e96f0a2156bb9a3167adbaf6073728440dfb751567b7
Instruction ID: 9757fcb5d6840237fca44759b2fb2800b93672f0fdcc2e8b89194e9a623a20bd
Opcode Fuzzy Hash: 693b13e680d05a84d006e96f0a2156bb9a3167adbaf6073728440dfb751567b7
Instruction Fuzzy Hash: 3B017CB9104211BFE700EBA9CC88CEB37ECEEC5215F44891CF94983211E630D55ACB62

Function 1E8C9620 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 47threadCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,OiH:SetClassWord,?,?,?), ref: 1E8C963C
?PyWinObject_AsHANDLE@@YAHPAU_object@@PAPAX@Z.PYWINTYPES27(?,?), ref: 1E8C9658
PyEval_SaveThread.PYTHON27 ref: 1E8C9667
SetClassWord.USER32(?,?,?), ref: 1E8C967E
PyEval_RestoreThread.PYTHON27(00000000), ref: 1E8C9688
Py_BuildValue.PYTHON27(1E8D1818), ref: 1E8C9694

Strings

OiH:SetClassWord, xrefs: 1E8C9636

Memory Dump Source

Source File: 00000011.00000002.1562490344.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 00000011.00000002.1562469835.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562702731.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562730939.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Eval_Thread$Arg_BuildClassObject_ParseRestoreSaveTupleU_object@@ValueWord
String ID: OiH:SetClassWord
API String ID: 4137373742-2662879383
Opcode ID: 60916635556915d4755e0385fe637fd5652a27065125a1c28e87bc86ce65a818
Instruction ID: 6e4b15cd90c58defe7778c42c5c8bed0fa7f48acf13b0415796ddc49a107f7c1
Opcode Fuzzy Hash: 60916635556915d4755e0385fe637fd5652a27065125a1c28e87bc86ce65a818
Instruction Fuzzy Hash: 9C0178B9104221BFE700EBA8CC88CEB77E8EEC5605F44895CF849C3211E630D55ACBA2

Function 1E8C8E30 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 45threadprocessCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27 ref: 1E8C8E4E
PyEval_SaveThread.PYTHON27 ref: 1E8C8E61
WinExec.KERNEL32(?,?), ref: 1E8C8E73
PyEval_RestoreThread.PYTHON27(00000000), ref: 1E8C8E7C
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(WinExec,00000000), ref: 1E8C8E90

Strings

s|i:WinExec, xrefs: 1E8C8E40
WinExec, xrefs: 1E8C8E8B

Memory Dump Source

Source File: 00000011.00000002.1562490344.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 00000011.00000002.1562469835.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562702731.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562730939.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Eval_Thread$Arg_Error@@ExecParseRestoreSaveTupleU_object@@Win_
String ID: WinExec$s|i:WinExec
API String ID: 2056427439-1679636345
Opcode ID: 7c82fa5205b9f8d0cf3c31fca5a3a44589ebd4e45f68d0512a48efd5fac95032
Instruction ID: 159855b81b8e51874cb0150887629e4abb79e4fb6d01676d991d131ce2afe9b1
Opcode Fuzzy Hash: 7c82fa5205b9f8d0cf3c31fca5a3a44589ebd4e45f68d0512a48efd5fac95032
Instruction Fuzzy Hash: 1401A275500211AFE300EB69EC8C8CBBBE8FFC6215F444529F94DC3211E7309599CBA2

Function 1E7A6C50 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 44COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON27(?,SetSecurityDescriptorControl does not exist on this platform), ref: 1E7A6C69
PyArg_ParseTuple.PYTHON27(?,ll:SetSecurityDescriptorControl,?), ref: 1E7A6C8B
SetSecurityDescriptorControl.ADVAPI32(?,?), ref: 1E7A6CA9
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(SetSecurityDescriptorControl,00000000), ref: 1E7A6CB9

Strings

SetSecurityDescriptorControl, xrefs: 1E7A6CB4
SetSecurityDescriptorControl does not exist on this platform, xrefs: 1E7A6C63
ll:SetSecurityDescriptorControl, xrefs: 1E7A6C85

Memory Dump Source

Source File: 00000011.00000002.1561923280.000000001E7A1000.00000040.00000001.01000000.00000012.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000011.00000002.1561891626.000000001E7A0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7B9000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7BE000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562197228.000000001E7C0000.00000080.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562233172.000000001E7C2000.00000004.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e7a0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_ControlDescriptorErr_Error@@ParseSecurityStringTupleU_object@@Win_
String ID: SetSecurityDescriptorControl$SetSecurityDescriptorControl does not exist on this platform$ll:SetSecurityDescriptorControl
API String ID: 1472735374-853495732
Opcode ID: 5db2d0e93c83969b0d6bfa78bdb88a4c1f9b7462955516ccb8f44a727ce8f5fd
Instruction ID: 783fd8f79bfda2c56084a0fa5360aa7764f1971089dafc8b28dc17343dfed23b
Opcode Fuzzy Hash: 5db2d0e93c83969b0d6bfa78bdb88a4c1f9b7462955516ccb8f44a727ce8f5fd
Instruction Fuzzy Hash: 31012CB4500201EFE704EB54DD85D5673A9FBC8745F884A28FA4983315F635E958CBA2

Function 1E7AA420 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

PyInt_AsLong.PYTHON27(?,?,?,?,1E7A40BF,?,?), ref: 1E7AA428
PyErr_Occurred.PYTHON27 ref: 1E7AA442
PyErr_Clear.PYTHON27 ref: 1E7AA448
PyLong_AsUnsignedLong.PYTHON27(?), ref: 1E7AA44F
PyErr_Occurred.PYTHON27 ref: 1E7AA45F
PyErr_Format.PYTHON27(?,Unable to convert %s to pointer-sized value,?), ref: 1E7AA47A

Strings

Unable to convert %s to pointer-sized value, xrefs: 1E7AA474

Memory Dump Source

Source File: 00000011.00000002.1561923280.000000001E7A1000.00000040.00000001.01000000.00000012.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000011.00000002.1561891626.000000001E7A0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7B9000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7BE000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562197228.000000001E7C0000.00000080.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562233172.000000001E7C2000.00000004.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e7a0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Err_$LongOccurred$ClearFormatInt_Long_Unsigned
String ID: Unable to convert %s to pointer-sized value
API String ID: 1914827174-2431006615
Opcode ID: cbc5f5c853536b678cc34165d37b7aef96da6bc27c67da3717dfffdedeb242b5
Instruction ID: e0954bc911f069dd05ef2579020623ccda8515ec9cb0790b54c623815e95e27a
Opcode Fuzzy Hash: cbc5f5c853536b678cc34165d37b7aef96da6bc27c67da3717dfffdedeb242b5
Instruction Fuzzy Hash: CF0181751106229FE700ABB8ECC888A73A9EFCC33AB184725F611C3291D731E851CBA1

Function 1E8CAE60 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 44COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27 ref: 1E8CAE7E
?PyWinObject_AsString@@YAHPAU_object@@PAPADHPAK@Z.PYWINTYPES27(?,?,00000000,00000000), ref: 1E8CAE9F
LoadKeyboardLayoutA.USER32(?), ref: 1E8CAEB5
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(LoadKeyboardLayout,00000000), ref: 1E8CAEC5

Strings

O|k:LoadKeyboardLayout, xrefs: 1E8CAE70
LoadKeyboardLayout, xrefs: 1E8CAEC0

Memory Dump Source

Source File: 00000011.00000002.1562490344.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 00000011.00000002.1562469835.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562702731.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562730939.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: U_object@@$Arg_Error@@KeyboardLayoutLoadObject_ParseString@@TupleWin_
String ID: LoadKeyboardLayout$O|k:LoadKeyboardLayout
API String ID: 3027879772-2653305174
Opcode ID: 1a71ddff9180a3fa61f994ffea2360d2e9551e9f2fc33960db58859f990cb953
Instruction ID: aab2a2f48a223e0b75216b41e25fcc03c12d86bbd9ef672072850926747cb1f5
Opcode Fuzzy Hash: 1a71ddff9180a3fa61f994ffea2360d2e9551e9f2fc33960db58859f990cb953
Instruction Fuzzy Hash: B10162B45043026BE310DB64DC49FAB77E8BB84605F844A18F94AC3240F735D65CC7A3

Function 1E8C93D0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 42threadCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,Oi:GetWindowLong,?,?), ref: 1E8C93E7
?PyWinObject_AsHANDLE@@YAHPAU_object@@PAPAX@Z.PYWINTYPES27(?,?), ref: 1E8C9403
PyEval_SaveThread.PYTHON27 ref: 1E8C9412
GetWindowLongA.USER32(?,?), ref: 1E8C9424
PyEval_RestoreThread.PYTHON27(00000000), ref: 1E8C942D
?PyWinLong_FromVoidPtr@@YAPAU_object@@PBX@Z.PYWINTYPES27(00000000), ref: 1E8C9434

Strings

Oi:GetWindowLong, xrefs: 1E8C93E1

Memory Dump Source

Source File: 00000011.00000002.1562490344.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 00000011.00000002.1562469835.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562702731.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562730939.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Eval_ThreadU_object@@$Arg_FromLongLong_Object_ParsePtr@@RestoreSaveTupleVoidWindow
String ID: Oi:GetWindowLong
API String ID: 1337450506-643273479
Opcode ID: fe0f14b34b76ef1aa2a3c6c40cdeacec275f490749824ac1fcbd184791dfac54
Instruction ID: 9dbc677ce5d791d03a312997c9a79426bb36f6e7e5fad179a5d83d7aa77490a2
Opcode Fuzzy Hash: fe0f14b34b76ef1aa2a3c6c40cdeacec275f490749824ac1fcbd184791dfac54
Instruction Fuzzy Hash: 7CF06975500211AFD300DBB8DD8C9AB37E8EE86615F444929FD4DC3210EB35D59ACAA2

Function 1E8C8B10 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 42threadCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,(ii):SetCursorPos,?), ref: 1E8C8B26
PyEval_SaveThread.PYTHON27 ref: 1E8C8B39
SetCursorPos.USER32(?,?), ref: 1E8C8B4B
PyEval_RestoreThread.PYTHON27(00000000), ref: 1E8C8B54
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(SetCursorPos,00000000), ref: 1E8C8B6A

Strings

(ii):SetCursorPos, xrefs: 1E8C8B20
SetCursorPos, xrefs: 1E8C8B65

Memory Dump Source

Source File: 00000011.00000002.1562490344.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 00000011.00000002.1562469835.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562702731.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562730939.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Eval_Thread$Arg_CursorError@@ParseRestoreSaveTupleU_object@@Win_
String ID: (ii):SetCursorPos$SetCursorPos
API String ID: 647088857-2583399437
Opcode ID: 46b12024f42166a58400776cf2848e42b4b56acf0635cf6b9676b25b696b6c79
Instruction ID: d0bf164e9695ec1ed29dd8ff2556ef71d848b48139457e3b4605a368a05c5645
Opcode Fuzzy Hash: 46b12024f42166a58400776cf2848e42b4b56acf0635cf6b9676b25b696b6c79
Instruction Fuzzy Hash: B1F081B95102117FE700AB78EC8D9DA37E4EF86252F844528F90EC3211E630E559CAA6

Function 1E8C2920 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 42threadCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,ll:GenerateConsoleCtrlEvent,?), ref: 1E8C2936
PyEval_SaveThread.PYTHON27 ref: 1E8C2949
GenerateConsoleCtrlEvent.KERNEL32(?,?), ref: 1E8C295B
PyEval_RestoreThread.PYTHON27(00000000), ref: 1E8C2964
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(GenerateConsoleCtrlEvent,00000000), ref: 1E8C297A

Strings

ll:GenerateConsoleCtrlEvent, xrefs: 1E8C2930
GenerateConsoleCtrlEvent, xrefs: 1E8C2975

Memory Dump Source

Source File: 00000011.00000002.1562490344.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 00000011.00000002.1562469835.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562702731.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562730939.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Eval_Thread$Arg_ConsoleCtrlError@@EventGenerateParseRestoreSaveTupleU_object@@Win_
String ID: GenerateConsoleCtrlEvent$ll:GenerateConsoleCtrlEvent
API String ID: 2295157843-3675785453
Opcode ID: e63e4e8a3dd996caf342ebad4f51df8f02cc3a3785e10096a6d3410208ed8a27
Instruction ID: fe574b0c7b7cfe122e6096f740d61bf58c9d6fd84ce55bb5a138f21cde9d477b
Opcode Fuzzy Hash: e63e4e8a3dd996caf342ebad4f51df8f02cc3a3785e10096a6d3410208ed8a27
Instruction Fuzzy Hash: 34F0AFBA510111BFE700AB68DC8DDDA77E8EFC6646F844528F90DC3361E730D599CAA2

Function 1E8C1160 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 42threadCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,ii:Beep,?), ref: 1E8C1176
PyEval_SaveThread.PYTHON27 ref: 1E8C1189
Beep.KERNEL32(?,?), ref: 1E8C119B
PyEval_RestoreThread.PYTHON27(00000000), ref: 1E8C11A4
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(Beep,00000000), ref: 1E8C11BA

Strings

Beep, xrefs: 1E8C11B5
ii:Beep, xrefs: 1E8C1170

Memory Dump Source

Source File: 00000011.00000002.1562490344.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 00000011.00000002.1562469835.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562702731.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562730939.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Eval_Thread$Arg_BeepError@@ParseRestoreSaveTupleU_object@@Win_
String ID: Beep$ii:Beep
API String ID: 1393573721-3516216599
Opcode ID: c25a0fc67e16a25e60de6125e59c7f0106056040f616fa6202c44e6e94ac9679
Instruction ID: 9e0aec933e9fad2c0f69af6bf82fa439435e95ff4dade5a9591759a5000bd0ab
Opcode Fuzzy Hash: c25a0fc67e16a25e60de6125e59c7f0106056040f616fa6202c44e6e94ac9679
Instruction Fuzzy Hash: CCF081795001107FE7009B68DC8D9DA37E4EFC6242F848529F90DC3210E634D59ACAA2

Function 1E7A7210 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 41COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,i:GetSubAuthority), ref: 1E7A721F
GetSidSubAuthorityCount.ADVAPI32(?), ref: 1E7A7237
GetSidSubAuthority.ADVAPI32(?,?), ref: 1E7A724A
PyInt_FromLong.PYTHON27 ref: 1E7A7253

Strings

i:GetSubAuthority, xrefs: 1E7A7219
The index is out of range, xrefs: 1E7A7266

Memory Dump Source

Source File: 00000011.00000002.1561923280.000000001E7A1000.00000040.00000001.01000000.00000012.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000011.00000002.1561891626.000000001E7A0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7B9000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7BE000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562197228.000000001E7C0000.00000080.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562233172.000000001E7C2000.00000004.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e7a0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Authority$Arg_CountFromInt_LongParseTuple
String ID: The index is out of range$i:GetSubAuthority
API String ID: 1053781174-2602025648
Opcode ID: f5cfad954a81e2f8e163155194127437a91c0880765b4be690a6733872cd6292
Instruction ID: a1aaf9b68beabba143168c8bff436ab9866d544519ce4a735eace0c1f9e9515e
Opcode Fuzzy Hash: f5cfad954a81e2f8e163155194127437a91c0880765b4be690a6733872cd6292
Instruction Fuzzy Hash: D1F062B1114125EFE2049B64EC84C9B77ADEFCC31AB184A69FA07C7251E734D911DB91

Function 1E8C9B70 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 41threadCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,O:OutputDebugString,?), ref: 1E8C9B82
?PyWinObject_AsString@@YAHPAU_object@@PAPADHPAK@Z.PYWINTYPES27(?,00000000,00000000,00000000), ref: 1E8C9BA3
PyEval_SaveThread.PYTHON27 ref: 1E8C9BB1
OutputDebugStringA.KERNEL32(?), ref: 1E8C9BBE
PyEval_RestoreThread.PYTHON27(00000000), ref: 1E8C9BC5
?PyWinObject_FreeString@@YAXPAD@Z.PYWINTYPES27(?), ref: 1E8C9BD0

Strings

O:OutputDebugString, xrefs: 1E8C9B7C

Memory Dump Source

Source File: 00000011.00000002.1562490344.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 00000011.00000002.1562469835.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562702731.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562730939.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Eval_Object_String@@Thread$Arg_DebugFreeOutputParseRestoreSaveStringTupleU_object@@
String ID: O:OutputDebugString
API String ID: 3346880622-3429311566
Opcode ID: dab3ee4718e11110c7d84f9bf3340fe9019661522cf49ec08a83fce47eea3bd8
Instruction ID: dc26aec447bd5298a83eb4cd614d42344f27e281b28a2bf34cce5d3a64c84e79
Opcode Fuzzy Hash: dab3ee4718e11110c7d84f9bf3340fe9019661522cf49ec08a83fce47eea3bd8
Instruction Fuzzy Hash: 38018139510221BFE7009B78DD8CADA37E8BF89645F848918FE0DC3250E734D555CBA6

Function 1E8C9900 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 40threadtimeCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,:GetSystemTime), ref: 1E8C990D
PyEval_SaveThread.PYTHON27 ref: 1E8C991F
GetSystemTime.KERNEL32(?), ref: 1E8C992C
PyEval_RestoreThread.PYTHON27(00000000), ref: 1E8C9933
Py_BuildValue.PYTHON27((hhhhhhhh),?,?,?,?,?,?,?,?), ref: 1E8C996E

Strings

(hhhhhhhh), xrefs: 1E8C9969
:GetSystemTime, xrefs: 1E8C9907

Memory Dump Source

Source File: 00000011.00000002.1562490344.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 00000011.00000002.1562469835.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562702731.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562730939.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Eval_Thread$Arg_BuildParseRestoreSaveSystemTimeTupleValue
String ID: (hhhhhhhh)$:GetSystemTime
API String ID: 2142700038-484796045
Opcode ID: 87137d63702dbb6af0df5b8a9a5e6bee568a8e8c6cd4f39bc92b013ba4d42653
Instruction ID: a44096939f3c937b81a47f373943e3559f2622194acb0566e44efa176687763a
Opcode Fuzzy Hash: 87137d63702dbb6af0df5b8a9a5e6bee568a8e8c6cd4f39bc92b013ba4d42653
Instruction Fuzzy Hash: 8DF036A1408231BBD344DFAADC488BB76E9FE89A02F40494DF98991151F73C8599D377

Function 1E8C91B0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 39threadwindowCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,|i:MessageBeep), ref: 1E8C91C7
PyEval_SaveThread.PYTHON27 ref: 1E8C91D8
MessageBeep.USER32(?), ref: 1E8C91E5
PyEval_RestoreThread.PYTHON27(00000000), ref: 1E8C91EE
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(MessageBeep,00000000), ref: 1E8C9204

Strings

|i:MessageBeep, xrefs: 1E8C91B9
MessageBeep, xrefs: 1E8C91FF

Memory Dump Source

Source File: 00000011.00000002.1562490344.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 00000011.00000002.1562469835.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562702731.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562730939.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Eval_Thread$Arg_BeepError@@MessageParseRestoreSaveTupleU_object@@Win_
String ID: MessageBeep$|i:MessageBeep
API String ID: 3242808027-984191393
Opcode ID: dd1e6941ebad322ef9b9d53e5ed57da65e2730346cf2d1c792ac8bf816f57f33
Instruction ID: c8f8a986a808dcf6b7472ef62cee4ecbfbf3c348f8bc72a49a2330aaab80a333
Opcode Fuzzy Hash: dd1e6941ebad322ef9b9d53e5ed57da65e2730346cf2d1c792ac8bf816f57f33
Instruction Fuzzy Hash: 1BF090B5110211BFE3109B69EC8CACA37F8EFCA366F148159F90EC3361DB349496DA61

Function 1E8C3250 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 38threadCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,O:SetCursor), ref: 1E8C3261
?PyWinObject_AsHANDLE@@YAHPAU_object@@PAPAX@Z.PYWINTYPES27(00000000,?), ref: 1E8C327D
PyEval_SaveThread.PYTHON27 ref: 1E8C328C
SetCursor.USER32(?), ref: 1E8C3299
PyEval_RestoreThread.PYTHON27(00000000), ref: 1E8C32A2
?PyWinLong_FromHANDLE@@YAPAU_object@@PAX@Z.PYWINTYPES27(00000000), ref: 1E8C32A9

Strings

O:SetCursor, xrefs: 1E8C325B

Memory Dump Source

Source File: 00000011.00000002.1562490344.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 00000011.00000002.1562469835.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562702731.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562730939.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Eval_ThreadU_object@@$Arg_CursorFromLong_Object_ParseRestoreSaveTuple
String ID: O:SetCursor
API String ID: 3428432267-3909396347
Opcode ID: 4d2e2fcc5fb17deadd4f2858d9e161bd464ee683d7b575d28ef08367569555f5
Instruction ID: 5f31362884e0252305bdac1811b4adf885422f02c771a9a2e498e6ec6ba7da09
Opcode Fuzzy Hash: 4d2e2fcc5fb17deadd4f2858d9e161bd464ee683d7b575d28ef08367569555f5
Instruction Fuzzy Hash: C5F090755001106FDB00ABB8ED8C8EB37E9BF86606F444928F94DC3200E638D65AC6A2

Function 1E8C30D0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 30threadwindowCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,:GetFocus), ref: 1E8C30DA
PyEval_SaveThread.PYTHON27 ref: 1E8C30EA
GetFocus.USER32 ref: 1E8C30F2
PyEval_RestoreThread.PYTHON27(00000000), ref: 1E8C30FB

Strings

:GetFocus, xrefs: 1E8C30D4
No window has the focus, xrefs: 1E8C3112

Memory Dump Source

Source File: 00000011.00000002.1562490344.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 00000011.00000002.1562469835.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562702731.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562730939.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Eval_Thread$Arg_FocusParseRestoreSaveTuple
String ID: :GetFocus$No window has the focus
API String ID: 1746004230-4284376810
Opcode ID: 25a051c9d68cfc617a08563b5d3fbcd5f70c09b6d65c2b16a97492498e0f2857
Instruction ID: 8e7685c53ce8a165b35c7e30d536c9ba2e62afbace7b2f2048a7686770725b0b
Opcode Fuzzy Hash: 25a051c9d68cfc617a08563b5d3fbcd5f70c09b6d65c2b16a97492498e0f2857
Instruction Fuzzy Hash: DFF0A072500220ABE3011B79EC4C6CB3BE4AF832A6F408125FA0DC3210D335C58A8792

Function 03416630 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 104COMMON

Download Yara Rule

APIs

CommandLineToArgvW.SHELL32(?,?,?,?,?,03411B15,?,00000000), ref: 0341668A
PyList_New.PYTHON27(?,?,?,?,03411B15,?,00000000), ref: 034166AE
PyUnicodeUCS2_FromWideChar.PYTHON27(?,?,?,?,?,?,03411B15,?,00000000), ref: 034166F1
LocalFree.KERNEL32(00000000,?,?,?,03411B15,?,00000000), ref: 03416719
73BB3B4E.MSVCR90(?,?,?,03411B15,?,00000000), ref: 03416729

Part of subcall function 03416100: GetCurrentProcess.KERNEL32(?,?,00000000), ref: 0341614F
Part of subcall function 03416100: IsWow64Process.KERNEL32(00000000,?,00000000), ref: 0341615C
Part of subcall function 03416100: IsWow64Process.KERNEL32(00000000,?,?,00000000), ref: 0341616C
Part of subcall function 03416100: PyErr_Clear.PYTHON27(?,?,?,00000000), ref: 034161AE
Part of subcall function 03416100: CloseHandle.KERNEL32(00000000,?,?,00000000), ref: 03416488
Part of subcall function 03416100: 73BB3B4E.MSVCR90(00000000,?,?,00000000), ref: 03416493

Strings

CommandLineToArgvW, xrefs: 0341669A

Memory Dump Source

Source File: 00000011.00000002.1560676867.0000000003411000.00000040.00000001.01000000.0000000F.sdmp, Offset: 03410000, based on PE: true

Associated: 00000011.00000002.1560637646.0000000003410000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560676867.000000000341B000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560676867.000000000341F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560836323.0000000003423000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_3410000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Process$Wow64$ArgvCharClearCloseCommandCurrentErr_FreeFromHandleLineList_LocalUnicodeWide
String ID: CommandLineToArgvW
API String ID: 3998261610-1958408031
Opcode ID: 3760b8b260f43006a77e6db660fe96ad2b0be50a9b99c838edfb7272c22c81c1
Instruction ID: 34488bf526ba0cecdcd4bd84c46f2771be60b3bd0a5481d517241346e8fc8fd2
Opcode Fuzzy Hash: 3760b8b260f43006a77e6db660fe96ad2b0be50a9b99c838edfb7272c22c81c1
Instruction Fuzzy Hash: 9A31AFBA5047119FC710DF58D88096FF7E8FB84654F09892AFC958F204E338EA65CB96

Function 1E7A5960 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 82COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON27(?,can't delete SECURITY_ATTRIBUTES attributes), ref: 1E7A5976
PyString_AsString.PYTHON27(?), ref: 1E7A598A
?PyWinObject_AsSECURITY_DESCRIPTOR@@YAHPAU_object@@PAPAXH@Z.PYWINTYPES27(?,?,00000001), ref: 1E7A59D1

Strings

SECURITY_DESCRIPTOR, xrefs: 1E7A5997
can't delete SECURITY_ATTRIBUTES attributes, xrefs: 1E7A5970

Memory Dump Source

Source File: 00000011.00000002.1561923280.000000001E7A1000.00000040.00000001.01000000.00000012.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000011.00000002.1561891626.000000001E7A0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7B9000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7BE000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562197228.000000001E7C0000.00000080.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562233172.000000001E7C2000.00000004.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e7a0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: String$Err_Object_String_U_object@@
String ID: SECURITY_DESCRIPTOR$can't delete SECURITY_ATTRIBUTES attributes
API String ID: 3706224395-4263807770
Opcode ID: 0613e97584f3de8c592d6cf404edb2e6f0f69ae6fc6be730566a8e602bd57885
Instruction ID: c517fce7c456d270daf6b15982e9f99ee51033fe113d8d5a3c88660618a33db3
Opcode Fuzzy Hash: 0613e97584f3de8c592d6cf404edb2e6f0f69ae6fc6be730566a8e602bd57885
Instruction Fuzzy Hash: E921D3716142814FE310CF38E880A9B77AAAFC5234F4C4B59EAA58B2A5D332D445CB91

Function 1E8C73AE Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 67registrythreadCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,Oi:PyRegEnumValue,?,?), ref: 1E8C73DA
?PyWinObject_AsHKEY@@YAHPAU_object@@PAPAUHKEY__@@@Z.PYWINTYPES27(?,?), ref: 1E8C73F3
RegQueryInfoKeyA.ADVAPI32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000000,00000000), ref: 1E8C7422
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(RegQueryInfoKey,00000000), ref: 1E8C7432
__alloca_probe_16.LIBCMT ref: 1E8C7453
__alloca_probe_16.LIBCMT ref: 1E8C745C
PyEval_SaveThread.PYTHON27 ref: 1E8C7473
RegEnumValueA.ADVAPI32(?,?,?,?,00000000,?,?,?), ref: 1E8C7494
PyEval_RestoreThread.PYTHON27(?,?,?,00000000,?,?,?), ref: 1E8C74A0
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(PyRegEnumValue,00000000,?), ref: 1E8C74B3

Strings

RegQueryInfoKey, xrefs: 1E8C742D
Oi:PyRegEnumValue, xrefs: 1E8C73D4

Memory Dump Source

Source File: 00000011.00000002.1562490344.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 00000011.00000002.1562469835.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562702731.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562730939.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: U_object@@$Error@@Eval_ThreadWin___alloca_probe_16$Arg_EnumInfoObject_ParseQueryRestoreSaveTupleValueY__@@@
String ID: Oi:PyRegEnumValue$RegQueryInfoKey
API String ID: 1596361088-2323119663
Opcode ID: e21ab7a682a271032234e114d654a7c0c3e36d51f578021c83ed091e73415115
Instruction ID: 4af1df99f5c254d1d898ccb9de021f5908bd2d7b8270b7a9d3d9faaaa6498ef8
Opcode Fuzzy Hash: e21ab7a682a271032234e114d654a7c0c3e36d51f578021c83ed091e73415115
Instruction Fuzzy Hash: C601B575A00208BBEB10EBA89D89FEFB7BCEF45506F104514FA09D3140E631E655C7B1

Function 1E7D26E0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 67registryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,000003F8,?,00000100,?), ref: 1E7D26F0
LoadStringW.USER32(00000000), ref: 1E7D26F7
RegOpenKeyW.ADVAPI32(80000002,?,?), ref: 1E7D2741
RegQueryValueExW.ADVAPI32(?,00000000,00000000,?,?,?,?,?,?,?), ref: 1E7D277F
RegCloseKey.ADVAPI32(?,?,?,?,?,?), ref: 1E7D27A9

Part of subcall function 1E7D1F00: GetLastError.KERNEL32(00000000,?), ref: 1E7D1F0E
Part of subcall function 1E7D1F00: FormatMessageW.KERNEL32(00001000,00000000,00000000,00000000,?,00000200,00000000,00000000,?), ref: 1E7D1F2C
Part of subcall function 1E7D1F00: wsprintfW.USER32 ref: 1E7D1FB8

Strings

System\CurrentControlSet\Services\%s\PythonClass, xrefs: 1E7D2712

Memory Dump Source

Source File: 00000011.00000002.1562321143.000000001E7D1000.00000040.00000001.01000000.00000015.sdmp, Offset: 1E7D0000, based on PE: true

Associated: 00000011.00000002.1562293036.000000001E7D0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000011.00000002.1562321143.000000001E7DA000.00000040.00000001.01000000.00000015.sdmpDownload File
Associated: 00000011.00000002.1562391495.000000001E7DB000.00000080.00000001.01000000.00000015.sdmpDownload File
Associated: 00000011.00000002.1562417397.000000001E7DD000.00000004.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e7d0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: CloseErrorFormatHandleLastLoadMessageModuleOpenQueryStringValuewsprintf
String ID: System\CurrentControlSet\Services\%s\PythonClass
API String ID: 27574671-1026807537
Opcode ID: 40515b2818b6dc3e270ed72e885fa7a2b777dfc16a4924f6962957220fcecc06
Instruction ID: b8fd87fb04ddff267a4369b85114c0a4cdcc8413256b62ce42043f5239a09799
Opcode Fuzzy Hash: 40515b2818b6dc3e270ed72e885fa7a2b777dfc16a4924f6962957220fcecc06
Instruction Fuzzy Hash: 94114275604301ABF3609FA4ED89BA777ECFB88B61F40492CFA49D2144EA35D50CCA63

Function 03411BA0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27 ref: 03411BC0
QueryFullProcessImageNameW.KERNEL32(00000000,00000000,?,?), ref: 03411C0E
CloseHandle.KERNEL32(00000000), ref: 03411C26

Strings

QueryFullProcessImageNameW, xrefs: 03411C18

Memory Dump Source

Source File: 00000011.00000002.1560676867.0000000003411000.00000040.00000001.01000000.0000000F.sdmp, Offset: 03410000, based on PE: true

Associated: 00000011.00000002.1560637646.0000000003410000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560676867.000000000341B000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560676867.000000000341F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560836323.0000000003423000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_3410000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_CloseFullHandleImageNameParseProcessQueryTuple
String ID: QueryFullProcessImageNameW
API String ID: 1411945861-4231907612
Opcode ID: 024b5703f8abbcbb5870d94b2967c4238db1a5adc6bb4fc8a6b2c7ac58e0b737
Instruction ID: 64ce7f6f3dcc7130261280b4a440a2dce2fb1ae8ed056056760c415b992df6fe
Opcode Fuzzy Hash: 024b5703f8abbcbb5870d94b2967c4238db1a5adc6bb4fc8a6b2c7ac58e0b737
Instruction Fuzzy Hash: 48110875940B056BD710EB50DC5ABDF73DCAF84704F484919F9548E244F778921887DA

Function 1E7A4930 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61COMMON

Download Yara Rule

APIs

?PyWinObject_AsBstr@@YAHPAU_object@@PAPA_WHPAK@Z.PYWINTYPES27(?,?,00000000,00000000,?,1E7A23A8,?,?,?,?,?,?,1E7A257E,77613D50,AddAccessAllowedObjectAce,?), ref: 1E7A496A
?PyWinObject_FreeBstr@@YAXPA_W@Z.PYWINTYPES27(?,?,?,?,?,1E7A257E,77613D50,AddAccessAllowedObjectAce,?,?,?,?,?,?), ref: 1E7A499C
?PyWin_SetBasicCOMError@@YAPAU_object@@J@Z.PYWINTYPES27(00000000,?,?,?,?,?,1E7A257E,77613D50,AddAccessAllowedObjectAce,?,?,?,?,?,?), ref: 1E7A49AA

Strings

Only strings and iids can be converted to a CLSID., xrefs: 1E7A49C3

Memory Dump Source

Source File: 00000011.00000002.1561923280.000000001E7A1000.00000040.00000001.01000000.00000012.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000011.00000002.1561891626.000000001E7A0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7B9000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7BE000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562197228.000000001E7C0000.00000080.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562233172.000000001E7C2000.00000004.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e7a0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Bstr@@Object_U_object@@$BasicError@@FreeWin_
String ID: Only strings and iids can be converted to a CLSID.
API String ID: 835282281-2423238067
Opcode ID: 321871e96fd2cac169694fdee2af4e56b379268f01c51050ea6f4b5a5e62ddae
Instruction ID: 2249318a8fb0346b6fcdd8d5cb5be9f3ba8f2840abed072d4f8f9613932de697
Opcode Fuzzy Hash: 321871e96fd2cac169694fdee2af4e56b379268f01c51050ea6f4b5a5e62ddae
Instruction Fuzzy Hash: 81112175510211AFE314DF25E848E57B7E9AFC9214F1D8A59FA08C7221E731E852CA92

Function 1E7A6540 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 60COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,:GetSecurityDescriptorOwner), ref: 1E7A6562
GetSecurityDescriptorOwner.ADVAPI32(?,?,?), ref: 1E7A6585
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(GetSecurityDescriptorOwner,00000000), ref: 1E7A6595

Part of subcall function 1E7A9F20: GetLastError.KERNEL32(00000000,?,1E7A5F68,MakeSelfRelativeSD,00000000), ref: 1E7A9F2A
Part of subcall function 1E7A9F20: ?PyWin_GetErrorMessageModule@@YAPAUHINSTANCE__@@K@Z.PYWINTYPES27(00000000,00000000,?,1E7A5F68,MakeSelfRelativeSD,00000000), ref: 1E7A9F38
Part of subcall function 1E7A9F20: FormatMessageA.KERNEL32(00001300,00000000,00000000,00000000,?,00000000,00000000), ref: 1E7A9F69
Part of subcall function 1E7A9F20: ?PyWinObject_FromTCHAR@@YAPAU_object@@PBDH@Z.PYWINTYPES27(No error message is available,000000FF,?,?,?,?,?,?,?,?,?,?,00000000), ref: 1E7A9FC7
Part of subcall function 1E7A9F20: ?PyWinCoreString_FromString@@YAPAU_object@@PBDH@Z.PYWINTYPES27(?,000000FF,00000000,?,73BB3D3F), ref: 1E7A9FD7
Part of subcall function 1E7A9F20: Py_BuildValue.PYTHON27((iNN),00000000,00000000,?,00000000,?,73BB3D3F), ref: 1E7A9FE6
Part of subcall function 1E7A9F20: LocalFree.KERNEL32(?), ref: 1E7A9FFF
Part of subcall function 1E7A9F20: PyErr_SetObject.PYTHON27(031BEB40,00000000), ref: 1E7AA010

Strings

:GetSecurityDescriptorOwner, xrefs: 1E7A655C
GetSecurityDescriptorOwner, xrefs: 1E7A6590

Memory Dump Source

Source File: 00000011.00000002.1561923280.000000001E7A1000.00000040.00000001.01000000.00000012.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000011.00000002.1561891626.000000001E7A0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7B9000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7BE000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562197228.000000001E7C0000.00000080.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562233172.000000001E7C2000.00000004.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e7a0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: U_object@@$ErrorFromMessageWin_$Arg_BuildCoreDescriptorE__@@Err_Error@@FormatFreeLastLocalModule@@ObjectObject_OwnerParseSecurityString@@String_TupleValue
String ID: :GetSecurityDescriptorOwner$GetSecurityDescriptorOwner
API String ID: 2810472384-1512101531
Opcode ID: a412d8fe6911e0f1e0a418da118e8a6826e278e7d09b049214d9a43513b37fd1
Instruction ID: c362184cb5a130664209f985e73367608124750c02ac9819a35c572582ec3584
Opcode Fuzzy Hash: a412d8fe6911e0f1e0a418da118e8a6826e278e7d09b049214d9a43513b37fd1
Instruction Fuzzy Hash: 901160B4904641EFE704DF54D941B56B7E5FBC8B14F484B2CE94A83364E738D544CB52

Function 1E8CAEE0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 60COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27 ref: 1E8CAF18
PyErr_Format.PYTHON27(?,keyboard state string must be exactly 256 characters), ref: 1E8CAF40

Strings

iis#|iO, xrefs: 1E8CAF02
keyboard state string must be exactly 256 characters, xrefs: 1E8CAF3A

Memory Dump Source

Source File: 00000011.00000002.1562490344.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 00000011.00000002.1562469835.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562702731.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562730939.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_Err_FormatParseTuple
String ID: iis#|iO$keyboard state string must be exactly 256 characters
API String ID: 361908667-3385178162
Opcode ID: d940f14d424c1dee7a6e6b7e86e6a4b4b238b9f617b53157f3decbc1d883f2b9
Instruction ID: aba608c82e1aaf34ce578c390401470956eaed16462a6466cb76b7691235ee25
Opcode Fuzzy Hash: d940f14d424c1dee7a6e6b7e86e6a4b4b238b9f617b53157f3decbc1d883f2b9
Instruction Fuzzy Hash: C9110AB5514201AFD304DF69C884E9BB7E8BBC9644F808A8CF54E83261E630DA59CB62

Function 1E7A6280 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 56COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,:Initialize), ref: 1E7A629A
InitializeSecurityDescriptor.ADVAPI32(?,00000001), ref: 1E7A62AE

Strings

InitializeSecurityDescriptor, xrefs: 1E7A62BF
:Initialize, xrefs: 1E7A628E

Memory Dump Source

Source File: 00000011.00000002.1561923280.000000001E7A1000.00000040.00000001.01000000.00000012.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000011.00000002.1561891626.000000001E7A0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7B9000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7BE000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562197228.000000001E7C0000.00000080.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562233172.000000001E7C2000.00000004.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e7a0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_DescriptorInitializeParseSecurityTuple
String ID: :Initialize$InitializeSecurityDescriptor
API String ID: 3008588735-475701968
Opcode ID: 5876e770a373c18191ec1faa5bf97fbc7e97dc22295245029203b1da22021b78
Instruction ID: b1fcaf02be90c8365b70036c527c572e31b673439928258eaf6a5abf4ed0a7a9
Opcode Fuzzy Hash: 5876e770a373c18191ec1faa5bf97fbc7e97dc22295245029203b1da22021b78
Instruction Fuzzy Hash: 080192367012125BE6009F99D884A9B77AAAFC8656F0D4729FB08C3261E770D459CBE2

Function 1E7D1890 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 56threadCOMMON

Download Yara Rule

APIs

?PyWinObject_AsWCHAR@@YAHPAU_object@@PAPA_WHPAK@Z.PYWINTYPES27(?,00000000,00000000,00000000), ref: 1E7D18A0
PyEval_SaveThread.PYTHON27 ref: 1E7D18C4
?PyWinObject_FreeWCHAR@@YAXPA_W@Z.PYWINTYPES27(00000000,-C00000FF), ref: 1E7D18F1
PyEval_RestoreThread.PYTHON27(00000000), ref: 1E7D18F8
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(RegisterEventSource/ReportEvent,00000000), ref: 1E7D190E

Strings

RegisterEventSource/ReportEvent, xrefs: 1E7D1909

Memory Dump Source

Source File: 00000011.00000002.1562321143.000000001E7D1000.00000040.00000001.01000000.00000015.sdmp, Offset: 1E7D0000, based on PE: true

Associated: 00000011.00000002.1562293036.000000001E7D0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000011.00000002.1562321143.000000001E7DA000.00000040.00000001.01000000.00000015.sdmpDownload File
Associated: 00000011.00000002.1562391495.000000001E7DB000.00000080.00000001.01000000.00000015.sdmpDownload File
Associated: 00000011.00000002.1562417397.000000001E7DD000.00000004.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e7d0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Eval_Object_ThreadU_object@@$Error@@FreeRestoreSaveWin_
String ID: RegisterEventSource/ReportEvent
API String ID: 4048910748-2303438860
Opcode ID: 48b1f20c97d904b64e62a35c35a0593539e51a329892c9e58eec7bd66798f6a8
Instruction ID: 224d882d99823ae8c3a7710d5ca33429d1bcd0e10a79e121167ea7d1a6192e6d
Opcode Fuzzy Hash: 48b1f20c97d904b64e62a35c35a0593539e51a329892c9e58eec7bd66798f6a8
Instruction Fuzzy Hash: EC01C0364402229BF300DB68FD85BEB37E8BF98614F440625FD44D2251F735991C8AA2

Function 1E7A1F30 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 50COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,lO:AddAccessAllowedAce,?,?), ref: 1E7A1F4F
PyErr_Clear.PYTHON27 ref: 1E7A1F8D
PyArg_ParseTuple.PYTHON27(?,llO:AddAccessAllowedAce,?,?,?), ref: 1E7A1FA8

Part of subcall function 1E7A1DC0: PyErr_Format.PYTHON27(?,%s not supported by this version of Windows,?,6D071680,?,?,1E7A1F84,775FF170,AddAccesAllowedAce,?,?,?,?), ref: 1E7A1DE5

Strings

lO:AddAccessAllowedAce, xrefs: 1E7A1F49
AddAccesAllowedAce, xrefs: 1E7A1F79
llO:AddAccessAllowedAce, xrefs: 1E7A1FA2

Memory Dump Source

Source File: 00000011.00000002.1561923280.000000001E7A1000.00000040.00000001.01000000.00000012.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000011.00000002.1561891626.000000001E7A0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7B9000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7BE000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562197228.000000001E7C0000.00000080.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562233172.000000001E7C2000.00000004.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e7a0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_Err_ParseTuple$ClearFormat
String ID: AddAccesAllowedAce$lO:AddAccessAllowedAce$llO:AddAccessAllowedAce
API String ID: 1510928575-648165593
Opcode ID: bbd5723521c4338b971aec1d90824913ded98b824ed5b6ff009ef995beb95b12
Instruction ID: 22f0cd8007abc6ae17bcfee7f7f34f525c5ca14dec3df2f8543c6bfe18f9246c
Opcode Fuzzy Hash: bbd5723521c4338b971aec1d90824913ded98b824ed5b6ff009ef995beb95b12
Instruction Fuzzy Hash: 1D0152B6504246BBE300EE58DC41DEB77ECAFD8648F484A1DFA9483211F730E509CBA2

Function 1E7A1FC0 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 50COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,lO:AddAccessDeniedAce,?,?), ref: 1E7A1FDF
PyErr_Clear.PYTHON27 ref: 1E7A201D
PyArg_ParseTuple.PYTHON27(?,llO:AddAccessDeniedAce,?,?,?), ref: 1E7A2038

Part of subcall function 1E7A1DC0: PyErr_Format.PYTHON27(?,%s not supported by this version of Windows,?,6D071680,?,?,1E7A1F84,775FF170,AddAccesAllowedAce,?,?,?,?), ref: 1E7A1DE5

Strings

llO:AddAccessDeniedAce, xrefs: 1E7A2032
AddAccesDeniedAce, xrefs: 1E7A2009
lO:AddAccessDeniedAce, xrefs: 1E7A1FD9

Memory Dump Source

Source File: 00000011.00000002.1561923280.000000001E7A1000.00000040.00000001.01000000.00000012.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000011.00000002.1561891626.000000001E7A0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7B9000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7BE000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562197228.000000001E7C0000.00000080.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562233172.000000001E7C2000.00000004.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e7a0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_Err_ParseTuple$ClearFormat
String ID: AddAccesDeniedAce$lO:AddAccessDeniedAce$llO:AddAccessDeniedAce
API String ID: 1510928575-45297876
Opcode ID: 467fc6351f60dd3b24c835575a2581c75a0a42df007bde8ab6291a3e9a98f7a4
Instruction ID: 46de305ba21667a810e6f12e26549760d6ee3b05b5f5e83b573ca7e8065276f4
Opcode Fuzzy Hash: 467fc6351f60dd3b24c835575a2581c75a0a42df007bde8ab6291a3e9a98f7a4
Instruction Fuzzy Hash: A7011EB6604256BBE300EA58DC45DEB77ECEFD8244F494A1DFA8483211F770E509CBA2

Function 034168D1 Relevance: 10.5, APIs: 7, Instructions: 45threadsynchronizationinjectionCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,00000000,Function_00006880,00000000,00000000,00000000), ref: 034168E8
SetEvent.KERNEL32(00000000), ref: 03416905
WaitForSingleObject.KERNEL32(00000000,00000064), ref: 0341691A
SuspendThread.KERNEL32(00000000), ref: 0341692D
TerminateThread.KERNEL32(00000000,00000001), ref: 0341693B
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 0341694A
CloseHandle.KERNEL32(00000000), ref: 03416953

Memory Dump Source

Source File: 00000011.00000002.1560676867.0000000003411000.00000040.00000001.01000000.0000000F.sdmp, Offset: 03410000, based on PE: true

Associated: 00000011.00000002.1560637646.0000000003410000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560676867.000000000341B000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560676867.000000000341F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560836323.0000000003423000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_3410000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Thread$ObjectSingleWait$CloseCreateEventHandleSuspendTerminate
String ID:
API String ID: 4123217685-0
Opcode ID: 9c9f7e3e788f03b6955063937b248b0596879aba9a8bbdb81b1b59ce8ee6f0fb
Instruction ID: 7d04714517543b525f68f7ea4c5a9c4f5602d165afe479b97db0e6bfa5923275
Opcode Fuzzy Hash: 9c9f7e3e788f03b6955063937b248b0596879aba9a8bbdb81b1b59ce8ee6f0fb
Instruction Fuzzy Hash: BD0152B5B00B00AFD610BF28EC59B563BE9A74E710F158126FA11FF298C7F49404CBA5

Function 034168D0 Relevance: 10.5, APIs: 7, Instructions: 45threadsynchronizationinjectionCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,00000000,Function_00006880,00000000,00000000,00000000), ref: 034168E8
SetEvent.KERNEL32(00000000), ref: 03416905
WaitForSingleObject.KERNEL32(00000000,00000064), ref: 0341691A
SuspendThread.KERNEL32(00000000), ref: 0341692D
TerminateThread.KERNEL32(00000000,00000001), ref: 0341693B
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 0341694A
CloseHandle.KERNEL32(00000000), ref: 03416953

Memory Dump Source

Source File: 00000011.00000002.1560676867.0000000003411000.00000040.00000001.01000000.0000000F.sdmp, Offset: 03410000, based on PE: true

Associated: 00000011.00000002.1560637646.0000000003410000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560676867.000000000341B000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560676867.000000000341F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560836323.0000000003423000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_3410000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Thread$ObjectSingleWait$CloseCreateEventHandleSuspendTerminate
String ID:
API String ID: 4123217685-0
Opcode ID: 69283e8dce2acf8aeed659680a0902f583ffed900542bf776a2c8ff49638cbee
Instruction ID: 97d80a9b279027548062f252494959290482dd0314c399e83b2ed229a38a9963
Opcode Fuzzy Hash: 69283e8dce2acf8aeed659680a0902f583ffed900542bf776a2c8ff49638cbee
Instruction Fuzzy Hash: 800152B5B00B00AFD610BF28EC58F1637E9A74D711F158125FA21BF298C7F49444CBA1

Function 1E8CA0D0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 41COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,Oi:EndUpdateResource,?,?), ref: 1E8CA0E7
?PyWinObject_AsHANDLE@@YAHPAU_object@@PAPAX@Z.PYWINTYPES27(?,?), ref: 1E8CA103
EndUpdateResourceA.KERNEL32(?,?), ref: 1E8CA11A
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(EndUpdateResource,00000000), ref: 1E8CA12A

Strings

Oi:EndUpdateResource, xrefs: 1E8CA0E1
EndUpdateResource, xrefs: 1E8CA125

Memory Dump Source

Source File: 00000011.00000002.1562490344.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 00000011.00000002.1562469835.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562702731.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562730939.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: U_object@@$Arg_Error@@Object_ParseResourceTupleUpdateWin_
String ID: EndUpdateResource$Oi:EndUpdateResource
API String ID: 4121047371-1734625141
Opcode ID: c75c927be0fba14724fb0a0c494349b171f8eb2223558daf36e9fcdac5c91e02
Instruction ID: 105fb289bed03b331dd796e16fa62cab99200bf520088ebde34c660d0d9d8d3b
Opcode Fuzzy Hash: c75c927be0fba14724fb0a0c494349b171f8eb2223558daf36e9fcdac5c91e02
Instruction Fuzzy Hash: D0F0A478500202AFE700CB78DD899EB77E8FF85645F804528FD4EC3200E735DA98CA52

Function 1E8C1220 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 41COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,iO:SetStdHandle,?), ref: 1E8C1236
?PyWinObject_AsHANDLE@@YAHPAU_object@@PAPAX@Z.PYWINTYPES27(?,?), ref: 1E8C1252
SetStdHandle.KERNEL32(?,?), ref: 1E8C1269
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(SetStdHandle,00000000), ref: 1E8C1279

Strings

SetStdHandle, xrefs: 1E8C1274
iO:SetStdHandle, xrefs: 1E8C1230

Memory Dump Source

Source File: 00000011.00000002.1562490344.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 00000011.00000002.1562469835.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562702731.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562730939.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: U_object@@$Arg_Error@@HandleObject_ParseTupleWin_
String ID: SetStdHandle$iO:SetStdHandle
API String ID: 1363360364-96720624
Opcode ID: bcc7c0d22d117de4c8cb3bee34273880fa43975de0644e5ee1b5d1d81e712dc7
Instruction ID: 443a8c45348a6dd5a8db6d8d0ee51aada99b43da59f2574c7ea3b886bc8aa48c
Opcode Fuzzy Hash: bcc7c0d22d117de4c8cb3bee34273880fa43975de0644e5ee1b5d1d81e712dc7
Instruction Fuzzy Hash: E5F03CB8504201AFE700DB74DDC9DAA33F8BB85645F448918FD4DC3200F635DA99DAA2

Function 03417220 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 40serviceCOMMON

Download Yara Rule

APIs

OpenSCManagerA.ADVAPI32(00000000,00000000,?), ref: 0341722A
OpenServiceA.ADVAPI32(00000000,?,?), ref: 03417253
CloseServiceHandle.ADVAPI32(00000000), ref: 0341726D

Part of subcall function 03411090: GetLastError.KERNEL32 ref: 034110B2
Part of subcall function 03411090: PyErr_SetFromWindowsErrWithFilename.PYTHON27(00000000), ref: 034110B9

Strings

OpenSCManager, xrefs: 03417236
OpenService, xrefs: 0341725F

Memory Dump Source

Source File: 00000011.00000002.1560676867.0000000003411000.00000040.00000001.01000000.0000000F.sdmp, Offset: 03410000, based on PE: true

Associated: 00000011.00000002.1560637646.0000000003410000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560676867.000000000341B000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560676867.000000000341F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560836323.0000000003423000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_3410000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: OpenService$CloseErr_ErrorFilenameFromHandleLastManagerWindowsWith
String ID: OpenSCManager$OpenService
API String ID: 4042265537-1214084076
Opcode ID: c335269aafeb9507ef5b3dfc1629e0af88aa5946e3d81fd13410dc49bf77e05e
Instruction ID: 37adb9fd8f410d344e85d08d5a9d44fa9ce28beaa559a6744da0da75173a2ac0
Opcode Fuzzy Hash: c335269aafeb9507ef5b3dfc1629e0af88aa5946e3d81fd13410dc49bf77e05e
Instruction Fuzzy Hash: BEF0B47AA45E206FD611F775FC19FAF6FA8EBC4261F040026F905DE204EB20D91285E6

Function 1E8C99F0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 37timeCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,O:SetLocalTime), ref: 1E8C9A01
?PyWinObject_AsSYSTEMTIME@@YAHPAU_object@@PAU_SYSTEMTIME@@@Z.PYWINTYPES27(00000000,?), ref: 1E8C9A1D
SetLocalTime.KERNEL32(?), ref: 1E8C9A2F
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(SetLocalTime,00000000), ref: 1E8C9A3F

Strings

O:SetLocalTime, xrefs: 1E8C99FB
SetLocalTime, xrefs: 1E8C9A3A

Memory Dump Source

Source File: 00000011.00000002.1562490344.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 00000011.00000002.1562469835.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562702731.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562730939.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: U_object@@$Arg_E@@@Error@@LocalObject_ParseTimeTupleWin_
String ID: O:SetLocalTime$SetLocalTime
API String ID: 1291033024-2636629638
Opcode ID: 0180f5b66fde7ff7e5c118e077179e95732af4910b424f852f13321b630858b8
Instruction ID: 78caf500052a1c90a272530612c34794933576fa06f95cc288bb2ec09b89f863
Opcode Fuzzy Hash: 0180f5b66fde7ff7e5c118e077179e95732af4910b424f852f13321b630858b8
Instruction Fuzzy Hash: 78F090B4510201AFE704EB78CD888DB37E8BF81605F8445A8F80EC3212F635D668CB66

Function 1E7A7390 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36COMMON

Download Yara Rule

APIs

IsValidSid.ADVAPI32(?), ref: 1E7A7399
PyErr_SetString.PYTHON27(?,GetSidIdentifierAuthority: Invalid SID in object), ref: 1E7A73B0
GetSidIdentifierAuthority.ADVAPI32(?), ref: 1E7A73C1
Py_BuildValue.PYTHON27((BBBBBB),?,?,?,?,?,?), ref: 1E7A73E9

Strings

(BBBBBB), xrefs: 1E7A73E4
GetSidIdentifierAuthority: Invalid SID in object, xrefs: 1E7A73AA

Memory Dump Source

Source File: 00000011.00000002.1561923280.000000001E7A1000.00000040.00000001.01000000.00000012.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000011.00000002.1561891626.000000001E7A0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7B9000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7BE000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562197228.000000001E7C0000.00000080.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562233172.000000001E7C2000.00000004.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e7a0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: AuthorityBuildErr_IdentifierStringValidValue
String ID: (BBBBBB)$GetSidIdentifierAuthority: Invalid SID in object
API String ID: 4045288465-3761804006
Opcode ID: cec292d7eb4ecf5f3e5984fe76aa5cee9fbf2e8986fc4ba528effe0d474b7665
Instruction ID: d7919b7b6e3c6315f71cde707b081f753a377a013c802aea03a92098d945fdaf
Opcode Fuzzy Hash: cec292d7eb4ecf5f3e5984fe76aa5cee9fbf2e8986fc4ba528effe0d474b7665
Instruction Fuzzy Hash: E2F04FA51181A0AFE2059BA5A858C63BFED9ECD20530E8589FA9587266D128D510DB30

Function 1E8C17D0 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,O:DragFinish), ref: 1E8C17E1
?PyWinObject_AsHANDLE@@YAHPAU_object@@PAPAX@Z.PYWINTYPES27(00000000,?), ref: 1E8C17FD
PyEval_SaveThread.PYTHON27 ref: 1E8C180B
DragFinish.SHELL32(?), ref: 1E8C1818
PyEval_RestoreThread.PYTHON27(00000000), ref: 1E8C181F

Strings

O:DragFinish, xrefs: 1E8C17DB

Memory Dump Source

Source File: 00000011.00000002.1562490344.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 00000011.00000002.1562469835.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562702731.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562730939.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Eval_Thread$Arg_DragFinishObject_ParseRestoreSaveTupleU_object@@
String ID: O:DragFinish
API String ID: 667219122-2115251260
Opcode ID: 0e11a7cf812275f29d55ad1cb8714dc204b154e14af910ddceacc48ef915f7e3
Instruction ID: 1f616337184f3ce4f81639ad99c817622e22938b799c1965db2bbfffb8e7dcae
Opcode Fuzzy Hash: 0e11a7cf812275f29d55ad1cb8714dc204b154e14af910ddceacc48ef915f7e3
Instruction Fuzzy Hash: EEF03074510211AFE700EBB8DDCC8DA77F8BF86246F444928F84DC3215E735D699CAA6

Function 1E8C8DC0 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 35threadCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27 ref: 1E8C8DDE
PyEval_SaveThread.PYTHON27 ref: 1E8C8DF1
SleepEx.KERNEL32(?,?), ref: 1E8C8E03
PyEval_RestoreThread.PYTHON27(00000000), ref: 1E8C8E0C
Py_BuildValue.PYTHON27(1E8D16C8,00000000), ref: 1E8C8E18

Strings

i|i:Sleep, xrefs: 1E8C8DD0

Memory Dump Source

Source File: 00000011.00000002.1562490344.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 00000011.00000002.1562469835.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562702731.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562730939.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Eval_Thread$Arg_BuildParseRestoreSaveSleepTupleValue
String ID: i|i:Sleep
API String ID: 158943565-1579782342
Opcode ID: e45b8054deaec5112eab14cf63731a11efcd6a200fad6705fafbfa5a9dbeb54a
Instruction ID: d806c01f9865846d43ef39b987b8fbf1501cc82d24ae86c9a836417681d55fb3
Opcode Fuzzy Hash: e45b8054deaec5112eab14cf63731a11efcd6a200fad6705fafbfa5a9dbeb54a
Instruction Fuzzy Hash: 37F06775500211AFE300AB68EC8C9DB7BE8EFC6206F448A19F94DC3210E7308549CBA2

Function 1E7A7E10 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 33timeCOMMON

Download Yara Rule

APIs

VariantTimeToSystemTime.OLEAUT32 ref: 1E7A7E20
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(VariantTimeToSystemTime,00000000), ref: 1E7A7E30

Part of subcall function 1E7A9F20: GetLastError.KERNEL32(00000000,?,1E7A5F68,MakeSelfRelativeSD,00000000), ref: 1E7A9F2A
Part of subcall function 1E7A9F20: ?PyWin_GetErrorMessageModule@@YAPAUHINSTANCE__@@K@Z.PYWINTYPES27(00000000,00000000,?,1E7A5F68,MakeSelfRelativeSD,00000000), ref: 1E7A9F38
Part of subcall function 1E7A9F20: FormatMessageA.KERNEL32(00001300,00000000,00000000,00000000,?,00000000,00000000), ref: 1E7A9F69
Part of subcall function 1E7A9F20: ?PyWinObject_FromTCHAR@@YAPAU_object@@PBDH@Z.PYWINTYPES27(No error message is available,000000FF,?,?,?,?,?,?,?,?,?,?,00000000), ref: 1E7A9FC7
Part of subcall function 1E7A9F20: ?PyWinCoreString_FromString@@YAPAU_object@@PBDH@Z.PYWINTYPES27(?,000000FF,00000000,?,73BB3D3F), ref: 1E7A9FD7
Part of subcall function 1E7A9F20: Py_BuildValue.PYTHON27((iNN),00000000,00000000,?,00000000,?,73BB3D3F), ref: 1E7A9FE6
Part of subcall function 1E7A9F20: LocalFree.KERNEL32(?), ref: 1E7A9FFF
Part of subcall function 1E7A9F20: PyErr_SetObject.PYTHON27(031BEB40,00000000), ref: 1E7AA010

SystemTimeToFileTime.KERNEL32(?,?), ref: 1E7A7E4A
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(SystemTimeToFileTime,00000000), ref: 1E7A7E5A

Strings

SystemTimeToFileTime, xrefs: 1E7A7E55
VariantTimeToSystemTime, xrefs: 1E7A7E2B

Memory Dump Source

Source File: 00000011.00000002.1561923280.000000001E7A1000.00000040.00000001.01000000.00000012.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000011.00000002.1561891626.000000001E7A0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7B9000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7BE000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562197228.000000001E7C0000.00000080.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562233172.000000001E7C2000.00000004.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e7a0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: TimeU_object@@$Win_$ErrorError@@FromMessageSystem$BuildCoreE__@@Err_FileFormatFreeLastLocalModule@@ObjectObject_String@@String_ValueVariant
String ID: SystemTimeToFileTime$VariantTimeToSystemTime
API String ID: 934721868-2203997993
Opcode ID: 647fcc6a78f94493d9b8faee3e143f28f934e57bee1462480c98f52f151eb49c
Instruction ID: dd953f5dd9d58e8322515d91941214e58708e7a00023c4a248e21ce2019c5af3
Opcode Fuzzy Hash: 647fcc6a78f94493d9b8faee3e143f28f934e57bee1462480c98f52f151eb49c
Instruction Fuzzy Hash: 93F0A7BA92405197F300BB74EC4A967B29DEBE4305F8C4E78FA45C0215F632D628C6B3

Function 1E8C2AB0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 32COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,:GetComputerName), ref: 1E8C2ABD
GetComputerNameA.KERNEL32 ref: 1E8C2ADF
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(GetComputerName,00000000), ref: 1E8C2AEF

Strings

GetComputerName, xrefs: 1E8C2AEA
:GetComputerName, xrefs: 1E8C2AB7

Memory Dump Source

Source File: 00000011.00000002.1562490344.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 00000011.00000002.1562469835.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562702731.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562730939.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_ComputerError@@NameParseTupleU_object@@Win_
String ID: :GetComputerName$GetComputerName
API String ID: 4196016030-2709991892
Opcode ID: 0512f74f21b52b107b490ffa1c8e8b1009e0f943d950b31e8499fc6513ce866d
Instruction ID: b12b74aac5da509e22ea5d8a420b9a0cbf235df85fc4c94a6cb621774333b325
Opcode Fuzzy Hash: 0512f74f21b52b107b490ffa1c8e8b1009e0f943d950b31e8499fc6513ce866d
Instruction Fuzzy Hash: 7CF0E2F1800202ABD700AB68CC889CB7BE8BF81645F84451CF84EC3221F731C2988A77

Function 1E8C3990 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 31COMMON

Download Yara Rule

APIs

PyErr_Format.PYTHON27(?,%s is not available on this platform,GetLastInputInfo), ref: 1E8C39AE
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(GetLastInputInfo,00000000), ref: 1E8C39D3

Strings

GetLastInputInfo, xrefs: 1E8C39CE
%s is not available on this platform, xrefs: 1E8C39A8
GetLastInputInfo, xrefs: 1E8C39A3

Memory Dump Source

Source File: 00000011.00000002.1562490344.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 00000011.00000002.1562469835.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562702731.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562730939.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Err_Error@@FormatU_object@@Win_
String ID: %s is not available on this platform$GetLastInputInfo$GetLastInputInfo
API String ID: 1771588633-2589227319
Opcode ID: 30dc0b3051989705708709633c8e8a7417d6f92dda299da89081135bda25bf6f
Instruction ID: 11e889900d90880b94c597949818924ac2dc31b5944f260e088313a4b06ab924
Opcode Fuzzy Hash: 30dc0b3051989705708709633c8e8a7417d6f92dda299da89081135bda25bf6f
Instruction Fuzzy Hash: 11F0A7F18002007FD700A769DC89A8933E5BB82645F444524F84DC3300F635DA6DC667

Function 1E8C3680 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 30threadkeyboardCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,i:GetKeyState), ref: 1E8C368F
PyEval_SaveThread.PYTHON27 ref: 1E8C36A0
GetKeyState.USER32(?), ref: 1E8C36AD
PyEval_RestoreThread.PYTHON27(00000000), ref: 1E8C36B7
Py_BuildValue.PYTHON27(1E8CFF44), ref: 1E8C36C3

Strings

i:GetKeyState, xrefs: 1E8C3689

Memory Dump Source

Source File: 00000011.00000002.1562490344.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 00000011.00000002.1562469835.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562702731.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562730939.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Eval_Thread$Arg_BuildParseRestoreSaveStateTupleValue
String ID: i:GetKeyState
API String ID: 3560425627-953873090
Opcode ID: 874e11f6e6752b7958fa547267b63b222e8cbb90394d792a0352820dd353ef5f
Instruction ID: c7eed590ed3c1a63b1348e3e07fda079a8f11cc75afad1236c05f9476bc24966
Opcode Fuzzy Hash: 874e11f6e6752b7958fa547267b63b222e8cbb90394d792a0352820dd353ef5f
Instruction Fuzzy Hash: 1FE039765142217FE61457A5DC8CCDB3BE8EFCA216B10811DF94AC3220DA3081968765

Function 1E8C8BE0 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 30threadCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,i:ShowCursor), ref: 1E8C8BEF
PyEval_SaveThread.PYTHON27 ref: 1E8C8C00
ShowCursor.USER32(?), ref: 1E8C8C0D
PyEval_RestoreThread.PYTHON27(00000000), ref: 1E8C8C16
Py_BuildValue.PYTHON27(1E8D1694,00000000), ref: 1E8C8C22

Strings

i:ShowCursor, xrefs: 1E8C8BE9

Memory Dump Source

Source File: 00000011.00000002.1562490344.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 00000011.00000002.1562469835.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562702731.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562730939.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Eval_Thread$Arg_BuildCursorParseRestoreSaveShowTupleValue
String ID: i:ShowCursor
API String ID: 4093611133-3798339376
Opcode ID: 7171d54dc319324140084b959139bf1e9a4544ddf6d43ad1b62c5c3874224bdd
Instruction ID: d1b4b877a176d9f56fada2f030214ed3f2f62531e52fbd83decd2445a943bbd5
Opcode Fuzzy Hash: 7171d54dc319324140084b959139bf1e9a4544ddf6d43ad1b62c5c3874224bdd
Instruction Fuzzy Hash: F2E039761002217FD71057B9EC8CCDB7BE8EECA266B148529F90AC3221EB3084968B65

Function 1E8C3570 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 30threadkeyboardCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,i:GetAsyncKeyState), ref: 1E8C357F
PyEval_SaveThread.PYTHON27 ref: 1E8C3590
GetAsyncKeyState.USER32(?), ref: 1E8C359D
PyEval_RestoreThread.PYTHON27(00000000), ref: 1E8C35A7
Py_BuildValue.PYTHON27(1E8CFEDC), ref: 1E8C35B3

Strings

i:GetAsyncKeyState, xrefs: 1E8C3579

Memory Dump Source

Source File: 00000011.00000002.1562490344.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 00000011.00000002.1562469835.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562702731.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562730939.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Eval_Thread$Arg_AsyncBuildParseRestoreSaveStateTupleValue
String ID: i:GetAsyncKeyState
API String ID: 225494149-464828283
Opcode ID: 7bf8ce1668fb437a7aa60a6e5318454d186a6168a3ceef1f3851bb61a39043fc
Instruction ID: 00b5126a7c1e8670ffaa280926f471f816529a0ceb3f743f59c23d9ccfb7e73d
Opcode Fuzzy Hash: 7bf8ce1668fb437a7aa60a6e5318454d186a6168a3ceef1f3851bb61a39043fc
Instruction Fuzzy Hash: 13E06D765101217FE6145BA9DC8CCDB7BE8EFC6256B10821DF90EC7321D7308192CB62

Function 1E8C8B90 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 29threadCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,i:SetErrorMode), ref: 1E8C8B9F
PyEval_SaveThread.PYTHON27 ref: 1E8C8BB0
SetErrorMode.KERNEL32(?), ref: 1E8C8BBD
PyEval_RestoreThread.PYTHON27(00000000), ref: 1E8C8BC6
PyInt_FromLong.PYTHON27(00000000), ref: 1E8C8BCD

Strings

i:SetErrorMode, xrefs: 1E8C8B99

Memory Dump Source

Source File: 00000011.00000002.1562490344.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 00000011.00000002.1562469835.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562702731.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562730939.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Eval_Thread$Arg_ErrorFromInt_LongModeParseRestoreSaveTuple
String ID: i:SetErrorMode
API String ID: 3074247271-911818189
Opcode ID: e8150a1bf50b264aaa9479065a1ce7d985660c5c45fffff7373d61ca7f34cb14
Instruction ID: ee51321ec7a789ff2f4fde8a5302c4e441ec70b123c31863b561e08171481dba
Opcode Fuzzy Hash: e8150a1bf50b264aaa9479065a1ce7d985660c5c45fffff7373d61ca7f34cb14
Instruction Fuzzy Hash: E4E06DB21101207FD70057B5DC8C8EA77ECEFC6266F14852DF90EC3211DB3484968761

Function 1E8C5CE0 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 27threadCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,:GetWindowsDirectory), ref: 1E8C5CF0
PyEval_SaveThread.PYTHON27 ref: 1E8C5D05
GetWindowsDirectoryA.KERNEL32(00000104,00000104), ref: 1E8C5D17
PyEval_RestoreThread.PYTHON27(00000000), ref: 1E8C5D1E
?PyWinObject_FromTCHAR@@YAPAU_object@@PBDH@Z.PYWINTYPES27(?,000000FF), ref: 1E8C5D2B

Strings

:GetWindowsDirectory, xrefs: 1E8C5CEA

Memory Dump Source

Source File: 00000011.00000002.1562490344.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 00000011.00000002.1562469835.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562702731.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562730939.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Eval_Thread$Arg_DirectoryFromObject_ParseRestoreSaveTupleU_object@@Windows
String ID: :GetWindowsDirectory
API String ID: 3009372331-2340468556
Opcode ID: 962b626807ba67fc9742cbf347db58deebb524eff57d2dd19d7f6918ebe6386b
Instruction ID: 80df3d3ee1bcda18ef9ed22107583096ea1c938076e7ca8d19921f139c096ae0
Opcode Fuzzy Hash: 962b626807ba67fc9742cbf347db58deebb524eff57d2dd19d7f6918ebe6386b
Instruction Fuzzy Hash: 21E0E5B58002227FE7009778DCCC9CA3AA4AF81316F404614F65D871B0EA7882D9C796

Function 1E8CACF0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 27COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,:GetKeyboardLayoutName), ref: 1E8CACFD
GetKeyboardLayoutNameW.USER32 ref: 1E8CAD12
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(GetKeyboardLayoutNameW,00000000), ref: 1E8CAD22

Strings

:GetKeyboardLayoutName, xrefs: 1E8CACF7
GetKeyboardLayoutNameW, xrefs: 1E8CAD1D

Memory Dump Source

Source File: 00000011.00000002.1562490344.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 00000011.00000002.1562469835.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562702731.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562730939.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_Error@@KeyboardLayoutNameParseTupleU_object@@Win_
String ID: :GetKeyboardLayoutName$GetKeyboardLayoutNameW
API String ID: 364696899-3230485078
Opcode ID: fc9aecbdca34ad702312586820e69376db179222d8f3ceeedb0db3e0a29f3a1c
Instruction ID: 6551c84cbeb5ac7c60092215621d62be4356671e5b7074631baa72feb50c3108
Opcode Fuzzy Hash: fc9aecbdca34ad702312586820e69376db179222d8f3ceeedb0db3e0a29f3a1c
Instruction Fuzzy Hash: DAE092F58102026BD60477388C8D88B36A4BE8150AFC905A8F94BC2226FA29C26C85B7

Function 1E8C57E0 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 27threadCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,:GetSystemDirectory), ref: 1E8C57F0
PyEval_SaveThread.PYTHON27 ref: 1E8C5805
GetSystemDirectoryA.KERNEL32(00000105,00000105), ref: 1E8C5817
PyEval_RestoreThread.PYTHON27(00000000), ref: 1E8C581E
?PyWinObject_FromTCHAR@@YAPAU_object@@PBDH@Z.PYWINTYPES27(?,000000FF), ref: 1E8C582B

Strings

:GetSystemDirectory, xrefs: 1E8C57EA

Memory Dump Source

Source File: 00000011.00000002.1562490344.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 00000011.00000002.1562469835.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562702731.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562730939.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Eval_Thread$Arg_DirectoryFromObject_ParseRestoreSaveSystemTupleU_object@@
String ID: :GetSystemDirectory
API String ID: 3789406084-2580655871
Opcode ID: 5445fa0cc5344d84b2cd859abc1ced15b19ef7d755deb2825023aba21ded5b36
Instruction ID: 511e617184639e132d85474616b77c0220cadbf2a311004c9eeb9119a603c5c8
Opcode Fuzzy Hash: 5445fa0cc5344d84b2cd859abc1ced15b19ef7d755deb2825023aba21ded5b36
Instruction Fuzzy Hash: 12E02B718042227FEB006778DC8C9CF3BA4AF81315F804614F59D831E0EB3881D9C796

Function 1E8C4EE0 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 23threadCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,:PyGetTickCount), ref: 1E8C4EEA
PyEval_SaveThread.PYTHON27 ref: 1E8C4EFA
GetTickCount.KERNEL32 ref: 1E8C4F02
PyEval_RestoreThread.PYTHON27(00000000), ref: 1E8C4F0B
Py_BuildValue.PYTHON27(1E8D0690,00000000), ref: 1E8C4F17

Strings

:PyGetTickCount, xrefs: 1E8C4EE4

Memory Dump Source

Source File: 00000011.00000002.1562490344.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 00000011.00000002.1562469835.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562702731.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562730939.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Eval_Thread$Arg_BuildCountParseRestoreSaveTickTupleValue
String ID: :PyGetTickCount
API String ID: 207086270-1183235398
Opcode ID: 16d0a5e4fd5531d6aa4d6a20d699ea7a28c6c1b47eda18dcf371e9492d44e105
Instruction ID: 7f1c4792ac6b9497bc45939c13e58b1da6aa85e37699b29b9bcee2c5673bb308
Opcode Fuzzy Hash: 16d0a5e4fd5531d6aa4d6a20d699ea7a28c6c1b47eda18dcf371e9492d44e105
Instruction Fuzzy Hash: F5E0BF3A5002217FE7101BB9AD4C8CA3AE9AFC6256B454514F50DC3210D62485969665

Function 1E8CB210 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 22COMMON

Download Yara Rule

APIs

PyLong_FromUnsignedLong.PYTHON27(?), ref: 1E8CB220
PyLong_FromUnsignedLong.PYTHON27(?,Capacity,00000000), ref: 1E8CB22E
Py_BuildValue.PYTHON27({s:N, s:N},Granularity,00000000,00000000), ref: 1E8CB23E

Strings

Capacity, xrefs: 1E8CB228
{s:N, s:N}, xrefs: 1E8CB239
Granularity, xrefs: 1E8CB234

Memory Dump Source

Source File: 00000011.00000002.1562490344.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 00000011.00000002.1562469835.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562702731.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562730939.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: FromLongLong_Unsigned$BuildValue
String ID: Capacity$Granularity${s:N, s:N}
API String ID: 760731585-1405704946
Opcode ID: 586267e8c9b8772deba39f19741fab5c17f1dc5479e567312a588fe7ac6d2544
Instruction ID: ecca7d0d8e1495485ea0b8364f649f29c85f9f25947dd19e7063274423bad656
Opcode Fuzzy Hash: 586267e8c9b8772deba39f19741fab5c17f1dc5479e567312a588fe7ac6d2544
Instruction Fuzzy Hash: 35E012B55002107FE5046B6DEC44CD7B39CAE85935B064529F989A3320D561E9558AB2

Function 1E7A1C80 Relevance: 10.5, APIs: 1, Strings: 5, Instructions: 21COMMON

Download Yara Rule

APIs

Py_BuildValue.PYTHON27({s:l,s:l,s:l,s:N},AccessPermissions,00000000,AccessMode,?,Inheritance,?,Trustee,00000000,?), ref: 1E7A1CB3

Strings

Inheritance, xrefs: 1E7A1C9D
{s:l,s:l,s:l,s:N}, xrefs: 1E7A1CAE
Trustee, xrefs: 1E7A1C97
AccessMode, xrefs: 1E7A1CA3
AccessPermissions, xrefs: 1E7A1CA9

Memory Dump Source

Source File: 00000011.00000002.1561923280.000000001E7A1000.00000040.00000001.01000000.00000012.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000011.00000002.1561891626.000000001E7A0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7B9000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7BE000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562197228.000000001E7C0000.00000080.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562233172.000000001E7C2000.00000004.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e7a0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: BuildValue
String ID: AccessMode$AccessPermissions$Inheritance$Trustee${s:l,s:l,s:l,s:N}
API String ID: 3383912721-738551721
Opcode ID: 5a68f0335fcf1f4b7d90955cabee018b32cf1474b5c979d2dd32ecf681b0515a
Instruction ID: c82e2407a718cda2c452ebf11e3a7213119d6916032330c42638df7a64402765
Opcode Fuzzy Hash: 5a68f0335fcf1f4b7d90955cabee018b32cf1474b5c979d2dd32ecf681b0515a
Instruction Fuzzy Hash: 8DE0ECB5100115BFB614CB48DC85CD3B3EDDBC871CB088B19BB9A93321D660BC84CBA4

Function 1E7D25D0 Relevance: 9.1, APIs: 6, Instructions: 102COMMON

Download Yara Rule

APIs

PyTuple_New.PYTHON27(?,00000000,00000000,1E7D2A10,?,?), ref: 1E7D25EC

Part of subcall function 1E7D2000: PyErr_Occurred.PYTHON27(776004E0,?,?,?,?,?,?,1E7D2B38,C0000003), ref: 1E7D2004
Part of subcall function 1E7D2000: PyErr_Fetch.PYTHON27(?,?,?,00000000,00000000,?,?,?,?,?,?,1E7D2B38,C0000003), ref: 1E7D2035
Part of subcall function 1E7D2000: ?GetPythonTraceback@@YAPADPAU_object@@00@Z.PYWINTYPES27 ref: 1E7D2054
Part of subcall function 1E7D2000: MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000002,00000000,00000002,?,?,?,?,?,?,?), ref: 1E7D2090
Part of subcall function 1E7D2000: 73BB3B4E.MSVCR90(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,1E7D2B38,C0000003), ref: 1E7D20A3
Part of subcall function 1E7D2000: 73BB3B4E.MSVCR90(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,1E7D2B38), ref: 1E7D20CD
Part of subcall function 1E7D2000: PyErr_Restore.PYTHON27(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,1E7D2B38), ref: 1E7D20F0

Memory Dump Source

Source File: 00000011.00000002.1562321143.000000001E7D1000.00000040.00000001.01000000.00000015.sdmp, Offset: 1E7D0000, based on PE: true

Associated: 00000011.00000002.1562293036.000000001E7D0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000011.00000002.1562321143.000000001E7DA000.00000040.00000001.01000000.00000015.sdmpDownload File
Associated: 00000011.00000002.1562391495.000000001E7DB000.00000080.00000001.01000000.00000015.sdmpDownload File
Associated: 00000011.00000002.1562417397.000000001E7DD000.00000004.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e7d0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Err_$ByteCharFetchMultiOccurredPythonRestoreTraceback@@Tuple_U_object@@00@Wide
String ID:
API String ID: 2813028372-0
Opcode ID: 7373bfe208acb559bd7bd61f0dfc6b3ccb59c34290f91cbda599b3b82ac85291
Instruction ID: eeaa5fe410aa8f6bb57b926c9732998bb83485d7342da4a4a61dd9611b0c1845
Opcode Fuzzy Hash: 7373bfe208acb559bd7bd61f0dfc6b3ccb59c34290f91cbda599b3b82ac85291
Instruction Fuzzy Hash: 3831E8B2A003515BF7009FA8FD44A8A7359BF84635F068734ED15D7665E732E80BCB92

Function 03413790 Relevance: 9.0, APIs: 6, Instructions: 50COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,0341B578), ref: 0341379F

Memory Dump Source

Source File: 00000011.00000002.1560676867.0000000003411000.00000040.00000001.01000000.0000000F.sdmp, Offset: 03410000, based on PE: true

Associated: 00000011.00000002.1560637646.0000000003410000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560676867.000000000341B000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560676867.000000000341F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560836323.0000000003423000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_3410000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_ParseTuple
String ID:
API String ID: 3371842430-0
Opcode ID: b7c19c7c228e579a78e57c63091bc156d6393542ebb36c111cee3c8a232df0ff
Instruction ID: aacee2de5496db17232ab52b2fc6cec680926b32758dc5b1e1a8e655da5f08a9
Opcode Fuzzy Hash: b7c19c7c228e579a78e57c63091bc156d6393542ebb36c111cee3c8a232df0ff
Instruction Fuzzy Hash: C4F028B66019106BD650BB65BC1CDCF77ECDFC1677B24452AFC47DE204DB20802186EA

Function 03413A70 Relevance: 9.0, APIs: 6, Instructions: 48COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,0341B5D4), ref: 03413A81
GetProcessAffinityMask.KERNEL32(00000000,?,?), ref: 03413AB5
PyErr_SetFromWindowsErr.PYTHON27(00000000), ref: 03413AC0
CloseHandle.KERNEL32(00000000), ref: 03413ACA

Memory Dump Source

Source File: 00000011.00000002.1560676867.0000000003411000.00000040.00000001.01000000.0000000F.sdmp, Offset: 03410000, based on PE: true

Associated: 00000011.00000002.1560637646.0000000003410000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560676867.000000000341B000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560676867.000000000341F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560836323.0000000003423000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_3410000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: AffinityArg_CloseErr_FromHandleMaskParseProcessTupleWindows
String ID:
API String ID: 1573772585-0
Opcode ID: 0bd39efdeae61d4e316894ba49d6d83a01b00ad6177ed3aca2a86a662234d25c
Instruction ID: d48af3de170b30803ab1d13051c837db069f7ae367c320e1503c428ea2c5280f
Opcode Fuzzy Hash: 0bd39efdeae61d4e316894ba49d6d83a01b00ad6177ed3aca2a86a662234d25c
Instruction Fuzzy Hash: E901F274900A006FD200EB64AC19AEF7BECEF44649F448529FC4AE9204F7359228C6EB

Function 1E7D1160 Relevance: 9.0, APIs: 6, Instructions: 47windowthreadCOMMON

Download Yara Rule

APIs

PyEval_SaveThread.PYTHON27 ref: 1E7D1168
PeekMessageW.USER32(00000000,00000000,00000000,00000000,00000001), ref: 1E7D1180
DispatchMessageW.USER32(?), ref: 1E7D119C
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 1E7D11AB
PyEval_RestoreThread.PYTHON27(00000000), ref: 1E7D11BA
PyInt_FromLong.PYTHON27(00000000), ref: 1E7D11C1

Memory Dump Source

Source File: 00000011.00000002.1562321143.000000001E7D1000.00000040.00000001.01000000.00000015.sdmp, Offset: 1E7D0000, based on PE: true

Associated: 00000011.00000002.1562293036.000000001E7D0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000011.00000002.1562321143.000000001E7DA000.00000040.00000001.01000000.00000015.sdmpDownload File
Associated: 00000011.00000002.1562391495.000000001E7DB000.00000080.00000001.01000000.00000015.sdmpDownload File
Associated: 00000011.00000002.1562417397.000000001E7DD000.00000004.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e7d0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Message$Eval_PeekThread$DispatchFromInt_LongRestoreSave
String ID:
API String ID: 657982229-0
Opcode ID: 4f6df83992706d05af043f1095cc6411094232bf5fd708fc8007b3c8b21bda32
Instruction ID: 79e05ceda1f12033598b73f50187700dec268c07c473ed28bbb07a70fed9b785
Opcode Fuzzy Hash: 4f6df83992706d05af043f1095cc6411094232bf5fd708fc8007b3c8b21bda32
Instruction Fuzzy Hash: 9BF0F43110031AABF300EAA4DDC5FA77B9CFB89740F800529FE0196081F667E9098BB1

Function 034148D0 Relevance: 9.0, APIs: 6, Instructions: 46COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,0341B7D8), ref: 034148E1
GetProcessHandleCount.KERNEL32(00000000,?), ref: 03414910
PyErr_SetFromWindowsErr.PYTHON27(00000000), ref: 0341491B
CloseHandle.KERNEL32(00000000), ref: 03414925

Memory Dump Source

Source File: 00000011.00000002.1560676867.0000000003411000.00000040.00000001.01000000.0000000F.sdmp, Offset: 03410000, based on PE: true

Associated: 00000011.00000002.1560637646.0000000003410000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560676867.000000000341B000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560676867.000000000341F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560836323.0000000003423000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_3410000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Handle$Arg_CloseCountErr_FromParseProcessTupleWindows
String ID:
API String ID: 375582320-0
Opcode ID: 95110f6bfa4dfa69915488445e69597d0f24fc8315d1fb1d08239b0f2df3566d
Instruction ID: 7ef0b024faa4d5513a03a6146f6494a4570a6d35526fb17b19bf7c72f25cc750
Opcode Fuzzy Hash: 95110f6bfa4dfa69915488445e69597d0f24fc8315d1fb1d08239b0f2df3566d
Instruction Fuzzy Hash: 91F0D135900A106FD610FB34AC5999B7BECAF45646F880829FC49E9304E7259568CAEB

Function 03414960 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 174COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,0341B7E0,?), ref: 03414979
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 03414A70

Strings

kkdddiKKKKKKkIIIIIIIII, xrefs: 03414B23

Memory Dump Source

Source File: 00000011.00000002.1560676867.0000000003411000.00000040.00000001.01000000.0000000F.sdmp, Offset: 03410000, based on PE: true

Associated: 00000011.00000002.1560637646.0000000003410000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560676867.000000000341B000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560676867.000000000341F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560836323.0000000003423000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_3410000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_ParseTupleUnothrow_t@std@@@__ehfuncinfo$??2@
String ID: kkdddiKKKKKKkIIIIIIIII
API String ID: 1811236384-3169003817
Opcode ID: 6faceaf59fdee77f6d8d2e6fc178774169f2665c0ec00be89bc70c65eba0d6ab
Instruction ID: f9b5dd87beb85df009aea1e9d1dc1627cae0cbd78333b2975c2f77e60f3be75b
Opcode Fuzzy Hash: 6faceaf59fdee77f6d8d2e6fc178774169f2665c0ec00be89bc70c65eba0d6ab
Instruction Fuzzy Hash: CC518CB2604B01AFD324DE69D980EA7B3F9FB88740F14890DF59AC7315E731A814CBA5

Function 1E7A96C0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 100COMMON

Download Yara Rule

APIs

?PyWinSequence_Tuple@@YAPAU_object@@PAU1@PAK@Z.PYWINTYPES27(?,?), ref: 1E7A96FF
PyErr_Format.PYTHON27(?,Unable to allocate %d bytes), ref: 1E7A973C

Strings

Unable to allocate %d bytes, xrefs: 1E7A9736

Memory Dump Source

Source File: 00000011.00000002.1561923280.000000001E7A1000.00000040.00000001.01000000.00000012.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000011.00000002.1561891626.000000001E7A0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7B9000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7BE000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562197228.000000001E7C0000.00000080.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562233172.000000001E7C2000.00000004.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e7a0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Err_FormatSequence_Tuple@@U_object@@
String ID: Unable to allocate %d bytes
API String ID: 1543589335-4174463691
Opcode ID: d0e8eacf44129ecc10919c1794ef6b6eaa1e32cb9ddee5808c2f8c3d58b881e1
Instruction ID: 502f4dc75cf1b314209e96e6d2c1fa99613c471ee25fd0d465ed71d49e91eb32
Opcode Fuzzy Hash: d0e8eacf44129ecc10919c1794ef6b6eaa1e32cb9ddee5808c2f8c3d58b881e1
Instruction Fuzzy Hash: 9F3190B95003119BF700CF14EC84BABB7A9EFC4315F184719EA054B350E775E864CBA2

Function 1E7A9570 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 100COMMON

Download Yara Rule

APIs

?PyWinSequence_Tuple@@YAPAU_object@@PAU1@PAK@Z.PYWINTYPES27(?,?), ref: 1E7A95AF
PyErr_Format.PYTHON27(?,Unable to allocate %d bytes), ref: 1E7A95EC

Strings

Unable to allocate %d bytes, xrefs: 1E7A95E6

Memory Dump Source

Source File: 00000011.00000002.1561923280.000000001E7A1000.00000040.00000001.01000000.00000012.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000011.00000002.1561891626.000000001E7A0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7B9000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7BE000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562197228.000000001E7C0000.00000080.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562233172.000000001E7C2000.00000004.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e7a0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Err_FormatSequence_Tuple@@U_object@@
String ID: Unable to allocate %d bytes
API String ID: 1543589335-4174463691
Opcode ID: 681418be127ffa6c53ca0d4aecc3749e7d385911e530dbb52c956eea3fec761c
Instruction ID: 5d19c7c7ef0a3e43b6323071edecda289ceb4ba1e8a65891708ef51e050d7ca3
Opcode Fuzzy Hash: 681418be127ffa6c53ca0d4aecc3749e7d385911e530dbb52c956eea3fec761c
Instruction Fuzzy Hash: E9318FB95003129BF700DF14EC84B5BB7A8EFC4314F184719EA454B295E771E965CBA2

Function 1E7A76A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 67COMMON

Download Yara Rule

APIs

Part of subcall function 1E7A7580: IsValidSid.ADVAPI32(?,?,?,1E7A76BD,?,?,?,00000000,?), ref: 1E7A7587

GetLastError.KERNEL32 ref: 1E7A76C0

Strings

PySID: Invalid SID, xrefs: 1E7A76CC
PySID:, xrefs: 1E7A76DA, 1E7A76F2, 1E7A770A, 1E7A771D, 1E7A7735

Memory Dump Source

Source File: 00000011.00000002.1561923280.000000001E7A1000.00000040.00000001.01000000.00000012.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000011.00000002.1561891626.000000001E7A0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7B9000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7BE000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562197228.000000001E7C0000.00000080.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562233172.000000001E7C2000.00000004.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e7a0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: ErrorLastValid
String ID: PySID:$PySID: Invalid SID
API String ID: 3587717397-2976353951
Opcode ID: f18dd9da2f5104390cb3125d8c96f2ea8e4d73bf68058a868b06e408b71de58a
Instruction ID: 9bb39448acdf562fe9648570bef67148e51199e6bb1486cf44013a8b0869382c
Opcode Fuzzy Hash: f18dd9da2f5104390cb3125d8c96f2ea8e4d73bf68058a868b06e408b71de58a
Instruction Fuzzy Hash: E811E635608251EFF2024B2CD858A9BFBDAAFC5354F1D8754F689C7235EA70D805CB91

Function 1E7A33A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 66COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON27(?,Attributes of PyDEVMODE can't be deleted), ref: 1E7A33B6
PyString_AsStringAndSize.PYTHON27(?,?,?), ref: 1E7A33CF
PyErr_Format.PYTHON27(00000000,FormName must be a string of length %d or less,00000020), ref: 1E7A33F6

Strings

FormName must be a string of length %d or less, xrefs: 1E7A33F0
Attributes of PyDEVMODE can't be deleted, xrefs: 1E7A33B0

Memory Dump Source

Source File: 00000011.00000002.1561923280.000000001E7A1000.00000040.00000001.01000000.00000012.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000011.00000002.1561891626.000000001E7A0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7B9000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7BE000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562197228.000000001E7C0000.00000080.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562233172.000000001E7C2000.00000004.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e7a0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Err_String$FormatSizeString_
String ID: Attributes of PyDEVMODE can't be deleted$FormName must be a string of length %d or less
API String ID: 301252844-1665263692
Opcode ID: 5788f44cd0015131cf61957f049737314424a777b4137c6783e9371fe053b4bd
Instruction ID: 9d0933375fba2d774f8241adf00576b0f83738936202cabb0702084604eb83e5
Opcode Fuzzy Hash: 5788f44cd0015131cf61957f049737314424a777b4137c6783e9371fe053b4bd
Instruction Fuzzy Hash: 69116DB1504211AFE708CF58D888C5ABBE9EFC8324B188B5DF119C73A1D770E855CB95

Function 1E7A32C0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 65COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON27(?,Attributes of PyDEVMODE can't be deleted), ref: 1E7A32D6
PyString_AsStringAndSize.PYTHON27(?,?,?), ref: 1E7A32EF
PyErr_Format.PYTHON27(00000000,DeviceName must be a string of length %d or less,00000020), ref: 1E7A3316

Strings

DeviceName must be a string of length %d or less, xrefs: 1E7A3310
Attributes of PyDEVMODE can't be deleted, xrefs: 1E7A32D0

Memory Dump Source

Source File: 00000011.00000002.1561923280.000000001E7A1000.00000040.00000001.01000000.00000012.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000011.00000002.1561891626.000000001E7A0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7B9000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7BE000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562197228.000000001E7C0000.00000080.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562233172.000000001E7C2000.00000004.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e7a0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Err_String$FormatSizeString_
String ID: Attributes of PyDEVMODE can't be deleted$DeviceName must be a string of length %d or less
API String ID: 301252844-574576777
Opcode ID: b1ac9a71e56239c946c6ced970b3f6838fe2d813c7eb85937e9fcd7bae41cacb
Instruction ID: b51fbc4c90078e32eb892db30ed0c0ba1b38a9121c84e1418c2818b24f9ca2a4
Opcode Fuzzy Hash: b1ac9a71e56239c946c6ced970b3f6838fe2d813c7eb85937e9fcd7bae41cacb
Instruction Fuzzy Hash: 49116DB1504301AFE324CF69D88485AB7E9EFC8324B148F1EF5AAC3690E770E850CB91

Function 03417140 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 64networkCOMMON

Download Yara Rule

APIs

WSAAddressToStringA.WS2_32(?,?,00000000,?,?), ref: 034171BF
WSAGetLastError.WS2_32 ref: 034171C9
PyErr_SetExcFromWindowsErr.PYTHON27(?,00000000), ref: 034171D9

Strings

invalid family, xrefs: 03417201

Memory Dump Source

Source File: 00000011.00000002.1560676867.0000000003411000.00000040.00000001.01000000.0000000F.sdmp, Offset: 03410000, based on PE: true

Associated: 00000011.00000002.1560637646.0000000003410000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560676867.000000000341B000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560676867.000000000341F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560836323.0000000003423000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_3410000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: AddressErr_ErrorFromLastStringWindows
String ID: invalid family
API String ID: 1619670159-3911939720
Opcode ID: 218551b193657daf4efa98a274b1a62e706683eba4eda6246a6fc2facdddc9d5
Instruction ID: 8646e4c9862578523cac6b7983c27019594bee54551f1dedd3b7d8f11a78063c
Opcode Fuzzy Hash: 218551b193657daf4efa98a274b1a62e706683eba4eda6246a6fc2facdddc9d5
Instruction Fuzzy Hash: 1E2118756046019FD360DF54D894F9BB7E4FF88700F14C81AE889DB351E734A919CB96

Function 03411200 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 63COMMON

Download Yara Rule

APIs

GetAdaptersAddresses.IPHLPAPI(00000000,00000000,00000000,00000000,?), ref: 0341123C
73BB3B4E.MSVCR90(00000000), ref: 03411247
PyErr_NoMemory.PYTHON27 ref: 03411254
PyErr_SetString.PYTHON27(00000000,GetAdaptersAddresses() syscall failed.), ref: 03411274

Strings

GetAdaptersAddresses() syscall failed., xrefs: 0341126E

Memory Dump Source

Source File: 00000011.00000002.1560676867.0000000003411000.00000040.00000001.01000000.0000000F.sdmp, Offset: 03410000, based on PE: true

Associated: 00000011.00000002.1560637646.0000000003410000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560676867.000000000341B000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560676867.000000000341F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560836323.0000000003423000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_3410000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Err_$AdaptersAddressesMemoryString
String ID: GetAdaptersAddresses() syscall failed.
API String ID: 1780708024-4058666537
Opcode ID: 6e202cc7287f833ff66bb3360624e2c9cf1e13766a71fa8cf23603b03931c364
Instruction ID: 123c62c08ec8e78717cb5dc7c6c679d8b07f679762f0324a033dc72e442c93e3
Opcode Fuzzy Hash: 6e202cc7287f833ff66bb3360624e2c9cf1e13766a71fa8cf23603b03931c364
Instruction Fuzzy Hash: 5101FC737456105BD650DB99BC84B5FF3DCEB85661F14083BF706EE280DB64A42482EE

Function 1E7A3B40 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 55COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON27(?,Attributes of PyDEVMODEW can't be deleted), ref: 1E7A3B56
PyString_AsStringAndSize.PYTHON27(?,?,?), ref: 1E7A3B6F
PyErr_Format.PYTHON27(?,Length of DriverData cannot be longer that DriverExtra (%d bytes),?), ref: 1E7A3B9C

Strings

Attributes of PyDEVMODEW can't be deleted, xrefs: 1E7A3B50
Length of DriverData cannot be longer that DriverExtra (%d bytes), xrefs: 1E7A3B96

Memory Dump Source

Source File: 00000011.00000002.1561923280.000000001E7A1000.00000040.00000001.01000000.00000012.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000011.00000002.1561891626.000000001E7A0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7B9000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7BE000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562197228.000000001E7C0000.00000080.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562233172.000000001E7C2000.00000004.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e7a0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Err_String$FormatSizeString_
String ID: Attributes of PyDEVMODEW can't be deleted$Length of DriverData cannot be longer that DriverExtra (%d bytes)
API String ID: 301252844-1897733207
Opcode ID: c44eb35a4a49b764f6e462bab1ea667ec7661c8f46fee69d96410a6f7165e2df
Instruction ID: 7055a081320a5b9631eaf5358434ab7c76269a42b0bff68f5663389cf0001c79
Opcode Fuzzy Hash: c44eb35a4a49b764f6e462bab1ea667ec7661c8f46fee69d96410a6f7165e2df
Instruction Fuzzy Hash: B1116571514211AFE308DF68DC84CAA73A9AFC8325F188B1DF666C72E1D770D951CB51

Function 1E7AB320 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

?PyWinObject_AsReadBuffer@@YAHPAU_object@@PAPAXPAKH@Z.PYWINTYPES27(?,?,?,00000000), ref: 1E7AB35B
PyErr_Clear.PYTHON27 ref: 1E7AB367
?PyWinLong_AsVoidPtr@@YAHPAU_object@@PAPAX@Z.PYWINTYPES27(?,?), ref: 1E7AB36F

Strings

WPARAM must be a String, int, or buffer object (got %s), xrefs: 1E7AB392

Memory Dump Source

Source File: 00000011.00000002.1561923280.000000001E7A1000.00000040.00000001.01000000.00000012.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000011.00000002.1561891626.000000001E7A0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7B9000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7BE000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562197228.000000001E7C0000.00000080.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562233172.000000001E7C2000.00000004.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e7a0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: U_object@@$Buffer@@ClearErr_Long_Object_Ptr@@ReadVoid
String ID: WPARAM must be a String, int, or buffer object (got %s)
API String ID: 241014388-4291837332
Opcode ID: 3a904c6f6d98946c24ea8d8144d0d732180643676da8321d460e4947ddb0d469
Instruction ID: 1021d1b02bfc2ca7ec35e8df0df25621b7c1ee42ba7ab1a84bc5fadbafdb14dc
Opcode Fuzzy Hash: 3a904c6f6d98946c24ea8d8144d0d732180643676da8321d460e4947ddb0d469
Instruction Fuzzy Hash: 750184316142109BE700DF1CE884FABB3E9EFC5714F094A5DF94587250E371E881CBA1

Function 1E7AB4B0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,OiOOi(ii):MSG param,?,?,?,?,?,?,?), ref: 1E7AB4E1
?PyWinObject_AsHANDLE@@YAHPAU_object@@PAPAX@Z.PYWINTYPES27(?,?), ref: 1E7AB4F4
?PyWinObject_AsPARAM@@YAHPAU_object@@PAI@Z.PYWINTYPES27(?,?), ref: 1E7AB509
?PyWinObject_AsPARAM@@YAHPAU_object@@PAI@Z.PYWINTYPES27(?,?), ref: 1E7AB51E

Part of subcall function 1E7AB320: ?PyWinObject_AsReadBuffer@@YAHPAU_object@@PAPAXPAKH@Z.PYWINTYPES27(?,?,?,00000000), ref: 1E7AB35B
Part of subcall function 1E7AB320: PyErr_Clear.PYTHON27 ref: 1E7AB367
Part of subcall function 1E7AB320: ?PyWinLong_AsVoidPtr@@YAHPAU_object@@PAPAX@Z.PYWINTYPES27(?,?), ref: 1E7AB36F

Strings

OiOOi(ii):MSG param, xrefs: 1E7AB4DB

Memory Dump Source

Source File: 00000011.00000002.1561923280.000000001E7A1000.00000040.00000001.01000000.00000012.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000011.00000002.1561891626.000000001E7A0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7B9000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7BE000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562197228.000000001E7C0000.00000080.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562233172.000000001E7C2000.00000004.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e7a0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: U_object@@$Object_$Arg_Buffer@@ClearErr_Long_ParsePtr@@ReadTupleVoid
String ID: OiOOi(ii):MSG param
API String ID: 348261915-2487705627
Opcode ID: 10744ced5d4691e5cb92688050c6a36684eefdad3d2eee3e07e5666aae978160
Instruction ID: 0397f60459674a67a67bb8158ca58dcd352047cb7f67d739f37e549acb50c7a4
Opcode Fuzzy Hash: 10744ced5d4691e5cb92688050c6a36684eefdad3d2eee3e07e5666aae978160
Instruction Fuzzy Hash: 91015E765042026BDA14DB64FD90DE773ED9ED4605F484F2DBA4A92210F631F90DCBB2

Function 1E7A3490 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 55COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON27(?,Attributes of PyDEVMODE can't be deleted), ref: 1E7A34A6
PyString_AsStringAndSize.PYTHON27(?,?,?), ref: 1E7A34BF
PyErr_Format.PYTHON27(?,Length of DriverData cannot be longer that DriverExtra (%d bytes),?), ref: 1E7A34EC

Strings

Length of DriverData cannot be longer that DriverExtra (%d bytes), xrefs: 1E7A34E6
Attributes of PyDEVMODE can't be deleted, xrefs: 1E7A34A0

Memory Dump Source

Source File: 00000011.00000002.1561923280.000000001E7A1000.00000040.00000001.01000000.00000012.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000011.00000002.1561891626.000000001E7A0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7B9000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7BE000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562197228.000000001E7C0000.00000080.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562233172.000000001E7C2000.00000004.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e7a0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Err_String$FormatSizeString_
String ID: Attributes of PyDEVMODE can't be deleted$Length of DriverData cannot be longer that DriverExtra (%d bytes)
API String ID: 301252844-1044516220
Opcode ID: 935c3decca00fc34bc2bc92f51abae63d7f95c6c576f60146de3a36975921f34
Instruction ID: 325acc7eb66dc15b96f7b465ae6409d590e4e333d0b30a3b700b5f2318206a2f
Opcode Fuzzy Hash: 935c3decca00fc34bc2bc92f51abae63d7f95c6c576f60146de3a36975921f34
Instruction Fuzzy Hash: CB115EB2514221AFE308DF68DC84C6A73A9ABC8325B188B1DF66A873E0D770D851CB51

Function 1E7A7300 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 47COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,1E7B064C,?,?), ref: 1E7A7317
GetSidSubAuthorityCount.ADVAPI32(?), ref: 1E7A7337
GetSidSubAuthority.ADVAPI32(?,?), ref: 1E7A734D

Strings

The index is out of range, xrefs: 1E7A7372

Memory Dump Source

Source File: 00000011.00000002.1561923280.000000001E7A1000.00000040.00000001.01000000.00000012.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000011.00000002.1561891626.000000001E7A0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7B9000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7BE000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562197228.000000001E7C0000.00000080.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562233172.000000001E7C2000.00000004.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e7a0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Authority$Arg_CountParseTuple
String ID: The index is out of range
API String ID: 3726579381-505141048
Opcode ID: 74a8035810e6da8ac0139c350eddb6b19be950eb2d8064f3a05f950149c82e7c
Instruction ID: b3877d2c5a15b5ea2b3d1da0776e4bc8f4d27aaff6834a92ff866c41324e0b48
Opcode Fuzzy Hash: 74a8035810e6da8ac0139c350eddb6b19be950eb2d8064f3a05f950149c82e7c
Instruction Fuzzy Hash: D50169B5500211EFE704DF24EC8889B77E8EB8C705F884A18FA8A83310F334E854DB62

Function 1E7A7150 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 45COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,(bbbbbb)b:Initialize,?,?,?,?,?,?), ref: 1E7A717F
InitializeSid.ADVAPI32(?,?), ref: 1E7A71A1
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(InitializeSid,00000000), ref: 1E7A71B1

Strings

(bbbbbb)b:Initialize, xrefs: 1E7A7179
InitializeSid, xrefs: 1E7A71AC

Memory Dump Source

Source File: 00000011.00000002.1561923280.000000001E7A1000.00000040.00000001.01000000.00000012.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000011.00000002.1561891626.000000001E7A0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7B9000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7BE000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562197228.000000001E7C0000.00000080.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562233172.000000001E7C2000.00000004.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e7a0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_Error@@InitializeParseTupleU_object@@Win_
String ID: (bbbbbb)b:Initialize$InitializeSid
API String ID: 3877137221-750340051
Opcode ID: aa7daafbb759b25788039a03be18939b4c694aa2444684957441c63932da7943
Instruction ID: 10ab030ec4b198fa436c4aadcd1ee38d0d3844dd64356e47da7903b33080a037
Opcode Fuzzy Hash: aa7daafbb759b25788039a03be18939b4c694aa2444684957441c63932da7943
Instruction Fuzzy Hash: 5101CCB6504206ABE305CF54E880DABB3EDBBD8704F484A1DFA5686215F630E65DCB62

Function 1E7D1B90 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 44COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27 ref: 1E7D1BAF
?PyWinObject_AsWCHAR@@YAHPAU_object@@PAPA_WHPAK@Z.PYWINTYPES27(?,00000000,00000000,00000000,?,?,?,?), ref: 1E7D1BD0
?PyWinObject_FreeWCHAR@@YAXPA_W@Z.PYWINTYPES27(?,?,00000104), ref: 1E7D1BF6

Strings

Python Service, xrefs: 1E7D1BE6
O|i:SetEventSourceName, xrefs: 1E7D1BA1

Memory Dump Source

Source File: 00000011.00000002.1562321143.000000001E7D1000.00000040.00000001.01000000.00000015.sdmp, Offset: 1E7D0000, based on PE: true

Associated: 00000011.00000002.1562293036.000000001E7D0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000011.00000002.1562321143.000000001E7DA000.00000040.00000001.01000000.00000015.sdmpDownload File
Associated: 00000011.00000002.1562391495.000000001E7DB000.00000080.00000001.01000000.00000015.sdmpDownload File
Associated: 00000011.00000002.1562417397.000000001E7DD000.00000004.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e7d0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Object_$Arg_FreeParseTupleU_object@@
String ID: O|i:SetEventSourceName$Python Service
API String ID: 1565148867-529513643
Opcode ID: 0599bc790083b23f89953cd3b24e0be4fb3c60658e64526809c4facee4508021
Instruction ID: 495f03ea7a87981dc086c003640c53d9ad6f8914b936ddc2ee08646903b21914
Opcode Fuzzy Hash: 0599bc790083b23f89953cd3b24e0be4fb3c60658e64526809c4facee4508021
Instruction Fuzzy Hash: 93015A74104311AFF300DFA8E989BAA77E8FB88704F408958FA5992251F7759518CBA3

Function 1E7AB170 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,1E7B11D4), ref: 1E7AB181
PyErr_SetString.PYTHON27(00000000,Buffer cannot be None), ref: 1E7AB1AD

Strings

Buffer cannot be None, xrefs: 1E7AB1A7

Memory Dump Source

Source File: 00000011.00000002.1561923280.000000001E7A1000.00000040.00000001.01000000.00000012.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000011.00000002.1561891626.000000001E7A0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7B9000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7BE000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562197228.000000001E7C0000.00000080.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562233172.000000001E7C2000.00000004.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e7a0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_Err_ParseStringTuple
String ID: Buffer cannot be None
API String ID: 385655187-305949699
Opcode ID: bfd3bbf9ec776fd0cbed73bcf4741e34848bab66d44e7337f5646f5175b0d4ba
Instruction ID: d9fdcce8e39f652205a2d3057938a80de7f292bd62c13796bb9a62fa39a76d7e
Opcode Fuzzy Hash: bfd3bbf9ec776fd0cbed73bcf4741e34848bab66d44e7337f5646f5175b0d4ba
Instruction Fuzzy Hash: 350181B5914101ABE200DB64EC85C6A73EAABC8214F884B18FD49C2250F735DA19CB92

Function 1E7D2FF0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,1E7D4430,?,?), ref: 1E7D3007
?PyWinObject_AsWCHAR@@YAHPAU_object@@PAPA_WHPAK@Z.PYWINTYPES27(?,?,00000000,00000000), ref: 1E7D3021
PythonService_PrepareToHostMultiple.SERVICEMANAGER(?,?), ref: 1E7D3038
PyErr_SetString.PYTHON27(032D7208,PrepareToHostMultiple failed!), ref: 1E7D3050

Strings

PrepareToHostMultiple failed!, xrefs: 1E7D304A

Memory Dump Source

Source File: 00000011.00000002.1562321143.000000001E7D1000.00000040.00000001.01000000.00000015.sdmp, Offset: 1E7D0000, based on PE: true

Associated: 00000011.00000002.1562293036.000000001E7D0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000011.00000002.1562321143.000000001E7DA000.00000040.00000001.01000000.00000015.sdmpDownload File
Associated: 00000011.00000002.1562391495.000000001E7DB000.00000080.00000001.01000000.00000015.sdmpDownload File
Associated: 00000011.00000002.1562417397.000000001E7DD000.00000004.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e7d0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_Err_HostMultipleObject_ParsePreparePythonService_StringTupleU_object@@
String ID: PrepareToHostMultiple failed!
API String ID: 1222711015-3429171965
Opcode ID: b7e719f689ea6bbe7982a48dc7b0700921edfd19d239eb00ca995da368396ec1
Instruction ID: 6f3a04a2308bc642dd2cfa3c9dfd410a7730ce4d5d150b0fdfc8b6312f701fff
Opcode Fuzzy Hash: b7e719f689ea6bbe7982a48dc7b0700921edfd19d239eb00ca995da368396ec1
Instruction Fuzzy Hash: 8A01AD75100311ABF300DBA8EC89FAA33BEBB88604F404A18FD18D2251F636E918CB52

Function 03412030 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 41COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNEL32 ref: 0341203F
PyErr_SetFromWindowsErr.PYTHON27(00000000), ref: 0341204A
Py_BuildValue.PYTHON27((LLLLLL),?,?,?,?,?,?,?,?,?,?,?,?), ref: 03412098

Strings

(LLLLLL), xrefs: 03412093
@, xrefs: 03412037

Memory Dump Source

Source File: 00000011.00000002.1560676867.0000000003411000.00000040.00000001.01000000.0000000F.sdmp, Offset: 03410000, based on PE: true

Associated: 00000011.00000002.1560637646.0000000003410000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560676867.000000000341B000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560676867.000000000341F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560836323.0000000003423000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_3410000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: BuildErr_FromGlobalMemoryStatusValueWindows
String ID: (LLLLLL)$@
API String ID: 1532042667-4274804333
Opcode ID: 7ed2fac70a195342ab93ea988904401f31852fbfbac8929d228e7f541baa2c74
Instruction ID: 899ed8b838d01a5880b287bc40095ac4171f14ae3966c3625e9e35555a843594
Opcode Fuzzy Hash: 7ed2fac70a195342ab93ea988904401f31852fbfbac8929d228e7f541baa2c74
Instruction Fuzzy Hash: F801E1F1508600AFD344DB68C855D1BB3EDABCC614F408A0CF6ADE7204D330EA118B67

Function 1E7AA4B0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

?PyWinObject_AsString@@YAHPAU_object@@PAPADHPAK@Z.PYWINTYPES27(?,?,?,00000000), ref: 1E7AA4C3

Part of subcall function 1E7A8DC0: PyErr_SetString.PYTHON27(?,None is not a valid string in this context,?,?,1E7A7B2B,?,00000000,00000000,00000000), ref: 1E7A8DE3

PyErr_Clear.PYTHON27 ref: 1E7AA4D7
?PyWinLong_AsVoidPtr@@YAHPAU_object@@PAPAX@Z.PYWINTYPES27(?,?), ref: 1E7AA4DF
PyErr_SetString.PYTHON27(?,Resource id/name must be string or int in the range 0-65536), ref: 1E7AA507

Strings

Resource id/name must be string or int in the range 0-65536, xrefs: 1E7AA501

Memory Dump Source

Source File: 00000011.00000002.1561923280.000000001E7A1000.00000040.00000001.01000000.00000012.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000011.00000002.1561891626.000000001E7A0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7B9000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7BE000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562197228.000000001E7C0000.00000080.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562233172.000000001E7C2000.00000004.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e7a0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Err_$StringU_object@@$ClearLong_Object_Ptr@@String@@Void
String ID: Resource id/name must be string or int in the range 0-65536
API String ID: 2728866234-907244015
Opcode ID: 920197796de660b57c42923f58a76e78782c0e11e69cae9d5ea9f9d4bbb4a0b9
Instruction ID: f70c8d959fc3c3bc47c875e56b3ba40f8ca3c04804b8cb833017eddc0e9e7d73
Opcode Fuzzy Hash: 920197796de660b57c42923f58a76e78782c0e11e69cae9d5ea9f9d4bbb4a0b9
Instruction Fuzzy Hash: 10F05476500211ABF7006F69FC48B6B77EDAFC9224F184A1DFA5486250E774A842CBA1

Function 1E7AA520 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

?PyWinObject_AsWCHAR@@YAHPAU_object@@PAPA_WHPAK@Z.PYWINTYPES27(?,?,?,00000000), ref: 1E7AA533

Part of subcall function 1E7A91A0: PyString_Size.PYTHON27(?,?,?,?,?,?,1E7A1A6E), ref: 1E7A91C4
Part of subcall function 1E7A91A0: PyString_AsString.PYTHON27(?,?,?,?,?,?,1E7A1A6E), ref: 1E7A91CD
Part of subcall function 1E7A91A0: PyMem_Malloc.PYTHON27(00000002), ref: 1E7A91E1
Part of subcall function 1E7A91A0: PyErr_SetString.PYTHON27(?,No memory for wide string buffer), ref: 1E7A9202

PyErr_Clear.PYTHON27 ref: 1E7AA547
?PyWinLong_AsVoidPtr@@YAHPAU_object@@PAPAX@Z.PYWINTYPES27(?,?), ref: 1E7AA54F
PyErr_SetString.PYTHON27(?,Resource id/name must be unicode or int in the range 0-65536), ref: 1E7AA577

Strings

Resource id/name must be unicode or int in the range 0-65536, xrefs: 1E7AA571

Memory Dump Source

Source File: 00000011.00000002.1561923280.000000001E7A1000.00000040.00000001.01000000.00000012.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000011.00000002.1561891626.000000001E7A0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7B9000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7BE000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562197228.000000001E7C0000.00000080.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562233172.000000001E7C2000.00000004.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e7a0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Err_String$String_U_object@@$ClearLong_MallocMem_Object_Ptr@@SizeVoid
String ID: Resource id/name must be unicode or int in the range 0-65536
API String ID: 755803416-4091729669
Opcode ID: 2632017ce2bf5ac6b95679754a2a973fd521f32be430ffea670e1b8837c3b272
Instruction ID: 2d8723932c19104dcfc6704304a6b1488e3fde49e018eddc69453608a133668f
Opcode Fuzzy Hash: 2632017ce2bf5ac6b95679754a2a973fd521f32be430ffea670e1b8837c3b272
Instruction Fuzzy Hash: E6F05436500211AFF7006F69FC84B6B77ED9FC5224F184619FA4486250E771A852DBA5

Function 1E7AB3C0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 35COMMON

Download Yara Rule

APIs

PyInt_FromLong.PYTHON27(?), ref: 1E7AB3D1
PyInt_FromLong.PYTHON27(?), ref: 1E7AB3D9
Py_BuildValue.PYTHON27(NiNNi(ii),00000000,?), ref: 1E7AB401

Strings

NiNNi(ii), xrefs: 1E7AB3FC

Memory Dump Source

Source File: 00000011.00000002.1561923280.000000001E7A1000.00000040.00000001.01000000.00000012.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000011.00000002.1561891626.000000001E7A0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7B9000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7BE000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562197228.000000001E7C0000.00000080.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562233172.000000001E7C2000.00000004.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e7a0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: FromInt_Long$BuildValue
String ID: NiNNi(ii)
API String ID: 888719023-1588869203
Opcode ID: 6f9e57c2ab50b754ba7c5d891f3220bfb5b8b8f3f960ecb2099020ab75ecf9ea
Instruction ID: 600a3cbe9f4dd5b1d6e6f73f8ebd3f17cef683e4046ce1cbfe6031156d57bbf7
Opcode Fuzzy Hash: 6f9e57c2ab50b754ba7c5d891f3220bfb5b8b8f3f960ecb2099020ab75ecf9ea
Instruction Fuzzy Hash: 0DF03AB6600604AFE620DB99EC84C63F3EDEFDC2143048A19F64AC3210D630FC148BB1

Function 1E7AA1D0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 35timeCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,1E7B11EC,?), ref: 1E7AA1E6
DosDateTimeToFileTime.KERNEL32(?,?,?), ref: 1E7AA205
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(DosDateTimeToFileTime,00000000,?,?), ref: 1E7AA215

Strings

DosDateTimeToFileTime, xrefs: 1E7AA210

Memory Dump Source

Source File: 00000011.00000002.1561923280.000000001E7A1000.00000040.00000001.01000000.00000012.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000011.00000002.1561891626.000000001E7A0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7B9000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7BE000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562197228.000000001E7C0000.00000080.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562233172.000000001E7C2000.00000004.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e7a0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Time$Arg_DateError@@FileParseTupleU_object@@Win_
String ID: DosDateTimeToFileTime
API String ID: 4133277378-852992627
Opcode ID: cabd68730d99bb26236951a684e042c0b80bb00e771ade28997c396cc5b6dc1d
Instruction ID: 1ad1988e12163e41036fecd26eb31fcc969569cc4c0c69665e9a07c11a2a2a0c
Opcode Fuzzy Hash: cabd68730d99bb26236951a684e042c0b80bb00e771ade28997c396cc5b6dc1d
Instruction Fuzzy Hash: 33F05BFA9041057BF700EB64DC45D7B77EDEAD4244F884F5CF64981125F631E6148A63

Function 1E8CC490 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 34COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,Ol:ChangeDisplaySettings,?,?), ref: 1E8CC4A7
?PyWinObject_AsDEVMODE@@YAHPAU_object@@PAPAU_devicemodeA@@H@Z.PYWINTYPES27(?,?,00000001), ref: 1E8CC4C5
ChangeDisplaySettingsA.USER32(?,?), ref: 1E8CC4DC
PyLong_FromLong.PYTHON27(00000000), ref: 1E8CC4E3

Strings

Ol:ChangeDisplaySettings, xrefs: 1E8CC4A1

Memory Dump Source

Source File: 00000011.00000002.1562490344.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 00000011.00000002.1562469835.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562702731.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562730939.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_ChangeDisplayFromLongLong_Object_ParseSettingsTupleU_devicemodeU_object@@
String ID: Ol:ChangeDisplaySettings
API String ID: 3818478573-3103544731
Opcode ID: fa3f3607112ed3cdb6b2581a02ffef90bcb212320e5154c00ad130450a5e7dbe
Instruction ID: a818a24045d3b82742ea6a6c60390124733a7f6b70b4184c9e8bac0533bb95b3
Opcode Fuzzy Hash: fa3f3607112ed3cdb6b2581a02ffef90bcb212320e5154c00ad130450a5e7dbe
Instruction Fuzzy Hash: 22F030B55042007BE304DBB4DD89AAB77E8BB84600F408928FE49C3240E635D698C792

Function 1E8C9980 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 34timeCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,:GetLocalTime), ref: 1E8C998D
GetLocalTime.KERNEL32 ref: 1E8C99A2
Py_BuildValue.PYTHON27((hhhhhhhh),?,?,?,?,?,?,?,?), ref: 1E8C99DD

Strings

(hhhhhhhh), xrefs: 1E8C99D8
:GetLocalTime, xrefs: 1E8C9987

Memory Dump Source

Source File: 00000011.00000002.1562490344.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 00000011.00000002.1562469835.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562702731.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562730939.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_BuildLocalParseTimeTupleValue
String ID: (hhhhhhhh)$:GetLocalTime
API String ID: 3440996560-3174222679
Opcode ID: 962b2b3fad23355d32a191882aba7bd93fffec2874ccd47b13ab7b539e90085e
Instruction ID: fce27bc3f8d6523c934b3ae2fa700324a7e6f33faa9b206168d5b99a2a0e40f3
Opcode Fuzzy Hash: 962b2b3fad23355d32a191882aba7bd93fffec2874ccd47b13ab7b539e90085e
Instruction Fuzzy Hash: 07F036A5408220BAD3549B5ACC4887BB3E8FEC9A02F44894DF9DD81151F23CC5A4D333

Function 1E7A2DD0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 31COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,l:DeleteAce), ref: 1E7A2DDF
DeleteAce.ADVAPI32(?), ref: 1E7A2DFA
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(DeleteAce,00000000), ref: 1E7A2E0A

Strings

DeleteAce, xrefs: 1E7A2E05
l:DeleteAce, xrefs: 1E7A2DD9

Memory Dump Source

Source File: 00000011.00000002.1561923280.000000001E7A1000.00000040.00000001.01000000.00000012.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000011.00000002.1561891626.000000001E7A0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7B9000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7BE000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562197228.000000001E7C0000.00000080.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562233172.000000001E7C2000.00000004.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e7a0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_DeleteError@@ParseTupleU_object@@Win_
String ID: DeleteAce$l:DeleteAce
API String ID: 1786209359-3702189175
Opcode ID: ce5fd305235c97bde9b3ef9642e050d5369c46c8b6d80eb8a0d665e81d70d31b
Instruction ID: 7a913d743d00f5e356b4a98154f223191f25b48d46b68e5047dd7693ada9250e
Opcode Fuzzy Hash: ce5fd305235c97bde9b3ef9642e050d5369c46c8b6d80eb8a0d665e81d70d31b
Instruction Fuzzy Hash: 6FF01CB5614215EFE208CB24EC8495A73EDABDC219B1C4759FA46C3355E730E890DA21

Function 1E7A4250 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 28threadCOMMON

Download Yara Rule

APIs

PyEval_SaveThread.PYTHON27 ref: 1E7A4260
CloseHandle.KERNEL32(00000000), ref: 1E7A426C
PyEval_RestoreThread.PYTHON27(00000000), ref: 1E7A4275
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(CloseHandle,00000000), ref: 1E7A428F

Part of subcall function 1E7A9F20: GetLastError.KERNEL32(00000000,?,1E7A5F68,MakeSelfRelativeSD,00000000), ref: 1E7A9F2A
Part of subcall function 1E7A9F20: ?PyWin_GetErrorMessageModule@@YAPAUHINSTANCE__@@K@Z.PYWINTYPES27(00000000,00000000,?,1E7A5F68,MakeSelfRelativeSD,00000000), ref: 1E7A9F38
Part of subcall function 1E7A9F20: FormatMessageA.KERNEL32(00001300,00000000,00000000,00000000,?,00000000,00000000), ref: 1E7A9F69
Part of subcall function 1E7A9F20: ?PyWinObject_FromTCHAR@@YAPAU_object@@PBDH@Z.PYWINTYPES27(No error message is available,000000FF,?,?,?,?,?,?,?,?,?,?,00000000), ref: 1E7A9FC7
Part of subcall function 1E7A9F20: ?PyWinCoreString_FromString@@YAPAU_object@@PBDH@Z.PYWINTYPES27(?,000000FF,00000000,?,73BB3D3F), ref: 1E7A9FD7
Part of subcall function 1E7A9F20: Py_BuildValue.PYTHON27((iNN),00000000,00000000,?,00000000,?,73BB3D3F), ref: 1E7A9FE6
Part of subcall function 1E7A9F20: LocalFree.KERNEL32(?), ref: 1E7A9FFF
Part of subcall function 1E7A9F20: PyErr_SetObject.PYTHON27(031BEB40,00000000), ref: 1E7AA010

Strings

CloseHandle, xrefs: 1E7A428A

Memory Dump Source

Source File: 00000011.00000002.1561923280.000000001E7A1000.00000040.00000001.01000000.00000012.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000011.00000002.1561891626.000000001E7A0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7B9000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7BE000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562197228.000000001E7C0000.00000080.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562233172.000000001E7C2000.00000004.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e7a0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: U_object@@$ErrorEval_FromMessageThreadWin_$BuildCloseCoreE__@@Err_Error@@FormatFreeHandleLastLocalModule@@ObjectObject_RestoreSaveString@@String_Value
String ID: CloseHandle
API String ID: 963033428-2962429428
Opcode ID: 63a43d65403068f0e7636a8c1c4a97ee249978d8b292d1f9f86c4ba43abdbb0a
Instruction ID: 0bbe37597261bf1a2ede6810f1a390a27d30c1db8d4d9705f916c8421cd2adfb
Opcode Fuzzy Hash: 63a43d65403068f0e7636a8c1c4a97ee249978d8b292d1f9f86c4ba43abdbb0a
Instruction Fuzzy Hash: F4E0ED766002109BF3105769AC88B5A77AAABC932AF0D8629F649C2251E675D844CB61

Function 1E8C60D0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 28threadwindowCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,|i:PostQuitMessage), ref: 1E8C60E7
PyEval_SaveThread.PYTHON27 ref: 1E8C60F7
PostQuitMessage.USER32(?), ref: 1E8C6104
PyEval_RestoreThread.PYTHON27(00000000), ref: 1E8C610B

Strings

|i:PostQuitMessage, xrefs: 1E8C60D9

Memory Dump Source

Source File: 00000011.00000002.1562490344.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 00000011.00000002.1562469835.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562702731.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562730939.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Eval_Thread$Arg_MessageParsePostQuitRestoreSaveTuple
String ID: |i:PostQuitMessage
API String ID: 269209952-1144408335
Opcode ID: 82e29b0b71da585f572279535b2e7e01a812acf761bb326885863395b2838976
Instruction ID: 4f7c9f09a45ccba557c0e5c9e07c43df70fb202aa7e24ca0219a018d5ef01fd4
Opcode Fuzzy Hash: 82e29b0b71da585f572279535b2e7e01a812acf761bb326885863395b2838976
Instruction Fuzzy Hash: 20F06575114221BFE3009BA8D88C9CA73E8FF8A35AF108129F94EC3321DB349556DF56

Function 1E8C1600 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 20threadCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,:DebugBreak), ref: 1E8C160A
PyEval_SaveThread.PYTHON27 ref: 1E8C1619
DebugBreak.KERNEL32 ref: 1E8C1621
PyEval_RestoreThread.PYTHON27(00000000), ref: 1E8C1628

Strings

:DebugBreak, xrefs: 1E8C1604

Memory Dump Source

Source File: 00000011.00000002.1562490344.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 00000011.00000002.1562469835.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562702731.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562730939.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Eval_Thread$Arg_BreakDebugParseRestoreSaveTuple
String ID: :DebugBreak
API String ID: 3289820779-303509038
Opcode ID: 518779556bc3d7879ce74f03b7fbb960c24639bcc4f7645481982fd9471bbffd
Instruction ID: 34e1c241da1c6be935254b1badbcbbb2164396c5b4b5829c3c61708fd7579241
Opcode Fuzzy Hash: 518779556bc3d7879ce74f03b7fbb960c24639bcc4f7645481982fd9471bbffd
Instruction Fuzzy Hash: 4BE0B639500621AFE7015BB8ECCC8C937E4AF4B246B448050F90EC3221D72496D68A95

Function 1E8C29A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 18COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,:GetLogicalDrives), ref: 1E8C29AA
GetLogicalDrives.KERNEL32 ref: 1E8C29B8

Strings

:GetLogicalDrives, xrefs: 1E8C29A4
GetLogicalDrives, xrefs: 1E8C29C6

Memory Dump Source

Source File: 00000011.00000002.1562490344.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 00000011.00000002.1562469835.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562702731.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562730939.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_DrivesLogicalParseTuple
String ID: :GetLogicalDrives$GetLogicalDrives
API String ID: 264834140-2320110798
Opcode ID: 80d1d7a2175918ecc6cea6558e36c6e1fd0b3e22cfbd169ad0bc9c649af3e07d
Instruction ID: ef833bf3ea7ffd4b79836891a99121fb47201ce6f46cc944831f6b38c3e55405
Opcode Fuzzy Hash: 80d1d7a2175918ecc6cea6558e36c6e1fd0b3e22cfbd169ad0bc9c649af3e07d
Instruction Fuzzy Hash: C5E0ECB4504312ABEA009B64D94C5CA7AE8BE46A49F804969F94DC3150E734C1D4CB16

Function 034113D0 Relevance: 7.6, APIs: 5, Instructions: 89COMMON

Download Yara Rule

APIs

PyList_New.PYTHON27(00000000), ref: 034113D6
Py_BuildValue.PYTHON27(0341B100), ref: 0341141B
PyList_Append.PYTHON27(?,00000000), ref: 0341142C
73BB3B4E.MSVCR90(00000000), ref: 03411456

Memory Dump Source

Source File: 00000011.00000002.1560676867.0000000003411000.00000040.00000001.01000000.0000000F.sdmp, Offset: 03410000, based on PE: true

Associated: 00000011.00000002.1560637646.0000000003410000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560676867.000000000341B000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560676867.000000000341F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560836323.0000000003423000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_3410000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: List_$AppendBuildValue
String ID:
API String ID: 3827097313-0
Opcode ID: 06377a9f65dc945fcd928b479200a84b95c6aeeaf0960b905bec56b3dc15ed86
Instruction ID: edfb79dfaf894f8c4b7d04e72e757145dbf4101ecd19579ad3ab94a483eca300
Opcode Fuzzy Hash: 06377a9f65dc945fcd928b479200a84b95c6aeeaf0960b905bec56b3dc15ed86
Instruction Fuzzy Hash: 3C213E72A00B114BC710DF94AC41497B3D4EF80A31F180679EE955F340E325E926C7E7

Function 03415C00 Relevance: 7.6, APIs: 5, Instructions: 63COMMON

Download Yara Rule

APIs

73BB3B4E.MSVCR90(00000000,0341253C,00000000,?,?,?,03415DCA,?,?,03415E23,?,03415F4A,0341253C,pir: GetExitCodeProcess() -> ERROR_ACCESS_DENIED,0341253C,?), ref: 03415C2B
EnumProcesses.PSAPI(00000000,-00001000,?,?), ref: 03415C43
PyErr_NoMemory.PYTHON27(?), ref: 03415C65

Memory Dump Source

Source File: 00000011.00000002.1560676867.0000000003411000.00000040.00000001.01000000.0000000F.sdmp, Offset: 03410000, based on PE: true

Associated: 00000011.00000002.1560637646.0000000003410000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560676867.000000000341B000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560676867.000000000341F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560836323.0000000003423000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_3410000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: EnumErr_MemoryProcesses
String ID:
API String ID: 1372074777-0
Opcode ID: d7ddaf5cde700edf4e494176314d4b3b0a8971576a6045fe6bb7b0be568cdfc7
Instruction ID: 38e798d6a4856e8df22493e57672f7c081ef8a80f98acc8193e65dc38164f88f
Opcode Fuzzy Hash: d7ddaf5cde700edf4e494176314d4b3b0a8971576a6045fe6bb7b0be568cdfc7
Instruction Fuzzy Hash: A30128736066141FD320DF59BC40BEBF3D8EBC1562F18053BF906DA204E711952483EA

Function 03411300 Relevance: 7.6, APIs: 5, Instructions: 50timeCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(?), ref: 0341130A
__aulldiv.LIBCMT ref: 0341133D
GetTickCount.KERNEL32 ref: 0341135B
__aulldiv.LIBCMT ref: 0341136B
Py_BuildValue.PYTHON27(0341B0F8,00000000,?,00000000,00000000,000003E8,00000000,?,00989680,00000000,?,00000000,00000000,00000001), ref: 0341137B

Memory Dump Source

Source File: 00000011.00000002.1560676867.0000000003411000.00000040.00000001.01000000.0000000F.sdmp, Offset: 03410000, based on PE: true

Associated: 00000011.00000002.1560637646.0000000003410000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560676867.000000000341B000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560676867.000000000341F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560836323.0000000003423000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_3410000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Time__aulldiv$BuildCountFileSystemTickValue
String ID:
API String ID: 2881610869-0
Opcode ID: 23502d662678311502877523034e5eb54defd94423f63ff60e91c5e8eb508064
Instruction ID: e27adabdb2d0795e176d851170cb7ff9346ef739d8e1570ada9cba1bbf29a2ed
Opcode Fuzzy Hash: 23502d662678311502877523034e5eb54defd94423f63ff60e91c5e8eb508064
Instruction Fuzzy Hash: 19014976B80B107BE620F3B9DC8AF9B3AAC9FC0F11F144419F505AF2C4DA749804C2A5

Function 03413B00 Relevance: 7.5, APIs: 5, Instructions: 46COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,0341B5DC,?,?), ref: 03413B17
SetProcessAffinityMask.KERNEL32(00000000,?), ref: 03413B46
PyErr_SetFromWindowsErr.PYTHON27(00000000), ref: 03413B51
CloseHandle.KERNEL32(00000000), ref: 03413B5B

Memory Dump Source

Source File: 00000011.00000002.1560676867.0000000003411000.00000040.00000001.01000000.0000000F.sdmp, Offset: 03410000, based on PE: true

Associated: 00000011.00000002.1560637646.0000000003410000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560676867.000000000341B000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560676867.000000000341F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560836323.0000000003423000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_3410000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: AffinityArg_CloseErr_FromHandleMaskParseProcessTupleWindows
String ID:
API String ID: 1573772585-0
Opcode ID: b6aabdee0e4d027dceefa22be27382aaad8dd00775c4b054256ccc253fa472b8
Instruction ID: acecd2a9fb53ceb4e685f768aef4dd73fdf61901dbe534d4fc4529335325411d
Opcode Fuzzy Hash: b6aabdee0e4d027dceefa22be27382aaad8dd00775c4b054256ccc253fa472b8
Instruction Fuzzy Hash: 2D01D679900A006FDB00FF28EC599DB7BE8EF45606F444915F805DA205F7359528C6EA

Function 03413810 Relevance: 7.5, APIs: 5, Instructions: 46COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,0341B580,?,?), ref: 03413827
SetPriorityClass.KERNEL32(00000000,?), ref: 03413856
PyErr_SetFromWindowsErr.PYTHON27(00000000), ref: 03413861
CloseHandle.KERNEL32(00000000), ref: 0341386B

Memory Dump Source

Source File: 00000011.00000002.1560676867.0000000003411000.00000040.00000001.01000000.0000000F.sdmp, Offset: 03410000, based on PE: true

Associated: 00000011.00000002.1560637646.0000000003410000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560676867.000000000341B000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560676867.000000000341F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560836323.0000000003423000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_3410000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_ClassCloseErr_FromHandleParsePriorityTupleWindows
String ID:
API String ID: 3897049644-0
Opcode ID: 3ae9b711a17b13e21e62bf8bbb8615a155b871d6b7b8809412cc66f7cdcd02f9
Instruction ID: 3b4279c2d45f5ee660a2acef4485d1288c3d19898e061aed96f498e6a74e3ce1
Opcode Fuzzy Hash: 3ae9b711a17b13e21e62bf8bbb8615a155b871d6b7b8809412cc66f7cdcd02f9
Instruction Fuzzy Hash: 77012678900A006FDB00FF24EC599DB77E8EF44606F444A15F845DA204F774D528C6E6

Function 1E7A1BB0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 81COMMON

Download Yara Rule

APIs

PyTuple_New.PYTHON27(00000000,00000000,00000000,00000000), ref: 1E7A1BF3
PyArg_ParseTupleAndKeywords.PYTHON27(00000000,00000000,lllO,1E7B928C,00000000,00000004,00000008,?), ref: 1E7A1C15
PyErr_SetString.PYTHON27(?,1E7AD788), ref: 1E7A1C44

Strings

lllO, xrefs: 1E7A1C0E

Memory Dump Source

Source File: 00000011.00000002.1561923280.000000001E7A1000.00000040.00000001.01000000.00000012.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000011.00000002.1561891626.000000001E7A0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7B9000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7BE000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562197228.000000001E7C0000.00000080.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562233172.000000001E7C2000.00000004.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e7a0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_Err_KeywordsParseStringTupleTuple_
String ID: lllO
API String ID: 3950017715-1045617993
Opcode ID: f5f89ebe41beef2f32c1f3c17d1cabb9be9954199c96356579386fcbec7b5029
Instruction ID: 08d8effb5adb1004457c770861327b2e76babae03bf5db99f63565ed38fbf6b7
Opcode Fuzzy Hash: f5f89ebe41beef2f32c1f3c17d1cabb9be9954199c96356579386fcbec7b5029
Instruction Fuzzy Hash: DE218EF15043119FE310DF68EC80A97B7E9EF88264B188B2DE65AC7650E730E805CFA1

Function 1E7A8020 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 50timeCOMMON

Download Yara Rule

APIs

VariantTimeToSystemTime.OLEAUT32 ref: 1E7A8030
PyErr_SetString.PYTHON27(?,illegal time value,?), ref: 1E7A80C8

Strings

illegal internal value, xrefs: 1E7A803A
illegal time value, xrefs: 1E7A80BA

Memory Dump Source

Source File: 00000011.00000002.1561923280.000000001E7A1000.00000040.00000001.01000000.00000012.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000011.00000002.1561891626.000000001E7A0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7B9000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7BE000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562197228.000000001E7C0000.00000080.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562233172.000000001E7C2000.00000004.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e7a0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Time$Err_StringSystemVariant
String ID: illegal internal value$illegal time value
API String ID: 734564000-2642589432
Opcode ID: 964756817cc6cb85c05dbbe89d63bd9126806e69b3753ecd44fdb19bbd25d8af
Instruction ID: f61d69b775cdebe565980329dd661b6306e7cfa33506af53998606bedb03edbc
Opcode Fuzzy Hash: 964756817cc6cb85c05dbbe89d63bd9126806e69b3753ecd44fdb19bbd25d8af
Instruction Fuzzy Hash: 0511B3B08083119FD344DF29D58412ABBE5BF88715F144B2EF4E9D22A0E335C658CB57

Function 1E7A3E90 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 45COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON27(?,PyDEVMODE cannot be None in this context), ref: 1E7A3EC3
PyErr_SetString.PYTHON27(?,Object must be a PyDEVMODEW), ref: 1E7A3EE6

Strings

PyDEVMODE cannot be None in this context, xrefs: 1E7A3EBD
Object must be a PyDEVMODEW, xrefs: 1E7A3EE0

Memory Dump Source

Source File: 00000011.00000002.1561923280.000000001E7A1000.00000040.00000001.01000000.00000012.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000011.00000002.1561891626.000000001E7A0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7B9000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7BE000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562197228.000000001E7C0000.00000080.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562233172.000000001E7C2000.00000004.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e7a0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Err_String
String ID: Object must be a PyDEVMODEW$PyDEVMODE cannot be None in this context
API String ID: 1450464846-2899910425
Opcode ID: 21e41cc0aa8f2f3e772c201b8eca5bceb9c031ded88e50f76fd1154524d610d9
Instruction ID: 0d056efd9ed13ab34f53a50e731a2c7b963b847f693507e6b8e3a92ce8ab4735
Opcode Fuzzy Hash: 21e41cc0aa8f2f3e772c201b8eca5bceb9c031ded88e50f76fd1154524d610d9
Instruction Fuzzy Hash: DE018F35518221DFE314DF28E880A96B3E5FBC8314F488A59FA9687760D3B1EC85CB91

Function 1E7A37E0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 45COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON27(?,PyDEVMODE cannot be None in this context), ref: 1E7A3813
PyErr_SetString.PYTHON27(?,Object must be a PyDEVMODE), ref: 1E7A3836

Strings

Object must be a PyDEVMODE, xrefs: 1E7A3830
PyDEVMODE cannot be None in this context, xrefs: 1E7A380D

Memory Dump Source

Source File: 00000011.00000002.1561923280.000000001E7A1000.00000040.00000001.01000000.00000012.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000011.00000002.1561891626.000000001E7A0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7B9000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7BE000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562197228.000000001E7C0000.00000080.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562233172.000000001E7C2000.00000004.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e7a0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Err_String
String ID: Object must be a PyDEVMODE$PyDEVMODE cannot be None in this context
API String ID: 1450464846-2477746375
Opcode ID: 089bcdfcbc4c715e3bc217147319a0c13bfe898e8b0aa01acbc6ebb2447913e2
Instruction ID: 2bb3631950f2e647fb65eca4f9d3e7eaa7229254fc47ca11e80c8130b675704d
Opcode Fuzzy Hash: 089bcdfcbc4c715e3bc217147319a0c13bfe898e8b0aa01acbc6ebb2447913e2
Instruction Fuzzy Hash: E1018475514220DFE310DF28E884E9A77E5FBC8314F098A19F65687764D371E881CBA1

Function 1E7A4400 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 1E7A441E
?PyWinCoreString_FromString@@YAPAU_object@@PBDH@Z.PYWINTYPES27(?,000000FF,?,?), ref: 1E7A442B

Part of subcall function 1E7A8D50: PyString_FromStringAndSize.PYTHON27(000000FF,000000FF,?,1E7A9FDC,?,000000FF,00000000,?,73BB3D3F), ref: 1E7A8D6E

PyObject_Print.PYTHON27(00000000,?,?,?,000000FF,?,?), ref: 1E7A4446

Strings

<%hs at %Id (%Id)>, xrefs: 1E7A4418

Memory Dump Source

Source File: 00000011.00000002.1561923280.000000001E7A1000.00000040.00000001.01000000.00000012.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000011.00000002.1561891626.000000001E7A0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7B9000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7BE000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562197228.000000001E7C0000.00000080.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562233172.000000001E7C2000.00000004.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e7a0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: FromString_$CoreObject_PrintSizeStringString@@U_object@@wsprintf
String ID: <%hs at %Id (%Id)>
API String ID: 711216819-3200932714
Opcode ID: e425816edbd7d02f1cdcc2ed4a3d43bdca452798a5d951565fd94d3448bc8129
Instruction ID: e86a4feb11b32c17249f2d4142182bc1e985024cfd951d88e0efc2910224f2a2
Opcode Fuzzy Hash: e425816edbd7d02f1cdcc2ed4a3d43bdca452798a5d951565fd94d3448bc8129
Instruction Fuzzy Hash: C6F062755002116FE324DB68DC84ED7B3A9FF99324F144B08F5A983290D735E986CBD2

Function 1E7A40F0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 35COMMON

Download Yara Rule

APIs

?PyWinObject_AsHANDLE@@YAHPAU_object@@PAPAX@Z.PYWINTYPES27(?,1E7B9C30), ref: 1E7A410D

Strings

CloseHandle, xrefs: 1E7A413A

Memory Dump Source

Source File: 00000011.00000002.1561923280.000000001E7A1000.00000040.00000001.01000000.00000012.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000011.00000002.1561891626.000000001E7A0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7B9000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7BE000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562197228.000000001E7C0000.00000080.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562233172.000000001E7C2000.00000004.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e7a0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Object_U_object@@
String ID: CloseHandle
API String ID: 1576115637-2962429428
Opcode ID: d515525a59980dd4745b30429a4515627da6f293e74e9e358221e4e3c2f81418
Instruction ID: c74c4f745da5c23a9b40cb27c516a234e269fb0ec53848802019e691b7e39b0c
Opcode Fuzzy Hash: d515525a59980dd4745b30429a4515627da6f293e74e9e358221e4e3c2f81418
Instruction Fuzzy Hash: 8AF0827AA14211AFE700CB68FE4898A77D99BD4646F4D8768FA04C7224F332EC00CB90

Function 03411290 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

PyErr_SetFromWindowsErr.PYTHON27(00000000), ref: 034112AF
PyErr_SetString.PYTHON27(?,GetSystemInfo() failed to retrieve CPU count), ref: 034112E7

Strings

GetSystemInfo() failed to retrieve CPU count, xrefs: 034112E1
GetActiveProcessorCount() not available; using GetSystemInfo(), xrefs: 034112BC

Memory Dump Source

Source File: 00000011.00000002.1560676867.0000000003411000.00000040.00000001.01000000.0000000F.sdmp, Offset: 03410000, based on PE: true

Associated: 00000011.00000002.1560637646.0000000003410000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560676867.000000000341B000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560676867.000000000341F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560836323.0000000003423000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_3410000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Err_$FromStringWindows
String ID: GetActiveProcessorCount() not available; using GetSystemInfo()$GetSystemInfo() failed to retrieve CPU count
API String ID: 3288110570-607474584
Opcode ID: 7f4b897be7842f1668b14b11d255446ddca44ff98ab35ee0145df30af0382495
Instruction ID: 24ceebc1fd04c347a9db86d822898af10f5bc9b530c7e2bbdbd4e1a0503ba2fe
Opcode Fuzzy Hash: 7f4b897be7842f1668b14b11d255446ddca44ff98ab35ee0145df30af0382495
Instruction Fuzzy Hash: BEF0E271A00F229BCA60E758B80485BB7949F42B91F084066FA05FF349C720CC64C7DE

Function 1E8CC380 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 32COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON27(?,PyDISPLAY_DEVICE cannot be None in this context), ref: 1E8CC3B1
PyErr_SetString.PYTHON27(?,Object must be a PyDISPLAY_DEVICE), ref: 1E8CC3D3

Strings

Object must be a PyDISPLAY_DEVICE, xrefs: 1E8CC3CD
PyDISPLAY_DEVICE cannot be None in this context, xrefs: 1E8CC3AB

Memory Dump Source

Source File: 00000011.00000002.1562490344.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 00000011.00000002.1562469835.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562702731.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562730939.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Err_String
String ID: Object must be a PyDISPLAY_DEVICE$PyDISPLAY_DEVICE cannot be None in this context
API String ID: 1450464846-405748036
Opcode ID: e89c9a85334526bac0ab53cbacb74359faf66aabb9cd7e1899d6c125f13a21a2
Instruction ID: 501ab3cfbfd86b682cb8db7a33c957312986ce6e56eb62dc9eb2bad537a3eaad
Opcode Fuzzy Hash: e89c9a85334526bac0ab53cbacb74359faf66aabb9cd7e1899d6c125f13a21a2
Instruction Fuzzy Hash: B1F01774220311AFD300DB34C8A8B8A77E1BBC6746F8085A8E849C7364C775D886CB01

Function 1E7AA130 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 31COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,s#i,?,?), ref: 1E7AA14B
IsTextUnicode.ADVAPI32(?,?), ref: 1E7AA16A
Py_BuildValue.PYTHON27(1E7B11DC,00000000), ref: 1E7AA17A

Strings

s#i, xrefs: 1E7AA145

Memory Dump Source

Source File: 00000011.00000002.1561923280.000000001E7A1000.00000040.00000001.01000000.00000012.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000011.00000002.1561891626.000000001E7A0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7B9000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7BE000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562197228.000000001E7C0000.00000080.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562233172.000000001E7C2000.00000004.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e7a0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_BuildParseTextTupleUnicodeValue
String ID: s#i
API String ID: 2774509455-590455174
Opcode ID: 453fe5755126a118ebc95c7cab0a81264b077f3a151c5da22f9c40cc54f01f6b
Instruction ID: 36c3ec844df6c82846c36ea364573cd93661ce2a1d01448fcb93af4688642379
Opcode Fuzzy Hash: 453fe5755126a118ebc95c7cab0a81264b077f3a151c5da22f9c40cc54f01f6b
Instruction Fuzzy Hash: 7BF0FEB5414106AFE704DB54DC85D6B77EDEBD8604F444A1CF985C2210F6309A1CCB62

Function 1E7D2F90 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 31COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,1E7D4410), ref: 1E7D2FA8
PythonService_PrepareToHostSingle.SERVICEMANAGER(00000000), ref: 1E7D2FB9
PyErr_SetString.PYTHON27(032D7208,PrepareToHostSingle failed!), ref: 1E7D2FD1

Strings

PrepareToHostSingle failed!, xrefs: 1E7D2FCB

Memory Dump Source

Source File: 00000011.00000002.1562321143.000000001E7D1000.00000040.00000001.01000000.00000015.sdmp, Offset: 1E7D0000, based on PE: true

Associated: 00000011.00000002.1562293036.000000001E7D0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000011.00000002.1562321143.000000001E7DA000.00000040.00000001.01000000.00000015.sdmpDownload File
Associated: 00000011.00000002.1562391495.000000001E7DB000.00000080.00000001.01000000.00000015.sdmpDownload File
Associated: 00000011.00000002.1562417397.000000001E7DD000.00000004.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e7d0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_Err_HostParsePreparePythonService_SingleStringTuple
String ID: PrepareToHostSingle failed!
API String ID: 1333664782-85598821
Opcode ID: 2b54bca35b5b5e7c0b373872ff5cce923c46f9b2fc6b6240102f271ba5feeb4a
Instruction ID: 4c8ea9770406a559d2d4e590d98cad70f2ac53d139ea68866d7fdc81ca0c64c4
Opcode Fuzzy Hash: 2b54bca35b5b5e7c0b373872ff5cce923c46f9b2fc6b6240102f271ba5feeb4a
Instruction Fuzzy Hash: 67F082B05042519FF304CB68EC88A9633F8FB58315B144918FC56D3311F735E41ACB22

Function 1E7A31E0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 30COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27 ref: 1E7A3206
??0PyACL@@QAE@HH@Z.PYWINTYPES27(?), ref: 1E7A322C

Part of subcall function 1E7A3140: InitializeAcl.ADVAPI32(?,?,?), ref: 1E7A3175

Strings

|ii:ACL, xrefs: 1E7A31F0
@, xrefs: 1E7A31F6

Memory Dump Source

Source File: 00000011.00000002.1561923280.000000001E7A1000.00000040.00000001.01000000.00000012.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000011.00000002.1561891626.000000001E7A0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7B9000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7BE000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562197228.000000001E7C0000.00000080.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562233172.000000001E7C2000.00000004.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e7a0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_InitializeParseTuple
String ID: @$|ii:ACL
API String ID: 1991639834-2672190651
Opcode ID: 7edf293a9c74c413279b1d7ce2a0fb01a909c7666d8738b4d448500780494bab
Instruction ID: 74a87209ab8cb403452c0990788f27e9a289fdb2b4c98989480c22d48669a341
Opcode Fuzzy Hash: 7edf293a9c74c413279b1d7ce2a0fb01a909c7666d8738b4d448500780494bab
Instruction Fuzzy Hash: 0BF089B5504241A7F704DF54DC49B5BB2E5AFD4604F440B1CE64982250F774D918C6A3

Function 1E7A15B0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 29COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,:Initialize), ref: 1E7A15C2
InitializeAcl.ADVAPI32(?,?), ref: 1E7A15DB

Strings

:Initialize, xrefs: 1E7A15BC
InitializeAcl, xrefs: 1E7A15EA

Memory Dump Source

Source File: 00000011.00000002.1561923280.000000001E7A1000.00000040.00000001.01000000.00000012.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000011.00000002.1561891626.000000001E7A0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7B9000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7BE000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562197228.000000001E7C0000.00000080.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562233172.000000001E7C2000.00000004.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e7a0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_InitializeParseTuple
String ID: :Initialize$InitializeAcl
API String ID: 1991639834-2627007299
Opcode ID: 371fa6cd209f1c126be1f7f0d88b158557fbecb33cdc87e4b8c1ac775306d557
Instruction ID: c62c1774421f629ccd9a69c2dda4d7c54b139183f5a64b65de638822c10d847d
Opcode Fuzzy Hash: 371fa6cd209f1c126be1f7f0d88b158557fbecb33cdc87e4b8c1ac775306d557
Instruction Fuzzy Hash: 5BF01275504221EFF200DB19F8849D777E8ABDD655B0C864DFB8583225E730D881DB51

Function 1E7A9CC0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 26COMMON

Download Yara Rule

APIs

Py_MakePendingCalls.PYTHON27 ref: 1E7A9CC7
PyErr_Clear.PYTHON27 ref: 1E7A9CF2
Py_MakePendingCalls.PYTHON27 ref: 1E7A9CF4

Strings

Unhandled exception detected before entering Python., xrefs: 1E7A9CE2

Memory Dump Source

Source File: 00000011.00000002.1561923280.000000001E7A1000.00000040.00000001.01000000.00000012.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000011.00000002.1561891626.000000001E7A0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7B9000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7BE000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562197228.000000001E7C0000.00000080.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562233172.000000001E7C2000.00000004.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e7a0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: CallsMakePending$ClearErr_
String ID: Unhandled exception detected before entering Python.
API String ID: 4110921123-920423093
Opcode ID: f0c071681995f902383e4545f838b450c1dbfc50d0e84d5c5c968bad517cb020
Instruction ID: d4cb54c3fbb9ec965c1f0f7f1050b815d5788e54fa3d65024c3b61c7519daee6
Opcode Fuzzy Hash: f0c071681995f902383e4545f838b450c1dbfc50d0e84d5c5c968bad517cb020
Instruction Fuzzy Hash: 5DE0EC7360062E97F60066BABCD1A8A77DDADCC19835E4122E704D3220EA21E8108F75

Function 1E8CAFA0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 26keyboardCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27 ref: 1E8CAFC1
MapVirtualKeyW.USER32(?,00000000), ref: 1E8CAFDB
PyInt_FromLong.PYTHON27(00000000,?,?,?,00000000,00000000), ref: 1E8CAFE2

Strings

ii|O, xrefs: 1E8CAFB3

Memory Dump Source

Source File: 00000011.00000002.1562490344.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 00000011.00000002.1562469835.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562702731.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562730939.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_FromInt_LongParseTupleVirtual
String ID: ii|O
API String ID: 3814047383-1166409153
Opcode ID: 468e61a3283d20fc7856ac0f7213df9d7d9799319ff80cf4ee50a1def5b6e197
Instruction ID: 2c8c4a43155c7093a4e1ee9f5dccd1540b76565a26c040d942b97ad9a4becf87
Opcode Fuzzy Hash: 468e61a3283d20fc7856ac0f7213df9d7d9799319ff80cf4ee50a1def5b6e197
Instruction Fuzzy Hash: 1EE0E5F55142007BE304DF64DD49B5B77E8BB94A04F444518FA4D83250E635DA5DCBA3

Function 1E7AA5D0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON27(?,RECT must be a tuple of 4 ints (left, top, right, bottom)), ref: 1E7AA5EE
PyArg_ParseTuple.PYTHON27(?,llll;RECT must be a tuple of 4 ints (left, top, right, bottom),?,?,?,?), ref: 1E7AA611

Strings

RECT must be a tuple of 4 ints (left, top, right, bottom), xrefs: 1E7AA5E8
llll;RECT must be a tuple of 4 ints (left, top, right, bottom), xrefs: 1E7AA60B

Memory Dump Source

Source File: 00000011.00000002.1561923280.000000001E7A1000.00000040.00000001.01000000.00000012.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000011.00000002.1561891626.000000001E7A0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7B9000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7BE000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562197228.000000001E7C0000.00000080.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562233172.000000001E7C2000.00000004.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e7a0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_Err_ParseStringTuple
String ID: RECT must be a tuple of 4 ints (left, top, right, bottom)$llll;RECT must be a tuple of 4 ints (left, top, right, bottom)
API String ID: 385655187-1420951713
Opcode ID: deb873378a669a06904be79b0b6fc6f96cd7636d8d5b6a77b56a87ba49847c1a
Instruction ID: 71e0d93671387db44d78b4e52f7237645d07242e30c5255af73fd4a01b7a4810
Opcode Fuzzy Hash: deb873378a669a06904be79b0b6fc6f96cd7636d8d5b6a77b56a87ba49847c1a
Instruction Fuzzy Hash: F5F039B9110201EFE300DB24CD88D9677F9EBC8708F48CA88F6098B226D231E945DB91

Function 03415940 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 24COMMON

Download Yara Rule

APIs

GetSystemPowerStatus.KERNEL32 ref: 03415947
PyErr_SetFromWindowsErr.PYTHON27(00000000), ref: 03415952
Py_BuildValue.PYTHON27(iiiI,?,?,?,?), ref: 0341597B

Strings

iiiI, xrefs: 03415976

Memory Dump Source

Source File: 00000011.00000002.1560676867.0000000003411000.00000040.00000001.01000000.0000000F.sdmp, Offset: 03410000, based on PE: true

Associated: 00000011.00000002.1560637646.0000000003410000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560676867.000000000341B000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560676867.000000000341F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560836323.0000000003423000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_3410000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: BuildErr_FromPowerStatusSystemValueWindows
String ID: iiiI
API String ID: 2045901803-2605956832
Opcode ID: 5e5ccdb21f53a3dbfcaff9613707972975c5904703dd59e9e4a7e544a1172626
Instruction ID: 1e2b09eb0839b40696d7fc9b9c711dc212fc6d5443023c6504dafd7c1d9f2829
Opcode Fuzzy Hash: 5e5ccdb21f53a3dbfcaff9613707972975c5904703dd59e9e4a7e544a1172626
Instruction Fuzzy Hash: 68E0D8F08081403BD240A7606C29A3F7FFCA9C0501F884859FDDAC1105E338C734DAA7

Function 1E7AA340 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 21COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON27(?,POINT must be a tuple of 2 ints (x,y)), ref: 1E7AA35E
PyArg_ParseTuple.PYTHON27(?,ll;POINT must be a tuple of 2 ints (x,y),?,?), ref: 1E7AA379

Strings

ll;POINT must be a tuple of 2 ints (x,y), xrefs: 1E7AA373
POINT must be a tuple of 2 ints (x,y), xrefs: 1E7AA358

Memory Dump Source

Source File: 00000011.00000002.1561923280.000000001E7A1000.00000040.00000001.01000000.00000012.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000011.00000002.1561891626.000000001E7A0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7B9000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7BE000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562197228.000000001E7C0000.00000080.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562233172.000000001E7C2000.00000004.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e7a0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_Err_ParseStringTuple
String ID: POINT must be a tuple of 2 ints (x,y)$ll;POINT must be a tuple of 2 ints (x,y)
API String ID: 385655187-334919720
Opcode ID: 155658ddf636710168af306f84a09a79f05ae7f21781ae87cb7844963b91f125
Instruction ID: de04e064e9e169f74d6134cd9905d11eb21f7dc762df9965750b020c373bcc8a
Opcode Fuzzy Hash: 155658ddf636710168af306f84a09a79f05ae7f21781ae87cb7844963b91f125
Instruction Fuzzy Hash: D5E01274610214EFE304DB24D988E6A77E9EBC8709F98CA88FA0886221D631E815AB51

Function 1E8CACB0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 21COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,|i:GetKeyboardLayout), ref: 1E8CACC7
GetKeyboardLayout.USER32 ref: 1E8CACDA
?PyWinLong_FromVoidPtr@@YAPAU_object@@PBX@Z.PYWINTYPES27(00000000), ref: 1E8CACE1

Strings

|i:GetKeyboardLayout, xrefs: 1E8CACB9

Memory Dump Source

Source File: 00000011.00000002.1562490344.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 00000011.00000002.1562469835.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562702731.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562730939.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_FromKeyboardLayoutLong_ParsePtr@@TupleU_object@@Void
String ID: |i:GetKeyboardLayout
API String ID: 1317064056-2940790594
Opcode ID: 09a060fcc3da761e7cbb32738a244b1ad15c8de339e3ed68de2e14662a5b57ac
Instruction ID: 40816fbaaf80538c511bb5444039194ada2f8adf6546f3ab00c00861a388c44b
Opcode Fuzzy Hash: 09a060fcc3da761e7cbb32738a244b1ad15c8de339e3ed68de2e14662a5b57ac
Instruction Fuzzy Hash: C4E08CB0008200ABE2149B60D88CA8A77E8AF84219F10851DF84EC3240D730C094DA22

Function 1E8C4A40 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 21COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,i:GetSystemMetrics), ref: 1E8C4A4F
GetSystemMetrics.USER32 ref: 1E8C4A62
Py_BuildValue.PYTHON27(1E8D04E8,00000000), ref: 1E8C4A6E

Strings

i:GetSystemMetrics, xrefs: 1E8C4A49

Memory Dump Source

Source File: 00000011.00000002.1562490344.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 00000011.00000002.1562469835.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562702731.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562730939.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_BuildMetricsParseSystemTupleValue
String ID: i:GetSystemMetrics
API String ID: 725957282-2591059673
Opcode ID: a9957b2b90f2ad978d2ac9babdf989c3353ca72dfba8476ca51d01fe12711ec1
Instruction ID: 88ea78358364e9ab9d1c7e8d3968945b61ac0cb936ccb9f30ec9b3a05d7cd284
Opcode Fuzzy Hash: a9957b2b90f2ad978d2ac9babdf989c3353ca72dfba8476ca51d01fe12711ec1
Instruction Fuzzy Hash: 13E0C2B00042106FE2049724DD88C9A33EEEB80209F10460CF85EC3200D63085958621

Function 1E8C5590 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 21COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,i:GetSysColor), ref: 1E8C559F
GetSysColor.USER32 ref: 1E8C55B2
Py_BuildValue.PYTHON27(1E8D0804,00000000), ref: 1E8C55BE

Strings

i:GetSysColor, xrefs: 1E8C5599

Memory Dump Source

Source File: 00000011.00000002.1562490344.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 00000011.00000002.1562469835.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562702731.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562730939.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_BuildColorParseTupleValue
String ID: i:GetSysColor
API String ID: 1738626209-1403295634
Opcode ID: 108ab7d7826d3ed239f6191a1bb14ec065e925f9cf5907a10b33d928752393cc
Instruction ID: 778f50fab512a9596d65492bbe2488b29ee31a1f5aa1ae9a33c245e2ac923d88
Opcode Fuzzy Hash: 108ab7d7826d3ed239f6191a1bb14ec065e925f9cf5907a10b33d928752393cc
Instruction Fuzzy Hash: F2E012B4114206AFE6049B60DD88CAA37EDAB85219F10451CF85EC3340DA3195659A61

Function 1E8C11E0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 20COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,i:GetStdHandle), ref: 1E8C11EF
GetStdHandle.KERNEL32 ref: 1E8C1202
?PyWinLong_FromHANDLE@@YAPAU_object@@PAX@Z.PYWINTYPES27(00000000), ref: 1E8C1209

Strings

i:GetStdHandle, xrefs: 1E8C11E9

Memory Dump Source

Source File: 00000011.00000002.1562490344.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 00000011.00000002.1562469835.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562702731.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562730939.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_FromHandleLong_ParseTupleU_object@@
String ID: i:GetStdHandle
API String ID: 7986732-1864289571
Opcode ID: 347bf9416aa9b191e35074066cb0bfe1607b4b420d5499735df63cd8aa09006e
Instruction ID: b5601b76630eeca97fae304e71a85a7ba58aa028ad9f505f5826c9aa5ef7c253
Opcode Fuzzy Hash: 347bf9416aa9b191e35074066cb0bfe1607b4b420d5499735df63cd8aa09006e
Instruction Fuzzy Hash: 58D017B1114201ABE6149B649C8C99A37ECAB85219F144A19F95EC3640EA34D5A8DA16

Function 1E7AA190 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 19COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,:CreateGuid), ref: 1E7AA19D
773F6F40.OLE32 ref: 1E7AA1B2
?PyWinObject_FromIID@@YAPAU_object@@ABU_GUID@@@Z.PYWINTYPES27 ref: 1E7AA1BC

Strings

:CreateGuid, xrefs: 1E7AA197

Memory Dump Source

Source File: 00000011.00000002.1561923280.000000001E7A1000.00000040.00000001.01000000.00000012.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000011.00000002.1561891626.000000001E7A0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7B9000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7BE000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562197228.000000001E7C0000.00000080.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562233172.000000001E7C2000.00000004.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e7a0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_D@@@FromObject_ParseTupleU_object@@
String ID: :CreateGuid
API String ID: 3096979222-3559396464
Opcode ID: 75984b2a1a55f003a82e977fbbc8c0bf9471d43b977b979faa1fee228480cefb
Instruction ID: b536029c95e65dd2c4863dede9b7c9c384e5a91298c47d83d09b0ff4a7a35c2a
Opcode Fuzzy Hash: 75984b2a1a55f003a82e977fbbc8c0bf9471d43b977b979faa1fee228480cefb
Instruction Fuzzy Hash: CED02BF6D00111B7F7007778DC4A95936A8FAD4248FCC4E4CF95980121F736E228C683

Function 1E7A72C0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 17COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,:GetSubAuthorityCount), ref: 1E7A72CA
GetSidSubAuthorityCount.ADVAPI32(?), ref: 1E7A72E0
PyInt_FromLong.PYTHON27 ref: 1E7A72EA

Strings

:GetSubAuthorityCount, xrefs: 1E7A72C4

Memory Dump Source

Source File: 00000011.00000002.1561923280.000000001E7A1000.00000040.00000001.01000000.00000012.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000011.00000002.1561891626.000000001E7A0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7B9000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7BE000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562197228.000000001E7C0000.00000080.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562233172.000000001E7C2000.00000004.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e7a0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_AuthorityCountFromInt_LongParseTuple
String ID: :GetSubAuthorityCount
API String ID: 1273865820-2020981275
Opcode ID: beed286a0919f5ec57719747f6022a3b0ad21ffc1dfaa9c56b0a949f77f9eb49
Instruction ID: 6bea6145a493d680a90d0f6f4b203e4852a9afd63872dce3f52fcc745f203711
Opcode Fuzzy Hash: beed286a0919f5ec57719747f6022a3b0ad21ffc1dfaa9c56b0a949f77f9eb49
Instruction Fuzzy Hash: F5D05EB8904214EBE6009B74DC8895B7BFDBFDD30EB8C4958FA4AC2211E639E814DF15

Function 1E7A1610 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 16COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,:IsValid), ref: 1E7A161A
IsValidAcl.ADVAPI32(?), ref: 1E7A1630
PyInt_FromLong.PYTHON27(00000000), ref: 1E7A1637

Strings

:IsValid, xrefs: 1E7A1614

Memory Dump Source

Source File: 00000011.00000002.1561923280.000000001E7A1000.00000040.00000001.01000000.00000012.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000011.00000002.1561891626.000000001E7A0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7B9000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7BE000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562197228.000000001E7C0000.00000080.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562233172.000000001E7C2000.00000004.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e7a0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_FromInt_LongParseTupleValid
String ID: :IsValid
API String ID: 2516359903-2800628479
Opcode ID: 44658e7caec4482fd3719adcdf574b4ea9f28ca412f674b506a3c6864be0a26a
Instruction ID: 3f9578271bd3a94630b89274b82762446c33be49e7591507272a9c73e2b3fe81
Opcode Fuzzy Hash: 44658e7caec4482fd3719adcdf574b4ea9f28ca412f674b506a3c6864be0a26a
Instruction Fuzzy Hash: EBD09EB9900215ABEA049BA4DD8C84A77ECBFDC34AFCC4958FB09C3211E635E815CB16

Function 1E7A7280 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 16COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,:GetLength), ref: 1E7A728A
GetLengthSid.ADVAPI32(?), ref: 1E7A72A0
PyInt_FromLong.PYTHON27(00000000), ref: 1E7A72A7

Strings

:GetLength, xrefs: 1E7A7284

Memory Dump Source

Source File: 00000011.00000002.1561923280.000000001E7A1000.00000040.00000001.01000000.00000012.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000011.00000002.1561891626.000000001E7A0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7B9000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7BE000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562197228.000000001E7C0000.00000080.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562233172.000000001E7C2000.00000004.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e7a0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_FromInt_LengthLongParseTuple
String ID: :GetLength
API String ID: 3712002366-295138441
Opcode ID: 84a24790b93c7c4a73ff40985447289244b7c1ec6bdf31e7b99395a487db834e
Instruction ID: 9501a6b803b8185f35ef0a89396f7e04b28ec9daf78be9ab5e28fc5891646c17
Opcode Fuzzy Hash: 84a24790b93c7c4a73ff40985447289244b7c1ec6bdf31e7b99395a487db834e
Instruction Fuzzy Hash: 98D09E75900215EBEA009BB4DD8C84A77EDBFDC30AF8C4958F60AC2211E635D815DB16

Function 1E7A6CE0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 16COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,:IsValid), ref: 1E7A6CEA
IsValidSecurityDescriptor.ADVAPI32(?), ref: 1E7A6D00
PyInt_FromLong.PYTHON27(00000000), ref: 1E7A6D07

Strings

:IsValid, xrefs: 1E7A6CE4

Memory Dump Source

Source File: 00000011.00000002.1561923280.000000001E7A1000.00000040.00000001.01000000.00000012.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000011.00000002.1561891626.000000001E7A0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7B9000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7BE000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562197228.000000001E7C0000.00000080.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562233172.000000001E7C2000.00000004.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e7a0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_DescriptorFromInt_LongParseSecurityTupleValid
String ID: :IsValid
API String ID: 611389677-2800628479
Opcode ID: cb4c301f7373676c4dc75cf954139f22eee3fe9d3fb9fc9ff4779f8b301c4c74
Instruction ID: 29e1a6c25f4eb623ad40aa21812ff4296b3927412491083fea7c1125f354af32
Opcode Fuzzy Hash: cb4c301f7373676c4dc75cf954139f22eee3fe9d3fb9fc9ff4779f8b301c4c74
Instruction Fuzzy Hash: A3D05E79900204EBE6009BA0DC8C80B3BACBFDC309B8C891CFA0982211E635E815CB11

Function 1E7A6D20 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 16COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,:GetLength), ref: 1E7A6D2A
GetSecurityDescriptorLength.ADVAPI32(?), ref: 1E7A6D40
PyInt_FromLong.PYTHON27(00000000), ref: 1E7A6D47

Strings

:GetLength, xrefs: 1E7A6D24

Memory Dump Source

Source File: 00000011.00000002.1561923280.000000001E7A1000.00000040.00000001.01000000.00000012.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000011.00000002.1561891626.000000001E7A0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7B9000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7BE000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562197228.000000001E7C0000.00000080.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562233172.000000001E7C2000.00000004.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e7a0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_DescriptorFromInt_LengthLongParseSecurityTuple
String ID: :GetLength
API String ID: 2131620719-295138441
Opcode ID: 3ef294804a5e8b845e8a685a321d11cf6e294a4268de28b1fb38760265c01efd
Instruction ID: f6768a3837cc35b51806b45b333385c6bbb7f0c355774fc769e2d36e2489be40
Opcode Fuzzy Hash: 3ef294804a5e8b845e8a685a321d11cf6e294a4268de28b1fb38760265c01efd
Instruction Fuzzy Hash: 99D05EB8900204EBEA009BB0DC8C80B37ACBFDC30ABC88918F60982210E639D815CB15

Function 1E7A71D0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 16COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,:IsValid), ref: 1E7A71DA
IsValidSid.ADVAPI32(?), ref: 1E7A71F0
PyBool_FromLong.PYTHON27(00000000), ref: 1E7A71F7

Strings

:IsValid, xrefs: 1E7A71D4

Memory Dump Source

Source File: 00000011.00000002.1561923280.000000001E7A1000.00000040.00000001.01000000.00000012.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000011.00000002.1561891626.000000001E7A0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7B9000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7BE000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562197228.000000001E7C0000.00000080.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562233172.000000001E7C2000.00000004.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e7a0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_Bool_FromLongParseTupleValid
String ID: :IsValid
API String ID: 2573489340-2800628479
Opcode ID: 37a7c79fcca67e17f28ec3bc1c981b490c3eb67a2a63c6ed941581db47bc1e71
Instruction ID: 6472d82cbf0dacd2b8f8cca8d49615c3881991c667ae612a455b55f748157f8a
Opcode Fuzzy Hash: 37a7c79fcca67e17f28ec3bc1c981b490c3eb67a2a63c6ed941581db47bc1e71
Instruction Fuzzy Hash: BFD05E74A00204EBEB00ABA4DC8C80B7BECAFC8309B884818F60AC3211D635D915DB16

Function 1E8C3380 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 14COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,:GetCommandLine), ref: 1E8C338A
GetCommandLineA.KERNEL32(000000FF), ref: 1E8C339A
?PyWinObject_FromTCHAR@@YAPAU_object@@PBDH@Z.PYWINTYPES27(00000000), ref: 1E8C33A1

Strings

:GetCommandLine, xrefs: 1E8C3384

Memory Dump Source

Source File: 00000011.00000002.1562490344.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 00000011.00000002.1562469835.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562702731.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562730939.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_CommandFromLineObject_ParseTupleU_object@@
String ID: :GetCommandLine
API String ID: 3930691415-3337920127
Opcode ID: f086f842816503a80e4bd5ce0dd256e48ade3070e726a9b91cd2329492f671d5
Instruction ID: 056f59a69b5d007fa26453af01ac2a7a9241068f1e6511ae4629bde16c0a4d12
Opcode Fuzzy Hash: f086f842816503a80e4bd5ce0dd256e48ade3070e726a9b91cd2329492f671d5
Instruction Fuzzy Hash: 66D01275400351BBEE0027B89D4C9CA37D87E86A27FD44754F92DC72A1D734C2D5C626

Function 1E8C30A0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 13COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,:GetCurrentProcessId), ref: 1E8C30AA
GetCurrentProcessId.KERNEL32 ref: 1E8C30B8
PyLong_FromUnsignedLong.PYTHON27(00000000), ref: 1E8C30BF

Strings

:GetCurrentProcessId, xrefs: 1E8C30A4

Memory Dump Source

Source File: 00000011.00000002.1562490344.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 00000011.00000002.1562469835.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562702731.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562730939.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_CurrentFromLongLong_ParseProcessTupleUnsigned
String ID: :GetCurrentProcessId
API String ID: 3032462896-1699093009
Opcode ID: 276130d3cc22fd1f690ad07a273cb2c9a31b4f1e937937a629cc27b0bbfffb98
Instruction ID: 146dd15b365ed1b2c2524c27bbe08420038e32910f31412ed5b7add437767a46
Opcode Fuzzy Hash: 276130d3cc22fd1f690ad07a273cb2c9a31b4f1e937937a629cc27b0bbfffb98
Instruction Fuzzy Hash: 49C01275400211BFFA002BB49C4C5CA36D87E4650EFC04450FE0EC3120E639D1D98A1A

Function 1E8C3010 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 13threadCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,:GetCurrentThread), ref: 1E8C301A
GetCurrentThread.KERNEL32 ref: 1E8C3028
?PyWinLong_FromHANDLE@@YAPAU_object@@PAX@Z.PYWINTYPES27(00000000), ref: 1E8C302F

Strings

:GetCurrentThread, xrefs: 1E8C3014

Memory Dump Source

Source File: 00000011.00000002.1562490344.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 00000011.00000002.1562469835.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562702731.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562730939.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_CurrentFromLong_ParseThreadTupleU_object@@
String ID: :GetCurrentThread
API String ID: 1734122981-929862528
Opcode ID: f337bdd109942e0fbd099691ee016e5bd255c2ab4fcb3d3bda4e6050ba18ee0e
Instruction ID: 9d4cc8aaff61248f68d869493510890a09bdf3815a55dff329fc891614ab01a7
Opcode Fuzzy Hash: f337bdd109942e0fbd099691ee016e5bd255c2ab4fcb3d3bda4e6050ba18ee0e
Instruction Fuzzy Hash: 18C01279400211FBEA001774DC4C4C636D87E4650AFC08550FA0DC3110E639D198C715

Function 1E8C3040 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 13threadCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,:GetCurrentThreadId), ref: 1E8C304A
GetCurrentThreadId.KERNEL32 ref: 1E8C3058
PyLong_FromUnsignedLong.PYTHON27(00000000), ref: 1E8C305F

Strings

:GetCurrentThreadId, xrefs: 1E8C3044

Memory Dump Source

Source File: 00000011.00000002.1562490344.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 00000011.00000002.1562469835.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562702731.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562730939.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_CurrentFromLongLong_ParseThreadTupleUnsigned
String ID: :GetCurrentThreadId
API String ID: 3722607512-2016947755
Opcode ID: cc9f207cb2e8bf795010baa77be821d31f5fe7f31a83cf47fd0a41b38b8fd842
Instruction ID: b1885eb8c927712484ea09ebfce43f0256fdf333ef7feda9b9d3e1b943472bc0
Opcode Fuzzy Hash: cc9f207cb2e8bf795010baa77be821d31f5fe7f31a83cf47fd0a41b38b8fd842
Instruction Fuzzy Hash: 7AC012755002517FEA0027B49C4C5C636D87E4650AFC40554FE0EC3110E639D2E5C655

Function 1E8C3070 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 13COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,:GetCurrentProcess), ref: 1E8C307A
GetCurrentProcess.KERNEL32 ref: 1E8C3088
?PyWinLong_FromHANDLE@@YAPAU_object@@PAX@Z.PYWINTYPES27(00000000), ref: 1E8C308F

Strings

:GetCurrentProcess, xrefs: 1E8C3074

Memory Dump Source

Source File: 00000011.00000002.1562490344.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 00000011.00000002.1562469835.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562702731.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562730939.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_CurrentFromLong_ParseProcessTupleU_object@@
String ID: :GetCurrentProcess
API String ID: 2431447350-521274867
Opcode ID: 0a23308958b15157f8934ef0dad7bc25c038c69d307098069107125a8d38c2a4
Instruction ID: 5222b167127caf7ffd612000e6c389607dfd310af6d469462c9ef39a22521fb2
Opcode Fuzzy Hash: 0a23308958b15157f8934ef0dad7bc25c038c69d307098069107125a8d38c2a4
Instruction Fuzzy Hash: 85C012794003127BEA0027B49C4C5C73AE87E4654AFC40454FA0DC3111E738D298CA16

Function 1E8C9B40 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 13threadCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,:GetThreadLocale), ref: 1E8C9B4A
GetThreadLocale.KERNEL32 ref: 1E8C9B58
PyInt_FromLong.PYTHON27(00000000), ref: 1E8C9B5F

Strings

:GetThreadLocale, xrefs: 1E8C9B44

Memory Dump Source

Source File: 00000011.00000002.1562490344.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 00000011.00000002.1562469835.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562702731.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562730939.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_FromInt_LocaleLongParseThreadTuple
String ID: :GetThreadLocale
API String ID: 2331809440-1873615413
Opcode ID: c4e5754d8295ac176ec670718bcc580db2f4b95a433703fa6d3a767ac800885f
Instruction ID: 35a042a4ff142aef31e9e8a2ed89fcd745ef5e79e5511ef816368a6d980c831d
Opcode Fuzzy Hash: c4e5754d8295ac176ec670718bcc580db2f4b95a433703fa6d3a767ac800885f
Instruction Fuzzy Hash: 66C012B44002127BEA002774DC4C4CA3AD87E4154AFC40450F90DC3121E638D1948615

Function 1E7A9990 Relevance: 6.1, APIs: 4, Instructions: 126COMMON

Download Yara Rule

APIs

?PyWinObject_AsWCHARArray@@YAHPAU_object@@PAPAPA_WPAKH@Z.PYWINTYPES27(?,?,00000000,?), ref: 1E7A99C9
PyErr_NoMemory.PYTHON27 ref: 1E7A9A3A
PyMem_Free.PYTHON27 ref: 1E7A9AC5
73BB3B4E.MSVCR90(?), ref: 1E7A9AD0

Memory Dump Source

Source File: 00000011.00000002.1561923280.000000001E7A1000.00000040.00000001.01000000.00000012.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000011.00000002.1561891626.000000001E7A0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7B9000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7BE000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562197228.000000001E7C0000.00000080.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562233172.000000001E7C2000.00000004.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e7a0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Array@@Err_FreeMem_MemoryObject_U_object@@
String ID:
API String ID: 3368010703-0
Opcode ID: 544c814765cc9c805f7d97cd72211d02afd64d184149ab0ab396259da161b5eb
Instruction ID: e675ec3cd445089cd1581056fa3a45adce5b08394d79935a84ccc819ca9daa00
Opcode Fuzzy Hash: 544c814765cc9c805f7d97cd72211d02afd64d184149ab0ab396259da161b5eb
Instruction Fuzzy Hash: EF41B039A043268BE710DF58E84165BB3E6FFC8214F0D4B19EE8997310E735EA15CB92

Function 1E7A9860 Relevance: 6.1, APIs: 4, Instructions: 117COMMON

Download Yara Rule

APIs

?PyWinObject_AsCharArray@@YAHPAU_object@@PAPAPADPAKH@Z.PYWINTYPES27(?,?,00000000,?), ref: 1E7A9898
PyErr_NoMemory.PYTHON27 ref: 1E7A98FD
PyMem_Free.PYTHON27 ref: 1E7A996A
73BB3B4E.MSVCR90(?), ref: 1E7A9975

Memory Dump Source

Source File: 00000011.00000002.1561923280.000000001E7A1000.00000040.00000001.01000000.00000012.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000011.00000002.1561891626.000000001E7A0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7B9000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7BE000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562197228.000000001E7C0000.00000080.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562233172.000000001E7C2000.00000004.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e7a0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Array@@CharErr_FreeMem_MemoryObject_U_object@@
String ID:
API String ID: 74240247-0
Opcode ID: 21f876d9bf40596094c1a1d59b80165e952b58c2402fc8390370b5a9d234fec0
Instruction ID: 4fbdfe691c836c31e449419b391f82f06291ce6f3d4b10a1aaebf924a5470c5a
Opcode Fuzzy Hash: 21f876d9bf40596094c1a1d59b80165e952b58c2402fc8390370b5a9d234fec0
Instruction Fuzzy Hash: 5E41B1795043469BE701CF18E890657B7E6FFC9204F0D4718EAC987211E736E519CB92

Function 1E7AB410 Relevance: 6.1, APIs: 4, Instructions: 51threadCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000012), ref: 1E7AB418
PyThreadState_Delete.PYTHON27 ref: 1E7AB42E
TlsSetValue.KERNEL32(00000012,00000000), ref: 1E7AB43F
LocalFree.KERNEL32(00000000), ref: 1E7AB446

Memory Dump Source

Source File: 00000011.00000002.1561923280.000000001E7A1000.00000040.00000001.01000000.00000012.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000011.00000002.1561891626.000000001E7A0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7B9000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7BE000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562197228.000000001E7C0000.00000080.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562233172.000000001E7C2000.00000004.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e7a0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Value$DeleteFreeLocalState_Thread
String ID:
API String ID: 3706641815-0
Opcode ID: 415a2254691268ec2b06917da2f3f2a6eac46f7ff0273582bcdc132a2fb2bdeb
Instruction ID: 638d4c1509f15d39aa636b1b1560b993415ec605562db5f92fce1d33357dd9b2
Opcode Fuzzy Hash: 415a2254691268ec2b06917da2f3f2a6eac46f7ff0273582bcdc132a2fb2bdeb
Instruction Fuzzy Hash: B0112A75500220DFE302FF14D8C8C6637FAFBCD2523294A58E69687A10E235D883CF60

Function 03412720 Relevance: 6.0, APIs: 4, Instructions: 50COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,0341B49C), ref: 0341272F

Memory Dump Source

Source File: 00000011.00000002.1560676867.0000000003411000.00000040.00000001.01000000.0000000F.sdmp, Offset: 03410000, based on PE: true

Associated: 00000011.00000002.1560637646.0000000003410000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560676867.000000000341B000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560676867.000000000341F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560836323.0000000003423000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_3410000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_ParseTuple
String ID:
API String ID: 3371842430-0
Opcode ID: 85c1e1737063a96d7a1ac5a48d0626641dff330ce390643925140ff0d091abcd
Instruction ID: 196cf510e7d4108bf27a83521a7a24b9eface6d2c69cc0d9a6fc9327bbd2a235
Opcode Fuzzy Hash: 85c1e1737063a96d7a1ac5a48d0626641dff330ce390643925140ff0d091abcd
Instruction Fuzzy Hash: 37F02872601A106BCA10E765BC08A8B77ECCFC1176F14497EFD0ADE300D734C42592EA

Function 1E7AB120 Relevance: 6.0, APIs: 4, Instructions: 22threadCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000012), ref: 1E7AB127
PyThreadState_Delete.PYTHON27 ref: 1E7AB13C
TlsSetValue.KERNEL32(00000012,00000000), ref: 1E7AB14E
LocalFree.KERNEL32(00000000), ref: 1E7AB155

Memory Dump Source

Source File: 00000011.00000002.1561923280.000000001E7A1000.00000040.00000001.01000000.00000012.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000011.00000002.1561891626.000000001E7A0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7B9000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7BE000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562197228.000000001E7C0000.00000080.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562233172.000000001E7C2000.00000004.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e7a0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Value$DeleteFreeLocalState_Thread
String ID:
API String ID: 3706641815-0
Opcode ID: 558dc935b24244ae2e551653a032c3aa8d3780a0030ded8c0a822f064c599124
Instruction ID: 742de9be5bfa6addb7aa7fd9322835ef7f0356fa1e3ba90f2b641c1f8199123d
Opcode Fuzzy Hash: 558dc935b24244ae2e551653a032c3aa8d3780a0030ded8c0a822f064c599124
Instruction Fuzzy Hash: 52E0E571401620ABE721AB24E8C8B9737A9EF8C62AF194A14EA9242640D635D882CE94

Function 1E7A9E40 Relevance: 6.0, APIs: 4, Instructions: 21threadCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000012), ref: 1E7A9E47
PyThreadState_Delete.PYTHON27 ref: 1E7A9E5C
TlsSetValue.KERNEL32(00000012,00000000), ref: 1E7A9E6E
LocalFree.KERNEL32(00000000), ref: 1E7A9E75

Memory Dump Source

Source File: 00000011.00000002.1561923280.000000001E7A1000.00000040.00000001.01000000.00000012.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000011.00000002.1561891626.000000001E7A0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7B9000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7BE000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562197228.000000001E7C0000.00000080.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562233172.000000001E7C2000.00000004.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e7a0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Value$DeleteFreeLocalState_Thread
String ID:
API String ID: 3706641815-0
Opcode ID: 6c79d154b6e56f47ac9ad9d0b0d1be6d675ba5e8e95ee4f066c45160e2837b67
Instruction ID: 3816705c34b1e456f645b1b9cc39bf09c3e91a7a2bdf128d3975373a88bbfe9b
Opcode Fuzzy Hash: 6c79d154b6e56f47ac9ad9d0b0d1be6d675ba5e8e95ee4f066c45160e2837b67
Instruction Fuzzy Hash: 06E04F36401631EBE3216B20E8C8BC737ADEF8C61AF1D8614FA8242154D734D882CE95

Function 1E7A3F20 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 58COMMON

Download Yara Rule

APIs

PyErr_Format.PYTHON27(?,DEVMODE structure of size %d greater than supported size of %d,?,?), ref: 1E7A3F5C

Strings

DEVMODE structure of size %d greater than supported size of %d, xrefs: 1E7A3F56

Memory Dump Source

Source File: 00000011.00000002.1561923280.000000001E7A1000.00000040.00000001.01000000.00000012.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000011.00000002.1561891626.000000001E7A0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7B9000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7BE000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562197228.000000001E7C0000.00000080.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562233172.000000001E7C2000.00000004.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e7a0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Err_Format
String ID: DEVMODE structure of size %d greater than supported size of %d
API String ID: 376477240-1470040908
Opcode ID: 70dac7ef397431be941df9c7c8c659e02a7bda4e7df70613e57b58546c3235f8
Instruction ID: 115a685f8cba940808cc017bd3699b64ed7dd8331da33372fce7189a4455f878
Opcode Fuzzy Hash: 70dac7ef397431be941df9c7c8c659e02a7bda4e7df70613e57b58546c3235f8
Instruction Fuzzy Hash: DC11EC75914271DBE214AF58E8409A773F9DBC8721B084B19FA9283290D3B4EC81C791

Function 1E7A3870 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 58COMMON

Download Yara Rule

APIs

PyErr_Format.PYTHON27(?,DEVMODE structure of size %d greater than supported size of %d,?,?), ref: 1E7A38AC

Strings

DEVMODE structure of size %d greater than supported size of %d, xrefs: 1E7A38A6

Memory Dump Source

Source File: 00000011.00000002.1561923280.000000001E7A1000.00000040.00000001.01000000.00000012.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000011.00000002.1561891626.000000001E7A0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7B9000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7BE000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562197228.000000001E7C0000.00000080.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562233172.000000001E7C2000.00000004.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e7a0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Err_Format
String ID: DEVMODE structure of size %d greater than supported size of %d
API String ID: 376477240-1470040908
Opcode ID: 73d69d95eba3511825a2040f022b2becc1b682d415afc64ab6810caf5bcc7648
Instruction ID: 16166c521baea562084c85cdb8c98f11016189f3d4a06579fea11ca892beb7f5
Opcode Fuzzy Hash: 73d69d95eba3511825a2040f022b2becc1b682d415afc64ab6810caf5bcc7648
Instruction Fuzzy Hash: 6111EC759102719BF6649F68E8409AB73E9EBC8721B084719FA8283254D3B4EC81CB91

Function 03411A90 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 53COMMON

Download Yara Rule

APIs

PyArg_ParseTupleAndKeywords.PYTHON27(?,?,i|O,0341B2C4,?), ref: 03411AB9

Strings

i|O, xrefs: 03411AB2

Memory Dump Source

Source File: 00000011.00000002.1560676867.0000000003411000.00000040.00000001.01000000.0000000F.sdmp, Offset: 03410000, based on PE: true

Associated: 00000011.00000002.1560637646.0000000003410000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560676867.000000000341B000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560676867.000000000341F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560836323.0000000003423000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_3410000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_KeywordsParseTuple
String ID: i|O
API String ID: 3508857537-3719185222
Opcode ID: 3c743d8babf5d8d5680c5a1c4b06f3e390674858e38cb5f222aad4e28f90fe30
Instruction ID: afed99f795c3a4cd62afa7d38f64eea08238889ba17eb4365133111bdde91833
Opcode Fuzzy Hash: 3c743d8babf5d8d5680c5a1c4b06f3e390674858e38cb5f222aad4e28f90fe30
Instruction Fuzzy Hash: 4201D6B4A00B026FDB00E728BC45A1FB7D8AA84604F484D29F85DDA205F335D138C7AB

Function 1E8CC8F0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 45COMMON

Download Yara Rule

APIs

Py_BuildValue.PYTHON27(O&O&O&,1E7A4700,?,1E7A4700,?,1E7AA620,?), ref: 1E8CC913
PyList_Append.PYTHON27(?,00000000), ref: 1E8CC928

Strings

O&O&O&, xrefs: 1E8CC90E

Memory Dump Source

Source File: 00000011.00000002.1562490344.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 00000011.00000002.1562469835.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562702731.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562730939.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: AppendBuildList_Value
String ID: O&O&O&
API String ID: 2697182481-1528194992
Opcode ID: eb1c4cfc7d12b7c32becc9904c3ea688ddd20078ee265e0048b073791030e8fc
Instruction ID: ba703cbcddef479ea44520c9ac7f819abd94486d464151d09c21986fb55ead4b
Opcode Fuzzy Hash: eb1c4cfc7d12b7c32becc9904c3ea688ddd20078ee265e0048b073791030e8fc
Instruction Fuzzy Hash: 59014FB2510612AFD214CB68DD84DD773E9EB86330F004B18F9A983385D334ED86C7A2

Function 03411020 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

PyObject_CallFunction.PYTHON27(?,(is),00000003,00000000,0341D7E1), ref: 0341105A
PyErr_SetObject.PYTHON27(00000000,00000000,?,(is),00000003,00000000,0341D7E1), ref: 0341106C

Strings

(is), xrefs: 03411054

Memory Dump Source

Source File: 00000011.00000002.1560676867.0000000003411000.00000040.00000001.01000000.0000000F.sdmp, Offset: 03410000, based on PE: true

Associated: 00000011.00000002.1560637646.0000000003410000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560676867.000000000341B000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560676867.000000000341F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560836323.0000000003423000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_3410000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: CallErr_FunctionObjectObject_
String ID: (is)
API String ID: 915594520-1164188219
Opcode ID: 4175e2bc9455c3a13da4dc9051fca94fce33f68a19606adc3c9b19440e102564
Instruction ID: 03d99afdc6a85e71c4c59e4a71948810227cb00a08ce0eed31e2c41ee65c3c1b
Opcode Fuzzy Hash: 4175e2bc9455c3a13da4dc9051fca94fce33f68a19606adc3c9b19440e102564
Instruction Fuzzy Hash: AB014930A009109FC310DB18EC28A97BBD9EF44350F184655F956DF784D731E912C7C5

Function 034110D0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

PyObject_CallFunction.PYTHON27(?,(is),0000000D,00000000,0341D7E0), ref: 0341110A
PyErr_SetObject.PYTHON27(00000000,00000000,?,(is),0000000D,00000000,0341D7E0), ref: 0341111C

Strings

(is), xrefs: 03411104

Memory Dump Source

Source File: 00000011.00000002.1560676867.0000000003411000.00000040.00000001.01000000.0000000F.sdmp, Offset: 03410000, based on PE: true

Associated: 00000011.00000002.1560637646.0000000003410000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560676867.000000000341B000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560676867.000000000341F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560836323.0000000003423000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_3410000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: CallErr_FunctionObjectObject_
String ID: (is)
API String ID: 915594520-1164188219
Opcode ID: e63ab781dbd29c51d560bef7d7e04c6641c2bfe4c08800f107d6b06c389fe74c
Instruction ID: a2dacb1a7d6b128fa0e34740289980718bc2313ae8e482c0b5e24476ef33fab9
Opcode Fuzzy Hash: e63ab781dbd29c51d560bef7d7e04c6641c2bfe4c08800f107d6b06c389fe74c
Instruction Fuzzy Hash: 6F012631B00A119FC260DB58EC58A57B7E5EB48360F188655F956DF388D730E811C7D4

Function 1E7A2510 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 43COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,lllOOO:AddAccessAllowedObjectAce,?,?,?,?,?), ref: 1E7A253A

Strings

lllOOO:AddAccessAllowedObjectAce, xrefs: 1E7A2534
AddAccessAllowedObjectAce, xrefs: 1E7A2573

Memory Dump Source

Source File: 00000011.00000002.1561923280.000000001E7A1000.00000040.00000001.01000000.00000012.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000011.00000002.1561891626.000000001E7A0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7B9000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7BE000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562197228.000000001E7C0000.00000080.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562233172.000000001E7C2000.00000004.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e7a0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_ParseTuple
String ID: AddAccessAllowedObjectAce$lllOOO:AddAccessAllowedObjectAce
API String ID: 3371842430-684429688
Opcode ID: 70afb1bb17fd9af8553180bc2cc374c43091f26cc838916356be171b7dd8f761
Instruction ID: 5334963454f766d8806366109799812a03107103cd582ed98986707243f9d265
Opcode Fuzzy Hash: 70afb1bb17fd9af8553180bc2cc374c43091f26cc838916356be171b7dd8f761
Instruction Fuzzy Hash: AE0192B6518241ABD305DB54CC80CABB7EDBBDC604F444B0CF69983215E634E555CB92

Function 1E7A2590 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 43COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,lllOOO:AddAccessDeniedObjectAce,?,?,?,?,?), ref: 1E7A25BA

Strings

AddAccessDeniedObjectAce, xrefs: 1E7A25F3
lllOOO:AddAccessDeniedObjectAce, xrefs: 1E7A25B4

Memory Dump Source

Source File: 00000011.00000002.1561923280.000000001E7A1000.00000040.00000001.01000000.00000012.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000011.00000002.1561891626.000000001E7A0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7B9000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7BE000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562197228.000000001E7C0000.00000080.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562233172.000000001E7C2000.00000004.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e7a0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_ParseTuple
String ID: AddAccessDeniedObjectAce$lllOOO:AddAccessDeniedObjectAce
API String ID: 3371842430-3179976129
Opcode ID: 4263e734ad7c35de3555712d6e566fb878268f41d3d04156fb5d9dd2d72979c3
Instruction ID: 93ed2dc530eff0f46820f1fb5063490e334964b331319ad75ddf0807c0b6f9fa
Opcode Fuzzy Hash: 4263e734ad7c35de3555712d6e566fb878268f41d3d04156fb5d9dd2d72979c3
Instruction Fuzzy Hash: 0D0192B6518241ABD305DB54CC90C9BB7EDBBDC604F444B4CF69983215F630E955CBA2

Function 1E7A8AE0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42timeCOMMON

Download Yara Rule

APIs

VariantTimeToSystemTime.OLEAUT32 ref: 1E7A8B10
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(VariantTimeToSystemTime,00000000), ref: 1E7A8B20

Strings

VariantTimeToSystemTime, xrefs: 1E7A8B1B

Memory Dump Source

Source File: 00000011.00000002.1561923280.000000001E7A1000.00000040.00000001.01000000.00000012.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000011.00000002.1561891626.000000001E7A0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7B9000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7BE000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562197228.000000001E7C0000.00000080.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562233172.000000001E7C2000.00000004.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e7a0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Time$Error@@SystemU_object@@VariantWin_
String ID: VariantTimeToSystemTime
API String ID: 963617488-2676162551
Opcode ID: e2b2eaf6430580e1ed9ed4f0d59e255b3e351f23eb2aded1247cddc75be8fa89
Instruction ID: 5e4a76e1de2732a55a3c896ad13680a6d931588b491aacda0412475925a2740e
Opcode Fuzzy Hash: e2b2eaf6430580e1ed9ed4f0d59e255b3e351f23eb2aded1247cddc75be8fa89
Instruction Fuzzy Hash: 02F0F6B6E101519BF200AB24FC4D98BF39A9BC4320F0D4764EA9887274E730DC46C791

Function 1E7A4680 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,|O:HANDLE), ref: 1E7A469A
?PyWinObject_AsHANDLE@@YAHPAU_object@@PAPAX@Z.PYWINTYPES27(?,?), ref: 1E7A46B0

Strings

|O:HANDLE, xrefs: 1E7A4690

Memory Dump Source

Source File: 00000011.00000002.1561923280.000000001E7A1000.00000040.00000001.01000000.00000012.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000011.00000002.1561891626.000000001E7A0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7B9000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7BE000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562197228.000000001E7C0000.00000080.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562233172.000000001E7C2000.00000004.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e7a0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_Object_ParseTupleU_object@@
String ID: |O:HANDLE
API String ID: 71531768-3700050126
Opcode ID: 97a5f86fb53aab01e3b472677d1aee3a6230a149102aa4e46843a0049de515be
Instruction ID: 9fea3204e8c686e50d175317a2d6e768496ae01543ccd2b35dbee12b2030e3e2
Opcode Fuzzy Hash: 97a5f86fb53aab01e3b472677d1aee3a6230a149102aa4e46843a0049de515be
Instruction Fuzzy Hash: 75F081745002029FE700DF21ED45A5677E4AF84708F8D8A2CE94887265F736D808CF62

Function 1E7A4820 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,|O:HANDLERegistry), ref: 1E7A483A
?PyWinObject_AsHANDLE@@YAHPAU_object@@PAPAX@Z.PYWINTYPES27(?,?), ref: 1E7A4850

Strings

|O:HANDLERegistry, xrefs: 1E7A4830

Memory Dump Source

Source File: 00000011.00000002.1561923280.000000001E7A1000.00000040.00000001.01000000.00000012.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000011.00000002.1561891626.000000001E7A0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7B9000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7BE000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562197228.000000001E7C0000.00000080.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562233172.000000001E7C2000.00000004.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e7a0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_Object_ParseTupleU_object@@
String ID: |O:HANDLERegistry
API String ID: 71531768-3745035425
Opcode ID: 0a6614b4f45f53d7ce3bbb6a172cde0393e7d9d3efe5548aa7c87bbfca7da9ee
Instruction ID: 78016d20080cc73d3eed8d9878b0b370806111abdbe6293ea97bc578d4860306
Opcode Fuzzy Hash: 0a6614b4f45f53d7ce3bbb6a172cde0393e7d9d3efe5548aa7c87bbfca7da9ee
Instruction Fuzzy Hash: 76F081709002459FF704DF21ED45A5677E8AF84309F498B2CE94887265F736D808CF62

Function 03416060 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMON

Download Yara Rule

Strings

OpenProcess, xrefs: 034160AC

Memory Dump Source

Source File: 00000011.00000002.1560676867.0000000003411000.00000040.00000001.01000000.0000000F.sdmp, Offset: 03410000, based on PE: true

Associated: 00000011.00000002.1560637646.0000000003410000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560676867.000000000341B000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560676867.000000000341F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560836323.0000000003423000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_3410000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Err_ErrorLastString
String ID: OpenProcess
API String ID: 2598814712-3743895883
Opcode ID: 29c4f38fa345533bcb6f584c735cdec5db5c51219e158cd84c7523f24fcb85aa
Instruction ID: cef39c3817fda7a791de0224d96427bbbc344b33103dde1684ac2231fea124f6
Opcode Fuzzy Hash: 29c4f38fa345533bcb6f584c735cdec5db5c51219e158cd84c7523f24fcb85aa
Instruction Fuzzy Hash: DEF0A0BAD04E202ED890F2687C015DB3BAC4B81174F0A05A7FA19CC259E315D8E042DB

Function 1E7A2240 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,lllO:AddAccessDeniedAceEx,?,?,?), ref: 1E7A2260

Strings

AddAccessDeniedAceEx, xrefs: 1E7A228F
lllO:AddAccessDeniedAceEx, xrefs: 1E7A225A

Memory Dump Source

Source File: 00000011.00000002.1561923280.000000001E7A1000.00000040.00000001.01000000.00000012.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000011.00000002.1561891626.000000001E7A0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7B9000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7BE000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562197228.000000001E7C0000.00000080.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562233172.000000001E7C2000.00000004.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e7a0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_ParseTuple
String ID: AddAccessDeniedAceEx$lllO:AddAccessDeniedAceEx
API String ID: 3371842430-4150984663
Opcode ID: 4f5e869a4ed58cc0528e119ce8c8622e65122daad5b519976a5ee7cfaf79775d
Instruction ID: 559fe5d0b0d1aa5da0a5778d5a2d034146b27b96cda6793b7671a9b29633ec21
Opcode Fuzzy Hash: 4f5e869a4ed58cc0528e119ce8c8622e65122daad5b519976a5ee7cfaf79775d
Instruction Fuzzy Hash: 7CF0FFB5518241ABE304EB48CC80C6B73EDEBDC204F884A4CF69982211E631E914CBA2

Function 1E7A22B0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,kkkO:AddMandatoryAce,?,?,?), ref: 1E7A22D0

Strings

AddMandatoryAce, xrefs: 1E7A22FF
kkkO:AddMandatoryAce, xrefs: 1E7A22CA

Memory Dump Source

Source File: 00000011.00000002.1561923280.000000001E7A1000.00000040.00000001.01000000.00000012.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000011.00000002.1561891626.000000001E7A0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7B9000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7BE000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562197228.000000001E7C0000.00000080.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562233172.000000001E7C2000.00000004.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e7a0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_ParseTuple
String ID: AddMandatoryAce$kkkO:AddMandatoryAce
API String ID: 3371842430-3675006617
Opcode ID: 46c05328ee7976d7440bf2f43bdffecd6cb4c65775cb1d888be865e9f40e0576
Instruction ID: 7f23a4a1f2b1c2cbcfbaf322defb73a6374f4e8cc69aa36090b9374c9f2dad15
Opcode Fuzzy Hash: 46c05328ee7976d7440bf2f43bdffecd6cb4c65775cb1d888be865e9f40e0576
Instruction Fuzzy Hash: 57F0FFB5518241ABE304EF58CC80C6B77EDFBD8204F884A4CF69982211E631E915CBA2

Function 1E7A21D0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,lllO:AddAccessAllowedAceEx,?,?,?), ref: 1E7A21F0

Strings

AddAccessAllowedAceEx, xrefs: 1E7A221F
lllO:AddAccessAllowedAceEx, xrefs: 1E7A21EA

Memory Dump Source

Source File: 00000011.00000002.1561923280.000000001E7A1000.00000040.00000001.01000000.00000012.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000011.00000002.1561891626.000000001E7A0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7B9000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7BE000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562197228.000000001E7C0000.00000080.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562233172.000000001E7C2000.00000004.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e7a0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_ParseTuple
String ID: AddAccessAllowedAceEx$lllO:AddAccessAllowedAceEx
API String ID: 3371842430-1263352432
Opcode ID: 2016b7318cc1c9307ffe6315d39bfe0492d25665433e1036ba71498118c0f9de
Instruction ID: 2174431e89f6836d0037ace102f62b3d35fc440892d23438eac549f2bd8a23e7
Opcode Fuzzy Hash: 2016b7318cc1c9307ffe6315d39bfe0492d25665433e1036ba71498118c0f9de
Instruction Fuzzy Hash: 21F0B2B5518251ABE304EF58DC80CAB77EDEBDC604F884F4CF69983215E631E915CB62

Function 1E7AA660 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 33COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON27(?,Buffer cannot be None), ref: 1E7AA69B
PyObject_AsReadBuffer.PYTHON27(?,?,?), ref: 1E7AA6B2

Strings

Buffer cannot be None, xrefs: 1E7AA695

Memory Dump Source

Source File: 00000011.00000002.1561923280.000000001E7A1000.00000040.00000001.01000000.00000012.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000011.00000002.1561891626.000000001E7A0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7B9000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7BE000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562197228.000000001E7C0000.00000080.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562233172.000000001E7C2000.00000004.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e7a0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: BufferErr_Object_ReadString
String ID: Buffer cannot be None
API String ID: 2639099642-305949699
Opcode ID: 19c57a778f8e9aa1081b611f4b79bb025d1220240c0f4c5aeb705c9aee0f7808
Instruction ID: a688b6be686cb57bf39391a94feefbd22bdef396c9fa96efdcf007c4d6a4b364
Opcode Fuzzy Hash: 19c57a778f8e9aa1081b611f4b79bb025d1220240c0f4c5aeb705c9aee0f7808
Instruction Fuzzy Hash: 30F04474604201EFE700DF24C894B1AB7EAFBC8319F488A58F959873A4D375E841CF52

Function 1E7AA6D0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 33COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON27(?,Buffer cannot be None), ref: 1E7AA70B
PyObject_AsWriteBuffer.PYTHON27(?,?,?), ref: 1E7AA722

Strings

Buffer cannot be None, xrefs: 1E7AA705

Memory Dump Source

Source File: 00000011.00000002.1561923280.000000001E7A1000.00000040.00000001.01000000.00000012.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000011.00000002.1561891626.000000001E7A0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7B9000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7BE000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562197228.000000001E7C0000.00000080.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562233172.000000001E7C2000.00000004.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e7a0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: BufferErr_Object_StringWrite
String ID: Buffer cannot be None
API String ID: 334160135-305949699
Opcode ID: c4ba574ea6a0bbdb1c1885778383a5aa53c7cf8077222459e5814996ff224a12
Instruction ID: 227a7656f5a7a9ae79d213f45de0f893da0795107b3711735d4bfed2e7804f4d
Opcode Fuzzy Hash: c4ba574ea6a0bbdb1c1885778383a5aa53c7cf8077222459e5814996ff224a12
Instruction Fuzzy Hash: 06F0E774504201EFE700DF24C894B5AB7E5FBC8719F588A58F959873A0E375E845CF52

Function 1E7A5A30 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 31COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,:SECURITY_ATTRIBUTES,?,?,1E7AC545,000000FF), ref: 1E7A5A50
??0PySECURITY_ATTRIBUTES@@QAE@XZ.PYWINTYPES27(?,?,?,?,?,1E7AC545,000000FF), ref: 1E7A5A78

Part of subcall function 1E7A57A0: ??0PySECURITY_DESCRIPTOR@@QAE@H@Z.PYWINTYPES27(00000014,?,?,?,?,?,000000FF), ref: 1E7A57EB

Strings

:SECURITY_ATTRIBUTES, xrefs: 1E7A5A4A

Memory Dump Source

Source File: 00000011.00000002.1561923280.000000001E7A1000.00000040.00000001.01000000.00000012.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000011.00000002.1561891626.000000001E7A0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7B9000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7BE000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562197228.000000001E7C0000.00000080.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562233172.000000001E7C2000.00000004.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e7a0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_ParseTuple
String ID: :SECURITY_ATTRIBUTES
API String ID: 3371842430-781453600
Opcode ID: 97dc0fcc2ffbb38c8d2fa18ac671e02a9d77380a627e85d9754ccc30bca6deea
Instruction ID: 139a1ec2d183b8573b6fa07223e233117c3cf4f7e98ee41a91cee8791dd9c6a1
Opcode Fuzzy Hash: 97dc0fcc2ffbb38c8d2fa18ac671e02a9d77380a627e85d9754ccc30bca6deea
Instruction Fuzzy Hash: 49F09071644680AFFB04DF288D5172A76D4EBC4710F884F2CA60987791E73C9404CB42

Function 1E7A4080 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 29COMMON

Download Yara Rule

Strings

The object is not a PyHANDLE object, xrefs: 1E7A40CE

Memory Dump Source

Source File: 00000011.00000002.1561923280.000000001E7A1000.00000040.00000001.01000000.00000012.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000011.00000002.1561891626.000000001E7A0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7B9000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7BE000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562197228.000000001E7C0000.00000080.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562233172.000000001E7C2000.00000004.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e7a0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID:
String ID: The object is not a PyHANDLE object
API String ID: 0-1472460041
Opcode ID: b16bbc3c3540c80b4e2d12e95baacea7153eab08338637abd6f6f01700d6faa8
Instruction ID: 8ace2676f54b8ef0a103196ba0983d8f9ecfb5d7735ed0d57fc716834aa7d7dc
Opcode Fuzzy Hash: b16bbc3c3540c80b4e2d12e95baacea7153eab08338637abd6f6f01700d6faa8
Instruction Fuzzy Hash: F0F0FE74614241DFE704CF24DC94A0677E5ABC8315F988A98F64487365E376EC80DB55

Function 1E8C98A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 29COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,iii:RGB,?,?), ref: 1E8C98BB
Py_BuildValue.PYTHON27(1E8D1898), ref: 1E8C98EA

Strings

iii:RGB, xrefs: 1E8C98B5

Memory Dump Source

Source File: 00000011.00000002.1562490344.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 00000011.00000002.1562469835.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562702731.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562730939.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_BuildParseTupleValue
String ID: iii:RGB
API String ID: 155762061-4024403587
Opcode ID: 6a107d205be4ae74f5a8f5a88b9cb3bc012bf4ed536f3e3fe7d54220c3333bcd
Instruction ID: e55180f7454dc98bbebbff8a9c721b95a64144eb62a42f8ca264fddfe3379853
Opcode Fuzzy Hash: 6a107d205be4ae74f5a8f5a88b9cb3bc012bf4ed536f3e3fe7d54220c3333bcd
Instruction Fuzzy Hash: 8FF0ECB48082522BD708D728DC5997A7FE4ADC1141F48495DF9DEC1151F224832CC763

Function 1E7AA740 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 28COMMON

Download Yara Rule

APIs

PySequence_Tuple.PYTHON27(?,1E7A95B4,?,?), ref: 1E7AA745
PyErr_Format.PYTHON27(?,Sequence can contain at most %d items,000000FF), ref: 1E7AA77B

Strings

Sequence can contain at most %d items, xrefs: 1E7AA775

Memory Dump Source

Source File: 00000011.00000002.1561923280.000000001E7A1000.00000040.00000001.01000000.00000012.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000011.00000002.1561891626.000000001E7A0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7B9000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7BE000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562197228.000000001E7C0000.00000080.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562233172.000000001E7C2000.00000004.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e7a0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Err_FormatSequence_Tuple
String ID: Sequence can contain at most %d items
API String ID: 265768891-3507602910
Opcode ID: d8d6afdfbb9cbf3b130b51502246ed754ac2cb1c310f0387f610daff4be3b9a1
Instruction ID: 6421c2fa2fc9848ac64fe7f6484a11aff877643a5084c5f79034508cd35374b1
Opcode Fuzzy Hash: d8d6afdfbb9cbf3b130b51502246ed754ac2cb1c310f0387f610daff4be3b9a1
Instruction Fuzzy Hash: E0F0A0749002029FEB08DF64D98485733A6AFC8338B698358F62A4B7F1E734DC52DB02

Function 1E8C1080 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 28COMMON

Download Yara Rule

APIs

Py_BuildValue.PYTHON27((izs),00000000,?,?), ref: 1E8C1092
PyErr_SetObject.PYTHON27(00000000,00000000), ref: 1E8C10AB

Strings

(izs), xrefs: 1E8C108D

Memory Dump Source

Source File: 00000011.00000002.1562490344.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 00000011.00000002.1562469835.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562702731.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562730939.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: BuildErr_ObjectValue
String ID: (izs)
API String ID: 893777110-1853584526
Opcode ID: 444c8dcf400e9214967bb6f3f9d38ff8b45b5fd5fca8b50161822f51621304f4
Instruction ID: 3b10a9d8e536fb499eb69ce40538f5937920e9c40a288ae469dde84ca554babb
Opcode Fuzzy Hash: 444c8dcf400e9214967bb6f3f9d38ff8b45b5fd5fca8b50161822f51621304f4
Instruction Fuzzy Hash: B7F065B5600121ABE3109F64DD88DD77BE5EF46320F114718F95D87380E635ED82CE92

Function 03417C40 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 26COMMON

Download Yara Rule

APIs

RtlNtStatusToDosErrorNoTeb.NTDLL(00000000), ref: 03417C61
PyErr_SetFromWindowsErrWithFilename.PYTHON27(00000000,?), ref: 03417C87

Strings

(originated from %s), xrefs: 03417C75

Memory Dump Source

Source File: 00000011.00000002.1560676867.0000000003411000.00000040.00000001.01000000.0000000F.sdmp, Offset: 03410000, based on PE: true

Associated: 00000011.00000002.1560637646.0000000003410000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560676867.000000000341B000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560676867.000000000341F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560836323.0000000003423000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_3410000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Err_ErrorFilenameFromStatusWindowsWith
String ID: (originated from %s)
API String ID: 3439497670-1804376747
Opcode ID: 3eb7ef0159f2e5448aa21fa864afb97fe33a131659157cadb54eae98002cdff7
Instruction ID: 8497d96cadaa0e71e4f840b00b1d24651e7f08a1fd4118de6c3a6cbbbc67cbca
Opcode Fuzzy Hash: 3eb7ef0159f2e5448aa21fa864afb97fe33a131659157cadb54eae98002cdff7
Instruction Fuzzy Hash: 5BE0EDB9800A11ABC710E728C898ABB76E8AB44200F044919F64AA7304E238985987E9

Function 1E7A49E0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 25COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON27(00000000,The string is too long), ref: 1E7A4A0D
?PyWinCoreString_FromString@@YAPAU_object@@PB_WH@Z.PYWINTYPES27(?,000000FF), ref: 1E7A4A25

Strings

The string is too long, xrefs: 1E7A4A07

Memory Dump Source

Source File: 00000011.00000002.1561923280.000000001E7A1000.00000040.00000001.01000000.00000012.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000011.00000002.1561891626.000000001E7A0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7B9000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7BE000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562197228.000000001E7C0000.00000080.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562233172.000000001E7C2000.00000004.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e7a0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: CoreErr_FromStringString@@String_U_object@@
String ID: The string is too long
API String ID: 1928936689-1150129668
Opcode ID: 2126abc13462aac166fd96a83b9d679a8c95d2edcd03a74c1f742252c852e550
Instruction ID: 140cd566065624560fef59a2dbca3b2a561fb194f070c44245e7b0d89a700948
Opcode Fuzzy Hash: 2126abc13462aac166fd96a83b9d679a8c95d2edcd03a74c1f742252c852e550
Instruction Fuzzy Hash: 04E0D8B5910111ABF314DF64DC89EE673ADABCC708F4C0B28FA54C22C0FABAD654CA51

Function 1E8C9800 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 25COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,ii:MAKEWORD,?), ref: 1E8C9816
Py_BuildValue.PYTHON27(1E8D187C), ref: 1E8C9840

Strings

ii:MAKEWORD, xrefs: 1E8C9810

Memory Dump Source

Source File: 00000011.00000002.1562490344.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 00000011.00000002.1562469835.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562702731.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562730939.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_BuildParseTupleValue
String ID: ii:MAKEWORD
API String ID: 155762061-2814099321
Opcode ID: 1b7844d0a77b860d0295d6ae167181b1b76d517bed9f05300de3b6520f25117d
Instruction ID: 9fcedd9464ae863094b8dd6a7851cbd9b0cd01cbf5704c5921abd2f656e5a61c
Opcode Fuzzy Hash: 1b7844d0a77b860d0295d6ae167181b1b76d517bed9f05300de3b6520f25117d
Instruction Fuzzy Hash: F9E0D8B84041513BD704B734DC498FA3AE4EEC1542F88866DF4DD92340F635926DDAB3

Function 1E7A4640 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32(?), ref: 1E7A464C
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(RegCloseKey,00000000), ref: 1E7A4669

Strings

RegCloseKey, xrefs: 1E7A4664

Memory Dump Source

Source File: 00000011.00000002.1561923280.000000001E7A1000.00000040.00000001.01000000.00000012.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000011.00000002.1561891626.000000001E7A0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7B9000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7BE000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562197228.000000001E7C0000.00000080.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562233172.000000001E7C2000.00000004.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e7a0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: CloseError@@U_object@@Win_
String ID: RegCloseKey
API String ID: 1034232812-2838036789
Opcode ID: 7d9df3432cc1dbb9cf2862c5f58f9f1a4a214cc6e82f1e3c6292054b0065c490
Instruction ID: 68866fbe72ae9d0c7b84e0fd236e99aaab0eed117d67b761fa5e8b109a6c7f97
Opcode Fuzzy Hash: 7d9df3432cc1dbb9cf2862c5f58f9f1a4a214cc6e82f1e3c6292054b0065c490
Instruction Fuzzy Hash: 4EE0CD37D0153167E62006797C08B83E6985FC49A0F0E8712AF08D3318F760D810C9E5

Function 1E7A41A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,:Detach), ref: 1E7A41AA

Strings

:Detach, xrefs: 1E7A41A4

Memory Dump Source

Source File: 00000011.00000002.1561923280.000000001E7A1000.00000040.00000001.01000000.00000012.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000011.00000002.1561891626.000000001E7A0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7B9000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7BE000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562197228.000000001E7C0000.00000080.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562233172.000000001E7C2000.00000004.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e7a0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_ParseTuple
String ID: :Detach
API String ID: 3371842430-4103459575
Opcode ID: df6d6618377fd099a107d91d811ae1db2e0d67615b640fe5b6a37cd9dcd82a3a
Instruction ID: ede5e5d1767ed638faf1f10c17aa865b9927e94bbd855ee55707449518be4470
Opcode Fuzzy Hash: df6d6618377fd099a107d91d811ae1db2e0d67615b640fe5b6a37cd9dcd82a3a
Instruction Fuzzy Hash: 0AE04F769012119BFA509B65ED48A4777E99FE4355F8A8718FE04C3120F335E901CB91

Function 1E8C12A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,O:CloseHandle), ref: 1E8C12AF
?PyWinObject_CloseHANDLE@@YAHPAU_object@@@Z.PYWINTYPES27 ref: 1E8C12C4

Strings

O:CloseHandle, xrefs: 1E8C12A9

Memory Dump Source

Source File: 00000011.00000002.1562490344.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 00000011.00000002.1562469835.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562702731.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562730939.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_CloseObject_ParseTupleU_object@@@
String ID: O:CloseHandle
API String ID: 3472323294-2961406049
Opcode ID: aa87869055a5b7ad71a42f5129ea2f7053d92170931817aa4536b8c7839d83cd
Instruction ID: 750c3133fc38a4e7ef9b938bbd1db128e09c6b2f89a4e8d3fa2e66dff809a3b4
Opcode Fuzzy Hash: aa87869055a5b7ad71a42f5129ea2f7053d92170931817aa4536b8c7839d83cd
Instruction Fuzzy Hash: 8CE04F78214101AFF304CB74DDC999673F8EB86245F104519F84EC3651E730D651DA55

Function 1E8C96B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,ii:MAKELANGID,?), ref: 1E8C96C6
Py_BuildValue.PYTHON27(1E8D182C,00000000), ref: 1E8C96EB

Strings

ii:MAKELANGID, xrefs: 1E8C96C0

Memory Dump Source

Source File: 00000011.00000002.1562490344.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 00000011.00000002.1562469835.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562702731.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562730939.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_BuildParseTupleValue
String ID: ii:MAKELANGID
API String ID: 155762061-2052633188
Opcode ID: b37c3daec02fb16663ddcfa9e6f0e6a0bf8abc1c0670acc461f90505a65b8f28
Instruction ID: abcc1383068a00334d1f70dce470c76f102b1bb2d8044fbf65a8e81acde3c889
Opcode Fuzzy Hash: b37c3daec02fb16663ddcfa9e6f0e6a0bf8abc1c0670acc461f90505a65b8f28
Instruction Fuzzy Hash: 8EE0D8B58041006BE700AB24EC498BA76E8FE80A02F844A6CF88CC1200F235C66CC6A3

Function 1E8C9850 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,ii:MAKELONG,?), ref: 1E8C9866
Py_BuildValue.PYTHON27(1E8D188C,00000000), ref: 1E8C988B

Strings

ii:MAKELONG, xrefs: 1E8C9860

Memory Dump Source

Source File: 00000011.00000002.1562490344.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 00000011.00000002.1562469835.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562702731.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562730939.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_BuildParseTupleValue
String ID: ii:MAKELONG
API String ID: 155762061-1608344320
Opcode ID: 558280e68739c48e7747efd07e2e46400d5f3417e36ae772c5adb74d41dd9e55
Instruction ID: 159faa3b8526e6f8920408efd6bcdad28fadb247ad09b9984508cf7fb2744657
Opcode Fuzzy Hash: 558280e68739c48e7747efd07e2e46400d5f3417e36ae772c5adb74d41dd9e55
Instruction Fuzzy Hash: 6CE048754041107BE704AB68EC498BA76E4FE80641F844A6DF88DD2210F635D66DD6B3

Function 1E8C6130 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,O:RegCloseKey), ref: 1E8C613F
?PyWinObject_CloseHKEY@@YAHPAU_object@@@Z.PYWINTYPES27 ref: 1E8C6154

Strings

O:RegCloseKey, xrefs: 1E8C6139

Memory Dump Source

Source File: 00000011.00000002.1562490344.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 00000011.00000002.1562469835.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562702731.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562730939.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_CloseObject_ParseTupleU_object@@@
String ID: O:RegCloseKey
API String ID: 3472323294-2839112864
Opcode ID: ce4d8e12cac51589a9419de2ff843ad4199c908a2e0a0e857f5993d64f6a0a32
Instruction ID: 14c0e139c683df0ddeacfdec9c4ab8408f41de9e4d25bf794fb025d8797c2426
Opcode Fuzzy Hash: ce4d8e12cac51589a9419de2ff843ad4199c908a2e0a0e857f5993d64f6a0a32
Instruction Fuzzy Hash: 7FE04F70114201AFE304CB74DC8899673E9EF8624AF104529F84EC3252D730E556DA11

Function 1E8C9780 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,i:HIBYTE), ref: 1E8C978F
Py_BuildValue.PYTHON27(1E8D185C,00000000), ref: 1E8C97AD

Strings

i:HIBYTE, xrefs: 1E8C9789

Memory Dump Source

Source File: 00000011.00000002.1562490344.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 00000011.00000002.1562469835.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562702731.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562730939.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_BuildParseTupleValue
String ID: i:HIBYTE
API String ID: 155762061-2590802970
Opcode ID: 2763f62d721677e1ddee347e83a8c2e0d122fddc804a74874ccfc112410a4364
Instruction ID: e0ca8e0a3e9938b6be76d93a916b2d4b8581d3f35dcb0a9d6a34d2a3275d378d
Opcode Fuzzy Hash: 2763f62d721677e1ddee347e83a8c2e0d122fddc804a74874ccfc112410a4364
Instruction Fuzzy Hash: 49D05EB40152116FE604DB24EC88DAA33EDEEC120AF14465DFC8ED3744D730D6B99A36

Function 1E7D1070 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,l:CoInitializeEx), ref: 1E7D107F
PyInt_FromLong.PYTHON27(00000000), ref: 1E7D109B

Strings

l:CoInitializeEx, xrefs: 1E7D1079

Memory Dump Source

Source File: 00000011.00000002.1562321143.000000001E7D1000.00000040.00000001.01000000.00000015.sdmp, Offset: 1E7D0000, based on PE: true

Associated: 00000011.00000002.1562293036.000000001E7D0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000011.00000002.1562321143.000000001E7DA000.00000040.00000001.01000000.00000015.sdmpDownload File
Associated: 00000011.00000002.1562391495.000000001E7DB000.00000080.00000001.01000000.00000015.sdmpDownload File
Associated: 00000011.00000002.1562417397.000000001E7DD000.00000004.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e7d0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_FromInt_LongParseTuple
String ID: l:CoInitializeEx
API String ID: 1558196150-1925297153
Opcode ID: ec0509fd26b9ef2bfcaef7020cfca185c8b10c1574a64fbc4144a89fc15cc55e
Instruction ID: 1c623fa8a659761ff80ced244e31f837b15c6b8dd6e3d274f15f084048ef0bc9
Opcode Fuzzy Hash: ec0509fd26b9ef2bfcaef7020cfca185c8b10c1574a64fbc4144a89fc15cc55e
Instruction Fuzzy Hash: 5BE012B11442016FF618A7A4EC49E9A37ACFF98316F144518F85AC2644F631D4189A12

Function 1E7A4C90 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 20COMMON

Download Yara Rule

APIs

wsprintfW.USER32 ref: 1E7A4CBF
?PyWinCoreString_FromString@@YAPAU_object@@PB_WH@Z.PYWINTYPES27(?,000000FF), ref: 1E7A4CCF

Part of subcall function 1E7A8D80: PyUnicode_EncodeMBCS.PYTHON27(?,?,ignore,?,1E7A44A3,?,000000FF), ref: 1E7A8DA9

Strings

IID('%ws'), xrefs: 1E7A4CB9

Memory Dump Source

Source File: 00000011.00000002.1561923280.000000001E7A1000.00000040.00000001.01000000.00000012.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000011.00000002.1561891626.000000001E7A0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7B9000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7BE000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562197228.000000001E7C0000.00000080.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562233172.000000001E7C2000.00000004.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e7a0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: CoreEncodeFromString@@String_U_object@@Unicode_wsprintf
String ID: IID('%ws')
API String ID: 3792274457-2301737843
Opcode ID: 8a14e57cda7b935a403cc0ac7e33954166b7022befa0ad3e0e61d947b577112d
Instruction ID: 2d2d4485e3fd04aecccba5e7c1875613c9d76b5ca7e0269f76f9520b57c18360
Opcode Fuzzy Hash: 8a14e57cda7b935a403cc0ac7e33954166b7022befa0ad3e0e61d947b577112d
Instruction Fuzzy Hash: 9FE08675444345ABE628DB60DC88EDA73ACABE8715F084F0CF2A5811D0DA78A148CB61

Function 1E8C9B00 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 20threadCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,i:SetThreadLocale), ref: 1E8C9B0F
SetThreadLocale.KERNEL32 ref: 1E8C9B22

Strings

i:SetThreadLocale, xrefs: 1E8C9B09

Memory Dump Source

Source File: 00000011.00000002.1562490344.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 00000011.00000002.1562469835.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562702731.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562730939.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_LocaleParseThreadTuple
String ID: i:SetThreadLocale
API String ID: 3627380632-2528413986
Opcode ID: 4605e3fbc77f5d247fe53b10f0b917bdda5aace6c163460a40e77f5878a2d6cc
Instruction ID: 0f93813525b90b7dd1cb7a0c5c9b5b0d5047b91816859b9a6fb141cb92d0ad6a
Opcode Fuzzy Hash: 4605e3fbc77f5d247fe53b10f0b917bdda5aace6c163460a40e77f5878a2d6cc
Instruction Fuzzy Hash: 12E0E2B4214212BFE208DB24D8C8D9A73E8EB8A255F148549F84EC3251DB30E5969A11

Function 1E8C9700 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 20COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,i:HIWORD), ref: 1E8C970F
Py_BuildValue.PYTHON27(1E8D183C), ref: 1E8C972A

Strings

i:HIWORD, xrefs: 1E8C9709

Memory Dump Source

Source File: 00000011.00000002.1562490344.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 00000011.00000002.1562469835.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562702731.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562730939.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_BuildParseTupleValue
String ID: i:HIWORD
API String ID: 155762061-3294456677
Opcode ID: 0587242bbf81e3b2fedcd4c551293293c14e0984e8d6955ff7ec16c5d62a11b7
Instruction ID: 4fe24b56a5788844fc2585f6d25360349978921a56916d58b2b37c34e04f02d5
Opcode Fuzzy Hash: 0587242bbf81e3b2fedcd4c551293293c14e0984e8d6955ff7ec16c5d62a11b7
Instruction Fuzzy Hash: 31D05EB00152016BE204DB64EC88D9E33EDEEC4209F18865DF88ED3345E731A5B9C626

Function 1E7A4BD0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19COMMON

Download Yara Rule

APIs

wsprintfW.USER32 ref: 1E7A4BFB
?PyWinCoreString_FromString@@YAPAU_object@@PB_WH@Z.PYWINTYPES27(?,000000FF,?,?,00000100,00000100), ref: 1E7A4C0B

Part of subcall function 1E7A8D80: PyUnicode_EncodeMBCS.PYTHON27(?,?,ignore,?,1E7A44A3,?,000000FF), ref: 1E7A8DA9

Strings

IID('%ws'), xrefs: 1E7A4BF5

Memory Dump Source

Source File: 00000011.00000002.1561923280.000000001E7A1000.00000040.00000001.01000000.00000012.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000011.00000002.1561891626.000000001E7A0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7B9000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7BE000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562197228.000000001E7C0000.00000080.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562233172.000000001E7C2000.00000004.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e7a0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: CoreEncodeFromString@@String_U_object@@Unicode_wsprintf
String ID: IID('%ws')
API String ID: 3792274457-2301737843
Opcode ID: 2abbe10c6e8e3aa996611bea5ddff082f6dfd2988d33d5695f436cfc0d175c55
Instruction ID: 22109b8ba7a8e5182a843bf6f6f16d9fb55b2b12166e3122a4bcc044e99b3ef9
Opcode Fuzzy Hash: 2abbe10c6e8e3aa996611bea5ddff082f6dfd2988d33d5695f436cfc0d175c55
Instruction Fuzzy Hash: A8E0CD7544434567E624DB50DC88EDA736C9BEC315F084F08F3A5811D0D6786148C761

Function 1E8C97C0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,i:LOBYTE), ref: 1E8C97CF
Py_BuildValue.PYTHON27(1E8D186C), ref: 1E8C97E8

Strings

i:LOBYTE, xrefs: 1E8C97C9

Memory Dump Source

Source File: 00000011.00000002.1562490344.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 00000011.00000002.1562469835.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562702731.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562730939.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_BuildParseTupleValue
String ID: i:LOBYTE
API String ID: 155762061-2394764204
Opcode ID: 03021429ab00f9785643580e42af78515a56a524a7d0f8f3051649016d9b5837
Instruction ID: ee4a016c18ff6d9a85c38ede41c8c53bd6041a30090cb73956fca556d2b1dc8d
Opcode Fuzzy Hash: 03021429ab00f9785643580e42af78515a56a524a7d0f8f3051649016d9b5837
Instruction Fuzzy Hash: 1DD0A5740181557BD30497719C44D5537DC5EC1209F14455DFC9EC2741D73091759526

Function 1E8C9740 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,i:LOWORD), ref: 1E8C974F
Py_BuildValue.PYTHON27(1E8D184C), ref: 1E8C9768

Strings

i:LOWORD, xrefs: 1E8C9749

Memory Dump Source

Source File: 00000011.00000002.1562490344.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 00000011.00000002.1562469835.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562702731.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562730939.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_BuildParseTupleValue
String ID: i:LOWORD
API String ID: 155762061-3498892499
Opcode ID: 0896a47240a3f03c497480d113d2e738cf5c140b8ae71706a1eab93fe62ba1cc
Instruction ID: f267f1e8c226ff196d3aa9ea6adbc48451d505575c1b53d8ca26c335656574ef
Opcode Fuzzy Hash: 0896a47240a3f03c497480d113d2e738cf5c140b8ae71706a1eab93fe62ba1cc
Instruction Fuzzy Hash: BED0A7B00182117BE3049B60EC88DAA33EDAFC031AF14855DFC8EC2341EB31D1B8D626

Function 1E7A7400 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 18COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON27(?,accessing non-existent SID segment), ref: 1E7A7414
GetLengthSid.ADVAPI32(00000000), ref: 1E7A7432

Strings

accessing non-existent SID segment, xrefs: 1E7A740E

Memory Dump Source

Source File: 00000011.00000002.1561923280.000000001E7A1000.00000040.00000001.01000000.00000012.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000011.00000002.1561891626.000000001E7A0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7B9000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7BE000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562197228.000000001E7C0000.00000080.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562233172.000000001E7C2000.00000004.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e7a0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Err_LengthString
String ID: accessing non-existent SID segment
API String ID: 1760038233-3097192503
Opcode ID: 14be65b52f7148950622b5230740f973da08e08fe7c405ae6a5a67ca233c0de9
Instruction ID: 6cd91ad286f46aaf469f0a576c27ed529f60a56409ecb5a537196b02de065097
Opcode Fuzzy Hash: 14be65b52f7148950622b5230740f973da08e08fe7c405ae6a5a67ca233c0de9
Instruction Fuzzy Hash: A2E09278600210EFD604CF24C9C8A1AB7E5EBC9315F188B58FA59873B1D674E841DF51

Function 1E7A6D60 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 18COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON27(?,accessing non-existent SID segment), ref: 1E7A6D74
GetSecurityDescriptorLength.ADVAPI32(00000000), ref: 1E7A6D92

Strings

accessing non-existent SID segment, xrefs: 1E7A6D6E

Memory Dump Source

Source File: 00000011.00000002.1561923280.000000001E7A1000.00000040.00000001.01000000.00000012.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000011.00000002.1561891626.000000001E7A0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7B9000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7BE000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562197228.000000001E7C0000.00000080.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562233172.000000001E7C2000.00000004.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e7a0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: DescriptorErr_LengthSecurityString
String ID: accessing non-existent SID segment
API String ID: 32998279-3097192503
Opcode ID: 9aef06ef43b9c8e85925e2d1e9ccbaa3db07d46650957569e10a01251027214a
Instruction ID: 808be5442e337268da46dc4997b0412caebfe655a7adbcb1d1c9b31d747b21d1
Opcode Fuzzy Hash: 9aef06ef43b9c8e85925e2d1e9ccbaa3db07d46650957569e10a01251027214a
Instruction Fuzzy Hash: B1E092B8500200EFD604DB24C98891AB7E5ABC9315F18CB58E959873A1C674E841CA51

Function 1E7A8770 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 17COMMON

Download Yara Rule

APIs

PyType_Ready.PYTHON27(?,1E7AAAFA,00000000), ref: 1E7A8775
PyDict_SetItemString.PYTHON27(?,TimeType,?), ref: 1E7A8792

Strings

TimeType, xrefs: 1E7A878C

Memory Dump Source

Source File: 00000011.00000002.1561923280.000000001E7A1000.00000040.00000001.01000000.00000012.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000011.00000002.1561891626.000000001E7A0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7B9000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7BE000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562197228.000000001E7C0000.00000080.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562233172.000000001E7C2000.00000004.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e7a0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Dict_ItemReadyStringType_
String ID: TimeType
API String ID: 3706659500-1114695889
Opcode ID: bed97daf3c5b50e0ba997466c55de5c4a08913e7e6b78094c5e21c873f17e9a6
Instruction ID: 464f0db92dc8bc4a3a828ede623ffa9aa7c7083612fcbde95dcce5d1c6aaef56
Opcode Fuzzy Hash: bed97daf3c5b50e0ba997466c55de5c4a08913e7e6b78094c5e21c873f17e9a6
Instruction Fuzzy Hash: 4AD0A77491050063F50066BC5D4DD95B3045BC033EF180B10F23ADA2F0F638C466CA02

Function 1E7A7E80 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16timeCOMMON

Download Yara Rule

APIs

VariantTimeToSystemTime.OLEAUT32 ref: 1E7A7E8E
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(VariantTimeToSystemTime,00000000), ref: 1E7A7E9E

Part of subcall function 1E7A9F20: GetLastError.KERNEL32(00000000,?,1E7A5F68,MakeSelfRelativeSD,00000000), ref: 1E7A9F2A
Part of subcall function 1E7A9F20: ?PyWin_GetErrorMessageModule@@YAPAUHINSTANCE__@@K@Z.PYWINTYPES27(00000000,00000000,?,1E7A5F68,MakeSelfRelativeSD,00000000), ref: 1E7A9F38
Part of subcall function 1E7A9F20: FormatMessageA.KERNEL32(00001300,00000000,00000000,00000000,?,00000000,00000000), ref: 1E7A9F69
Part of subcall function 1E7A9F20: ?PyWinObject_FromTCHAR@@YAPAU_object@@PBDH@Z.PYWINTYPES27(No error message is available,000000FF,?,?,?,?,?,?,?,?,?,?,00000000), ref: 1E7A9FC7
Part of subcall function 1E7A9F20: ?PyWinCoreString_FromString@@YAPAU_object@@PBDH@Z.PYWINTYPES27(?,000000FF,00000000,?,73BB3D3F), ref: 1E7A9FD7
Part of subcall function 1E7A9F20: Py_BuildValue.PYTHON27((iNN),00000000,00000000,?,00000000,?,73BB3D3F), ref: 1E7A9FE6
Part of subcall function 1E7A9F20: LocalFree.KERNEL32(?), ref: 1E7A9FFF
Part of subcall function 1E7A9F20: PyErr_SetObject.PYTHON27(031BEB40,00000000), ref: 1E7AA010

Strings

VariantTimeToSystemTime, xrefs: 1E7A7E99

Memory Dump Source

Source File: 00000011.00000002.1561923280.000000001E7A1000.00000040.00000001.01000000.00000012.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000011.00000002.1561891626.000000001E7A0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7B9000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1561923280.000000001E7BE000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562197228.000000001E7C0000.00000080.00000001.01000000.00000012.sdmpDownload File
Associated: 00000011.00000002.1562233172.000000001E7C2000.00000004.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e7a0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: U_object@@$ErrorFromMessageTimeWin_$BuildCoreE__@@Err_Error@@FormatFreeLastLocalModule@@ObjectObject_String@@String_SystemValueVariant
String ID: VariantTimeToSystemTime
API String ID: 3868328766-2676162551
Opcode ID: f7b787d6cf7be4c79ecf884839bd8904334afdd48da64d58407a09cca3453c7e
Instruction ID: 63a79f8bf2bafc2be4b8ca9dad34d6ea96d76cfd0864b2d3fcef044f47aaf464
Opcode Fuzzy Hash: f7b787d6cf7be4c79ecf884839bd8904334afdd48da64d58407a09cca3453c7e
Instruction Fuzzy Hash: D0D0C7B5614045D7E300BB34FD4DA5BB65CDB94706F584A74F648C0158E732D934C765

Function 03411090 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 034110B2
PyErr_SetFromWindowsErrWithFilename.PYTHON27(00000000), ref: 034110B9

Strings

(originated from %s), xrefs: 0341109F

Memory Dump Source

Source File: 00000011.00000002.1560676867.0000000003411000.00000040.00000001.01000000.0000000F.sdmp, Offset: 03410000, based on PE: true

Associated: 00000011.00000002.1560637646.0000000003410000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560676867.000000000341B000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560676867.000000000341F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560836323.0000000003423000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_3410000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Err_ErrorFilenameFromLastWindowsWith
String ID: (originated from %s)
API String ID: 3182726521-1804376747
Opcode ID: 0810fdb67756aefe50ae73e084aff18d034a50455504e575f634e89dc8d2ef30
Instruction ID: ec6ae6b0c59c93fb326ce371b1dd3fcb44de3070d82bac6fd01696783f8f38bf
Opcode Fuzzy Hash: 0810fdb67756aefe50ae73e084aff18d034a50455504e575f634e89dc8d2ef30
Instruction Fuzzy Hash: 4BD02EF0800A00AFD310FBB0EC5C98F77E8BB44600F808D08F656E9004EB78E518CAD6

Function 03417090 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(0341712E,034159F6), ref: 0341709D
PyErr_WarnEx.PYTHON27(?,psutil module couldn't set SE DEBUG mode for this process; please file an issue against psutil bug tracker,00000001), ref: 034170B7

Strings

psutil module couldn't set SE DEBUG mode for this process; please file an issue against psutil bug tracker, xrefs: 03417090, 034170B1

Memory Dump Source

Source File: 00000011.00000002.1560676867.0000000003411000.00000040.00000001.01000000.0000000F.sdmp, Offset: 03410000, based on PE: true

Associated: 00000011.00000002.1560637646.0000000003410000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560676867.000000000341B000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560676867.000000000341F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000011.00000002.1560836323.0000000003423000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_3410000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Err_ErrorLastWarn
String ID: psutil module couldn't set SE DEBUG mode for this process; please file an issue against psutil bug tracker
API String ID: 2910580754-1400796036
Opcode ID: 0bf50678e2d250f6c0ae8c10d96edffde3a7bbab427330e6ce5fa28f358a2626
Instruction ID: de85e4f7ed008adffe8f6495a36b74e582ea0f73c095174f4bc804945452afe4
Opcode Fuzzy Hash: 0bf50678e2d250f6c0ae8c10d96edffde3a7bbab427330e6ce5fa28f358a2626
Instruction Fuzzy Hash: F6D0A7B0940E00DFC241F714BC69A1AB7B0EB0B700B080455F812AE246D7F2D460C68F

Function 1E7D10B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,:CoUninitialize), ref: 1E7D10BA
773FD120.OLE32 ref: 1E7D10C8

Strings

:CoUninitialize, xrefs: 1E7D10B4

Memory Dump Source

Source File: 00000011.00000002.1562321143.000000001E7D1000.00000040.00000001.01000000.00000015.sdmp, Offset: 1E7D0000, based on PE: true

Associated: 00000011.00000002.1562293036.000000001E7D0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000011.00000002.1562321143.000000001E7DA000.00000040.00000001.01000000.00000015.sdmpDownload File
Associated: 00000011.00000002.1562391495.000000001E7DB000.00000080.00000001.01000000.00000015.sdmpDownload File
Associated: 00000011.00000002.1562417397.000000001E7DD000.00000004.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e7d0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_D120ParseTuple
String ID: :CoUninitialize
API String ID: 1723112310-4124906679
Opcode ID: 33aa3bc3a4d1318914e480ad88524f8f589a94fa845ea05bd4fcaccd5dda84c5
Instruction ID: 6b3fcdcd7bde38cb48e555476325dc9214291706c06f053cb35c5b445605e222
Opcode Fuzzy Hash: 33aa3bc3a4d1318914e480ad88524f8f589a94fa845ea05bd4fcaccd5dda84c5
Instruction Fuzzy Hash: F8D092746002229FEA00AB9CD98CAC63BF8BB58302B400444EC15A2321F63AA408CE00

Function 1E8C5990 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 12COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,:GetVersion), ref: 1E8C599A
GetVersion.KERNEL32 ref: 1E8C59A8

Strings

:GetVersion, xrefs: 1E8C5994

Memory Dump Source

Source File: 00000011.00000002.1562490344.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 00000011.00000002.1562469835.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562490344.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562702731.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000011.00000002.1562730939.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_ParseTupleVersion
String ID: :GetVersion
API String ID: 322320466-235393037
Opcode ID: f8ca0e449184e12c242462229bf1263d67a67a025446e0bfa2461b1cc2d42e74
Instruction ID: edf8c9fea9b39d5e35d73d5f35fdeaf1007e9c7ca045f0ed5592c07d7c58a692
Opcode Fuzzy Hash: f8ca0e449184e12c242462229bf1263d67a67a025446e0bfa2461b1cc2d42e74
Instruction Fuzzy Hash: 98D0C974845312FFE7009F75CA8C5CA7BE5FA85386F808969F94DC3250E235D18ACB12

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create an account to maintain access to victim systems. With a sufficient level of access, creating such accounts may be used to establish secondary credentialed access that do not require persistent remote access tools to be deployed on the system.
Tactics:	Persistence
Data Sources:	Command: Command Execution, Process: Process Creation, User Account: User Account Creation
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use bootkits to persist on systems. Bootkits reside at a layer below the operating system and may make it difficult to perform full remediation unless an organization suspects one was used and can act accordingly.
Tactics:	Defense Evasion, Persistence
Data Sources:	Drive: Drive Modification
Platforms:	Linux, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads (ex: `rundll32.exe {DLLname, DLLfunction}` ).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 240506-b7lv1sfmcw_pw_infected.zip

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Bitcoin Miner

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

Spam, unwanted Advertisements and Ransom Demands

Protection of GUI

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\ProgramData\USOShared\Logs\System\UpdateSessionOrchestration.eee4f034-8eeb-4401-9a1e-ac155fc48dae.1.etl

C:\Users\user\AppData\Local\Temp\_MEI13602\Crypto.Cipher._AES.pyd

C:\Users\user\AppData\Local\Temp\_MEI13602\Include\pyconfig.h

C:\Users\user\AppData\Local\Temp\_MEI13602\Microsoft.VC90.CRT.manifest

C:\Users\user\AppData\Local\Temp\_MEI13602\_ctypes.pyd

C:\Users\user\AppData\Local\Temp\_MEI13602\_hashlib.pyd

C:\Users\user\AppData\Local\Temp\_MEI13602\_socket.pyd

Windows Analysis Report
240506-b7lv1sfmcw_pw_infected.zip

Description:	Adversaries may try to gather information about registered local system services. Adversaries may obtain information about services using tools as well as OS utility commands such as `sc query` , `tasklist /svc` , `systemctl --type=service` , and `net start` .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre