Edit tour

Windows Analysis Report
Wo0CkmOz64.exe

Overview

General Information

Sample name:	Wo0CkmOz64.exe renamed because original name is a hash value
Original sample name:	06b81c8edd7f620513a06e3a5cc11483.exe
Analysis ID:	1459120
MD5:	06b81c8edd7f620513a06e3a5cc11483
SHA1:	af4ffbf3510bb2e86387d26a6de309736548b340
SHA256:	65082d1a97a4636a529d3a52248ec1eed728fa78c1a3b3e34986e0378b393f1c
Tags:	32exetrojan
Infos:

Detection

PureLog Stealer

Score:	92
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for submitted file

Yara detected PureLog Stealer

.NET source code contains method to dynamically call methods (often used by packers)

.NET source code contains potential unpacker

.NET source code contains very large array initializations

AI detected suspicious sample

Machine Learning detection for sample

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Yara detected Costura Assembly Loader

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Contains long sleeps (>= 3 min)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

May sleep (evasive loops) to hinder dynamic analysis

Program does not show much activity (idle)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

Wo0CkmOz64.exe (PID: 2752 cmdline: "C:\Users\user\Desktop\Wo0CkmOz64.exe" MD5: 06B81C8EDD7F620513A06E3A5CC11483)

cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.3380383003.000000001BBA0000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000000.00000002.3379202075.000000001B690000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000000.00000002.3376338658.0000000012F41000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000000.00000002.3376338658.0000000013171000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000000.00000002.3376338658.0000000013171000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000000.00000002.3371913837.0000000002C11000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
Process Memory Space: Wo0CkmOz64.exe PID: 2752	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
Click to see the 2 entries

Unpacked PEs

Source	Rule	Description	Author
0.2.Wo0CkmOz64.exe.1bba0000.7.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
0.2.Wo0CkmOz64.exe.1b690000.6.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.2.Wo0CkmOz64.exe.1b690000.6.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.2.Wo0CkmOz64.exe.130312b8.5.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.2.Wo0CkmOz64.exe.130312b8.5.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.2.Wo0CkmOz64.exe.131712f0.3.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
0.2.Wo0CkmOz64.exe.131712f0.3.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.2.Wo0CkmOz64.exe.13281328.2.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
0.2.Wo0CkmOz64.exe.12fdae80.4.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.2.Wo0CkmOz64.exe.131712f0.3.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
0.2.Wo0CkmOz64.exe.131712f0.3.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
Click to see the 6 entries

Sigma Signatures

⊘No Sigma rule has matched

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: Wo0CkmOz64.exe

Avira: detected

Multi AV Scanner detection for submitted file

Source: Wo0CkmOz64.exe

ReversingLabs: Detection: 71%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.2% probability

Machine Learning detection for sample

Source: Wo0CkmOz64.exe

Joe Sandbox ML: detected

Source: Wo0CkmOz64.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: Msajjuwub.pdb source: Wo0CkmOz64.exe, 00000000.00000002.3376338658.0000000012F41000.00000004.00000800.00020000.00000000.sdmp, Wo0CkmOz64.exe, 00000000.00000002.3376338658.0000000013171000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: 74130c7c-3821-4585-8a44-d82d54fb894c<Module>costura.costura.dll.compressedcostura.dotnetzip.dll.compressedcostura.dotnetzip.pdb.compressedcostura.protobuf-net.dll.compressedMsajjuwub.g.resourcesaR3nbf8dQp2feLmk31.lSfgApatkdxsVcGcrktoFd.resources source: Wo0CkmOz64.exe, 00000000.00000002.3376338658.0000000013171000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: costura.dotnetzip.pdb.compressed source: Wo0CkmOz64.exe, 00000000.00000002.3376338658.0000000013171000.00000004.00000800.00020000.00000000.sdmp, Wo0CkmOz64.exe, 00000000.00000002.3371913837.0000000002C11000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: costura.dotnetzip.pdb.compressed source: Wo0CkmOz64.exe, 00000000.00000002.3371913837.0000000002C11000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: protobuf-net.pdbSHA256}Lq source: Wo0CkmOz64.exe, 00000000.00000002.3376338658.0000000013171000.00000004.00000800.00020000.00000000.sdmp, Wo0CkmOz64.exe, 00000000.00000002.3371838921.0000000002BB0000.00000004.08000000.00040000.00000000.sdmp, Wo0CkmOz64.exe, 00000000.00000002.3376338658.000000001336B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: protobuf-net.pdb source: Wo0CkmOz64.exe, 00000000.00000002.3376338658.0000000013171000.00000004.00000800.00020000.00000000.sdmp, Wo0CkmOz64.exe, 00000000.00000002.3371838921.0000000002BB0000.00000004.08000000.00040000.00000000.sdmp, Wo0CkmOz64.exe, 00000000.00000002.3376338658.000000001336B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: costura.dotnetzip.pdb.compressed8 source: Wo0CkmOz64.exe, 00000000.00000002.3371913837.0000000002C11000.00000004.00000800.00020000.00000000.sdmp

Source: global traffic

TCP traffic: 192.168.2.6:49711 -> 80.76.49.148:7702

Source: unknown	TCP traffic detected without corresponding DNS query: 80.76.49.148
Source: unknown	TCP traffic detected without corresponding DNS query: 80.76.49.148
Source: unknown	TCP traffic detected without corresponding DNS query: 80.76.49.148
Source: unknown	TCP traffic detected without corresponding DNS query: 80.76.49.148
Source: unknown	TCP traffic detected without corresponding DNS query: 80.76.49.148
Source: unknown	TCP traffic detected without corresponding DNS query: 80.76.49.148
Source: unknown	TCP traffic detected without corresponding DNS query: 80.76.49.148
Source: unknown	TCP traffic detected without corresponding DNS query: 80.76.49.148
Source: unknown	TCP traffic detected without corresponding DNS query: 80.76.49.148
Source: unknown	TCP traffic detected without corresponding DNS query: 80.76.49.148
Source: unknown	TCP traffic detected without corresponding DNS query: 80.76.49.148
Source: unknown	TCP traffic detected without corresponding DNS query: 80.76.49.148
Source: unknown	TCP traffic detected without corresponding DNS query: 80.76.49.148
Source: unknown	TCP traffic detected without corresponding DNS query: 80.76.49.148
Source: unknown	TCP traffic detected without corresponding DNS query: 80.76.49.148
Source: unknown	TCP traffic detected without corresponding DNS query: 80.76.49.148
Source: unknown	TCP traffic detected without corresponding DNS query: 80.76.49.148
Source: unknown	TCP traffic detected without corresponding DNS query: 80.76.49.148
Source: unknown	TCP traffic detected without corresponding DNS query: 80.76.49.148
Source: unknown	TCP traffic detected without corresponding DNS query: 80.76.49.148
Source: unknown	TCP traffic detected without corresponding DNS query: 80.76.49.148
Source: unknown	TCP traffic detected without corresponding DNS query: 80.76.49.148
Source: unknown	TCP traffic detected without corresponding DNS query: 80.76.49.148
Source: unknown	TCP traffic detected without corresponding DNS query: 80.76.49.148
Source: unknown	TCP traffic detected without corresponding DNS query: 80.76.49.148
Source: unknown	TCP traffic detected without corresponding DNS query: 80.76.49.148
Source: unknown	TCP traffic detected without corresponding DNS query: 80.76.49.148
Source: unknown	TCP traffic detected without corresponding DNS query: 80.76.49.148
Source: unknown	TCP traffic detected without corresponding DNS query: 80.76.49.148
Source: unknown	TCP traffic detected without corresponding DNS query: 80.76.49.148
Source: unknown	TCP traffic detected without corresponding DNS query: 80.76.49.148
Source: unknown	TCP traffic detected without corresponding DNS query: 80.76.49.148
Source: unknown	TCP traffic detected without corresponding DNS query: 80.76.49.148
Source: unknown	TCP traffic detected without corresponding DNS query: 80.76.49.148
Source: unknown	TCP traffic detected without corresponding DNS query: 80.76.49.148
Source: unknown	TCP traffic detected without corresponding DNS query: 80.76.49.148
Source: unknown	TCP traffic detected without corresponding DNS query: 80.76.49.148
Source: unknown	TCP traffic detected without corresponding DNS query: 80.76.49.148
Source: unknown	TCP traffic detected without corresponding DNS query: 80.76.49.148
Source: unknown	TCP traffic detected without corresponding DNS query: 80.76.49.148
Source: unknown	TCP traffic detected without corresponding DNS query: 80.76.49.148
Source: unknown	TCP traffic detected without corresponding DNS query: 80.76.49.148
Source: unknown	TCP traffic detected without corresponding DNS query: 80.76.49.148
Source: unknown	TCP traffic detected without corresponding DNS query: 80.76.49.148
Source: unknown	TCP traffic detected without corresponding DNS query: 80.76.49.148
Source: unknown	TCP traffic detected without corresponding DNS query: 80.76.49.148
Source: unknown	TCP traffic detected without corresponding DNS query: 80.76.49.148
Source: unknown	TCP traffic detected without corresponding DNS query: 80.76.49.148
Source: unknown	TCP traffic detected without corresponding DNS query: 80.76.49.148
Source: unknown	TCP traffic detected without corresponding DNS query: 80.76.49.148

Source: Wo0CkmOz64.exe, 00000000.00000002.3371913837.0000000002C11000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://archive.torproject.org/tor-package-archive/torbrowser/13.0.9/tor-expert-bundle-windows-i686-
Source: Wo0CkmOz64.exe, 00000000.00000002.3376338658.0000000013171000.00000004.00000800.00020000.00000000.sdmp, Wo0CkmOz64.exe, 00000000.00000002.3371838921.0000000002BB0000.00000004.08000000.00040000.00000000.sdmp, Wo0CkmOz64.exe, 00000000.00000002.3376338658.000000001336B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-net
Source: Wo0CkmOz64.exe, 00000000.00000002.3376338658.0000000013171000.00000004.00000800.00020000.00000000.sdmp, Wo0CkmOz64.exe, 00000000.00000002.3371838921.0000000002BB0000.00000004.08000000.00040000.00000000.sdmp, Wo0CkmOz64.exe, 00000000.00000002.3376338658.000000001336B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-netJ
Source: Wo0CkmOz64.exe, 00000000.00000002.3376338658.0000000013171000.00000004.00000800.00020000.00000000.sdmp, Wo0CkmOz64.exe, 00000000.00000002.3371838921.0000000002BB0000.00000004.08000000.00040000.00000000.sdmp, Wo0CkmOz64.exe, 00000000.00000002.3376338658.000000001336B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-neti
Source: Wo0CkmOz64.exe, 00000000.00000002.3376338658.0000000013171000.00000004.00000800.00020000.00000000.sdmp, Wo0CkmOz64.exe, 00000000.00000002.3371838921.0000000002BB0000.00000004.08000000.00040000.00000000.sdmp, Wo0CkmOz64.exe, 00000000.00000002.3376338658.000000001336B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/11564914/23354;
Source: Wo0CkmOz64.exe, 00000000.00000002.3376338658.0000000013171000.00000004.00000800.00020000.00000000.sdmp, Wo0CkmOz64.exe, 00000000.00000002.3371838921.0000000002BB0000.00000004.08000000.00040000.00000000.sdmp, Wo0CkmOz64.exe, 00000000.00000002.3371913837.0000000002C11000.00000004.00000800.00020000.00000000.sdmp, Wo0CkmOz64.exe, 00000000.00000002.3376338658.000000001336B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/14436606/23354
Source: Wo0CkmOz64.exe, 00000000.00000002.3376338658.0000000013171000.00000004.00000800.00020000.00000000.sdmp, Wo0CkmOz64.exe, 00000000.00000002.3371838921.0000000002BB0000.00000004.08000000.00040000.00000000.sdmp, Wo0CkmOz64.exe, 00000000.00000002.3376338658.000000001336B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/2152978/23354

System Summary

.NET source code contains very large array initializations

Source: Wo0CkmOz64.exe, Program.cs

Large array initialization: Main: array initializer size 849520

Source: C:\Users\user\Desktop\Wo0CkmOz64.exe	Code function: 0_2_00007FFD346772D3	0_2_00007FFD346772D3
Source: C:\Users\user\Desktop\Wo0CkmOz64.exe	Code function: 0_2_00007FFD346743B0	0_2_00007FFD346743B0
Source: C:\Users\user\Desktop\Wo0CkmOz64.exe	Code function: 0_2_00007FFD346734D3	0_2_00007FFD346734D3
Source: C:\Users\user\Desktop\Wo0CkmOz64.exe	Code function: 0_2_00007FFD346740FA	0_2_00007FFD346740FA
Source: C:\Users\user\Desktop\Wo0CkmOz64.exe	Code function: 0_2_00007FFD346729FA	0_2_00007FFD346729FA
Source: C:\Users\user\Desktop\Wo0CkmOz64.exe	Code function: 0_2_00007FFD34673387	0_2_00007FFD34673387
Source: C:\Users\user\Desktop\Wo0CkmOz64.exe	Code function: 0_2_00007FFD347713D4	0_2_00007FFD347713D4
Source: C:\Users\user\Desktop\Wo0CkmOz64.exe	Code function: 0_2_00007FFD347705D4	0_2_00007FFD347705D4

Source: Wo0CkmOz64.exe, 00000000.00000002.3376338658.0000000012F41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMsajjuwub.dll" vs Wo0CkmOz64.exe
Source: Wo0CkmOz64.exe, 00000000.00000000.2130169567.0000000000A54000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameDniblceid.exe" vs Wo0CkmOz64.exe
Source: Wo0CkmOz64.exe, 00000000.00000002.3376338658.0000000013171000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMsajjuwub.dll" vs Wo0CkmOz64.exe
Source: Wo0CkmOz64.exe, 00000000.00000002.3376338658.0000000013171000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameprotobuf-net.dllJ vs Wo0CkmOz64.exe
Source: Wo0CkmOz64.exe, 00000000.00000002.3371838921.0000000002BB0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameprotobuf-net.dllJ vs Wo0CkmOz64.exe
Source: Wo0CkmOz64.exe, 00000000.00000002.3376338658.000000001336B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameprotobuf-net.dllJ vs Wo0CkmOz64.exe
Source: Wo0CkmOz64.exe	Binary or memory string: OriginalFilenameDniblceid.exe" vs Wo0CkmOz64.exe

Source: Wo0CkmOz64.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: Wo0CkmOz64.exe, Program.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.Wo0CkmOz64.exe.130312b8.5.raw.unpack, ixTk49fcGhAJ2sgoDPl.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.Wo0CkmOz64.exe.130312b8.5.raw.unpack, ixTk49fcGhAJ2sgoDPl.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.Wo0CkmOz64.exe.130312b8.5.raw.unpack, ixTk49fcGhAJ2sgoDPl.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.Wo0CkmOz64.exe.131712f0.3.raw.unpack, ixTk49fcGhAJ2sgoDPl.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.Wo0CkmOz64.exe.131712f0.3.raw.unpack, ixTk49fcGhAJ2sgoDPl.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.Wo0CkmOz64.exe.131712f0.3.raw.unpack, ixTk49fcGhAJ2sgoDPl.cs	Cryptographic APIs: 'CreateDecryptor'

Source: classification engine

Classification label: mal92.troj.evad.winEXE@1/0@0/1

Source: C:\Users\user\Desktop\Wo0CkmOz64.exe	Mutant created: NULL
Source: C:\Users\user\Desktop\Wo0CkmOz64.exe	Mutant created: \Sessions\1\BaseNamedObjects\f1bf4db99626c2f2

Source: Wo0CkmOz64.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: Wo0CkmOz64.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Users\user\Desktop\Wo0CkmOz64.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Wo0CkmOz64.exe

ReversingLabs: Detection: 71%

Source: C:\Users\user\Desktop\Wo0CkmOz64.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wo0CkmOz64.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wo0CkmOz64.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wo0CkmOz64.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wo0CkmOz64.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wo0CkmOz64.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wo0CkmOz64.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wo0CkmOz64.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wo0CkmOz64.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wo0CkmOz64.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wo0CkmOz64.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wo0CkmOz64.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wo0CkmOz64.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wo0CkmOz64.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wo0CkmOz64.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wo0CkmOz64.exe	Section loaded: mswsock.dll	Jump to behavior

Source: C:\Users\user\Desktop\Wo0CkmOz64.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\Wo0CkmOz64.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: Wo0CkmOz64.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: Wo0CkmOz64.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: Wo0CkmOz64.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: Msajjuwub.pdb source: Wo0CkmOz64.exe, 00000000.00000002.3376338658.0000000012F41000.00000004.00000800.00020000.00000000.sdmp, Wo0CkmOz64.exe, 00000000.00000002.3376338658.0000000013171000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: 74130c7c-3821-4585-8a44-d82d54fb894c<Module>costura.costura.dll.compressedcostura.dotnetzip.dll.compressedcostura.dotnetzip.pdb.compressedcostura.protobuf-net.dll.compressedMsajjuwub.g.resourcesaR3nbf8dQp2feLmk31.lSfgApatkdxsVcGcrktoFd.resources source: Wo0CkmOz64.exe, 00000000.00000002.3376338658.0000000013171000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: costura.dotnetzip.pdb.compressed source: Wo0CkmOz64.exe, 00000000.00000002.3376338658.0000000013171000.00000004.00000800.00020000.00000000.sdmp, Wo0CkmOz64.exe, 00000000.00000002.3371913837.0000000002C11000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: costura.dotnetzip.pdb.compressed source: Wo0CkmOz64.exe, 00000000.00000002.3371913837.0000000002C11000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: protobuf-net.pdbSHA256}Lq source: Wo0CkmOz64.exe, 00000000.00000002.3376338658.0000000013171000.00000004.00000800.00020000.00000000.sdmp, Wo0CkmOz64.exe, 00000000.00000002.3371838921.0000000002BB0000.00000004.08000000.00040000.00000000.sdmp, Wo0CkmOz64.exe, 00000000.00000002.3376338658.000000001336B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: protobuf-net.pdb source: Wo0CkmOz64.exe, 00000000.00000002.3376338658.0000000013171000.00000004.00000800.00020000.00000000.sdmp, Wo0CkmOz64.exe, 00000000.00000002.3371838921.0000000002BB0000.00000004.08000000.00040000.00000000.sdmp, Wo0CkmOz64.exe, 00000000.00000002.3376338658.000000001336B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: costura.dotnetzip.pdb.compressed8 source: Wo0CkmOz64.exe, 00000000.00000002.3371913837.0000000002C11000.00000004.00000800.00020000.00000000.sdmp

Data Obfuscation

.NET source code contains method to dynamically call methods (often used by packers)

Source: 0.2.Wo0CkmOz64.exe.130312b8.5.raw.unpack, ixTk49fcGhAJ2sgoDPl.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})
Source: 0.2.Wo0CkmOz64.exe.131712f0.3.raw.unpack, ixTk49fcGhAJ2sgoDPl.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})

.NET source code contains potential unpacker

Source: Wo0CkmOz64.exe, Program.cs	.Net Code: Main System.Reflection.Assembly.Load(byte[])
Source: 0.2.Wo0CkmOz64.exe.2bb0000.1.raw.unpack, TypeModel.cs	.Net Code: TryDeserializeList
Source: 0.2.Wo0CkmOz64.exe.2bb0000.1.raw.unpack, ListDecorator.cs	.Net Code: Read
Source: 0.2.Wo0CkmOz64.exe.2bb0000.1.raw.unpack, TypeSerializer.cs	.Net Code: CreateInstance
Source: 0.2.Wo0CkmOz64.exe.2bb0000.1.raw.unpack, TypeSerializer.cs	.Net Code: EmitCreateInstance
Source: 0.2.Wo0CkmOz64.exe.2bb0000.1.raw.unpack, TypeSerializer.cs	.Net Code: EmitCreateIfNull

Yara detected Costura Assembly Loader

Source: Yara match	File source: 0.2.Wo0CkmOz64.exe.1bba0000.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Wo0CkmOz64.exe.131712f0.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Wo0CkmOz64.exe.13281328.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Wo0CkmOz64.exe.131712f0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.3380383003.000000001BBA0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.3376338658.0000000013171000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.3371913837.0000000002C11000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Wo0CkmOz64.exe PID: 2752, type: MEMORYSTR

Source: Wo0CkmOz64.exe

Static PE information: 0xC8E3E1A2 [Tue Oct 20 00:00:34 2076 UTC]

Source: C:\Users\user\Desktop\Wo0CkmOz64.exe	Code function: 0_2_00007FFD3467BDDA push es; iretd	0_2_00007FFD3467BDDF
Source: C:\Users\user\Desktop\Wo0CkmOz64.exe	Code function: 0_2_00007FFD34670E55 push ebx; ret	0_2_00007FFD34670E6A
Source: C:\Users\user\Desktop\Wo0CkmOz64.exe	Code function: 0_2_00007FFD347739B8 pushad ; retf	0_2_00007FFD347739B9

Source: Wo0CkmOz64.exe

Static PE information: section name: .text entropy: 7.999487700871465

Source: 0.2.Wo0CkmOz64.exe.130312b8.5.raw.unpack, Y2lLZcbSYWt9UP9rF7.cs	High entropy of concatenated method names: 'OPE0mL6RM', 'amhzaWG7D', 'xSK4X3fqaj', 'weU44KmgRV', 'x7X4KrV49G', 'LLS4evHfen', 'z3U4darRRK', 'Nlr4m7yH7I', 'wXL4JU8I4P', 'PZW4Y9DtVn'
Source: 0.2.Wo0CkmOz64.exe.130312b8.5.raw.unpack, AssemblyLoader.cs	High entropy of concatenated method names: 'CultureToString', 'ReadExistingAssembly', 'CopyTo', 'LoadStream', 'LoadStream', 'ReadStream', 'ReadFromEmbeddedResources', 'ResolveAssembly', 'Attach', 'ibP1P0u5rrp3VJbKq47'
Source: 0.2.Wo0CkmOz64.exe.130312b8.5.raw.unpack, gAeOsta063lyJEOOAwv.cs	High entropy of concatenated method names: 'EDKs6mxP25', 'e2FsLaSBvn', 'Q2ksTi1BIb', 'ND1s5Juqq7', 'sIbs8MwiEE', 'YqVs1vbi9w', 'sbusAYPU96', 'XXxhpSv9Dy', 'v9gsH604Ok', 'l68suULumv'
Source: 0.2.Wo0CkmOz64.exe.130312b8.5.raw.unpack, ixTk49fcGhAJ2sgoDPl.cs	High entropy of concatenated method names: 'SQQ9SLDtcCWavixBCma', 'EO6PV9D7VYR6pQw11Me', 'xmbaCCGGr7', 'NsKJigDPaVWkLp0vcVV', 'rSxuMPDndnPj8eZrpdR', 'QGTD51DWCjyUP69NmQk', 'isk9ngDUqv54HqZOvx8', 'wXgJa5DwvBWhCUB4dHF', 'T4WiVKDZR5U4nsojT33', 'FFHa4ADRcIhMkabc29V'
Source: 0.2.Wo0CkmOz64.exe.130312b8.5.raw.unpack, W4sJouaB4OvhNNX2KbG.cs	High entropy of concatenated method names: 'DHbaFapw8d', 'YBiaPYQbOS', 'nQManmQEs3', 'WnjaWkekEO', 'QE8aUmC191', 'pqeawkLeP0', 'xCIaZAU4y3', 'DdnaR0f1KN', 'xx6abZpsSB', 'i0yakyWOe3'
Source: 0.2.Wo0CkmOz64.exe.131712f0.3.raw.unpack, Y2lLZcbSYWt9UP9rF7.cs	High entropy of concatenated method names: 'OPE0mL6RM', 'amhzaWG7D', 'xSK4X3fqaj', 'weU44KmgRV', 'x7X4KrV49G', 'LLS4evHfen', 'z3U4darRRK', 'Nlr4m7yH7I', 'wXL4JU8I4P', 'PZW4Y9DtVn'
Source: 0.2.Wo0CkmOz64.exe.131712f0.3.raw.unpack, AssemblyLoader.cs	High entropy of concatenated method names: 'CultureToString', 'ReadExistingAssembly', 'CopyTo', 'LoadStream', 'LoadStream', 'ReadStream', 'ReadFromEmbeddedResources', 'ResolveAssembly', 'Attach', 'ibP1P0u5rrp3VJbKq47'
Source: 0.2.Wo0CkmOz64.exe.131712f0.3.raw.unpack, gAeOsta063lyJEOOAwv.cs	High entropy of concatenated method names: 'EDKs6mxP25', 'e2FsLaSBvn', 'Q2ksTi1BIb', 'ND1s5Juqq7', 'sIbs8MwiEE', 'YqVs1vbi9w', 'sbusAYPU96', 'XXxhpSv9Dy', 'v9gsH604Ok', 'l68suULumv'
Source: 0.2.Wo0CkmOz64.exe.131712f0.3.raw.unpack, ixTk49fcGhAJ2sgoDPl.cs	High entropy of concatenated method names: 'SQQ9SLDtcCWavixBCma', 'EO6PV9D7VYR6pQw11Me', 'xmbaCCGGr7', 'NsKJigDPaVWkLp0vcVV', 'rSxuMPDndnPj8eZrpdR', 'QGTD51DWCjyUP69NmQk', 'isk9ngDUqv54HqZOvx8', 'wXgJa5DwvBWhCUB4dHF', 'T4WiVKDZR5U4nsojT33', 'FFHa4ADRcIhMkabc29V'
Source: 0.2.Wo0CkmOz64.exe.131712f0.3.raw.unpack, W4sJouaB4OvhNNX2KbG.cs	High entropy of concatenated method names: 'DHbaFapw8d', 'YBiaPYQbOS', 'nQManmQEs3', 'WnjaWkekEO', 'QE8aUmC191', 'pqeawkLeP0', 'xCIaZAU4y3', 'DdnaR0f1KN', 'xx6abZpsSB', 'i0yakyWOe3'

Source: C:\Users\user\Desktop\Wo0CkmOz64.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wo0CkmOz64.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wo0CkmOz64.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wo0CkmOz64.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wo0CkmOz64.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wo0CkmOz64.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wo0CkmOz64.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wo0CkmOz64.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wo0CkmOz64.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wo0CkmOz64.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wo0CkmOz64.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wo0CkmOz64.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wo0CkmOz64.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wo0CkmOz64.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wo0CkmOz64.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wo0CkmOz64.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wo0CkmOz64.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wo0CkmOz64.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wo0CkmOz64.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wo0CkmOz64.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wo0CkmOz64.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wo0CkmOz64.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wo0CkmOz64.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wo0CkmOz64.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wo0CkmOz64.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wo0CkmOz64.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wo0CkmOz64.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wo0CkmOz64.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wo0CkmOz64.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wo0CkmOz64.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wo0CkmOz64.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wo0CkmOz64.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wo0CkmOz64.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wo0CkmOz64.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: Wo0CkmOz64.exe, 00000000.00000002.3371913837.0000000002C11000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: SBIEDLL.DLL0SELECT * FROM WIN32_BIOS8UNEXPECTED WMI QUERY FAILURE

Source: C:\Users\user\Desktop\Wo0CkmOz64.exe	Memory allocated: 1080000 memory reserve \| memory write watch			Jump to behavior
Source: C:\Users\user\Desktop\Wo0CkmOz64.exe	Memory allocated: 1AC10000 memory reserve \| memory write watch			Jump to behavior

Source: C:\Users\user\Desktop\Wo0CkmOz64.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Users\user\Desktop\Wo0CkmOz64.exe	Window / User API: threadDelayed 3907			Jump to behavior
Source: C:\Users\user\Desktop\Wo0CkmOz64.exe	Window / User API: threadDelayed 6028			Jump to behavior

Source: C:\Users\user\Desktop\Wo0CkmOz64.exe TID: 4900	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Wo0CkmOz64.exe TID: 4156	Thread sleep count: 3907 > 30	Jump to behavior
Source: C:\Users\user\Desktop\Wo0CkmOz64.exe TID: 4156	Thread sleep count: 6028 > 30	Jump to behavior
Source: C:\Users\user\Desktop\Wo0CkmOz64.exe TID: 4900	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\Wo0CkmOz64.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: Wo0CkmOz64.exe, 00000000.00000002.3371913837.0000000002C11000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 0VMware\|VIRTUAL\|A M I\|XenDselect * from Win32_ComputerSystem
Source: Wo0CkmOz64.exe, 00000000.00000002.3371913837.0000000002C11000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: model0Microsoft\|VMWare\|Virtual
Source: Wo0CkmOz64.exe, 00000000.00000002.3379823672.000000001BAC0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\Wo0CkmOz64.exe

Process token adjusted: Debug

Jump to behavior

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\Wo0CkmOz64.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\Wo0CkmOz64.exe

Queries volume information: C:\Users\user\Desktop\Wo0CkmOz64.exe VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\Wo0CkmOz64.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected PureLog Stealer

Source: Yara match	File source: 0.2.Wo0CkmOz64.exe.1b690000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Wo0CkmOz64.exe.1b690000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Wo0CkmOz64.exe.130312b8.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Wo0CkmOz64.exe.130312b8.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Wo0CkmOz64.exe.131712f0.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Wo0CkmOz64.exe.12fdae80.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Wo0CkmOz64.exe.131712f0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.3379202075.000000001B690000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.3376338658.0000000012F41000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.3376338658.0000000013171000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Remote Access Functionality

Yara detected PureLog Stealer

Source: Yara match	File source: 0.2.Wo0CkmOz64.exe.1b690000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Wo0CkmOz64.exe.1b690000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Wo0CkmOz64.exe.130312b8.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Wo0CkmOz64.exe.130312b8.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Wo0CkmOz64.exe.131712f0.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Wo0CkmOz64.exe.12fdae80.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Wo0CkmOz64.exe.131712f0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.3379202075.000000001B690000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.3376338658.0000000012F41000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.3376338658.0000000013171000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	OS Credential Dumping	11 Security Software Discovery	Remote Services	11 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	31 Virtualization/Sandbox Evasion	LSASS Memory	31 Virtualization/Sandbox Evasion	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Deobfuscate/Decode Files or Information	Security Account Manager	1 Application Window Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	2 Obfuscated Files or Information	NTDS	12 System Information Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	22 Software Packing	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Timestomp	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label
Wo0CkmOz64.exe	71%	ReversingLabs	ByteCode-MSIL.Trojan.PureLogStealer
Wo0CkmOz64.exe	100%	Avira	TR/Dropper.Gen
Wo0CkmOz64.exe	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
https://github.com/mgravell/protobuf-netJ	0%	Avira URL Cloud	safe
https://github.com/mgravell/protobuf-neti	0%	Avira URL Cloud	safe
https://github.com/mgravell/protobuf-net	0%	Avira URL Cloud	safe
https://stackoverflow.com/q/14436606/23354	0%	Avira URL Cloud	safe
https://stackoverflow.com/q/2152978/23354	0%	Avira URL Cloud	safe
https://stackoverflow.com/q/11564914/23354;	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

⊘No contacted domains info

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://github.com/mgravell/protobuf-net	Wo0CkmOz64.exe, 00000000.00000002.3376338658.0000000013171000.00000004.00000800.00020000.00000000.sdmp, Wo0CkmOz64.exe, 00000000.00000002.3371838921.0000000002BB0000.00000004.08000000.00040000.00000000.sdmp, Wo0CkmOz64.exe, 00000000.00000002.3376338658.000000001336B000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/mgravell/protobuf-neti	Wo0CkmOz64.exe, 00000000.00000002.3376338658.0000000013171000.00000004.00000800.00020000.00000000.sdmp, Wo0CkmOz64.exe, 00000000.00000002.3371838921.0000000002BB0000.00000004.08000000.00040000.00000000.sdmp, Wo0CkmOz64.exe, 00000000.00000002.3376338658.000000001336B000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://stackoverflow.com/q/14436606/23354	Wo0CkmOz64.exe, 00000000.00000002.3376338658.0000000013171000.00000004.00000800.00020000.00000000.sdmp, Wo0CkmOz64.exe, 00000000.00000002.3371838921.0000000002BB0000.00000004.08000000.00040000.00000000.sdmp, Wo0CkmOz64.exe, 00000000.00000002.3371913837.0000000002C11000.00000004.00000800.00020000.00000000.sdmp, Wo0CkmOz64.exe, 00000000.00000002.3376338658.000000001336B000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/mgravell/protobuf-netJ	Wo0CkmOz64.exe, 00000000.00000002.3376338658.0000000013171000.00000004.00000800.00020000.00000000.sdmp, Wo0CkmOz64.exe, 00000000.00000002.3371838921.0000000002BB0000.00000004.08000000.00040000.00000000.sdmp, Wo0CkmOz64.exe, 00000000.00000002.3376338658.000000001336B000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://stackoverflow.com/q/11564914/23354;	Wo0CkmOz64.exe, 00000000.00000002.3376338658.0000000013171000.00000004.00000800.00020000.00000000.sdmp, Wo0CkmOz64.exe, 00000000.00000002.3371838921.0000000002BB0000.00000004.08000000.00040000.00000000.sdmp, Wo0CkmOz64.exe, 00000000.00000002.3376338658.000000001336B000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://stackoverflow.com/q/2152978/23354	Wo0CkmOz64.exe, 00000000.00000002.3376338658.0000000013171000.00000004.00000800.00020000.00000000.sdmp, Wo0CkmOz64.exe, 00000000.00000002.3371838921.0000000002BB0000.00000004.08000000.00040000.00000000.sdmp, Wo0CkmOz64.exe, 00000000.00000002.3376338658.000000001336B000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
80.76.49.148	unknown	Bulgaria		43659	CLOUDCOMPUTINGDE	false

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1459120
Start date and time:	2024-06-18 21:17:12 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 51s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Wo0CkmOz64.exe renamed because original name is a hash value
Original Sample Name:	06b81c8edd7f620513a06e3a5cc11483.exe
Detection:	MAL
Classification:	mal92.troj.evad.winEXE@1/0@0/1
EGA Information:	Failed
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, svchost.exe
Excluded domains from analysis (whitelisted): client.wns.windows.com, ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target Wo0CkmOz64.exe, PID 2752 because it is empty
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: Wo0CkmOz64.exe

Simulations

Behavior and APIs

⊘No simulations

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
80.76.49.148	kedkWql9QT.exe	Get hash	malicious	PureLog Stealer	Browse
	CnmvELQWAS.exe	Get hash	malicious	PureLog Stealer	Browse
	2IKiv37X2P.exe	Get hash	malicious	PureLog Stealer	Browse
	TiM9oz608f.exe	Get hash	malicious	PureLog Stealer	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDCOMPUTINGDE	kedkWql9QT.exe	Get hash	malicious	PureLog Stealer	Browse	80.76.49.148
	CnmvELQWAS.exe	Get hash	malicious	PureLog Stealer	Browse	80.76.49.148
	2IKiv37X2P.exe	Get hash	malicious	PureLog Stealer	Browse	80.76.49.148
	UlS9404Fb2.exe	Get hash	malicious	PureLog Stealer	Browse	80.76.49.162
	TiM9oz608f.exe	Get hash	malicious	PureLog Stealer	Browse	80.76.49.148
	Yeni sipari#U015f.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	194.169.175.179
	hjjm5bDMeZ.exe	Get hash	malicious	Unknown	Browse	185.216.70.126
	file.exe	Get hash	malicious	Unknown	Browse	185.216.68.152
	New Order Ref AKPL-31059904_QTY.js	Get hash	malicious	Unknown	Browse	185.216.70.134
	jjC1tHQTSX.exe	Get hash	malicious	AsyncRAT, VenomRAT	Browse	80.76.49.162

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.998288715406636
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	Wo0CkmOz64.exe
File size:	856'064 bytes
MD5:	06b81c8edd7f620513a06e3a5cc11483
SHA1:	af4ffbf3510bb2e86387d26a6de309736548b340
SHA256:	65082d1a97a4636a529d3a52248ec1eed728fa78c1a3b3e34986e0378b393f1c
SHA512:	9d80d9208d778779538cf5075b4018dc8b8d037a9d07c961ce2389580290df050929876d1adc2489f7dc5f6c1466cde7d21b9152185e88ba0601e4dd2da4aec7
SSDEEP:	24576:fI0eDXhXsbQSa0t2xiewR2rpXN/L+9+dClWdD9:AVebQzxieHpXNL+jWdD
TLSH:	8E05336341660B90EC3B31B91B5CBB85D3B4F45DB278AB7184FD3745D6C2D4C8A2A8E8
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................."...0.............&/... ...@....@.. ....................................@................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x402f26
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0xC8E3E1A2 [Tue Oct 20 00:00:34 2076 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
popfd
mov ah, 28h
xor edi, dword ptr [ebx+1A3F4A74h]
add dword ptr [ebp-2Ah], edx
mov ah, FBh
mov ebp, 50AC891Eh
push ecx
int D0h
popfd
mov eax, dword ptr [E5F0278Dh]
inc ebp
or dword ptr [eax], ecx
fld tbyte ptr [edi+125D0849h]
cmp al, C9h
add ecx, dword ptr [ebx-16h]
xchg eax, esi
push cs
retn FD36h
insd
mov edi, ebp
xchg eax, edx
sbb dl, byte ptr [eax]
inc eax
salc
scasd
add dword ptr [ecx+ecx*8], 11CB4B64h
cmp eax, C89BE90Dh
out dx, eax
scasd
add byte ptr [edx-346D90F2h], ch

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x2ed4	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xd4000	0x56c	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xd6000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x2eb8	0x1c	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xd05a0	0xd0600	770641f1a98083bf31fa95fdbdd86bf1	False	0.9987686056538693	data	7.999487700871465	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xd4000	0x56c	0x600	8a873b0a97c1a8a85796cbb4935c6f9c	False	0.3997395833333333	data	3.9339981650904186	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xd6000	0xc	0x200	34aa1c7f786d5445ac690bf61d2e9e0f	False	0.044921875	data	0.08153941234324169	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0xd4090	0x2dc	data			0.43306010928961747
RT_MANIFEST	0xd437c	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jun 18, 2024 21:18:09.141510963 CEST	49711	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:09.146845102 CEST	7702	49711	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:09.146953106 CEST	49711	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:10.540179014 CEST	7702	49711	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:10.540246010 CEST	49711	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:10.549874067 CEST	49711	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:10.554729939 CEST	7702	49711	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:10.560682058 CEST	49713	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:10.566210032 CEST	7702	49713	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:10.566281080 CEST	49713	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:11.982278109 CEST	7702	49713	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:11.982376099 CEST	49713	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:11.982599974 CEST	49713	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:11.983155012 CEST	49714	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:11.987298012 CEST	7702	49713	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:11.987919092 CEST	7702	49714	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:11.987993956 CEST	49714	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:13.382674932 CEST	7702	49714	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:13.382740021 CEST	49714	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:13.382854939 CEST	49714	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:13.383271933 CEST	49715	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:13.388106108 CEST	7702	49714	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:13.388565063 CEST	7702	49715	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:13.388863087 CEST	49715	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:13.396214008 CEST	7702	49715	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:13.396260977 CEST	49715	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:13.396333933 CEST	49715	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:13.396646976 CEST	49716	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:13.401057005 CEST	7702	49715	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:13.401371002 CEST	7702	49716	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:13.401473045 CEST	49716	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:13.409975052 CEST	7702	49716	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:13.410023928 CEST	49716	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:13.991096973 CEST	49716	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:13.991787910 CEST	49717	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:13.996259928 CEST	7702	49716	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:13.996879101 CEST	7702	49717	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:13.997111082 CEST	49717	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:14.323818922 CEST	49717	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:14.329365015 CEST	7702	49717	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:14.329411983 CEST	49717	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:14.334270000 CEST	7702	49717	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:15.399308920 CEST	7702	49717	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:15.399378061 CEST	49717	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:15.399513006 CEST	49717	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:15.399935961 CEST	49718	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:15.405038118 CEST	7702	49717	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:15.405102968 CEST	7702	49718	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:15.405189991 CEST	49718	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:15.581182003 CEST	49718	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:15.586077929 CEST	7702	49718	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:15.586124897 CEST	49718	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:15.593799114 CEST	7702	49718	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:16.790262938 CEST	7702	49718	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:16.790333986 CEST	49718	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:16.790457964 CEST	49718	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:16.790992022 CEST	49719	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:16.800076962 CEST	7702	49718	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:16.801033020 CEST	7702	49719	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:16.801131964 CEST	49719	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:17.002578020 CEST	49719	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:17.009890079 CEST	7702	49719	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:17.009975910 CEST	49719	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:17.019483089 CEST	7702	49719	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:18.194920063 CEST	7702	49719	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:18.195035934 CEST	49719	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:18.195199013 CEST	49719	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:18.195784092 CEST	49721	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:18.200634956 CEST	7702	49719	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:18.200651884 CEST	7702	49721	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:18.200747013 CEST	49721	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:18.393647909 CEST	49721	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:18.398709059 CEST	7702	49721	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:18.398766994 CEST	49721	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:18.403701067 CEST	7702	49721	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:18.408972025 CEST	49721	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:18.413930893 CEST	7702	49721	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:18.413995028 CEST	49721	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:18.418946981 CEST	7702	49721	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:19.002813101 CEST	49721	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:19.007709980 CEST	7702	49721	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:19.007766962 CEST	49721	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:19.013520956 CEST	7702	49721	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:19.652283907 CEST	7702	49721	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:19.652350903 CEST	49721	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:19.652503014 CEST	49721	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:19.652857065 CEST	49722	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:19.666204929 CEST	7702	49721	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:19.666533947 CEST	7702	49722	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:19.666600943 CEST	49722	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:19.697191954 CEST	7702	49722	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:19.697257996 CEST	49722	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:19.697381973 CEST	49722	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:19.697760105 CEST	49723	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:19.705105066 CEST	7702	49722	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:19.705118895 CEST	7702	49723	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:19.705209970 CEST	49723	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:19.719852924 CEST	7702	49723	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:19.719932079 CEST	49723	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:19.720067978 CEST	49723	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:19.720402002 CEST	49724	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:19.725369930 CEST	7702	49723	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:19.725393057 CEST	7702	49724	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:19.725469112 CEST	49724	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:20.408788919 CEST	49724	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:20.413746119 CEST	7702	49724	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:20.413830996 CEST	49724	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:20.418637037 CEST	7702	49724	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:21.138879061 CEST	7702	49724	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:21.139060020 CEST	49724	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:21.139113903 CEST	49724	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:21.139754057 CEST	49725	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:21.144038916 CEST	7702	49724	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:21.145503998 CEST	7702	49725	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:21.145720959 CEST	49725	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:21.815045118 CEST	49725	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:21.819897890 CEST	7702	49725	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:21.819958925 CEST	49725	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:21.824692011 CEST	7702	49725	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:22.537446022 CEST	7702	49725	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:22.537739992 CEST	49725	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:22.543294907 CEST	49725	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:22.543703079 CEST	49726	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:22.548293114 CEST	7702	49725	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:22.549221992 CEST	7702	49726	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:22.549290895 CEST	49726	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:23.206059933 CEST	49726	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:23.213921070 CEST	7702	49726	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:23.214026928 CEST	49726	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:23.222740889 CEST	7702	49726	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:23.947216034 CEST	7702	49726	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:23.947300911 CEST	49726	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:23.947436094 CEST	49726	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:23.947999001 CEST	49728	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:23.952227116 CEST	7702	49726	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:23.952790976 CEST	7702	49728	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:23.952852964 CEST	49728	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:23.958636045 CEST	7702	49728	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:23.958697081 CEST	49728	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:23.958780050 CEST	49728	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:23.959146976 CEST	49729	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:23.963610888 CEST	7702	49728	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:23.963963985 CEST	7702	49729	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:23.964052916 CEST	49729	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:23.969409943 CEST	7702	49729	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:23.969470978 CEST	49729	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:24.674591064 CEST	49729	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:24.674802065 CEST	49729	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:24.675337076 CEST	49732	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:24.679708958 CEST	7702	49729	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:24.679738998 CEST	7702	49729	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:24.680712938 CEST	7702	49732	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:24.680792093 CEST	49732	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:24.685781002 CEST	7702	49732	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:24.685856104 CEST	49732	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:24.721160889 CEST	49732	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:24.721395016 CEST	49732	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:24.721869946 CEST	49733	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:24.725990057 CEST	7702	49732	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:24.726198912 CEST	7702	49732	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:24.726656914 CEST	7702	49733	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:24.726716042 CEST	49733	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:24.731554031 CEST	7702	49733	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:24.731605053 CEST	49733	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:24.736959934 CEST	49733	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:24.737126112 CEST	49733	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:24.737468004 CEST	49734	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:24.741772890 CEST	7702	49733	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:24.741940975 CEST	7702	49733	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:24.742235899 CEST	7702	49734	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:24.742292881 CEST	49734	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:24.747204065 CEST	7702	49734	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:24.747258902 CEST	49734	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:25.965435982 CEST	49734	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:25.966190100 CEST	49737	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:25.970375061 CEST	7702	49734	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:25.970952988 CEST	7702	49737	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:25.971034050 CEST	49737	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:26.159033060 CEST	49737	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:26.165415049 CEST	7702	49737	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:26.165524006 CEST	49737	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:26.170389891 CEST	7702	49737	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:27.410789967 CEST	7702	49737	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:27.410896063 CEST	49737	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:27.411137104 CEST	49737	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:27.411685944 CEST	49738	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:27.415950060 CEST	7702	49737	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:27.416444063 CEST	7702	49738	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:27.416520119 CEST	49738	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:27.565253973 CEST	49738	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:27.570777893 CEST	7702	49738	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:27.570830107 CEST	49738	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:27.575865030 CEST	7702	49738	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:28.822597027 CEST	7702	49738	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:28.823888063 CEST	49738	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:28.823888063 CEST	49738	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:28.824438095 CEST	49739	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:28.829384089 CEST	7702	49738	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:28.829396963 CEST	7702	49739	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:28.829618931 CEST	49739	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:28.955702066 CEST	49739	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:28.960562944 CEST	7702	49739	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:28.961637020 CEST	49739	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:28.966438055 CEST	7702	49739	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:28.971251011 CEST	49739	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:28.976032972 CEST	7702	49739	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:28.976344109 CEST	49739	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:28.981281042 CEST	7702	49739	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:29.697787046 CEST	49739	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:29.702610016 CEST	7702	49739	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:29.705450058 CEST	49739	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:29.710247040 CEST	7702	49739	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:29.741694927 CEST	49739	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:29.746763945 CEST	7702	49739	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:29.746833086 CEST	49739	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:29.751667023 CEST	7702	49739	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:29.780740023 CEST	49739	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:29.785727978 CEST	7702	49739	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:29.785794020 CEST	49739	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:29.791048050 CEST	7702	49739	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:30.246520996 CEST	7702	49739	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:30.246623993 CEST	49739	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:30.246774912 CEST	49739	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:30.247284889 CEST	49741	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:30.251590967 CEST	7702	49739	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:30.252157927 CEST	7702	49741	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:30.252253056 CEST	49741	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:30.987036943 CEST	49741	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:30.992036104 CEST	7702	49741	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:30.992089987 CEST	49741	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:30.997266054 CEST	7702	49741	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:31.652472019 CEST	7702	49741	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:31.652533054 CEST	49741	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:31.652678967 CEST	49741	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:31.653378010 CEST	49742	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:31.657913923 CEST	7702	49741	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:31.658114910 CEST	7702	49742	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:31.658179045 CEST	49742	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:32.424695969 CEST	49742	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:32.429589987 CEST	7702	49742	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:32.429855108 CEST	49742	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:32.434592009 CEST	7702	49742	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:33.072915077 CEST	7702	49742	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:33.073004007 CEST	49742	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:33.073128939 CEST	49742	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:33.073648930 CEST	49743	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:33.078104973 CEST	7702	49742	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:33.078603983 CEST	7702	49743	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:33.078682899 CEST	49743	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:33.830821991 CEST	49743	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:33.835715055 CEST	7702	49743	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:33.835781097 CEST	49743	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:33.840581894 CEST	7702	49743	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:34.459353924 CEST	7702	49743	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:34.459513903 CEST	49743	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:34.459661961 CEST	49743	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:34.460150003 CEST	49744	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:34.464512110 CEST	7702	49743	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:34.464977026 CEST	7702	49744	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:34.465050936 CEST	49744	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:35.268162966 CEST	49744	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:35.273356915 CEST	7702	49744	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:35.273426056 CEST	49744	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:35.278407097 CEST	7702	49744	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:35.849708080 CEST	7702	49744	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:35.849839926 CEST	49744	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:35.849957943 CEST	49744	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:35.850502014 CEST	49745	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:35.854849100 CEST	7702	49744	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:35.855426073 CEST	7702	49745	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:35.855518103 CEST	49745	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:36.674573898 CEST	49745	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:36.679583073 CEST	7702	49745	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:36.679652929 CEST	49745	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:36.684478998 CEST	7702	49745	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:37.262269020 CEST	7702	49745	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:37.262336016 CEST	49745	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:37.262469053 CEST	49745	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:37.262909889 CEST	49746	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:37.268044949 CEST	7702	49745	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:37.268080950 CEST	7702	49746	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:37.268172979 CEST	49746	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:38.080697060 CEST	49746	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:38.086265087 CEST	7702	49746	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:38.086338997 CEST	49746	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:38.091289997 CEST	7702	49746	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:38.684572935 CEST	7702	49746	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:38.684804916 CEST	49746	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:38.684804916 CEST	49746	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:38.685178041 CEST	49747	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:38.689771891 CEST	7702	49746	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:38.690051079 CEST	7702	49747	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:38.690116882 CEST	49747	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:39.471638918 CEST	49747	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:39.484163046 CEST	7702	49747	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:39.484378099 CEST	49747	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:39.490894079 CEST	7702	49747	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:40.068589926 CEST	7702	49747	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:40.068670988 CEST	49747	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:40.068824053 CEST	49747	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:40.069272041 CEST	49748	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:40.083036900 CEST	7702	49747	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:40.083050966 CEST	7702	49748	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:40.083158016 CEST	49748	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:40.111704111 CEST	7702	49748	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:40.111782074 CEST	49748	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:40.111905098 CEST	49748	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:40.112390995 CEST	49749	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:40.116782904 CEST	7702	49748	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:40.117218018 CEST	7702	49749	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:40.117284060 CEST	49749	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:40.127604961 CEST	7702	49749	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:40.127657890 CEST	49749	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:40.127701044 CEST	49749	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:40.128086090 CEST	49750	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:40.132632017 CEST	7702	49749	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:40.132848024 CEST	7702	49750	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:40.132904053 CEST	49750	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:40.861861944 CEST	49750	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:40.866713047 CEST	7702	49750	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:40.866818905 CEST	49750	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:40.871577024 CEST	7702	49750	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:41.524085045 CEST	7702	49750	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:41.524146080 CEST	49750	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:41.524996996 CEST	49750	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:41.525439024 CEST	49751	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:41.529764891 CEST	7702	49750	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:41.530242920 CEST	7702	49751	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:41.530349970 CEST	49751	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:42.283945084 CEST	49751	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:42.288968086 CEST	7702	49751	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:42.289700031 CEST	49751	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:42.294482946 CEST	7702	49751	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:42.933995008 CEST	7702	49751	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:42.934129000 CEST	49751	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:42.934350014 CEST	49751	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:42.934900999 CEST	49752	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:42.939152002 CEST	7702	49751	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:42.939699888 CEST	7702	49752	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:42.939786911 CEST	49752	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:42.944801092 CEST	7702	49752	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:42.944866896 CEST	49752	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:42.944947004 CEST	49752	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:42.945308924 CEST	49753	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:42.949845076 CEST	7702	49752	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:42.950609922 CEST	7702	49753	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:42.950685024 CEST	49753	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:42.955730915 CEST	7702	49753	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:42.955810070 CEST	49753	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:42.955930948 CEST	49753	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:42.956270933 CEST	49754	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:42.960834026 CEST	7702	49753	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:42.961244106 CEST	7702	49754	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:42.961325884 CEST	49754	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:42.967663050 CEST	7702	49754	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:42.967725992 CEST	49754	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:42.967803955 CEST	49754	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:42.968147993 CEST	49755	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:42.972527981 CEST	7702	49754	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:42.972893000 CEST	7702	49755	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:42.972964048 CEST	49755	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:42.978292942 CEST	7702	49755	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:42.978352070 CEST	49755	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:43.705714941 CEST	49755	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:43.705935955 CEST	49755	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:43.706294060 CEST	49756	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:43.713332891 CEST	7702	49755	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:43.713346958 CEST	7702	49755	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:43.713633060 CEST	7702	49756	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:43.713712931 CEST	49756	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:43.721393108 CEST	7702	49756	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:43.721448898 CEST	49756	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:44.284749985 CEST	49756	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:44.285101891 CEST	49757	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:44.289638996 CEST	7702	49756	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:44.290218115 CEST	7702	49757	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:44.290282011 CEST	49757	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:45.096265078 CEST	49757	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:45.184674025 CEST	7702	49757	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:45.184941053 CEST	49757	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:45.196027040 CEST	7702	49757	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:45.679682016 CEST	7702	49757	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:45.679754972 CEST	49757	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:45.679866076 CEST	49757	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:45.680272102 CEST	49758	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:45.684778929 CEST	7702	49757	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:45.685094118 CEST	7702	49758	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:45.685161114 CEST	49758	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:46.533941984 CEST	49758	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:46.540690899 CEST	7702	49758	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:46.540757895 CEST	49758	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:46.545526028 CEST	7702	49758	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:47.069468975 CEST	7702	49758	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:47.069535971 CEST	49758	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:47.069673061 CEST	49758	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:47.070059061 CEST	49759	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:47.074434996 CEST	7702	49758	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:47.076034069 CEST	7702	49759	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:47.076121092 CEST	49759	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:47.955648899 CEST	49759	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:47.960668087 CEST	7702	49759	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:47.960768938 CEST	49759	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:47.965521097 CEST	7702	49759	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:47.971410036 CEST	49759	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:47.980643988 CEST	7702	49759	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:47.980707884 CEST	49759	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:47.987721920 CEST	7702	49759	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:47.987921953 CEST	49759	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:47.992798090 CEST	7702	49759	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:48.460251093 CEST	7702	49759	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:48.460340023 CEST	49759	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:48.460457087 CEST	49759	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:48.460903883 CEST	49760	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:48.465202093 CEST	7702	49759	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:48.465732098 CEST	7702	49760	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:48.465804100 CEST	49760	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:48.721681118 CEST	49760	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:48.726744890 CEST	7702	49760	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:48.726815939 CEST	49760	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:48.731586933 CEST	7702	49760	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:49.299679995 CEST	49760	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:49.305299044 CEST	7702	49760	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:49.305649996 CEST	49760	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:49.311151981 CEST	7702	49760	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:49.851614952 CEST	7702	49760	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:49.851778030 CEST	49760	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:49.851993084 CEST	49760	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:49.852475882 CEST	49762	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:49.856745005 CEST	7702	49760	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:49.858037949 CEST	7702	49762	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:49.858134985 CEST	49762	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:50.689922094 CEST	49762	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:50.694783926 CEST	7702	49762	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:50.694863081 CEST	49762	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:50.699736118 CEST	7702	49762	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:51.263739109 CEST	7702	49762	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:51.263917923 CEST	49762	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:51.263978004 CEST	49762	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:51.264456034 CEST	49763	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:51.268836021 CEST	7702	49762	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:51.269890070 CEST	7702	49763	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:51.269982100 CEST	49763	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:51.275218010 CEST	7702	49763	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:51.275289059 CEST	49763	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:51.275353909 CEST	49763	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:51.275646925 CEST	49764	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:51.280544996 CEST	7702	49763	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:51.280555964 CEST	7702	49764	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:51.280653954 CEST	49764	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:51.285765886 CEST	7702	49764	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:51.285835028 CEST	49764	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:51.285890102 CEST	49764	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:51.286163092 CEST	49765	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:51.290730953 CEST	7702	49764	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:51.291064978 CEST	7702	49765	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:51.291136980 CEST	49765	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:51.298485994 CEST	7702	49765	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:51.298655987 CEST	49765	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:51.298655987 CEST	49765	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:51.299057961 CEST	49766	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:51.303868055 CEST	7702	49765	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:51.304212093 CEST	7702	49766	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:51.304280996 CEST	49766	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:52.080941916 CEST	49766	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:52.085736990 CEST	7702	49766	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:52.085803986 CEST	49766	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:52.090550900 CEST	7702	49766	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:52.721906900 CEST	7702	49766	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:52.721975088 CEST	49766	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:52.722114086 CEST	49766	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:52.722624063 CEST	49767	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:52.726924896 CEST	7702	49766	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:52.727588892 CEST	7702	49767	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:52.727665901 CEST	49767	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:53.471477985 CEST	49767	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:53.476500988 CEST	7702	49767	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:53.476591110 CEST	49767	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:53.481498003 CEST	7702	49767	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:54.152600050 CEST	7702	49767	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:54.152709007 CEST	49767	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:54.152893066 CEST	49767	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:54.153413057 CEST	49768	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:54.157778025 CEST	7702	49767	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:54.158243895 CEST	7702	49768	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:54.158341885 CEST	49768	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:54.862236023 CEST	49768	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:54.867233992 CEST	7702	49768	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:54.867321968 CEST	49768	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:54.872215033 CEST	7702	49768	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:55.537880898 CEST	7702	49768	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:55.538023949 CEST	49768	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:55.538499117 CEST	49768	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:55.538893938 CEST	49769	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:55.543320894 CEST	7702	49768	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:55.543750048 CEST	7702	49769	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:55.543816090 CEST	49769	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:56.283618927 CEST	49769	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:56.288572073 CEST	7702	49769	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:56.288630962 CEST	49769	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:56.293382883 CEST	7702	49769	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:56.299524069 CEST	49769	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:56.304440975 CEST	7702	49769	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:56.304503918 CEST	49769	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:56.309551001 CEST	7702	49769	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:56.315212965 CEST	49769	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:56.321660042 CEST	7702	49769	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:56.321700096 CEST	49769	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:56.331058979 CEST	7702	49769	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:56.948194981 CEST	7702	49769	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:56.948250055 CEST	49769	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:56.948998928 CEST	49769	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:56.949394941 CEST	49770	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:56.954015970 CEST	7702	49769	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:56.954560041 CEST	7702	49770	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:56.954626083 CEST	49770	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:57.736988068 CEST	49770	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:57.743100882 CEST	7702	49770	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:57.743153095 CEST	49770	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:57.753530979 CEST	7702	49770	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:58.364171028 CEST	7702	49770	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:58.364247084 CEST	49770	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:58.364459991 CEST	49770	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:58.365052938 CEST	49771	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:58.369353056 CEST	7702	49770	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:58.370018959 CEST	7702	49771	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:58.370115995 CEST	49771	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:59.174325943 CEST	49771	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:59.179177999 CEST	7702	49771	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:59.179241896 CEST	49771	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:59.184056997 CEST	7702	49771	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:59.782135010 CEST	7702	49771	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:59.782219887 CEST	49771	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:59.782349110 CEST	49771	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:59.782766104 CEST	49772	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:18:59.787193060 CEST	7702	49771	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:59.788748980 CEST	7702	49772	80.76.49.148	192.168.2.6
Jun 18, 2024 21:18:59.788824081 CEST	49772	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:00.549348116 CEST	49772	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:00.554326057 CEST	7702	49772	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:00.554399014 CEST	49772	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:00.560266972 CEST	7702	49772	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:01.354459047 CEST	7702	49772	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:01.354641914 CEST	49772	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:01.354676962 CEST	49772	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:01.355142117 CEST	49773	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:01.359729052 CEST	7702	49772	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:01.360167027 CEST	7702	49773	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:01.360232115 CEST	49773	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:01.955590010 CEST	49773	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:01.963433981 CEST	7702	49773	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:01.963489056 CEST	49773	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:01.968940973 CEST	7702	49773	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:02.760767937 CEST	7702	49773	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:02.760868073 CEST	49773	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:02.760982990 CEST	49773	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:02.761446953 CEST	49775	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:02.765829086 CEST	7702	49773	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:02.766473055 CEST	7702	49775	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:02.766587019 CEST	49775	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:02.772574902 CEST	7702	49775	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:02.772758961 CEST	49775	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:02.776226044 CEST	49775	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:02.776400089 CEST	49776	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:02.781212091 CEST	7702	49775	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:02.781263113 CEST	7702	49776	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:02.781359911 CEST	49776	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:03.377402067 CEST	49776	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:03.382230043 CEST	7702	49776	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:03.382304907 CEST	49776	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:03.400383949 CEST	7702	49776	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:04.211994886 CEST	7702	49776	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:04.212093115 CEST	49776	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:04.212224960 CEST	49776	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:04.212718964 CEST	49777	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:04.217031002 CEST	7702	49776	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:04.217564106 CEST	7702	49777	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:04.217642069 CEST	49777	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:04.799334049 CEST	49777	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:04.804198980 CEST	7702	49777	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:04.804389000 CEST	49777	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:04.809559107 CEST	7702	49777	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:05.604615927 CEST	7702	49777	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:05.604708910 CEST	49777	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:05.604826927 CEST	49777	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:05.605271101 CEST	49778	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:05.609803915 CEST	7702	49777	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:05.610284090 CEST	7702	49778	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:05.610364914 CEST	49778	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:06.362071991 CEST	49778	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:06.373771906 CEST	7702	49778	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:06.373850107 CEST	49778	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:06.385013103 CEST	7702	49778	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:06.991063118 CEST	7702	49778	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:06.991308928 CEST	49778	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:06.991309881 CEST	49778	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:06.991708994 CEST	49779	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:06.996587038 CEST	7702	49778	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:06.996622086 CEST	7702	49779	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:06.996682882 CEST	49779	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:07.768179893 CEST	49779	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:07.773000956 CEST	7702	49779	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:07.773061037 CEST	49779	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:07.778043985 CEST	7702	49779	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:07.783571959 CEST	49779	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:07.788871050 CEST	7702	49779	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:07.788922071 CEST	49779	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:07.793775082 CEST	7702	49779	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:08.382071972 CEST	7702	49779	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:08.382165909 CEST	49779	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:08.382299900 CEST	49779	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:08.382905960 CEST	49780	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:08.387135029 CEST	7702	49779	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:08.387943983 CEST	7702	49780	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:08.388036966 CEST	49780	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:08.393208981 CEST	7702	49780	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:08.393285036 CEST	49780	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:08.393330097 CEST	49780	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:08.393598080 CEST	49781	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:08.398093939 CEST	7702	49780	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:08.398401976 CEST	7702	49781	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:08.398472071 CEST	49781	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:08.403433084 CEST	7702	49781	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:08.403496027 CEST	49781	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:08.403544903 CEST	49781	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:08.403820992 CEST	49782	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:08.408348083 CEST	7702	49781	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:08.412360907 CEST	7702	49782	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:08.412452936 CEST	49782	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:09.221640110 CEST	49782	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:09.226983070 CEST	7702	49782	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:09.227062941 CEST	49782	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:09.232712030 CEST	7702	49782	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:09.806051016 CEST	7702	49782	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:09.806145906 CEST	49782	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:09.806389093 CEST	49782	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:09.807111979 CEST	49783	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:09.813357115 CEST	7702	49782	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:09.813395977 CEST	7702	49783	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:09.813503027 CEST	49783	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:10.611891031 CEST	49783	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:10.620768070 CEST	7702	49783	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:10.620955944 CEST	49783	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:10.625998974 CEST	7702	49783	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:11.198741913 CEST	7702	49783	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:11.199032068 CEST	49783	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:11.199085951 CEST	49783	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:11.199734926 CEST	49784	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:11.203874111 CEST	7702	49783	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:11.204600096 CEST	7702	49784	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:11.204682112 CEST	49784	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:12.002924919 CEST	49784	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:12.008790970 CEST	7702	49784	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:12.008939028 CEST	49784	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:12.013853073 CEST	7702	49784	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:12.585273981 CEST	7702	49784	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:12.585402012 CEST	49784	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:12.586298943 CEST	49784	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:12.586633921 CEST	49785	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:12.591197014 CEST	7702	49784	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:12.592303991 CEST	7702	49785	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:12.592389107 CEST	49785	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:13.393071890 CEST	49785	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:13.398158073 CEST	7702	49785	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:13.398215055 CEST	49785	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:13.403043032 CEST	7702	49785	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:13.408695936 CEST	49785	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:13.413484097 CEST	7702	49785	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:13.413553953 CEST	49785	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:13.418306112 CEST	7702	49785	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:13.426229954 CEST	49785	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:13.430977106 CEST	7702	49785	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:13.431056023 CEST	49785	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:13.435789108 CEST	7702	49785	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:14.008899927 CEST	7702	49785	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:14.008994102 CEST	49785	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:14.009229898 CEST	49785	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:14.009877920 CEST	49787	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:14.014401913 CEST	7702	49785	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:14.014604092 CEST	7702	49787	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:14.014694929 CEST	49787	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:14.019715071 CEST	7702	49787	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:14.019792080 CEST	49787	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:14.019856930 CEST	49787	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:14.020239115 CEST	49788	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:14.024812937 CEST	7702	49787	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:14.025018930 CEST	7702	49788	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:14.025085926 CEST	49788	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:14.030433893 CEST	7702	49788	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:14.030514002 CEST	49788	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:14.030561924 CEST	49788	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:14.030910969 CEST	49789	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:14.035578966 CEST	7702	49788	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:14.035778046 CEST	7702	49789	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:14.035865068 CEST	49789	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:14.041263103 CEST	7702	49789	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:14.041352987 CEST	49789	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:14.041412115 CEST	49789	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:14.041766882 CEST	49790	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:14.046278954 CEST	7702	49789	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:14.046514988 CEST	7702	49790	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:14.046583891 CEST	49790	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:14.051997900 CEST	7702	49790	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:14.052089930 CEST	49790	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:14.052139997 CEST	49790	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:14.052464008 CEST	49791	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:14.059593916 CEST	7702	49790	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:14.059608936 CEST	7702	49791	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:14.059688091 CEST	49791	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:14.067455053 CEST	7702	49791	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:14.067518950 CEST	49791	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:14.067672014 CEST	49791	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:14.068128109 CEST	49792	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:14.073414087 CEST	7702	49791	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:14.073427916 CEST	7702	49792	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:14.073510885 CEST	49792	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:14.078566074 CEST	7702	49792	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:14.078653097 CEST	49792	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:14.078741074 CEST	49792	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:14.079157114 CEST	49793	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:14.083565950 CEST	7702	49792	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:14.084537983 CEST	7702	49793	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:14.084626913 CEST	49793	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:14.090158939 CEST	7702	49793	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:14.090260029 CEST	49793	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:14.817321062 CEST	49793	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:14.817564964 CEST	49793	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:14.818022013 CEST	49794	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:14.822473049 CEST	7702	49793	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:14.822499990 CEST	7702	49793	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:14.825294971 CEST	7702	49794	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:14.825516939 CEST	49794	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:16.221541882 CEST	49794	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:16.226541042 CEST	7702	49794	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:16.226769924 CEST	49794	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:16.229264021 CEST	7702	49794	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:16.229645014 CEST	49794	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:16.229645014 CEST	49794	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:16.230149031 CEST	49795	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:16.231560946 CEST	7702	49794	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:16.234471083 CEST	7702	49794	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:16.234488964 CEST	7702	49794	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:16.235033035 CEST	7702	49795	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:16.235116959 CEST	49795	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:17.596287012 CEST	49795	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:17.601403952 CEST	7702	49795	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:17.601479053 CEST	49795	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:17.606312990 CEST	7702	49795	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:17.616177082 CEST	7702	49795	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:17.616241932 CEST	49795	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:17.616390944 CEST	49795	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:17.617141008 CEST	49796	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:17.625314951 CEST	7702	49795	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:17.632978916 CEST	7702	49796	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:17.633052111 CEST	49796	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:19.018585920 CEST	49796	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:19.026087046 CEST	7702	49796	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:19.026160002 CEST	49796	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:19.026608944 CEST	7702	49796	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:19.026669025 CEST	49796	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:19.026777029 CEST	49796	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:19.027173042 CEST	49797	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:19.030993938 CEST	7702	49796	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:19.031457901 CEST	7702	49796	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:19.031563044 CEST	7702	49796	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:19.032043934 CEST	7702	49797	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:19.032115936 CEST	49797	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:19.033827066 CEST	49797	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:19.038666010 CEST	7702	49797	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:19.038723946 CEST	49797	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:19.043555975 CEST	7702	49797	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:19.049253941 CEST	49797	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:19.054070950 CEST	7702	49797	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:19.054127932 CEST	49797	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:19.058985949 CEST	7702	49797	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:19.065001965 CEST	49797	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:19.069747925 CEST	7702	49797	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:19.069801092 CEST	49797	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:19.074999094 CEST	7702	49797	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:19.080370903 CEST	49797	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:19.085352898 CEST	7702	49797	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:19.085411072 CEST	49797	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:19.090208054 CEST	7702	49797	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:19.095911026 CEST	49797	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:19.100905895 CEST	7702	49797	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:19.100951910 CEST	49797	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:19.105983973 CEST	7702	49797	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:19.831626892 CEST	49797	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:19.836447954 CEST	7702	49797	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:19.836514950 CEST	49797	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:19.842216015 CEST	7702	49797	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:20.435513973 CEST	7702	49797	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:20.435570002 CEST	49797	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:20.435683966 CEST	49797	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:20.436064959 CEST	49798	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:20.440459967 CEST	7702	49797	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:20.440824986 CEST	7702	49798	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:20.440880060 CEST	49798	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:21.242760897 CEST	49798	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:21.247879982 CEST	7702	49798	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:21.247961998 CEST	49798	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:21.252882004 CEST	7702	49798	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:21.837830067 CEST	7702	49798	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:21.837990999 CEST	49798	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:21.838139057 CEST	49798	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:21.838800907 CEST	49799	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:21.843072891 CEST	7702	49798	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:21.843978882 CEST	7702	49799	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:21.844054937 CEST	49799	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:22.643506050 CEST	49799	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:22.649255037 CEST	7702	49799	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:22.649344921 CEST	49799	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:22.654226065 CEST	7702	49799	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:23.272002935 CEST	7702	49799	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:23.272247076 CEST	49799	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:23.272346020 CEST	49799	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:23.272855043 CEST	49800	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:23.277152061 CEST	7702	49799	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:23.277718067 CEST	7702	49800	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:23.277815104 CEST	49800	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:24.033823013 CEST	49800	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:24.041989088 CEST	7702	49800	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:24.042073965 CEST	49800	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:24.048809052 CEST	7702	49800	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:24.714361906 CEST	7702	49800	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:24.714556932 CEST	49800	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:24.714556932 CEST	49800	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:24.714966059 CEST	49801	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:24.719564915 CEST	7702	49800	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:24.720252991 CEST	7702	49801	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:24.720334053 CEST	49801	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:24.725307941 CEST	7702	49801	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:24.725366116 CEST	49801	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:24.725419998 CEST	49801	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:24.725769997 CEST	49802	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:24.730237961 CEST	7702	49801	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:24.730952024 CEST	7702	49802	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:24.731029034 CEST	49802	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:24.736398935 CEST	7702	49802	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:24.736455917 CEST	49802	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:24.736543894 CEST	49802	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:24.737019062 CEST	49803	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:24.741398096 CEST	7702	49802	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:24.741969109 CEST	7702	49803	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:24.742170095 CEST	49803	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:24.747412920 CEST	7702	49803	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:24.747586966 CEST	49803	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:24.747586966 CEST	49803	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:24.747848988 CEST	49804	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:24.752496004 CEST	7702	49803	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:24.752664089 CEST	7702	49804	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:24.752737045 CEST	49804	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:25.455652952 CEST	49804	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:25.460443974 CEST	7702	49804	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:25.460520029 CEST	49804	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:25.465277910 CEST	7702	49804	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:26.156908035 CEST	7702	49804	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:26.157094955 CEST	49804	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:26.157387972 CEST	49804	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:26.157999992 CEST	49806	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:26.162575960 CEST	7702	49804	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:26.163527966 CEST	7702	49806	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:26.163678885 CEST	49806	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:26.169049978 CEST	7702	49806	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:26.169109106 CEST	49806	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:26.169159889 CEST	49806	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:26.169466019 CEST	49807	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:26.174052954 CEST	7702	49806	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:26.174799919 CEST	7702	49807	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:26.174881935 CEST	49807	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:26.846122980 CEST	49807	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:26.851464033 CEST	7702	49807	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:26.851547003 CEST	49807	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:26.856758118 CEST	7702	49807	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:27.575309038 CEST	7702	49807	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:27.575427055 CEST	49807	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:27.575654984 CEST	49807	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:27.576210022 CEST	49808	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:27.581125975 CEST	7702	49807	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:27.581161022 CEST	7702	49808	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:27.581228018 CEST	49808	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:28.283849001 CEST	49808	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:28.288789034 CEST	7702	49808	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:28.288861036 CEST	49808	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:28.293612003 CEST	7702	49808	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:28.979888916 CEST	7702	49808	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:28.979963064 CEST	49808	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:28.980628967 CEST	49808	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:28.981101990 CEST	49809	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:28.985404015 CEST	7702	49808	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:28.986083031 CEST	7702	49809	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:28.986165047 CEST	49809	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:29.736913919 CEST	49809	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:29.741856098 CEST	7702	49809	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:29.741916895 CEST	49809	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:29.746783972 CEST	7702	49809	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:29.752337933 CEST	49809	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:29.757383108 CEST	7702	49809	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:29.757442951 CEST	49809	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:29.762294054 CEST	7702	49809	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:29.767842054 CEST	49809	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:29.772772074 CEST	7702	49809	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:29.772850990 CEST	49809	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:29.777657032 CEST	7702	49809	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:30.387172937 CEST	7702	49809	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:30.387330055 CEST	49809	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:30.387418032 CEST	49809	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:30.387818098 CEST	49810	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:30.392270088 CEST	7702	49809	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:30.392841101 CEST	7702	49810	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:30.392904043 CEST	49810	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:31.174298048 CEST	49810	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:31.179140091 CEST	7702	49810	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:31.179204941 CEST	49810	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:31.184041023 CEST	7702	49810	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:31.189810991 CEST	49810	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:31.194834948 CEST	7702	49810	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:31.194909096 CEST	49810	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:31.199798107 CEST	7702	49810	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:31.773119926 CEST	7702	49810	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:31.773231030 CEST	49810	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:31.773425102 CEST	49810	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:31.773958921 CEST	49811	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:31.778240919 CEST	7702	49810	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:31.779103994 CEST	7702	49811	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:31.779184103 CEST	49811	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:32.596153975 CEST	49811	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:32.601428032 CEST	7702	49811	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:32.601507902 CEST	49811	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:32.606295109 CEST	7702	49811	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:33.163669109 CEST	7702	49811	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:33.163822889 CEST	49811	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:33.164108038 CEST	49811	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:33.164779902 CEST	49812	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:33.172347069 CEST	7702	49811	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:33.172544003 CEST	7702	49812	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:33.172689915 CEST	49812	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:33.212549925 CEST	7702	49812	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:33.212721109 CEST	49812	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:33.212937117 CEST	49812	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:33.213574886 CEST	49813	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:33.217657089 CEST	7702	49812	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:33.218311071 CEST	7702	49813	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:33.218439102 CEST	49813	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:33.244992018 CEST	7702	49813	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:33.245095968 CEST	49813	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:33.245352030 CEST	49813	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:33.246113062 CEST	49814	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:33.250186920 CEST	7702	49813	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:33.250852108 CEST	7702	49814	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:33.250967979 CEST	49814	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:33.256464958 CEST	7702	49814	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:33.256572962 CEST	49814	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:33.256738901 CEST	49814	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:33.257262945 CEST	49815	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:33.261563063 CEST	7702	49814	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:33.262562037 CEST	7702	49815	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:33.262670040 CEST	49815	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:33.267627954 CEST	7702	49815	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:33.267719984 CEST	49815	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:33.267947912 CEST	49815	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:33.268482924 CEST	49816	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:33.272675991 CEST	7702	49815	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:33.273283005 CEST	7702	49816	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:33.273376942 CEST	49816	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:33.278280973 CEST	7702	49816	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:33.278357029 CEST	49816	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:33.278549910 CEST	49816	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:33.278996944 CEST	49817	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:33.283287048 CEST	7702	49816	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:33.283705950 CEST	7702	49817	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:33.283806086 CEST	49817	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:33.290227890 CEST	7702	49817	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:33.290365934 CEST	49817	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:33.290465117 CEST	49817	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:33.290760994 CEST	49818	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:33.295187950 CEST	7702	49817	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:33.296143055 CEST	7702	49818	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:33.296247959 CEST	49818	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:33.302370071 CEST	7702	49818	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:33.302443027 CEST	49818	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:34.002507925 CEST	49818	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:34.002692938 CEST	49818	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:34.003068924 CEST	49819	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:34.007272005 CEST	7702	49818	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:34.007412910 CEST	7702	49818	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:34.008090019 CEST	7702	49819	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:34.008158922 CEST	49819	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:34.013288021 CEST	7702	49819	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:34.013350010 CEST	49819	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:34.689659119 CEST	49819	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:34.690068960 CEST	49820	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:34.694899082 CEST	7702	49819	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:34.695422888 CEST	7702	49820	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:34.695502996 CEST	49820	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:35.408894062 CEST	49820	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:35.413697958 CEST	7702	49820	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:35.413817883 CEST	49820	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:35.418881893 CEST	7702	49820	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:36.118455887 CEST	7702	49820	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:36.118587971 CEST	49820	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:36.118695021 CEST	49820	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:36.119234085 CEST	49821	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:36.123439074 CEST	7702	49820	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:36.124078035 CEST	7702	49821	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:36.124146938 CEST	49821	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:36.783612967 CEST	49821	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:36.789985895 CEST	7702	49821	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:36.790060997 CEST	49821	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:36.798017979 CEST	7702	49821	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:37.527563095 CEST	7702	49821	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:37.527694941 CEST	49821	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:37.527821064 CEST	49821	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:37.528369904 CEST	49822	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:37.532747984 CEST	7702	49821	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:37.533397913 CEST	7702	49822	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:37.533488035 CEST	49822	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:38.174521923 CEST	49822	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:38.179577112 CEST	7702	49822	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:38.179662943 CEST	49822	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:38.184972048 CEST	7702	49822	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:38.221798897 CEST	49822	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:38.230401993 CEST	7702	49822	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:38.230484962 CEST	49822	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:38.235348940 CEST	7702	49822	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:38.252350092 CEST	49822	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:38.257528067 CEST	7702	49822	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:38.257587910 CEST	49822	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:38.263309002 CEST	7702	49822	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:38.268202066 CEST	49822	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:38.273329020 CEST	7702	49822	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:38.273380995 CEST	49822	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:38.278311968 CEST	7702	49822	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:38.283564091 CEST	49822	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:38.292186975 CEST	7702	49822	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:38.292253017 CEST	49822	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:38.299679995 CEST	7702	49822	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:38.308332920 CEST	49822	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:38.313807964 CEST	7702	49822	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:38.313872099 CEST	49822	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:38.318932056 CEST	7702	49822	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:38.948779106 CEST	7702	49822	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:38.948944092 CEST	49822	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:38.949244976 CEST	49822	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:38.949892044 CEST	49823	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:38.954157114 CEST	7702	49822	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:38.954672098 CEST	7702	49823	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:38.954907894 CEST	49823	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:39.018085957 CEST	49823	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:39.023092985 CEST	7702	49823	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:39.023159981 CEST	49823	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:39.027844906 CEST	7702	49823	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:39.705697060 CEST	49823	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:39.711482048 CEST	7702	49823	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:39.711539030 CEST	49823	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:39.722151041 CEST	7702	49823	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:40.340439081 CEST	7702	49823	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:40.340509892 CEST	49823	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:40.340877056 CEST	49823	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:40.341381073 CEST	49824	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:40.345668077 CEST	7702	49823	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:40.346400023 CEST	7702	49824	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:40.346493959 CEST	49824	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:41.127756119 CEST	49824	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:41.132775068 CEST	7702	49824	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:41.132849932 CEST	49824	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:41.137613058 CEST	7702	49824	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:41.748240948 CEST	7702	49824	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:41.748500109 CEST	49824	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:41.748534918 CEST	49824	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:41.749217033 CEST	49825	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:41.753551006 CEST	7702	49824	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:41.754621029 CEST	7702	49825	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:41.754712105 CEST	49825	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:42.549762964 CEST	49825	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:42.554697990 CEST	7702	49825	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:42.554771900 CEST	49825	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:42.559612989 CEST	7702	49825	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:43.132076025 CEST	7702	49825	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:43.132186890 CEST	49825	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:43.132317066 CEST	49825	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:43.137774944 CEST	7702	49825	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:43.138845921 CEST	49826	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:43.144078970 CEST	7702	49826	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:43.144144058 CEST	49826	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:43.971692085 CEST	49826	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:43.976502895 CEST	7702	49826	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:43.976567984 CEST	49826	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:43.981416941 CEST	7702	49826	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:44.557854891 CEST	7702	49826	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:44.557987928 CEST	49826	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:44.558666945 CEST	49826	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:44.559108019 CEST	49827	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:44.563632011 CEST	7702	49826	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:44.564039946 CEST	7702	49827	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:44.564147949 CEST	49827	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:45.361893892 CEST	49827	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:45.369657040 CEST	7702	49827	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:45.369715929 CEST	49827	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:45.377361059 CEST	7702	49827	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:45.945050001 CEST	7702	49827	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:45.945669889 CEST	49827	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:45.945842981 CEST	49827	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:45.946286917 CEST	49828	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:45.955182076 CEST	7702	49827	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:45.955204010 CEST	7702	49828	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:45.955281019 CEST	49828	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:46.768124104 CEST	49828	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:46.778676987 CEST	7702	49828	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:46.778805017 CEST	49828	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:46.787528038 CEST	7702	49828	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:47.339468956 CEST	7702	49828	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:47.339566946 CEST	49828	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:47.339751959 CEST	49828	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:47.340214014 CEST	49830	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:47.344789982 CEST	7702	49828	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:47.345316887 CEST	7702	49830	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:47.345382929 CEST	49830	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:47.351025105 CEST	7702	49830	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:47.351082087 CEST	49830	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:47.351166010 CEST	49830	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:47.351484060 CEST	49831	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:47.357084990 CEST	7702	49830	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:47.357099056 CEST	7702	49831	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:47.357182026 CEST	49831	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:47.362957001 CEST	7702	49831	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:47.363008976 CEST	49831	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:47.363092899 CEST	49831	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:47.363405943 CEST	49832	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:47.367827892 CEST	7702	49831	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:47.368153095 CEST	7702	49832	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:47.368212938 CEST	49832	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:47.374274015 CEST	7702	49832	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:47.374320984 CEST	49832	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:47.374386072 CEST	49832	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:47.374675035 CEST	49833	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:47.381387949 CEST	7702	49832	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:47.381582022 CEST	7702	49833	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:47.381630898 CEST	49833	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:47.387238979 CEST	7702	49833	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:47.387288094 CEST	49833	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:47.387341022 CEST	49833	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:47.387612104 CEST	49834	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:47.396697998 CEST	7702	49833	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:47.397193909 CEST	7702	49834	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:47.397248983 CEST	49834	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:47.402414083 CEST	7702	49834	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:47.402461052 CEST	49834	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:47.402520895 CEST	49834	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:47.402782917 CEST	49835	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:47.407646894 CEST	7702	49834	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:47.407665014 CEST	7702	49835	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:47.407721043 CEST	49835	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:48.159079075 CEST	49835	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:48.163917065 CEST	7702	49835	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:48.163995981 CEST	49835	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:48.168801069 CEST	7702	49835	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:48.849314928 CEST	7702	49835	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:48.849411011 CEST	49835	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:48.849586964 CEST	49835	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:48.850080013 CEST	49836	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:48.854404926 CEST	7702	49835	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:48.856877089 CEST	7702	49836	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:48.857023954 CEST	49836	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:49.581195116 CEST	49836	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:49.589086056 CEST	7702	49836	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:49.589669943 CEST	49836	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:49.597585917 CEST	7702	49836	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:50.245331049 CEST	7702	49836	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:50.245445013 CEST	49836	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:50.245697021 CEST	49836	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:50.246076107 CEST	49837	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:50.250431061 CEST	7702	49836	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:50.250874043 CEST	7702	49837	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:50.250945091 CEST	49837	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:50.971188068 CEST	49837	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:50.976037025 CEST	7702	49837	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:50.976331949 CEST	49837	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:50.981441021 CEST	7702	49837	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:51.634677887 CEST	7702	49837	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:51.634819984 CEST	49837	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:51.634933949 CEST	49837	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:51.635421991 CEST	49838	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:51.639727116 CEST	7702	49837	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:51.640197992 CEST	7702	49838	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:51.640281916 CEST	49838	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:51.665712118 CEST	7702	49838	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:51.665788889 CEST	49838	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:51.668301105 CEST	49838	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:51.669094086 CEST	49839	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:51.673495054 CEST	7702	49838	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:51.673887014 CEST	7702	49839	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:51.674068928 CEST	49839	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:51.678962946 CEST	7702	49839	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:51.679023027 CEST	49839	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:51.679088116 CEST	49839	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:51.679547071 CEST	49840	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:51.684392929 CEST	7702	49839	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:51.684417009 CEST	7702	49840	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:51.684494972 CEST	49840	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:52.361958981 CEST	49840	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:52.567759991 CEST	7702	49840	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:52.567893982 CEST	49840	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:52.572630882 CEST	7702	49840	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:53.074295998 CEST	7702	49840	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:53.074379921 CEST	49840	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:53.074534893 CEST	49840	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:53.075309992 CEST	49841	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:53.079384089 CEST	7702	49840	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:53.081629992 CEST	7702	49841	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:53.081713915 CEST	49841	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:53.862396002 CEST	49841	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:53.867396116 CEST	7702	49841	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:53.867459059 CEST	49841	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:53.872229099 CEST	7702	49841	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:54.460496902 CEST	7702	49841	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:54.460553885 CEST	49841	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:54.460726023 CEST	49841	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:54.461272001 CEST	49842	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:54.465468884 CEST	7702	49841	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:54.466099977 CEST	7702	49842	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:54.466248989 CEST	49842	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:55.252420902 CEST	49842	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:55.257324934 CEST	7702	49842	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:55.257384062 CEST	49842	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:55.262187004 CEST	7702	49842	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:55.851193905 CEST	7702	49842	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:55.851273060 CEST	49842	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:55.851398945 CEST	49842	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:55.851895094 CEST	49843	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:55.856123924 CEST	7702	49842	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:55.856719971 CEST	7702	49843	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:55.856785059 CEST	49843	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:56.643435001 CEST	49843	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:56.648513079 CEST	7702	49843	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:56.648672104 CEST	49843	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:56.653470993 CEST	7702	49843	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:56.690073967 CEST	49843	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:56.694864035 CEST	7702	49843	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:56.694936991 CEST	49843	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:56.699659109 CEST	7702	49843	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:57.262667894 CEST	7702	49843	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:57.262739897 CEST	49843	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:57.264394999 CEST	49843	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:57.264972925 CEST	49844	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:57.269954920 CEST	7702	49843	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:57.269970894 CEST	7702	49844	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:57.270061970 CEST	49844	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:57.275151968 CEST	7702	49844	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:57.275214911 CEST	49844	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:57.276007891 CEST	49844	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:57.276352882 CEST	49845	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:57.280867100 CEST	7702	49844	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:57.282056093 CEST	7702	49845	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:57.282115936 CEST	49845	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:57.287133932 CEST	7702	49845	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:57.287213087 CEST	49845	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:57.287292957 CEST	49845	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:57.287646055 CEST	49846	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:57.292052031 CEST	7702	49845	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:57.292902946 CEST	7702	49846	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:57.292963028 CEST	49846	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:57.298274994 CEST	7702	49846	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:57.298340082 CEST	49846	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:57.298396111 CEST	49846	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:57.298765898 CEST	49847	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:57.303265095 CEST	7702	49846	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:57.303529978 CEST	7702	49847	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:57.303605080 CEST	49847	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:58.096477032 CEST	49847	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:58.101378918 CEST	7702	49847	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:58.101433039 CEST	49847	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:58.106236935 CEST	7702	49847	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:58.716893911 CEST	7702	49847	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:58.716989040 CEST	49847	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:58.717132092 CEST	49847	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:58.717600107 CEST	49848	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:58.722089052 CEST	7702	49847	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:58.722493887 CEST	7702	49848	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:58.722584963 CEST	49848	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:58.728132010 CEST	7702	49848	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:58.728199959 CEST	49848	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:58.728266954 CEST	49848	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:58.728585005 CEST	49849	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:58.733407974 CEST	7702	49848	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:58.733418941 CEST	7702	49849	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:58.733474016 CEST	49849	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:59.472390890 CEST	49849	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:59.521045923 CEST	7702	49849	80.76.49.148	192.168.2.6
Jun 18, 2024 21:19:59.521120071 CEST	49849	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:19:59.526104927 CEST	7702	49849	80.76.49.148	192.168.2.6
Jun 18, 2024 21:20:00.117343903 CEST	7702	49849	80.76.49.148	192.168.2.6
Jun 18, 2024 21:20:00.117556095 CEST	49849	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:20:00.126816034 CEST	49849	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:20:00.127285957 CEST	49850	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:20:00.132096052 CEST	7702	49849	80.76.49.148	192.168.2.6
Jun 18, 2024 21:20:00.132108927 CEST	7702	49850	80.76.49.148	192.168.2.6
Jun 18, 2024 21:20:00.132200003 CEST	49850	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:20:00.861783981 CEST	49850	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:20:00.866647959 CEST	7702	49850	80.76.49.148	192.168.2.6
Jun 18, 2024 21:20:00.866728067 CEST	49850	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:20:00.871910095 CEST	7702	49850	80.76.49.148	192.168.2.6
Jun 18, 2024 21:20:01.526573896 CEST	7702	49850	80.76.49.148	192.168.2.6
Jun 18, 2024 21:20:01.526631117 CEST	49850	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:20:01.526808023 CEST	49850	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:20:01.527347088 CEST	49851	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:20:01.531639099 CEST	7702	49850	80.76.49.148	192.168.2.6
Jun 18, 2024 21:20:01.532279968 CEST	7702	49851	80.76.49.148	192.168.2.6
Jun 18, 2024 21:20:01.532355070 CEST	49851	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:20:02.285053015 CEST	49851	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:20:02.290041924 CEST	7702	49851	80.76.49.148	192.168.2.6
Jun 18, 2024 21:20:02.290252924 CEST	49851	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:20:02.295121908 CEST	7702	49851	80.76.49.148	192.168.2.6
Jun 18, 2024 21:20:02.299284935 CEST	49851	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:20:02.304115057 CEST	7702	49851	80.76.49.148	192.168.2.6
Jun 18, 2024 21:20:02.304191113 CEST	49851	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:20:02.322464943 CEST	7702	49851	80.76.49.148	192.168.2.6
Jun 18, 2024 21:20:02.322578907 CEST	49851	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:20:02.331005096 CEST	7702	49851	80.76.49.148	192.168.2.6
Jun 18, 2024 21:20:02.915683985 CEST	7702	49851	80.76.49.148	192.168.2.6
Jun 18, 2024 21:20:02.915832996 CEST	49851	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:20:02.915946007 CEST	49851	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:20:02.916692019 CEST	49852	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:20:02.920787096 CEST	7702	49851	80.76.49.148	192.168.2.6
Jun 18, 2024 21:20:02.922013044 CEST	7702	49852	80.76.49.148	192.168.2.6
Jun 18, 2024 21:20:02.922079086 CEST	49852	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:20:03.736948967 CEST	49852	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:20:03.741856098 CEST	7702	49852	80.76.49.148	192.168.2.6
Jun 18, 2024 21:20:03.741947889 CEST	49852	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:20:03.746758938 CEST	7702	49852	80.76.49.148	192.168.2.6
Jun 18, 2024 21:20:04.347594023 CEST	7702	49852	80.76.49.148	192.168.2.6
Jun 18, 2024 21:20:04.347671986 CEST	49852	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:20:04.347840071 CEST	49852	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:20:04.348376989 CEST	49853	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:20:04.352780104 CEST	7702	49852	80.76.49.148	192.168.2.6
Jun 18, 2024 21:20:04.353518009 CEST	7702	49853	80.76.49.148	192.168.2.6
Jun 18, 2024 21:20:04.353585005 CEST	49853	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:20:05.144427061 CEST	49853	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:20:05.149491072 CEST	7702	49853	80.76.49.148	192.168.2.6
Jun 18, 2024 21:20:05.149708986 CEST	49853	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:20:05.154608965 CEST	7702	49853	80.76.49.148	192.168.2.6
Jun 18, 2024 21:20:05.744209051 CEST	7702	49853	80.76.49.148	192.168.2.6
Jun 18, 2024 21:20:05.744306087 CEST	49853	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:20:05.744405985 CEST	49853	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:20:05.744879007 CEST	49854	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:20:05.752278090 CEST	7702	49853	80.76.49.148	192.168.2.6
Jun 18, 2024 21:20:05.752290964 CEST	7702	49854	80.76.49.148	192.168.2.6
Jun 18, 2024 21:20:05.752401114 CEST	49854	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:20:06.533734083 CEST	49854	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:20:06.538521051 CEST	7702	49854	80.76.49.148	192.168.2.6
Jun 18, 2024 21:20:06.538578033 CEST	49854	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:20:06.544581890 CEST	7702	49854	80.76.49.148	192.168.2.6
Jun 18, 2024 21:20:07.175192118 CEST	7702	49854	80.76.49.148	192.168.2.6
Jun 18, 2024 21:20:07.175319910 CEST	49854	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:20:07.175452948 CEST	49854	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:20:07.176096916 CEST	49855	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:20:07.180752039 CEST	7702	49854	80.76.49.148	192.168.2.6
Jun 18, 2024 21:20:07.181359053 CEST	7702	49855	80.76.49.148	192.168.2.6
Jun 18, 2024 21:20:07.181525946 CEST	49855	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:20:07.187076092 CEST	7702	49855	80.76.49.148	192.168.2.6
Jun 18, 2024 21:20:07.187233925 CEST	49855	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:20:07.187233925 CEST	49855	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:20:07.187618971 CEST	49856	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:20:07.192843914 CEST	7702	49855	80.76.49.148	192.168.2.6
Jun 18, 2024 21:20:07.193109989 CEST	7702	49856	80.76.49.148	192.168.2.6
Jun 18, 2024 21:20:07.193173885 CEST	49856	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:20:07.198755980 CEST	7702	49856	80.76.49.148	192.168.2.6
Jun 18, 2024 21:20:07.198811054 CEST	49856	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:20:07.198885918 CEST	49856	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:20:07.199470043 CEST	49857	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:20:07.203819990 CEST	7702	49856	80.76.49.148	192.168.2.6
Jun 18, 2024 21:20:07.204349995 CEST	7702	49857	80.76.49.148	192.168.2.6
Jun 18, 2024 21:20:07.204477072 CEST	49857	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:20:07.924187899 CEST	49857	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:20:07.929861069 CEST	7702	49857	80.76.49.148	192.168.2.6
Jun 18, 2024 21:20:07.930063963 CEST	49857	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:20:07.939924955 CEST	7702	49857	80.76.49.148	192.168.2.6
Jun 18, 2024 21:20:08.587414980 CEST	7702	49857	80.76.49.148	192.168.2.6
Jun 18, 2024 21:20:08.587481022 CEST	49857	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:20:08.587634087 CEST	49857	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:20:08.588154078 CEST	49858	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:20:08.592437983 CEST	7702	49857	80.76.49.148	192.168.2.6
Jun 18, 2024 21:20:08.593457937 CEST	7702	49858	80.76.49.148	192.168.2.6
Jun 18, 2024 21:20:08.593539000 CEST	49858	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:20:08.598459959 CEST	7702	49858	80.76.49.148	192.168.2.6
Jun 18, 2024 21:20:08.598526001 CEST	49858	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:20:08.598623037 CEST	49858	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:20:08.598989964 CEST	49859	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:20:08.603646040 CEST	7702	49858	80.76.49.148	192.168.2.6
Jun 18, 2024 21:20:08.603687048 CEST	7702	49859	80.76.49.148	192.168.2.6
Jun 18, 2024 21:20:08.603777885 CEST	49859	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:20:08.608668089 CEST	7702	49859	80.76.49.148	192.168.2.6
Jun 18, 2024 21:20:08.608750105 CEST	49859	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:20:08.608840942 CEST	49859	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:20:08.609154940 CEST	49860	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:20:08.613521099 CEST	7702	49859	80.76.49.148	192.168.2.6
Jun 18, 2024 21:20:08.613872051 CEST	7702	49860	80.76.49.148	192.168.2.6
Jun 18, 2024 21:20:08.613935947 CEST	49860	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:20:08.618725061 CEST	7702	49860	80.76.49.148	192.168.2.6
Jun 18, 2024 21:20:08.618807077 CEST	49860	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:20:08.618863106 CEST	49860	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:20:08.619142056 CEST	49861	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:20:08.623928070 CEST	7702	49860	80.76.49.148	192.168.2.6
Jun 18, 2024 21:20:08.623939037 CEST	7702	49861	80.76.49.148	192.168.2.6
Jun 18, 2024 21:20:08.623992920 CEST	49861	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:20:08.629251003 CEST	7702	49861	80.76.49.148	192.168.2.6
Jun 18, 2024 21:20:08.629334927 CEST	49861	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:20:08.629394054 CEST	49861	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:20:08.629708052 CEST	49862	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:20:08.634337902 CEST	7702	49861	80.76.49.148	192.168.2.6
Jun 18, 2024 21:20:08.634479046 CEST	7702	49862	80.76.49.148	192.168.2.6
Jun 18, 2024 21:20:08.634677887 CEST	49862	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:20:09.361823082 CEST	49862	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:20:09.366595030 CEST	7702	49862	80.76.49.148	192.168.2.6
Jun 18, 2024 21:20:09.366677999 CEST	49862	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:20:09.371612072 CEST	7702	49862	80.76.49.148	192.168.2.6
Jun 18, 2024 21:20:10.024282932 CEST	7702	49862	80.76.49.148	192.168.2.6
Jun 18, 2024 21:20:10.024498940 CEST	49862	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:20:10.024568081 CEST	49862	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:20:10.025163889 CEST	49863	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:20:10.030680895 CEST	7702	49862	80.76.49.148	192.168.2.6
Jun 18, 2024 21:20:10.030693054 CEST	7702	49863	80.76.49.148	192.168.2.6
Jun 18, 2024 21:20:10.030802965 CEST	49863	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:20:10.036756992 CEST	7702	49863	80.76.49.148	192.168.2.6
Jun 18, 2024 21:20:10.036814928 CEST	49863	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:20:10.036875963 CEST	49863	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:20:10.037157059 CEST	49864	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:20:10.041781902 CEST	7702	49863	80.76.49.148	192.168.2.6
Jun 18, 2024 21:20:10.041929960 CEST	7702	49864	80.76.49.148	192.168.2.6
Jun 18, 2024 21:20:10.041991949 CEST	49864	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:20:10.047007084 CEST	7702	49864	80.76.49.148	192.168.2.6
Jun 18, 2024 21:20:10.047065020 CEST	49864	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:20:10.047101974 CEST	49864	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:20:10.047353983 CEST	49865	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:20:10.052062035 CEST	7702	49864	80.76.49.148	192.168.2.6
Jun 18, 2024 21:20:10.052095890 CEST	7702	49865	80.76.49.148	192.168.2.6
Jun 18, 2024 21:20:10.052167892 CEST	49865	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:20:10.768029928 CEST	49865	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:20:10.773489952 CEST	7702	49865	80.76.49.148	192.168.2.6
Jun 18, 2024 21:20:10.773572922 CEST	49865	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:20:10.779140949 CEST	7702	49865	80.76.49.148	192.168.2.6
Jun 18, 2024 21:20:11.429557085 CEST	7702	49865	80.76.49.148	192.168.2.6
Jun 18, 2024 21:20:11.429645061 CEST	49865	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:20:11.429794073 CEST	49865	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:20:11.430295944 CEST	49866	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:20:11.434734106 CEST	7702	49865	80.76.49.148	192.168.2.6
Jun 18, 2024 21:20:11.436644077 CEST	7702	49866	80.76.49.148	192.168.2.6
Jun 18, 2024 21:20:11.436727047 CEST	49866	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:20:12.822912931 CEST	7702	49866	80.76.49.148	192.168.2.6
Jun 18, 2024 21:20:12.823113918 CEST	49866	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:20:12.823113918 CEST	49866	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:20:12.823467970 CEST	49867	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:20:12.831289053 CEST	7702	49866	80.76.49.148	192.168.2.6
Jun 18, 2024 21:20:12.833107948 CEST	7702	49867	80.76.49.148	192.168.2.6
Jun 18, 2024 21:20:12.833282948 CEST	49867	7702	192.168.2.6	80.76.49.148
Jun 18, 2024 21:20:14.244716883 CEST	7702	49867	80.76.49.148	192.168.2.6
Jun 18, 2024 21:20:14.244786978 CEST	49867	7702	192.168.2.6	80.76.49.148

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

System Behavior

Analysis Process: Wo0CkmOz64.exePID: 2752, Parent PID: 4004

General

Target ID:	0
Start time:	15:18:06
Start date:	18/06/2024
Path:	C:\Users\user\Desktop\Wo0CkmOz64.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\Wo0CkmOz64.exe"
Imagebase:	0x980000
File size:	856'064 bytes
MD5 hash:	06B81C8EDD7F620513A06E3A5CC11483
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000000.00000002.3380383003.000000001BBA0000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000000.00000002.3379202075.000000001B690000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000000.00000002.3376338658.0000000012F41000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000000.00000002.3376338658.0000000013171000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000000.00000002.3376338658.0000000013171000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000000.00000002.3371913837.0000000002C11000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Analysis Process: Wo0CkmOz64.exePID: 2752, Parent PID: 4004COMMON

Executed Functions

Function 00007FFD347713D4 Relevance: 5.8, Strings: 2, Instructions: 3303COMMON

Download Yara Rule

Strings

H, xrefs: 00007FFD34772EFE
H, xrefs: 00007FFD34771EF9

Memory Dump Source

Source File: 00000000.00000002.3382773087.00007FFD34770000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34770000_Wo0CkmOz64.jbxd

Similarity

API ID:
String ID: H$H
API String ID: 0-136785262
Opcode ID: 01e9ef4dfe311562daa8a7d65b23cdc664e8a6349d275b86109b94cf945ed9c6
Instruction ID: 267d08fed6f6da15f09647d35d2e54f0531e82464777a7f0dc73280113778bbf
Opcode Fuzzy Hash: 01e9ef4dfe311562daa8a7d65b23cdc664e8a6349d275b86109b94cf945ed9c6
Instruction Fuzzy Hash: 4413D192B0DA864FE7A696280CB52743FD1EF97204B9940BBD199C72E3DD5CFC06A341

Function 00007FFD346743B0 Relevance: .4, Instructions: 439COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3381895971.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34670000_Wo0CkmOz64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3671006aac96a1d182fbbae3da2edc16d34ee98063f9cab3f961c935daa8a4b2
Instruction ID: 09a0dec6012e8c5525fe9e9893959eeeaa5680742a27b4dba8216d248da07c54
Opcode Fuzzy Hash: 3671006aac96a1d182fbbae3da2edc16d34ee98063f9cab3f961c935daa8a4b2
Instruction Fuzzy Hash: 42D14217B0E7A507E722B7ACE8F61E63B94DF9323A70C42B3D1D8C9093DD0964498655

Function 00007FFD346772D3 Relevance: .4, Instructions: 351COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3381895971.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34670000_Wo0CkmOz64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d447a6aac0a9b22eed3562a94fbb1d3741b5a107b9fd49ab50fa82359ccd3622
Instruction ID: 926d0f6a5a1dbc28aba883c2ada612c67f242e6b0b06f18990f4557541051a05
Opcode Fuzzy Hash: d447a6aac0a9b22eed3562a94fbb1d3741b5a107b9fd49ab50fa82359ccd3622
Instruction Fuzzy Hash: B8A17517B4E7A606E721B7ACE8B61F67BD0EF9323B70C42B3D188C9093DC0D644A9645

Function 00007FFD346706FA Relevance: 2.5, Strings: 2, Instructions: 24COMMON

Download Yara Rule

Strings

N_^3, xrefs: 00007FFD346706FA
=N_^, xrefs: 00007FFD34670701

Memory Dump Source

Source File: 00000000.00000002.3381895971.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34670000_Wo0CkmOz64.jbxd

Similarity

API ID:
String ID: =N_^$N_^3
API String ID: 0-1442565542
Opcode ID: a6e89f03fde5d09723b9b96d6edb9ae81753ef9e1325f9f5694f9fab53e6051f
Instruction ID: 7bc4fc99b617f9bd30c1645740fdef5e66b1fd3c4e91d28663844702feaa5280
Opcode Fuzzy Hash: a6e89f03fde5d09723b9b96d6edb9ae81753ef9e1325f9f5694f9fab53e6051f
Instruction Fuzzy Hash: BAE0C211B9A92A0ED2826BB81DF90E8BFC0AB85210F8456B7C358C1482D84CF12E52D2

Function 00007FFD34675805 Relevance: 1.4, Strings: 1, Instructions: 148COMMON

Download Yara Rule

Strings

M_^, xrefs: 00007FFD34675A01

Memory Dump Source

Source File: 00000000.00000002.3381895971.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34670000_Wo0CkmOz64.jbxd

Similarity

API ID:
String ID: M_^
API String ID: 0-3807191693
Opcode ID: 2ee20bf0996f822a5543be496256a6a818f396563bb2aeec4b635e0525ce9ffe
Instruction ID: 0f753eb2eef454febc270c50c6f65aaabe107548921492cdd981d263431c273c
Opcode Fuzzy Hash: 2ee20bf0996f822a5543be496256a6a818f396563bb2aeec4b635e0525ce9ffe
Instruction Fuzzy Hash: 4041B617B0E7A606E352B76CE8F61E63F90DF5323AB0C42F3C288C9493DC0D944A9291

Function 00007FFD346722D8 Relevance: 1.3, Strings: 1, Instructions: 18COMMON

Download Yara Rule

Strings

X#q4, xrefs: 00007FFD34686005

Memory Dump Source

Source File: 00000000.00000002.3381895971.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34670000_Wo0CkmOz64.jbxd

Similarity

API ID:
String ID: X#q4
API String ID: 0-40287466
Opcode ID: 8987cf877736dc561fba305aafcd9fba88f19e74b8ad7d1abab21eaa0bf56422
Instruction ID: 51764f5551cade6decb78347474b916a138976ef6236b89fc9412b37c6babee7
Opcode Fuzzy Hash: 8987cf877736dc561fba305aafcd9fba88f19e74b8ad7d1abab21eaa0bf56422
Instruction Fuzzy Hash: 51D05E91E5E6AA09FB946E3808E53E02FC09F63314F891974E60AC52D2DDCE65966206

Function 00007FFD34773145 Relevance: .5, Instructions: 518COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3382773087.00007FFD34770000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34770000_Wo0CkmOz64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb7c45a1518240d0bf5cb733bf7505ed047a634136d7c459be6b6cbb7eeb0459
Instruction ID: d10fca98190a8473ec7355a1f3358aff084133c17eada9aa62666b1973d64ed3
Opcode Fuzzy Hash: cb7c45a1518240d0bf5cb733bf7505ed047a634136d7c459be6b6cbb7eeb0459
Instruction Fuzzy Hash: 5FE17691F5DD5B4BF6AA962808F12BC2AC2EFD7254B94407AD21DC32C6DD5CFD02A381

Function 00007FFD34671E78 Relevance: .4, Instructions: 435COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3381895971.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34670000_Wo0CkmOz64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8d9340262b83351e54cb7a687b521d7004a9642e8f2b5c272bf321ad7fbbf3c
Instruction ID: 4a8ea1d39429b1c847d4f3ed53190c21801da87c69474553744355fc9a24d314
Opcode Fuzzy Hash: c8d9340262b83351e54cb7a687b521d7004a9642e8f2b5c272bf321ad7fbbf3c
Instruction Fuzzy Hash: 2BD1C471B0C9198FEB94EF6CC4A66F977E1FF99314B1406B9D14EC7292DE24A842C780

Function 00007FFD34677C75 Relevance: .3, Instructions: 313COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3381895971.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34670000_Wo0CkmOz64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94e5c7ef620daed1dd15077f2cf7af96b8076f21b1f622158e04a6a34b07963b
Instruction ID: 134a2b97a9f79f605a9a53e7adfd1a375e05a178875eaff3d48d44c75c22b22b
Opcode Fuzzy Hash: 94e5c7ef620daed1dd15077f2cf7af96b8076f21b1f622158e04a6a34b07963b
Instruction Fuzzy Hash: B2917657B0E6660AD326B7ACFCF21F67B94DF9327B70C82B3D188C9153EC0968494591

Function 00007FFD34676A05 Relevance: .3, Instructions: 298COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3381895971.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34670000_Wo0CkmOz64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 59bf5b059e536014344cbd66a70f64bb24be3943189179d20e946aa66ea4aeeb
Instruction ID: 0217dac1af49059d99bf5e59df25b09f980a1eb033e5b99bf85be06797f75a3c
Opcode Fuzzy Hash: 59bf5b059e536014344cbd66a70f64bb24be3943189179d20e946aa66ea4aeeb
Instruction Fuzzy Hash: B8819727B0E76606E715BBACF8F61F67B90EF9323A74C82B3D1C8C9053DC0964498695

Function 00007FFD34671EC8 Relevance: .3, Instructions: 273COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3381895971.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34670000_Wo0CkmOz64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5ed1789a9414db219e71e14b312fc4ff10412bb937f0d5f9c198ea1b241eb8c
Instruction ID: 9aa8e0db7852bd325bbdf74d95fa4438e469b68428e3d0be45f4548cc714faee
Opcode Fuzzy Hash: c5ed1789a9414db219e71e14b312fc4ff10412bb937f0d5f9c198ea1b241eb8c
Instruction Fuzzy Hash: 02918171B089198FEB94EF58C495AF977E2FF59310B1002B9D11EC7296DE38B8428B80

Function 00007FFD34670493 Relevance: .3, Instructions: 259COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3381895971.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34670000_Wo0CkmOz64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7abc52647992b4b7b08b764e16dc566a109843581f8dcc6369aa7731fe647359
Instruction ID: 4c1326cee4f950c06e4f0921673be33e0ce28809245f909be45b60155ee06740
Opcode Fuzzy Hash: 7abc52647992b4b7b08b764e16dc566a109843581f8dcc6369aa7731fe647359
Instruction Fuzzy Hash: FA811552E0EAE24FF7219E6858B51F97FA0EF53314B1840BBD198CB0D7D91CAC0693A1

Function 00007FFD346709D5 Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3381895971.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34670000_Wo0CkmOz64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71ff05fff6f3f2186627f6db768df83f006c0493e293baa9e611afd2ba72d3f1
Instruction ID: 602985e69fa9072f0cb06e7c89545fdfa303a395f9b2849b14b263237114c052
Opcode Fuzzy Hash: 71ff05fff6f3f2186627f6db768df83f006c0493e293baa9e611afd2ba72d3f1
Instruction Fuzzy Hash: 4D515D70F18D1D8FEB98EF5C98A56BDBBE2EF99310F408179D10DD3292CE28A8419750

Function 00007FFD34676B63 Relevance: .2, Instructions: 175COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3381895971.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34670000_Wo0CkmOz64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe80d1af977d22fe07b4cffe440e36d50959195b52e7cc6dc36ca2e52ed06aec
Instruction ID: 8982c68c292cbb411592f1f0ec02a11ca4e5c16573728ee3b2f7fc7e4c562fbf
Opcode Fuzzy Hash: fe80d1af977d22fe07b4cffe440e36d50959195b52e7cc6dc36ca2e52ed06aec
Instruction Fuzzy Hash: 73416327B0E7A60AE715B7ACF8B60F67B90DF9323A74C42F3D1C8C9093DC0964498695

Function 00007FFD3467705D Relevance: .2, Instructions: 172COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3381895971.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34670000_Wo0CkmOz64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aefe48709d591ffaf213a7396bc07766886c52765d0fd7327a6c27e9aff1e02a
Instruction ID: 6e750411ad71a6f8b3b3457014b8d65d7c704715a1a5c92cd667bc3c90339a07
Opcode Fuzzy Hash: aefe48709d591ffaf213a7396bc07766886c52765d0fd7327a6c27e9aff1e02a
Instruction Fuzzy Hash: 73418822B0DA650BE764EB6CD8F65F53BD0EF52326B4842B7D089CA193DC1DB8498781

Function 00007FFD347745DD Relevance: .2, Instructions: 172COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3382773087.00007FFD34770000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34770000_Wo0CkmOz64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 670072c050f7096f0d5d777d4eb8ff2485fb3867745e5aee83f4d2af3f5f6f19
Instruction ID: 730f65b9702c6b12e3182530d082d770d043b81cd858b0179774c717385129db
Opcode Fuzzy Hash: 670072c050f7096f0d5d777d4eb8ff2485fb3867745e5aee83f4d2af3f5f6f19
Instruction Fuzzy Hash: 6E41C351B1DBDA4FE796962808F52B53FE2EF97200B4940BBD289C72D3CD9DAC056342

Function 00007FFD34670878 Relevance: .1, Instructions: 149COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3381895971.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34670000_Wo0CkmOz64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 291071c4cb86d8be47f45861a8c0308fea4ac5c68c89d0b83e3a66f3069d4349
Instruction ID: 36b763886c53dfb76697e7476b4b30e0d3b1d354835e88f35f8356a953f110f3
Opcode Fuzzy Hash: 291071c4cb86d8be47f45861a8c0308fea4ac5c68c89d0b83e3a66f3069d4349
Instruction Fuzzy Hash: 12412B35B1895C9FEB94EF6CD898EA877F1FF69301B0501A9E109D7266DE24EC41CB10

Function 00007FFD3467719D Relevance: .1, Instructions: 144COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3381895971.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34670000_Wo0CkmOz64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1529d4af7839db242983e7aa3caf17ca92ca1e39444d4f9c003d0d7cf1e17050
Instruction ID: 3c5326e2216a94d1ef4c19a4e424f81159670835bb03629f212676788863e1ad
Opcode Fuzzy Hash: 1529d4af7839db242983e7aa3caf17ca92ca1e39444d4f9c003d0d7cf1e17050
Instruction Fuzzy Hash: D0314B23B09A1907D718BB6CECF60F577D0EFA722774C43B3D148CA193DC0AA8898681

Function 00007FFD34677F18 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3381895971.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34670000_Wo0CkmOz64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 82d6b04ed209546e91200f77db6cb1f42e6618f8ec9879d0ece7dd80c61de678
Instruction ID: 7e8d1f195aaba920a15e0e9ffcead5e8bf4e50d36712fc08d6d29bc47814686f
Opcode Fuzzy Hash: 82d6b04ed209546e91200f77db6cb1f42e6618f8ec9879d0ece7dd80c61de678
Instruction Fuzzy Hash: 4531C613B4E7950BD715B7ACE8B21F63BA0DF5322A70C41B3D188CA093EC0DA8898651

Function 00007FFD347728B6 Relevance: .1, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3382773087.00007FFD34770000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34770000_Wo0CkmOz64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 66df17f3febedb7b9d752e4cb39289cf42686756ad4ec0b27bc4e23e25f41f6a
Instruction ID: 9d7093cac6a6905f0622df8a1cdd45624d022e770030b1a509d506e911c4fcef
Opcode Fuzzy Hash: 66df17f3febedb7b9d752e4cb39289cf42686756ad4ec0b27bc4e23e25f41f6a
Instruction Fuzzy Hash: C531C491B18D4A4FF7E5962C08B12796AC2EFD9244B99447AD51ED33C3ED2CFC02A381

Function 00007FFD34675745 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3381895971.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34670000_Wo0CkmOz64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f814ef24758de2d707316e025464aaf73012eeee435421f29a49e87e3f45782
Instruction ID: d702144c928b39cd87b58c08f05eded1b79e936c7f72f8b32575aa8c47594a1e
Opcode Fuzzy Hash: 6f814ef24758de2d707316e025464aaf73012eeee435421f29a49e87e3f45782
Instruction Fuzzy Hash: 66312921B1DB494BC709BB6CD8B50F57BE0EF9721674802F7D189CA183EC1EA88AC741

Function 00007FFD34772C5E Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3382773087.00007FFD34770000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34770000_Wo0CkmOz64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e5fe61bd394ed785acd2e962f849d62cacb34d989d23b05c43efdec59c2bc1e
Instruction ID: 15dad857ea688b1f883ad2d630313c2f3db821115eeb805b6a56f3d87615904f
Opcode Fuzzy Hash: 5e5fe61bd394ed785acd2e962f849d62cacb34d989d23b05c43efdec59c2bc1e
Instruction Fuzzy Hash: 9031B551B18D4A4FF7E5962C08B127969C2EFEA640B94447AD55EC33D6ED2CFC02A341

Function 00007FFD34772D49 Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3382773087.00007FFD34770000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34770000_Wo0CkmOz64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 854df0444f1c939fec0a99559966dc61f955bcb708507a00cae3b22b589ab16b
Instruction ID: fbae8c7d4ed0ff9804645b15cab8b90a6493c7e2a77ded143201979e2e517f7c
Opcode Fuzzy Hash: 854df0444f1c939fec0a99559966dc61f955bcb708507a00cae3b22b589ab16b
Instruction Fuzzy Hash: 9B31B391F18D0A4FF7D5A62C08B527966C2EFDA644BD5807A911EC33C6EE2CFC02A341

Function 00007FFD34771FE7 Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3382773087.00007FFD34770000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34770000_Wo0CkmOz64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 42eafffa52c5d76dc584e3b10be8cb12585a734eea5580850b9806f4e9f4e2dc
Instruction ID: 21a3392b8dcf1505c2b05ed3c05b6bc3b89edcb29f0c849a60fd734bdf3b5a4c
Opcode Fuzzy Hash: 42eafffa52c5d76dc584e3b10be8cb12585a734eea5580850b9806f4e9f4e2dc
Instruction Fuzzy Hash: E131C251F19D0A4BE7E5AA2C08B527966C2EFDA644B98447A911EC32D6DD2CFC02E341

Function 00007FFD346777D5 Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3381895971.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34670000_Wo0CkmOz64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8555a87dec56813db985b74f0eddb12a5acadcf24df1aba6146844efbfcfbf7b
Instruction ID: 08b9de886bebf413825be4042a665b0adf2b4271b5848121862637045e6f16f7
Opcode Fuzzy Hash: 8555a87dec56813db985b74f0eddb12a5acadcf24df1aba6146844efbfcfbf7b
Instruction Fuzzy Hash: 4821931660E7D54FC716B7ADE8B21F67BA09F9322A70C42F7D1C8CA193CC18A8498695

Function 00007FFD34677F95 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3381895971.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34670000_Wo0CkmOz64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a2560d47b321e49171acda834e6c876e070f803a414721ca997d0931d3a00a0
Instruction ID: a44b2371e1eadcc6b1a64a717bebb919de91b20ca52c6f74aa726945410f17cb
Opcode Fuzzy Hash: 7a2560d47b321e49171acda834e6c876e070f803a414721ca997d0931d3a00a0
Instruction Fuzzy Hash: EA21A712B0D6550FC716BB7CDCB55F53BA0DF9712A70C42B3D188CA1A3EC0DA8498651

Function 00007FFD34771CB0 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3382773087.00007FFD34770000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34770000_Wo0CkmOz64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4420076d4a98c3e08e55686f51e2dd0e465a313e4b890d8f0230ff4395d9f928
Instruction ID: 41420e8a515825b52c00ac10cdcda84de0012167c8696dfa3a78915b177d954b
Opcode Fuzzy Hash: 4420076d4a98c3e08e55686f51e2dd0e465a313e4b890d8f0230ff4395d9f928
Instruction Fuzzy Hash: E0219391B1EAC64FE392862808B11747FE2EF97140B9980F6C149C72D3DD5DF809E341

Function 00007FFD34772D30 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3382773087.00007FFD34770000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34770000_Wo0CkmOz64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 442b99f0626cbaf25f38a0d6a84bbd696f55cc03807fdfaa9cd56d96be3fe50e
Instruction ID: 86610bdf3ae4a176122664cf80cf75f6bba1bf483c77a8cda709f984003fc66e
Opcode Fuzzy Hash: 442b99f0626cbaf25f38a0d6a84bbd696f55cc03807fdfaa9cd56d96be3fe50e
Instruction Fuzzy Hash: 8E21CB91B19D4B4BF6E5962C08F127926C2EFD6644BD8847AD55EC32C6ED5CFC02A340

Function 00007FFD34677A68 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3381895971.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34670000_Wo0CkmOz64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: edbee2bd7cc7e39851a1510974933d55ac685fc7875bccaba4325486040afc63
Instruction ID: 009cb777051d73a5ff5ccac4e2f168bb915beffaf8c699df047e7756f0a969d7
Opcode Fuzzy Hash: edbee2bd7cc7e39851a1510974933d55ac685fc7875bccaba4325486040afc63
Instruction Fuzzy Hash: 05118412B0D7550AD716B7ACE8B61F77B94DFA322E70C43B3D1C8C9193DC09A4898685

Function 00007FFD34674775 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3381895971.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34670000_Wo0CkmOz64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 767bf2883d95b602c8a01002107c82bbe44a03252b36db1bd95c4ac9f43ccd5d
Instruction ID: 20475b22db914e6576f28e97ff70ad1c84b63df77817e55da45b90a9a1a5c33d
Opcode Fuzzy Hash: 767bf2883d95b602c8a01002107c82bbe44a03252b36db1bd95c4ac9f43ccd5d
Instruction Fuzzy Hash: 5611A921709A894FC709AB7C9CB90F07BA0DFA711674802F7D089C7193DC1D9849C741

Function 00007FFD346775CD Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3381895971.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34670000_Wo0CkmOz64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e18c2b250f5fdf2977f0bb1c6753822a8cfe0573b4d1c0c05320f53021ccd057
Instruction ID: ff6cf3984d7100ef7b15e92ffd13af1e1cf9d42107a16326718eba4af30e636d
Opcode Fuzzy Hash: e18c2b250f5fdf2977f0bb1c6753822a8cfe0573b4d1c0c05320f53021ccd057
Instruction Fuzzy Hash: 34119A23B0D7A54BD715B7ACE8B21F67BD0DF9713E71801B7D1C8CA143DC09A8498691

Function 00007FFD34677555 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3381895971.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34670000_Wo0CkmOz64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4adf1da8817cc52873b0141406b868d2369de11f2eaf51d50e6c0c54087d2610
Instruction ID: 2f2b4c451ab9e25669f5bf0c72e62aaec9d81fe7470586d4d6691fb073834374
Opcode Fuzzy Hash: 4adf1da8817cc52873b0141406b868d2369de11f2eaf51d50e6c0c54087d2610
Instruction Fuzzy Hash: DE11EE22B0E7550BD716B7ACE8B21F67B90EF9323A70C43F7D1C8C9183DC0994898685

Function 00007FFD34676585 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3381895971.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34670000_Wo0CkmOz64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea15e5cda5495e8a87724e9bf2eb65240ed32eb2558a02cd6d765d670d562e9d
Instruction ID: 43f7e5dcf60382c306d5a61c31aca0e3b6ce7a9574cb2cac3251adc47c18e280
Opcode Fuzzy Hash: ea15e5cda5495e8a87724e9bf2eb65240ed32eb2558a02cd6d765d670d562e9d
Instruction Fuzzy Hash: 95012031B04E194BD70CBA2CCCA94F473D0EFA622674843BBD009C61A6EC19EC858741

Function 00007FFD346747E5 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3381895971.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34670000_Wo0CkmOz64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e68207998d09b13e8bb100f793f64ad1f6fc42db8ab16c6c020f20e4f0e4d7e
Instruction ID: 2eb75a009a128d437cf385a94b1efe0a35f19c0f65ec90d065b436128d146eed
Opcode Fuzzy Hash: 2e68207998d09b13e8bb100f793f64ad1f6fc42db8ab16c6c020f20e4f0e4d7e
Instruction Fuzzy Hash: 5801DB31B149094BCB0CBB2CC8A95B477D0EF6A6167884176D049C7292ED1AEC89C741

Function 00007FFD34675AFB Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3381895971.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34670000_Wo0CkmOz64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e79da22184615a70cd7763b46d2a2626bbc9c1159e8ff2f2f3f7f983ec6910e
Instruction ID: 3c32e69ea240e20016c29bd202cb35252584e766477134cf2817acd79c448d21
Opcode Fuzzy Hash: 5e79da22184615a70cd7763b46d2a2626bbc9c1159e8ff2f2f3f7f983ec6910e
Instruction Fuzzy Hash: C501D235A08B4C8FCB54EF1CD4556E67BE4EFAA316F44026FE48AC3251CA31A8448781

Function 00007FFD34678845 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3381895971.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34670000_Wo0CkmOz64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 312bc2f057e2f52ad67cd4090ac8ade0fed038a4f7553f34f51ffac9db8839cb
Instruction ID: 695f6604ebef5deb5b3c5d04d2e85e3f5a2ba8cd5237c6c257177ca0e3acd316
Opcode Fuzzy Hash: 312bc2f057e2f52ad67cd4090ac8ade0fed038a4f7553f34f51ffac9db8839cb
Instruction Fuzzy Hash: FE115E35A1D3898FE712DF688CA41DD7FB0AF46350F1881E6D195CB192D63C5944A741

Function 00007FFD346756F5 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3381895971.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34670000_Wo0CkmOz64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 87f8f42574fb0964c9aa68b21104897615171f852d594280af21ded93d06cf66
Instruction ID: 3a76060dabe695473baff2bf220c6e2075ad6165f5d87a9942c307b3190dea34
Opcode Fuzzy Hash: 87f8f42574fb0964c9aa68b21104897615171f852d594280af21ded93d06cf66
Instruction Fuzzy Hash: 9AF09E3270CB190BD728B76DE4A60F6B3D4DF9621A30842BBD08EC7293DC14BC858680

Function 00007FFD34675A32 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3381895971.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34670000_Wo0CkmOz64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af438930d964e34e6bc1caafb8fee304f6b9dd3844372ed4f4027295edf4e0e1
Instruction ID: 69f458e51ea5d84d960b00a26ef97864a9810ca9aa50ca99370ffb547a224a3e
Opcode Fuzzy Hash: af438930d964e34e6bc1caafb8fee304f6b9dd3844372ed4f4027295edf4e0e1
Instruction Fuzzy Hash: 48F027227099D64FCB4AA73CD9B94E07F90EE9712234441FBC089CF592D82AD84ED7D1

Function 00007FFD346769B0 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3381895971.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34670000_Wo0CkmOz64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c81ae90f134a8c61d17b8ee1ab113388ba00085f234c0d34c218185640e1906f
Instruction ID: 6d4f35e01f323e6f4eadd04016f9f35d85a6e3b90735b4366623f8575791e76b
Opcode Fuzzy Hash: c81ae90f134a8c61d17b8ee1ab113388ba00085f234c0d34c218185640e1906f
Instruction Fuzzy Hash: FBF0A722B1DA664BD769BB6CC8B54F53BE0EF6222674C81B3D049CA1E3EC1CE44DD641

Function 00007FFD34679220 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3381895971.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34670000_Wo0CkmOz64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6363f6822be3c19f0e0e8a7c7301e78fc16e9de24c6e720aa8281b92dfd3ff5a
Instruction ID: 3ee96f9736ac8987c849af68ddb57addd30cc5d95b502495be21b6fa3f4fe624
Opcode Fuzzy Hash: 6363f6822be3c19f0e0e8a7c7301e78fc16e9de24c6e720aa8281b92dfd3ff5a
Instruction Fuzzy Hash: 60F03615F098294AF794DF2858E62F92AC2FB8A344F44C676D60ED3286DD2C6C066B41

Function 00007FFD346756CD Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3381895971.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34670000_Wo0CkmOz64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ca2cc85aa1a4d931e2d7e633d60c4e2147cd4ffe36a7b10faab0092178052e2
Instruction ID: 73be9a5bc4df1604837b76287a2bdfc3ae714d9d89e05c4fab2f9dd1fb2efb99
Opcode Fuzzy Hash: 9ca2cc85aa1a4d931e2d7e633d60c4e2147cd4ffe36a7b10faab0092178052e2
Instruction Fuzzy Hash: 34F05C137099490BC709BB3CDCAA5F437D0EF9322674C02F6C048C65A2ED1AA80AC740

Function 00007FFD3467571D Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3381895971.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34670000_Wo0CkmOz64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2e87bbe649d8e5a7db23fd3ad0404f3aaaf21f89383b22db561802c1b500265
Instruction ID: 11b6999f59c4ef92111b3b9d505dd4da2096a2ee02fb747f48d51e61ef19dc47
Opcode Fuzzy Hash: c2e87bbe649d8e5a7db23fd3ad0404f3aaaf21f89383b22db561802c1b500265
Instruction Fuzzy Hash: 5CF05C12B046854BC718FB3CDCAA5F43BD0EF92225B4801F6D088CE193DC19D889C751

Function 00007FFD3467603D Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3381895971.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34670000_Wo0CkmOz64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 350190e2d9d0fbdeb307bcb88a4f8906bd9128e70b0a961c7c6c24083e06c424
Instruction ID: 4b94749b988f9269be0f2a07f7d48cc0c90804f0dd6075352056a3797ae4ae7f
Opcode Fuzzy Hash: 350190e2d9d0fbdeb307bcb88a4f8906bd9128e70b0a961c7c6c24083e06c424
Instruction Fuzzy Hash: D8F0AB32704A044BC309B73CDCAA6E43BE0DFA722AF4901FAC18AC7193DC0AD80AC740

Function 00007FFD3467B144 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3381895971.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34670000_Wo0CkmOz64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df0f69c5782854f5240531d946cb4e1c1d5b525c20f4185cf02a80d2ea1d2e74
Instruction ID: 0b02192de2b5fb919dc293e6d7e9adb89d6c2001977dc2e7a40cf086e7b70ca0
Opcode Fuzzy Hash: df0f69c5782854f5240531d946cb4e1c1d5b525c20f4185cf02a80d2ea1d2e74
Instruction Fuzzy Hash: 23E0ED25F198299AE694EF1898A66F82AC1FB8A740F408776D20ED3282DD1C6D426781

Function 00007FFD346755D3 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3381895971.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34670000_Wo0CkmOz64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: efd5b181c41c000777e0dd029e55c64fc394409d981f9c37621a1097f9c1744f
Instruction ID: dcd7b3dac7e802d7c86265015595ceae8d33592ef35a0b42c3d3b5627850efd7
Opcode Fuzzy Hash: efd5b181c41c000777e0dd029e55c64fc394409d981f9c37621a1097f9c1744f
Instruction Fuzzy Hash: 78E0C230B64A4C4B8B0CB62D88A90B4B3D5EB9B11638413BAC04AC2285EC19DC8A8781

Function 00007FFD34676500 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3381895971.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34670000_Wo0CkmOz64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e96d03f9878ec939352fc03d5fb1186831e6f3d7665eb175b372815112c96153
Instruction ID: 6f7978904b8e50d6f5b40efc8d5f3438e1337a0bb1e8f65f11b4ddd11dd88f86
Opcode Fuzzy Hash: e96d03f9878ec939352fc03d5fb1186831e6f3d7665eb175b372815112c96153
Instruction Fuzzy Hash: CCE0CD20714A0947CB0CB53C48A90B1B3D1EF65106784427AD009C6192DC19DCC48741

Function 00007FFD34680CF0 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3381895971.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34670000_Wo0CkmOz64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd3a42e445e96ed8322664ae51c996cd283590b88514a77e475635294a1ed2e9
Instruction ID: 628513021618463b0e6a6c44ffcc1b576420866bb8b5a7750f0e2b6f93d7679a
Opcode Fuzzy Hash: fd3a42e445e96ed8322664ae51c996cd283590b88514a77e475635294a1ed2e9
Instruction Fuzzy Hash: C3E01B2075891E5FEB84F779D4A667422D1F75D205B4105B9D50DC3381DD2898508741

Function 00007FFD346772FA Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3381895971.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34670000_Wo0CkmOz64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e374bc411016711d027647db4b776f6ee49c1ed068ca47575760edc87ad69aec
Instruction ID: b587450b47b5bf7a6106956553c0437d89cec9dfb32d554185dd18cdd8413c37
Opcode Fuzzy Hash: e374bc411016711d027647db4b776f6ee49c1ed068ca47575760edc87ad69aec
Instruction Fuzzy Hash: B1E0CD30714E0C8BCB0CAA2C48990B0B7D1EF65202784026AD407C31D1DD15D8C5C745

Function 00007FFD346762D8 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3381895971.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34670000_Wo0CkmOz64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb3c5a519f0f4e4ca7b0056404c5e30fe6810b1e1e72a0cd63dda622f0f107e9
Instruction ID: c2f2a73392333c917717450523aa756709cded36c2e9a91548104e4ede753836
Opcode Fuzzy Hash: fb3c5a519f0f4e4ca7b0056404c5e30fe6810b1e1e72a0cd63dda622f0f107e9
Instruction Fuzzy Hash: 10D05B207599444FCB5CB77C88E55B137D0EF6A21578440A5D04EC71A3DD19D844C741

Function 00007FFD346706A5 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3381895971.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34670000_Wo0CkmOz64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07a3160f0f74fd0e3df30dd6913d11ec8870a11d4f0073d06b872e7acec190bb
Instruction ID: 57da28b237b7a8de20d4367a535596d20687e4b39fff2fd7874c9fff0372d7af
Opcode Fuzzy Hash: 07a3160f0f74fd0e3df30dd6913d11ec8870a11d4f0073d06b872e7acec190bb
Instruction Fuzzy Hash: A6D05E73B5B8458FD600EA29DCE21D83731EADA221BD816B1D154CA087DA6E904B9753

Function 00007FFD347741AE Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3382773087.00007FFD34770000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34770000_Wo0CkmOz64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c4db3c1ff35be7120f5db7953e230ea6589bf46ec792b176491d33f6362df0b
Instruction ID: 1c8847ec79681458df8ae0828204a4a9793aca52e0c6efc1bf37db17d41fb835
Opcode Fuzzy Hash: 3c4db3c1ff35be7120f5db7953e230ea6589bf46ec792b176491d33f6362df0b
Instruction Fuzzy Hash: 1BD0C70173D92547F504158D6C923F97285DF89B15F50413AD719C67C9CC9D7C9122D2

Function 00007FFD346CB820 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3381895971.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34670000_Wo0CkmOz64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2cba1b41126526f75a0803eea9f16bb6571da5a89aa4cb2979448745a51b7c35
Instruction ID: 93e2af40daecfd1dc081efd66d5ffcf9f96c26ae5ac659614b0b82a9acdf1f2f
Opcode Fuzzy Hash: 2cba1b41126526f75a0803eea9f16bb6571da5a89aa4cb2979448745a51b7c35
Instruction Fuzzy Hash: 64C012347509044F870CA63888598603391D76A1167854059D006C7271D966DC89C741

Non-executed Functions

Function 00007FFD347705D4 Relevance: .7, Instructions: 693COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3382773087.00007FFD34770000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34770000_Wo0CkmOz64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ffd54f82a0dc9d39b28d61e16a306d6628de088e9e477c06a95b8dc87b2f13bc
Instruction ID: 4ba6a44aeb2e60168b91627b1ed87ae6cf1f24bf8c66ebb155e0cfaba0a6928f
Opcode Fuzzy Hash: ffd54f82a0dc9d39b28d61e16a306d6628de088e9e477c06a95b8dc87b2f13bc
Instruction Fuzzy Hash: DA22CDA294E7C28FE75397744CB94607FB0AE13610B4E85EBC1D4CB4E3D58DA809D7A2

Function 00007FFD34673387 Relevance: .7, Instructions: 688COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3381895971.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34670000_Wo0CkmOz64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 89d2d85f5c22965f13aae46ff39eb23468c67933badd511924baf8a058acde30
Instruction ID: 40b77b0a178cec8cf7005bb24e2e26b75e02d3f6a6d0a622124aa7535f522096
Opcode Fuzzy Hash: 89d2d85f5c22965f13aae46ff39eb23468c67933badd511924baf8a058acde30
Instruction Fuzzy Hash: FF02E227B4C6724AD221BBEDF8A15FABB54DFD137B7084177D388C90439D18608A8BD5

Function 00007FFD346740FA Relevance: .7, Instructions: 686COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3381895971.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34670000_Wo0CkmOz64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a083e432c6bcf2d9db87246adbfd335342c90b53371dfb8377d724c1bda8b442
Instruction ID: 44091c3826c7c502e3a495c67b23c30fb5a0363f335eca32f64885bbe2757971
Opcode Fuzzy Hash: a083e432c6bcf2d9db87246adbfd335342c90b53371dfb8377d724c1bda8b442
Instruction Fuzzy Hash: C3223E17A4E7A14BE722B7ACE8F61E73B94DF9323E70C41B3D2D8C9093DD0864498695

Function 00007FFD346734D3 Relevance: .5, Instructions: 505COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3381895971.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34670000_Wo0CkmOz64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ceb26377c8b3de6dc5b5405a496bf0cdc4e7178b8fdff9556ad54963f6c68e8
Instruction ID: 0104d380d1891a046e438811e6f86f56295a51fb26fbb4fcf1116f8de302254c
Opcode Fuzzy Hash: 2ceb26377c8b3de6dc5b5405a496bf0cdc4e7178b8fdff9556ad54963f6c68e8
Instruction Fuzzy Hash: F3D19F27B4C6620AD221BBEDF8A25FA7B54DFD137B7044177D3C8C90939D18608A8BD5

Function 00007FFD346729FA Relevance: .1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3381895971.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34670000_Wo0CkmOz64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 935f5f0d59155bdc3b235aabc16018842657eeb90519f15a48d11997a397338a
Instruction ID: e0910b9848a4242d3e177a7c5d54ab59f7a84b131ebc3350b63675a4d576cc86
Opcode Fuzzy Hash: 935f5f0d59155bdc3b235aabc16018842657eeb90519f15a48d11997a397338a
Instruction Fuzzy Hash: 7021812BB4CA764A8315BAFDB8911FBB790DF8237A7445577C3C6C94438904648747D4

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Wo0CkmOz64.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Network Port Distribution

TCP Packets

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

System Behavior

Analysis Process: Wo0CkmOz64.exePID: 2752, Parent PID: 4004

General

Chronological Activities

Windows Analysis Report
Wo0CkmOz64.exe