Edit tour

Windows Analysis Report
7Y18r(223).exe

Overview

General Information

Sample name:	7Y18r(223).exe
Analysis ID:	1482699
MD5:	b77a751dbe5de08be02a2e38cedeccbf
SHA1:	5a69eaed587eabcb77049c71f4b2de94e7f71053
SHA256:	e6a8f27d09c850978b635d02a99758fe27e2accbe11eeab7588f90726fc89e74
Tags:	exe
Infos:

Detection

Bdaejec

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Detected unpacking (changes PE section rights)

Detected unpacking (creates a PE file in dynamic memory)

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Yara detected Bdaejec

AI detected suspicious sample

Connects to many ports of the same IP (likely port scanning)

Found evasive API chain (may stop execution after checking mutex)

Infects executable files (exe, dll, sys, html)

Machine Learning detection for dropped file

Machine Learning detection for sample

May modify the system service descriptor table (often done to hook functions)

PE file contains section with special chars

PE file has a writeable .text section

Sigma detected: Potential Persistence Via COM Hijacking From Suspicious Locations

AV process strings found (often used to terminate AV products)

Checks if the current process is being debugged

Contains functionality to create an SMB header

Contains functionality to dynamically determine API calls

Contains functionality to read the PEB

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Entry point lies outside standard sections

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found decision node followed by non-executed suspicious APIs

Found dropped PE file which has not been started or loaded

Found evasive API chain (date check)

Found evasive API chain (may stop execution after accessing registry keys)

Found evasive API chain (may stop execution after checking a module file name)

Found inlined nop instructions (likely shell or obfuscated code)

Installs a raw input device (often for capturing keystrokes)

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

PE file contains executable resources (Code or Archives)

PE file contains sections with non-standard names

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Use Short Name Path in Command Line

Sleep loop found (likely to delay execution)

Tries to resolve domain names, but no domain seems valid (expired dropper behavior)

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Uses the system / local time for branch decision (may execute only at specific dates)

Yara signature match

Classification

Process Tree

System is w10x64

7Y18r(223).exe (PID: 1796 cmdline: "C:\Users\user\Desktop\7Y18r(223).exe" MD5: B77A751DBE5DE08BE02A2E38CEDECCBF)

JdaybS.exe (PID: 6676 cmdline: C:\Users\user~1\AppData\Local\Temp\JdaybS.exe MD5: F7D21DE5C4E81341ECCD280C11DDCC9A)

WerFault.exe (PID: 7992 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 6676 -s 1364 MD5: C31336C1EFC2CCB44B4326EA793040F2)

cleanup

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	Linux_Trojan_Rbot_96625c8c	unknown	unknown	0xdad11:$a: 24 28 8B 45 3C 8B 54 05 78 01 EA 8B 4A 18 8B 5A 20 01 EB E3 38 49 8B 0xdd6c0:$a: 24 28 8B 45 3C 8B 54 05 78 01 EA 8B 4A 18 8B 5A 20 01 EB E3 38 49 8B 0x10eb23:$a: 24 28 8B 45 3C 8B 54 05 78 01 EA 8B 4A 18 8B 5A 20 01 EB E3 38 49 8B 0x127b82:$a: 24 28 8B 45 3C 8B 54 05 78 01 EA 8B 4A 18 8B 5A 20 01 EB E3 38 49 8B 0x146f6d:$a: 24 28 8B 45 3C 8B 54 05 78 01 EA 8B 4A 18 8B 5A 20 01 EB E3 38 49 8B 0x162a84:$a: 24 28 8B 45 3C 8B 54 05 78 01 EA 8B 4A 18 8B 5A 20 01 EB E3 38 49 8B 0x163ffd:$a: 24 28 8B 45 3C 8B 54 05 78 01 EA 8B 4A 18 8B 5A 20 01 EB E3 38 49 8B 0x165500:$a: 24 28 8B 45 3C 8B 54 05 78 01 EA 8B 4A 18 8B 5A 20 01 EB E3 38 49 8B 0x1801e9:$a: 24 28 8B 45 3C 8B 54 05 78 01 EA 8B 4A 18 8B 5A 20 01 EB E3 38 49 8B

Memory Dumps

Source	Rule	Description	Author	Strings
00000002.00000002.2567412345.0000000000610000.00000040.00001000.00020000.00000000.sdmp	Linux_Trojan_Rbot_96625c8c	unknown	unknown	0x559b:$a: 24 28 8B 45 3C 8B 54 05 78 01 EA 8B 4A 18 8B 5A 20 01 EB E3 38 49 8B
00000002.00000003.1321149619.00000000004C0000.00000040.00001000.00020000.00000000.sdmp	Linux_Trojan_Rbot_96625c8c	unknown	unknown	0x499b:$a: 24 28 8B 45 3C 8B 54 05 78 01 EA 8B 4A 18 8B 5A 20 01 EB E3 38 49 8B
00000002.00000002.2567487790.000000000068E000.00000004.00000020.00020000.00000000.sdmp	Linux_Trojan_Rbot_96625c8c	unknown	unknown	0x24b46:$a: 24 28 8B 45 3C 8B 54 05 78 01 EA 8B 4A 18 8B 5A 20 01 EB E3 38 49 8B
00000002.00000002.2567949608.0000000000745000.00000004.00000020.00020000.00000000.sdmp	Linux_Trojan_Rbot_96625c8c	unknown	unknown	0xb76e:$a: 24 28 8B 45 3C 8B 54 05 78 01 EA 8B 4A 18 8B 5A 20 01 EB E3 38 49 8B
00000002.00000002.2567487790.0000000000726000.00000004.00000020.00020000.00000000.sdmp	Linux_Trojan_Rbot_96625c8c	unknown	unknown	0x5f36:$a: 24 28 8B 45 3C 8B 54 05 78 01 EA 8B 4A 18 8B 5A 20 01 EB E3 38 49 8B
Process Memory Space: JdaybS.exe PID: 6676	JoeSecurity_Bdaejec	Yara detected Bdaejec	Joe Security
Click to see the 1 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
2.2.7Y18r(223).exe.610000.2.unpack	Linux_Trojan_Rbot_96625c8c	unknown	unknown	0x499b:$a: 24 28 8B 45 3C 8B 54 05 78 01 EA 8B 4A 18 8B 5A 20 01 EB E3 38 49 8B
2.3.7Y18r(223).exe.4c0000.0.unpack	Linux_Trojan_Rbot_96625c8c	unknown	unknown	0x3d9b:$a: 24 28 8B 45 3C 8B 54 05 78 01 EA 8B 4A 18 8B 5A 20 01 EB E3 38 49 8B
2.3.7Y18r(223).exe.4c0000.0.raw.unpack	Linux_Trojan_Rbot_96625c8c	unknown	unknown	0x499b:$a: 24 28 8B 45 3C 8B 54 05 78 01 EA 8B 4A 18 8B 5A 20 01 EB E3 38 49 8B
2.2.7Y18r(223).exe.610000.2.raw.unpack	Linux_Trojan_Rbot_96625c8c	unknown	unknown	0x559b:$a: 24 28 8B 45 3C 8B 54 05 78 01 EA 8B 4A 18 8B 5A 20 01 EB E3 38 49 8B

Sigma Signatures

System Summary

Sigma detected: Potential Persistence Via COM Hijacking From Suspicious Locations

Source: Registry Key set

Author: Nasreddine Bencherchali (Nextron Systems): Data: Details: C:\Users\user\Desktop\7Y18r(223).exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\7Y18r(223).exe, ProcessId: 1796, TargetObject: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5B4A3B5F-0954-749D-3B07-839E07C9953B}\LocalServer32\(Default)

Sigma detected: Use Short Name Path in Command Line

Source: Process started

Author: frack113, Nasreddine Bencherchali: Data: Command: C:\Users\user~1\AppData\Local\Temp\JdaybS.exe, CommandLine: C:\Users\user~1\AppData\Local\Temp\JdaybS.exe, CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Local\Temp\JdaybS.exe, NewProcessName: C:\Users\user\AppData\Local\Temp\JdaybS.exe, OriginalFileName: C:\Users\user\AppData\Local\Temp\JdaybS.exe, ParentCommandLine: "C:\Users\user\Desktop\7Y18r(223).exe", ParentImage: C:\Users\user\Desktop\7Y18r(223).exe, ParentProcessId: 1796, ParentProcessName: 7Y18r(223).exe, ProcessCommandLine: C:\Users\user~1\AppData\Local\Temp\JdaybS.exe, ProcessId: 6676, ProcessName: JdaybS.exe

Snort Signatures

⊘No Snort rule has matched

Suricata Signatures

ET WORM Allaple ICMP Sweep Ping Outbound - Source IP: 192.168.2.7 - Destination IP: 62.118.128.77

Timestamp:	2024-07-26T02:27:02.970869+0200
SID:	2003292
Source Port:	0
Destination Port:	0
Protocol:	ICMP
Classtype:	A Network Trojan was detected

ET WORM Allaple ICMP Sweep Ping Outbound - Source IP: 192.168.2.7 - Destination IP: 62.118.135.124

Timestamp:	2024-07-26T02:26:56.027550+0200
SID:	2003292
Source Port:	0
Destination Port:	0
Protocol:	ICMP
Classtype:	A Network Trojan was detected

ET WORM Allaple ICMP Sweep Ping Outbound - Source IP: 192.168.2.7 - Destination IP: 62.118.45.221

Timestamp:	2024-07-26T02:27:07.999877+0200
SID:	2003292
Source Port:	0
Destination Port:	0
Protocol:	ICMP
Classtype:	A Network Trojan was detected

ET WORM Allaple ICMP Sweep Ping Outbound - Source IP: 192.168.2.7 - Destination IP: 62.118.161.213

Timestamp:	2024-07-26T02:27:01.384363+0200
SID:	2003292
Source Port:	0
Destination Port:	0
Protocol:	ICMP
Classtype:	A Network Trojan was detected

ET WORM Allaple ICMP Sweep Ping Outbound - Source IP: 192.168.2.7 - Destination IP: 62.118.1.60

Timestamp:	2024-07-26T02:27:03.997715+0200
SID:	2003292
Source Port:	0
Destination Port:	0
Protocol:	ICMP
Classtype:	A Network Trojan was detected

ET WORM Allaple ICMP Sweep Ping Outbound - Source IP: 192.168.2.7 - Destination IP: 62.118.162.82

Timestamp:	2024-07-26T02:27:14.651880+0200
SID:	2003292
Source Port:	0
Destination Port:	0
Protocol:	ICMP
Classtype:	A Network Trojan was detected

ET WORM Allaple ICMP Sweep Ping Outbound - Source IP: 192.168.2.7 - Destination IP: 62.118.102.85

Timestamp:	2024-07-26T02:27:54.007071+0200
SID:	2003292
Source Port:	0
Destination Port:	0
Protocol:	ICMP
Classtype:	A Network Trojan was detected

ET WORM Allaple ICMP Sweep Ping Outbound - Source IP: 192.168.2.7 - Destination IP: 62.118.86.144

Timestamp:	2024-07-26T02:27:10.496514+0200
SID:	2003292
Source Port:	0
Destination Port:	0
Protocol:	ICMP
Classtype:	A Network Trojan was detected

ET WORM Allaple ICMP Sweep Ping Outbound - Source IP: 192.168.2.7 - Destination IP: 62.118.233.177

Timestamp:	2024-07-26T02:27:27.196283+0200
SID:	2003292
Source Port:	0
Destination Port:	0
Protocol:	ICMP
Classtype:	A Network Trojan was detected

ET WORM Allaple ICMP Sweep Ping Outbound - Source IP: 192.168.2.7 - Destination IP: 62.118.81.242

Timestamp:	2024-07-26T02:27:17.996340+0200
SID:	2003292
Source Port:	0
Destination Port:	0
Protocol:	ICMP
Classtype:	A Network Trojan was detected

ET WORM Allaple ICMP Sweep Ping Outbound - Source IP: 192.168.2.7 - Destination IP: 62.118.199.78

Timestamp:	2024-07-26T02:26:55.931822+0200
SID:	2003292
Source Port:	0
Destination Port:	0
Protocol:	ICMP
Classtype:	A Network Trojan was detected

ET WORM Allaple ICMP Sweep Reply Inbound - Source IP: 62.118.249.109 - Destination IP: 192.168.2.7

Timestamp:	2024-07-26T02:26:57.253717+0200
SID:	2003293
Source Port:	0
Destination Port:	0
Protocol:	ICMP
Classtype:	A Network Trojan was detected

ET WORM Allaple ICMP Sweep Ping Outbound - Source IP: 192.168.2.7 - Destination IP: 62.118.27.81

Timestamp:	2024-07-26T02:27:58.495968+0200
SID:	2003292
Source Port:	0
Destination Port:	0
Protocol:	ICMP
Classtype:	A Network Trojan was detected

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow - Source IP: 52.165.165.26 - Destination IP: 192.168.2.7

Timestamp:	2024-07-26T02:27:29.051429+0200
SID:	2022930
Source Port:	443
Destination Port:	50899
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow - Source IP: 52.165.165.26 - Destination IP: 192.168.2.7

Timestamp:	2024-07-26T02:27:30.160310+0200
SID:	2022930
Source Port:	443
Destination Port:	50901
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Backdoor.Win32/Bdaejec.A CnC Domain in DNS Lookup - Source IP: 192.168.2.7 - Destination IP: 1.1.1.1

Timestamp:	2024-07-26T02:26:56.946252+0200
SID:	2838522
Source Port:	58256
Destination Port:	53
Protocol:	UDP
Classtype:	Malware Command and Control Activity Detected

ET WORM Allaple ICMP Sweep Ping Outbound - Source IP: 192.168.2.7 - Destination IP: 62.118.203.229

Timestamp:	2024-07-26T02:27:41.321227+0200
SID:	2003292
Source Port:	0
Destination Port:	0
Protocol:	ICMP
Classtype:	A Network Trojan was detected

ET WORM Allaple ICMP Sweep Ping Outbound - Source IP: 192.168.2.7 - Destination IP: 62.118.123.177

Timestamp:	2024-07-26T02:26:56.119310+0200
SID:	2003292
Source Port:	0
Destination Port:	0
Protocol:	ICMP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Backdoor.Win32/Bdaejec.A CnC Domain in DNS Lookup - Source IP: 192.168.2.7 - Destination IP: 1.1.1.1

Timestamp:	2024-07-26T02:26:54.942287+0200
SID:	2838522
Source Port:	58256
Destination Port:	53
Protocol:	UDP
Classtype:	Malware Command and Control Activity Detected

ET WORM Allaple ICMP Sweep Ping Outbound - Source IP: 192.168.2.7 - Destination IP: 62.118.4.35

Timestamp:	2024-07-26T02:27:03.102878+0200
SID:	2003292
Source Port:	0
Destination Port:	0
Protocol:	ICMP
Classtype:	A Network Trojan was detected

ET WORM Allaple ICMP Sweep Ping Outbound - Source IP: 192.168.2.7 - Destination IP: 62.118.131.67

Timestamp:	2024-07-26T02:27:19.196980+0200
SID:	2003292
Source Port:	0
Destination Port:	0
Protocol:	ICMP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Backdoor.Win32/Bdaejec.A CnC Domain in DNS Lookup - Source IP: 192.168.2.7 - Destination IP: 1.1.1.1

Timestamp:	2024-07-26T02:26:55.930443+0200
SID:	2838522
Source Port:	58256
Destination Port:	53
Protocol:	UDP
Classtype:	Malware Command and Control Activity Detected

ET WORM Allaple ICMP Sweep Ping Outbound - Source IP: 192.168.2.7 - Destination IP: 62.118.232.175

Timestamp:	2024-07-26T02:27:53.602779+0200
SID:	2003292
Source Port:	0
Destination Port:	0
Protocol:	ICMP
Classtype:	A Network Trojan was detected

ET WORM Allaple ICMP Sweep Ping Outbound - Source IP: 192.168.2.7 - Destination IP: 62.118.255.239

Timestamp:	2024-07-26T02:26:53.864905+0200
SID:	2003292
Source Port:	0
Destination Port:	0
Protocol:	ICMP
Classtype:	A Network Trojan was detected

ET WORM Allaple ICMP Sweep Ping Outbound - Source IP: 192.168.2.7 - Destination IP: 62.118.11.73

Timestamp:	2024-07-26T02:27:05.547243+0200
SID:	2003292
Source Port:	0
Destination Port:	0
Protocol:	ICMP
Classtype:	A Network Trojan was detected

ET WORM Allaple ICMP Sweep Ping Outbound - Source IP: 192.168.2.7 - Destination IP: 62.118.49.137

Timestamp:	2024-07-26T02:27:56.496503+0200
SID:	2003292
Source Port:	0
Destination Port:	0
Protocol:	ICMP
Classtype:	A Network Trojan was detected

ET SCAN Behavioral Unusual Port 139 traffic Potential Scan or Infection - Source IP: 192.168.2.7 - Destination IP: 62.118.143.145

Timestamp:	2024-07-26T02:27:27.383277+0200
SID:	2001579
Source Port:	50893
Destination Port:	139
Protocol:	TCP
Classtype:	Misc activity

ET WORM Allaple ICMP Sweep Ping Outbound - Source IP: 192.168.2.7 - Destination IP: 62.118.175.11

Timestamp:	2024-07-26T02:26:53.601081+0200
SID:	2003292
Source Port:	0
Destination Port:	0
Protocol:	ICMP
Classtype:	A Network Trojan was detected

ET WORM Allaple ICMP Sweep Ping Outbound - Source IP: 192.168.2.7 - Destination IP: 62.118.21.191

Timestamp:	2024-07-26T02:27:04.999426+0200
SID:	2003292
Source Port:	0
Destination Port:	0
Protocol:	ICMP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Backdoor.Win32/Bdaejec.A CnC Domain in DNS Lookup - Source IP: 192.168.2.7 - Destination IP: 1.1.1.1

Timestamp:	2024-07-26T02:26:58.945741+0200
SID:	2838522
Source Port:	58256
Destination Port:	53
Protocol:	UDP
Classtype:	Malware Command and Control Activity Detected

ET WORM Allaple ICMP Sweep Ping Outbound - Source IP: 192.168.2.7 - Destination IP: 62.118.204.103

Timestamp:	2024-07-26T02:26:53.936683+0200
SID:	2003292
Source Port:	0
Destination Port:	0
Protocol:	ICMP
Classtype:	A Network Trojan was detected

ET WORM Allaple ICMP Sweep Ping Outbound - Source IP: 192.168.2.7 - Destination IP: 62.118.199.78

Timestamp:	2024-07-26T02:26:57.560276+0200
SID:	2003292
Source Port:	0
Destination Port:	0
Protocol:	ICMP
Classtype:	A Network Trojan was detected

ET WORM Allaple ICMP Sweep Ping Outbound - Source IP: 192.168.2.7 - Destination IP: 62.118.122.49

Timestamp:	2024-07-26T02:27:56.496128+0200
SID:	2003292
Source Port:	0
Destination Port:	0
Protocol:	ICMP
Classtype:	A Network Trojan was detected

ET WORM Allaple ICMP Sweep Ping Outbound - Source IP: 192.168.2.7 - Destination IP: 62.118.1.98

Timestamp:	2024-07-26T02:27:06.274216+0200
SID:	2003292
Source Port:	0
Destination Port:	0
Protocol:	ICMP
Classtype:	A Network Trojan was detected

ET WORM Allaple ICMP Sweep Ping Outbound - Source IP: 192.168.2.7 - Destination IP: 62.118.120.105

Timestamp:	2024-07-26T02:27:16.196297+0200
SID:	2003292
Source Port:	0
Destination Port:	0
Protocol:	ICMP
Classtype:	A Network Trojan was detected

ET WORM Allaple ICMP Sweep Ping Outbound - Source IP: 192.168.2.7 - Destination IP: 62.118.102.19

Timestamp:	2024-07-26T02:27:22.995556+0200
SID:	2003292
Source Port:	0
Destination Port:	0
Protocol:	ICMP
Classtype:	A Network Trojan was detected

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow - Source IP: 20.114.59.183 - Destination IP: 192.168.2.7

Timestamp:	2024-07-26T02:27:11.295939+0200
SID:	2022930
Source Port:	443
Destination Port:	49723
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET WORM Allaple ICMP Sweep Ping Outbound - Source IP: 192.168.2.7 - Destination IP: 62.118.17.91

Timestamp:	2024-07-26T02:27:00.997090+0200
SID:	2003292
Source Port:	0
Destination Port:	0
Protocol:	ICMP
Classtype:	A Network Trojan was detected

ET WORM Allaple ICMP Sweep Ping Outbound - Source IP: 192.168.2.7 - Destination IP: 62.118.216.56

Timestamp:	2024-07-26T02:27:00.343375+0200
SID:	2003292
Source Port:	0
Destination Port:	0
Protocol:	ICMP
Classtype:	A Network Trojan was detected

ET WORM Allaple ICMP Sweep Ping Outbound - Source IP: 192.168.2.7 - Destination IP: 62.118.173.26

Timestamp:	2024-07-26T02:27:05.547647+0200
SID:	2003292
Source Port:	0
Destination Port:	0
Protocol:	ICMP
Classtype:	A Network Trojan was detected

ET WORM Allaple ICMP Sweep Ping Outbound - Source IP: 192.168.2.7 - Destination IP: 62.118.125.148

Timestamp:	2024-07-26T02:27:34.008723+0200
SID:	2003292
Source Port:	0
Destination Port:	0
Protocol:	ICMP
Classtype:	A Network Trojan was detected

ET WORM Allaple ICMP Sweep Ping Outbound - Source IP: 192.168.2.7 - Destination IP: 62.118.4.35

Timestamp:	2024-07-26T02:27:04.999621+0200
SID:	2003292
Source Port:	0
Destination Port:	0
Protocol:	ICMP
Classtype:	A Network Trojan was detected

ET WORM Allaple ICMP Sweep Ping Outbound - Source IP: 192.168.2.7 - Destination IP: 62.118.104.174

Timestamp:	2024-07-26T02:26:53.608320+0200
SID:	2003292
Source Port:	0
Destination Port:	0
Protocol:	ICMP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: 7Y18r(223).exe

Avira: detected

Antivirus detection for URL or domain

Source: http://ddos.dnsnb8.net:799/cj//k1.rar	URL Reputation: Label: malware
Source: http://ddos.dnsnb8.net:799/cj//k1.rarGp	Avira URL Cloud: Label: phishing
Source: http://ddos.dnsnb8.net:799/cj//k1.rarQ	Avira URL Cloud: Label: malware
Source: http://ddos.dnsnb8.net:799/cj//k1.rarw	Avira URL Cloud: Label: malware
Source: http://ddos.dnsnb8.net:799/cj//k1.rarr	Avira URL Cloud: Label: phishing
Source: http://ddos.dnsnb8.net:799/cj//k1.rarK	Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\JdaybS.exe	Avira: detection malicious, Label: TR/Dldr.Small.Z.haljq
Source: C:\Program Files (x86)\AutoIt3\Examples\Helpfile\Extras\MyProg.exe	Avira: detection malicious, Label: W32/Jadtre.B
Source: C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe	Avira: detection malicious, Label: W32/Jadtre.B
Source: C:\Program Files\7-Zip\Uninstall.exe	Avira: detection malicious, Label: W32/Jadtre.B

Multi AV Scanner detection for domain / URL

Source: ddos.dnsnb8.net	Virustotal: Detection: 12%	Perma Link
Source: http://ddos.dnsnb8.net:799/cj//k1.rarQ	Virustotal: Detection: 9%	Perma Link
Source: http://ddos.dnsnb8.net:799/cj//k1.rarr	Virustotal: Detection: 15%	Perma Link
Source: http://ddos.dnsnb8.net:799/cj//k1.rarK	Virustotal: Detection: 12%	Perma Link
Source: http://ddos.dnsnb8.net:799/cj//k1.rarw	Virustotal: Detection: 9%	Perma Link

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\JdaybS.exe	ReversingLabs: Detection: 92%
Source: C:\Users\user\AppData\Local\Temp\JdaybS.exe	Virustotal: Detection: 93%			Perma Link

Multi AV Scanner detection for submitted file

Source: 7Y18r(223).exe	ReversingLabs: Detection: 95%
Source: 7Y18r(223).exe	Virustotal: Detection: 94%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\JdaybS.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\AutoIt3\Examples\Helpfile\Extras\MyProg.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe	Joe Sandbox ML: detected
Source: C:\Program Files\7-Zip\Uninstall.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: 7Y18r(223).exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\7Y18r(223).exe	Code function: 2_2_006133E0 CryptAcquireContextA,CryptGenRandom,CryptReleaseContext,	2_2_006133E0
Source: C:\Users\user\Desktop\7Y18r(223).exe	Code function: 2_2_0061EBB0 CryptAcquireContextA,CryptGenRandom,CryptReleaseContext,	2_2_0061EBB0
Source: C:\Users\user\Desktop\7Y18r(223).exe	Code function: 2_2_0061285E CryptAcquireContextA,socket,gethostbyname,htons,htons,CryptGenRandom,CryptGenRandom,htons,memcpy,connect,send,closesocket,CryptReleaseContext,socket,gethostbyname,htons,connect,send,closesocket,	2_2_0061285E

Source: C:\Users\user\Desktop\7Y18r(223).exe	Code function: mov dword ptr [edi], 424D53FFh	2_2_00617860
Source: C:\Users\user\Desktop\7Y18r(223).exe	Code function: mov dword ptr [esi], 424D53FFh	2_2_00620A80
Source: C:\Users\user\Desktop\7Y18r(223).exe	Code function: mov dword ptr [edi], 424D53FFh	2_2_00617790
Source: C:\Users\user\Desktop\7Y18r(223).exe	Code function: cmp dword ptr [edi+04h], 424D53FFh	2_2_0061EF90
Source: C:\Users\user\Desktop\7Y18r(223).exe	Code function: mov dword ptr [esi], 424D53FFh	2_2_00620460
Source: C:\Users\user\Desktop\7Y18r(223).exe	Code function: mov dword ptr [esi], 424D53FFh	2_2_006224C0
Source: C:\Users\user\Desktop\7Y18r(223).exe	Code function: mov dword ptr [esi], 424D53FFh	2_2_0061F100
Source: C:\Users\user\Desktop\7Y18r(223).exe	Code function: mov dword ptr [esi], 424D53FFh	2_2_0061F510
Source: C:\Users\user\Desktop\7Y18r(223).exe	Code function: mov dword ptr [esi], 424D53FFh	2_2_00620510
Source: C:\Users\user\Desktop\7Y18r(223).exe	Code function: mov dword ptr [esi], 424D53FFh	2_2_00620590
Source: C:\Users\user\Desktop\7Y18r(223).exe	Code function: mov dword ptr [esi], 424D53FFh	2_2_00620640
Source: C:\Users\user\Desktop\7Y18r(223).exe	Code function: mov dword ptr [esi], 424D53FFh	2_2_0061F250
Source: C:\Users\user\Desktop\7Y18r(223).exe	Code function: mov dword ptr [esi], 424D53FFh	2_2_0061FB50
Source: C:\Users\user\Desktop\7Y18r(223).exe	Code function: mov dword ptr [esi], 424D53FFh	2_2_006223D0
Source: C:\Users\user\Desktop\7Y18r(223).exe	Code function: mov dword ptr [esi], 424D53FFh	2_2_0061F3B0

Compliance

Detected unpacking (creates a PE file in dynamic memory)

Source: C:\Users\user\Desktop\7Y18r(223).exe

Unpacked PE file: 2.2.7Y18r(223).exe.610000.2.unpack

Source: 7Y18r(223).exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source:	Binary string: C:\exe.pdb source: 7Y18r(223).exe
Source:	Binary string: C:\Data\svn\autoit\branch_3.3.16\bin\SciTE\SciTE.pdb source: SciTE.exe.3.dr

Spreading

Infects executable files (exe, dll, sys, html)

Source: C:\Users\user\AppData\Local\Temp\JdaybS.exe	System file written: C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JdaybS.exe	System file written: C:\Program Files\7-Zip\Uninstall.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JdaybS.exe	System file written: C:\Program Files (x86)\AutoIt3\Examples\Helpfile\Extras\MyProg.exe	Jump to behavior

Source: C:\Users\user\Desktop\7Y18r(223).exe	Code function: 2_2_00612100 CoTaskMemAlloc,wsprintfA,FindFirstFileA,wsprintfA,Sleep,CharLowerA,lstrlenA,CoTaskMemAlloc,lstrcpyA,CreateThread,SetThreadPriority,WaitForSingleObject,CloseHandle,FindNextFileA,FindClose,CoTaskMemFree,		2_2_00612100
Source: C:\Users\user\AppData\Local\Temp\JdaybS.exe	Code function: 3_2_001A29E2 memset,wsprintfA,memset,lstrlen,lstrcpyn,strrchr,lstrcmpiA,lstrlen,memset,memset,FindFirstFileA,memset,FindNextFileA,lstrcmpiA,FindNextFileA,FindClose,		3_2_001A29E2

Source: C:\Users\user\Desktop\7Y18r(223).exe

Code function: 2_2_00612040 GetLogicalDriveStringsA,GetDriveTypeA,CoTaskMemAlloc,lstrcpyA,CreateThread,CreateThread,SetThreadPriority,WaitForSingleObject,lstrlenA,Sleep,

2_2_00612040

Source: C:\Users\user\Desktop\7Y18r(223).exe	File opened: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Config\	Jump to behavior
Source: C:\Users\user\Desktop\7Y18r(223).exe	File opened: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\	Jump to behavior
Source: C:\Users\user\Desktop\7Y18r(223).exe	File opened: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\	Jump to behavior
Source: C:\Users\user\Desktop\7Y18r(223).exe	File opened: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\GatherLogs\SystemIndex\	Jump to behavior
Source: C:\Users\user\Desktop\7Y18r(223).exe	File opened: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\GatherLogs\	Jump to behavior
Source: C:\Users\user\Desktop\7Y18r(223).exe	File opened: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\	Jump to behavior

Source: C:\Users\user\Desktop\7Y18r(223).exe

Code function: 4x nop then jmp edi

2_2_0042F5E0

Networking

Connects to many ports of the same IP (likely port scanning)

Source: global traffic	TCP traffic: 62.118.165.34 ports 1,3,445,139,9,9988
Source: global traffic	TCP traffic: 62.118.146.241 ports 1,3,445,139,9,9988
Source: global traffic	TCP traffic: 62.118.147.145 ports 1,3,445,139,9,9988
Source: global traffic	TCP traffic: 62.118.67.53 ports 1,3,445,139,9,9988
Source: global traffic	TCP traffic: 62.118.143.145 ports 1,3,445,139,9,9988
Source: global traffic	TCP traffic: 62.118.150.40 ports 1,3,445,139,9,9988

Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 62.118.249.109:139
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 62.118.78.116:139
Source: global traffic	TCP traffic: 192.168.2.7:49704 -> 62.118.147.145:139
Source: global traffic	TCP traffic: 192.168.2.7:49710 -> 62.118.67.53:139
Source: global traffic	TCP traffic: 192.168.2.7:49713 -> 62.118.143.145:139
Source: global traffic	TCP traffic: 192.168.2.7:49715 -> 62.118.95.82:139
Source: global traffic	TCP traffic: 192.168.2.7:49731 -> 62.118.146.241:139
Source: global traffic	TCP traffic: 192.168.2.7:49732 -> 62.118.155.156:139
Source: global traffic	TCP traffic: 192.168.2.7:49736 -> 62.118.138.100:139
Source: global traffic	TCP traffic: 192.168.2.7:49737 -> 62.118.78.100:139
Source: global traffic	TCP traffic: 192.168.2.7:49743 -> 62.118.150.7:139
Source: global traffic	TCP traffic: 192.168.2.7:49758 -> 62.118.138.85:139
Source: global traffic	TCP traffic: 192.168.2.7:49763 -> 62.118.132.5:139
Source: global traffic	TCP traffic: 192.168.2.7:50884 -> 62.118.253.30:139
Source: global traffic	TCP traffic: 192.168.2.7:50892 -> 62.118.165.34:139
Source: global traffic	TCP traffic: 192.168.2.7:50895 -> 62.118.132.3:139
Source: global traffic	TCP traffic: 192.168.2.7:50902 -> 62.118.253.46:139
Source: global traffic	TCP traffic: 192.168.2.7:50904 -> 62.118.78.113:139
Source: global traffic	TCP traffic: 192.168.2.7:50925 -> 62.118.150.40:139
Source: global traffic	TCP traffic: 192.168.2.7:50938 -> 62.118.136.167:139
Source: global traffic	TCP traffic: 192.168.2.7:50949 -> 62.118.153.81:139
Source: global traffic	TCP traffic: 192.168.2.7:50960 -> 62.118.253.29:139
Source: global traffic	TCP traffic: 192.168.2.7:50961 -> 62.118.78.103:139
Source: global traffic	TCP traffic: 192.168.2.7:50970 -> 62.118.140.194:139
Source: global traffic	TCP traffic: 192.168.2.7:50996 -> 62.118.249.2:139
Source: global traffic	TCP traffic: 192.168.2.7:51038 -> 62.118.253.27:139

Source: unknown	DNS traffic detected: query: 15.164.165.52.in-addr.arpa replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ddos.dnsnb8.net replaycode: Server failure (2)

Source: unknown	TCP traffic detected without corresponding DNS query: 62.118.249.109
Source: unknown	TCP traffic detected without corresponding DNS query: 62.118.249.109
Source: unknown	TCP traffic detected without corresponding DNS query: 62.118.78.116
Source: unknown	TCP traffic detected without corresponding DNS query: 62.118.78.116
Source: unknown	TCP traffic detected without corresponding DNS query: 62.118.249.109
Source: unknown	TCP traffic detected without corresponding DNS query: 62.118.78.116
Source: unknown	TCP traffic detected without corresponding DNS query: 62.118.147.145
Source: unknown	TCP traffic detected without corresponding DNS query: 62.118.147.145
Source: unknown	TCP traffic detected without corresponding DNS query: 62.118.249.109
Source: unknown	TCP traffic detected without corresponding DNS query: 62.118.249.109
Source: unknown	TCP traffic detected without corresponding DNS query: 62.118.249.109
Source: unknown	TCP traffic detected without corresponding DNS query: 62.118.249.109
Source: unknown	TCP traffic detected without corresponding DNS query: 62.118.67.53
Source: unknown	TCP traffic detected without corresponding DNS query: 62.118.249.109
Source: unknown	TCP traffic detected without corresponding DNS query: 62.118.67.53
Source: unknown	TCP traffic detected without corresponding DNS query: 62.118.78.116
Source: unknown	TCP traffic detected without corresponding DNS query: 62.118.78.116
Source: unknown	TCP traffic detected without corresponding DNS query: 62.118.78.116
Source: unknown	TCP traffic detected without corresponding DNS query: 62.118.78.116
Source: unknown	TCP traffic detected without corresponding DNS query: 62.118.143.145
Source: unknown	TCP traffic detected without corresponding DNS query: 62.118.147.145
Source: unknown	TCP traffic detected without corresponding DNS query: 62.118.78.116
Source: unknown	TCP traffic detected without corresponding DNS query: 62.118.143.145
Source: unknown	TCP traffic detected without corresponding DNS query: 62.118.95.82
Source: unknown	TCP traffic detected without corresponding DNS query: 62.118.249.109
Source: unknown	TCP traffic detected without corresponding DNS query: 62.118.67.53
Source: unknown	TCP traffic detected without corresponding DNS query: 62.118.95.82
Source: unknown	TCP traffic detected without corresponding DNS query: 62.118.78.116
Source: unknown	TCP traffic detected without corresponding DNS query: 62.118.143.145
Source: unknown	TCP traffic detected without corresponding DNS query: 62.118.147.145
Source: unknown	TCP traffic detected without corresponding DNS query: 62.118.147.145
Source: unknown	TCP traffic detected without corresponding DNS query: 62.118.147.145
Source: unknown	TCP traffic detected without corresponding DNS query: 62.118.147.145
Source: unknown	TCP traffic detected without corresponding DNS query: 62.118.147.145
Source: unknown	TCP traffic detected without corresponding DNS query: 62.118.95.82
Source: unknown	TCP traffic detected without corresponding DNS query: 62.118.249.109
Source: unknown	TCP traffic detected without corresponding DNS query: 62.118.249.109
Source: unknown	TCP traffic detected without corresponding DNS query: 62.118.249.109
Source: unknown	TCP traffic detected without corresponding DNS query: 62.118.67.53
Source: unknown	TCP traffic detected without corresponding DNS query: 62.118.67.53
Source: unknown	TCP traffic detected without corresponding DNS query: 62.118.67.53
Source: unknown	TCP traffic detected without corresponding DNS query: 62.118.67.53
Source: unknown	TCP traffic detected without corresponding DNS query: 62.118.67.53
Source: unknown	TCP traffic detected without corresponding DNS query: 62.118.78.116
Source: unknown	TCP traffic detected without corresponding DNS query: 62.118.78.116
Source: unknown	TCP traffic detected without corresponding DNS query: 62.118.78.116
Source: unknown	TCP traffic detected without corresponding DNS query: 62.118.143.145
Source: unknown	TCP traffic detected without corresponding DNS query: 62.118.143.145
Source: unknown	TCP traffic detected without corresponding DNS query: 62.118.143.145
Source: unknown	TCP traffic detected without corresponding DNS query: 62.118.143.145

Source: C:\Users\user\Desktop\7Y18r(223).exe

Code function: 2_2_00617860 htonl,send,select,recv,

2_2_00617860

Source: global traffic	DNS traffic detected: DNS query: ddos.dnsnb8.net
Source: global traffic	DNS traffic detected: DNS query: 15.164.165.52.in-addr.arpa

Source: JdaybS.exe, 00000003.00000002.1536822008.00000000001A3000.00000002.00000001.01000000.00000004.sdmp, JdaybS.exe, 00000003.00000003.1321237591.0000000000AD0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://%s:%d/%s/%sZwQuerySystemInformationntdll.dllNtSystemDebugControlSeDebugPrivilege%s%.8x.bat:DE
Source: 7Y18r(223).exe	String found in binary or memory: http://%s:%d/%swinsta0defaultExplorer.exe%s%d.exeultwinsta0
Source: JdaybS.exe, 00000003.00000002.1537510362.00000000027AA000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://ddos.dnsnb8.net:799/cj//k1.rar
Source: JdaybS.exe, 00000003.00000002.1537510362.00000000027AA000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://ddos.dnsnb8.net:799/cj//k1.rarGp
Source: JdaybS.exe, 00000003.00000002.1537127772.0000000000B4E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ddos.dnsnb8.net:799/cj//k1.rarK
Source: JdaybS.exe, 00000003.00000002.1537127772.0000000000BC4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ddos.dnsnb8.net:799/cj//k1.rarQ
Source: JdaybS.exe, 00000003.00000002.1537127772.0000000000B4E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ddos.dnsnb8.net:799/cj//k1.rarr
Source: JdaybS.exe, 00000003.00000002.1537127772.0000000000B4E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ddos.dnsnb8.net:799/cj//k1.rarw
Source: Amcache.hve.9.dr	String found in binary or memory: http://upx.sf.net
Source: SciTE.exe.3.dr	String found in binary or memory: http://www.activestate.com
Source: SciTE.exe.3.dr	String found in binary or memory: http://www.activestate.comHolger
Source: SciTE.exe.3.dr	String found in binary or memory: http://www.baanboard.com
Source: SciTE.exe.3.dr	String found in binary or memory: http://www.baanboard.comBrendon
Source: SciTE.exe.3.dr	String found in binary or memory: http://www.develop.com
Source: SciTE.exe.3.dr	String found in binary or memory: http://www.develop.comDeepak
Source: SciTE.exe.3.dr	String found in binary or memory: http://www.lua.org
Source: SciTE.exe.3.dr	String found in binary or memory: http://www.rftp.com
Source: SciTE.exe.3.dr	String found in binary or memory: http://www.rftp.comJosiah
Source: SciTE.exe.3.dr	String found in binary or memory: http://www.scintilla.org
Source: SciTE.exe.3.dr	String found in binary or memory: http://www.scintilla.org/scite.rng
Source: SciTE.exe.3.dr	String found in binary or memory: http://www.spaceblue.com
Source: SciTE.exe.3.dr	String found in binary or memory: http://www.spaceblue.comMathias
Source: JdaybS.exe, 00000003.00000002.1537127772.0000000000BC4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com
Source: SciTE.exe.3.dr	String found in binary or memory: https://www.smartsharesystems.com/
Source: SciTE.exe.3.dr	String found in binary or memory: https://www.smartsharesystems.com/Morten

Source: SciTE.exe.3.dr

Binary or memory string: _winapi_getrawinputdata _winapi_getrawinputdeviceinfo _winapi_getregiondata _winapi_getregisteredrawinputdevices \

memstr_73863bc2-1

System Summary

Malicious sample detected (through community Yara rule)

Source: dump.pcap, type: PCAP	Matched rule: Linux_Trojan_Rbot_96625c8c Author: unknown
Source: 2.2.7Y18r(223).exe.610000.2.unpack, type: UNPACKEDPE	Matched rule: Linux_Trojan_Rbot_96625c8c Author: unknown
Source: 2.3.7Y18r(223).exe.4c0000.0.unpack, type: UNPACKEDPE	Matched rule: Linux_Trojan_Rbot_96625c8c Author: unknown
Source: 2.3.7Y18r(223).exe.4c0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Linux_Trojan_Rbot_96625c8c Author: unknown
Source: 2.2.7Y18r(223).exe.610000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Linux_Trojan_Rbot_96625c8c Author: unknown
Source: 00000002.00000002.2567412345.0000000000610000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Rbot_96625c8c Author: unknown
Source: 00000002.00000003.1321149619.00000000004C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Rbot_96625c8c Author: unknown
Source: 00000002.00000002.2567487790.000000000068E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Rbot_96625c8c Author: unknown
Source: 00000002.00000002.2567949608.0000000000745000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Rbot_96625c8c Author: unknown
Source: 00000002.00000002.2567487790.0000000000726000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Rbot_96625c8c Author: unknown

PE file contains section with special chars

Source: 7Y18r(223).exe	Static PE information: section name: T<squ
Source: MyProg.exe.3.dr	Static PE information: section name: Y\|uR

PE file has a writeable .text section

Source: 7Y18r(223).exe	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: JdaybS.exe.2.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Source: C:\Users\user\Desktop\7Y18r(223).exe	Code function: 2_2_00622640	2_2_00622640
Source: C:\Users\user\Desktop\7Y18r(223).exe	Code function: 2_2_0061BA3C	2_2_0061BA3C
Source: C:\Users\user\Desktop\7Y18r(223).exe	Code function: 2_2_0061B6F0	2_2_0061B6F0
Source: C:\Users\user\Desktop\7Y18r(223).exe	Code function: 2_2_0061B6FF	2_2_0061B6FF
Source: C:\Users\user\AppData\Local\Temp\JdaybS.exe	Code function: 3_2_001A6076	3_2_001A6076
Source: C:\Users\user\AppData\Local\Temp\JdaybS.exe	Code function: 3_2_001A6D00	3_2_001A6D00

Source: Joe Sandbox View

Dropped File: C:\Users\user\AppData\Local\Temp\JdaybS.exe 4485DF22C627FA0BB899D79AA6FF29BC5BE1DBC3CAA2B7A490809338D54B7794

Source: C:\Users\user\AppData\Local\Temp\JdaybS.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6676 -s 1364

Source: MyProg.exe.3.dr

Static PE information: Resource name: RT_VERSION type: MIPSEB-LE ECOFF executable not stripped - version 0.79

Source: 7Y18r(223).exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: dump.pcap, type: PCAP	Matched rule: Linux_Trojan_Rbot_96625c8c reference_sample = a052cfad3034d851c6fad62cc8f9c65bceedc73f3e6a37c9befe52720fd0890e, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Rbot, fingerprint = 5dfabf693c87742ffa212573dded84a2c341628b79c7d11c16be493957c71a69, id = 96625c8c-897c-4bf0-97e7-0dc04595cb94, last_modified = 2021-09-16
Source: 2.2.7Y18r(223).exe.610000.2.unpack, type: UNPACKEDPE	Matched rule: Linux_Trojan_Rbot_96625c8c reference_sample = a052cfad3034d851c6fad62cc8f9c65bceedc73f3e6a37c9befe52720fd0890e, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Rbot, fingerprint = 5dfabf693c87742ffa212573dded84a2c341628b79c7d11c16be493957c71a69, id = 96625c8c-897c-4bf0-97e7-0dc04595cb94, last_modified = 2021-09-16
Source: 2.3.7Y18r(223).exe.4c0000.0.unpack, type: UNPACKEDPE	Matched rule: Linux_Trojan_Rbot_96625c8c reference_sample = a052cfad3034d851c6fad62cc8f9c65bceedc73f3e6a37c9befe52720fd0890e, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Rbot, fingerprint = 5dfabf693c87742ffa212573dded84a2c341628b79c7d11c16be493957c71a69, id = 96625c8c-897c-4bf0-97e7-0dc04595cb94, last_modified = 2021-09-16
Source: 2.3.7Y18r(223).exe.4c0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Linux_Trojan_Rbot_96625c8c reference_sample = a052cfad3034d851c6fad62cc8f9c65bceedc73f3e6a37c9befe52720fd0890e, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Rbot, fingerprint = 5dfabf693c87742ffa212573dded84a2c341628b79c7d11c16be493957c71a69, id = 96625c8c-897c-4bf0-97e7-0dc04595cb94, last_modified = 2021-09-16
Source: 2.2.7Y18r(223).exe.610000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Linux_Trojan_Rbot_96625c8c reference_sample = a052cfad3034d851c6fad62cc8f9c65bceedc73f3e6a37c9befe52720fd0890e, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Rbot, fingerprint = 5dfabf693c87742ffa212573dded84a2c341628b79c7d11c16be493957c71a69, id = 96625c8c-897c-4bf0-97e7-0dc04595cb94, last_modified = 2021-09-16
Source: 00000002.00000002.2567412345.0000000000610000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Rbot_96625c8c reference_sample = a052cfad3034d851c6fad62cc8f9c65bceedc73f3e6a37c9befe52720fd0890e, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Rbot, fingerprint = 5dfabf693c87742ffa212573dded84a2c341628b79c7d11c16be493957c71a69, id = 96625c8c-897c-4bf0-97e7-0dc04595cb94, last_modified = 2021-09-16
Source: 00000002.00000003.1321149619.00000000004C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Rbot_96625c8c reference_sample = a052cfad3034d851c6fad62cc8f9c65bceedc73f3e6a37c9befe52720fd0890e, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Rbot, fingerprint = 5dfabf693c87742ffa212573dded84a2c341628b79c7d11c16be493957c71a69, id = 96625c8c-897c-4bf0-97e7-0dc04595cb94, last_modified = 2021-09-16
Source: 00000002.00000002.2567487790.000000000068E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Rbot_96625c8c reference_sample = a052cfad3034d851c6fad62cc8f9c65bceedc73f3e6a37c9befe52720fd0890e, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Rbot, fingerprint = 5dfabf693c87742ffa212573dded84a2c341628b79c7d11c16be493957c71a69, id = 96625c8c-897c-4bf0-97e7-0dc04595cb94, last_modified = 2021-09-16
Source: 00000002.00000002.2567949608.0000000000745000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Rbot_96625c8c reference_sample = a052cfad3034d851c6fad62cc8f9c65bceedc73f3e6a37c9befe52720fd0890e, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Rbot, fingerprint = 5dfabf693c87742ffa212573dded84a2c341628b79c7d11c16be493957c71a69, id = 96625c8c-897c-4bf0-97e7-0dc04595cb94, last_modified = 2021-09-16
Source: 00000002.00000002.2567487790.0000000000726000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Rbot_96625c8c reference_sample = a052cfad3034d851c6fad62cc8f9c65bceedc73f3e6a37c9befe52720fd0890e, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Rbot, fingerprint = 5dfabf693c87742ffa212573dded84a2c341628b79c7d11c16be493957c71a69, id = 96625c8c-897c-4bf0-97e7-0dc04595cb94, last_modified = 2021-09-16

Source: JdaybS.exe.2.dr

Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Source: JdaybS.exe.2.dr

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Source: JdaybS.exe.2.dr

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESERVED size: 0x100000 address: 0x0

Source: 7Y18r(223).exe	Static PE information: Section: .data ZLIB complexity 0.9976050967261905
Source: 7Y18r(223).exe	Static PE information: Section: .brdata ZLIB complexity 1.00078125

Source: classification engine

Classification label: mal100.spre.troj.evad.winEXE@4/9@5/100

Source: C:\Users\user\AppData\Local\Temp\JdaybS.exe

Code function: 3_2_001A119F GetCurrentProcess,OpenProcessToken,AdjustTokenPrivileges,CloseHandle,CloseHandle,

3_2_001A119F

Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6676
Source: C:\Users\user\Desktop\7Y18r(223).exe	Mutant created: \Sessions\1\BaseNamedObjects\jhdheruhfrthkgjhtjkghjk5trh

Source: C:\Users\user\Desktop\7Y18r(223).exe

File created: C:\Users\user~1\AppData\Local\Temp\JdaybS.exe

Jump to behavior

Source: C:\Users\user\Desktop\7Y18r(223).exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 7Y18r(223).exe	ReversingLabs: Detection: 95%
Source: 7Y18r(223).exe	Virustotal: Detection: 94%

Source: 7Y18r(223).exe	String found in binary or memory: /cl1/install.asp
Source: 7Y18r(223).exe	String found in binary or memory: /stop
Source: 7Y18r(223).exe	String found in binary or memory: /stop
Source: 7Y18r(223).exe	String found in binary or memory: /installservice
Source: 7Y18r(223).exe	String found in binary or memory: /cl1/install.asp

Source: C:\Users\user\Desktop\7Y18r(223).exe

File read: C:\Users\user\Desktop\7Y18r(223).exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\7Y18r(223).exe "C:\Users\user\Desktop\7Y18r(223).exe"
Source: C:\Users\user\Desktop\7Y18r(223).exe	Process created: C:\Users\user\AppData\Local\Temp\JdaybS.exe C:\Users\user~1\AppData\Local\Temp\JdaybS.exe
Source: C:\Users\user\AppData\Local\Temp\JdaybS.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6676 -s 1364
Source: C:\Users\user\Desktop\7Y18r(223).exe	Process created: C:\Users\user\AppData\Local\Temp\JdaybS.exe C:\Users\user~1\AppData\Local\Temp\JdaybS.exe	Jump to behavior

Source: C:\Users\user\Desktop\7Y18r(223).exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\7Y18r(223).exe	Section loaded: icmp.dll	Jump to behavior
Source: C:\Users\user\Desktop\7Y18r(223).exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\7Y18r(223).exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\7Y18r(223).exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\7Y18r(223).exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\7Y18r(223).exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\7Y18r(223).exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\7Y18r(223).exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\7Y18r(223).exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\7Y18r(223).exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\Desktop\7Y18r(223).exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\7Y18r(223).exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\7Y18r(223).exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\Desktop\7Y18r(223).exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\7Y18r(223).exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JdaybS.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JdaybS.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JdaybS.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JdaybS.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JdaybS.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JdaybS.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JdaybS.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JdaybS.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JdaybS.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JdaybS.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JdaybS.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JdaybS.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JdaybS.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JdaybS.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JdaybS.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JdaybS.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JdaybS.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JdaybS.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JdaybS.exe	Section loaded: rasadhlp.dll	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\JdaybS.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Jump to behavior

Source:	Binary string: C:\exe.pdb source: 7Y18r(223).exe
Source:	Binary string: C:\Data\svn\autoit\branch_3.3.16\bin\SciTE\SciTE.pdb source: SciTE.exe.3.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\AppData\Local\Temp\JdaybS.exe

Unpacked PE file: 3.2.JdaybS.exe.1a0000.0.unpack .text:EW;.rdata:W;.data:W;.reloc:W;.aspack:EW;.adata:EW; vs .text:ER;.rdata:R;.data:W;.reloc:R;.aspack:EW;.adata:EW;

Detected unpacking (creates a PE file in dynamic memory)

Source: C:\Users\user\Desktop\7Y18r(223).exe

Unpacked PE file: 2.2.7Y18r(223).exe.610000.2.unpack

Source: C:\Users\user\Desktop\7Y18r(223).exe

Code function: 2_2_00617FC0 GetModuleFileNameA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,InitializeCriticalSection,InitializeCriticalSection,

2_2_00617FC0

Source: initial sample

Static PE information: section where entry point is pointing to: T<squ

Source: 7Y18r(223).exe	Static PE information: section name: .rdatap
Source: 7Y18r(223).exe	Static PE information: section name: .brdata
Source: 7Y18r(223).exe	Static PE information: section name: .tc
Source: 7Y18r(223).exe	Static PE information: section name: T<squ
Source: JdaybS.exe.2.dr	Static PE information: section name: .aspack
Source: JdaybS.exe.2.dr	Static PE information: section name: .adata
Source: Uninstall.exe.3.dr	Static PE information: section name: EpNuZ
Source: MyProg.exe.3.dr	Static PE information: section name: PELIB
Source: MyProg.exe.3.dr	Static PE information: section name: Y\|uR
Source: SciTE.exe.3.dr	Static PE information: section name: u

Source: C:\Users\user\Desktop\7Y18r(223).exe	Code function: 2_2_0045EC44 push dword ptr [esp+58h]; retn 005Ch	2_2_0045ED07
Source: C:\Users\user\Desktop\7Y18r(223).exe	Code function: 2_2_0045EC4B push edi; mov dword ptr [esp], eax	2_2_0045EC4C
Source: C:\Users\user\Desktop\7Y18r(223).exe	Code function: 2_2_0045EC4B push dword ptr [esp]; mov dword ptr [esp], 99F5E325h	2_2_0045EC5D
Source: C:\Users\user\Desktop\7Y18r(223).exe	Code function: 2_2_0045E26A push EF1D7116h; mov dword ptr [esp], eax	2_2_0045E26F
Source: C:\Users\user\Desktop\7Y18r(223).exe	Code function: 2_2_0046022E pushad ; iretd	2_2_00460231
Source: C:\Users\user\Desktop\7Y18r(223).exe	Code function: 2_2_0045E633 pushfd ; mov dword ptr [esp], 6D80C077h	2_2_0045E66A
Source: C:\Users\user\Desktop\7Y18r(223).exe	Code function: 2_2_00427CDB push dword ptr [esp+58h]; retn 005Ch	2_2_0045ED07
Source: C:\Users\user\Desktop\7Y18r(223).exe	Code function: 2_2_0042F4A9 push cs; iretd	2_2_0042F4AA
Source: C:\Users\user\Desktop\7Y18r(223).exe	Code function: 2_2_0042D342 push dword ptr [004090D4h]; ret	2_2_0042D4CB
Source: C:\Users\user\Desktop\7Y18r(223).exe	Code function: 2_2_00429562 push dword ptr [esp+08h]; retn 000Ch	2_2_0042957E
Source: C:\Users\user\Desktop\7Y18r(223).exe	Code function: 2_2_0042D537 push eax; ret	2_2_0042D565
Source: C:\Users\user\Desktop\7Y18r(223).exe	Code function: 2_2_004295FA push dword ptr [esp+50h]; retn 0054h	2_2_0042960D
Source: C:\Users\user\Desktop\7Y18r(223).exe	Code function: 2_2_0042D395 push dword ptr [004090D4h]; ret	2_2_0042D4CB
Source: C:\Users\user\Desktop\7Y18r(223).exe	Code function: 2_2_0042D3AE push dword ptr [004090D4h]; ret	2_2_0042D4CB
Source: C:\Users\user\Desktop\7Y18r(223).exe	Code function: 2_2_0062A648 push 00407D5Ah; ret	2_2_0062A655
Source: C:\Users\user\Desktop\7Y18r(223).exe	Code function: 2_2_0062A620 push 00407D5Ah; ret	2_2_0062A655
Source: C:\Users\user\Desktop\7Y18r(223).exe	Code function: 2_2_0062A628 push 00407D5Ah; ret	2_2_0062A655
Source: C:\Users\user\Desktop\7Y18r(223).exe	Code function: 2_2_0062A638 push 00407D5Ah; ret	2_2_0062A655
Source: C:\Users\user\Desktop\7Y18r(223).exe	Code function: 2_2_0062A60C push 00407D5Ah; ret	2_2_0062A655
Source: C:\Users\user\AppData\Local\Temp\JdaybS.exe	Code function: 3_2_001A1638 push dword ptr [001A3084h]; ret	3_2_001A170E
Source: C:\Users\user\AppData\Local\Temp\JdaybS.exe	Code function: 3_2_001A2D9B push ecx; ret	3_2_001A2DAB
Source: C:\Users\user\AppData\Local\Temp\JdaybS.exe	Code function: 3_2_001A6014 push 001A14E1h; ret	3_2_001A6425
Source: C:\Users\user\AppData\Local\Temp\JdaybS.exe	Code function: 3_2_001A600A push ebp; ret	3_2_001A600D

Source: 7Y18r(223).exe	Static PE information: section name: .brdata entropy: 7.9923959437222605
Source: 7Y18r(223).exe	Static PE information: section name: .tc entropy: 7.5816366968975855
Source: 7Y18r(223).exe	Static PE information: section name: T<squ entropy: 6.93452153597581
Source: JdaybS.exe.2.dr	Static PE information: section name: .text entropy: 7.81169422100848
Source: Uninstall.exe.3.dr	Static PE information: section name: EpNuZ entropy: 6.9350513519052255
Source: MyProg.exe.3.dr	Static PE information: section name: Y\|uR entropy: 6.934450841608958
Source: SciTE.exe.3.dr	Static PE information: section name: u entropy: 6.934600976025206

Persistence and Installation Behavior

Infects executable files (exe, dll, sys, html)

Source: C:\Users\user\AppData\Local\Temp\JdaybS.exe	System file written: C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JdaybS.exe	System file written: C:\Program Files\7-Zip\Uninstall.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JdaybS.exe	System file written: C:\Program Files (x86)\AutoIt3\Examples\Helpfile\Extras\MyProg.exe	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\JdaybS.exe	File created: C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\JdaybS.exe	File created: C:\Program Files\7-Zip\Uninstall.exe	Jump to dropped file
Source: C:\Users\user\Desktop\7Y18r(223).exe	File created: C:\Users\user\AppData\Local\Temp\JdaybS.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\JdaybS.exe	File created: C:\Program Files (x86)\AutoIt3\Examples\Helpfile\Extras\MyProg.exe	Jump to dropped file

Hooking and other Techniques for Hiding and Protection

May modify the system service descriptor table (often done to hook functions)

Source: 7Y18r(223).exe	Binary or memory string: KeServiceDescriptorTable
Source: 7Y18r(223).exe, 00000002.00000002.2568528193.0000000002D30000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: KeServiceDescriptorTable
Source: 7Y18r(223).exe, 00000002.00000002.2567155186.0000000000420000.00000080.00000001.01000000.00000003.sdmp	Binary or memory string: KeServiceDescriptorTable
Source: 7Y18r(223).exe, 00000002.00000003.2225966118.0000000002E90000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: KeServiceDescriptorTable
Source: 7Y18r(223).exe, 00000002.00000000.1319999839.0000000000420000.00000080.00000001.01000000.00000003.sdmp	Binary or memory string: KeServiceDescriptorTable
Source: 7Y18r(223).exe, 00000002.00000003.2283678992.0000000002EF0000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: KeServiceDescriptorTable
Source: 7Y18r(223).exe, 00000002.00000003.2206921567.0000000002D30000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: KeServiceDescriptorTable
Source: 7Y18r(223).exe	Binary or memory string: KeServiceDescriptorTable

Source: C:\Users\user\Desktop\7Y18r(223).exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7Y18r(223).exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7Y18r(223).exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7Y18r(223).exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JdaybS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JdaybS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JdaybS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Found evasive API chain (may stop execution after checking mutex)

Source: C:\Users\user\Desktop\7Y18r(223).exe	Evasive API call chain: CreateMutex,DecisionNodes,Sleep			graph_2-7731
Source: C:\Users\user\Desktop\7Y18r(223).exe	Evasive API call chain: CreateMutex,DecisionNodes,ExitProcess			graph_2-7731

Source: C:\Users\user\Desktop\7Y18r(223).exe

Window / User API: threadDelayed 1064

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\JdaybS.exe	Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)			graph_3-1317
Source: C:\Users\user\Desktop\7Y18r(223).exe	Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)			graph_2-8278

Source: C:\Users\user\AppData\Local\Temp\JdaybS.exe	Dropped PE file which has not been started: C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\JdaybS.exe	Dropped PE file which has not been started: C:\Program Files\7-Zip\Uninstall.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\JdaybS.exe	Dropped PE file which has not been started: C:\Program Files (x86)\AutoIt3\Examples\Helpfile\Extras\MyProg.exe	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\JdaybS.exe

Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes

graph_3-1058

Source: C:\Users\user\Desktop\7Y18r(223).exe

Evasive API call chain: RegOpenKey,DecisionNodes,ExitProcess

graph_2-7788

Source: C:\Users\user\Desktop\7Y18r(223).exe

Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess

graph_2-7809

Source: C:\Users\user\Desktop\7Y18r(223).exe TID: 2816	Thread sleep count: 1064 > 30	Jump to behavior
Source: C:\Users\user\Desktop\7Y18r(223).exe TID: 2816	Thread sleep count: 186 > 30	Jump to behavior
Source: C:\Users\user\Desktop\7Y18r(223).exe TID: 2816	Thread sleep time: -1116000s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\7Y18r(223).exe	Last function: Thread delayed
Source: C:\Users\user\Desktop\7Y18r(223).exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\7Y18r(223).exe

Thread sleep count: Count: 1064 delay: -20

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\JdaybS.exe

Code function: 3_2_001A1718 GetSystemTimeAsFileTime followed by cmp: cmp dword ptr [ebp+08h], 02h and CTI: jne 001A1754h

3_2_001A1718

Source: C:\Users\user\Desktop\7Y18r(223).exe	Code function: 2_2_00612100 CoTaskMemAlloc,wsprintfA,FindFirstFileA,wsprintfA,Sleep,CharLowerA,lstrlenA,CoTaskMemAlloc,lstrcpyA,CreateThread,SetThreadPriority,WaitForSingleObject,CloseHandle,FindNextFileA,FindClose,CoTaskMemFree,		2_2_00612100
Source: C:\Users\user\AppData\Local\Temp\JdaybS.exe	Code function: 3_2_001A29E2 memset,wsprintfA,memset,lstrlen,lstrcpyn,strrchr,lstrcmpiA,lstrlen,memset,memset,FindFirstFileA,memset,FindNextFileA,lstrcmpiA,FindNextFileA,FindClose,		3_2_001A29E2

Source: C:\Users\user\Desktop\7Y18r(223).exe

Code function: 2_2_00612040 GetLogicalDriveStringsA,GetDriveTypeA,CoTaskMemAlloc,lstrcpyA,CreateThread,CreateThread,SetThreadPriority,WaitForSingleObject,lstrlenA,Sleep,

2_2_00612040

Source: C:\Users\user\Desktop\7Y18r(223).exe	File opened: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Config\	Jump to behavior
Source: C:\Users\user\Desktop\7Y18r(223).exe	File opened: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\	Jump to behavior
Source: C:\Users\user\Desktop\7Y18r(223).exe	File opened: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\	Jump to behavior
Source: C:\Users\user\Desktop\7Y18r(223).exe	File opened: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\GatherLogs\SystemIndex\	Jump to behavior
Source: C:\Users\user\Desktop\7Y18r(223).exe	File opened: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\GatherLogs\	Jump to behavior
Source: C:\Users\user\Desktop\7Y18r(223).exe	File opened: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\	Jump to behavior

Source: Amcache.hve.9.dr	Binary or memory string: VMware
Source: Amcache.hve.9.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.9.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.9.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.9.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.9.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.9.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.9.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.9.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: 7Y18r(223).exe, 00000002.00000002.2567487790.000000000068E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll^
Source: Amcache.hve.9.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.9.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.9.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.9.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.9.dr	Binary or memory string: vmci.syshbin`
Source: 7Y18r(223).exe, 00000002.00000003.1321149619.00000000004C0000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: vmware
Source: Amcache.hve.9.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.9.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.9.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.9.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.9.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.9.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.9.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.9.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: 7Y18r(223).exe, 00000002.00000003.1321149619.00000000004C0000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: \lsarpc\\*SMBSERVER\IPC$Administratorpassword\\%skrbtgtSUPPORT_388945a0TelnetClientsHelpAssistantHelpServicesGroupTsInternetUserSQLDebuggerSQLServerSQLAgentCmdExecNetShowServicesASPNETVUSRILS_IIS_IUSR_IWAM_OWS_ASPNETDHCPWINS WEB POP3 SQL$??vmware-group-user Authors Admins Browsers Guests Users Developers Administrators
Source: Amcache.hve.9.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.9.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.9.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.9.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.9.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.9.dr	Binary or memory string: VMware-42 27 88 19 56 cc 59 1a-97 79 fb 8c bf a1 e2 9d
Source: JdaybS.exe, 00000003.00000002.1537127772.0000000000B6B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllD
Source: Amcache.hve.9.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Users\user\Desktop\7Y18r(223).exe	API call chain: ExitProcess graph end node	graph_2-7646
Source: C:\Users\user\Desktop\7Y18r(223).exe	API call chain: ExitProcess graph end node	graph_2-7830
Source: C:\Users\user\Desktop\7Y18r(223).exe	API call chain: ExitProcess graph end node	graph_2-7733
Source: C:\Users\user\Desktop\7Y18r(223).exe	API call chain: ExitProcess graph end node	graph_2-8886
Source: C:\Users\user\Desktop\7Y18r(223).exe	API call chain: ExitProcess graph end node	graph_2-7822
Source: C:\Users\user\AppData\Local\Temp\JdaybS.exe	API call chain: ExitProcess graph end node	graph_3-1033

Source: C:\Users\user\Desktop\7Y18r(223).exe

Process queried: DebugPort

Jump to behavior

Source: C:\Users\user\Desktop\7Y18r(223).exe

Code function: 2_2_00617FC0 GetModuleFileNameA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,InitializeCriticalSection,InitializeCriticalSection,

2_2_00617FC0

Source: C:\Users\user\Desktop\7Y18r(223).exe

Code function: 2_2_00462044 mov eax, dword ptr fs:[00000030h]

2_2_00462044

Source: SciTE.exe.3.dr

Binary or memory string: Ctrl+RightLeftDownUpDecimalMinusMultiplyDivideTabSpaceDeleteEscapeEndInsertEnterHomeForwardBackwardPLAT_WIN1PageDownPageUpMenuWinSciTEACCELSSciTEWindowContentSciTEWindowPLAT_WINNT1toolbar.largecreate.hidden.consolegbkbig5euc-krshift_jisutf-8asciilatin2latin1translation.encodingwindows-1251ScaleFactoriso-8859-5cyrillic1250iso8859-11SciTE_HOMEAppsUseLightThemeSciTE_USERHOMESciTE_HOMEPropertiesScaleFactorSoftware\Microsoft\Windows\CurrentVersion\Themes\PersonalizeEmbeddedRich Text FormatButtonShell_TrayWndUSERPROFILESciTE_HOMEHtmlHelpWHHCTRL.OCX

Source: C:\Users\user\AppData\Local\Temp\JdaybS.exe

Code function: 3_2_001A1718 GetSystemTimeAsFileTime,SHSetValueA,SHGetValueA,__aulldiv,__aulldiv,

3_2_001A1718

Source: C:\Users\user\Desktop\7Y18r(223).exe

Code function: 2_2_00617A10 EntryPoint,SetErrorMode,InitializeCriticalSection,InitializeCriticalSection,InitializeCriticalSection,InitializeCriticalSection,InitializeCriticalSection,WSAStartup,GetVersionExA,CreateEventA,ExitProcess,CreateMutexA,GetLastError,CloseHandle,ExitProcess,CoTaskMemAlloc,CreateEventA,CreateThread,CreateThread,CloseHandle,FindCloseChangeNotification,CreateThread,CloseHandle,CreateThread,WaitForSingleObject,Sleep,ExitProcess,Sleep,CoTaskMemFree,WaitForSingleObject,ResumeThread,SuspendThread,

2_2_00617A10

Source: C:\Users\user\Desktop\7Y18r(223).exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: 7Y18r(223).exe, 7Y18r(223).exe, 00000002.00000002.2568528193.0000000002D30000.00000040.00001000.00020000.00000000.sdmp, 7Y18r(223).exe, 00000002.00000002.2567155186.0000000000420000.00000080.00000001.01000000.00000003.sdmp, 7Y18r(223).exe, 00000002.00000003.2225966118.0000000002E90000.00000040.00001000.00020000.00000000.sdmp, 7Y18r(223).exe, 00000002.00000000.1319999839.0000000000420000.00000080.00000001.01000000.00000003.sdmp, 7Y18r(223).exe, 00000002.00000003.2283678992.0000000002EF0000.00000040.00001000.00020000.00000000.sdmp, 7Y18r(223).exe, 00000002.00000003.2206921567.0000000002D30000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: bdagent.exe
Source: 7Y18r(223).exe, 7Y18r(223).exe, 00000002.00000002.2568528193.0000000002D30000.00000040.00001000.00020000.00000000.sdmp, 7Y18r(223).exe, 00000002.00000002.2567155186.0000000000420000.00000080.00000001.01000000.00000003.sdmp, 7Y18r(223).exe, 00000002.00000003.2225966118.0000000002E90000.00000040.00001000.00020000.00000000.sdmp, 7Y18r(223).exe, 00000002.00000000.1319999839.0000000000420000.00000080.00000001.01000000.00000003.sdmp, 7Y18r(223).exe, 00000002.00000003.2283678992.0000000002EF0000.00000040.00001000.00020000.00000000.sdmp, 7Y18r(223).exe, 00000002.00000003.2206921567.0000000002D30000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: avp.exe
Source: Amcache.hve.9.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: JdaybS.exe, 00000003.00000002.1537127772.0000000000BB2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Program Files\Windows Defender\MsMpEng.exe
Source: Amcache.hve.9.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.9.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.9.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23090.2008-0\msmpeng.exe
Source: Amcache.hve.9.dr	Binary or memory string: MsMpEng.exe

Stealing of Sensitive Information

Yara detected Bdaejec

Source: Yara match

File source: Process Memory Space: JdaybS.exe PID: 6676, type: MEMORYSTR

Remote Access Functionality

Yara detected Bdaejec

Source: Yara match

File source: Process Memory Space: JdaybS.exe PID: 6676, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	1 Access Token Manipulation	3 Virtualization/Sandbox Evasion	1 Credential API Hooking	11 System Time Discovery	1 Exploitation of Remote Services	1 Credential API Hooking	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	13 Native API	Boot or Logon Initialization Scripts	2 Process Injection	1 Access Token Manipulation	11 Input Capture	121 Security Software Discovery	1 Taint Shared Content	11 Input Capture	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	2 Process Injection	Security Account Manager	3 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	1 Archive Collected Data	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	3 Obfuscated Files or Information	NTDS	1 Process Discovery	Distributed Component Object Model	Input Capture	1 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	23 Software Packing	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	1 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	3 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	4 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
7Y18r(223).exe	96%	ReversingLabs	Win32.Virus.Wapomi
7Y18r(223).exe	95%	Virustotal		Browse
7Y18r(223).exe	100%	Avira	W32/Diliman.B
7Y18r(223).exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\JdaybS.exe	100%	Avira	TR/Dldr.Small.Z.haljq
C:\Program Files (x86)\AutoIt3\Examples\Helpfile\Extras\MyProg.exe	100%	Avira	W32/Jadtre.B
C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe	100%	Avira	W32/Jadtre.B
C:\Program Files\7-Zip\Uninstall.exe	100%	Avira	W32/Jadtre.B
C:\Users\user\AppData\Local\Temp\JdaybS.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\AutoIt3\Examples\Helpfile\Extras\MyProg.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe	100%	Joe Sandbox ML
C:\Program Files\7-Zip\Uninstall.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\JdaybS.exe	92%	ReversingLabs	Win32.Trojan.Madeba
C:\Users\user\AppData\Local\Temp\JdaybS.exe	93%	Virustotal		Browse

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
15.164.165.52.in-addr.arpa	0%	Virustotal		Browse
ddos.dnsnb8.net	13%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
https://www.smartsharesystems.com/Morten	0%	URL Reputation	safe
http://www.scintilla.org/scite.rng	0%	URL Reputation	safe
http://www.develop.com	0%	URL Reputation	safe
http://www.lua.org	0%	URL Reputation	safe
http://www.rftp.comJosiah	0%	URL Reputation	safe
http://www.activestate.com	0%	URL Reputation	safe
http://www.activestate.comHolger	0%	URL Reputation	safe
http://ddos.dnsnb8.net:799/cj//k1.rar	100%	URL Reputation	malware
http://www.spaceblue.com	0%	URL Reputation	safe
http://upx.sf.net	0%	URL Reputation	safe
http://www.baanboard.com	0%	URL Reputation	safe
http://www.rftp.com	0%	URL Reputation	safe
http://www.develop.comDeepak	0%	URL Reputation	safe
http://www.baanboard.comBrendon	0%	URL Reputation	safe
https://www.smartsharesystems.com/	0%	URL Reputation	safe
http://www.scintilla.org	0%	URL Reputation	safe
http://www.spaceblue.comMathias	0%	URL Reputation	safe
http://ddos.dnsnb8.net:799/cj//k1.rarGp	100%	Avira URL Cloud	phishing
http://ddos.dnsnb8.net:799/cj//k1.rarQ	100%	Avira URL Cloud	malware
http://ddos.dnsnb8.net:799/cj//k1.rarw	100%	Avira URL Cloud	malware
http://%s:%d/%s/%sZwQuerySystemInformationntdll.dllNtSystemDebugControlSeDebugPrivilege%s%.8x.bat:DE	0%	Avira URL Cloud	safe
http://ddos.dnsnb8.net:799/cj//k1.rarr	100%	Avira URL Cloud	phishing
http://ddos.dnsnb8.net:799/cj//k1.rarK	100%	Avira URL Cloud	malware
http://ddos.dnsnb8.net:799/cj//k1.rarQ	9%	Virustotal		Browse
http://ddos.dnsnb8.net:799/cj//k1.rarr	16%	Virustotal		Browse
http://ddos.dnsnb8.net:799/cj//k1.rarK	13%	Virustotal		Browse
http://ddos.dnsnb8.net:799/cj//k1.rarw	9%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
15.164.165.52.in-addr.arpa	unknown	unknown	true	0%, Virustotal, Browse	unknown
ddos.dnsnb8.net	unknown	unknown	true	13%, Virustotal, Browse	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.smartsharesystems.com/Morten	SciTE.exe.3.dr	false	URL Reputation: safe	unknown
http://ddos.dnsnb8.net:799/cj//k1.rarGp	JdaybS.exe, 00000003.00000002.1537510362.00000000027AA000.00000004.00000010.00020000.00000000.sdmp	true	Avira URL Cloud: phishing	unknown
http://www.scintilla.org/scite.rng	SciTE.exe.3.dr	false	URL Reputation: safe	unknown
http://www.develop.com	SciTE.exe.3.dr	false	URL Reputation: safe	unknown
http://www.lua.org	SciTE.exe.3.dr	false	URL Reputation: safe	unknown
http://www.rftp.comJosiah	SciTE.exe.3.dr	false	URL Reputation: safe	unknown
http://ddos.dnsnb8.net:799/cj//k1.rarw	JdaybS.exe, 00000003.00000002.1537127772.0000000000B4E000.00000004.00000020.00020000.00000000.sdmp	true	9%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://www.activestate.com	SciTE.exe.3.dr	false	URL Reputation: safe	unknown
http://www.activestate.comHolger	SciTE.exe.3.dr	false	URL Reputation: safe	unknown
http://ddos.dnsnb8.net:799/cj//k1.rar	JdaybS.exe, 00000003.00000002.1537510362.00000000027AA000.00000004.00000010.00020000.00000000.sdmp	true	URL Reputation: malware	unknown
http://ddos.dnsnb8.net:799/cj//k1.rarr	JdaybS.exe, 00000003.00000002.1537127772.0000000000B4E000.00000004.00000020.00020000.00000000.sdmp	true	16%, Virustotal, Browse Avira URL Cloud: phishing	unknown
http://%s:%d/%s/%sZwQuerySystemInformationntdll.dllNtSystemDebugControlSeDebugPrivilege%s%.8x.bat:DE	JdaybS.exe, 00000003.00000002.1536822008.00000000001A3000.00000002.00000001.01000000.00000004.sdmp, JdaybS.exe, 00000003.00000003.1321237591.0000000000AD0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ddos.dnsnb8.net:799/cj//k1.rarQ	JdaybS.exe, 00000003.00000002.1537127772.0000000000BC4000.00000004.00000020.00020000.00000000.sdmp	true	9%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://www.spaceblue.com	SciTE.exe.3.dr	false	URL Reputation: safe	unknown
http://upx.sf.net	Amcache.hve.9.dr	false	URL Reputation: safe	unknown
http://www.baanboard.com	SciTE.exe.3.dr	false	URL Reputation: safe	unknown
http://www.rftp.com	SciTE.exe.3.dr	false	URL Reputation: safe	unknown
http://ddos.dnsnb8.net:799/cj//k1.rarK	JdaybS.exe, 00000003.00000002.1537127772.0000000000B4E000.00000004.00000020.00020000.00000000.sdmp	true	13%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://www.develop.comDeepak	SciTE.exe.3.dr	false	URL Reputation: safe	unknown
http://www.baanboard.comBrendon	SciTE.exe.3.dr	false	URL Reputation: safe	unknown
https://www.smartsharesystems.com/	SciTE.exe.3.dr	false	URL Reputation: safe	unknown
http://www.scintilla.org	SciTE.exe.3.dr	false	URL Reputation: safe	unknown
http://www.spaceblue.comMathias	SciTE.exe.3.dr	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
62.118.55.37	unknown	Russian Federation	8359	MTSRU	false
62.118.120.105	unknown	Russian Federation	8359	MTSRU	false
62.118.106.199	unknown	Russian Federation	8359	MTSRU	false
62.118.201.103	unknown	Russian Federation	62347	MTS_VNOVVelikiyNovgorodbranchRU	false
62.118.216.212	unknown	Russian Federation	62347	MTS_VNOVVelikiyNovgorodbranchRU	false
62.118.106.197	unknown	Russian Federation	8359	MTSRU	false
62.118.81.188	unknown	Russian Federation	8359	MTSRU	false
62.118.18.4	unknown	Russian Federation	8359	MTSRU	false
62.118.55.34	unknown	Russian Federation	8359	MTSRU	false
62.118.71.4	unknown	Russian Federation	8359	MTSRU	false
62.118.232.219	unknown	Russian Federation	62347	MTS_VNOVVelikiyNovgorodbranchRU	false
62.118.203.193	unknown	Russian Federation	62347	MTS_VNOVVelikiyNovgorodbranchRU	false
62.118.67.19	unknown	Russian Federation	8359	MTSRU	false
62.118.56.146	unknown	Russian Federation	8359	MTSRU	false
62.118.192.156	unknown	Russian Federation	62347	MTS_VNOVVelikiyNovgorodbranchRU	false
62.118.120.107	unknown	Russian Federation	8359	MTSRU	false
62.118.118.99	unknown	Russian Federation	8359	MTSRU	false
62.118.49.182	unknown	Russian Federation	8359	MTSRU	false
62.118.31.78	unknown	Russian Federation	8359	MTSRU	false
62.118.40.222	unknown	Russian Federation	8359	MTSRU	false
62.118.176.178	unknown	Russian Federation	62347	MTS_VNOVVelikiyNovgorodbranchRU	false
62.118.198.230	unknown	Russian Federation	62347	MTS_VNOVVelikiyNovgorodbranchRU	false
62.118.216.208	unknown	Russian Federation	62347	MTS_VNOVVelikiyNovgorodbranchRU	false
62.118.201.29	unknown	Russian Federation	62347	MTS_VNOVVelikiyNovgorodbranchRU	false
62.118.24.224	unknown	Russian Federation	8359	MTSRU	false
62.118.119.207	unknown	Russian Federation	8359	MTSRU	false
62.118.185.194	unknown	Russian Federation	62347	MTS_VNOVVelikiyNovgorodbranchRU	false
62.118.31.75	unknown	Russian Federation	8359	MTSRU	false
62.118.167.113	unknown	Russian Federation	62347	MTS_VNOVVelikiyNovgorodbranchRU	false
62.118.113.142	unknown	Russian Federation	8359	MTSRU	false
62.118.18.88	unknown	Russian Federation	8359	MTSRU	false
62.118.185.191	unknown	Russian Federation	62347	MTS_VNOVVelikiyNovgorodbranchRU	false
62.118.31.200	unknown	Russian Federation	8359	MTSRU	false
62.118.131.46	unknown	Russian Federation	62347	MTS_VNOVVelikiyNovgorodbranchRU	false
62.118.155.33	unknown	Russian Federation	62347	MTS_VNOVVelikiyNovgorodbranchRU	false
62.118.31.207	unknown	Russian Federation	8359	MTSRU	false
62.118.131.42	unknown	Russian Federation	62347	MTS_VNOVVelikiyNovgorodbranchRU	false
62.118.2.69	unknown	Russian Federation	8359	MTSRU	false
62.118.56.131	unknown	Russian Federation	8359	MTSRU	false
62.118.135.209	unknown	Russian Federation	62347	MTS_VNOVVelikiyNovgorodbranchRU	false
62.118.221.84	unknown	Russian Federation	62347	MTS_VNOVVelikiyNovgorodbranchRU	false
62.118.24.215	unknown	Russian Federation	8359	MTSRU	false
62.118.87.230	unknown	Russian Federation	8359	MTSRU	false
62.118.135.230	unknown	Russian Federation	62347	MTS_VNOVVelikiyNovgorodbranchRU	false
62.118.169.189	unknown	Russian Federation	62347	MTS_VNOVVelikiyNovgorodbranchRU	false
62.118.135.238	unknown	Russian Federation	62347	MTS_VNOVVelikiyNovgorodbranchRU	false
62.118.160.227	unknown	Russian Federation	62347	MTS_VNOVVelikiyNovgorodbranchRU	false
62.118.43.22	unknown	Russian Federation	8359	MTSRU	false
62.118.144.236	unknown	Russian Federation	62347	MTS_VNOVVelikiyNovgorodbranchRU	false
62.118.17.253	unknown	Russian Federation	8359	MTSRU	false
62.118.198.254	unknown	Russian Federation	62347	MTS_VNOVVelikiyNovgorodbranchRU	false
62.118.144.240	unknown	Russian Federation	62347	MTS_VNOVVelikiyNovgorodbranchRU	false
62.118.225.244	unknown	Russian Federation	62347	MTS_VNOVVelikiyNovgorodbranchRU	false
62.118.72.117	unknown	Russian Federation	8359	MTSRU	false
62.118.131.67	unknown	Russian Federation	62347	MTS_VNOVVelikiyNovgorodbranchRU	false
62.118.207.204	unknown	Russian Federation	62347	MTS_VNOVVelikiyNovgorodbranchRU	false
62.118.31.229	unknown	Russian Federation	8359	MTSRU	false
62.118.203.186	unknown	Russian Federation	62347	MTS_VNOVVelikiyNovgorodbranchRU	false
62.118.192.165	unknown	Russian Federation	62347	MTS_VNOVVelikiyNovgorodbranchRU	false
62.118.163.95	unknown	Russian Federation	62347	MTS_VNOVVelikiyNovgorodbranchRU	false
62.118.11.14	unknown	Russian Federation	8359	MTSRU	false
62.118.201.146	unknown	Russian Federation	62347	MTS_VNOVVelikiyNovgorodbranchRU	false
62.118.99.59	unknown	Russian Federation	8359	MTSRU	false
62.118.63.149	unknown	Russian Federation	8359	MTSRU	false
62.118.96.253	unknown	Russian Federation	8359	MTSRU	false
62.118.192.116	unknown	Russian Federation	62347	MTS_VNOVVelikiyNovgorodbranchRU	false
62.118.213.34	unknown	Russian Federation	62347	MTS_VNOVVelikiyNovgorodbranchRU	false
62.118.192.117	unknown	Russian Federation	62347	MTS_VNOVVelikiyNovgorodbranchRU	false
62.118.11.175	unknown	Russian Federation	8359	MTSRU	false
62.118.126.213	unknown	Russian Federation	8359	MTSRU	false
62.118.67.54	unknown	Russian Federation	8359	MTSRU	false
62.118.67.53	unknown	Russian Federation	8359	MTSRU	true
62.118.78.245	unknown	Russian Federation	8359	MTSRU	false
62.118.5.246	unknown	Russian Federation	8359	MTSRU	false
62.118.250.255	unknown	Russian Federation	62347	MTS_VNOVVelikiyNovgorodbranchRU	false
62.118.119.245	unknown	Russian Federation	8359	MTSRU	false
62.118.99.40	unknown	Russian Federation	8359	MTSRU	false
62.118.99.41	unknown	Russian Federation	8359	MTSRU	false
62.118.94.239	unknown	Russian Federation	8359	MTSRU	false
62.118.163.86	unknown	Russian Federation	62347	MTS_VNOVVelikiyNovgorodbranchRU	false
62.118.47.154	unknown	Russian Federation	8359	MTSRU	false
62.118.122.166	unknown	Russian Federation	8359	MTSRU	false
62.118.119.240	unknown	Russian Federation	8359	MTSRU	false
62.118.111.111	unknown	Russian Federation	8359	MTSRU	false
62.118.169.158	unknown	Russian Federation	62347	MTS_VNOVVelikiyNovgorodbranchRU	false
62.118.11.188	unknown	Russian Federation	8359	MTSRU	false
62.118.212.185	unknown	Russian Federation	62347	MTS_VNOVVelikiyNovgorodbranchRU	false
62.118.210.111	unknown	Russian Federation	62347	MTS_VNOVVelikiyNovgorodbranchRU	false
62.118.210.114	unknown	Russian Federation	62347	MTS_VNOVVelikiyNovgorodbranchRU	false
62.118.111.115	unknown	Russian Federation	8359	MTSRU	false
62.118.87.76	unknown	Russian Federation	8359	MTSRU	false
62.118.209.218	unknown	Russian Federation	62347	MTS_VNOVVelikiyNovgorodbranchRU	false
62.118.153.245	unknown	Russian Federation	62347	MTS_VNOVVelikiyNovgorodbranchRU	false
62.118.40.211	unknown	Russian Federation	8359	MTSRU	false
62.118.24.252	unknown	Russian Federation	8359	MTSRU	false
62.118.183.171	unknown	Russian Federation	62347	MTS_VNOVVelikiyNovgorodbranchRU	false
62.118.175.55	unknown	Russian Federation	62347	MTS_VNOVVelikiyNovgorodbranchRU	false
62.118.67.30	unknown	Russian Federation	8359	MTSRU	false
62.118.194.184	unknown	Russian Federation	62347	MTS_VNOVVelikiyNovgorodbranchRU	false
62.118.122.137	unknown	Russian Federation	8359	MTSRU	false

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1482699
Start date and time:	2024-07-26 02:25:51 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 5s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	16
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	7Y18r(223).exe
Detection:	MAL
Classification:	mal100.spre.troj.evad.winEXE@4/9@5/100
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 98% Number of executed functions: 56 Number of non-executed functions: 77
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, MoUsoCoreWorker.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 93.184.221.240, 20.42.73.29, 2.19.126.163, 2.19.126.137
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, wu.ec.azureedge.net, ctldl.windowsupdate.com, time.windows.com, a767.dspw65.akamai.net, wu.azureedge.net, fe3cr.delivery.mp.microsoft.com, download.windowsupdate.com.edgesuite.net, login.live.com, bg.apr-52dd2-0503.edgecastdns.net, cs11.wpc.v0cdn.net, blobcollector.events.data.trafficmanager.net, onedsblobprdeus15.eastus.cloudapp.azure.com, hlb.apr-52dd2-0.edgecastdns.net, umwatson.events.data.microsoft.com, wu-b-net.trafficmanager.net
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
21:34:16	API Interceptor	1x Sleep call for process: WerFault.exe modified
21:34:45	API Interceptor	1260x Sleep call for process: 7Y18r(223).exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
62.118.119.207	pKij0lMw8g.elf	Get hash	malicious	Mirai	Browse
62.118.167.113	Vyuhx7175I.elf	Get hash	malicious	Mirai	Browse
62.118.118.99	Tsunami.arm7	Get hash	malicious	Mirai	Browse
	Rubify.arm7	Get hash	malicious	Mirai	Browse
	qAwuBBElh2	Get hash	malicious	Mirai	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
MTSRU	https://assets-usa.mkt.dynamics.com/95689b1f-9545-ef11-bfdf-00224825570b/digitalassets/standaloneforms/40bb8d8b-d049-ef11-a317-6045bdd83a8b	Get hash	malicious	Outlook Phishing, HTMLPhisher	Browse	195.35.33.215
	Installer Setup 9.7.0.exe	Get hash	malicious	Unknown	Browse	195.35.49.154
	SecuriteInfo.com.FileRepMalware.25505.20211.exe	Get hash	malicious	Unknown	Browse	195.35.33.201
	Qa5qvgWyUn.elf	Get hash	malicious	Mirai	Browse	91.77.166.9
	http://pub-a8ca61c8f7dc4c519488087e0ecec227.r2.dev/index.html	Get hash	malicious	Unknown	Browse	195.35.33.215
	http://pub-87e95b6c746d4f758cf64246fecf1595.r2.dev/index.html	Get hash	malicious	Unknown	Browse	195.35.33.215
	jew.m68k.elf	Get hash	malicious	Unknown	Browse	89.209.77.15
	qgtfQPgL23.elf	Get hash	malicious	Unknown	Browse	91.76.115.62
	https://isragohar.github.io/Fb-Clone-	Get hash	malicious	Unknown	Browse	195.35.10.26
	SR9qYL1hLF.elf	Get hash	malicious	Mirai, Moobot	Browse	91.76.136.51
MTSRU	https://assets-usa.mkt.dynamics.com/95689b1f-9545-ef11-bfdf-00224825570b/digitalassets/standaloneforms/40bb8d8b-d049-ef11-a317-6045bdd83a8b	Get hash	malicious	Outlook Phishing, HTMLPhisher	Browse	195.35.33.215
	Installer Setup 9.7.0.exe	Get hash	malicious	Unknown	Browse	195.35.49.154
	SecuriteInfo.com.FileRepMalware.25505.20211.exe	Get hash	malicious	Unknown	Browse	195.35.33.201
	Qa5qvgWyUn.elf	Get hash	malicious	Mirai	Browse	91.77.166.9
	http://pub-a8ca61c8f7dc4c519488087e0ecec227.r2.dev/index.html	Get hash	malicious	Unknown	Browse	195.35.33.215
	http://pub-87e95b6c746d4f758cf64246fecf1595.r2.dev/index.html	Get hash	malicious	Unknown	Browse	195.35.33.215
	jew.m68k.elf	Get hash	malicious	Unknown	Browse	89.209.77.15
	qgtfQPgL23.elf	Get hash	malicious	Unknown	Browse	91.76.115.62
	https://isragohar.github.io/Fb-Clone-	Get hash	malicious	Unknown	Browse	195.35.10.26
	SR9qYL1hLF.elf	Get hash	malicious	Mirai, Moobot	Browse	91.76.136.51
MTS_VNOVVelikiyNovgorodbranchRU	Vyuhx7175I.elf	Get hash	malicious	Mirai	Browse	62.118.167.113
	pu8ZPF7c37.elf	Get hash	malicious	Mirai	Browse	62.118.143.18
	eMre2dimC4.elf	Get hash	malicious	Mirai	Browse	62.118.143.44
	p8a13ef0D3.elf	Get hash	malicious	Mirai	Browse	62.118.143.39
	RJudoDO8d4.elf	Get hash	malicious	Mirai	Browse	62.118.143.31
	F00D0B21M4.elf	Get hash	malicious	Mirai	Browse	62.118.143.14
	3VNmL4P4sG.elf	Get hash	malicious	Mirai	Browse	62.118.143.26
	arm7-20231005-1029.elf	Get hash	malicious	Mirai	Browse	62.118.143.34
	9gwgdVsT9o.elf	Get hash	malicious	Mirai	Browse	62.118.143.48
	3wrAneXrM7.elf	Get hash	malicious	Mirai	Browse	62.118.143.16
MTSRU	https://assets-usa.mkt.dynamics.com/95689b1f-9545-ef11-bfdf-00224825570b/digitalassets/standaloneforms/40bb8d8b-d049-ef11-a317-6045bdd83a8b	Get hash	malicious	Outlook Phishing, HTMLPhisher	Browse	195.35.33.215
	Installer Setup 9.7.0.exe	Get hash	malicious	Unknown	Browse	195.35.49.154
	SecuriteInfo.com.FileRepMalware.25505.20211.exe	Get hash	malicious	Unknown	Browse	195.35.33.201
	Qa5qvgWyUn.elf	Get hash	malicious	Mirai	Browse	91.77.166.9
	http://pub-a8ca61c8f7dc4c519488087e0ecec227.r2.dev/index.html	Get hash	malicious	Unknown	Browse	195.35.33.215
	http://pub-87e95b6c746d4f758cf64246fecf1595.r2.dev/index.html	Get hash	malicious	Unknown	Browse	195.35.33.215
	jew.m68k.elf	Get hash	malicious	Unknown	Browse	89.209.77.15
	qgtfQPgL23.elf	Get hash	malicious	Unknown	Browse	91.76.115.62
	https://isragohar.github.io/Fb-Clone-	Get hash	malicious	Unknown	Browse	195.35.10.26
	SR9qYL1hLF.elf	Get hash	malicious	Mirai, Moobot	Browse	91.76.136.51

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\JdaybS.exe	builder_Release.exe	Get hash	malicious	Bdaejec	Browse
	A9BCD8D127BE95C64EDAE5CDD2379494A37D458FD9D5881D74F8D5487A805E6C.exe	Get hash	malicious	Bdaejec, SmokeLoader	Browse
	BOTBINARY.EXE.exe	Get hash	malicious	Bdaejec	Browse
	BkPack.exe	Get hash	malicious	Bdaejec	Browse
	bss.exe	Get hash	malicious	Bdaejec	Browse
	C0ED98D08381257B540A04C0868ECD6A628649AA70FEBCBE03778BAE532FB5BE.exe	Get hash	malicious	Bdaejec, BitCoin Miner, Xmrig	Browse
	builder_Release.exe	Get hash	malicious	Bdaejec	Browse
	E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Get hash	malicious	Babuk, Bdaejec, Djvu, Zorab	Browse
	dllhost.exe	Get hash	malicious	Bdaejec	Browse
	eb46b015c1a492b2307a541e45c2ecc0662bc9fc34b5ed028aac2ee2b6b1895c.exe	Get hash	malicious	Bdaejec	Browse

Created / dropped Files

C:\Program Files (x86)\AutoIt3\Examples\Helpfile\Extras\MyProg.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\JdaybS.exe
File Type:	MS-DOS executable PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	19456
Entropy (8bit):	6.590597371892083
Encrypted:	false
SSDEEP:	384:1F9SvXZQaD7U8iu4YsAa7ZA0UvH2lsRv21yW7GbAxur6+Y9PffPz:AxQGPL4vzZq2o9W7GsxBbPr
MD5:	89A0DDC0AA273F897F8E6A46E8C29CC3
SHA1:	7096AE591B3D15306836115E3C50F2C2B0C49D92
SHA-256:	A048EEDFFC38C792E6802A7ADD2BB3E43E53516596A2CD8863C7770D24CC3918
SHA-512:	D4614A9D87ED1B71F32B7DF57DC5C8CE3286FEED34F4C3D0B60373FAFA7F11549BCB4765D076C972160C2C775123A9228742E5A4389ACF2D875FDA6DC1D1E22F
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	low
Preview:	MZ..........................................................@...PE..L....................................0............................................................................................... ..l...........................................................................................................PELIB...............................`....rsrc........ ......................@..@..Y\|.uR..P...0...B.................. ...................................................................................j.h"...h....j...(....Hello World!.MyProg........................................................................................................................................................................................................................(...........0...(.......................;.......User32.dll...MessageBoxA................................................................................................dummy.exe.....................TestExport.CallPlz................

C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\JdaybS.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	2389504
Entropy (8bit):	6.731346317835445
Encrypted:	false
SSDEEP:	49152:BGSXoV72tpV9XE8Wwi1aCvYMdRluS/fYw44RxL:V4OEtwiICvYMpf
MD5:	35CEE892DE08159128C10D808D60EC82
SHA1:	FC7733A833C4C75430F94776223C309EBD1C13D0
SHA-256:	ABA9531021C607E367C71EF00A89F2FD5216D2C7BE74C96449B848FA112AE670
SHA-512:	1FDB0BE379FEBE7CD6B44979BD720D4BD102826F93C63E074EB01A20BFA5B217DDEABEA17DF9E26A4C662A1DFC1EBA0C15FF1603AEB8FDF1F7F15ABE29A70BB7
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........Ark.Ark.Ark...o.Mrk...h.Jrk...n.^rk...j.Erk.H...Brk.H...nrk.Arj..pk...b.rk...k.@rk.....@rk...i.@rk.RichArk.........................PE..L.....(c.....................~.......p$...........@...........................$...........@.........................p...<............@ ......................P#.....@...p...................P...........@............................................text...e........................... ..`.rdata...^.......`..................@..@.data...`....0......................@....rsrc........@ ....... .............@..@.reloc.......P#......"#.............@..B.....u...P...p$..B...4$............. ...........................................................................................................................................................................................................................................................

C:\Program Files\7-Zip\Uninstall.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\JdaybS.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	31744
Entropy (8bit):	6.366944941402448
Encrypted:	false
SSDEEP:	768:uWQ3655Kv1X/qY1MSdaXQGPL4vzZq2o9W7GsxBbPr:uHqaNrFdagGCq2iW7z
MD5:	A9B9EA4032D278BC34D41D9E47D5B864
SHA1:	D3BDE624B8DB3D505C8D023A28727F625E649D4D
SHA-256:	48E1DFCB6C0A724FEEBCCEEB183134A950088E0DCA6C558E95CA2932FC5BE1D1
SHA-512:	6037DA04B344650DABAE68656C3F37C901B378542292699A7961D90900676C380BC3685FAE5918F1332F8BA7DCE383CDC253260E00E89814E72F517C88FC3522
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......S.6...X...X...X.x.R...X..V...X.x.\...X......X...Y.W.X......X.!.R...X...^...X.Rich..X.................PE..L...pN.d........../......V...@.......p.......0....@.........................................................................$9.......`...............................................................................0...............................text............................... ..`.rdata.......0......................@..@.data...X....@.......(..............@....rsrc........`.......*..............@..@.EpN.uZ..P...p...B...:.............. ...................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_JdaybS.exe_9e8ce935e9b7cca551c27c62a0c191c7d9681c5b_6dafb920_a99c52c2-4f7c-4dc1-8fe1-f6af9422e0a1\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	modified
Size (bytes):	65536
Entropy (8bit):	0.9117306927556712
Encrypted:	false
SSDEEP:	192:QyMnb72y0wcyrWm8dj8/nzuiFRZ24IO80j:ZMb725wcyr4jUzuiFRY4IO8a
MD5:	B817BDB8AF3E9085B178105DD8AB06A6
SHA1:	0B7D5EBBE51F0AF8C5E019D76C3B8E14B68984C8
SHA-256:	CF5F4BCD77EBBE4FD2E40CCDA1EE9F4676A863040207FE4FD53DED1D8257CE99
SHA-512:	5DFDBAE824107CC8DD455B45F6B76B67F0F4873BAAC4BC86ECF47350E7A90323888E75D0618DB4AB4C4FCAEA9E15524455811546E1FEB443BFD098A5C4D95004
Malicious:	false
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.6.6.4.2.7.2.1.8.6.6.0.7.3.1.8.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.6.6.4.2.7.2.1.9.5.8.2.6.0.5.4.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.a.9.9.c.5.2.c.2.-.4.f.7.c.-.4.d.c.1.-.8.f.e.1.-.f.6.a.f.9.4.2.2.e.0.a.1.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.7.5.6.9.d.1.8.3.-.e.9.6.6.-.4.e.4.f.-.a.d.6.1.-.4.5.1.1.d.0.8.0.9.c.c.c.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.J.d.a.y.b.S...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.a.1.4.-.0.0.0.1.-.0.0.1.4.-.b.8.9.b.-.f.6.8.2.f.2.d.e.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.3.d.b.d.f.5.a.1.5.d.0.6.9.9.6.4.5.8.2.8.3.b.2.5.d.c.7.1.3.c.8.e.0.0.0.0.f.f.f.f.!.0.0.0.0.d.4.e.9.e.f.1.0.d.7.6.8.5.d.4.9.1.5.8.3.c.6.f.a.9.3.a.e.5.d.9.1.0.5.d.8.1.5.b.d.!.J.d.a.y.b.S...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.1.3.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER80D6.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Fri Jul 26 00:26:59 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	152136
Entropy (8bit):	1.9761645484076413
Encrypted:	false
SSDEEP:	768:K2HBBDVi/BL+hnFyg3pju9J+WYjYk2IP9Xa:NUJaFlp5F9K
MD5:	00DDFB53955F54EC2B1354D55764A258
SHA1:	A9553670D4F144690B1B01AE5C84EFE60B3EC831
SHA-256:	4386B35FC36E911C501C5AA6338B141AD1E079060AA49AE919567D986AC17930
SHA-512:	8857B17B13B8ED1E7C79AC62F381D5E9D00C269153663E932FE3983BC5A4D47BC418B49E303850985910147E25C3F73C54FB87EDA56572A49230851CAF199681
Malicious:	false
Reputation:	low
Preview:	MDMP..a..... .......S.f............D...............L.......T...ZH..........T.......8...........T............5..............L...........8...............................................................................eJ..............GenuineIntel............T...........L.f.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER8386.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8272
Entropy (8bit):	3.6981746807315985
Encrypted:	false
SSDEEP:	192:R6l7wVeJXd6JW6YXI6witgmfWdNYpDB89bNSKhsf0sivm:R6lXJN6o6Y46witgmfWdZNSKafdj
MD5:	5E104457231C5A10F0DF6CDF2095158A
SHA1:	447571A1A9768DF98A3BD952739B486802822DCF
SHA-256:	837CAFDD6473A75082228DD7E3453D76DD0A6E1C9F76404C176CFC637BBCC30E
SHA-512:	6C67EB7D090D90635285FCE483BF9B582CFCCF342E66092A8ED081DBB3822700596664FF2BDC32949AC0A5BAF0612CCB6FF553D2377C4FAD3844AEC2ED2DBB32
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.6.6.7.6.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER83B6.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4551
Entropy (8bit):	4.446702962388452
Encrypted:	false
SSDEEP:	48:cvIwWl8zsxrJg77aI9gx0CWpW8VYGYm8M4JUoFi+q8Gfn2gsyd:uIjfxFI7Gx0D7VKJa72gsyd
MD5:	47216CAFE833EE35BB4DD7343D0AE517
SHA1:	1D4A1C568F0164A198108CEB503C5553B856CFB3
SHA-256:	EBEA98B8108F2B5BB92B89CEF99BCE6E0385377DDAAEDB47BD4EF86313036872
SHA-512:	068E7A0E4989371D6F98AF892F2D75CCBDEEFCB79C8776FBE3CDCD1731230E274C63EDAA8B06D86CFDC6C7B60B2D44825C2B9054758DD055A325C39275B4C433
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="427169" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Users\user\AppData\Local\Temp\JdaybS.exe

Download File

Process:	C:\Users\user\Desktop\7Y18r(223).exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	15872
Entropy (8bit):	7.031075575407894
Encrypted:	false
SSDEEP:	384:IXZQaD7U8iu4YsAa7ZA0UvH2lsRv21yW7GbAxur6+Y9PffPz:gQGPL4vzZq2o9W7GsxBbPr
MD5:	F7D21DE5C4E81341ECCD280C11DDCC9A
SHA1:	D4E9EF10D7685D491583C6FA93AE5D9105D815BD
SHA-256:	4485DF22C627FA0BB899D79AA6FF29BC5BE1DBC3CAA2B7A490809338D54B7794
SHA-512:	E4553B86B083996038BACFB979AD0B86F578F95185D8EFAC34A77F6CC73E491D4F70E1449BBC9EB1D62F430800C1574101B270E1CB0EEED43A83049A79B636A3
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 92% Antivirus: Virustotal, Detection: 93%, Browse
Joe Sandbox View:	Filename: builder_Release.exe, Detection: malicious, Browse Filename: A9BCD8D127BE95C64EDAE5CDD2379494A37D458FD9D5881D74F8D5487A805E6C.exe, Detection: malicious, Browse Filename: BOTBINARY.EXE.exe, Detection: malicious, Browse Filename: BkPack.exe, Detection: malicious, Browse Filename: bss.exe, Detection: malicious, Browse Filename: C0ED98D08381257B540A04C0868ECD6A628649AA70FEBCBE03778BAE532FB5BE.exe, Detection: malicious, Browse Filename: builder_Release.exe, Detection: malicious, Browse Filename: E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe, Detection: malicious, Browse Filename: dllhost.exe, Detection: malicious, Browse Filename: eb46b015c1a492b2307a541e45c2ecc0662bc9fc34b5ed028aac2ee2b6b1895c.exe, Detection: malicious, Browse
Reputation:	moderate, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........I.>.'..'.>.'..\.2.'.#.(.?.'.>.&.y.'.Q.#.=.'..).?.'.7...6.'.7...?.'.Rich>.'.................PE..L...JG.R.............................`.......0....@.......................................@..................................p...............................o.......................................................................................text.... ..........................`....rdata.......0......................@....data........@......................@....reloc.......P.......(..............@....aspack.. ...`.......,..............`....adata...............>..............@...................................................................................................................................................................................................................................................................................................

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.4166724914468745
Encrypted:	false
SSDEEP:	6144:Zcifpi6ceLPL9skLmb0moSWSPtaJG8nAgex285i2MMhA20X4WABlGuNA5+:Gi58oSWIZBk2MM6AFB2o
MD5:	B85E00BAE3FB2A1F24D708C7593066D2
SHA1:	E76A5091F6210BD05022C848C4719AC7CB094E81
SHA-256:	1E62AD0CB2EB5BA0764DA28D0AEC6187EB951C77B42EBD5FC13BA9E7C17D0F37
SHA-512:	13D6F6ED162127626DA54A35178633CEB85BEFF5DA60222B5112D0C71AF42FFEC0FC9CA494509A4491167EF671B547B4B1588E74F02FAC47A508FBE56700939C
Malicious:	false
Reputation:	low
Preview:	regfE...E....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm...................................................................................................................................................................................................................................................................................................................................................R..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.666003283660948
TrID:	Win32 Executable (generic) a (10002005/4) 99.66% UPX compressed Win32 Executable (30571/9) 0.30% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	7Y18r(223).exe
File size:	345'088 bytes
MD5:	b77a751dbe5de08be02a2e38cedeccbf
SHA1:	5a69eaed587eabcb77049c71f4b2de94e7f71053
SHA256:	e6a8f27d09c850978b635d02a99758fe27e2accbe11eeab7588f90726fc89e74
SHA512:	e7a83a51cdaa1e13d6007e8a39c3406a931f173f840df5f21102364dc47ce487cdacca3b2c92515eef879710dbcbbb9250fa77a2a2020194f1e4c22d5999390d
SSDEEP:	6144:WWxlqOUH2RfS155ONNXBuWoJBO9OMbHLkAqF7Ief9UmM7/uTW:WUqOy2EB0NxDIBuOFe7/uT
TLSH:	F274F1750713A032CB421C714DF26BBAAEA81E3D5C38EB07D9914E5F319C6D5EA98387
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................................Rich.g..........PE..L...sqH%.................H........... .......P....@........................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x462000
Entrypoint Section:	T<squ
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:
Time Stamp:	0x25487173 [Fri Oct 27 15:17:07 1989 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	11f5cfb8b4f49b61efa5a9fe2ce22934

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
sub esp, 0000016Ch
xor eax, eax
push ebx
push esi
push edi
mov dword ptr [ebp-24h], eax
mov dword ptr [ebp-10h], eax
mov dword ptr [ebp-14h], eax
mov dword ptr [ebp-08h], eax
mov dword ptr [ebp-0Ch], eax
mov dword ptr [ebp-20h], eax
mov dword ptr [ebp-18h], eax
mov dword ptr [ebp-48h], 7961644Ah
mov dword ptr [ebp-44h], 652E5362h
mov dword ptr [ebp-40h], 00006578h
mov dword ptr [ebp-3Ch], 00000000h
call 00007F9E88DCA435h
pop eax
add eax, 00000225h
mov dword ptr [ebp-04h], eax
mov eax, dword ptr fs:[00000030h]
mov dword ptr [ebp-28h], eax
mov eax, dword ptr [ebp-04h]
mov dword ptr [eax], E904C483h
mov eax, dword ptr [ebp-04h]
mov dword ptr [eax+04h], FFF9F6ABh
mov eax, dword ptr [ebp-28h]
mov eax, dword ptr [eax+0Ch]
mov eax, dword ptr [eax+1Ch]
mov eax, dword ptr [eax]
mov eax, dword ptr [eax+08h]
mov ecx, dword ptr [eax+3Ch]
mov ecx, dword ptr [ecx+eax+78h]
add ecx, eax
mov edi, dword ptr [ecx+1Ch]
mov ebx, dword ptr [ecx+20h]
mov esi, dword ptr [ecx+24h]
mov ecx, dword ptr [ecx+18h]
add esi, eax
add edi, eax
add ebx, eax
xor edx, edx
mov dword ptr [ebp-30h], esi
mov dword ptr [ebp-1Ch], edx
mov dword ptr [ebp-34h], ecx
cmp edx, dword ptr [ebp-34h]
jnc 00007F9E88DCA57Eh
movzx ecx, word ptr [esi+edx*2]
mov edx, dword ptr [ebx+edx*4]
mov esi, dword ptr [edi+ecx*4]
add edx, eax
mov ecx, dword ptr [edx]
add esi, eax
cmp ecx, 4D746547h
jne 00007F9E88DCA484h
cmp dword ptr [edx+04h], 6C75646Fh
jne 00007F9E88DCA47Bh

Data Directories

Name	Virtual Address	Virtual Size
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x4406	0x28
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x445a	0x2c
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x3428	0x3600	a927342220086b0290c72c80906ac34e	False	0.5238715277777778	data	6.6938545316729305	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdatap	0x5000	0x10000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.data	0x15000	0xa65a	0xa800	101598a8b4f3001379ed040b845e2178	False	0.9976050967261905	data	7.994835937836681	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.brdata	0x20000	0x5000	0x5000	482f6c87e8e8aafbf331ac0f2eb043f0	False	1.00078125	data	7.9923959437222605	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tc	0x25000	0x3d000	0x3d000	11bb19755687dd72da01f9f7428f0e1f	False	0.8068967725409836	data	7.5816366968975855	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
T<squ	0x62000	0x5000	0x4200	90732330242401647199e1fce0c5245a	False	0.7775804924242424	data	6.93452153597581	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
KERNEL32.dll	GetFileAttributesW, RegisterWaitForSingleObjectEx, GetCurrentThread, GetConsoleAliasW, CreateDirectoryExA, AddConsoleAliasW, ReadConsoleOutputAttribute, SetThreadPriorityBoost, GetComputerNameExW, LocalFileTimeToFileTime

Network Behavior

Suricata IDS Alerts

Timestamp	Protocol	SID	Signature	Source Port	Dest Port	Source IP	Dest IP
2024-07-26T02:27:02.970869+0200	ICMP	2003292	ET WORM Allaple ICMP Sweep Ping Outbound	0	0	192.168.2.7	62.118.128.77
2024-07-26T02:26:56.027550+0200	ICMP	2003292	ET WORM Allaple ICMP Sweep Ping Outbound	0	0	192.168.2.7	62.118.135.124
2024-07-26T02:27:07.999877+0200	ICMP	2003292	ET WORM Allaple ICMP Sweep Ping Outbound	0	0	192.168.2.7	62.118.45.221
2024-07-26T02:27:01.384363+0200	ICMP	2003292	ET WORM Allaple ICMP Sweep Ping Outbound	0	0	192.168.2.7	62.118.161.213
2024-07-26T02:27:03.997715+0200	ICMP	2003292	ET WORM Allaple ICMP Sweep Ping Outbound	0	0	192.168.2.7	62.118.1.60
2024-07-26T02:27:14.651880+0200	ICMP	2003292	ET WORM Allaple ICMP Sweep Ping Outbound	0	0	192.168.2.7	62.118.162.82
2024-07-26T02:27:54.007071+0200	ICMP	2003292	ET WORM Allaple ICMP Sweep Ping Outbound	0	0	192.168.2.7	62.118.102.85
2024-07-26T02:27:10.496514+0200	ICMP	2003292	ET WORM Allaple ICMP Sweep Ping Outbound	0	0	192.168.2.7	62.118.86.144
2024-07-26T02:27:27.196283+0200	ICMP	2003292	ET WORM Allaple ICMP Sweep Ping Outbound	0	0	192.168.2.7	62.118.233.177
2024-07-26T02:27:17.996340+0200	ICMP	2003292	ET WORM Allaple ICMP Sweep Ping Outbound	0	0	192.168.2.7	62.118.81.242
2024-07-26T02:26:55.931822+0200	ICMP	2003292	ET WORM Allaple ICMP Sweep Ping Outbound	0	0	192.168.2.7	62.118.199.78
2024-07-26T02:26:57.253717+0200	ICMP	2003293	ET WORM Allaple ICMP Sweep Reply Inbound	0	0	62.118.249.109	192.168.2.7
2024-07-26T02:27:58.495968+0200	ICMP	2003292	ET WORM Allaple ICMP Sweep Ping Outbound	0	0	192.168.2.7	62.118.27.81
2024-07-26T02:27:29.051429+0200	TCP	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	443	50899	52.165.165.26	192.168.2.7
2024-07-26T02:27:30.160310+0200	TCP	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	443	50901	52.165.165.26	192.168.2.7
2024-07-26T02:26:56.946252+0200	UDP	2838522	ETPRO MALWARE Backdoor.Win32/Bdaejec.A CnC Domain in DNS Lookup	58256	53	192.168.2.7	1.1.1.1
2024-07-26T02:27:41.321227+0200	ICMP	2003292	ET WORM Allaple ICMP Sweep Ping Outbound	0	0	192.168.2.7	62.118.203.229
2024-07-26T02:26:56.119310+0200	ICMP	2003292	ET WORM Allaple ICMP Sweep Ping Outbound	0	0	192.168.2.7	62.118.123.177
2024-07-26T02:26:54.942287+0200	UDP	2838522	ETPRO MALWARE Backdoor.Win32/Bdaejec.A CnC Domain in DNS Lookup	58256	53	192.168.2.7	1.1.1.1
2024-07-26T02:27:03.102878+0200	ICMP	2003292	ET WORM Allaple ICMP Sweep Ping Outbound	0	0	192.168.2.7	62.118.4.35
2024-07-26T02:27:19.196980+0200	ICMP	2003292	ET WORM Allaple ICMP Sweep Ping Outbound	0	0	192.168.2.7	62.118.131.67
2024-07-26T02:26:55.930443+0200	UDP	2838522	ETPRO MALWARE Backdoor.Win32/Bdaejec.A CnC Domain in DNS Lookup	58256	53	192.168.2.7	1.1.1.1
2024-07-26T02:27:53.602779+0200	ICMP	2003292	ET WORM Allaple ICMP Sweep Ping Outbound	0	0	192.168.2.7	62.118.232.175
2024-07-26T02:26:53.864905+0200	ICMP	2003292	ET WORM Allaple ICMP Sweep Ping Outbound	0	0	192.168.2.7	62.118.255.239
2024-07-26T02:27:05.547243+0200	ICMP	2003292	ET WORM Allaple ICMP Sweep Ping Outbound	0	0	192.168.2.7	62.118.11.73
2024-07-26T02:27:56.496503+0200	ICMP	2003292	ET WORM Allaple ICMP Sweep Ping Outbound	0	0	192.168.2.7	62.118.49.137
2024-07-26T02:27:27.383277+0200	TCP	2001579	ET SCAN Behavioral Unusual Port 139 traffic Potential Scan or Infection	50893	139	192.168.2.7	62.118.143.145
2024-07-26T02:26:53.601081+0200	ICMP	2003292	ET WORM Allaple ICMP Sweep Ping Outbound	0	0	192.168.2.7	62.118.175.11
2024-07-26T02:27:04.999426+0200	ICMP	2003292	ET WORM Allaple ICMP Sweep Ping Outbound	0	0	192.168.2.7	62.118.21.191
2024-07-26T02:26:58.945741+0200	UDP	2838522	ETPRO MALWARE Backdoor.Win32/Bdaejec.A CnC Domain in DNS Lookup	58256	53	192.168.2.7	1.1.1.1
2024-07-26T02:26:53.936683+0200	ICMP	2003292	ET WORM Allaple ICMP Sweep Ping Outbound	0	0	192.168.2.7	62.118.204.103
2024-07-26T02:26:57.560276+0200	ICMP	2003292	ET WORM Allaple ICMP Sweep Ping Outbound	0	0	192.168.2.7	62.118.199.78
2024-07-26T02:27:56.496128+0200	ICMP	2003292	ET WORM Allaple ICMP Sweep Ping Outbound	0	0	192.168.2.7	62.118.122.49
2024-07-26T02:27:06.274216+0200	ICMP	2003292	ET WORM Allaple ICMP Sweep Ping Outbound	0	0	192.168.2.7	62.118.1.98
2024-07-26T02:27:16.196297+0200	ICMP	2003292	ET WORM Allaple ICMP Sweep Ping Outbound	0	0	192.168.2.7	62.118.120.105
2024-07-26T02:27:22.995556+0200	ICMP	2003292	ET WORM Allaple ICMP Sweep Ping Outbound	0	0	192.168.2.7	62.118.102.19
2024-07-26T02:27:11.295939+0200	TCP	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	443	49723	20.114.59.183	192.168.2.7
2024-07-26T02:27:00.997090+0200	ICMP	2003292	ET WORM Allaple ICMP Sweep Ping Outbound	0	0	192.168.2.7	62.118.17.91
2024-07-26T02:27:00.343375+0200	ICMP	2003292	ET WORM Allaple ICMP Sweep Ping Outbound	0	0	192.168.2.7	62.118.216.56
2024-07-26T02:27:05.547647+0200	ICMP	2003292	ET WORM Allaple ICMP Sweep Ping Outbound	0	0	192.168.2.7	62.118.173.26
2024-07-26T02:27:34.008723+0200	ICMP	2003292	ET WORM Allaple ICMP Sweep Ping Outbound	0	0	192.168.2.7	62.118.125.148
2024-07-26T02:27:04.999621+0200	ICMP	2003292	ET WORM Allaple ICMP Sweep Ping Outbound	0	0	192.168.2.7	62.118.4.35
2024-07-26T02:26:53.608320+0200	ICMP	2003292	ET WORM Allaple ICMP Sweep Ping Outbound	0	0	192.168.2.7	62.118.104.174

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 26, 2024 02:26:57.384393930 CEST	49700	139	192.168.2.7	62.118.249.109
Jul 26, 2024 02:26:58.398729086 CEST	49700	139	192.168.2.7	62.118.249.109
Jul 26, 2024 02:26:58.763946056 CEST	49701	139	192.168.2.7	62.118.78.116
Jul 26, 2024 02:26:59.773718119 CEST	49701	139	192.168.2.7	62.118.78.116
Jul 26, 2024 02:27:00.414360046 CEST	49700	139	192.168.2.7	62.118.249.109
Jul 26, 2024 02:27:01.773745060 CEST	49701	139	192.168.2.7	62.118.78.116
Jul 26, 2024 02:27:02.135665894 CEST	49704	139	192.168.2.7	62.118.147.145
Jul 26, 2024 02:27:03.137856007 CEST	49704	139	192.168.2.7	62.118.147.145
Jul 26, 2024 02:27:03.383557081 CEST	49708	445	192.168.2.7	62.118.249.109
Jul 26, 2024 02:27:03.388436079 CEST	445	49708	62.118.249.109	192.168.2.7
Jul 26, 2024 02:27:03.388533115 CEST	49708	445	192.168.2.7	62.118.249.109
Jul 26, 2024 02:27:03.388580084 CEST	49708	445	192.168.2.7	62.118.249.109
Jul 26, 2024 02:27:03.388799906 CEST	49709	139	192.168.2.7	62.118.249.109
Jul 26, 2024 02:27:03.693887949 CEST	49710	139	192.168.2.7	62.118.67.53
Jul 26, 2024 02:27:04.383116961 CEST	49709	139	192.168.2.7	62.118.249.109
Jul 26, 2024 02:27:04.695745945 CEST	49710	139	192.168.2.7	62.118.67.53
Jul 26, 2024 02:27:04.758837938 CEST	49711	445	192.168.2.7	62.118.78.116
Jul 26, 2024 02:27:04.763781071 CEST	445	49711	62.118.78.116	192.168.2.7
Jul 26, 2024 02:27:04.763890028 CEST	49711	445	192.168.2.7	62.118.78.116
Jul 26, 2024 02:27:04.764506102 CEST	49711	445	192.168.2.7	62.118.78.116
Jul 26, 2024 02:27:04.764782906 CEST	49712	139	192.168.2.7	62.118.78.116
Jul 26, 2024 02:27:04.874115944 CEST	49713	139	192.168.2.7	62.118.143.145
Jul 26, 2024 02:27:05.148753881 CEST	49704	139	192.168.2.7	62.118.147.145
Jul 26, 2024 02:27:05.773753881 CEST	49712	139	192.168.2.7	62.118.78.116
Jul 26, 2024 02:27:05.883223057 CEST	49713	139	192.168.2.7	62.118.143.145
Jul 26, 2024 02:27:06.291918039 CEST	49715	139	192.168.2.7	62.118.95.82
Jul 26, 2024 02:27:06.398741961 CEST	49709	139	192.168.2.7	62.118.249.109
Jul 26, 2024 02:27:06.711285114 CEST	49710	139	192.168.2.7	62.118.67.53
Jul 26, 2024 02:27:07.305022001 CEST	49715	139	192.168.2.7	62.118.95.82
Jul 26, 2024 02:27:07.789490938 CEST	49712	139	192.168.2.7	62.118.78.116
Jul 26, 2024 02:27:07.898799896 CEST	49713	139	192.168.2.7	62.118.143.145
Jul 26, 2024 02:27:08.152134895 CEST	49717	445	192.168.2.7	62.118.147.145
Jul 26, 2024 02:27:08.157538891 CEST	445	49717	62.118.147.145	192.168.2.7
Jul 26, 2024 02:27:08.159885883 CEST	49717	445	192.168.2.7	62.118.147.145
Jul 26, 2024 02:27:08.159986973 CEST	49717	445	192.168.2.7	62.118.147.145
Jul 26, 2024 02:27:08.160350084 CEST	49718	139	192.168.2.7	62.118.147.145
Jul 26, 2024 02:27:09.160218954 CEST	49718	139	192.168.2.7	62.118.147.145
Jul 26, 2024 02:27:09.320646048 CEST	49715	139	192.168.2.7	62.118.95.82
Jul 26, 2024 02:27:09.399194956 CEST	49720	445	192.168.2.7	62.118.249.109
Jul 26, 2024 02:27:09.404515982 CEST	445	49720	62.118.249.109	192.168.2.7
Jul 26, 2024 02:27:09.404721975 CEST	49720	445	192.168.2.7	62.118.249.109
Jul 26, 2024 02:27:09.404923916 CEST	49720	445	192.168.2.7	62.118.249.109
Jul 26, 2024 02:27:09.409692049 CEST	445	49720	62.118.249.109	192.168.2.7
Jul 26, 2024 02:27:09.696083069 CEST	49721	445	192.168.2.7	62.118.67.53
Jul 26, 2024 02:27:09.701225996 CEST	445	49721	62.118.67.53	192.168.2.7
Jul 26, 2024 02:27:09.701347113 CEST	49721	445	192.168.2.7	62.118.67.53
Jul 26, 2024 02:27:09.701483011 CEST	49721	445	192.168.2.7	62.118.67.53
Jul 26, 2024 02:27:09.701760054 CEST	49722	139	192.168.2.7	62.118.67.53
Jul 26, 2024 02:27:10.711287022 CEST	49722	139	192.168.2.7	62.118.67.53
Jul 26, 2024 02:27:10.777256966 CEST	49727	445	192.168.2.7	62.118.78.116
Jul 26, 2024 02:27:10.782672882 CEST	445	49727	62.118.78.116	192.168.2.7
Jul 26, 2024 02:27:10.784740925 CEST	49727	445	192.168.2.7	62.118.78.116
Jul 26, 2024 02:27:10.791928053 CEST	49727	445	192.168.2.7	62.118.78.116
Jul 26, 2024 02:27:10.796762943 CEST	445	49727	62.118.78.116	192.168.2.7
Jul 26, 2024 02:27:10.883610964 CEST	49728	445	192.168.2.7	62.118.143.145
Jul 26, 2024 02:27:10.888509989 CEST	445	49728	62.118.143.145	192.168.2.7
Jul 26, 2024 02:27:10.894016981 CEST	49728	445	192.168.2.7	62.118.143.145
Jul 26, 2024 02:27:10.897933006 CEST	49728	445	192.168.2.7	62.118.143.145
Jul 26, 2024 02:27:10.898235083 CEST	49729	139	192.168.2.7	62.118.143.145
Jul 26, 2024 02:27:11.164412975 CEST	49718	139	192.168.2.7	62.118.147.145
Jul 26, 2024 02:27:11.857872009 CEST	49731	139	192.168.2.7	62.118.146.241
Jul 26, 2024 02:27:11.883155107 CEST	49729	139	192.168.2.7	62.118.143.145
Jul 26, 2024 02:27:12.075692892 CEST	49732	139	192.168.2.7	62.118.155.156
Jul 26, 2024 02:27:12.305608034 CEST	49734	445	192.168.2.7	62.118.95.82
Jul 26, 2024 02:27:12.310589075 CEST	445	49734	62.118.95.82	192.168.2.7
Jul 26, 2024 02:27:12.310652971 CEST	49734	445	192.168.2.7	62.118.95.82
Jul 26, 2024 02:27:12.310870886 CEST	49734	445	192.168.2.7	62.118.95.82
Jul 26, 2024 02:27:12.311150074 CEST	49735	139	192.168.2.7	62.118.95.82
Jul 26, 2024 02:27:12.325174093 CEST	49736	139	192.168.2.7	62.118.138.100
Jul 26, 2024 02:27:12.726933956 CEST	49722	139	192.168.2.7	62.118.67.53
Jul 26, 2024 02:27:12.867568970 CEST	49731	139	192.168.2.7	62.118.146.241
Jul 26, 2024 02:27:13.086287022 CEST	49732	139	192.168.2.7	62.118.155.156
Jul 26, 2024 02:27:13.305064917 CEST	49735	139	192.168.2.7	62.118.95.82
Jul 26, 2024 02:27:13.336304903 CEST	49736	139	192.168.2.7	62.118.138.100
Jul 26, 2024 02:27:13.383272886 CEST	49737	139	192.168.2.7	62.118.78.100
Jul 26, 2024 02:27:13.883193970 CEST	49729	139	192.168.2.7	62.118.143.145
Jul 26, 2024 02:27:14.165317059 CEST	49740	445	192.168.2.7	62.118.147.145
Jul 26, 2024 02:27:14.170305967 CEST	445	49740	62.118.147.145	192.168.2.7
Jul 26, 2024 02:27:14.170497894 CEST	49740	445	192.168.2.7	62.118.147.145
Jul 26, 2024 02:27:14.170497894 CEST	49740	445	192.168.2.7	62.118.147.145
Jul 26, 2024 02:27:14.175364971 CEST	445	49740	62.118.147.145	192.168.2.7
Jul 26, 2024 02:27:14.398802996 CEST	49737	139	192.168.2.7	62.118.78.100
Jul 26, 2024 02:27:14.638272047 CEST	49743	139	192.168.2.7	62.118.150.7
Jul 26, 2024 02:27:14.867604017 CEST	49731	139	192.168.2.7	62.118.146.241
Jul 26, 2024 02:27:15.086319923 CEST	49732	139	192.168.2.7	62.118.155.156
Jul 26, 2024 02:27:15.305058002 CEST	49735	139	192.168.2.7	62.118.95.82
Jul 26, 2024 02:27:15.336299896 CEST	49736	139	192.168.2.7	62.118.138.100
Jul 26, 2024 02:27:15.414560080 CEST	49720	445	192.168.2.7	62.118.249.109
Jul 26, 2024 02:27:15.428517103 CEST	49744	139	192.168.2.7	62.118.249.109
Jul 26, 2024 02:27:15.649502039 CEST	49743	139	192.168.2.7	62.118.150.7
Jul 26, 2024 02:27:15.712030888 CEST	49745	445	192.168.2.7	62.118.67.53
Jul 26, 2024 02:27:15.717772961 CEST	445	49745	62.118.67.53	192.168.2.7
Jul 26, 2024 02:27:15.717982054 CEST	49745	445	192.168.2.7	62.118.67.53
Jul 26, 2024 02:27:15.717982054 CEST	49745	445	192.168.2.7	62.118.67.53
Jul 26, 2024 02:27:15.722865105 CEST	445	49745	62.118.67.53	192.168.2.7
Jul 26, 2024 02:27:15.901402950 CEST	445	49740	62.118.147.145	192.168.2.7
Jul 26, 2024 02:27:15.901582956 CEST	49740	445	192.168.2.7	62.118.147.145
Jul 26, 2024 02:27:15.901582956 CEST	49740	445	192.168.2.7	62.118.147.145
Jul 26, 2024 02:27:15.901946068 CEST	49746	139	192.168.2.7	62.118.147.145
Jul 26, 2024 02:27:16.414792061 CEST	49737	139	192.168.2.7	62.118.78.100
Jul 26, 2024 02:27:16.430078030 CEST	49744	139	192.168.2.7	62.118.249.109
Jul 26, 2024 02:27:16.789932966 CEST	49727	445	192.168.2.7	62.118.78.116
Jul 26, 2024 02:27:16.793471098 CEST	49747	139	192.168.2.7	62.118.78.116
Jul 26, 2024 02:27:16.899271965 CEST	49748	445	192.168.2.7	62.118.143.145
Jul 26, 2024 02:27:16.904158115 CEST	445	49748	62.118.143.145	192.168.2.7
Jul 26, 2024 02:27:16.904233932 CEST	49748	445	192.168.2.7	62.118.143.145
Jul 26, 2024 02:27:16.904323101 CEST	49748	445	192.168.2.7	62.118.143.145
Jul 26, 2024 02:27:16.909085989 CEST	445	49748	62.118.143.145	192.168.2.7
Jul 26, 2024 02:27:16.914479971 CEST	49746	139	192.168.2.7	62.118.147.145
Jul 26, 2024 02:27:17.470386982 CEST	445	49745	62.118.67.53	192.168.2.7
Jul 26, 2024 02:27:17.473154068 CEST	49745	445	192.168.2.7	62.118.67.53
Jul 26, 2024 02:27:17.474277020 CEST	49745	445	192.168.2.7	62.118.67.53
Jul 26, 2024 02:27:17.475171089 CEST	49749	139	192.168.2.7	62.118.67.53
Jul 26, 2024 02:27:17.664475918 CEST	49743	139	192.168.2.7	62.118.150.7
Jul 26, 2024 02:27:17.805108070 CEST	49747	139	192.168.2.7	62.118.78.116
Jul 26, 2024 02:27:17.852272034 CEST	49750	445	192.168.2.7	62.118.146.241
Jul 26, 2024 02:27:17.857198954 CEST	445	49750	62.118.146.241	192.168.2.7
Jul 26, 2024 02:27:17.857327938 CEST	49750	445	192.168.2.7	62.118.146.241
Jul 26, 2024 02:27:17.857407093 CEST	49750	445	192.168.2.7	62.118.146.241
Jul 26, 2024 02:27:17.857569933 CEST	49751	139	192.168.2.7	62.118.146.241
Jul 26, 2024 02:27:18.086694956 CEST	49752	445	192.168.2.7	62.118.155.156
Jul 26, 2024 02:27:18.091801882 CEST	445	49752	62.118.155.156	192.168.2.7
Jul 26, 2024 02:27:18.093914986 CEST	49752	445	192.168.2.7	62.118.155.156
Jul 26, 2024 02:27:18.094166994 CEST	49752	445	192.168.2.7	62.118.155.156
Jul 26, 2024 02:27:18.094168901 CEST	49753	139	192.168.2.7	62.118.155.156
Jul 26, 2024 02:27:18.305351019 CEST	49754	445	192.168.2.7	62.118.95.82
Jul 26, 2024 02:27:18.310132027 CEST	445	49754	62.118.95.82	192.168.2.7
Jul 26, 2024 02:27:18.313167095 CEST	49754	445	192.168.2.7	62.118.95.82
Jul 26, 2024 02:27:18.313255072 CEST	49754	445	192.168.2.7	62.118.95.82
Jul 26, 2024 02:27:18.319226027 CEST	445	49754	62.118.95.82	192.168.2.7
Jul 26, 2024 02:27:18.336690903 CEST	49755	445	192.168.2.7	62.118.138.100
Jul 26, 2024 02:27:18.342288971 CEST	445	49755	62.118.138.100	192.168.2.7
Jul 26, 2024 02:27:18.344340086 CEST	49755	445	192.168.2.7	62.118.138.100
Jul 26, 2024 02:27:18.344450951 CEST	49755	445	192.168.2.7	62.118.138.100
Jul 26, 2024 02:27:18.344639063 CEST	49756	139	192.168.2.7	62.118.138.100
Jul 26, 2024 02:27:18.430097103 CEST	49744	139	192.168.2.7	62.118.249.109
Jul 26, 2024 02:27:18.477008104 CEST	49749	139	192.168.2.7	62.118.67.53
Jul 26, 2024 02:27:18.662230015 CEST	445	49748	62.118.143.145	192.168.2.7
Jul 26, 2024 02:27:18.662292004 CEST	49748	445	192.168.2.7	62.118.143.145
Jul 26, 2024 02:27:18.662412882 CEST	49748	445	192.168.2.7	62.118.143.145
Jul 26, 2024 02:27:18.662748098 CEST	49757	139	192.168.2.7	62.118.143.145
Jul 26, 2024 02:27:18.851978064 CEST	49751	139	192.168.2.7	62.118.146.241
Jul 26, 2024 02:27:18.914474964 CEST	49746	139	192.168.2.7	62.118.147.145
Jul 26, 2024 02:27:18.969991922 CEST	49758	139	192.168.2.7	62.118.138.85
Jul 26, 2024 02:27:19.101967096 CEST	49753	139	192.168.2.7	62.118.155.156
Jul 26, 2024 02:27:19.336380005 CEST	49756	139	192.168.2.7	62.118.138.100
Jul 26, 2024 02:27:19.383708954 CEST	49759	445	192.168.2.7	62.118.78.100
Jul 26, 2024 02:27:19.388698101 CEST	445	49759	62.118.78.100	192.168.2.7
Jul 26, 2024 02:27:19.388787985 CEST	49759	445	192.168.2.7	62.118.78.100
Jul 26, 2024 02:27:19.388854980 CEST	49759	445	192.168.2.7	62.118.78.100
Jul 26, 2024 02:27:19.389022112 CEST	49760	139	192.168.2.7	62.118.78.100
Jul 26, 2024 02:27:19.664478064 CEST	49757	139	192.168.2.7	62.118.143.145
Jul 26, 2024 02:27:19.820708036 CEST	49747	139	192.168.2.7	62.118.78.116
Jul 26, 2024 02:27:19.976948023 CEST	49758	139	192.168.2.7	62.118.138.85
Jul 26, 2024 02:27:20.383224010 CEST	49760	139	192.168.2.7	62.118.78.100
Jul 26, 2024 02:27:20.476978064 CEST	49749	139	192.168.2.7	62.118.67.53
Jul 26, 2024 02:27:20.633601904 CEST	49761	445	192.168.2.7	62.118.150.7
Jul 26, 2024 02:27:20.638467073 CEST	445	49761	62.118.150.7	192.168.2.7
Jul 26, 2024 02:27:20.638535976 CEST	49761	445	192.168.2.7	62.118.150.7
Jul 26, 2024 02:27:20.638572931 CEST	49761	445	192.168.2.7	62.118.150.7
Jul 26, 2024 02:27:20.638753891 CEST	49762	139	192.168.2.7	62.118.150.7
Jul 26, 2024 02:27:20.867607117 CEST	49751	139	192.168.2.7	62.118.146.241
Jul 26, 2024 02:27:21.102021933 CEST	49753	139	192.168.2.7	62.118.155.156
Jul 26, 2024 02:27:21.195385933 CEST	49763	139	192.168.2.7	62.118.132.5
Jul 26, 2024 02:27:21.336358070 CEST	49756	139	192.168.2.7	62.118.138.100
Jul 26, 2024 02:27:21.414863110 CEST	49764	445	192.168.2.7	62.118.249.109
Jul 26, 2024 02:27:21.419790030 CEST	445	49764	62.118.249.109	192.168.2.7
Jul 26, 2024 02:27:21.419872999 CEST	49764	445	192.168.2.7	62.118.249.109
Jul 26, 2024 02:27:21.420053959 CEST	49764	445	192.168.2.7	62.118.249.109
Jul 26, 2024 02:27:21.425173044 CEST	445	49764	62.118.249.109	192.168.2.7
Jul 26, 2024 02:27:21.638737917 CEST	49762	139	192.168.2.7	62.118.150.7
Jul 26, 2024 02:27:21.664479017 CEST	49757	139	192.168.2.7	62.118.143.145
Jul 26, 2024 02:27:21.915250063 CEST	49765	445	192.168.2.7	62.118.147.145
Jul 26, 2024 02:27:21.920109987 CEST	445	49765	62.118.147.145	192.168.2.7
Jul 26, 2024 02:27:21.920195103 CEST	49765	445	192.168.2.7	62.118.147.145
Jul 26, 2024 02:27:21.920293093 CEST	49765	445	192.168.2.7	62.118.147.145
Jul 26, 2024 02:27:21.925051928 CEST	445	49765	62.118.147.145	192.168.2.7
Jul 26, 2024 02:27:21.976974010 CEST	49758	139	192.168.2.7	62.118.138.85
Jul 26, 2024 02:27:22.195816994 CEST	49763	139	192.168.2.7	62.118.132.5
Jul 26, 2024 02:27:22.383342028 CEST	49760	139	192.168.2.7	62.118.78.100
Jul 26, 2024 02:27:22.805468082 CEST	49766	445	192.168.2.7	62.118.78.116
Jul 26, 2024 02:27:22.811058044 CEST	445	49766	62.118.78.116	192.168.2.7
Jul 26, 2024 02:27:22.811157942 CEST	49766	445	192.168.2.7	62.118.78.116
Jul 26, 2024 02:27:22.811327934 CEST	49766	445	192.168.2.7	62.118.78.116
Jul 26, 2024 02:27:22.816219091 CEST	445	49766	62.118.78.116	192.168.2.7
Jul 26, 2024 02:27:23.461723089 CEST	49767	445	192.168.2.7	62.118.67.53
Jul 26, 2024 02:27:23.466780901 CEST	445	49767	62.118.67.53	192.168.2.7
Jul 26, 2024 02:27:23.466990948 CEST	49767	445	192.168.2.7	62.118.67.53
Jul 26, 2024 02:27:23.467096090 CEST	49767	445	192.168.2.7	62.118.67.53
Jul 26, 2024 02:27:23.472678900 CEST	445	49767	62.118.67.53	192.168.2.7
Jul 26, 2024 02:27:23.648910046 CEST	49762	139	192.168.2.7	62.118.150.7
Jul 26, 2024 02:27:23.657350063 CEST	445	49765	62.118.147.145	192.168.2.7
Jul 26, 2024 02:27:23.659996033 CEST	49765	445	192.168.2.7	62.118.147.145
Jul 26, 2024 02:27:23.660522938 CEST	49765	445	192.168.2.7	62.118.147.145
Jul 26, 2024 02:27:23.660938978 CEST	49768	139	192.168.2.7	62.118.147.145
Jul 26, 2024 02:27:23.872042894 CEST	49769	445	192.168.2.7	62.118.146.241
Jul 26, 2024 02:27:23.877310038 CEST	445	49769	62.118.146.241	192.168.2.7
Jul 26, 2024 02:27:23.877568007 CEST	49769	445	192.168.2.7	62.118.146.241
Jul 26, 2024 02:27:23.880224943 CEST	49769	445	192.168.2.7	62.118.146.241
Jul 26, 2024 02:27:23.885102987 CEST	445	49769	62.118.146.241	192.168.2.7
Jul 26, 2024 02:27:24.102441072 CEST	49770	445	192.168.2.7	62.118.155.156
Jul 26, 2024 02:27:24.108572960 CEST	445	49770	62.118.155.156	192.168.2.7
Jul 26, 2024 02:27:24.108714104 CEST	49770	445	192.168.2.7	62.118.155.156
Jul 26, 2024 02:27:24.108787060 CEST	49770	445	192.168.2.7	62.118.155.156
Jul 26, 2024 02:27:24.114109993 CEST	445	49770	62.118.155.156	192.168.2.7
Jul 26, 2024 02:27:24.211401939 CEST	49763	139	192.168.2.7	62.118.132.5
Jul 26, 2024 02:27:24.320909977 CEST	49754	445	192.168.2.7	62.118.95.82
Jul 26, 2024 02:27:24.321286917 CEST	49771	139	192.168.2.7	62.118.95.82
Jul 26, 2024 02:27:24.352389097 CEST	49772	445	192.168.2.7	62.118.138.100
Jul 26, 2024 02:27:24.357268095 CEST	445	49772	62.118.138.100	192.168.2.7
Jul 26, 2024 02:27:24.357336044 CEST	49772	445	192.168.2.7	62.118.138.100
Jul 26, 2024 02:27:24.357402086 CEST	49772	445	192.168.2.7	62.118.138.100
Jul 26, 2024 02:27:24.362310886 CEST	445	49772	62.118.138.100	192.168.2.7
Jul 26, 2024 02:27:24.648938894 CEST	49768	139	192.168.2.7	62.118.147.145
Jul 26, 2024 02:27:24.649398088 CEST	50883	445	192.168.2.7	62.118.143.145
Jul 26, 2024 02:27:24.654524088 CEST	445	50883	62.118.143.145	192.168.2.7
Jul 26, 2024 02:27:24.654611111 CEST	50883	445	192.168.2.7	62.118.143.145
Jul 26, 2024 02:27:24.654736042 CEST	50883	445	192.168.2.7	62.118.143.145
Jul 26, 2024 02:27:24.659593105 CEST	445	50883	62.118.143.145	192.168.2.7
Jul 26, 2024 02:27:24.759273052 CEST	50884	139	192.168.2.7	62.118.253.30
Jul 26, 2024 02:27:24.977289915 CEST	50885	445	192.168.2.7	62.118.138.85
Jul 26, 2024 02:27:24.982161045 CEST	445	50885	62.118.138.85	192.168.2.7
Jul 26, 2024 02:27:24.982254982 CEST	50885	445	192.168.2.7	62.118.138.85
Jul 26, 2024 02:27:24.982286930 CEST	50885	445	192.168.2.7	62.118.138.85
Jul 26, 2024 02:27:24.982415915 CEST	50886	139	192.168.2.7	62.118.138.85
Jul 26, 2024 02:27:25.202892065 CEST	445	49767	62.118.67.53	192.168.2.7
Jul 26, 2024 02:27:25.203018904 CEST	49767	445	192.168.2.7	62.118.67.53
Jul 26, 2024 02:27:25.203075886 CEST	49767	445	192.168.2.7	62.118.67.53
Jul 26, 2024 02:27:25.203418970 CEST	50888	139	192.168.2.7	62.118.67.53
Jul 26, 2024 02:27:25.321883917 CEST	49771	139	192.168.2.7	62.118.95.82
Jul 26, 2024 02:27:25.399100065 CEST	50889	445	192.168.2.7	62.118.78.100
Jul 26, 2024 02:27:25.404114008 CEST	445	50889	62.118.78.100	192.168.2.7
Jul 26, 2024 02:27:25.404169083 CEST	50889	445	192.168.2.7	62.118.78.100
Jul 26, 2024 02:27:25.404268980 CEST	50889	445	192.168.2.7	62.118.78.100
Jul 26, 2024 02:27:25.409182072 CEST	445	50889	62.118.78.100	192.168.2.7
Jul 26, 2024 02:27:25.640228987 CEST	445	49769	62.118.146.241	192.168.2.7
Jul 26, 2024 02:27:25.640295982 CEST	49769	445	192.168.2.7	62.118.146.241
Jul 26, 2024 02:27:25.640377998 CEST	49769	445	192.168.2.7	62.118.146.241
Jul 26, 2024 02:27:25.640602112 CEST	50890	139	192.168.2.7	62.118.146.241
Jul 26, 2024 02:27:25.773875952 CEST	50884	139	192.168.2.7	62.118.253.30
Jul 26, 2024 02:27:25.992703915 CEST	50886	139	192.168.2.7	62.118.138.85
Jul 26, 2024 02:27:26.056978941 CEST	50892	139	192.168.2.7	62.118.165.34
Jul 26, 2024 02:27:26.211509943 CEST	50888	139	192.168.2.7	62.118.67.53
Jul 26, 2024 02:27:26.389857054 CEST	445	50883	62.118.143.145	192.168.2.7
Jul 26, 2024 02:27:26.389940023 CEST	50883	445	192.168.2.7	62.118.143.145
Jul 26, 2024 02:27:26.390095949 CEST	50883	445	192.168.2.7	62.118.143.145
Jul 26, 2024 02:27:26.390511036 CEST	50893	139	192.168.2.7	62.118.143.145
Jul 26, 2024 02:27:26.648869991 CEST	50890	139	192.168.2.7	62.118.146.241
Jul 26, 2024 02:27:26.648978949 CEST	49768	139	192.168.2.7	62.118.147.145
Jul 26, 2024 02:27:26.649441957 CEST	50894	445	192.168.2.7	62.118.150.7
Jul 26, 2024 02:27:26.654309034 CEST	445	50894	62.118.150.7	192.168.2.7
Jul 26, 2024 02:27:26.654570103 CEST	50894	445	192.168.2.7	62.118.150.7
Jul 26, 2024 02:27:26.654778957 CEST	50894	445	192.168.2.7	62.118.150.7
Jul 26, 2024 02:27:26.659605980 CEST	445	50894	62.118.150.7	192.168.2.7
Jul 26, 2024 02:27:26.781085014 CEST	50895	139	192.168.2.7	62.118.132.3
Jul 26, 2024 02:27:27.070827007 CEST	50892	139	192.168.2.7	62.118.165.34
Jul 26, 2024 02:27:27.196072102 CEST	50896	445	192.168.2.7	62.118.132.5
Jul 26, 2024 02:27:27.200932026 CEST	445	50896	62.118.132.5	192.168.2.7
Jul 26, 2024 02:27:27.201008081 CEST	50896	445	192.168.2.7	62.118.132.5
Jul 26, 2024 02:27:27.201061010 CEST	50896	445	192.168.2.7	62.118.132.5
Jul 26, 2024 02:27:27.201298952 CEST	50897	139	192.168.2.7	62.118.132.5
Jul 26, 2024 02:27:27.336365938 CEST	49771	139	192.168.2.7	62.118.95.82
Jul 26, 2024 02:27:27.383276939 CEST	50893	139	192.168.2.7	62.118.143.145
Jul 26, 2024 02:27:27.430239916 CEST	49764	445	192.168.2.7	62.118.249.109
Jul 26, 2024 02:27:27.434329987 CEST	50898	139	192.168.2.7	62.118.249.109
Jul 26, 2024 02:27:27.789514065 CEST	50884	139	192.168.2.7	62.118.253.30
Jul 26, 2024 02:27:27.789540052 CEST	50895	139	192.168.2.7	62.118.132.3
Jul 26, 2024 02:27:28.008351088 CEST	50886	139	192.168.2.7	62.118.138.85
Jul 26, 2024 02:27:28.211503983 CEST	50888	139	192.168.2.7	62.118.67.53
Jul 26, 2024 02:27:28.213891029 CEST	50897	139	192.168.2.7	62.118.132.5
Jul 26, 2024 02:27:28.445780039 CEST	50898	139	192.168.2.7	62.118.249.109
Jul 26, 2024 02:27:28.664520979 CEST	50890	139	192.168.2.7	62.118.146.241
Jul 26, 2024 02:27:28.820878029 CEST	49766	445	192.168.2.7	62.118.78.116
Jul 26, 2024 02:27:28.823962927 CEST	50900	139	192.168.2.7	62.118.78.116
Jul 26, 2024 02:27:29.070751905 CEST	50892	139	192.168.2.7	62.118.165.34
Jul 26, 2024 02:27:29.383265972 CEST	50893	139	192.168.2.7	62.118.143.145
Jul 26, 2024 02:27:29.489777088 CEST	50902	139	192.168.2.7	62.118.253.46
Jul 26, 2024 02:27:29.665076017 CEST	50903	445	192.168.2.7	62.118.147.145
Jul 26, 2024 02:27:29.669954062 CEST	445	50903	62.118.147.145	192.168.2.7
Jul 26, 2024 02:27:29.670042038 CEST	50903	445	192.168.2.7	62.118.147.145
Jul 26, 2024 02:27:29.670145988 CEST	50903	445	192.168.2.7	62.118.147.145
Jul 26, 2024 02:27:29.675003052 CEST	445	50903	62.118.147.145	192.168.2.7
Jul 26, 2024 02:27:29.789532900 CEST	50895	139	192.168.2.7	62.118.132.3
Jul 26, 2024 02:27:29.798846960 CEST	50904	139	192.168.2.7	62.118.78.113
Jul 26, 2024 02:27:29.821228027 CEST	50900	139	192.168.2.7	62.118.78.116
Jul 26, 2024 02:27:30.102042913 CEST	49770	445	192.168.2.7	62.118.155.156
Jul 26, 2024 02:27:30.102309942 CEST	50905	139	192.168.2.7	62.118.155.156
Jul 26, 2024 02:27:30.211575985 CEST	50897	139	192.168.2.7	62.118.132.5
Jul 26, 2024 02:27:30.321171999 CEST	50906	445	192.168.2.7	62.118.95.82
Jul 26, 2024 02:27:30.326168060 CEST	445	50906	62.118.95.82	192.168.2.7
Jul 26, 2024 02:27:30.326345921 CEST	50906	445	192.168.2.7	62.118.95.82
Jul 26, 2024 02:27:30.326345921 CEST	50906	445	192.168.2.7	62.118.95.82
Jul 26, 2024 02:27:30.331377029 CEST	445	50906	62.118.95.82	192.168.2.7
Jul 26, 2024 02:27:30.352073908 CEST	49772	445	192.168.2.7	62.118.138.100
Jul 26, 2024 02:27:30.352310896 CEST	50907	139	192.168.2.7	62.118.138.100
Jul 26, 2024 02:27:30.445771933 CEST	50898	139	192.168.2.7	62.118.249.109
Jul 26, 2024 02:27:30.477035046 CEST	50902	139	192.168.2.7	62.118.253.46
Jul 26, 2024 02:27:30.774286985 CEST	50908	445	192.168.2.7	62.118.253.30
Jul 26, 2024 02:27:30.779205084 CEST	445	50908	62.118.253.30	192.168.2.7
Jul 26, 2024 02:27:30.779320955 CEST	50908	445	192.168.2.7	62.118.253.30
Jul 26, 2024 02:27:30.779413939 CEST	50908	445	192.168.2.7	62.118.253.30
Jul 26, 2024 02:27:30.779530048 CEST	50909	139	192.168.2.7	62.118.253.30
Jul 26, 2024 02:27:30.805267096 CEST	50904	139	192.168.2.7	62.118.78.113
Jul 26, 2024 02:27:30.993443012 CEST	50910	445	192.168.2.7	62.118.138.85
Jul 26, 2024 02:27:30.998317957 CEST	445	50910	62.118.138.85	192.168.2.7
Jul 26, 2024 02:27:31.000138044 CEST	50910	445	192.168.2.7	62.118.138.85
Jul 26, 2024 02:27:31.000138044 CEST	50910	445	192.168.2.7	62.118.138.85
Jul 26, 2024 02:27:31.005014896 CEST	445	50910	62.118.138.85	192.168.2.7
Jul 26, 2024 02:27:31.102051020 CEST	50905	139	192.168.2.7	62.118.155.156
Jul 26, 2024 02:27:31.196257114 CEST	50911	445	192.168.2.7	62.118.67.53
Jul 26, 2024 02:27:31.201477051 CEST	445	50911	62.118.67.53	192.168.2.7
Jul 26, 2024 02:27:31.201673031 CEST	50911	445	192.168.2.7	62.118.67.53
Jul 26, 2024 02:27:31.201673031 CEST	50911	445	192.168.2.7	62.118.67.53
Jul 26, 2024 02:27:31.207011938 CEST	445	50911	62.118.67.53	192.168.2.7
Jul 26, 2024 02:27:31.352015972 CEST	50907	139	192.168.2.7	62.118.138.100
Jul 26, 2024 02:27:31.414702892 CEST	50889	445	192.168.2.7	62.118.78.100
Jul 26, 2024 02:27:31.415146112 CEST	50912	139	192.168.2.7	62.118.78.100
Jul 26, 2024 02:27:31.423954964 CEST	445	50903	62.118.147.145	192.168.2.7
Jul 26, 2024 02:27:31.424067974 CEST	50903	445	192.168.2.7	62.118.147.145
Jul 26, 2024 02:27:31.424292088 CEST	50903	445	192.168.2.7	62.118.147.145
Jul 26, 2024 02:27:31.424623013 CEST	50913	139	192.168.2.7	62.118.147.145
Jul 26, 2024 02:27:31.633903980 CEST	50914	445	192.168.2.7	62.118.146.241
Jul 26, 2024 02:27:31.639178991 CEST	445	50914	62.118.146.241	192.168.2.7
Jul 26, 2024 02:27:31.640726089 CEST	50914	445	192.168.2.7	62.118.146.241
Jul 26, 2024 02:27:31.640726089 CEST	50914	445	192.168.2.7	62.118.146.241
Jul 26, 2024 02:27:31.646050930 CEST	445	50914	62.118.146.241	192.168.2.7
Jul 26, 2024 02:27:31.789542913 CEST	50909	139	192.168.2.7	62.118.253.30
Jul 26, 2024 02:27:31.836412907 CEST	50900	139	192.168.2.7	62.118.78.116
Jul 26, 2024 02:27:32.071053028 CEST	50915	445	192.168.2.7	62.118.165.34
Jul 26, 2024 02:27:32.076077938 CEST	445	50915	62.118.165.34	192.168.2.7
Jul 26, 2024 02:27:32.076188087 CEST	50915	445	192.168.2.7	62.118.165.34
Jul 26, 2024 02:27:32.076225042 CEST	50915	445	192.168.2.7	62.118.165.34
Jul 26, 2024 02:27:32.076452971 CEST	50916	139	192.168.2.7	62.118.165.34
Jul 26, 2024 02:27:32.383670092 CEST	50917	445	192.168.2.7	62.118.143.145
Jul 26, 2024 02:27:32.388581038 CEST	445	50917	62.118.143.145	192.168.2.7
Jul 26, 2024 02:27:32.388652086 CEST	50917	445	192.168.2.7	62.118.143.145
Jul 26, 2024 02:27:32.388757944 CEST	50917	445	192.168.2.7	62.118.143.145
Jul 26, 2024 02:27:32.393548965 CEST	445	50917	62.118.143.145	192.168.2.7
Jul 26, 2024 02:27:32.414541006 CEST	50913	139	192.168.2.7	62.118.147.145
Jul 26, 2024 02:27:32.427777052 CEST	50912	139	192.168.2.7	62.118.78.100
Jul 26, 2024 02:27:32.477078915 CEST	50902	139	192.168.2.7	62.118.253.46
Jul 26, 2024 02:27:32.664809942 CEST	50894	445	192.168.2.7	62.118.150.7
Jul 26, 2024 02:27:32.665121078 CEST	50918	139	192.168.2.7	62.118.150.7
Jul 26, 2024 02:27:32.774432898 CEST	50919	445	192.168.2.7	62.118.132.3
Jul 26, 2024 02:27:32.779378891 CEST	445	50919	62.118.132.3	192.168.2.7
Jul 26, 2024 02:27:32.779495955 CEST	50919	445	192.168.2.7	62.118.132.3
Jul 26, 2024 02:27:32.779618979 CEST	50919	445	192.168.2.7	62.118.132.3
Jul 26, 2024 02:27:32.779869080 CEST	50920	139	192.168.2.7	62.118.132.3
Jul 26, 2024 02:27:32.805188894 CEST	50904	139	192.168.2.7	62.118.78.113
Jul 26, 2024 02:27:32.935081005 CEST	445	50911	62.118.67.53	192.168.2.7
Jul 26, 2024 02:27:32.935146093 CEST	50911	445	192.168.2.7	62.118.67.53
Jul 26, 2024 02:27:32.935261965 CEST	50911	445	192.168.2.7	62.118.67.53
Jul 26, 2024 02:27:32.935651064 CEST	50921	139	192.168.2.7	62.118.67.53
Jul 26, 2024 02:27:33.086429119 CEST	50916	139	192.168.2.7	62.118.165.34
Jul 26, 2024 02:27:33.102086067 CEST	50905	139	192.168.2.7	62.118.155.156
Jul 26, 2024 02:27:33.211692095 CEST	50922	445	192.168.2.7	62.118.132.5
Jul 26, 2024 02:27:33.216564894 CEST	445	50922	62.118.132.5	192.168.2.7
Jul 26, 2024 02:27:33.216639996 CEST	50922	445	192.168.2.7	62.118.132.5
Jul 26, 2024 02:27:33.216706991 CEST	50922	445	192.168.2.7	62.118.132.5
Jul 26, 2024 02:27:33.221607924 CEST	445	50922	62.118.132.5	192.168.2.7
Jul 26, 2024 02:27:33.352036953 CEST	50907	139	192.168.2.7	62.118.138.100
Jul 26, 2024 02:27:33.438592911 CEST	445	50914	62.118.146.241	192.168.2.7
Jul 26, 2024 02:27:33.438859940 CEST	50914	445	192.168.2.7	62.118.146.241
Jul 26, 2024 02:27:33.438859940 CEST	50914	445	192.168.2.7	62.118.146.241
Jul 26, 2024 02:27:33.439479113 CEST	50923	139	192.168.2.7	62.118.146.241
Jul 26, 2024 02:27:33.446181059 CEST	50924	445	192.168.2.7	62.118.249.109
Jul 26, 2024 02:27:33.451062918 CEST	445	50924	62.118.249.109	192.168.2.7
Jul 26, 2024 02:27:33.451148987 CEST	50924	445	192.168.2.7	62.118.249.109
Jul 26, 2024 02:27:33.451261997 CEST	50924	445	192.168.2.7	62.118.249.109
Jul 26, 2024 02:27:33.456079006 CEST	445	50924	62.118.249.109	192.168.2.7
Jul 26, 2024 02:27:33.664588928 CEST	50918	139	192.168.2.7	62.118.150.7
Jul 26, 2024 02:27:33.789546967 CEST	50909	139	192.168.2.7	62.118.253.30
Jul 26, 2024 02:27:33.789556980 CEST	50920	139	192.168.2.7	62.118.132.3
Jul 26, 2024 02:27:33.945965052 CEST	50921	139	192.168.2.7	62.118.67.53
Jul 26, 2024 02:27:34.414556980 CEST	50913	139	192.168.2.7	62.118.147.145
Jul 26, 2024 02:27:34.430176020 CEST	50912	139	192.168.2.7	62.118.78.100
Jul 26, 2024 02:27:34.435364962 CEST	50925	139	192.168.2.7	62.118.150.40
Jul 26, 2024 02:27:34.445795059 CEST	50923	139	192.168.2.7	62.118.146.241
Jul 26, 2024 02:27:34.821305037 CEST	50926	445	192.168.2.7	62.118.78.116
Jul 26, 2024 02:27:34.826323032 CEST	445	50926	62.118.78.116	192.168.2.7
Jul 26, 2024 02:27:34.826442003 CEST	50926	445	192.168.2.7	62.118.78.116
Jul 26, 2024 02:27:34.826534986 CEST	50926	445	192.168.2.7	62.118.78.116
Jul 26, 2024 02:27:34.831370115 CEST	445	50926	62.118.78.116	192.168.2.7
Jul 26, 2024 02:27:35.086431026 CEST	50916	139	192.168.2.7	62.118.165.34
Jul 26, 2024 02:27:35.445801020 CEST	50925	139	192.168.2.7	62.118.150.40
Jul 26, 2024 02:27:35.493096113 CEST	50927	445	192.168.2.7	62.118.253.46
Jul 26, 2024 02:27:35.497944117 CEST	445	50927	62.118.253.46	192.168.2.7
Jul 26, 2024 02:27:35.497998953 CEST	50927	445	192.168.2.7	62.118.253.46
Jul 26, 2024 02:27:35.498059034 CEST	50927	445	192.168.2.7	62.118.253.46
Jul 26, 2024 02:27:35.498212099 CEST	50928	139	192.168.2.7	62.118.253.46
Jul 26, 2024 02:27:35.680243015 CEST	50918	139	192.168.2.7	62.118.150.7
Jul 26, 2024 02:27:35.789681911 CEST	50920	139	192.168.2.7	62.118.132.3
Jul 26, 2024 02:27:35.789899111 CEST	50929	445	192.168.2.7	62.118.78.113
Jul 26, 2024 02:27:35.794893026 CEST	445	50929	62.118.78.113	192.168.2.7
Jul 26, 2024 02:27:35.794994116 CEST	50929	445	192.168.2.7	62.118.78.113
Jul 26, 2024 02:27:35.795166969 CEST	50930	139	192.168.2.7	62.118.78.113
Jul 26, 2024 02:27:35.795171022 CEST	50929	445	192.168.2.7	62.118.78.113
Jul 26, 2024 02:27:35.961456060 CEST	50921	139	192.168.2.7	62.118.67.53
Jul 26, 2024 02:27:36.117893934 CEST	50931	445	192.168.2.7	62.118.155.156
Jul 26, 2024 02:27:36.122807026 CEST	445	50931	62.118.155.156	192.168.2.7
Jul 26, 2024 02:27:36.122884989 CEST	50931	445	192.168.2.7	62.118.155.156
Jul 26, 2024 02:27:36.122941017 CEST	50931	445	192.168.2.7	62.118.155.156
Jul 26, 2024 02:27:36.127737999 CEST	445	50931	62.118.155.156	192.168.2.7
Jul 26, 2024 02:27:36.337083101 CEST	50906	445	192.168.2.7	62.118.95.82
Jul 26, 2024 02:27:36.337240934 CEST	50932	139	192.168.2.7	62.118.95.82
Jul 26, 2024 02:27:36.368388891 CEST	50933	445	192.168.2.7	62.118.138.100
Jul 26, 2024 02:27:36.373457909 CEST	445	50933	62.118.138.100	192.168.2.7
Jul 26, 2024 02:27:36.373555899 CEST	50933	445	192.168.2.7	62.118.138.100
Jul 26, 2024 02:27:36.378499031 CEST	50933	445	192.168.2.7	62.118.138.100
Jul 26, 2024 02:27:36.383477926 CEST	445	50933	62.118.138.100	192.168.2.7
Jul 26, 2024 02:27:36.461442947 CEST	50923	139	192.168.2.7	62.118.146.241
Jul 26, 2024 02:27:36.508301020 CEST	50928	139	192.168.2.7	62.118.253.46
Jul 26, 2024 02:27:36.774359941 CEST	50934	445	192.168.2.7	62.118.253.30
Jul 26, 2024 02:27:36.779362917 CEST	445	50934	62.118.253.30	192.168.2.7
Jul 26, 2024 02:27:36.779478073 CEST	50934	445	192.168.2.7	62.118.253.30
Jul 26, 2024 02:27:36.779562950 CEST	50934	445	192.168.2.7	62.118.253.30
Jul 26, 2024 02:27:36.784326077 CEST	445	50934	62.118.253.30	192.168.2.7
Jul 26, 2024 02:27:36.805207968 CEST	50930	139	192.168.2.7	62.118.78.113
Jul 26, 2024 02:27:37.008407116 CEST	50910	445	192.168.2.7	62.118.138.85
Jul 26, 2024 02:27:37.008688927 CEST	50935	139	192.168.2.7	62.118.138.85
Jul 26, 2024 02:27:37.336456060 CEST	50932	139	192.168.2.7	62.118.95.82
Jul 26, 2024 02:27:37.421217918 CEST	50936	445	192.168.2.7	62.118.147.145
Jul 26, 2024 02:27:37.421403885 CEST	50937	445	192.168.2.7	62.118.78.100
Jul 26, 2024 02:27:37.426208019 CEST	445	50936	62.118.147.145	192.168.2.7
Jul 26, 2024 02:27:37.426239014 CEST	445	50937	62.118.78.100	192.168.2.7
Jul 26, 2024 02:27:37.426278114 CEST	50936	445	192.168.2.7	62.118.147.145
Jul 26, 2024 02:27:37.426301956 CEST	50937	445	192.168.2.7	62.118.78.100
Jul 26, 2024 02:27:37.430049896 CEST	50936	445	192.168.2.7	62.118.147.145
Jul 26, 2024 02:27:37.430121899 CEST	50937	445	192.168.2.7	62.118.78.100
Jul 26, 2024 02:27:37.434995890 CEST	445	50936	62.118.147.145	192.168.2.7
Jul 26, 2024 02:27:37.435019016 CEST	445	50937	62.118.78.100	192.168.2.7
Jul 26, 2024 02:27:37.461452961 CEST	50925	139	192.168.2.7	62.118.150.40
Jul 26, 2024 02:27:37.564611912 CEST	50938	139	192.168.2.7	62.118.136.167
Jul 26, 2024 02:27:38.023927927 CEST	50935	139	192.168.2.7	62.118.138.85
Jul 26, 2024 02:27:38.071060896 CEST	50939	445	192.168.2.7	62.118.165.34
Jul 26, 2024 02:27:38.076035976 CEST	445	50939	62.118.165.34	192.168.2.7
Jul 26, 2024 02:27:38.076175928 CEST	50939	445	192.168.2.7	62.118.165.34
Jul 26, 2024 02:27:38.076231956 CEST	50939	445	192.168.2.7	62.118.165.34
Jul 26, 2024 02:27:38.081151009 CEST	445	50939	62.118.165.34	192.168.2.7
Jul 26, 2024 02:27:38.399086952 CEST	50917	445	192.168.2.7	62.118.143.145
Jul 26, 2024 02:27:38.402393103 CEST	50940	139	192.168.2.7	62.118.143.145
Jul 26, 2024 02:27:38.523984909 CEST	50928	139	192.168.2.7	62.118.253.46
Jul 26, 2024 02:27:38.565844059 CEST	50938	139	192.168.2.7	62.118.136.167
Jul 26, 2024 02:27:38.664920092 CEST	50941	445	192.168.2.7	62.118.150.7
Jul 26, 2024 02:27:38.669826984 CEST	445	50941	62.118.150.7	192.168.2.7
Jul 26, 2024 02:27:38.669943094 CEST	50941	445	192.168.2.7	62.118.150.7
Jul 26, 2024 02:27:38.669996023 CEST	50941	445	192.168.2.7	62.118.150.7
Jul 26, 2024 02:27:38.675851107 CEST	445	50941	62.118.150.7	192.168.2.7
Jul 26, 2024 02:27:38.790169954 CEST	50942	445	192.168.2.7	62.118.132.3
Jul 26, 2024 02:27:38.795192003 CEST	445	50942	62.118.132.3	192.168.2.7
Jul 26, 2024 02:27:38.798049927 CEST	50942	445	192.168.2.7	62.118.132.3
Jul 26, 2024 02:27:38.801883936 CEST	50942	445	192.168.2.7	62.118.132.3
Jul 26, 2024 02:27:38.805214882 CEST	50930	139	192.168.2.7	62.118.78.113
Jul 26, 2024 02:27:38.807796955 CEST	445	50942	62.118.132.3	192.168.2.7
Jul 26, 2024 02:27:38.930711985 CEST	50943	445	192.168.2.7	62.118.67.53
Jul 26, 2024 02:27:38.935647964 CEST	445	50943	62.118.67.53	192.168.2.7
Jul 26, 2024 02:27:38.938033104 CEST	50943	445	192.168.2.7	62.118.67.53
Jul 26, 2024 02:27:38.938699007 CEST	50943	445	192.168.2.7	62.118.67.53
Jul 26, 2024 02:27:38.944730043 CEST	445	50943	62.118.67.53	192.168.2.7
Jul 26, 2024 02:27:39.173561096 CEST	445	50936	62.118.147.145	192.168.2.7
Jul 26, 2024 02:27:39.173634052 CEST	50936	445	192.168.2.7	62.118.147.145
Jul 26, 2024 02:27:39.173700094 CEST	50936	445	192.168.2.7	62.118.147.145
Jul 26, 2024 02:27:39.174015999 CEST	50944	139	192.168.2.7	62.118.147.145
Jul 26, 2024 02:27:39.227099895 CEST	50922	445	192.168.2.7	62.118.132.5
Jul 26, 2024 02:27:39.227348089 CEST	50945	139	192.168.2.7	62.118.132.5
Jul 26, 2024 02:27:39.336474895 CEST	50932	139	192.168.2.7	62.118.95.82
Jul 26, 2024 02:27:39.414557934 CEST	50940	139	192.168.2.7	62.118.143.145
Jul 26, 2024 02:27:39.430727005 CEST	50946	445	192.168.2.7	62.118.146.241
Jul 26, 2024 02:27:39.435636997 CEST	445	50946	62.118.146.241	192.168.2.7
Jul 26, 2024 02:27:39.435703993 CEST	50946	445	192.168.2.7	62.118.146.241
Jul 26, 2024 02:27:39.435791969 CEST	50946	445	192.168.2.7	62.118.146.241
Jul 26, 2024 02:27:39.445247889 CEST	445	50946	62.118.146.241	192.168.2.7
Jul 26, 2024 02:27:39.445919991 CEST	50924	445	192.168.2.7	62.118.249.109
Jul 26, 2024 02:27:39.448441029 CEST	50947	139	192.168.2.7	62.118.249.109
Jul 26, 2024 02:27:39.867398977 CEST	445	50939	62.118.165.34	192.168.2.7
Jul 26, 2024 02:27:39.867506981 CEST	50939	445	192.168.2.7	62.118.165.34
Jul 26, 2024 02:27:39.867654085 CEST	50939	445	192.168.2.7	62.118.165.34
Jul 26, 2024 02:27:39.867954969 CEST	50948	139	192.168.2.7	62.118.165.34
Jul 26, 2024 02:27:40.039597034 CEST	50935	139	192.168.2.7	62.118.138.85
Jul 26, 2024 02:27:40.164625883 CEST	50944	139	192.168.2.7	62.118.147.145
Jul 26, 2024 02:27:40.219280958 CEST	50949	139	192.168.2.7	62.118.153.81
Jul 26, 2024 02:27:40.242711067 CEST	50945	139	192.168.2.7	62.118.132.5
Jul 26, 2024 02:27:40.446665049 CEST	50950	445	192.168.2.7	62.118.150.40
Jul 26, 2024 02:27:40.451787949 CEST	445	50950	62.118.150.40	192.168.2.7
Jul 26, 2024 02:27:40.451862097 CEST	50950	445	192.168.2.7	62.118.150.40
Jul 26, 2024 02:27:40.451920986 CEST	50950	445	192.168.2.7	62.118.150.40
Jul 26, 2024 02:27:40.452220917 CEST	50951	139	192.168.2.7	62.118.150.40
Jul 26, 2024 02:27:40.461461067 CEST	50947	139	192.168.2.7	62.118.249.109
Jul 26, 2024 02:27:40.570848942 CEST	50938	139	192.168.2.7	62.118.136.167
Jul 26, 2024 02:27:40.686980963 CEST	445	50943	62.118.67.53	192.168.2.7
Jul 26, 2024 02:27:40.687129974 CEST	50943	445	192.168.2.7	62.118.67.53
Jul 26, 2024 02:27:40.687362909 CEST	50943	445	192.168.2.7	62.118.67.53
Jul 26, 2024 02:27:40.687628984 CEST	50952	139	192.168.2.7	62.118.67.53
Jul 26, 2024 02:27:40.836874962 CEST	50926	445	192.168.2.7	62.118.78.116
Jul 26, 2024 02:27:40.839186907 CEST	50953	139	192.168.2.7	62.118.78.116
Jul 26, 2024 02:27:40.868386984 CEST	50948	139	192.168.2.7	62.118.165.34
Jul 26, 2024 02:27:41.170686960 CEST	445	50946	62.118.146.241	192.168.2.7
Jul 26, 2024 02:27:41.170823097 CEST	50946	445	192.168.2.7	62.118.146.241
Jul 26, 2024 02:27:41.170874119 CEST	50946	445	192.168.2.7	62.118.146.241
Jul 26, 2024 02:27:41.171106100 CEST	50954	139	192.168.2.7	62.118.146.241
Jul 26, 2024 02:27:41.211522102 CEST	50949	139	192.168.2.7	62.118.153.81
Jul 26, 2024 02:27:41.414587021 CEST	50940	139	192.168.2.7	62.118.143.145
Jul 26, 2024 02:27:41.461467028 CEST	50951	139	192.168.2.7	62.118.150.40
Jul 26, 2024 02:27:41.509071112 CEST	50955	445	192.168.2.7	62.118.253.46
Jul 26, 2024 02:27:41.514190912 CEST	445	50955	62.118.253.46	192.168.2.7
Jul 26, 2024 02:27:41.514271021 CEST	50955	445	192.168.2.7	62.118.253.46
Jul 26, 2024 02:27:41.514446974 CEST	50955	445	192.168.2.7	62.118.253.46
Jul 26, 2024 02:27:41.519345999 CEST	445	50955	62.118.253.46	192.168.2.7
Jul 26, 2024 02:27:41.680248022 CEST	50952	139	192.168.2.7	62.118.67.53
Jul 26, 2024 02:27:41.805499077 CEST	50956	445	192.168.2.7	62.118.78.113
Jul 26, 2024 02:27:41.810503006 CEST	445	50956	62.118.78.113	192.168.2.7
Jul 26, 2024 02:27:41.810615063 CEST	50956	445	192.168.2.7	62.118.78.113
Jul 26, 2024 02:27:41.810682058 CEST	50956	445	192.168.2.7	62.118.78.113
Jul 26, 2024 02:27:41.815479994 CEST	445	50956	62.118.78.113	192.168.2.7
Jul 26, 2024 02:27:41.852130890 CEST	50953	139	192.168.2.7	62.118.78.116
Jul 26, 2024 02:27:42.117763042 CEST	50931	445	192.168.2.7	62.118.155.156
Jul 26, 2024 02:27:42.118021011 CEST	50957	139	192.168.2.7	62.118.155.156
Jul 26, 2024 02:27:42.180262089 CEST	50944	139	192.168.2.7	62.118.147.145
Jul 26, 2024 02:27:42.180260897 CEST	50954	139	192.168.2.7	62.118.146.241
Jul 26, 2024 02:27:42.242779016 CEST	50945	139	192.168.2.7	62.118.132.5
Jul 26, 2024 02:27:42.336905956 CEST	50958	445	192.168.2.7	62.118.95.82
Jul 26, 2024 02:27:42.341893911 CEST	445	50958	62.118.95.82	192.168.2.7
Jul 26, 2024 02:27:42.341989994 CEST	50958	445	192.168.2.7	62.118.95.82
Jul 26, 2024 02:27:42.342063904 CEST	50958	445	192.168.2.7	62.118.95.82
Jul 26, 2024 02:27:42.349111080 CEST	445	50958	62.118.95.82	192.168.2.7
Jul 26, 2024 02:27:42.367760897 CEST	50933	445	192.168.2.7	62.118.138.100
Jul 26, 2024 02:27:42.367980003 CEST	50959	139	192.168.2.7	62.118.138.100
Jul 26, 2024 02:27:42.370387077 CEST	50960	139	192.168.2.7	62.118.253.29
Jul 26, 2024 02:27:42.461482048 CEST	50947	139	192.168.2.7	62.118.249.109
Jul 26, 2024 02:27:42.616470098 CEST	50961	139	192.168.2.7	62.118.78.103
Jul 26, 2024 02:27:42.774432898 CEST	50934	445	192.168.2.7	62.118.253.30
Jul 26, 2024 02:27:42.774602890 CEST	50962	139	192.168.2.7	62.118.253.30
Jul 26, 2024 02:27:42.867824078 CEST	50948	139	192.168.2.7	62.118.165.34
Jul 26, 2024 02:27:43.008806944 CEST	50963	445	192.168.2.7	62.118.138.85
Jul 26, 2024 02:27:43.018208981 CEST	445	50963	62.118.138.85	192.168.2.7
Jul 26, 2024 02:27:43.018443108 CEST	50963	445	192.168.2.7	62.118.138.85
Jul 26, 2024 02:27:43.018634081 CEST	50963	445	192.168.2.7	62.118.138.85
Jul 26, 2024 02:27:43.023592949 CEST	445	50963	62.118.138.85	192.168.2.7
Jul 26, 2024 02:27:43.133399010 CEST	50957	139	192.168.2.7	62.118.155.156
Jul 26, 2024 02:27:43.211666107 CEST	50949	139	192.168.2.7	62.118.153.81
Jul 26, 2024 02:27:43.368408918 CEST	50959	139	192.168.2.7	62.118.138.100
Jul 26, 2024 02:27:43.368408918 CEST	50960	139	192.168.2.7	62.118.253.29
Jul 26, 2024 02:27:43.430313110 CEST	50937	445	192.168.2.7	62.118.78.100
Jul 26, 2024 02:27:43.430744886 CEST	50964	139	192.168.2.7	62.118.78.100
Jul 26, 2024 02:27:43.461493015 CEST	50951	139	192.168.2.7	62.118.150.40
Jul 26, 2024 02:27:43.555813074 CEST	50965	445	192.168.2.7	62.118.136.167
Jul 26, 2024 02:27:43.560900927 CEST	445	50965	62.118.136.167	192.168.2.7
Jul 26, 2024 02:27:43.560992956 CEST	50965	445	192.168.2.7	62.118.136.167
Jul 26, 2024 02:27:43.561093092 CEST	50965	445	192.168.2.7	62.118.136.167
Jul 26, 2024 02:27:43.561254978 CEST	50966	139	192.168.2.7	62.118.136.167
Jul 26, 2024 02:27:43.617760897 CEST	50961	139	192.168.2.7	62.118.78.103
Jul 26, 2024 02:27:43.695903063 CEST	50952	139	192.168.2.7	62.118.67.53
Jul 26, 2024 02:27:43.789697886 CEST	50962	139	192.168.2.7	62.118.253.30
Jul 26, 2024 02:27:43.852102995 CEST	50953	139	192.168.2.7	62.118.78.116
Jul 26, 2024 02:27:44.195921898 CEST	50954	139	192.168.2.7	62.118.146.241
Jul 26, 2024 02:27:44.415209055 CEST	50967	445	192.168.2.7	62.118.143.145
Jul 26, 2024 02:27:44.420077085 CEST	445	50967	62.118.143.145	192.168.2.7
Jul 26, 2024 02:27:44.420253038 CEST	50967	445	192.168.2.7	62.118.143.145
Jul 26, 2024 02:27:44.420284033 CEST	50967	445	192.168.2.7	62.118.143.145
Jul 26, 2024 02:27:44.425079107 CEST	445	50967	62.118.143.145	192.168.2.7
Jul 26, 2024 02:27:44.430234909 CEST	50964	139	192.168.2.7	62.118.78.100
Jul 26, 2024 02:27:44.570879936 CEST	50966	139	192.168.2.7	62.118.136.167
Jul 26, 2024 02:27:44.664731026 CEST	50941	445	192.168.2.7	62.118.150.7
Jul 26, 2024 02:27:44.665010929 CEST	50968	139	192.168.2.7	62.118.150.7
Jul 26, 2024 02:27:44.805387020 CEST	50942	445	192.168.2.7	62.118.132.3
Jul 26, 2024 02:27:44.805682898 CEST	50969	139	192.168.2.7	62.118.132.3
Jul 26, 2024 02:27:45.005769014 CEST	50970	139	192.168.2.7	62.118.140.194
Jul 26, 2024 02:27:45.133361101 CEST	50957	139	192.168.2.7	62.118.155.156
Jul 26, 2024 02:27:45.165158987 CEST	50971	445	192.168.2.7	62.118.147.145
Jul 26, 2024 02:27:45.170538902 CEST	445	50971	62.118.147.145	192.168.2.7
Jul 26, 2024 02:27:45.174051046 CEST	50971	445	192.168.2.7	62.118.147.145
Jul 26, 2024 02:27:45.174200058 CEST	50971	445	192.168.2.7	62.118.147.145
Jul 26, 2024 02:27:45.179810047 CEST	445	50971	62.118.147.145	192.168.2.7
Jul 26, 2024 02:27:45.227349997 CEST	50972	445	192.168.2.7	62.118.132.5
Jul 26, 2024 02:27:45.232291937 CEST	445	50972	62.118.132.5	192.168.2.7
Jul 26, 2024 02:27:45.232424974 CEST	50972	445	192.168.2.7	62.118.132.5
Jul 26, 2024 02:27:45.232532978 CEST	50972	445	192.168.2.7	62.118.132.5
Jul 26, 2024 02:27:45.237268925 CEST	445	50972	62.118.132.5	192.168.2.7
Jul 26, 2024 02:27:45.367755890 CEST	50959	139	192.168.2.7	62.118.138.100
Jul 26, 2024 02:27:45.367944956 CEST	50960	139	192.168.2.7	62.118.253.29
Jul 26, 2024 02:27:45.446325064 CEST	50973	445	192.168.2.7	62.118.249.109
Jul 26, 2024 02:27:45.451440096 CEST	445	50973	62.118.249.109	192.168.2.7
Jul 26, 2024 02:27:45.451628923 CEST	50973	445	192.168.2.7	62.118.249.109
Jul 26, 2024 02:27:45.451729059 CEST	50973	445	192.168.2.7	62.118.249.109
Jul 26, 2024 02:27:45.457092047 CEST	445	50973	62.118.249.109	192.168.2.7
Jul 26, 2024 02:27:45.617759943 CEST	50961	139	192.168.2.7	62.118.78.103
Jul 26, 2024 02:27:45.669203043 CEST	50968	139	192.168.2.7	62.118.150.7
Jul 26, 2024 02:27:45.789695978 CEST	50962	139	192.168.2.7	62.118.253.30
Jul 26, 2024 02:27:45.805318117 CEST	50969	139	192.168.2.7	62.118.132.3
Jul 26, 2024 02:27:45.868191957 CEST	50974	445	192.168.2.7	62.118.165.34
Jul 26, 2024 02:27:45.873230934 CEST	445	50974	62.118.165.34	192.168.2.7
Jul 26, 2024 02:27:45.873377085 CEST	50974	445	192.168.2.7	62.118.165.34
Jul 26, 2024 02:27:45.873419046 CEST	50974	445	192.168.2.7	62.118.165.34
Jul 26, 2024 02:27:45.878273964 CEST	445	50974	62.118.165.34	192.168.2.7
Jul 26, 2024 02:27:46.008388042 CEST	50970	139	192.168.2.7	62.118.140.194
Jul 26, 2024 02:27:46.153775930 CEST	445	50967	62.118.143.145	192.168.2.7
Jul 26, 2024 02:27:46.153862953 CEST	50967	445	192.168.2.7	62.118.143.145
Jul 26, 2024 02:27:46.153902054 CEST	50967	445	192.168.2.7	62.118.143.145
Jul 26, 2024 02:27:46.154191017 CEST	50975	139	192.168.2.7	62.118.143.145
Jul 26, 2024 02:27:46.211755991 CEST	50976	445	192.168.2.7	62.118.153.81
Jul 26, 2024 02:27:46.216726065 CEST	445	50976	62.118.153.81	192.168.2.7
Jul 26, 2024 02:27:46.216823101 CEST	50976	445	192.168.2.7	62.118.153.81
Jul 26, 2024 02:27:46.216865063 CEST	50976	445	192.168.2.7	62.118.153.81
Jul 26, 2024 02:27:46.217060089 CEST	50977	139	192.168.2.7	62.118.153.81
Jul 26, 2024 02:27:46.430233955 CEST	50964	139	192.168.2.7	62.118.78.100
Jul 26, 2024 02:27:46.461729050 CEST	50978	445	192.168.2.7	62.118.150.40
Jul 26, 2024 02:27:46.468907118 CEST	445	50978	62.118.150.40	192.168.2.7
Jul 26, 2024 02:27:46.468980074 CEST	50978	445	192.168.2.7	62.118.150.40
Jul 26, 2024 02:27:46.469047070 CEST	50978	445	192.168.2.7	62.118.150.40
Jul 26, 2024 02:27:46.473926067 CEST	445	50978	62.118.150.40	192.168.2.7
Jul 26, 2024 02:27:46.586509943 CEST	50966	139	192.168.2.7	62.118.136.167
Jul 26, 2024 02:27:46.696408987 CEST	50979	445	192.168.2.7	62.118.67.53
Jul 26, 2024 02:27:46.701740980 CEST	445	50979	62.118.67.53	192.168.2.7
Jul 26, 2024 02:27:46.702048063 CEST	50979	445	192.168.2.7	62.118.67.53
Jul 26, 2024 02:27:46.705521107 CEST	50979	445	192.168.2.7	62.118.67.53
Jul 26, 2024 02:27:46.711253881 CEST	445	50979	62.118.67.53	192.168.2.7
Jul 26, 2024 02:27:46.837064028 CEST	50980	445	192.168.2.7	62.118.78.116
Jul 26, 2024 02:27:46.842102051 CEST	445	50980	62.118.78.116	192.168.2.7
Jul 26, 2024 02:27:46.846038103 CEST	50980	445	192.168.2.7	62.118.78.116
Jul 26, 2024 02:27:46.846157074 CEST	50980	445	192.168.2.7	62.118.78.116
Jul 26, 2024 02:27:46.851008892 CEST	445	50980	62.118.78.116	192.168.2.7
Jul 26, 2024 02:27:46.927625895 CEST	445	50971	62.118.147.145	192.168.2.7
Jul 26, 2024 02:27:46.929074049 CEST	50971	445	192.168.2.7	62.118.147.145
Jul 26, 2024 02:27:46.929143906 CEST	50971	445	192.168.2.7	62.118.147.145
Jul 26, 2024 02:27:46.929502964 CEST	50981	139	192.168.2.7	62.118.147.145
Jul 26, 2024 02:27:47.149033070 CEST	50975	139	192.168.2.7	62.118.143.145
Jul 26, 2024 02:27:47.180594921 CEST	50982	445	192.168.2.7	62.118.146.241
Jul 26, 2024 02:27:47.185724020 CEST	445	50982	62.118.146.241	192.168.2.7
Jul 26, 2024 02:27:47.185825109 CEST	50982	445	192.168.2.7	62.118.146.241
Jul 26, 2024 02:27:47.185910940 CEST	50982	445	192.168.2.7	62.118.146.241
Jul 26, 2024 02:27:47.190610886 CEST	445	50982	62.118.146.241	192.168.2.7
Jul 26, 2024 02:27:47.211527109 CEST	50977	139	192.168.2.7	62.118.153.81
Jul 26, 2024 02:27:47.508584976 CEST	50955	445	192.168.2.7	62.118.253.46
Jul 26, 2024 02:27:47.508645058 CEST	50983	139	192.168.2.7	62.118.253.46
Jul 26, 2024 02:27:47.680346012 CEST	50968	139	192.168.2.7	62.118.150.7
Jul 26, 2024 02:27:47.681442976 CEST	445	50974	62.118.165.34	192.168.2.7
Jul 26, 2024 02:27:47.683640957 CEST	50974	445	192.168.2.7	62.118.165.34
Jul 26, 2024 02:27:47.683692932 CEST	50974	445	192.168.2.7	62.118.165.34
Jul 26, 2024 02:27:47.684011936 CEST	50984	139	192.168.2.7	62.118.165.34
Jul 26, 2024 02:27:47.805603027 CEST	50969	139	192.168.2.7	62.118.132.3
Jul 26, 2024 02:27:47.821038008 CEST	50956	445	192.168.2.7	62.118.78.113
Jul 26, 2024 02:27:47.821337938 CEST	50985	139	192.168.2.7	62.118.78.113
Jul 26, 2024 02:27:47.930248976 CEST	50981	139	192.168.2.7	62.118.147.145
Jul 26, 2024 02:27:48.024020910 CEST	50970	139	192.168.2.7	62.118.140.194
Jul 26, 2024 02:27:48.118031025 CEST	50986	445	192.168.2.7	62.118.155.156
Jul 26, 2024 02:27:48.336646080 CEST	50958	445	192.168.2.7	62.118.95.82
Jul 26, 2024 02:27:48.336872101 CEST	50987	139	192.168.2.7	62.118.95.82
Jul 26, 2024 02:27:48.352832079 CEST	445	50978	62.118.150.40	192.168.2.7
Jul 26, 2024 02:27:48.352919102 CEST	50978	445	192.168.2.7	62.118.150.40
Jul 26, 2024 02:27:48.352999926 CEST	50978	445	192.168.2.7	62.118.150.40
Jul 26, 2024 02:27:48.353136063 CEST	50988	139	192.168.2.7	62.118.150.40
Jul 26, 2024 02:27:48.355106115 CEST	445	50986	62.118.155.156	192.168.2.7
Jul 26, 2024 02:27:48.355190992 CEST	50986	445	192.168.2.7	62.118.155.156
Jul 26, 2024 02:27:48.355324030 CEST	50986	445	192.168.2.7	62.118.155.156
Jul 26, 2024 02:27:48.360291004 CEST	445	50986	62.118.155.156	192.168.2.7
Jul 26, 2024 02:27:48.368000984 CEST	50989	445	192.168.2.7	62.118.253.29
Jul 26, 2024 02:27:48.368108034 CEST	50990	445	192.168.2.7	62.118.138.100
Jul 26, 2024 02:27:48.373428106 CEST	445	50989	62.118.253.29	192.168.2.7
Jul 26, 2024 02:27:48.373461008 CEST	445	50990	62.118.138.100	192.168.2.7
Jul 26, 2024 02:27:48.373554945 CEST	50989	445	192.168.2.7	62.118.253.29
Jul 26, 2024 02:27:48.373584986 CEST	50989	445	192.168.2.7	62.118.253.29
Jul 26, 2024 02:27:48.373688936 CEST	50990	445	192.168.2.7	62.118.138.100
Jul 26, 2024 02:27:48.373688936 CEST	50990	445	192.168.2.7	62.118.138.100
Jul 26, 2024 02:27:48.373755932 CEST	50991	139	192.168.2.7	62.118.253.29
Jul 26, 2024 02:27:48.378767014 CEST	445	50990	62.118.138.100	192.168.2.7
Jul 26, 2024 02:27:48.416021109 CEST	445	50979	62.118.67.53	192.168.2.7
Jul 26, 2024 02:27:48.418064117 CEST	50979	445	192.168.2.7	62.118.67.53
Jul 26, 2024 02:27:48.418124914 CEST	50979	445	192.168.2.7	62.118.67.53
Jul 26, 2024 02:27:48.418462038 CEST	50992	139	192.168.2.7	62.118.67.53
Jul 26, 2024 02:27:48.524009943 CEST	50983	139	192.168.2.7	62.118.253.46
Jul 26, 2024 02:27:48.602793932 CEST	50993	445	192.168.2.7	62.118.78.103
Jul 26, 2024 02:27:48.607848883 CEST	445	50993	62.118.78.103	192.168.2.7
Jul 26, 2024 02:27:48.607927084 CEST	50993	445	192.168.2.7	62.118.78.103
Jul 26, 2024 02:27:48.607954025 CEST	50993	445	192.168.2.7	62.118.78.103
Jul 26, 2024 02:27:48.608239889 CEST	50994	139	192.168.2.7	62.118.78.103
Jul 26, 2024 02:27:48.680243015 CEST	50984	139	192.168.2.7	62.118.165.34
Jul 26, 2024 02:27:48.808634043 CEST	50995	445	192.168.2.7	62.118.253.30
Jul 26, 2024 02:27:48.813584089 CEST	445	50995	62.118.253.30	192.168.2.7
Jul 26, 2024 02:27:48.813663960 CEST	50995	445	192.168.2.7	62.118.253.30
Jul 26, 2024 02:27:48.813816071 CEST	50995	445	192.168.2.7	62.118.253.30
Jul 26, 2024 02:27:48.818691969 CEST	445	50995	62.118.253.30	192.168.2.7
Jul 26, 2024 02:27:48.820945024 CEST	50985	139	192.168.2.7	62.118.78.113
Jul 26, 2024 02:27:48.931166887 CEST	50996	139	192.168.2.7	62.118.249.2
Jul 26, 2024 02:27:48.964452028 CEST	445	50982	62.118.146.241	192.168.2.7
Jul 26, 2024 02:27:48.964560986 CEST	50982	445	192.168.2.7	62.118.146.241
Jul 26, 2024 02:27:48.964643002 CEST	50982	445	192.168.2.7	62.118.146.241
Jul 26, 2024 02:27:48.965101004 CEST	50997	139	192.168.2.7	62.118.146.241
Jul 26, 2024 02:27:49.024250984 CEST	50963	445	192.168.2.7	62.118.138.85
Jul 26, 2024 02:27:49.024502039 CEST	50998	139	192.168.2.7	62.118.138.85
Jul 26, 2024 02:27:49.164650917 CEST	50975	139	192.168.2.7	62.118.143.145
Jul 26, 2024 02:27:49.227214098 CEST	50977	139	192.168.2.7	62.118.153.81
Jul 26, 2024 02:27:49.352221966 CEST	50987	139	192.168.2.7	62.118.95.82
Jul 26, 2024 02:27:49.367808104 CEST	50988	139	192.168.2.7	62.118.150.40
Jul 26, 2024 02:27:49.367840052 CEST	50991	139	192.168.2.7	62.118.253.29
Jul 26, 2024 02:27:49.430371046 CEST	50992	139	192.168.2.7	62.118.67.53
Jul 26, 2024 02:27:49.431684017 CEST	50999	445	192.168.2.7	62.118.78.100
Jul 26, 2024 02:27:49.436739922 CEST	445	50999	62.118.78.100	192.168.2.7
Jul 26, 2024 02:27:49.436822891 CEST	50999	445	192.168.2.7	62.118.78.100
Jul 26, 2024 02:27:49.437094927 CEST	50999	445	192.168.2.7	62.118.78.100
Jul 26, 2024 02:27:49.442132950 CEST	445	50999	62.118.78.100	192.168.2.7
Jul 26, 2024 02:27:49.571278095 CEST	51000	445	192.168.2.7	62.118.136.167
Jul 26, 2024 02:27:49.576462030 CEST	445	51000	62.118.136.167	192.168.2.7
Jul 26, 2024 02:27:49.576570988 CEST	51000	445	192.168.2.7	62.118.136.167
Jul 26, 2024 02:27:49.576663017 CEST	51000	445	192.168.2.7	62.118.136.167
Jul 26, 2024 02:27:49.581938982 CEST	445	51000	62.118.136.167	192.168.2.7
Jul 26, 2024 02:27:49.602164030 CEST	50994	139	192.168.2.7	62.118.78.103
Jul 26, 2024 02:27:49.930453062 CEST	50996	139	192.168.2.7	62.118.249.2
Jul 26, 2024 02:27:49.946162939 CEST	50981	139	192.168.2.7	62.118.147.145
Jul 26, 2024 02:27:49.961641073 CEST	50997	139	192.168.2.7	62.118.146.241
Jul 26, 2024 02:27:50.039674044 CEST	50998	139	192.168.2.7	62.118.138.85
Jul 26, 2024 02:27:50.523998976 CEST	50983	139	192.168.2.7	62.118.253.46
Jul 26, 2024 02:27:50.680531025 CEST	51001	445	192.168.2.7	62.118.150.7
Jul 26, 2024 02:27:50.685467005 CEST	445	51001	62.118.150.7	192.168.2.7
Jul 26, 2024 02:27:50.685561895 CEST	51001	445	192.168.2.7	62.118.150.7
Jul 26, 2024 02:27:50.685650110 CEST	51001	445	192.168.2.7	62.118.150.7
Jul 26, 2024 02:27:50.691873074 CEST	445	51001	62.118.150.7	192.168.2.7
Jul 26, 2024 02:27:50.695888996 CEST	50984	139	192.168.2.7	62.118.165.34
Jul 26, 2024 02:27:50.821142912 CEST	51002	445	192.168.2.7	62.118.132.3
Jul 26, 2024 02:27:50.826147079 CEST	445	51002	62.118.132.3	192.168.2.7
Jul 26, 2024 02:27:50.826244116 CEST	51002	445	192.168.2.7	62.118.132.3
Jul 26, 2024 02:27:50.826307058 CEST	51002	445	192.168.2.7	62.118.132.3
Jul 26, 2024 02:27:50.832402945 CEST	445	51002	62.118.132.3	192.168.2.7
Jul 26, 2024 02:27:50.836510897 CEST	50985	139	192.168.2.7	62.118.78.113
Jul 26, 2024 02:27:50.993221045 CEST	51003	445	192.168.2.7	62.118.140.194
Jul 26, 2024 02:27:50.998816013 CEST	445	51003	62.118.140.194	192.168.2.7
Jul 26, 2024 02:27:50.999017954 CEST	51003	445	192.168.2.7	62.118.140.194
Jul 26, 2024 02:27:50.999049902 CEST	51003	445	192.168.2.7	62.118.140.194
Jul 26, 2024 02:27:50.999234915 CEST	51004	139	192.168.2.7	62.118.140.194
Jul 26, 2024 02:27:51.227206945 CEST	50972	445	192.168.2.7	62.118.132.5
Jul 26, 2024 02:27:51.227500916 CEST	51005	139	192.168.2.7	62.118.132.5
Jul 26, 2024 02:27:51.352160931 CEST	50987	139	192.168.2.7	62.118.95.82
Jul 26, 2024 02:27:51.367801905 CEST	50988	139	192.168.2.7	62.118.150.40
Jul 26, 2024 02:27:51.367983103 CEST	50991	139	192.168.2.7	62.118.253.29
Jul 26, 2024 02:27:51.430280924 CEST	50992	139	192.168.2.7	62.118.67.53
Jul 26, 2024 02:27:51.457329035 CEST	50973	445	192.168.2.7	62.118.249.109
Jul 26, 2024 02:27:51.460325003 CEST	51006	139	192.168.2.7	62.118.249.109
Jul 26, 2024 02:27:51.602153063 CEST	50994	139	192.168.2.7	62.118.78.103
Jul 26, 2024 02:27:51.945970058 CEST	50996	139	192.168.2.7	62.118.249.2
Jul 26, 2024 02:27:51.961535931 CEST	50997	139	192.168.2.7	62.118.146.241
Jul 26, 2024 02:27:52.008505106 CEST	51004	139	192.168.2.7	62.118.140.194
Jul 26, 2024 02:27:52.040252924 CEST	50998	139	192.168.2.7	62.118.138.85
Jul 26, 2024 02:27:52.165096998 CEST	51007	445	192.168.2.7	62.118.143.145
Jul 26, 2024 02:27:52.170355082 CEST	445	51007	62.118.143.145	192.168.2.7
Jul 26, 2024 02:27:52.170468092 CEST	51007	445	192.168.2.7	62.118.143.145
Jul 26, 2024 02:27:52.170604944 CEST	51007	445	192.168.2.7	62.118.143.145
Jul 26, 2024 02:27:52.175574064 CEST	445	51007	62.118.143.145	192.168.2.7
Jul 26, 2024 02:27:52.211946964 CEST	51008	445	192.168.2.7	62.118.153.81
Jul 26, 2024 02:27:52.217276096 CEST	445	51008	62.118.153.81	192.168.2.7
Jul 26, 2024 02:27:52.217407942 CEST	51008	445	192.168.2.7	62.118.153.81
Jul 26, 2024 02:27:52.217515945 CEST	51008	445	192.168.2.7	62.118.153.81
Jul 26, 2024 02:27:52.222455978 CEST	445	51008	62.118.153.81	192.168.2.7
Jul 26, 2024 02:27:52.227312088 CEST	51005	139	192.168.2.7	62.118.132.5
Jul 26, 2024 02:27:52.461575985 CEST	51006	139	192.168.2.7	62.118.249.109
Jul 26, 2024 02:27:52.852521896 CEST	50980	445	192.168.2.7	62.118.78.116
Jul 26, 2024 02:27:52.855427980 CEST	51009	139	192.168.2.7	62.118.78.116
Jul 26, 2024 02:27:52.915375948 CEST	51010	445	192.168.2.7	62.118.147.145
Jul 26, 2024 02:27:52.920286894 CEST	445	51010	62.118.147.145	192.168.2.7
Jul 26, 2024 02:27:52.920380116 CEST	51010	445	192.168.2.7	62.118.147.145
Jul 26, 2024 02:27:52.920516014 CEST	51010	445	192.168.2.7	62.118.147.145
Jul 26, 2024 02:27:52.925268888 CEST	445	51010	62.118.147.145	192.168.2.7
Jul 26, 2024 02:27:53.508982897 CEST	51011	445	192.168.2.7	62.118.253.46
Jul 26, 2024 02:27:53.514017105 CEST	445	51011	62.118.253.46	192.168.2.7
Jul 26, 2024 02:27:53.514250994 CEST	51011	445	192.168.2.7	62.118.253.46
Jul 26, 2024 02:27:53.514250994 CEST	51011	445	192.168.2.7	62.118.253.46
Jul 26, 2024 02:27:53.519081116 CEST	445	51011	62.118.253.46	192.168.2.7
Jul 26, 2024 02:27:53.696595907 CEST	51012	445	192.168.2.7	62.118.165.34
Jul 26, 2024 02:27:53.701522112 CEST	445	51012	62.118.165.34	192.168.2.7
Jul 26, 2024 02:27:53.701726913 CEST	51012	445	192.168.2.7	62.118.165.34
Jul 26, 2024 02:27:53.701814890 CEST	51012	445	192.168.2.7	62.118.165.34
Jul 26, 2024 02:27:53.708290100 CEST	445	51012	62.118.165.34	192.168.2.7
Jul 26, 2024 02:27:53.836951971 CEST	51013	445	192.168.2.7	62.118.78.113
Jul 26, 2024 02:27:53.842364073 CEST	445	51013	62.118.78.113	192.168.2.7
Jul 26, 2024 02:27:53.845088005 CEST	51013	445	192.168.2.7	62.118.78.113
Jul 26, 2024 02:27:53.845221996 CEST	51013	445	192.168.2.7	62.118.78.113
Jul 26, 2024 02:27:53.850265026 CEST	445	51013	62.118.78.113	192.168.2.7
Jul 26, 2024 02:27:53.852226973 CEST	51009	139	192.168.2.7	62.118.78.116
Jul 26, 2024 02:27:53.924385071 CEST	445	51007	62.118.143.145	192.168.2.7
Jul 26, 2024 02:27:53.924501896 CEST	51007	445	192.168.2.7	62.118.143.145
Jul 26, 2024 02:27:53.924699068 CEST	51007	445	192.168.2.7	62.118.143.145
Jul 26, 2024 02:27:53.925059080 CEST	51014	139	192.168.2.7	62.118.143.145
Jul 26, 2024 02:27:53.986432076 CEST	445	51008	62.118.153.81	192.168.2.7
Jul 26, 2024 02:27:53.990071058 CEST	51008	445	192.168.2.7	62.118.153.81
Jul 26, 2024 02:27:53.990160942 CEST	51008	445	192.168.2.7	62.118.153.81
Jul 26, 2024 02:27:53.990554094 CEST	51015	139	192.168.2.7	62.118.153.81
Jul 26, 2024 02:27:54.008424997 CEST	51004	139	192.168.2.7	62.118.140.194
Jul 26, 2024 02:27:54.243020058 CEST	51005	139	192.168.2.7	62.118.132.5
Jul 26, 2024 02:27:54.352889061 CEST	51016	445	192.168.2.7	62.118.95.82
Jul 26, 2024 02:27:54.352925062 CEST	50986	445	192.168.2.7	62.118.155.156
Jul 26, 2024 02:27:54.353070021 CEST	51017	139	192.168.2.7	62.118.155.156
Jul 26, 2024 02:27:54.353260040 CEST	51018	445	192.168.2.7	62.118.150.40
Jul 26, 2024 02:27:54.368237019 CEST	50990	445	192.168.2.7	62.118.138.100
Jul 26, 2024 02:27:54.368532896 CEST	51019	139	192.168.2.7	62.118.138.100
Jul 26, 2024 02:27:54.368583918 CEST	51020	445	192.168.2.7	62.118.253.29
Jul 26, 2024 02:27:54.371069908 CEST	445	51016	62.118.95.82	192.168.2.7
Jul 26, 2024 02:27:54.371136904 CEST	445	51018	62.118.150.40	192.168.2.7
Jul 26, 2024 02:27:54.371171951 CEST	51016	445	192.168.2.7	62.118.95.82
Jul 26, 2024 02:27:54.371201992 CEST	51018	445	192.168.2.7	62.118.150.40
Jul 26, 2024 02:27:54.371273994 CEST	51016	445	192.168.2.7	62.118.95.82
Jul 26, 2024 02:27:54.371330023 CEST	51018	445	192.168.2.7	62.118.150.40
Jul 26, 2024 02:27:54.384077072 CEST	445	51020	62.118.253.29	192.168.2.7
Jul 26, 2024 02:27:54.384095907 CEST	445	51016	62.118.95.82	192.168.2.7
Jul 26, 2024 02:27:54.384109974 CEST	445	51018	62.118.150.40	192.168.2.7
Jul 26, 2024 02:27:54.384243965 CEST	51020	445	192.168.2.7	62.118.253.29
Jul 26, 2024 02:27:54.384272099 CEST	51020	445	192.168.2.7	62.118.253.29
Jul 26, 2024 02:27:54.390568972 CEST	445	51020	62.118.253.29	192.168.2.7
Jul 26, 2024 02:27:54.415630102 CEST	51021	445	192.168.2.7	62.118.67.53
Jul 26, 2024 02:27:54.425329924 CEST	445	51021	62.118.67.53	192.168.2.7
Jul 26, 2024 02:27:54.426246881 CEST	51021	445	192.168.2.7	62.118.67.53
Jul 26, 2024 02:27:54.426301003 CEST	51021	445	192.168.2.7	62.118.67.53
Jul 26, 2024 02:27:54.431472063 CEST	445	51021	62.118.67.53	192.168.2.7
Jul 26, 2024 02:27:54.461764097 CEST	51006	139	192.168.2.7	62.118.249.109
Jul 26, 2024 02:27:54.605489969 CEST	51022	445	192.168.2.7	62.118.78.103
Jul 26, 2024 02:27:54.610507011 CEST	445	51022	62.118.78.103	192.168.2.7
Jul 26, 2024 02:27:54.610598087 CEST	51022	445	192.168.2.7	62.118.78.103
Jul 26, 2024 02:27:54.610831976 CEST	51022	445	192.168.2.7	62.118.78.103
Jul 26, 2024 02:27:54.615564108 CEST	445	51022	62.118.78.103	192.168.2.7
Jul 26, 2024 02:27:54.714793921 CEST	445	51010	62.118.147.145	192.168.2.7
Jul 26, 2024 02:27:54.715034962 CEST	51010	445	192.168.2.7	62.118.147.145
Jul 26, 2024 02:27:54.715034962 CEST	51010	445	192.168.2.7	62.118.147.145
Jul 26, 2024 02:27:54.715487003 CEST	51023	139	192.168.2.7	62.118.147.145
Jul 26, 2024 02:27:54.805521965 CEST	50995	445	192.168.2.7	62.118.253.30
Jul 26, 2024 02:27:54.805767059 CEST	51024	139	192.168.2.7	62.118.253.30
Jul 26, 2024 02:27:54.930510044 CEST	51014	139	192.168.2.7	62.118.143.145
Jul 26, 2024 02:27:54.931337118 CEST	51025	445	192.168.2.7	62.118.249.2
Jul 26, 2024 02:27:54.939635038 CEST	445	51025	62.118.249.2	192.168.2.7
Jul 26, 2024 02:27:54.939807892 CEST	51025	445	192.168.2.7	62.118.249.2
Jul 26, 2024 02:27:54.943773031 CEST	51025	445	192.168.2.7	62.118.249.2
Jul 26, 2024 02:27:54.944061995 CEST	51026	139	192.168.2.7	62.118.249.2
Jul 26, 2024 02:27:54.961946011 CEST	51027	445	192.168.2.7	62.118.146.241
Jul 26, 2024 02:27:54.967185020 CEST	445	51027	62.118.146.241	192.168.2.7
Jul 26, 2024 02:27:54.967298031 CEST	51027	445	192.168.2.7	62.118.146.241
Jul 26, 2024 02:27:54.967423916 CEST	51027	445	192.168.2.7	62.118.146.241
Jul 26, 2024 02:27:54.972275972 CEST	445	51027	62.118.146.241	192.168.2.7
Jul 26, 2024 02:27:54.993386030 CEST	51015	139	192.168.2.7	62.118.153.81
Jul 26, 2024 02:27:55.024600029 CEST	51028	445	192.168.2.7	62.118.138.85
Jul 26, 2024 02:27:55.029586077 CEST	445	51028	62.118.138.85	192.168.2.7
Jul 26, 2024 02:27:55.029706955 CEST	51028	445	192.168.2.7	62.118.138.85
Jul 26, 2024 02:27:55.029797077 CEST	51028	445	192.168.2.7	62.118.138.85
Jul 26, 2024 02:27:55.034684896 CEST	445	51028	62.118.138.85	192.168.2.7
Jul 26, 2024 02:27:55.352408886 CEST	51017	139	192.168.2.7	62.118.155.156
Jul 26, 2024 02:27:55.368036032 CEST	51019	139	192.168.2.7	62.118.138.100
Jul 26, 2024 02:27:55.430613041 CEST	50999	445	192.168.2.7	62.118.78.100
Jul 26, 2024 02:27:55.430825949 CEST	51029	139	192.168.2.7	62.118.78.100
Jul 26, 2024 02:27:55.570993900 CEST	51000	445	192.168.2.7	62.118.136.167
Jul 26, 2024 02:27:55.571342945 CEST	51030	139	192.168.2.7	62.118.136.167
Jul 26, 2024 02:27:55.725131989 CEST	445	51012	62.118.165.34	192.168.2.7
Jul 26, 2024 02:27:55.725205898 CEST	51012	445	192.168.2.7	62.118.165.34
Jul 26, 2024 02:27:55.725250006 CEST	51012	445	192.168.2.7	62.118.165.34
Jul 26, 2024 02:27:55.725464106 CEST	51031	139	192.168.2.7	62.118.165.34
Jul 26, 2024 02:27:55.726851940 CEST	445	51012	62.118.165.34	192.168.2.7
Jul 26, 2024 02:27:55.726900101 CEST	51012	445	192.168.2.7	62.118.165.34
Jul 26, 2024 02:27:55.727168083 CEST	51023	139	192.168.2.7	62.118.147.145
Jul 26, 2024 02:27:55.805332899 CEST	51024	139	192.168.2.7	62.118.253.30
Jul 26, 2024 02:27:55.852338076 CEST	51009	139	192.168.2.7	62.118.78.116
Jul 26, 2024 02:27:55.930527925 CEST	51026	139	192.168.2.7	62.118.249.2
Jul 26, 2024 02:27:56.430474043 CEST	51029	139	192.168.2.7	62.118.78.100
Jul 26, 2024 02:27:56.586565971 CEST	51030	139	192.168.2.7	62.118.136.167
Jul 26, 2024 02:27:56.680361032 CEST	51001	445	192.168.2.7	62.118.150.7
Jul 26, 2024 02:27:56.680563927 CEST	51032	139	192.168.2.7	62.118.150.7
Jul 26, 2024 02:27:56.711532116 CEST	51031	139	192.168.2.7	62.118.165.34
Jul 26, 2024 02:27:56.773571014 CEST	445	51012	62.118.165.34	192.168.2.7
Jul 26, 2024 02:27:56.773583889 CEST	445	51018	62.118.150.40	192.168.2.7
Jul 26, 2024 02:27:56.773593903 CEST	445	51021	62.118.67.53	192.168.2.7
Jul 26, 2024 02:27:56.773627996 CEST	51012	445	192.168.2.7	62.118.165.34
Jul 26, 2024 02:27:56.773648024 CEST	51018	445	192.168.2.7	62.118.150.40
Jul 26, 2024 02:27:56.773664951 CEST	445	51018	62.118.150.40	192.168.2.7
Jul 26, 2024 02:27:56.773688078 CEST	51021	445	192.168.2.7	62.118.67.53
Jul 26, 2024 02:27:56.773698092 CEST	51018	445	192.168.2.7	62.118.150.40
Jul 26, 2024 02:27:56.773782015 CEST	51018	445	192.168.2.7	62.118.150.40
Jul 26, 2024 02:27:56.773852110 CEST	51021	445	192.168.2.7	62.118.67.53
Jul 26, 2024 02:27:56.774003029 CEST	51033	139	192.168.2.7	62.118.150.40
Jul 26, 2024 02:27:56.774029016 CEST	445	51012	62.118.165.34	192.168.2.7
Jul 26, 2024 02:27:56.774039984 CEST	445	51021	62.118.67.53	192.168.2.7
Jul 26, 2024 02:27:56.774049997 CEST	445	51018	62.118.150.40	192.168.2.7
Jul 26, 2024 02:27:56.774070978 CEST	51012	445	192.168.2.7	62.118.165.34
Jul 26, 2024 02:27:56.774096012 CEST	51018	445	192.168.2.7	62.118.150.40
Jul 26, 2024 02:27:56.774097919 CEST	51021	445	192.168.2.7	62.118.67.53
Jul 26, 2024 02:27:56.774106979 CEST	445	51021	62.118.67.53	192.168.2.7
Jul 26, 2024 02:27:56.774118900 CEST	445	51027	62.118.146.241	192.168.2.7
Jul 26, 2024 02:27:56.774143934 CEST	51021	445	192.168.2.7	62.118.67.53
Jul 26, 2024 02:27:56.774163008 CEST	51027	445	192.168.2.7	62.118.146.241
Jul 26, 2024 02:27:56.774362087 CEST	51027	445	192.168.2.7	62.118.146.241
Jul 26, 2024 02:27:56.774477005 CEST	51034	139	192.168.2.7	62.118.67.53
Jul 26, 2024 02:27:56.774590969 CEST	51035	139	192.168.2.7	62.118.146.241
Jul 26, 2024 02:27:56.820985079 CEST	51002	445	192.168.2.7	62.118.132.3
Jul 26, 2024 02:27:56.821424007 CEST	51036	139	192.168.2.7	62.118.132.3
Jul 26, 2024 02:27:56.945930004 CEST	51014	139	192.168.2.7	62.118.143.145
Jul 26, 2024 02:27:56.992866993 CEST	51015	139	192.168.2.7	62.118.153.81
Jul 26, 2024 02:27:57.008774042 CEST	51037	445	192.168.2.7	62.118.140.194
Jul 26, 2024 02:27:57.013909101 CEST	445	51037	62.118.140.194	192.168.2.7
Jul 26, 2024 02:27:57.016089916 CEST	51037	445	192.168.2.7	62.118.140.194
Jul 26, 2024 02:27:57.018028021 CEST	51037	445	192.168.2.7	62.118.140.194
Jul 26, 2024 02:27:57.022891998 CEST	445	51037	62.118.140.194	192.168.2.7
Jul 26, 2024 02:27:57.100327015 CEST	51038	139	192.168.2.7	62.118.253.27
Jul 26, 2024 02:27:57.243187904 CEST	51039	445	192.168.2.7	62.118.132.5
Jul 26, 2024 02:27:57.248076916 CEST	445	51039	62.118.132.5	192.168.2.7
Jul 26, 2024 02:27:57.248194933 CEST	51039	445	192.168.2.7	62.118.132.5
Jul 26, 2024 02:27:57.248276949 CEST	51039	445	192.168.2.7	62.118.132.5
Jul 26, 2024 02:27:57.253070116 CEST	445	51039	62.118.132.5	192.168.2.7
Jul 26, 2024 02:27:57.352222919 CEST	51017	139	192.168.2.7	62.118.155.156
Jul 26, 2024 02:27:57.383507967 CEST	51019	139	192.168.2.7	62.118.138.100
Jul 26, 2024 02:27:57.446504116 CEST	51040	445	192.168.2.7	62.118.249.109
Jul 26, 2024 02:27:57.451411009 CEST	445	51040	62.118.249.109	192.168.2.7
Jul 26, 2024 02:27:57.451524019 CEST	51040	445	192.168.2.7	62.118.249.109
Jul 26, 2024 02:27:57.451884985 CEST	51040	445	192.168.2.7	62.118.249.109
Jul 26, 2024 02:27:57.456646919 CEST	445	51040	62.118.249.109	192.168.2.7
Jul 26, 2024 02:27:57.695944071 CEST	51032	139	192.168.2.7	62.118.150.7
Jul 26, 2024 02:27:57.727205038 CEST	51023	139	192.168.2.7	62.118.147.145
Jul 26, 2024 02:27:57.758433104 CEST	51033	139	192.168.2.7	62.118.150.40
Jul 26, 2024 02:27:57.774075985 CEST	51034	139	192.168.2.7	62.118.67.53
Jul 26, 2024 02:27:57.774142981 CEST	51035	139	192.168.2.7	62.118.146.241
Jul 26, 2024 02:27:57.805306911 CEST	51024	139	192.168.2.7	62.118.253.30
Jul 26, 2024 02:27:57.820910931 CEST	51036	139	192.168.2.7	62.118.132.3
Jul 26, 2024 02:27:57.946055889 CEST	51026	139	192.168.2.7	62.118.249.2
Jul 26, 2024 02:27:58.102226973 CEST	51038	139	192.168.2.7	62.118.253.27
Jul 26, 2024 02:27:58.430511951 CEST	51029	139	192.168.2.7	62.118.78.100
Jul 26, 2024 02:27:58.586576939 CEST	51030	139	192.168.2.7	62.118.136.167
Jul 26, 2024 02:27:58.711543083 CEST	51031	139	192.168.2.7	62.118.165.34
Jul 26, 2024 02:27:58.868310928 CEST	51041	445	192.168.2.7	62.118.78.116
Jul 26, 2024 02:27:58.873311996 CEST	445	51041	62.118.78.116	192.168.2.7
Jul 26, 2024 02:27:58.873384953 CEST	51041	445	192.168.2.7	62.118.78.116
Jul 26, 2024 02:27:58.873476982 CEST	51041	445	192.168.2.7	62.118.78.116
Jul 26, 2024 02:27:58.878217936 CEST	445	51041	62.118.78.116	192.168.2.7
Jul 26, 2024 02:27:59.524255991 CEST	51011	445	192.168.2.7	62.118.253.46
Jul 26, 2024 02:27:59.524395943 CEST	51042	139	192.168.2.7	62.118.253.46
Jul 26, 2024 02:27:59.711544991 CEST	51032	139	192.168.2.7	62.118.150.7
Jul 26, 2024 02:27:59.774054050 CEST	51033	139	192.168.2.7	62.118.150.40
Jul 26, 2024 02:27:59.789710999 CEST	51034	139	192.168.2.7	62.118.67.53
Jul 26, 2024 02:27:59.789938927 CEST	51035	139	192.168.2.7	62.118.146.241
Jul 26, 2024 02:27:59.836587906 CEST	51036	139	192.168.2.7	62.118.132.3
Jul 26, 2024 02:27:59.852303028 CEST	51013	445	192.168.2.7	62.118.78.113
Jul 26, 2024 02:27:59.852565050 CEST	51043	139	192.168.2.7	62.118.78.113
Jul 26, 2024 02:27:59.932496071 CEST	51044	445	192.168.2.7	62.118.143.145
Jul 26, 2024 02:27:59.939527035 CEST	445	51044	62.118.143.145	192.168.2.7
Jul 26, 2024 02:27:59.940869093 CEST	51044	445	192.168.2.7	62.118.143.145
Jul 26, 2024 02:27:59.941138029 CEST	51044	445	192.168.2.7	62.118.143.145
Jul 26, 2024 02:27:59.945909977 CEST	445	51044	62.118.143.145	192.168.2.7
Jul 26, 2024 02:27:59.993932962 CEST	51045	445	192.168.2.7	62.118.153.81
Jul 26, 2024 02:27:59.998902082 CEST	445	51045	62.118.153.81	192.168.2.7
Jul 26, 2024 02:27:59.998999119 CEST	51045	445	192.168.2.7	62.118.153.81
Jul 26, 2024 02:27:59.999068022 CEST	51045	445	192.168.2.7	62.118.153.81
Jul 26, 2024 02:28:00.004344940 CEST	445	51045	62.118.153.81	192.168.2.7
Jul 26, 2024 02:28:00.117857933 CEST	51038	139	192.168.2.7	62.118.253.27
Jul 26, 2024 02:28:00.369443893 CEST	51046	445	192.168.2.7	62.118.155.156
Jul 26, 2024 02:28:00.375375032 CEST	445	51046	62.118.155.156	192.168.2.7
Jul 26, 2024 02:28:00.375443935 CEST	51046	445	192.168.2.7	62.118.155.156
Jul 26, 2024 02:28:00.377563000 CEST	51046	445	192.168.2.7	62.118.155.156
Jul 26, 2024 02:28:00.383358002 CEST	445	51046	62.118.155.156	192.168.2.7
Jul 26, 2024 02:28:00.385819912 CEST	51016	445	192.168.2.7	62.118.95.82
Jul 26, 2024 02:28:00.386039972 CEST	51047	445	192.168.2.7	62.118.138.100
Jul 26, 2024 02:28:00.386171103 CEST	51048	139	192.168.2.7	62.118.95.82
Jul 26, 2024 02:28:00.392050028 CEST	445	51047	62.118.138.100	192.168.2.7
Jul 26, 2024 02:28:00.394089937 CEST	51047	445	192.168.2.7	62.118.138.100
Jul 26, 2024 02:28:00.394192934 CEST	51047	445	192.168.2.7	62.118.138.100
Jul 26, 2024 02:28:00.400333881 CEST	445	51047	62.118.138.100	192.168.2.7
Jul 26, 2024 02:28:00.402721882 CEST	51020	445	192.168.2.7	62.118.253.29
Jul 26, 2024 02:28:00.402964115 CEST	51049	139	192.168.2.7	62.118.253.29
Jul 26, 2024 02:28:00.539752960 CEST	51042	139	192.168.2.7	62.118.253.46
Jul 26, 2024 02:28:00.620568037 CEST	51022	445	192.168.2.7	62.118.78.103
Jul 26, 2024 02:28:00.620784998 CEST	51050	139	192.168.2.7	62.118.78.103
Jul 26, 2024 02:28:00.731256962 CEST	51051	445	192.168.2.7	62.118.147.145
Jul 26, 2024 02:28:00.736177921 CEST	445	51051	62.118.147.145	192.168.2.7
Jul 26, 2024 02:28:00.736650944 CEST	51051	445	192.168.2.7	62.118.147.145
Jul 26, 2024 02:28:00.736943007 CEST	51051	445	192.168.2.7	62.118.147.145
Jul 26, 2024 02:28:00.741786003 CEST	445	51051	62.118.147.145	192.168.2.7
Jul 26, 2024 02:28:00.821348906 CEST	51052	445	192.168.2.7	62.118.253.30
Jul 26, 2024 02:28:00.829933882 CEST	445	51052	62.118.253.30	192.168.2.7
Jul 26, 2024 02:28:00.829998016 CEST	51052	445	192.168.2.7	62.118.253.30
Jul 26, 2024 02:28:00.830107927 CEST	51052	445	192.168.2.7	62.118.253.30
Jul 26, 2024 02:28:00.835035086 CEST	445	51052	62.118.253.30	192.168.2.7
Jul 26, 2024 02:28:00.852204084 CEST	51043	139	192.168.2.7	62.118.78.113
Jul 26, 2024 02:28:00.930918932 CEST	51053	445	192.168.2.7	62.118.249.2
Jul 26, 2024 02:28:00.941097975 CEST	445	51053	62.118.249.2	192.168.2.7
Jul 26, 2024 02:28:00.941203117 CEST	51053	445	192.168.2.7	62.118.249.2
Jul 26, 2024 02:28:00.941278934 CEST	51053	445	192.168.2.7	62.118.249.2
Jul 26, 2024 02:28:00.946496964 CEST	445	51053	62.118.249.2	192.168.2.7
Jul 26, 2024 02:28:01.039727926 CEST	51028	445	192.168.2.7	62.118.138.85
Jul 26, 2024 02:28:01.039933920 CEST	51054	139	192.168.2.7	62.118.138.85
Jul 26, 2024 02:28:01.399164915 CEST	51048	139	192.168.2.7	62.118.95.82
Jul 26, 2024 02:28:01.414880037 CEST	51049	139	192.168.2.7	62.118.253.29
Jul 26, 2024 02:28:01.446316957 CEST	51055	445	192.168.2.7	62.118.78.100
Jul 26, 2024 02:28:01.451292992 CEST	445	51055	62.118.78.100	192.168.2.7
Jul 26, 2024 02:28:01.452080011 CEST	51055	445	192.168.2.7	62.118.78.100
Jul 26, 2024 02:28:01.452183008 CEST	51055	445	192.168.2.7	62.118.78.100
Jul 26, 2024 02:28:01.457448959 CEST	445	51055	62.118.78.100	192.168.2.7
Jul 26, 2024 02:28:01.586848974 CEST	51056	445	192.168.2.7	62.118.136.167
Jul 26, 2024 02:28:01.591979027 CEST	445	51056	62.118.136.167	192.168.2.7
Jul 26, 2024 02:28:01.592050076 CEST	51056	445	192.168.2.7	62.118.136.167
Jul 26, 2024 02:28:01.592166901 CEST	51056	445	192.168.2.7	62.118.136.167
Jul 26, 2024 02:28:01.597449064 CEST	445	51056	62.118.136.167	192.168.2.7
Jul 26, 2024 02:28:01.633435011 CEST	51050	139	192.168.2.7	62.118.78.103
Jul 26, 2024 02:28:01.727622032 CEST	51057	445	192.168.2.7	62.118.165.34
Jul 26, 2024 02:28:02.039731979 CEST	51054	139	192.168.2.7	62.118.138.85
Jul 26, 2024 02:28:02.539766073 CEST	51042	139	192.168.2.7	62.118.253.46
Jul 26, 2024 02:28:02.680955887 CEST	51058	445	192.168.2.7	62.118.150.7
Jul 26, 2024 02:28:02.729410887 CEST	445	51044	62.118.143.145	192.168.2.7
Jul 26, 2024 02:28:02.729429007 CEST	445	51045	62.118.153.81	192.168.2.7
Jul 26, 2024 02:28:02.729535103 CEST	51044	445	192.168.2.7	62.118.143.145
Jul 26, 2024 02:28:02.729615927 CEST	51044	445	192.168.2.7	62.118.143.145
Jul 26, 2024 02:28:02.729615927 CEST	51045	445	192.168.2.7	62.118.153.81
Jul 26, 2024 02:28:02.729706049 CEST	445	51044	62.118.143.145	192.168.2.7
Jul 26, 2024 02:28:02.729731083 CEST	51045	445	192.168.2.7	62.118.153.81
Jul 26, 2024 02:28:02.729749918 CEST	51044	445	192.168.2.7	62.118.143.145
Jul 26, 2024 02:28:02.729846001 CEST	445	51045	62.118.153.81	192.168.2.7
Jul 26, 2024 02:28:02.729919910 CEST	51045	445	192.168.2.7	62.118.153.81
Jul 26, 2024 02:28:02.729955912 CEST	51059	139	192.168.2.7	62.118.153.81
Jul 26, 2024 02:28:02.730067968 CEST	51060	139	192.168.2.7	62.118.143.145
Jul 26, 2024 02:28:02.730093956 CEST	445	51044	62.118.143.145	192.168.2.7
Jul 26, 2024 02:28:02.730123043 CEST	445	51045	62.118.153.81	192.168.2.7
Jul 26, 2024 02:28:02.730159044 CEST	51044	445	192.168.2.7	62.118.143.145
Jul 26, 2024 02:28:02.730570078 CEST	445	51044	62.118.143.145	192.168.2.7
Jul 26, 2024 02:28:02.730581999 CEST	445	51051	62.118.147.145	192.168.2.7
Jul 26, 2024 02:28:02.730591059 CEST	445	51045	62.118.153.81	192.168.2.7
Jul 26, 2024 02:28:02.730596066 CEST	51045	445	192.168.2.7	62.118.153.81
Jul 26, 2024 02:28:02.730616093 CEST	51044	445	192.168.2.7	62.118.143.145
Jul 26, 2024 02:28:02.730648041 CEST	51045	445	192.168.2.7	62.118.153.81
Jul 26, 2024 02:28:02.730726004 CEST	51051	445	192.168.2.7	62.118.147.145
Jul 26, 2024 02:28:02.730726957 CEST	51051	445	192.168.2.7	62.118.147.145
Jul 26, 2024 02:28:02.730890036 CEST	51061	139	192.168.2.7	62.118.147.145
Jul 26, 2024 02:28:02.742835999 CEST	51057	445	192.168.2.7	62.118.165.34
Jul 26, 2024 02:28:02.790066004 CEST	51062	445	192.168.2.7	62.118.146.241
Jul 26, 2024 02:28:02.790070057 CEST	51063	445	192.168.2.7	62.118.67.53
Jul 26, 2024 02:28:02.790216923 CEST	51064	445	192.168.2.7	62.118.150.40
Jul 26, 2024 02:28:02.824639082 CEST	51065	445	192.168.2.7	62.118.132.3
Jul 26, 2024 02:28:02.852225065 CEST	51043	139	192.168.2.7	62.118.78.113
Jul 26, 2024 02:28:02.971714020 CEST	445	51057	62.118.165.34	192.168.2.7
Jul 26, 2024 02:28:02.971788883 CEST	445	51058	62.118.150.7	192.168.2.7
Jul 26, 2024 02:28:02.971877098 CEST	51057	445	192.168.2.7	62.118.165.34
Jul 26, 2024 02:28:02.971895933 CEST	51058	445	192.168.2.7	62.118.150.7
Jul 26, 2024 02:28:02.971985102 CEST	51057	445	192.168.2.7	62.118.165.34
Jul 26, 2024 02:28:02.972059011 CEST	51058	445	192.168.2.7	62.118.150.7
Jul 26, 2024 02:28:02.972397089 CEST	445	51051	62.118.147.145	192.168.2.7
Jul 26, 2024 02:28:02.972448111 CEST	51051	445	192.168.2.7	62.118.147.145
Jul 26, 2024 02:28:02.974229097 CEST	445	51057	62.118.165.34	192.168.2.7
Jul 26, 2024 02:28:02.974240065 CEST	445	51062	62.118.146.241	192.168.2.7
Jul 26, 2024 02:28:02.974256992 CEST	445	51063	62.118.67.53	192.168.2.7
Jul 26, 2024 02:28:02.974266052 CEST	445	51064	62.118.150.40	192.168.2.7
Jul 26, 2024 02:28:02.974277020 CEST	445	51065	62.118.132.3	192.168.2.7
Jul 26, 2024 02:28:02.974280119 CEST	51057	445	192.168.2.7	62.118.165.34
Jul 26, 2024 02:28:02.974303007 CEST	51062	445	192.168.2.7	62.118.146.241
Jul 26, 2024 02:28:02.974348068 CEST	51063	445	192.168.2.7	62.118.67.53
Jul 26, 2024 02:28:02.974360943 CEST	51065	445	192.168.2.7	62.118.132.3
Jul 26, 2024 02:28:02.974364042 CEST	51064	445	192.168.2.7	62.118.150.40
Jul 26, 2024 02:28:02.974438906 CEST	51063	445	192.168.2.7	62.118.67.53
Jul 26, 2024 02:28:02.974443913 CEST	51062	445	192.168.2.7	62.118.146.241
Jul 26, 2024 02:28:02.974493980 CEST	51064	445	192.168.2.7	62.118.150.40
Jul 26, 2024 02:28:02.974550962 CEST	51065	445	192.168.2.7	62.118.132.3
Jul 26, 2024 02:28:02.976689100 CEST	445	51057	62.118.165.34	192.168.2.7
Jul 26, 2024 02:28:02.976847887 CEST	445	51058	62.118.150.7	192.168.2.7
Jul 26, 2024 02:28:02.979335070 CEST	445	51063	62.118.67.53	192.168.2.7
Jul 26, 2024 02:28:02.979343891 CEST	445	51062	62.118.146.241	192.168.2.7
Jul 26, 2024 02:28:02.979347944 CEST	445	51064	62.118.150.40	192.168.2.7
Jul 26, 2024 02:28:02.979393959 CEST	445	51065	62.118.132.3	192.168.2.7
Jul 26, 2024 02:28:03.009547949 CEST	51037	445	192.168.2.7	62.118.140.194
Jul 26, 2024 02:28:03.009843111 CEST	51066	139	192.168.2.7	62.118.140.194
Jul 26, 2024 02:28:03.102587938 CEST	51067	445	192.168.2.7	62.118.253.27
Jul 26, 2024 02:28:03.107575893 CEST	445	51067	62.118.253.27	192.168.2.7
Jul 26, 2024 02:28:03.107678890 CEST	51067	445	192.168.2.7	62.118.253.27
Jul 26, 2024 02:28:03.107757092 CEST	51067	445	192.168.2.7	62.118.253.27
Jul 26, 2024 02:28:03.107902050 CEST	51068	139	192.168.2.7	62.118.253.27
Jul 26, 2024 02:28:03.258677959 CEST	51039	445	192.168.2.7	62.118.132.5
Jul 26, 2024 02:28:03.259170055 CEST	51069	139	192.168.2.7	62.118.132.5
Jul 26, 2024 02:28:03.399071932 CEST	51048	139	192.168.2.7	62.118.95.82
Jul 26, 2024 02:28:03.414714098 CEST	51049	139	192.168.2.7	62.118.253.29
Jul 26, 2024 02:28:03.462034941 CEST	51040	445	192.168.2.7	62.118.249.109
Jul 26, 2024 02:28:03.464272022 CEST	51070	139	192.168.2.7	62.118.249.109
Jul 26, 2024 02:28:03.634023905 CEST	51050	139	192.168.2.7	62.118.78.103
Jul 26, 2024 02:28:03.742863894 CEST	51060	139	192.168.2.7	62.118.143.145
Jul 26, 2024 02:28:03.742863894 CEST	51061	139	192.168.2.7	62.118.147.145
Jul 26, 2024 02:28:03.742950916 CEST	51059	139	192.168.2.7	62.118.153.81
Jul 26, 2024 02:28:04.024106026 CEST	51066	139	192.168.2.7	62.118.140.194
Jul 26, 2024 02:28:04.039725065 CEST	51054	139	192.168.2.7	62.118.138.85
Jul 26, 2024 02:28:04.102248907 CEST	51068	139	192.168.2.7	62.118.253.27
Jul 26, 2024 02:28:04.274110079 CEST	51069	139	192.168.2.7	62.118.132.5
Jul 26, 2024 02:28:04.461651087 CEST	51070	139	192.168.2.7	62.118.249.109
Jul 26, 2024 02:28:04.698173046 CEST	445	51063	62.118.67.53	192.168.2.7
Jul 26, 2024 02:28:04.698285103 CEST	51063	445	192.168.2.7	62.118.67.53
Jul 26, 2024 02:28:04.698380947 CEST	51063	445	192.168.2.7	62.118.67.53
Jul 26, 2024 02:28:04.698770046 CEST	51071	139	192.168.2.7	62.118.67.53
Jul 26, 2024 02:28:04.720160007 CEST	445	51064	62.118.150.40	192.168.2.7
Jul 26, 2024 02:28:04.720283031 CEST	51064	445	192.168.2.7	62.118.150.40
Jul 26, 2024 02:28:04.720362902 CEST	51064	445	192.168.2.7	62.118.150.40
Jul 26, 2024 02:28:04.720633984 CEST	51072	139	192.168.2.7	62.118.150.40
Jul 26, 2024 02:28:04.781713009 CEST	445	51057	62.118.165.34	192.168.2.7
Jul 26, 2024 02:28:04.781881094 CEST	51057	445	192.168.2.7	62.118.165.34
Jul 26, 2024 02:28:04.781989098 CEST	51057	445	192.168.2.7	62.118.165.34
Jul 26, 2024 02:28:04.782259941 CEST	51073	139	192.168.2.7	62.118.165.34
Jul 26, 2024 02:28:04.883739948 CEST	51041	445	192.168.2.7	62.118.78.116
Jul 26, 2024 02:28:04.888694048 CEST	51074	139	192.168.2.7	62.118.78.116
Jul 26, 2024 02:28:05.524801970 CEST	51075	445	192.168.2.7	62.118.253.46
Jul 26, 2024 02:28:05.530091047 CEST	445	51075	62.118.253.46	192.168.2.7
Jul 26, 2024 02:28:05.530319929 CEST	51075	445	192.168.2.7	62.118.253.46
Jul 26, 2024 02:28:05.530319929 CEST	51075	445	192.168.2.7	62.118.253.46
Jul 26, 2024 02:28:05.535279989 CEST	445	51075	62.118.253.46	192.168.2.7
Jul 26, 2024 02:28:05.711604118 CEST	51071	139	192.168.2.7	62.118.67.53
Jul 26, 2024 02:28:05.727233887 CEST	51072	139	192.168.2.7	62.118.150.40
Jul 26, 2024 02:28:05.742878914 CEST	51060	139	192.168.2.7	62.118.143.145
Jul 26, 2024 02:28:05.742897034 CEST	51061	139	192.168.2.7	62.118.147.145
Jul 26, 2024 02:28:05.742901087 CEST	51059	139	192.168.2.7	62.118.153.81
Jul 26, 2024 02:28:05.789962053 CEST	51073	139	192.168.2.7	62.118.165.34
Jul 26, 2024 02:28:05.868694067 CEST	51076	445	192.168.2.7	62.118.78.113
Jul 26, 2024 02:28:05.873641968 CEST	445	51076	62.118.78.113	192.168.2.7
Jul 26, 2024 02:28:05.873770952 CEST	51076	445	192.168.2.7	62.118.78.113
Jul 26, 2024 02:28:05.873867035 CEST	51076	445	192.168.2.7	62.118.78.113
Jul 26, 2024 02:28:05.878797054 CEST	445	51076	62.118.78.113	192.168.2.7
Jul 26, 2024 02:28:05.883479118 CEST	51074	139	192.168.2.7	62.118.78.116
Jul 26, 2024 02:28:06.024171114 CEST	51066	139	192.168.2.7	62.118.140.194
Jul 26, 2024 02:28:06.106009960 CEST	51068	139	192.168.2.7	62.118.253.27
Jul 26, 2024 02:28:06.289803028 CEST	51069	139	192.168.2.7	62.118.132.5
Jul 26, 2024 02:28:06.383691072 CEST	51046	445	192.168.2.7	62.118.155.156
Jul 26, 2024 02:28:06.383713961 CEST	51047	445	192.168.2.7	62.118.138.100
Jul 26, 2024 02:28:06.384016037 CEST	51077	139	192.168.2.7	62.118.155.156
Jul 26, 2024 02:28:06.384028912 CEST	51078	139	192.168.2.7	62.118.138.100
Jul 26, 2024 02:28:06.384200096 CEST	51079	445	192.168.2.7	62.118.95.82
Jul 26, 2024 02:28:06.389101982 CEST	445	51079	62.118.95.82	192.168.2.7
Jul 26, 2024 02:28:06.389257908 CEST	51079	445	192.168.2.7	62.118.95.82
Jul 26, 2024 02:28:06.389431000 CEST	51079	445	192.168.2.7	62.118.95.82
Jul 26, 2024 02:28:06.394305944 CEST	445	51079	62.118.95.82	192.168.2.7
Jul 26, 2024 02:28:06.399559975 CEST	51080	445	192.168.2.7	62.118.253.29
Jul 26, 2024 02:28:06.404474974 CEST	445	51080	62.118.253.29	192.168.2.7
Jul 26, 2024 02:28:06.404613972 CEST	51080	445	192.168.2.7	62.118.253.29
Jul 26, 2024 02:28:06.404716015 CEST	51080	445	192.168.2.7	62.118.253.29
Jul 26, 2024 02:28:06.409449100 CEST	445	51080	62.118.253.29	192.168.2.7
Jul 26, 2024 02:28:06.461685896 CEST	51070	139	192.168.2.7	62.118.249.109
Jul 26, 2024 02:28:06.618325949 CEST	51081	445	192.168.2.7	62.118.78.103
Jul 26, 2024 02:28:06.698389053 CEST	445	51081	62.118.78.103	192.168.2.7
Jul 26, 2024 02:28:06.698560953 CEST	51081	445	192.168.2.7	62.118.78.103
Jul 26, 2024 02:28:06.698676109 CEST	51081	445	192.168.2.7	62.118.78.103
Jul 26, 2024 02:28:06.703502893 CEST	445	51081	62.118.78.103	192.168.2.7
Jul 26, 2024 02:28:06.821024895 CEST	51052	445	192.168.2.7	62.118.253.30
Jul 26, 2024 02:28:06.821275949 CEST	51082	139	192.168.2.7	62.118.253.30
Jul 26, 2024 02:28:06.930516958 CEST	51053	445	192.168.2.7	62.118.249.2
Jul 26, 2024 02:28:06.930810928 CEST	51083	139	192.168.2.7	62.118.249.2
Jul 26, 2024 02:28:07.040302992 CEST	51084	445	192.168.2.7	62.118.138.85
Jul 26, 2024 02:28:07.045478106 CEST	445	51084	62.118.138.85	192.168.2.7
Jul 26, 2024 02:28:07.045650005 CEST	51084	445	192.168.2.7	62.118.138.85
Jul 26, 2024 02:28:07.045751095 CEST	51084	445	192.168.2.7	62.118.138.85
Jul 26, 2024 02:28:07.050806999 CEST	445	51084	62.118.138.85	192.168.2.7
Jul 26, 2024 02:28:07.074898958 CEST	445	51062	62.118.146.241	192.168.2.7
Jul 26, 2024 02:28:07.075066090 CEST	51062	445	192.168.2.7	62.118.146.241
Jul 26, 2024 02:28:07.075095892 CEST	51062	445	192.168.2.7	62.118.146.241
Jul 26, 2024 02:28:07.075452089 CEST	51085	139	192.168.2.7	62.118.146.241
Jul 26, 2024 02:28:07.383500099 CEST	51077	139	192.168.2.7	62.118.155.156
Jul 26, 2024 02:28:07.383506060 CEST	51078	139	192.168.2.7	62.118.138.100
Jul 26, 2024 02:28:07.446109056 CEST	51055	445	192.168.2.7	62.118.78.100
Jul 26, 2024 02:28:07.446389914 CEST	51086	139	192.168.2.7	62.118.78.100
Jul 26, 2024 02:28:07.586697102 CEST	51056	445	192.168.2.7	62.118.136.167
Jul 26, 2024 02:28:07.586950064 CEST	51087	139	192.168.2.7	62.118.136.167
Jul 26, 2024 02:28:07.711662054 CEST	51071	139	192.168.2.7	62.118.67.53
Jul 26, 2024 02:28:07.742959023 CEST	51072	139	192.168.2.7	62.118.150.40
Jul 26, 2024 02:28:07.792057991 CEST	51073	139	192.168.2.7	62.118.165.34
Jul 26, 2024 02:28:07.836630106 CEST	51082	139	192.168.2.7	62.118.253.30
Jul 26, 2024 02:28:07.899126053 CEST	51074	139	192.168.2.7	62.118.78.116
Jul 26, 2024 02:28:07.930362940 CEST	51083	139	192.168.2.7	62.118.249.2
Jul 26, 2024 02:28:08.086674929 CEST	51085	139	192.168.2.7	62.118.146.241
Jul 26, 2024 02:28:08.446125031 CEST	51086	139	192.168.2.7	62.118.78.100
Jul 26, 2024 02:28:08.586898088 CEST	51087	139	192.168.2.7	62.118.136.167
Jul 26, 2024 02:28:08.727859020 CEST	51088	445	192.168.2.7	62.118.147.145
Jul 26, 2024 02:28:08.728022099 CEST	51089	445	192.168.2.7	62.118.143.145
Jul 26, 2024 02:28:08.728096008 CEST	51090	445	192.168.2.7	62.118.153.81
Jul 26, 2024 02:28:08.732830048 CEST	445	51088	62.118.147.145	192.168.2.7
Jul 26, 2024 02:28:08.732851982 CEST	445	51089	62.118.143.145	192.168.2.7
Jul 26, 2024 02:28:08.732867956 CEST	445	51090	62.118.153.81	192.168.2.7
Jul 26, 2024 02:28:08.732975006 CEST	51088	445	192.168.2.7	62.118.147.145
Jul 26, 2024 02:28:08.732975960 CEST	51089	445	192.168.2.7	62.118.143.145
Jul 26, 2024 02:28:08.733007908 CEST	51090	445	192.168.2.7	62.118.153.81
Jul 26, 2024 02:28:08.733028889 CEST	51088	445	192.168.2.7	62.118.147.145
Jul 26, 2024 02:28:08.733079910 CEST	51089	445	192.168.2.7	62.118.143.145
Jul 26, 2024 02:28:08.733131886 CEST	51090	445	192.168.2.7	62.118.153.81
Jul 26, 2024 02:28:08.737929106 CEST	445	51088	62.118.147.145	192.168.2.7
Jul 26, 2024 02:28:08.737940073 CEST	445	51089	62.118.143.145	192.168.2.7
Jul 26, 2024 02:28:08.737952948 CEST	445	51090	62.118.153.81	192.168.2.7
Jul 26, 2024 02:28:08.961741924 CEST	51058	445	192.168.2.7	62.118.150.7
Jul 26, 2024 02:28:08.961744070 CEST	51065	445	192.168.2.7	62.118.132.3
Jul 26, 2024 02:28:08.962008953 CEST	51092	139	192.168.2.7	62.118.150.7
Jul 26, 2024 02:28:08.962014914 CEST	51091	139	192.168.2.7	62.118.132.3
Jul 26, 2024 02:28:09.008929968 CEST	51093	445	192.168.2.7	62.118.140.194
Jul 26, 2024 02:28:09.014007092 CEST	445	51093	62.118.140.194	192.168.2.7
Jul 26, 2024 02:28:09.014236927 CEST	51093	445	192.168.2.7	62.118.140.194
Jul 26, 2024 02:28:09.014339924 CEST	51093	445	192.168.2.7	62.118.140.194
Jul 26, 2024 02:28:09.019201994 CEST	445	51093	62.118.140.194	192.168.2.7
Jul 26, 2024 02:28:09.102524996 CEST	51094	445	192.168.2.7	62.118.253.27
Jul 26, 2024 02:28:09.110225916 CEST	445	51094	62.118.253.27	192.168.2.7
Jul 26, 2024 02:28:09.110320091 CEST	51094	445	192.168.2.7	62.118.253.27
Jul 26, 2024 02:28:09.110389948 CEST	51094	445	192.168.2.7	62.118.253.27
Jul 26, 2024 02:28:09.115194082 CEST	445	51094	62.118.253.27	192.168.2.7
Jul 26, 2024 02:28:09.259017944 CEST	51095	445	192.168.2.7	62.118.132.5
Jul 26, 2024 02:28:09.264286995 CEST	445	51095	62.118.132.5	192.168.2.7
Jul 26, 2024 02:28:09.264450073 CEST	51095	445	192.168.2.7	62.118.132.5
Jul 26, 2024 02:28:09.264580011 CEST	51095	445	192.168.2.7	62.118.132.5
Jul 26, 2024 02:28:09.270365953 CEST	445	51095	62.118.132.5	192.168.2.7
Jul 26, 2024 02:28:09.383588076 CEST	51078	139	192.168.2.7	62.118.138.100
Jul 26, 2024 02:28:09.383606911 CEST	51077	139	192.168.2.7	62.118.155.156
Jul 26, 2024 02:28:09.462111950 CEST	51096	445	192.168.2.7	62.118.249.109
Jul 26, 2024 02:28:09.467006922 CEST	445	51096	62.118.249.109	192.168.2.7
Jul 26, 2024 02:28:09.467119932 CEST	51096	445	192.168.2.7	62.118.249.109
Jul 26, 2024 02:28:09.467181921 CEST	51096	445	192.168.2.7	62.118.249.109
Jul 26, 2024 02:28:09.472001076 CEST	445	51096	62.118.249.109	192.168.2.7
Jul 26, 2024 02:28:09.852291107 CEST	51082	139	192.168.2.7	62.118.253.30
Jul 26, 2024 02:28:09.946038961 CEST	51083	139	192.168.2.7	62.118.249.2
Jul 26, 2024 02:28:09.961627960 CEST	51092	139	192.168.2.7	62.118.150.7
Jul 26, 2024 02:28:09.961630106 CEST	51091	139	192.168.2.7	62.118.132.3
Jul 26, 2024 02:28:10.102279902 CEST	51085	139	192.168.2.7	62.118.146.241
Jul 26, 2024 02:28:10.461815119 CEST	51086	139	192.168.2.7	62.118.78.100
Jul 26, 2024 02:28:10.470082045 CEST	445	51088	62.118.147.145	192.168.2.7
Jul 26, 2024 02:28:10.470243931 CEST	51088	445	192.168.2.7	62.118.147.145
Jul 26, 2024 02:28:10.470340014 CEST	51088	445	192.168.2.7	62.118.147.145
Jul 26, 2024 02:28:10.470645905 CEST	445	51089	62.118.143.145	192.168.2.7
Jul 26, 2024 02:28:10.470726013 CEST	51089	445	192.168.2.7	62.118.143.145
Jul 26, 2024 02:28:10.470813036 CEST	51089	445	192.168.2.7	62.118.143.145
Jul 26, 2024 02:28:10.470825911 CEST	51097	139	192.168.2.7	62.118.147.145
Jul 26, 2024 02:28:10.471240997 CEST	51098	139	192.168.2.7	62.118.143.145
Jul 26, 2024 02:28:10.489773989 CEST	445	51090	62.118.153.81	192.168.2.7
Jul 26, 2024 02:28:10.489921093 CEST	51090	445	192.168.2.7	62.118.153.81
Jul 26, 2024 02:28:10.489972115 CEST	51090	445	192.168.2.7	62.118.153.81
Jul 26, 2024 02:28:10.490266085 CEST	51099	139	192.168.2.7	62.118.153.81
Jul 26, 2024 02:28:10.586916924 CEST	51087	139	192.168.2.7	62.118.136.167
Jul 26, 2024 02:28:10.696521044 CEST	51100	445	192.168.2.7	62.118.67.53
Jul 26, 2024 02:28:10.701411009 CEST	445	51100	62.118.67.53	192.168.2.7
Jul 26, 2024 02:28:10.701533079 CEST	51100	445	192.168.2.7	62.118.67.53
Jul 26, 2024 02:28:10.701664925 CEST	51100	445	192.168.2.7	62.118.67.53
Jul 26, 2024 02:28:10.706429958 CEST	445	51100	62.118.67.53	192.168.2.7
Jul 26, 2024 02:28:10.727634907 CEST	51101	445	192.168.2.7	62.118.150.40
Jul 26, 2024 02:28:10.732654095 CEST	445	51101	62.118.150.40	192.168.2.7
Jul 26, 2024 02:28:10.732728958 CEST	51101	445	192.168.2.7	62.118.150.40
Jul 26, 2024 02:28:10.732923985 CEST	51101	445	192.168.2.7	62.118.150.40
Jul 26, 2024 02:28:10.737740040 CEST	445	51101	62.118.150.40	192.168.2.7
Jul 26, 2024 02:28:10.790033102 CEST	51102	445	192.168.2.7	62.118.165.34
Jul 26, 2024 02:28:10.796646118 CEST	445	51102	62.118.165.34	192.168.2.7
Jul 26, 2024 02:28:10.796751022 CEST	51102	445	192.168.2.7	62.118.165.34
Jul 26, 2024 02:28:10.798033953 CEST	51102	445	192.168.2.7	62.118.165.34
Jul 26, 2024 02:28:10.803762913 CEST	445	51102	62.118.165.34	192.168.2.7
Jul 26, 2024 02:28:10.884088039 CEST	51103	445	192.168.2.7	62.118.78.116
Jul 26, 2024 02:28:10.889029026 CEST	445	51103	62.118.78.116	192.168.2.7
Jul 26, 2024 02:28:10.889134884 CEST	51103	445	192.168.2.7	62.118.78.116
Jul 26, 2024 02:28:10.889220953 CEST	51103	445	192.168.2.7	62.118.78.116
Jul 26, 2024 02:28:10.896409035 CEST	445	51103	62.118.78.116	192.168.2.7
Jul 26, 2024 02:28:11.461659908 CEST	51097	139	192.168.2.7	62.118.147.145
Jul 26, 2024 02:28:11.477374077 CEST	51098	139	192.168.2.7	62.118.143.145
Jul 26, 2024 02:28:11.492908955 CEST	51099	139	192.168.2.7	62.118.153.81
Jul 26, 2024 02:28:11.541488886 CEST	51075	445	192.168.2.7	62.118.253.46
Jul 26, 2024 02:28:11.541699886 CEST	51105	139	192.168.2.7	62.118.253.46
Jul 26, 2024 02:28:11.884196997 CEST	51076	445	192.168.2.7	62.118.78.113
Jul 26, 2024 02:28:11.884507895 CEST	51106	139	192.168.2.7	62.118.78.113
Jul 26, 2024 02:28:11.961623907 CEST	51091	139	192.168.2.7	62.118.132.3
Jul 26, 2024 02:28:11.962044954 CEST	51092	139	192.168.2.7	62.118.150.7
Jul 26, 2024 02:28:12.399277925 CEST	51079	445	192.168.2.7	62.118.95.82
Jul 26, 2024 02:28:12.399564028 CEST	51107	139	192.168.2.7	62.118.95.82
Jul 26, 2024 02:28:12.399621010 CEST	51108	445	192.168.2.7	62.118.138.100
Jul 26, 2024 02:28:12.399667025 CEST	51080	445	192.168.2.7	62.118.253.29
Jul 26, 2024 02:28:12.399772882 CEST	51110	139	192.168.2.7	62.118.253.29
Jul 26, 2024 02:28:12.399779081 CEST	51109	445	192.168.2.7	62.118.155.156
Jul 26, 2024 02:28:12.406759977 CEST	445	51108	62.118.138.100	192.168.2.7
Jul 26, 2024 02:28:12.406919003 CEST	51108	445	192.168.2.7	62.118.138.100
Jul 26, 2024 02:28:12.407001019 CEST	51108	445	192.168.2.7	62.118.138.100
Jul 26, 2024 02:28:12.407103062 CEST	445	51109	62.118.155.156	192.168.2.7
Jul 26, 2024 02:28:12.407208920 CEST	51109	445	192.168.2.7	62.118.155.156
Jul 26, 2024 02:28:12.407244921 CEST	51109	445	192.168.2.7	62.118.155.156
Jul 26, 2024 02:28:12.419120073 CEST	445	51108	62.118.138.100	192.168.2.7
Jul 26, 2024 02:28:12.419272900 CEST	445	51109	62.118.155.156	192.168.2.7
Jul 26, 2024 02:28:12.432593107 CEST	445	51100	62.118.67.53	192.168.2.7
Jul 26, 2024 02:28:12.432684898 CEST	51100	445	192.168.2.7	62.118.67.53
Jul 26, 2024 02:28:12.432764053 CEST	51100	445	192.168.2.7	62.118.67.53
Jul 26, 2024 02:28:12.433144093 CEST	51111	139	192.168.2.7	62.118.67.53
Jul 26, 2024 02:28:12.463177919 CEST	445	51101	62.118.150.40	192.168.2.7
Jul 26, 2024 02:28:12.463228941 CEST	51101	445	192.168.2.7	62.118.150.40
Jul 26, 2024 02:28:12.463315010 CEST	51101	445	192.168.2.7	62.118.150.40
Jul 26, 2024 02:28:12.463572025 CEST	51112	139	192.168.2.7	62.118.150.40
Jul 26, 2024 02:28:12.555392981 CEST	51105	139	192.168.2.7	62.118.253.46
Jul 26, 2024 02:28:12.627074003 CEST	445	51102	62.118.165.34	192.168.2.7
Jul 26, 2024 02:28:12.627266884 CEST	51102	445	192.168.2.7	62.118.165.34
Jul 26, 2024 02:28:12.627305031 CEST	51102	445	192.168.2.7	62.118.165.34
Jul 26, 2024 02:28:12.627551079 CEST	51113	139	192.168.2.7	62.118.165.34
Jul 26, 2024 02:28:12.696203947 CEST	51081	445	192.168.2.7	62.118.78.103
Jul 26, 2024 02:28:12.696634054 CEST	51114	139	192.168.2.7	62.118.78.103
Jul 26, 2024 02:28:12.821367979 CEST	51115	445	192.168.2.7	62.118.253.30
Jul 26, 2024 02:28:12.826313972 CEST	445	51115	62.118.253.30	192.168.2.7
Jul 26, 2024 02:28:12.826421022 CEST	51115	445	192.168.2.7	62.118.253.30
Jul 26, 2024 02:28:12.826524019 CEST	51115	445	192.168.2.7	62.118.253.30
Jul 26, 2024 02:28:12.831252098 CEST	445	51115	62.118.253.30	192.168.2.7
Jul 26, 2024 02:28:12.899269104 CEST	51106	139	192.168.2.7	62.118.78.113
Jul 26, 2024 02:28:12.947036982 CEST	51116	445	192.168.2.7	62.118.249.2
Jul 26, 2024 02:28:12.952048063 CEST	445	51116	62.118.249.2	192.168.2.7
Jul 26, 2024 02:28:12.952171087 CEST	51116	445	192.168.2.7	62.118.249.2
Jul 26, 2024 02:28:12.952255964 CEST	51116	445	192.168.2.7	62.118.249.2
Jul 26, 2024 02:28:12.957003117 CEST	445	51116	62.118.249.2	192.168.2.7
Jul 26, 2024 02:28:13.055741072 CEST	51084	445	192.168.2.7	62.118.138.85
Jul 26, 2024 02:28:13.055746078 CEST	51117	139	192.168.2.7	62.118.138.85
Jul 26, 2024 02:28:13.086911917 CEST	51118	445	192.168.2.7	62.118.146.241
Jul 26, 2024 02:28:13.092005968 CEST	445	51118	62.118.146.241	192.168.2.7
Jul 26, 2024 02:28:13.092086077 CEST	51118	445	192.168.2.7	62.118.146.241
Jul 26, 2024 02:28:13.092430115 CEST	51118	445	192.168.2.7	62.118.146.241
Jul 26, 2024 02:28:13.101772070 CEST	445	51118	62.118.146.241	192.168.2.7
Jul 26, 2024 02:28:13.414849997 CEST	51107	139	192.168.2.7	62.118.95.82
Jul 26, 2024 02:28:13.414947033 CEST	51110	139	192.168.2.7	62.118.253.29
Jul 26, 2024 02:28:13.446141005 CEST	51111	139	192.168.2.7	62.118.67.53
Jul 26, 2024 02:28:13.446428061 CEST	51119	445	192.168.2.7	62.118.78.100
Jul 26, 2024 02:28:13.453895092 CEST	445	51119	62.118.78.100	192.168.2.7
Jul 26, 2024 02:28:13.454054117 CEST	51119	445	192.168.2.7	62.118.78.100
Jul 26, 2024 02:28:13.454256058 CEST	51119	445	192.168.2.7	62.118.78.100
Jul 26, 2024 02:28:13.460568905 CEST	445	51119	62.118.78.100	192.168.2.7
Jul 26, 2024 02:28:13.461644888 CEST	51097	139	192.168.2.7	62.118.147.145
Jul 26, 2024 02:28:13.477356911 CEST	51112	139	192.168.2.7	62.118.150.40
Jul 26, 2024 02:28:13.478146076 CEST	51098	139	192.168.2.7	62.118.143.145
Jul 26, 2024 02:28:13.494054079 CEST	51099	139	192.168.2.7	62.118.153.81
Jul 26, 2024 02:28:13.602586985 CEST	51120	445	192.168.2.7	62.118.136.167
Jul 26, 2024 02:28:13.607764006 CEST	445	51120	62.118.136.167	192.168.2.7
Jul 26, 2024 02:28:13.607825994 CEST	51120	445	192.168.2.7	62.118.136.167
Jul 26, 2024 02:28:13.607907057 CEST	51120	445	192.168.2.7	62.118.136.167
Jul 26, 2024 02:28:13.612756968 CEST	445	51120	62.118.136.167	192.168.2.7
Jul 26, 2024 02:28:13.617892027 CEST	51113	139	192.168.2.7	62.118.165.34
Jul 26, 2024 02:28:13.711677074 CEST	51114	139	192.168.2.7	62.118.78.103
Jul 26, 2024 02:28:14.071059942 CEST	51117	139	192.168.2.7	62.118.138.85
Jul 26, 2024 02:28:14.571018934 CEST	51105	139	192.168.2.7	62.118.253.46
Jul 26, 2024 02:28:14.847449064 CEST	445	51118	62.118.146.241	192.168.2.7
Jul 26, 2024 02:28:14.847568989 CEST	51118	445	192.168.2.7	62.118.146.241
Jul 26, 2024 02:28:14.847606897 CEST	51118	445	192.168.2.7	62.118.146.241
Jul 26, 2024 02:28:14.847878933 CEST	51121	139	192.168.2.7	62.118.146.241
Jul 26, 2024 02:28:14.915004969 CEST	51106	139	192.168.2.7	62.118.78.113
Jul 26, 2024 02:28:14.962197065 CEST	51122	445	192.168.2.7	62.118.132.3
Jul 26, 2024 02:28:14.962313890 CEST	51123	445	192.168.2.7	62.118.150.7
Jul 26, 2024 02:28:14.967684984 CEST	445	51122	62.118.132.3	192.168.2.7
Jul 26, 2024 02:28:14.967868090 CEST	445	51123	62.118.150.7	192.168.2.7
Jul 26, 2024 02:28:14.967865944 CEST	51122	445	192.168.2.7	62.118.132.3
Jul 26, 2024 02:28:14.968086004 CEST	51123	445	192.168.2.7	62.118.150.7
Jul 26, 2024 02:28:14.968086004 CEST	51123	445	192.168.2.7	62.118.150.7
Jul 26, 2024 02:28:14.968120098 CEST	51122	445	192.168.2.7	62.118.132.3
Jul 26, 2024 02:28:14.972913027 CEST	445	51123	62.118.150.7	192.168.2.7
Jul 26, 2024 02:28:14.973251104 CEST	445	51122	62.118.132.3	192.168.2.7
Jul 26, 2024 02:28:15.008717060 CEST	51093	445	192.168.2.7	62.118.140.194
Jul 26, 2024 02:28:15.009155989 CEST	51124	139	192.168.2.7	62.118.140.194
Jul 26, 2024 02:28:15.102431059 CEST	51094	445	192.168.2.7	62.118.253.27
Jul 26, 2024 02:28:15.102699995 CEST	51125	139	192.168.2.7	62.118.253.27
Jul 26, 2024 02:28:15.258640051 CEST	51095	445	192.168.2.7	62.118.132.5
Jul 26, 2024 02:28:15.258898020 CEST	51126	139	192.168.2.7	62.118.132.5
Jul 26, 2024 02:28:15.414807081 CEST	51107	139	192.168.2.7	62.118.95.82
Jul 26, 2024 02:28:15.414836884 CEST	51110	139	192.168.2.7	62.118.253.29
Jul 26, 2024 02:28:15.461707115 CEST	51111	139	192.168.2.7	62.118.67.53
Jul 26, 2024 02:28:15.477416992 CEST	51096	445	192.168.2.7	62.118.249.109
Jul 26, 2024 02:28:15.480099916 CEST	51127	139	192.168.2.7	62.118.249.109
Jul 26, 2024 02:28:15.492921114 CEST	51112	139	192.168.2.7	62.118.150.40
Jul 26, 2024 02:28:15.617929935 CEST	51113	139	192.168.2.7	62.118.165.34
Jul 26, 2024 02:28:15.711699009 CEST	51114	139	192.168.2.7	62.118.78.103
Jul 26, 2024 02:28:15.852415085 CEST	51121	139	192.168.2.7	62.118.146.241
Jul 26, 2024 02:28:16.008675098 CEST	51124	139	192.168.2.7	62.118.140.194
Jul 26, 2024 02:28:16.071094036 CEST	51117	139	192.168.2.7	62.118.138.85
Jul 26, 2024 02:28:16.118033886 CEST	51125	139	192.168.2.7	62.118.253.27
Jul 26, 2024 02:28:16.258632898 CEST	51126	139	192.168.2.7	62.118.132.5
Jul 26, 2024 02:28:16.477821112 CEST	51128	445	192.168.2.7	62.118.147.145
Jul 26, 2024 02:28:16.478085995 CEST	51129	445	192.168.2.7	62.118.143.145
Jul 26, 2024 02:28:16.478297949 CEST	51130	445	192.168.2.7	62.118.153.81
Jul 26, 2024 02:28:16.488130093 CEST	445	51128	62.118.147.145	192.168.2.7
Jul 26, 2024 02:28:16.488218069 CEST	51128	445	192.168.2.7	62.118.147.145
Jul 26, 2024 02:28:16.488260031 CEST	51128	445	192.168.2.7	62.118.147.145
Jul 26, 2024 02:28:16.488286018 CEST	445	51129	62.118.143.145	192.168.2.7
Jul 26, 2024 02:28:16.488297939 CEST	445	51130	62.118.153.81	192.168.2.7
Jul 26, 2024 02:28:16.488364935 CEST	51130	445	192.168.2.7	62.118.153.81
Jul 26, 2024 02:28:16.488367081 CEST	51129	445	192.168.2.7	62.118.143.145
Jul 26, 2024 02:28:16.488441944 CEST	51130	445	192.168.2.7	62.118.153.81
Jul 26, 2024 02:28:16.488504887 CEST	51129	445	192.168.2.7	62.118.143.145
Jul 26, 2024 02:28:16.492914915 CEST	51127	139	192.168.2.7	62.118.249.109
Jul 26, 2024 02:28:16.493452072 CEST	445	51128	62.118.147.145	192.168.2.7
Jul 26, 2024 02:28:16.493482113 CEST	445	51130	62.118.153.81	192.168.2.7
Jul 26, 2024 02:28:16.494889021 CEST	445	51129	62.118.143.145	192.168.2.7
Jul 26, 2024 02:28:16.883882046 CEST	51103	445	192.168.2.7	62.118.78.116
Jul 26, 2024 02:28:16.886847973 CEST	51131	139	192.168.2.7	62.118.78.116
Jul 26, 2024 02:28:17.540353060 CEST	51132	445	192.168.2.7	62.118.253.46
Jul 26, 2024 02:28:17.549459934 CEST	445	51132	62.118.253.46	192.168.2.7
Jul 26, 2024 02:28:17.549587011 CEST	51132	445	192.168.2.7	62.118.253.46
Jul 26, 2024 02:28:17.549710035 CEST	51132	445	192.168.2.7	62.118.253.46
Jul 26, 2024 02:28:17.555047989 CEST	445	51132	62.118.253.46	192.168.2.7
Jul 26, 2024 02:28:17.868033886 CEST	51121	139	192.168.2.7	62.118.146.241
Jul 26, 2024 02:28:17.884104967 CEST	51133	445	192.168.2.7	62.118.78.113
Jul 26, 2024 02:28:17.889035940 CEST	445	51133	62.118.78.113	192.168.2.7
Jul 26, 2024 02:28:17.889157057 CEST	51133	445	192.168.2.7	62.118.78.113
Jul 26, 2024 02:28:17.889300108 CEST	51133	445	192.168.2.7	62.118.78.113
Jul 26, 2024 02:28:17.894768953 CEST	445	51133	62.118.78.113	192.168.2.7
Jul 26, 2024 02:28:17.899219990 CEST	51131	139	192.168.2.7	62.118.78.116
Jul 26, 2024 02:28:18.024286032 CEST	51124	139	192.168.2.7	62.118.140.194
Jul 26, 2024 02:28:18.118011951 CEST	51125	139	192.168.2.7	62.118.253.27
Jul 26, 2024 02:28:18.216847897 CEST	445	51129	62.118.143.145	192.168.2.7
Jul 26, 2024 02:28:18.217019081 CEST	51129	445	192.168.2.7	62.118.143.145
Jul 26, 2024 02:28:18.217019081 CEST	51129	445	192.168.2.7	62.118.143.145
Jul 26, 2024 02:28:18.217334032 CEST	51134	139	192.168.2.7	62.118.143.145
Jul 26, 2024 02:28:18.235553980 CEST	445	51128	62.118.147.145	192.168.2.7
Jul 26, 2024 02:28:18.235636950 CEST	51128	445	192.168.2.7	62.118.147.145
Jul 26, 2024 02:28:18.235778093 CEST	51128	445	192.168.2.7	62.118.147.145
Jul 26, 2024 02:28:18.235845089 CEST	51128	445	192.168.2.7	62.118.147.145
Jul 26, 2024 02:28:18.239794016 CEST	445	51130	62.118.153.81	192.168.2.7
Jul 26, 2024 02:28:18.239866972 CEST	51130	445	192.168.2.7	62.118.153.81
Jul 26, 2024 02:28:18.239902973 CEST	51130	445	192.168.2.7	62.118.153.81
Jul 26, 2024 02:28:18.240081072 CEST	51135	139	192.168.2.7	62.118.153.81
Jul 26, 2024 02:28:18.240801096 CEST	445	51128	62.118.147.145	192.168.2.7
Jul 26, 2024 02:28:18.240814924 CEST	445	51128	62.118.147.145	192.168.2.7
Jul 26, 2024 02:28:18.240829945 CEST	445	51128	62.118.147.145	192.168.2.7
Jul 26, 2024 02:28:18.240839958 CEST	445	51128	62.118.147.145	192.168.2.7
Jul 26, 2024 02:28:18.274199963 CEST	51126	139	192.168.2.7	62.118.132.5
Jul 26, 2024 02:28:18.414885998 CEST	51109	445	192.168.2.7	62.118.155.156
Jul 26, 2024 02:28:18.415034056 CEST	51108	445	192.168.2.7	62.118.138.100
Jul 26, 2024 02:28:18.415188074 CEST	51136	139	192.168.2.7	62.118.155.156
Jul 26, 2024 02:28:18.415286064 CEST	51137	139	192.168.2.7	62.118.138.100
Jul 26, 2024 02:28:18.415425062 CEST	51138	445	192.168.2.7	62.118.95.82
Jul 26, 2024 02:28:18.415501118 CEST	51139	445	192.168.2.7	62.118.253.29
Jul 26, 2024 02:28:18.420291901 CEST	445	51138	62.118.95.82	192.168.2.7
Jul 26, 2024 02:28:18.420309067 CEST	445	51139	62.118.253.29	192.168.2.7
Jul 26, 2024 02:28:18.420538902 CEST	51139	445	192.168.2.7	62.118.253.29
Jul 26, 2024 02:28:18.420541048 CEST	51138	445	192.168.2.7	62.118.95.82
Jul 26, 2024 02:28:18.420538902 CEST	51139	445	192.168.2.7	62.118.253.29
Jul 26, 2024 02:28:18.420541048 CEST	51138	445	192.168.2.7	62.118.95.82
Jul 26, 2024 02:28:18.425406933 CEST	445	51138	62.118.95.82	192.168.2.7
Jul 26, 2024 02:28:18.425432920 CEST	445	51139	62.118.253.29	192.168.2.7
Jul 26, 2024 02:28:18.430936098 CEST	51140	445	192.168.2.7	62.118.67.53
Jul 26, 2024 02:28:18.436355114 CEST	445	51140	62.118.67.53	192.168.2.7
Jul 26, 2024 02:28:18.436448097 CEST	51140	445	192.168.2.7	62.118.67.53
Jul 26, 2024 02:28:18.436503887 CEST	51140	445	192.168.2.7	62.118.67.53
Jul 26, 2024 02:28:18.442049026 CEST	445	51140	62.118.67.53	192.168.2.7
Jul 26, 2024 02:28:18.462131977 CEST	51141	445	192.168.2.7	62.118.150.40
Jul 26, 2024 02:28:18.467128038 CEST	445	51141	62.118.150.40	192.168.2.7
Jul 26, 2024 02:28:18.467329979 CEST	51141	445	192.168.2.7	62.118.150.40
Jul 26, 2024 02:28:18.467329979 CEST	51141	445	192.168.2.7	62.118.150.40
Jul 26, 2024 02:28:18.472131014 CEST	445	51141	62.118.150.40	192.168.2.7
Jul 26, 2024 02:28:18.493235111 CEST	51127	139	192.168.2.7	62.118.249.109
Jul 26, 2024 02:28:18.634932041 CEST	51142	445	192.168.2.7	62.118.165.34
Jul 26, 2024 02:28:18.639971018 CEST	445	51142	62.118.165.34	192.168.2.7
Jul 26, 2024 02:28:18.640050888 CEST	51142	445	192.168.2.7	62.118.165.34
Jul 26, 2024 02:28:18.640125036 CEST	51142	445	192.168.2.7	62.118.165.34
Jul 26, 2024 02:28:18.645055056 CEST	445	51142	62.118.165.34	192.168.2.7
Jul 26, 2024 02:28:18.712125063 CEST	51143	445	192.168.2.7	62.118.78.103
Jul 26, 2024 02:28:18.717066050 CEST	445	51143	62.118.78.103	192.168.2.7
Jul 26, 2024 02:28:18.717278957 CEST	51143	445	192.168.2.7	62.118.78.103
Jul 26, 2024 02:28:18.717381001 CEST	51143	445	192.168.2.7	62.118.78.103
Jul 26, 2024 02:28:18.722136021 CEST	445	51143	62.118.78.103	192.168.2.7
Jul 26, 2024 02:28:18.821101904 CEST	51115	445	192.168.2.7	62.118.253.30
Jul 26, 2024 02:28:18.821333885 CEST	51144	139	192.168.2.7	62.118.253.30
Jul 26, 2024 02:28:18.961920977 CEST	51116	445	192.168.2.7	62.118.249.2
Jul 26, 2024 02:28:18.962042093 CEST	51145	139	192.168.2.7	62.118.249.2
Jul 26, 2024 02:28:19.055840015 CEST	51146	445	192.168.2.7	62.118.138.85
Jul 26, 2024 02:28:19.060920954 CEST	445	51146	62.118.138.85	192.168.2.7
Jul 26, 2024 02:28:19.061053038 CEST	51146	445	192.168.2.7	62.118.138.85
Jul 26, 2024 02:28:19.061113119 CEST	51146	445	192.168.2.7	62.118.138.85
Jul 26, 2024 02:28:19.066011906 CEST	445	51146	62.118.138.85	192.168.2.7
Jul 26, 2024 02:28:19.227336884 CEST	51134	139	192.168.2.7	62.118.143.145
Jul 26, 2024 02:28:19.243047953 CEST	51135	139	192.168.2.7	62.118.153.81
Jul 26, 2024 02:28:19.414805889 CEST	51137	139	192.168.2.7	62.118.138.100
Jul 26, 2024 02:28:19.414827108 CEST	51136	139	192.168.2.7	62.118.155.156
Jul 26, 2024 02:28:19.461735010 CEST	51119	445	192.168.2.7	62.118.78.100
Jul 26, 2024 02:28:19.462054968 CEST	51147	139	192.168.2.7	62.118.78.100
Jul 26, 2024 02:28:19.602452040 CEST	51120	445	192.168.2.7	62.118.136.167
Jul 26, 2024 02:28:19.602797031 CEST	51148	139	192.168.2.7	62.118.136.167
Jul 26, 2024 02:28:19.821093082 CEST	51144	139	192.168.2.7	62.118.253.30
Jul 26, 2024 02:28:19.914897919 CEST	51131	139	192.168.2.7	62.118.78.116
Jul 26, 2024 02:28:19.962048054 CEST	51145	139	192.168.2.7	62.118.249.2
Jul 26, 2024 02:28:20.203119040 CEST	445	51140	62.118.67.53	192.168.2.7
Jul 26, 2024 02:28:20.203349113 CEST	51140	445	192.168.2.7	62.118.67.53
Jul 26, 2024 02:28:20.203452110 CEST	51140	445	192.168.2.7	62.118.67.53
Jul 26, 2024 02:28:20.203483105 CEST	51140	445	192.168.2.7	62.118.67.53
Jul 26, 2024 02:28:20.209799051 CEST	445	51140	62.118.67.53	192.168.2.7
Jul 26, 2024 02:28:20.209825039 CEST	445	51140	62.118.67.53	192.168.2.7
Jul 26, 2024 02:28:20.209835052 CEST	445	51140	62.118.67.53	192.168.2.7
Jul 26, 2024 02:28:20.209844112 CEST	445	51140	62.118.67.53	192.168.2.7
Jul 26, 2024 02:28:20.243381977 CEST	445	51141	62.118.150.40	192.168.2.7
Jul 26, 2024 02:28:20.243577003 CEST	51141	445	192.168.2.7	62.118.150.40
Jul 26, 2024 02:28:20.243577003 CEST	51141	445	192.168.2.7	62.118.150.40
Jul 26, 2024 02:28:20.243803978 CEST	51149	139	192.168.2.7	62.118.150.40
Jul 26, 2024 02:28:20.250436068 CEST	51150	9988	192.168.2.7	62.118.147.145
Jul 26, 2024 02:28:20.256474018 CEST	9988	51150	62.118.147.145	192.168.2.7
Jul 26, 2024 02:28:20.256561041 CEST	51150	9988	192.168.2.7	62.118.147.145
Jul 26, 2024 02:28:20.338193893 CEST	51150	9988	192.168.2.7	62.118.147.145
Jul 26, 2024 02:28:20.338275909 CEST	51150	9988	192.168.2.7	62.118.147.145
Jul 26, 2024 02:28:20.338355064 CEST	51150	9988	192.168.2.7	62.118.147.145
Jul 26, 2024 02:28:20.338423967 CEST	51150	9988	192.168.2.7	62.118.147.145
Jul 26, 2024 02:28:20.338500023 CEST	51150	9988	192.168.2.7	62.118.147.145
Jul 26, 2024 02:28:20.338571072 CEST	51150	9988	192.168.2.7	62.118.147.145
Jul 26, 2024 02:28:20.338654995 CEST	51150	9988	192.168.2.7	62.118.147.145
Jul 26, 2024 02:28:20.338737965 CEST	51150	9988	192.168.2.7	62.118.147.145
Jul 26, 2024 02:28:20.338819981 CEST	51150	9988	192.168.2.7	62.118.147.145
Jul 26, 2024 02:28:20.338902950 CEST	51150	9988	192.168.2.7	62.118.147.145
Jul 26, 2024 02:28:20.338988066 CEST	51150	9988	192.168.2.7	62.118.147.145
Jul 26, 2024 02:28:20.345038891 CEST	9988	51150	62.118.147.145	192.168.2.7
Jul 26, 2024 02:28:20.345055103 CEST	9988	51150	62.118.147.145	192.168.2.7
Jul 26, 2024 02:28:20.345065117 CEST	9988	51150	62.118.147.145	192.168.2.7
Jul 26, 2024 02:28:20.345120907 CEST	9988	51150	62.118.147.145	192.168.2.7
Jul 26, 2024 02:28:20.345129013 CEST	51150	9988	192.168.2.7	62.118.147.145
Jul 26, 2024 02:28:20.345146894 CEST	51150	9988	192.168.2.7	62.118.147.145
Jul 26, 2024 02:28:20.345182896 CEST	51150	9988	192.168.2.7	62.118.147.145
Jul 26, 2024 02:28:20.345377922 CEST	9988	51150	62.118.147.145	192.168.2.7
Jul 26, 2024 02:28:20.345387936 CEST	9988	51150	62.118.147.145	192.168.2.7
Jul 26, 2024 02:28:20.345398903 CEST	9988	51150	62.118.147.145	192.168.2.7
Jul 26, 2024 02:28:20.345432997 CEST	51150	9988	192.168.2.7	62.118.147.145
Jul 26, 2024 02:28:20.345443964 CEST	9988	51150	62.118.147.145	192.168.2.7
Jul 26, 2024 02:28:20.345444918 CEST	51150	9988	192.168.2.7	62.118.147.145
Jul 26, 2024 02:28:20.345453024 CEST	9988	51150	62.118.147.145	192.168.2.7
Jul 26, 2024 02:28:20.345462084 CEST	9988	51150	62.118.147.145	192.168.2.7
Jul 26, 2024 02:28:20.345479012 CEST	9988	51150	62.118.147.145	192.168.2.7
Jul 26, 2024 02:28:20.345488071 CEST	9988	51150	62.118.147.145	192.168.2.7
Jul 26, 2024 02:28:20.345498085 CEST	9988	51150	62.118.147.145	192.168.2.7
Jul 26, 2024 02:28:20.345500946 CEST	51150	9988	192.168.2.7	62.118.147.145
Jul 26, 2024 02:28:20.345508099 CEST	9988	51150	62.118.147.145	192.168.2.7
Jul 26, 2024 02:28:20.345513105 CEST	51150	9988	192.168.2.7	62.118.147.145
Jul 26, 2024 02:28:20.345516920 CEST	9988	51150	62.118.147.145	192.168.2.7
Jul 26, 2024 02:28:20.345529079 CEST	9988	51150	62.118.147.145	192.168.2.7
Jul 26, 2024 02:28:20.345537901 CEST	51150	9988	192.168.2.7	62.118.147.145
Jul 26, 2024 02:28:20.345547915 CEST	9988	51150	62.118.147.145	192.168.2.7
Jul 26, 2024 02:28:20.345571041 CEST	51150	9988	192.168.2.7	62.118.147.145
Jul 26, 2024 02:28:20.345643997 CEST	51150	9988	192.168.2.7	62.118.147.145
Jul 26, 2024 02:28:20.345675945 CEST	51150	9988	192.168.2.7	62.118.147.145
Jul 26, 2024 02:28:20.345745087 CEST	9988	51150	62.118.147.145	192.168.2.7
Jul 26, 2024 02:28:20.345798016 CEST	51150	9988	192.168.2.7	62.118.147.145
Jul 26, 2024 02:28:20.351011992 CEST	9988	51150	62.118.147.145	192.168.2.7
Jul 26, 2024 02:28:20.351095915 CEST	51150	9988	192.168.2.7	62.118.147.145
Jul 26, 2024 02:28:20.351130962 CEST	9988	51150	62.118.147.145	192.168.2.7
Jul 26, 2024 02:28:20.351187944 CEST	51150	9988	192.168.2.7	62.118.147.145
Jul 26, 2024 02:28:20.351187944 CEST	51150	9988	192.168.2.7	62.118.147.145
Jul 26, 2024 02:28:20.398929119 CEST	9988	51150	62.118.147.145	192.168.2.7
Jul 26, 2024 02:28:20.399295092 CEST	51150	9988	192.168.2.7	62.118.147.145
Jul 26, 2024 02:28:20.399424076 CEST	51150	9988	192.168.2.7	62.118.147.145
Jul 26, 2024 02:28:20.399529934 CEST	51150	9988	192.168.2.7	62.118.147.145
Jul 26, 2024 02:28:20.414805889 CEST	51150	9988	192.168.2.7	62.118.147.145
Jul 26, 2024 02:28:20.446079969 CEST	445	51142	62.118.165.34	192.168.2.7
Jul 26, 2024 02:28:20.446199894 CEST	51142	445	192.168.2.7	62.118.165.34
Jul 26, 2024 02:28:20.446252108 CEST	51142	445	192.168.2.7	62.118.165.34
Jul 26, 2024 02:28:20.446507931 CEST	51151	139	192.168.2.7	62.118.165.34
Jul 26, 2024 02:28:20.446949005 CEST	9988	51150	62.118.147.145	192.168.2.7
Jul 26, 2024 02:28:20.477282047 CEST	51147	139	192.168.2.7	62.118.78.100
Jul 26, 2024 02:28:20.618032932 CEST	51148	139	192.168.2.7	62.118.136.167
Jul 26, 2024 02:28:20.758614063 CEST	51150	9988	192.168.2.7	62.118.147.145
Jul 26, 2024 02:28:20.763514996 CEST	9988	51150	62.118.147.145	192.168.2.7
Jul 26, 2024 02:28:20.852739096 CEST	51152	445	192.168.2.7	62.118.146.241
Jul 26, 2024 02:28:20.857939005 CEST	445	51152	62.118.146.241	192.168.2.7
Jul 26, 2024 02:28:20.858037949 CEST	51152	445	192.168.2.7	62.118.146.241
Jul 26, 2024 02:28:20.858131886 CEST	51152	445	192.168.2.7	62.118.146.241
Jul 26, 2024 02:28:20.862906933 CEST	445	51152	62.118.146.241	192.168.2.7
Jul 26, 2024 02:28:20.977452040 CEST	51123	445	192.168.2.7	62.118.150.7
Jul 26, 2024 02:28:20.977714062 CEST	51153	139	192.168.2.7	62.118.150.7
Jul 26, 2024 02:28:20.977745056 CEST	51122	445	192.168.2.7	62.118.132.3
Jul 26, 2024 02:28:20.977864027 CEST	51154	139	192.168.2.7	62.118.132.3
Jul 26, 2024 02:28:21.024461985 CEST	51155	445	192.168.2.7	62.118.140.194
Jul 26, 2024 02:28:21.030569077 CEST	445	51155	62.118.140.194	192.168.2.7
Jul 26, 2024 02:28:21.030642986 CEST	51155	445	192.168.2.7	62.118.140.194
Jul 26, 2024 02:28:21.030715942 CEST	51155	445	192.168.2.7	62.118.140.194
Jul 26, 2024 02:28:21.035641909 CEST	445	51155	62.118.140.194	192.168.2.7
Jul 26, 2024 02:28:21.118385077 CEST	51156	445	192.168.2.7	62.118.253.27
Jul 26, 2024 02:28:21.123342037 CEST	445	51156	62.118.253.27	192.168.2.7
Jul 26, 2024 02:28:21.123449087 CEST	51156	445	192.168.2.7	62.118.253.27
Jul 26, 2024 02:28:21.123528004 CEST	51156	445	192.168.2.7	62.118.253.27
Jul 26, 2024 02:28:21.129300117 CEST	445	51156	62.118.253.27	192.168.2.7
Jul 26, 2024 02:28:21.243010044 CEST	51134	139	192.168.2.7	62.118.143.145
Jul 26, 2024 02:28:21.258697987 CEST	51135	139	192.168.2.7	62.118.153.81
Jul 26, 2024 02:28:21.258722067 CEST	51149	139	192.168.2.7	62.118.150.40
Jul 26, 2024 02:28:21.274686098 CEST	51157	445	192.168.2.7	62.118.132.5
Jul 26, 2024 02:28:21.279692888 CEST	445	51157	62.118.132.5	192.168.2.7
Jul 26, 2024 02:28:21.279818058 CEST	51157	445	192.168.2.7	62.118.132.5
Jul 26, 2024 02:28:21.279918909 CEST	51157	445	192.168.2.7	62.118.132.5
Jul 26, 2024 02:28:21.284666061 CEST	445	51157	62.118.132.5	192.168.2.7
Jul 26, 2024 02:28:21.367945910 CEST	51150	9988	192.168.2.7	62.118.147.145
Jul 26, 2024 02:28:21.372966051 CEST	9988	51150	62.118.147.145	192.168.2.7
Jul 26, 2024 02:28:21.414870977 CEST	51136	139	192.168.2.7	62.118.155.156
Jul 26, 2024 02:28:21.430486917 CEST	51137	139	192.168.2.7	62.118.138.100
Jul 26, 2024 02:28:21.461707115 CEST	51151	139	192.168.2.7	62.118.165.34
Jul 26, 2024 02:28:21.493493080 CEST	51158	445	192.168.2.7	62.118.249.109
Jul 26, 2024 02:28:21.498647928 CEST	445	51158	62.118.249.109	192.168.2.7
Jul 26, 2024 02:28:21.498753071 CEST	51158	445	192.168.2.7	62.118.249.109
Jul 26, 2024 02:28:21.498852968 CEST	51158	445	192.168.2.7	62.118.249.109
Jul 26, 2024 02:28:21.503870964 CEST	445	51158	62.118.249.109	192.168.2.7
Jul 26, 2024 02:28:21.821281910 CEST	51144	139	192.168.2.7	62.118.253.30
Jul 26, 2024 02:28:21.977372885 CEST	51145	139	192.168.2.7	62.118.249.2
Jul 26, 2024 02:28:21.977880955 CEST	51153	139	192.168.2.7	62.118.150.7
Jul 26, 2024 02:28:21.992986917 CEST	51154	139	192.168.2.7	62.118.132.3
Jul 26, 2024 02:28:22.027802944 CEST	9988	51150	62.118.147.145	192.168.2.7
Jul 26, 2024 02:28:22.033324957 CEST	51159	139	192.168.2.7	62.118.147.145
Jul 26, 2024 02:28:22.212115049 CEST	51160	9988	192.168.2.7	62.118.67.53
Jul 26, 2024 02:28:22.217073917 CEST	9988	51160	62.118.67.53	192.168.2.7
Jul 26, 2024 02:28:22.217140913 CEST	51160	9988	192.168.2.7	62.118.67.53
Jul 26, 2024 02:28:22.291019917 CEST	51160	9988	192.168.2.7	62.118.67.53
Jul 26, 2024 02:28:22.291109085 CEST	51160	9988	192.168.2.7	62.118.67.53
Jul 26, 2024 02:28:22.291155100 CEST	51160	9988	192.168.2.7	62.118.67.53
Jul 26, 2024 02:28:22.291212082 CEST	51160	9988	192.168.2.7	62.118.67.53
Jul 26, 2024 02:28:22.291285992 CEST	51160	9988	192.168.2.7	62.118.67.53
Jul 26, 2024 02:28:22.291361094 CEST	51160	9988	192.168.2.7	62.118.67.53
Jul 26, 2024 02:28:22.291426897 CEST	51160	9988	192.168.2.7	62.118.67.53
Jul 26, 2024 02:28:22.291507006 CEST	51160	9988	192.168.2.7	62.118.67.53
Jul 26, 2024 02:28:22.291572094 CEST	51160	9988	192.168.2.7	62.118.67.53
Jul 26, 2024 02:28:22.291644096 CEST	51160	9988	192.168.2.7	62.118.67.53
Jul 26, 2024 02:28:22.291712046 CEST	51160	9988	192.168.2.7	62.118.67.53
Jul 26, 2024 02:28:22.295844078 CEST	9988	51160	62.118.67.53	192.168.2.7
Jul 26, 2024 02:28:22.295921087 CEST	9988	51160	62.118.67.53	192.168.2.7
Jul 26, 2024 02:28:22.295937061 CEST	51160	9988	192.168.2.7	62.118.67.53
Jul 26, 2024 02:28:22.295979977 CEST	9988	51160	62.118.67.53	192.168.2.7
Jul 26, 2024 02:28:22.295985937 CEST	51160	9988	192.168.2.7	62.118.67.53
Jul 26, 2024 02:28:22.295989990 CEST	9988	51160	62.118.67.53	192.168.2.7
Jul 26, 2024 02:28:22.296003103 CEST	9988	51160	62.118.67.53	192.168.2.7
Jul 26, 2024 02:28:22.296027899 CEST	9988	51160	62.118.67.53	192.168.2.7
Jul 26, 2024 02:28:22.296041965 CEST	51160	9988	192.168.2.7	62.118.67.53
Jul 26, 2024 02:28:22.296083927 CEST	51160	9988	192.168.2.7	62.118.67.53
Jul 26, 2024 02:28:22.296083927 CEST	51160	9988	192.168.2.7	62.118.67.53
Jul 26, 2024 02:28:22.296127081 CEST	51160	9988	192.168.2.7	62.118.67.53
Jul 26, 2024 02:28:22.296154022 CEST	9988	51160	62.118.67.53	192.168.2.7
Jul 26, 2024 02:28:22.296164036 CEST	9988	51160	62.118.67.53	192.168.2.7
Jul 26, 2024 02:28:22.296166897 CEST	9988	51160	62.118.67.53	192.168.2.7
Jul 26, 2024 02:28:22.296204090 CEST	9988	51160	62.118.67.53	192.168.2.7
Jul 26, 2024 02:28:22.296212912 CEST	9988	51160	62.118.67.53	192.168.2.7
Jul 26, 2024 02:28:22.296228886 CEST	51160	9988	192.168.2.7	62.118.67.53
Jul 26, 2024 02:28:22.296228886 CEST	51160	9988	192.168.2.7	62.118.67.53
Jul 26, 2024 02:28:22.296293020 CEST	51160	9988	192.168.2.7	62.118.67.53
Jul 26, 2024 02:28:22.296314955 CEST	9988	51160	62.118.67.53	192.168.2.7
Jul 26, 2024 02:28:22.296324968 CEST	9988	51160	62.118.67.53	192.168.2.7
Jul 26, 2024 02:28:22.296334028 CEST	9988	51160	62.118.67.53	192.168.2.7
Jul 26, 2024 02:28:22.296344995 CEST	9988	51160	62.118.67.53	192.168.2.7
Jul 26, 2024 02:28:22.296386003 CEST	51160	9988	192.168.2.7	62.118.67.53
Jul 26, 2024 02:28:22.296386003 CEST	51160	9988	192.168.2.7	62.118.67.53
Jul 26, 2024 02:28:22.296420097 CEST	51160	9988	192.168.2.7	62.118.67.53
Jul 26, 2024 02:28:22.296458960 CEST	9988	51160	62.118.67.53	192.168.2.7
Jul 26, 2024 02:28:22.296468019 CEST	9988	51160	62.118.67.53	192.168.2.7
Jul 26, 2024 02:28:22.296477079 CEST	9988	51160	62.118.67.53	192.168.2.7
Jul 26, 2024 02:28:22.296526909 CEST	51160	9988	192.168.2.7	62.118.67.53
Jul 26, 2024 02:28:22.296528101 CEST	51160	9988	192.168.2.7	62.118.67.53
Jul 26, 2024 02:28:22.296565056 CEST	51160	9988	192.168.2.7	62.118.67.53
Jul 26, 2024 02:28:22.296566010 CEST	51160	9988	192.168.2.7	62.118.67.53
Jul 26, 2024 02:28:22.296571970 CEST	9988	51160	62.118.67.53	192.168.2.7
Jul 26, 2024 02:28:22.296647072 CEST	51160	9988	192.168.2.7	62.118.67.53
Jul 26, 2024 02:28:22.300820112 CEST	9988	51160	62.118.67.53	192.168.2.7
Jul 26, 2024 02:28:22.300978899 CEST	9988	51160	62.118.67.53	192.168.2.7
Jul 26, 2024 02:28:22.301031113 CEST	51160	9988	192.168.2.7	62.118.67.53
Jul 26, 2024 02:28:22.301194906 CEST	51160	9988	192.168.2.7	62.118.67.53
Jul 26, 2024 02:28:22.342012882 CEST	9988	51160	62.118.67.53	192.168.2.7
Jul 26, 2024 02:28:22.342289925 CEST	51160	9988	192.168.2.7	62.118.67.53
Jul 26, 2024 02:28:22.342355967 CEST	51160	9988	192.168.2.7	62.118.67.53
Jul 26, 2024 02:28:22.342407942 CEST	51160	9988	192.168.2.7	62.118.67.53
Jul 26, 2024 02:28:22.342504025 CEST	51160	9988	192.168.2.7	62.118.67.53
Jul 26, 2024 02:28:22.390064955 CEST	9988	51160	62.118.67.53	192.168.2.7
Jul 26, 2024 02:28:22.492988110 CEST	51147	139	192.168.2.7	62.118.78.100
Jul 26, 2024 02:28:22.592761040 CEST	445	51152	62.118.146.241	192.168.2.7
Jul 26, 2024 02:28:22.592875957 CEST	51152	445	192.168.2.7	62.118.146.241
Jul 26, 2024 02:28:22.592951059 CEST	51152	445	192.168.2.7	62.118.146.241
Jul 26, 2024 02:28:22.593167067 CEST	51161	139	192.168.2.7	62.118.146.241
Jul 26, 2024 02:28:22.617990017 CEST	51148	139	192.168.2.7	62.118.136.167
Jul 26, 2024 02:28:22.696118116 CEST	51160	9988	192.168.2.7	62.118.67.53
Jul 26, 2024 02:28:22.701067924 CEST	9988	51160	62.118.67.53	192.168.2.7
Jul 26, 2024 02:28:22.899806976 CEST	51162	445	192.168.2.7	62.118.78.116
Jul 26, 2024 02:28:22.904709101 CEST	445	51162	62.118.78.116	192.168.2.7
Jul 26, 2024 02:28:22.904834986 CEST	51162	445	192.168.2.7	62.118.78.116
Jul 26, 2024 02:28:22.904932976 CEST	51162	445	192.168.2.7	62.118.78.116
Jul 26, 2024 02:28:22.909693956 CEST	445	51162	62.118.78.116	192.168.2.7
Jul 26, 2024 02:28:23.039865971 CEST	51159	139	192.168.2.7	62.118.147.145
Jul 26, 2024 02:28:23.258579969 CEST	51149	139	192.168.2.7	62.118.150.40
Jul 26, 2024 02:28:23.305424929 CEST	51160	9988	192.168.2.7	62.118.67.53
Jul 26, 2024 02:28:23.310619116 CEST	9988	51160	62.118.67.53	192.168.2.7
Jul 26, 2024 02:28:23.461704016 CEST	51151	139	192.168.2.7	62.118.165.34
Jul 26, 2024 02:28:23.555937052 CEST	51132	445	192.168.2.7	62.118.253.46
Jul 26, 2024 02:28:23.556166887 CEST	51163	139	192.168.2.7	62.118.253.46
Jul 26, 2024 02:28:23.602385044 CEST	51161	139	192.168.2.7	62.118.146.241
Jul 26, 2024 02:28:23.899588108 CEST	51133	445	192.168.2.7	62.118.78.113
Jul 26, 2024 02:28:23.899765968 CEST	51164	139	192.168.2.7	62.118.78.113
Jul 26, 2024 02:28:23.932379961 CEST	9988	51160	62.118.67.53	192.168.2.7
Jul 26, 2024 02:28:23.937370062 CEST	51165	139	192.168.2.7	62.118.67.53
Jul 26, 2024 02:28:23.977550030 CEST	51153	139	192.168.2.7	62.118.150.7
Jul 26, 2024 02:28:23.993033886 CEST	51154	139	192.168.2.7	62.118.132.3
Jul 26, 2024 02:28:24.212234974 CEST	51166	445	192.168.2.7	62.118.143.145
Jul 26, 2024 02:28:24.218463898 CEST	445	51166	62.118.143.145	192.168.2.7
Jul 26, 2024 02:28:24.218574047 CEST	51166	445	192.168.2.7	62.118.143.145
Jul 26, 2024 02:28:24.218628883 CEST	51166	445	192.168.2.7	62.118.143.145
Jul 26, 2024 02:28:24.223582029 CEST	445	51166	62.118.143.145	192.168.2.7
Jul 26, 2024 02:28:24.227634907 CEST	51167	445	192.168.2.7	62.118.153.81
Jul 26, 2024 02:28:24.232506037 CEST	445	51167	62.118.153.81	192.168.2.7
Jul 26, 2024 02:28:24.232600927 CEST	51167	445	192.168.2.7	62.118.153.81
Jul 26, 2024 02:28:24.232676983 CEST	51167	445	192.168.2.7	62.118.153.81
Jul 26, 2024 02:28:24.238444090 CEST	445	51167	62.118.153.81	192.168.2.7
Jul 26, 2024 02:28:24.415051937 CEST	51139	445	192.168.2.7	62.118.253.29
Jul 26, 2024 02:28:24.415349960 CEST	51168	139	192.168.2.7	62.118.253.29
Jul 26, 2024 02:28:24.415383101 CEST	51138	445	192.168.2.7	62.118.95.82
Jul 26, 2024 02:28:24.415528059 CEST	51169	139	192.168.2.7	62.118.95.82
Jul 26, 2024 02:28:24.415684938 CEST	51170	445	192.168.2.7	62.118.138.100
Jul 26, 2024 02:28:24.415811062 CEST	51171	445	192.168.2.7	62.118.155.156
Jul 26, 2024 02:28:24.420691967 CEST	445	51170	62.118.138.100	192.168.2.7
Jul 26, 2024 02:28:24.420708895 CEST	445	51171	62.118.155.156	192.168.2.7
Jul 26, 2024 02:28:24.420835018 CEST	51170	445	192.168.2.7	62.118.138.100
Jul 26, 2024 02:28:24.420835972 CEST	51171	445	192.168.2.7	62.118.155.156
Jul 26, 2024 02:28:24.420897961 CEST	51170	445	192.168.2.7	62.118.138.100
Jul 26, 2024 02:28:24.420928955 CEST	51171	445	192.168.2.7	62.118.155.156
Jul 26, 2024 02:28:24.425739050 CEST	445	51170	62.118.138.100	192.168.2.7
Jul 26, 2024 02:28:24.425764084 CEST	445	51171	62.118.155.156	192.168.2.7
Jul 26, 2024 02:28:24.555473089 CEST	51163	139	192.168.2.7	62.118.253.46
Jul 26, 2024 02:28:24.711915970 CEST	51143	445	192.168.2.7	62.118.78.103
Jul 26, 2024 02:28:24.712107897 CEST	51172	139	192.168.2.7	62.118.78.103
Jul 26, 2024 02:28:24.821518898 CEST	51173	445	192.168.2.7	62.118.253.30
Jul 26, 2024 02:28:24.827754021 CEST	445	51173	62.118.253.30	192.168.2.7
Jul 26, 2024 02:28:24.827857018 CEST	51173	445	192.168.2.7	62.118.253.30
Jul 26, 2024 02:28:24.827944040 CEST	51173	445	192.168.2.7	62.118.253.30
Jul 26, 2024 02:28:24.834127903 CEST	445	51173	62.118.253.30	192.168.2.7
Jul 26, 2024 02:28:24.914858103 CEST	51164	139	192.168.2.7	62.118.78.113
Jul 26, 2024 02:28:24.930512905 CEST	51165	139	192.168.2.7	62.118.67.53
Jul 26, 2024 02:28:24.966072083 CEST	51174	445	192.168.2.7	62.118.249.2
Jul 26, 2024 02:28:24.972182035 CEST	445	51174	62.118.249.2	192.168.2.7
Jul 26, 2024 02:28:24.972371101 CEST	51174	445	192.168.2.7	62.118.249.2
Jul 26, 2024 02:28:24.972371101 CEST	51174	445	192.168.2.7	62.118.249.2
Jul 26, 2024 02:28:24.977327108 CEST	445	51174	62.118.249.2	192.168.2.7
Jul 26, 2024 02:28:25.040015936 CEST	51159	139	192.168.2.7	62.118.147.145
Jul 26, 2024 02:28:25.055594921 CEST	51146	445	192.168.2.7	62.118.138.85
Jul 26, 2024 02:28:25.055860996 CEST	51175	139	192.168.2.7	62.118.138.85
Jul 26, 2024 02:28:25.430505991 CEST	51168	139	192.168.2.7	62.118.253.29
Jul 26, 2024 02:28:25.430510998 CEST	51169	139	192.168.2.7	62.118.95.82
Jul 26, 2024 02:28:25.462121964 CEST	51176	445	192.168.2.7	62.118.78.100
Jul 26, 2024 02:28:25.467365026 CEST	445	51176	62.118.78.100	192.168.2.7
Jul 26, 2024 02:28:25.467572927 CEST	51176	445	192.168.2.7	62.118.78.100
Jul 26, 2024 02:28:25.467725039 CEST	51176	445	192.168.2.7	62.118.78.100
Jul 26, 2024 02:28:25.472920895 CEST	445	51176	62.118.78.100	192.168.2.7
Jul 26, 2024 02:28:25.617995977 CEST	51161	139	192.168.2.7	62.118.146.241
Jul 26, 2024 02:28:25.618402004 CEST	51177	445	192.168.2.7	62.118.136.167
Jul 26, 2024 02:28:25.623429060 CEST	445	51177	62.118.136.167	192.168.2.7
Jul 26, 2024 02:28:25.623519897 CEST	51177	445	192.168.2.7	62.118.136.167
Jul 26, 2024 02:28:25.623615026 CEST	51177	445	192.168.2.7	62.118.136.167
Jul 26, 2024 02:28:25.628416061 CEST	445	51177	62.118.136.167	192.168.2.7
Jul 26, 2024 02:28:25.711783886 CEST	51172	139	192.168.2.7	62.118.78.103
Jul 26, 2024 02:28:25.973191977 CEST	445	51166	62.118.143.145	192.168.2.7
Jul 26, 2024 02:28:25.973393917 CEST	51166	445	192.168.2.7	62.118.143.145
Jul 26, 2024 02:28:25.973495007 CEST	51166	445	192.168.2.7	62.118.143.145
Jul 26, 2024 02:28:25.973561049 CEST	51166	445	192.168.2.7	62.118.143.145
Jul 26, 2024 02:28:25.978544950 CEST	445	51166	62.118.143.145	192.168.2.7
Jul 26, 2024 02:28:25.978557110 CEST	445	51166	62.118.143.145	192.168.2.7
Jul 26, 2024 02:28:25.978568077 CEST	445	51166	62.118.143.145	192.168.2.7
Jul 26, 2024 02:28:25.978807926 CEST	445	51166	62.118.143.145	192.168.2.7
Jul 26, 2024 02:28:25.992235899 CEST	445	51167	62.118.153.81	192.168.2.7
Jul 26, 2024 02:28:25.992316961 CEST	51167	445	192.168.2.7	62.118.153.81
Jul 26, 2024 02:28:26.003762007 CEST	51167	445	192.168.2.7	62.118.153.81
Jul 26, 2024 02:28:26.004041910 CEST	51178	139	192.168.2.7	62.118.153.81
Jul 26, 2024 02:28:26.071130991 CEST	51175	139	192.168.2.7	62.118.138.85
Jul 26, 2024 02:28:26.259049892 CEST	51179	445	192.168.2.7	62.118.150.40
Jul 26, 2024 02:28:26.263998985 CEST	445	51179	62.118.150.40	192.168.2.7
Jul 26, 2024 02:28:26.264085054 CEST	51179	445	192.168.2.7	62.118.150.40
Jul 26, 2024 02:28:26.264229059 CEST	51179	445	192.168.2.7	62.118.150.40
Jul 26, 2024 02:28:26.268994093 CEST	445	51179	62.118.150.40	192.168.2.7
Jul 26, 2024 02:28:26.447809935 CEST	51180	445	192.168.2.7	62.118.165.34
Jul 26, 2024 02:28:26.453080893 CEST	445	51180	62.118.165.34	192.168.2.7
Jul 26, 2024 02:28:26.453197956 CEST	51180	445	192.168.2.7	62.118.165.34
Jul 26, 2024 02:28:26.455910921 CEST	51180	445	192.168.2.7	62.118.165.34
Jul 26, 2024 02:28:26.460771084 CEST	445	51180	62.118.165.34	192.168.2.7
Jul 26, 2024 02:28:26.555509090 CEST	51163	139	192.168.2.7	62.118.253.46
Jul 26, 2024 02:28:26.914863110 CEST	51164	139	192.168.2.7	62.118.78.113
Jul 26, 2024 02:28:26.930491924 CEST	51165	139	192.168.2.7	62.118.67.53
Jul 26, 2024 02:28:26.977724075 CEST	51181	445	192.168.2.7	62.118.132.3
Jul 26, 2024 02:28:26.977883101 CEST	51182	445	192.168.2.7	62.118.150.7
Jul 26, 2024 02:28:26.982724905 CEST	445	51181	62.118.132.3	192.168.2.7
Jul 26, 2024 02:28:26.982767105 CEST	445	51182	62.118.150.7	192.168.2.7
Jul 26, 2024 02:28:26.982944012 CEST	51182	445	192.168.2.7	62.118.150.7
Jul 26, 2024 02:28:26.982944012 CEST	51182	445	192.168.2.7	62.118.150.7
Jul 26, 2024 02:28:26.982975960 CEST	51181	445	192.168.2.7	62.118.132.3
Jul 26, 2024 02:28:26.982975960 CEST	51181	445	192.168.2.7	62.118.132.3
Jul 26, 2024 02:28:26.988075018 CEST	445	51182	62.118.150.7	192.168.2.7
Jul 26, 2024 02:28:26.988090992 CEST	445	51181	62.118.132.3	192.168.2.7
Jul 26, 2024 02:28:26.992981911 CEST	51178	139	192.168.2.7	62.118.153.81
Jul 26, 2024 02:28:27.039899111 CEST	51155	445	192.168.2.7	62.118.140.194
Jul 26, 2024 02:28:27.040199041 CEST	51183	139	192.168.2.7	62.118.140.194
Jul 26, 2024 02:28:27.133745909 CEST	51156	445	192.168.2.7	62.118.253.27
Jul 26, 2024 02:28:27.134036064 CEST	51184	139	192.168.2.7	62.118.253.27
Jul 26, 2024 02:28:27.289910078 CEST	51157	445	192.168.2.7	62.118.132.5
Jul 26, 2024 02:28:27.290208101 CEST	51185	139	192.168.2.7	62.118.132.5
Jul 26, 2024 02:28:27.430501938 CEST	51169	139	192.168.2.7	62.118.95.82
Jul 26, 2024 02:28:27.446140051 CEST	51168	139	192.168.2.7	62.118.253.29
Jul 26, 2024 02:28:27.493043900 CEST	51158	445	192.168.2.7	62.118.249.109
Jul 26, 2024 02:28:27.495471954 CEST	51186	139	192.168.2.7	62.118.249.109
Jul 26, 2024 02:28:27.727497101 CEST	51172	139	192.168.2.7	62.118.78.103
Jul 26, 2024 02:28:27.977930069 CEST	51187	9988	192.168.2.7	62.118.143.145
Jul 26, 2024 02:28:27.982812881 CEST	9988	51187	62.118.143.145	192.168.2.7
Jul 26, 2024 02:28:27.982985020 CEST	51187	9988	192.168.2.7	62.118.143.145
Jul 26, 2024 02:28:28.000996113 CEST	445	51179	62.118.150.40	192.168.2.7
Jul 26, 2024 02:28:28.001066923 CEST	51179	445	192.168.2.7	62.118.150.40
Jul 26, 2024 02:28:28.001111984 CEST	51179	445	192.168.2.7	62.118.150.40
Jul 26, 2024 02:28:28.001363039 CEST	51188	139	192.168.2.7	62.118.150.40
Jul 26, 2024 02:28:28.039844990 CEST	51183	139	192.168.2.7	62.118.140.194
Jul 26, 2024 02:28:28.040193081 CEST	51189	445	192.168.2.7	62.118.147.145
Jul 26, 2024 02:28:28.045033932 CEST	445	51189	62.118.147.145	192.168.2.7
Jul 26, 2024 02:28:28.045101881 CEST	51189	445	192.168.2.7	62.118.147.145
Jul 26, 2024 02:28:28.045197010 CEST	51189	445	192.168.2.7	62.118.147.145
Jul 26, 2024 02:28:28.050057888 CEST	445	51189	62.118.147.145	192.168.2.7
Jul 26, 2024 02:28:28.068926096 CEST	51187	9988	192.168.2.7	62.118.143.145
Jul 26, 2024 02:28:28.069037914 CEST	51187	9988	192.168.2.7	62.118.143.145
Jul 26, 2024 02:28:28.069144964 CEST	51187	9988	192.168.2.7	62.118.143.145
Jul 26, 2024 02:28:28.069247961 CEST	51187	9988	192.168.2.7	62.118.143.145
Jul 26, 2024 02:28:28.069345951 CEST	51187	9988	192.168.2.7	62.118.143.145
Jul 26, 2024 02:28:28.069456100 CEST	51187	9988	192.168.2.7	62.118.143.145
Jul 26, 2024 02:28:28.069578886 CEST	51187	9988	192.168.2.7	62.118.143.145
Jul 26, 2024 02:28:28.069717884 CEST	51187	9988	192.168.2.7	62.118.143.145
Jul 26, 2024 02:28:28.069809914 CEST	51187	9988	192.168.2.7	62.118.143.145
Jul 26, 2024 02:28:28.069993019 CEST	51187	9988	192.168.2.7	62.118.143.145
Jul 26, 2024 02:28:28.070079088 CEST	51187	9988	192.168.2.7	62.118.143.145
Jul 26, 2024 02:28:28.071110964 CEST	51175	139	192.168.2.7	62.118.138.85
Jul 26, 2024 02:28:28.073813915 CEST	9988	51187	62.118.143.145	192.168.2.7
Jul 26, 2024 02:28:28.073842049 CEST	9988	51187	62.118.143.145	192.168.2.7
Jul 26, 2024 02:28:28.073914051 CEST	51187	9988	192.168.2.7	62.118.143.145
Jul 26, 2024 02:28:28.073961973 CEST	51187	9988	192.168.2.7	62.118.143.145
Jul 26, 2024 02:28:28.073996067 CEST	9988	51187	62.118.143.145	192.168.2.7
Jul 26, 2024 02:28:28.074006081 CEST	9988	51187	62.118.143.145	192.168.2.7
Jul 26, 2024 02:28:28.074069977 CEST	51187	9988	192.168.2.7	62.118.143.145
Jul 26, 2024 02:28:28.074084997 CEST	51187	9988	192.168.2.7	62.118.143.145
Jul 26, 2024 02:28:28.074088097 CEST	9988	51187	62.118.143.145	192.168.2.7
Jul 26, 2024 02:28:28.074196100 CEST	9988	51187	62.118.143.145	192.168.2.7
Jul 26, 2024 02:28:28.074207067 CEST	9988	51187	62.118.143.145	192.168.2.7
Jul 26, 2024 02:28:28.074210882 CEST	9988	51187	62.118.143.145	192.168.2.7
Jul 26, 2024 02:28:28.074234009 CEST	9988	51187	62.118.143.145	192.168.2.7
Jul 26, 2024 02:28:28.074270964 CEST	9988	51187	62.118.143.145	192.168.2.7
Jul 26, 2024 02:28:28.074306011 CEST	51187	9988	192.168.2.7	62.118.143.145
Jul 26, 2024 02:28:28.074320078 CEST	51187	9988	192.168.2.7	62.118.143.145
Jul 26, 2024 02:28:28.074320078 CEST	51187	9988	192.168.2.7	62.118.143.145
Jul 26, 2024 02:28:28.074584961 CEST	9988	51187	62.118.143.145	192.168.2.7
Jul 26, 2024 02:28:28.074594975 CEST	9988	51187	62.118.143.145	192.168.2.7
Jul 26, 2024 02:28:28.074604988 CEST	9988	51187	62.118.143.145	192.168.2.7
Jul 26, 2024 02:28:28.074662924 CEST	51187	9988	192.168.2.7	62.118.143.145
Jul 26, 2024 02:28:28.074675083 CEST	51187	9988	192.168.2.7	62.118.143.145
Jul 26, 2024 02:28:28.078886986 CEST	9988	51187	62.118.143.145	192.168.2.7
Jul 26, 2024 02:28:28.078901052 CEST	9988	51187	62.118.143.145	192.168.2.7
Jul 26, 2024 02:28:28.078911066 CEST	9988	51187	62.118.143.145	192.168.2.7
Jul 26, 2024 02:28:28.078921080 CEST	9988	51187	62.118.143.145	192.168.2.7
Jul 26, 2024 02:28:28.078929901 CEST	9988	51187	62.118.143.145	192.168.2.7
Jul 26, 2024 02:28:28.078939915 CEST	9988	51187	62.118.143.145	192.168.2.7
Jul 26, 2024 02:28:28.078958988 CEST	9988	51187	62.118.143.145	192.168.2.7
Jul 26, 2024 02:28:28.078969002 CEST	9988	51187	62.118.143.145	192.168.2.7
Jul 26, 2024 02:28:28.078994989 CEST	9988	51187	62.118.143.145	192.168.2.7
Jul 26, 2024 02:28:28.079027891 CEST	51187	9988	192.168.2.7	62.118.143.145
Jul 26, 2024 02:28:28.079027891 CEST	51187	9988	192.168.2.7	62.118.143.145
Jul 26, 2024 02:28:28.079081059 CEST	51187	9988	192.168.2.7	62.118.143.145
Jul 26, 2024 02:28:28.079081059 CEST	51187	9988	192.168.2.7	62.118.143.145
Jul 26, 2024 02:28:28.079093933 CEST	51187	9988	192.168.2.7	62.118.143.145
Jul 26, 2024 02:28:28.126020908 CEST	9988	51187	62.118.143.145	192.168.2.7
Jul 26, 2024 02:28:28.126506090 CEST	51187	9988	192.168.2.7	62.118.143.145
Jul 26, 2024 02:28:28.126641035 CEST	51187	9988	192.168.2.7	62.118.143.145
Jul 26, 2024 02:28:28.133783102 CEST	51184	139	192.168.2.7	62.118.253.27
Jul 26, 2024 02:28:28.174036026 CEST	9988	51187	62.118.143.145	192.168.2.7
Jul 26, 2024 02:28:28.238791943 CEST	445	51180	62.118.165.34	192.168.2.7
Jul 26, 2024 02:28:28.239069939 CEST	51180	445	192.168.2.7	62.118.165.34
Jul 26, 2024 02:28:28.239128113 CEST	51180	445	192.168.2.7	62.118.165.34
Jul 26, 2024 02:28:28.239367008 CEST	51190	139	192.168.2.7	62.118.165.34
Jul 26, 2024 02:28:28.289896965 CEST	51185	139	192.168.2.7	62.118.132.5
Jul 26, 2024 02:28:28.477441072 CEST	51187	9988	192.168.2.7	62.118.143.145
Jul 26, 2024 02:28:28.482358932 CEST	9988	51187	62.118.143.145	192.168.2.7
Jul 26, 2024 02:28:28.508761883 CEST	51186	139	192.168.2.7	62.118.249.109
Jul 26, 2024 02:28:28.587153912 CEST	51191	445	192.168.2.7	62.118.146.241
Jul 26, 2024 02:28:28.592353106 CEST	445	51191	62.118.146.241	192.168.2.7
Jul 26, 2024 02:28:28.592510939 CEST	51191	445	192.168.2.7	62.118.146.241
Jul 26, 2024 02:28:28.592587948 CEST	51191	445	192.168.2.7	62.118.146.241
Jul 26, 2024 02:28:28.597426891 CEST	445	51191	62.118.146.241	192.168.2.7
Jul 26, 2024 02:28:28.899568081 CEST	51162	445	192.168.2.7	62.118.78.116
Jul 26, 2024 02:28:28.902426958 CEST	51192	139	192.168.2.7	62.118.78.116
Jul 26, 2024 02:28:28.993050098 CEST	51178	139	192.168.2.7	62.118.153.81
Jul 26, 2024 02:28:28.993053913 CEST	51188	139	192.168.2.7	62.118.150.40
Jul 26, 2024 02:28:29.086951017 CEST	51187	9988	192.168.2.7	62.118.143.145
Jul 26, 2024 02:28:29.092209101 CEST	9988	51187	62.118.143.145	192.168.2.7
Jul 26, 2024 02:28:29.227375031 CEST	51190	139	192.168.2.7	62.118.165.34
Jul 26, 2024 02:28:29.555876970 CEST	51193	445	192.168.2.7	62.118.253.46
Jul 26, 2024 02:28:29.571403980 CEST	445	51193	62.118.253.46	192.168.2.7
Jul 26, 2024 02:28:29.571521044 CEST	51193	445	192.168.2.7	62.118.253.46
Jul 26, 2024 02:28:29.571628094 CEST	51193	445	192.168.2.7	62.118.253.46
Jul 26, 2024 02:28:29.576531887 CEST	445	51193	62.118.253.46	192.168.2.7
Jul 26, 2024 02:28:29.703367949 CEST	9988	51187	62.118.143.145	192.168.2.7
Jul 26, 2024 02:28:29.708086967 CEST	51194	139	192.168.2.7	62.118.143.145
Jul 26, 2024 02:28:29.762231112 CEST	445	51189	62.118.147.145	192.168.2.7
Jul 26, 2024 02:28:29.762367010 CEST	51189	445	192.168.2.7	62.118.147.145
Jul 26, 2024 02:28:29.762461901 CEST	51189	445	192.168.2.7	62.118.147.145
Jul 26, 2024 02:28:29.762839079 CEST	51195	139	192.168.2.7	62.118.147.145
Jul 26, 2024 02:28:29.899657965 CEST	51196	445	192.168.2.7	62.118.78.113
Jul 26, 2024 02:28:29.905155897 CEST	445	51196	62.118.78.113	192.168.2.7
Jul 26, 2024 02:28:29.905245066 CEST	51196	445	192.168.2.7	62.118.78.113
Jul 26, 2024 02:28:29.905344963 CEST	51196	445	192.168.2.7	62.118.78.113
Jul 26, 2024 02:28:29.914510012 CEST	445	51196	62.118.78.113	192.168.2.7
Jul 26, 2024 02:28:29.914907932 CEST	51192	139	192.168.2.7	62.118.78.116
Jul 26, 2024 02:28:29.931001902 CEST	51197	445	192.168.2.7	62.118.67.53
Jul 26, 2024 02:28:29.937520981 CEST	445	51197	62.118.67.53	192.168.2.7
Jul 26, 2024 02:28:29.937661886 CEST	51197	445	192.168.2.7	62.118.67.53
Jul 26, 2024 02:28:29.937819958 CEST	51197	445	192.168.2.7	62.118.67.53
Jul 26, 2024 02:28:29.945890903 CEST	445	51197	62.118.67.53	192.168.2.7
Jul 26, 2024 02:28:30.039935112 CEST	51183	139	192.168.2.7	62.118.140.194
Jul 26, 2024 02:28:30.133821011 CEST	51184	139	192.168.2.7	62.118.253.27
Jul 26, 2024 02:28:30.289915085 CEST	51185	139	192.168.2.7	62.118.132.5
Jul 26, 2024 02:28:30.326462030 CEST	445	51191	62.118.146.241	192.168.2.7
Jul 26, 2024 02:28:30.326574087 CEST	51191	445	192.168.2.7	62.118.146.241
Jul 26, 2024 02:28:30.326705933 CEST	51191	445	192.168.2.7	62.118.146.241
Jul 26, 2024 02:28:30.326733112 CEST	51191	445	192.168.2.7	62.118.146.241
Jul 26, 2024 02:28:30.331554890 CEST	445	51191	62.118.146.241	192.168.2.7
Jul 26, 2024 02:28:30.331584930 CEST	445	51191	62.118.146.241	192.168.2.7
Jul 26, 2024 02:28:30.331594944 CEST	445	51191	62.118.146.241	192.168.2.7
Jul 26, 2024 02:28:30.332384109 CEST	445	51191	62.118.146.241	192.168.2.7
Jul 26, 2024 02:28:30.415175915 CEST	51171	445	192.168.2.7	62.118.155.156
Jul 26, 2024 02:28:30.415255070 CEST	51170	445	192.168.2.7	62.118.138.100
Jul 26, 2024 02:28:30.415499926 CEST	51198	139	192.168.2.7	62.118.138.100
Jul 26, 2024 02:28:30.415594101 CEST	51199	139	192.168.2.7	62.118.155.156
Jul 26, 2024 02:28:30.415672064 CEST	51200	445	192.168.2.7	62.118.95.82
Jul 26, 2024 02:28:30.415713072 CEST	51201	445	192.168.2.7	62.118.253.29
Jul 26, 2024 02:28:30.524271965 CEST	51186	139	192.168.2.7	62.118.249.109
Jul 26, 2024 02:28:30.655921936 CEST	445	51200	62.118.95.82	192.168.2.7
Jul 26, 2024 02:28:30.655946970 CEST	445	51201	62.118.253.29	192.168.2.7
Jul 26, 2024 02:28:30.656017065 CEST	51200	445	192.168.2.7	62.118.95.82
Jul 26, 2024 02:28:30.656045914 CEST	51201	445	192.168.2.7	62.118.253.29
Jul 26, 2024 02:28:30.656164885 CEST	51200	445	192.168.2.7	62.118.95.82
Jul 26, 2024 02:28:30.656229019 CEST	51201	445	192.168.2.7	62.118.253.29
Jul 26, 2024 02:28:30.661102057 CEST	445	51200	62.118.95.82	192.168.2.7
Jul 26, 2024 02:28:30.661114931 CEST	445	51201	62.118.253.29	192.168.2.7
Jul 26, 2024 02:28:30.711781979 CEST	51194	139	192.168.2.7	62.118.143.145
Jul 26, 2024 02:28:30.727773905 CEST	51202	445	192.168.2.7	62.118.78.103
Jul 26, 2024 02:28:30.732847929 CEST	445	51202	62.118.78.103	192.168.2.7
Jul 26, 2024 02:28:30.732947111 CEST	51202	445	192.168.2.7	62.118.78.103
Jul 26, 2024 02:28:30.733035088 CEST	51202	445	192.168.2.7	62.118.78.103
Jul 26, 2024 02:28:30.738991022 CEST	445	51202	62.118.78.103	192.168.2.7
Jul 26, 2024 02:28:30.758758068 CEST	51195	139	192.168.2.7	62.118.147.145
Jul 26, 2024 02:28:30.821336031 CEST	51173	445	192.168.2.7	62.118.253.30
Jul 26, 2024 02:28:30.821923018 CEST	51203	139	192.168.2.7	62.118.253.30
Jul 26, 2024 02:28:30.977674961 CEST	51174	445	192.168.2.7	62.118.249.2
Jul 26, 2024 02:28:30.977943897 CEST	51204	139	192.168.2.7	62.118.249.2
Jul 26, 2024 02:28:30.993005037 CEST	51188	139	192.168.2.7	62.118.150.40
Jul 26, 2024 02:28:31.071420908 CEST	51205	445	192.168.2.7	62.118.138.85
Jul 26, 2024 02:28:31.076288939 CEST	445	51205	62.118.138.85	192.168.2.7
Jul 26, 2024 02:28:31.076373100 CEST	51205	445	192.168.2.7	62.118.138.85
Jul 26, 2024 02:28:31.076494932 CEST	51205	445	192.168.2.7	62.118.138.85
Jul 26, 2024 02:28:31.081254005 CEST	445	51205	62.118.138.85	192.168.2.7
Jul 26, 2024 02:28:31.243037939 CEST	51190	139	192.168.2.7	62.118.165.34
Jul 26, 2024 02:28:31.430517912 CEST	51199	139	192.168.2.7	62.118.155.156
Jul 26, 2024 02:28:31.430524111 CEST	51198	139	192.168.2.7	62.118.138.100
Jul 26, 2024 02:28:31.461771965 CEST	51176	445	192.168.2.7	62.118.78.100
Jul 26, 2024 02:28:31.461987972 CEST	51206	139	192.168.2.7	62.118.78.100
Jul 26, 2024 02:28:31.618088007 CEST	51177	445	192.168.2.7	62.118.136.167
Jul 26, 2024 02:28:31.618402958 CEST	51207	139	192.168.2.7	62.118.136.167
Jul 26, 2024 02:28:31.700985909 CEST	445	51197	62.118.67.53	192.168.2.7
Jul 26, 2024 02:28:31.701157093 CEST	51197	445	192.168.2.7	62.118.67.53
Jul 26, 2024 02:28:31.701241016 CEST	51197	445	192.168.2.7	62.118.67.53
Jul 26, 2024 02:28:31.701611042 CEST	51208	139	192.168.2.7	62.118.67.53
Jul 26, 2024 02:28:31.836822987 CEST	51203	139	192.168.2.7	62.118.253.30
Jul 26, 2024 02:28:31.915014982 CEST	51192	139	192.168.2.7	62.118.78.116
Jul 26, 2024 02:28:31.978461981 CEST	51204	139	192.168.2.7	62.118.249.2
Jul 26, 2024 02:28:31.993392944 CEST	51209	445	192.168.2.7	62.118.153.81
Jul 26, 2024 02:28:31.999342918 CEST	445	51209	62.118.153.81	192.168.2.7
Jul 26, 2024 02:28:31.999514103 CEST	51209	445	192.168.2.7	62.118.153.81
Jul 26, 2024 02:28:31.999587059 CEST	51209	445	192.168.2.7	62.118.153.81
Jul 26, 2024 02:28:32.004555941 CEST	445	51209	62.118.153.81	192.168.2.7
Jul 26, 2024 02:28:32.337485075 CEST	51210	9988	192.168.2.7	62.118.146.241
Jul 26, 2024 02:28:32.342643023 CEST	9988	51210	62.118.146.241	192.168.2.7
Jul 26, 2024 02:28:32.342817068 CEST	51210	9988	192.168.2.7	62.118.146.241
Jul 26, 2024 02:28:32.413546085 CEST	51210	9988	192.168.2.7	62.118.146.241
Jul 26, 2024 02:28:32.413614035 CEST	51210	9988	192.168.2.7	62.118.146.241
Jul 26, 2024 02:28:32.413722992 CEST	51210	9988	192.168.2.7	62.118.146.241
Jul 26, 2024 02:28:32.413849115 CEST	51210	9988	192.168.2.7	62.118.146.241
Jul 26, 2024 02:28:32.413944006 CEST	51210	9988	192.168.2.7	62.118.146.241
Jul 26, 2024 02:28:32.414031029 CEST	51210	9988	192.168.2.7	62.118.146.241
Jul 26, 2024 02:28:32.414108992 CEST	51210	9988	192.168.2.7	62.118.146.241
Jul 26, 2024 02:28:32.414196014 CEST	51210	9988	192.168.2.7	62.118.146.241
Jul 26, 2024 02:28:32.414309025 CEST	51210	9988	192.168.2.7	62.118.146.241
Jul 26, 2024 02:28:32.414381027 CEST	51210	9988	192.168.2.7	62.118.146.241
Jul 26, 2024 02:28:32.414457083 CEST	51210	9988	192.168.2.7	62.118.146.241
Jul 26, 2024 02:28:32.418854952 CEST	9988	51210	62.118.146.241	192.168.2.7
Jul 26, 2024 02:28:32.418872118 CEST	9988	51210	62.118.146.241	192.168.2.7
Jul 26, 2024 02:28:32.419038057 CEST	51210	9988	192.168.2.7	62.118.146.241
Jul 26, 2024 02:28:32.419071913 CEST	51210	9988	192.168.2.7	62.118.146.241
Jul 26, 2024 02:28:32.419092894 CEST	9988	51210	62.118.146.241	192.168.2.7
Jul 26, 2024 02:28:32.419107914 CEST	9988	51210	62.118.146.241	192.168.2.7
Jul 26, 2024 02:28:32.419130087 CEST	9988	51210	62.118.146.241	192.168.2.7
Jul 26, 2024 02:28:32.419140100 CEST	9988	51210	62.118.146.241	192.168.2.7
Jul 26, 2024 02:28:32.419183969 CEST	9988	51210	62.118.146.241	192.168.2.7
Jul 26, 2024 02:28:32.419194937 CEST	9988	51210	62.118.146.241	192.168.2.7
Jul 26, 2024 02:28:32.419209957 CEST	51210	9988	192.168.2.7	62.118.146.241
Jul 26, 2024 02:28:32.419223070 CEST	51210	9988	192.168.2.7	62.118.146.241
Jul 26, 2024 02:28:32.419235945 CEST	51210	9988	192.168.2.7	62.118.146.241
Jul 26, 2024 02:28:32.419269085 CEST	51210	9988	192.168.2.7	62.118.146.241
Jul 26, 2024 02:28:32.419472933 CEST	9988	51210	62.118.146.241	192.168.2.7
Jul 26, 2024 02:28:32.419485092 CEST	9988	51210	62.118.146.241	192.168.2.7
Jul 26, 2024 02:28:32.419529915 CEST	9988	51210	62.118.146.241	192.168.2.7
Jul 26, 2024 02:28:32.419539928 CEST	9988	51210	62.118.146.241	192.168.2.7
Jul 26, 2024 02:28:32.419569016 CEST	51210	9988	192.168.2.7	62.118.146.241
Jul 26, 2024 02:28:32.419569016 CEST	51210	9988	192.168.2.7	62.118.146.241
Jul 26, 2024 02:28:32.419589996 CEST	9988	51210	62.118.146.241	192.168.2.7
Jul 26, 2024 02:28:32.419601917 CEST	51210	9988	192.168.2.7	62.118.146.241
Jul 26, 2024 02:28:32.419601917 CEST	9988	51210	62.118.146.241	192.168.2.7
Jul 26, 2024 02:28:32.419617891 CEST	9988	51210	62.118.146.241	192.168.2.7
Jul 26, 2024 02:28:32.419627905 CEST	9988	51210	62.118.146.241	192.168.2.7
Jul 26, 2024 02:28:32.419683933 CEST	51210	9988	192.168.2.7	62.118.146.241
Jul 26, 2024 02:28:32.419683933 CEST	51210	9988	192.168.2.7	62.118.146.241
Jul 26, 2024 02:28:32.419698000 CEST	51210	9988	192.168.2.7	62.118.146.241
Jul 26, 2024 02:28:32.419703960 CEST	51210	9988	192.168.2.7	62.118.146.241
Jul 26, 2024 02:28:32.419852972 CEST	9988	51210	62.118.146.241	192.168.2.7
Jul 26, 2024 02:28:32.423957109 CEST	9988	51210	62.118.146.241	192.168.2.7
Jul 26, 2024 02:28:32.423986912 CEST	9988	51210	62.118.146.241	192.168.2.7
Jul 26, 2024 02:28:32.424151897 CEST	51210	9988	192.168.2.7	62.118.146.241
Jul 26, 2024 02:28:32.424206018 CEST	51210	9988	192.168.2.7	62.118.146.241
Jul 26, 2024 02:28:32.424392939 CEST	9988	51210	62.118.146.241	192.168.2.7
Jul 26, 2024 02:28:32.424453974 CEST	9988	51210	62.118.146.241	192.168.2.7
Jul 26, 2024 02:28:32.424489021 CEST	9988	51210	62.118.146.241	192.168.2.7
Jul 26, 2024 02:28:32.424504995 CEST	51210	9988	192.168.2.7	62.118.146.241
Jul 26, 2024 02:28:32.424525023 CEST	51210	9988	192.168.2.7	62.118.146.241
Jul 26, 2024 02:28:32.424601078 CEST	51210	9988	192.168.2.7	62.118.146.241
Jul 26, 2024 02:28:32.424601078 CEST	51210	9988	192.168.2.7	62.118.146.241
Jul 26, 2024 02:28:32.461850882 CEST	51206	139	192.168.2.7	62.118.78.100
Jul 26, 2024 02:28:32.466866016 CEST	9988	51210	62.118.146.241	192.168.2.7
Jul 26, 2024 02:28:32.467411041 CEST	51210	9988	192.168.2.7	62.118.146.241
Jul 26, 2024 02:28:32.467592001 CEST	51210	9988	192.168.2.7	62.118.146.241
Jul 26, 2024 02:28:32.519066095 CEST	9988	51210	62.118.146.241	192.168.2.7
Jul 26, 2024 02:28:32.519649982 CEST	51210	9988	192.168.2.7	62.118.146.241
Jul 26, 2024 02:28:32.519649982 CEST	51210	9988	192.168.2.7	62.118.146.241
Jul 26, 2024 02:28:32.566827059 CEST	9988	51210	62.118.146.241	192.168.2.7
Jul 26, 2024 02:28:32.618020058 CEST	51207	139	192.168.2.7	62.118.136.167
Jul 26, 2024 02:28:32.696198940 CEST	51208	139	192.168.2.7	62.118.67.53
Jul 26, 2024 02:28:32.711827993 CEST	51194	139	192.168.2.7	62.118.143.145
Jul 26, 2024 02:28:32.774316072 CEST	51195	139	192.168.2.7	62.118.147.145
Jul 26, 2024 02:28:32.868063927 CEST	51210	9988	192.168.2.7	62.118.146.241
Jul 26, 2024 02:28:32.873051882 CEST	9988	51210	62.118.146.241	192.168.2.7
Jul 26, 2024 02:28:32.993172884 CEST	51182	445	192.168.2.7	62.118.150.7
Jul 26, 2024 02:28:32.993316889 CEST	51181	445	192.168.2.7	62.118.132.3
Jul 26, 2024 02:28:32.993545055 CEST	51211	139	192.168.2.7	62.118.132.3
Jul 26, 2024 02:28:32.997009993 CEST	51212	139	192.168.2.7	62.118.150.7
Jul 26, 2024 02:28:33.055962086 CEST	51213	445	192.168.2.7	62.118.140.194
Jul 26, 2024 02:28:33.060991049 CEST	445	51213	62.118.140.194	192.168.2.7
Jul 26, 2024 02:28:33.061114073 CEST	51213	445	192.168.2.7	62.118.140.194
Jul 26, 2024 02:28:33.061204910 CEST	51213	445	192.168.2.7	62.118.140.194
Jul 26, 2024 02:28:33.065995932 CEST	445	51213	62.118.140.194	192.168.2.7
Jul 26, 2024 02:28:33.149678946 CEST	51214	445	192.168.2.7	62.118.253.27
Jul 26, 2024 02:28:33.154524088 CEST	445	51214	62.118.253.27	192.168.2.7
Jul 26, 2024 02:28:33.154654026 CEST	51214	445	192.168.2.7	62.118.253.27
Jul 26, 2024 02:28:33.154747963 CEST	51214	445	192.168.2.7	62.118.253.27
Jul 26, 2024 02:28:33.160676956 CEST	445	51214	62.118.253.27	192.168.2.7
Jul 26, 2024 02:28:33.305991888 CEST	51215	445	192.168.2.7	62.118.132.5
Jul 26, 2024 02:28:33.311142921 CEST	445	51215	62.118.132.5	192.168.2.7
Jul 26, 2024 02:28:33.311258078 CEST	51215	445	192.168.2.7	62.118.132.5
Jul 26, 2024 02:28:33.311398029 CEST	51215	445	192.168.2.7	62.118.132.5
Jul 26, 2024 02:28:33.316287994 CEST	445	51215	62.118.132.5	192.168.2.7
Jul 26, 2024 02:28:33.430572033 CEST	51199	139	192.168.2.7	62.118.155.156
Jul 26, 2024 02:28:33.432297945 CEST	51198	139	192.168.2.7	62.118.138.100
Jul 26, 2024 02:28:33.477407932 CEST	51210	9988	192.168.2.7	62.118.146.241
Jul 26, 2024 02:28:33.484154940 CEST	9988	51210	62.118.146.241	192.168.2.7
Jul 26, 2024 02:28:33.509124994 CEST	51216	445	192.168.2.7	62.118.249.109
Jul 26, 2024 02:28:33.515944004 CEST	445	51216	62.118.249.109	192.168.2.7
Jul 26, 2024 02:28:33.516026974 CEST	51216	445	192.168.2.7	62.118.249.109
Jul 26, 2024 02:28:33.516132116 CEST	51216	445	192.168.2.7	62.118.249.109
Jul 26, 2024 02:28:33.520986080 CEST	445	51216	62.118.249.109	192.168.2.7
Jul 26, 2024 02:28:33.735110044 CEST	445	51209	62.118.153.81	192.168.2.7
Jul 26, 2024 02:28:33.735246897 CEST	51209	445	192.168.2.7	62.118.153.81
Jul 26, 2024 02:28:33.735279083 CEST	51209	445	192.168.2.7	62.118.153.81
Jul 26, 2024 02:28:33.735517025 CEST	51217	139	192.168.2.7	62.118.153.81
Jul 26, 2024 02:28:33.836842060 CEST	51203	139	192.168.2.7	62.118.253.30
Jul 26, 2024 02:28:33.977426052 CEST	51204	139	192.168.2.7	62.118.249.2
Jul 26, 2024 02:28:34.008703947 CEST	51212	139	192.168.2.7	62.118.150.7
Jul 26, 2024 02:28:34.008882046 CEST	51211	139	192.168.2.7	62.118.132.3
Jul 26, 2024 02:28:34.009244919 CEST	51218	445	192.168.2.7	62.118.150.40
Jul 26, 2024 02:28:34.014054060 CEST	445	51218	62.118.150.40	192.168.2.7
Jul 26, 2024 02:28:34.014182091 CEST	51218	445	192.168.2.7	62.118.150.40
Jul 26, 2024 02:28:34.014354944 CEST	51218	445	192.168.2.7	62.118.150.40
Jul 26, 2024 02:28:34.019988060 CEST	445	51218	62.118.150.40	192.168.2.7
Jul 26, 2024 02:28:34.179615021 CEST	9988	51210	62.118.146.241	192.168.2.7
Jul 26, 2024 02:28:34.181288004 CEST	51219	139	192.168.2.7	62.118.146.241
Jul 26, 2024 02:28:34.228049994 CEST	51220	445	192.168.2.7	62.118.165.34
Jul 26, 2024 02:28:34.234479904 CEST	445	51220	62.118.165.34	192.168.2.7
Jul 26, 2024 02:28:34.234600067 CEST	51220	445	192.168.2.7	62.118.165.34
Jul 26, 2024 02:28:34.234707117 CEST	51220	445	192.168.2.7	62.118.165.34
Jul 26, 2024 02:28:34.241761923 CEST	445	51220	62.118.165.34	192.168.2.7
Jul 26, 2024 02:28:34.461819887 CEST	51206	139	192.168.2.7	62.118.78.100
Jul 26, 2024 02:28:34.618180990 CEST	51207	139	192.168.2.7	62.118.136.167
Jul 26, 2024 02:28:34.711822033 CEST	51208	139	192.168.2.7	62.118.67.53
Jul 26, 2024 02:28:34.743083000 CEST	51217	139	192.168.2.7	62.118.153.81
Jul 26, 2024 02:28:34.917670012 CEST	51221	445	192.168.2.7	62.118.78.116
Jul 26, 2024 02:28:34.923161983 CEST	445	51221	62.118.78.116	192.168.2.7
Jul 26, 2024 02:28:34.923261881 CEST	51221	445	192.168.2.7	62.118.78.116
Jul 26, 2024 02:28:34.926493883 CEST	51221	445	192.168.2.7	62.118.78.116
Jul 26, 2024 02:28:34.931437969 CEST	445	51221	62.118.78.116	192.168.2.7
Jul 26, 2024 02:28:35.196219921 CEST	51219	139	192.168.2.7	62.118.146.241
Jul 26, 2024 02:28:35.586846113 CEST	51193	445	192.168.2.7	62.118.253.46
Jul 26, 2024 02:28:35.587057114 CEST	51222	139	192.168.2.7	62.118.253.46
Jul 26, 2024 02:28:35.696547031 CEST	51223	445	192.168.2.7	62.118.143.145
Jul 26, 2024 02:28:35.701642036 CEST	445	51223	62.118.143.145	192.168.2.7
Jul 26, 2024 02:28:35.701750994 CEST	51223	445	192.168.2.7	62.118.143.145
Jul 26, 2024 02:28:35.701905012 CEST	51223	445	192.168.2.7	62.118.143.145
Jul 26, 2024 02:28:35.706981897 CEST	445	51223	62.118.143.145	192.168.2.7
Jul 26, 2024 02:28:35.751153946 CEST	445	51218	62.118.150.40	192.168.2.7
Jul 26, 2024 02:28:35.751319885 CEST	51218	445	192.168.2.7	62.118.150.40
Jul 26, 2024 02:28:35.751434088 CEST	51218	445	192.168.2.7	62.118.150.40
Jul 26, 2024 02:28:35.751780987 CEST	51224	139	192.168.2.7	62.118.150.40
Jul 26, 2024 02:28:35.774754047 CEST	51225	445	192.168.2.7	62.118.147.145
Jul 26, 2024 02:28:35.781357050 CEST	445	51225	62.118.147.145	192.168.2.7
Jul 26, 2024 02:28:35.781584024 CEST	51225	445	192.168.2.7	62.118.147.145
Jul 26, 2024 02:28:35.781621933 CEST	51225	445	192.168.2.7	62.118.147.145
Jul 26, 2024 02:28:35.786868095 CEST	445	51225	62.118.147.145	192.168.2.7
Jul 26, 2024 02:28:35.915091991 CEST	51196	445	192.168.2.7	62.118.78.113
Jul 26, 2024 02:28:35.915369987 CEST	51226	139	192.168.2.7	62.118.78.113
Jul 26, 2024 02:28:36.008801937 CEST	51212	139	192.168.2.7	62.118.150.7
Jul 26, 2024 02:28:36.008805990 CEST	51211	139	192.168.2.7	62.118.132.3
Jul 26, 2024 02:28:36.038798094 CEST	445	51220	62.118.165.34	192.168.2.7
Jul 26, 2024 02:28:36.039040089 CEST	51220	445	192.168.2.7	62.118.165.34
Jul 26, 2024 02:28:36.039279938 CEST	51220	445	192.168.2.7	62.118.165.34
Jul 26, 2024 02:28:36.039659023 CEST	51227	139	192.168.2.7	62.118.165.34
Jul 26, 2024 02:28:36.430943966 CEST	51229	445	192.168.2.7	62.118.138.100
Jul 26, 2024 02:28:36.430948019 CEST	51228	445	192.168.2.7	62.118.155.156
Jul 26, 2024 02:28:36.435933113 CEST	445	51228	62.118.155.156	192.168.2.7
Jul 26, 2024 02:28:36.435955048 CEST	445	51229	62.118.138.100	192.168.2.7
Jul 26, 2024 02:28:36.436014891 CEST	51228	445	192.168.2.7	62.118.155.156
Jul 26, 2024 02:28:36.436047077 CEST	51229	445	192.168.2.7	62.118.138.100
Jul 26, 2024 02:28:36.436098099 CEST	51228	445	192.168.2.7	62.118.155.156
Jul 26, 2024 02:28:36.436167002 CEST	51229	445	192.168.2.7	62.118.138.100
Jul 26, 2024 02:28:36.441028118 CEST	445	51228	62.118.155.156	192.168.2.7
Jul 26, 2024 02:28:36.441040039 CEST	445	51229	62.118.138.100	192.168.2.7
Jul 26, 2024 02:28:36.586800098 CEST	51222	139	192.168.2.7	62.118.253.46
Jul 26, 2024 02:28:36.665005922 CEST	51200	445	192.168.2.7	62.118.95.82
Jul 26, 2024 02:28:36.665143013 CEST	51201	445	192.168.2.7	62.118.253.29
Jul 26, 2024 02:28:36.665337086 CEST	51231	139	192.168.2.7	62.118.95.82
Jul 26, 2024 02:28:36.665338993 CEST	51230	139	192.168.2.7	62.118.253.29
Jul 26, 2024 02:28:36.743024111 CEST	51217	139	192.168.2.7	62.118.153.81
Jul 26, 2024 02:28:36.743221998 CEST	51202	445	192.168.2.7	62.118.78.103
Jul 26, 2024 02:28:36.743504047 CEST	51232	139	192.168.2.7	62.118.78.103
Jul 26, 2024 02:28:36.758708000 CEST	51224	139	192.168.2.7	62.118.150.40
Jul 26, 2024 02:28:36.837416887 CEST	51233	445	192.168.2.7	62.118.253.30
Jul 26, 2024 02:28:36.842950106 CEST	445	51233	62.118.253.30	192.168.2.7
Jul 26, 2024 02:28:36.843070984 CEST	51233	445	192.168.2.7	62.118.253.30
Jul 26, 2024 02:28:36.843123913 CEST	51233	445	192.168.2.7	62.118.253.30
Jul 26, 2024 02:28:36.850115061 CEST	445	51233	62.118.253.30	192.168.2.7
Jul 26, 2024 02:28:36.914974928 CEST	51226	139	192.168.2.7	62.118.78.113
Jul 26, 2024 02:28:36.977986097 CEST	51234	445	192.168.2.7	62.118.249.2
Jul 26, 2024 02:28:36.983077049 CEST	445	51234	62.118.249.2	192.168.2.7
Jul 26, 2024 02:28:36.983252048 CEST	51234	445	192.168.2.7	62.118.249.2
Jul 26, 2024 02:28:36.983355045 CEST	51234	445	192.168.2.7	62.118.249.2
Jul 26, 2024 02:28:36.988718987 CEST	445	51234	62.118.249.2	192.168.2.7
Jul 26, 2024 02:28:37.039978981 CEST	51227	139	192.168.2.7	62.118.165.34
Jul 26, 2024 02:28:37.071522951 CEST	51205	445	192.168.2.7	62.118.138.85
Jul 26, 2024 02:28:37.071645021 CEST	51235	139	192.168.2.7	62.118.138.85
Jul 26, 2024 02:28:37.211992979 CEST	51219	139	192.168.2.7	62.118.146.241
Jul 26, 2024 02:28:37.462060928 CEST	445	51223	62.118.143.145	192.168.2.7
Jul 26, 2024 02:28:37.462171078 CEST	51223	445	192.168.2.7	62.118.143.145
Jul 26, 2024 02:28:37.462225914 CEST	51236	445	192.168.2.7	62.118.78.100
Jul 26, 2024 02:28:37.462323904 CEST	51223	445	192.168.2.7	62.118.143.145
Jul 26, 2024 02:28:37.462596893 CEST	51237	139	192.168.2.7	62.118.143.145
Jul 26, 2024 02:28:37.467194080 CEST	445	51236	62.118.78.100	192.168.2.7
Jul 26, 2024 02:28:37.467272997 CEST	51236	445	192.168.2.7	62.118.78.100
Jul 26, 2024 02:28:37.467350960 CEST	51236	445	192.168.2.7	62.118.78.100
Jul 26, 2024 02:28:37.472332001 CEST	445	51236	62.118.78.100	192.168.2.7
Jul 26, 2024 02:28:37.512631893 CEST	445	51225	62.118.147.145	192.168.2.7
Jul 26, 2024 02:28:37.512751102 CEST	51225	445	192.168.2.7	62.118.147.145
Jul 26, 2024 02:28:37.513034105 CEST	51225	445	192.168.2.7	62.118.147.145
Jul 26, 2024 02:28:37.513948917 CEST	51238	139	192.168.2.7	62.118.147.145
Jul 26, 2024 02:28:37.635797024 CEST	51239	445	192.168.2.7	62.118.136.167
Jul 26, 2024 02:28:37.643064022 CEST	445	51239	62.118.136.167	192.168.2.7
Jul 26, 2024 02:28:37.643136024 CEST	51239	445	192.168.2.7	62.118.136.167
Jul 26, 2024 02:28:37.643908978 CEST	51239	445	192.168.2.7	62.118.136.167
Jul 26, 2024 02:28:37.651350021 CEST	445	51239	62.118.136.167	192.168.2.7
Jul 26, 2024 02:28:37.666920900 CEST	51230	139	192.168.2.7	62.118.253.29
Jul 26, 2024 02:28:37.680540085 CEST	51231	139	192.168.2.7	62.118.95.82
Jul 26, 2024 02:28:37.712306023 CEST	51240	445	192.168.2.7	62.118.67.53
Jul 26, 2024 02:28:37.717225075 CEST	445	51240	62.118.67.53	192.168.2.7
Jul 26, 2024 02:28:37.717302084 CEST	51240	445	192.168.2.7	62.118.67.53
Jul 26, 2024 02:28:37.717422962 CEST	51240	445	192.168.2.7	62.118.67.53
Jul 26, 2024 02:28:37.722213030 CEST	445	51240	62.118.67.53	192.168.2.7
Jul 26, 2024 02:28:37.743025064 CEST	51232	139	192.168.2.7	62.118.78.103
Jul 26, 2024 02:28:38.086854935 CEST	51235	139	192.168.2.7	62.118.138.85
Jul 26, 2024 02:28:38.477442980 CEST	51237	139	192.168.2.7	62.118.143.145
Jul 26, 2024 02:28:38.524301052 CEST	51238	139	192.168.2.7	62.118.147.145
Jul 26, 2024 02:28:38.586824894 CEST	51222	139	192.168.2.7	62.118.253.46
Jul 26, 2024 02:28:38.758665085 CEST	51224	139	192.168.2.7	62.118.150.40
Jul 26, 2024 02:28:38.914932966 CEST	51226	139	192.168.2.7	62.118.78.113
Jul 26, 2024 02:28:39.008977890 CEST	51241	445	192.168.2.7	62.118.150.7
Jul 26, 2024 02:28:39.009079933 CEST	51242	445	192.168.2.7	62.118.132.3
Jul 26, 2024 02:28:39.013827085 CEST	445	51241	62.118.150.7	192.168.2.7
Jul 26, 2024 02:28:39.013880968 CEST	445	51242	62.118.132.3	192.168.2.7
Jul 26, 2024 02:28:39.013988018 CEST	51241	445	192.168.2.7	62.118.150.7
Jul 26, 2024 02:28:39.014029980 CEST	51242	445	192.168.2.7	62.118.132.3
Jul 26, 2024 02:28:39.014081001 CEST	51241	445	192.168.2.7	62.118.150.7
Jul 26, 2024 02:28:39.014120102 CEST	51242	445	192.168.2.7	62.118.132.3
Jul 26, 2024 02:28:39.018867970 CEST	445	51241	62.118.150.7	192.168.2.7
Jul 26, 2024 02:28:39.019001007 CEST	445	51242	62.118.132.3	192.168.2.7
Jul 26, 2024 02:28:39.039894104 CEST	51227	139	192.168.2.7	62.118.165.34
Jul 26, 2024 02:28:39.071213961 CEST	51213	445	192.168.2.7	62.118.140.194
Jul 26, 2024 02:28:39.071487904 CEST	51243	139	192.168.2.7	62.118.140.194
Jul 26, 2024 02:28:39.149476051 CEST	51214	445	192.168.2.7	62.118.253.27
Jul 26, 2024 02:28:39.149780989 CEST	51244	139	192.168.2.7	62.118.253.27
Jul 26, 2024 02:28:39.305634975 CEST	51215	445	192.168.2.7	62.118.132.5
Jul 26, 2024 02:28:39.305922031 CEST	51245	139	192.168.2.7	62.118.132.5
Jul 26, 2024 02:28:39.432645082 CEST	445	51240	62.118.67.53	192.168.2.7
Jul 26, 2024 02:28:39.432760954 CEST	51240	445	192.168.2.7	62.118.67.53
Jul 26, 2024 02:28:39.432842970 CEST	51240	445	192.168.2.7	62.118.67.53
Jul 26, 2024 02:28:39.433209896 CEST	51246	139	192.168.2.7	62.118.67.53
Jul 26, 2024 02:28:39.508908033 CEST	51216	445	192.168.2.7	62.118.249.109
Jul 26, 2024 02:28:39.513807058 CEST	51247	139	192.168.2.7	62.118.249.109
Jul 26, 2024 02:28:39.680557013 CEST	51230	139	192.168.2.7	62.118.253.29
Jul 26, 2024 02:28:39.680562973 CEST	51231	139	192.168.2.7	62.118.95.82
Jul 26, 2024 02:28:39.743151903 CEST	51232	139	192.168.2.7	62.118.78.103
Jul 26, 2024 02:28:39.743877888 CEST	51248	445	192.168.2.7	62.118.153.81
Jul 26, 2024 02:28:39.753191948 CEST	445	51248	62.118.153.81	192.168.2.7
Jul 26, 2024 02:28:39.753310919 CEST	51248	445	192.168.2.7	62.118.153.81
Jul 26, 2024 02:28:39.753390074 CEST	51248	445	192.168.2.7	62.118.153.81
Jul 26, 2024 02:28:39.758435965 CEST	445	51248	62.118.153.81	192.168.2.7
Jul 26, 2024 02:28:40.086863995 CEST	51243	139	192.168.2.7	62.118.140.194
Jul 26, 2024 02:28:40.086925983 CEST	51235	139	192.168.2.7	62.118.138.85
Jul 26, 2024 02:28:40.149343014 CEST	51244	139	192.168.2.7	62.118.253.27
Jul 26, 2024 02:28:40.197015047 CEST	51249	445	192.168.2.7	62.118.146.241
Jul 26, 2024 02:28:40.205971956 CEST	445	51249	62.118.146.241	192.168.2.7
Jul 26, 2024 02:28:40.206106901 CEST	51249	445	192.168.2.7	62.118.146.241
Jul 26, 2024 02:28:40.206264019 CEST	51249	445	192.168.2.7	62.118.146.241
Jul 26, 2024 02:28:40.213498116 CEST	445	51249	62.118.146.241	192.168.2.7
Jul 26, 2024 02:28:40.308135986 CEST	51245	139	192.168.2.7	62.118.132.5
Jul 26, 2024 02:28:40.446218967 CEST	51246	139	192.168.2.7	62.118.67.53
Jul 26, 2024 02:28:40.477454901 CEST	51237	139	192.168.2.7	62.118.143.145
Jul 26, 2024 02:28:40.508702040 CEST	51247	139	192.168.2.7	62.118.249.109
Jul 26, 2024 02:28:40.524441957 CEST	51238	139	192.168.2.7	62.118.147.145
Jul 26, 2024 02:28:40.915517092 CEST	51221	445	192.168.2.7	62.118.78.116
Jul 26, 2024 02:28:40.919454098 CEST	51250	139	192.168.2.7	62.118.78.116
Jul 26, 2024 02:28:41.492003918 CEST	445	51248	62.118.153.81	192.168.2.7
Jul 26, 2024 02:28:41.492094994 CEST	51248	445	192.168.2.7	62.118.153.81
Jul 26, 2024 02:28:41.492188931 CEST	51248	445	192.168.2.7	62.118.153.81
Jul 26, 2024 02:28:41.492470980 CEST	51251	139	192.168.2.7	62.118.153.81
Jul 26, 2024 02:28:41.602793932 CEST	51252	445	192.168.2.7	62.118.253.46
Jul 26, 2024 02:28:41.609328032 CEST	445	51252	62.118.253.46	192.168.2.7
Jul 26, 2024 02:28:41.609405994 CEST	51252	445	192.168.2.7	62.118.253.46
Jul 26, 2024 02:28:41.614130020 CEST	51252	445	192.168.2.7	62.118.253.46
Jul 26, 2024 02:28:41.621184111 CEST	445	51252	62.118.253.46	192.168.2.7
Jul 26, 2024 02:28:41.759058952 CEST	51253	445	192.168.2.7	62.118.150.40
Jul 26, 2024 02:28:41.763931036 CEST	445	51253	62.118.150.40	192.168.2.7
Jul 26, 2024 02:28:41.764134884 CEST	51253	445	192.168.2.7	62.118.150.40
Jul 26, 2024 02:28:41.764437914 CEST	51253	445	192.168.2.7	62.118.150.40
Jul 26, 2024 02:28:41.769810915 CEST	445	51253	62.118.150.40	192.168.2.7
Jul 26, 2024 02:28:41.930605888 CEST	51250	139	192.168.2.7	62.118.78.116
Jul 26, 2024 02:28:41.931188107 CEST	51254	445	192.168.2.7	62.118.78.113
Jul 26, 2024 02:28:41.936033964 CEST	445	51254	62.118.78.113	192.168.2.7
Jul 26, 2024 02:28:41.936136007 CEST	51254	445	192.168.2.7	62.118.78.113
Jul 26, 2024 02:28:41.936248064 CEST	51254	445	192.168.2.7	62.118.78.113
Jul 26, 2024 02:28:41.941092968 CEST	445	51254	62.118.78.113	192.168.2.7
Jul 26, 2024 02:28:41.952258110 CEST	445	51249	62.118.146.241	192.168.2.7
Jul 26, 2024 02:28:41.952390909 CEST	51249	445	192.168.2.7	62.118.146.241
Jul 26, 2024 02:28:41.952390909 CEST	51249	445	192.168.2.7	62.118.146.241
Jul 26, 2024 02:28:41.952653885 CEST	51255	139	192.168.2.7	62.118.146.241
Jul 26, 2024 02:28:42.040348053 CEST	51256	445	192.168.2.7	62.118.165.34
Jul 26, 2024 02:28:42.045459986 CEST	445	51256	62.118.165.34	192.168.2.7
Jul 26, 2024 02:28:42.045593977 CEST	51256	445	192.168.2.7	62.118.165.34
Jul 26, 2024 02:28:42.045694113 CEST	51256	445	192.168.2.7	62.118.165.34
Jul 26, 2024 02:28:42.051464081 CEST	445	51256	62.118.165.34	192.168.2.7
Jul 26, 2024 02:28:42.086822033 CEST	51243	139	192.168.2.7	62.118.140.194
Jul 26, 2024 02:28:42.164928913 CEST	51244	139	192.168.2.7	62.118.253.27
Jul 26, 2024 02:28:42.305566072 CEST	51245	139	192.168.2.7	62.118.132.5
Jul 26, 2024 02:28:42.446187973 CEST	51246	139	192.168.2.7	62.118.67.53
Jul 26, 2024 02:28:42.446333885 CEST	51228	445	192.168.2.7	62.118.155.156
Jul 26, 2024 02:28:42.446435928 CEST	51229	445	192.168.2.7	62.118.138.100
Jul 26, 2024 02:28:42.446600914 CEST	51257	139	192.168.2.7	62.118.155.156
Jul 26, 2024 02:28:42.446630001 CEST	51258	139	192.168.2.7	62.118.138.100
Jul 26, 2024 02:28:42.477456093 CEST	51251	139	192.168.2.7	62.118.153.81
Jul 26, 2024 02:28:42.524363041 CEST	51247	139	192.168.2.7	62.118.249.109
Jul 26, 2024 02:28:42.680814981 CEST	51259	445	192.168.2.7	62.118.253.29
Jul 26, 2024 02:28:42.680819988 CEST	51260	445	192.168.2.7	62.118.95.82
Jul 26, 2024 02:28:42.691292048 CEST	445	51259	62.118.253.29	192.168.2.7
Jul 26, 2024 02:28:42.691415071 CEST	51259	445	192.168.2.7	62.118.253.29
Jul 26, 2024 02:28:42.691488981 CEST	51259	445	192.168.2.7	62.118.253.29
Jul 26, 2024 02:28:42.692106009 CEST	445	51260	62.118.95.82	192.168.2.7
Jul 26, 2024 02:28:42.692162037 CEST	51260	445	192.168.2.7	62.118.95.82
Jul 26, 2024 02:28:42.692193985 CEST	51260	445	192.168.2.7	62.118.95.82
Jul 26, 2024 02:28:42.696422100 CEST	445	51259	62.118.253.29	192.168.2.7
Jul 26, 2024 02:28:42.697205067 CEST	445	51260	62.118.95.82	192.168.2.7
Jul 26, 2024 02:28:42.743576050 CEST	51261	445	192.168.2.7	62.118.78.103
Jul 26, 2024 02:28:42.748595953 CEST	445	51261	62.118.78.103	192.168.2.7
Jul 26, 2024 02:28:42.748694897 CEST	51261	445	192.168.2.7	62.118.78.103
Jul 26, 2024 02:28:42.748928070 CEST	51261	445	192.168.2.7	62.118.78.103
Jul 26, 2024 02:28:42.753921986 CEST	445	51261	62.118.78.103	192.168.2.7
Jul 26, 2024 02:28:42.852552891 CEST	51233	445	192.168.2.7	62.118.253.30
Jul 26, 2024 02:28:42.853003025 CEST	51262	139	192.168.2.7	62.118.253.30
Jul 26, 2024 02:28:42.961802959 CEST	51255	139	192.168.2.7	62.118.146.241
Jul 26, 2024 02:28:42.993136883 CEST	51234	445	192.168.2.7	62.118.249.2
Jul 26, 2024 02:28:42.993391991 CEST	51263	139	192.168.2.7	62.118.249.2
Jul 26, 2024 02:28:43.087145090 CEST	51264	445	192.168.2.7	62.118.138.85
Jul 26, 2024 02:28:43.092197895 CEST	445	51264	62.118.138.85	192.168.2.7
Jul 26, 2024 02:28:43.092300892 CEST	51264	445	192.168.2.7	62.118.138.85
Jul 26, 2024 02:28:43.095063925 CEST	51264	445	192.168.2.7	62.118.138.85
Jul 26, 2024 02:28:43.099909067 CEST	445	51264	62.118.138.85	192.168.2.7
Jul 26, 2024 02:28:43.461872101 CEST	51257	139	192.168.2.7	62.118.155.156
Jul 26, 2024 02:28:43.461946964 CEST	51236	445	192.168.2.7	62.118.78.100
Jul 26, 2024 02:28:43.461951971 CEST	51258	139	192.168.2.7	62.118.138.100
Jul 26, 2024 02:28:43.462335110 CEST	51265	139	192.168.2.7	62.118.78.100
Jul 26, 2024 02:28:43.462763071 CEST	51266	445	192.168.2.7	62.118.143.145
Jul 26, 2024 02:28:43.467618942 CEST	445	51266	62.118.143.145	192.168.2.7
Jul 26, 2024 02:28:43.467716932 CEST	51266	445	192.168.2.7	62.118.143.145
Jul 26, 2024 02:28:43.467876911 CEST	51266	445	192.168.2.7	62.118.143.145
Jul 26, 2024 02:28:43.473371983 CEST	445	51266	62.118.143.145	192.168.2.7
Jul 26, 2024 02:28:43.501564026 CEST	445	51253	62.118.150.40	192.168.2.7
Jul 26, 2024 02:28:43.501636028 CEST	51253	445	192.168.2.7	62.118.150.40
Jul 26, 2024 02:28:43.501694918 CEST	51253	445	192.168.2.7	62.118.150.40
Jul 26, 2024 02:28:43.501972914 CEST	51267	139	192.168.2.7	62.118.150.40
Jul 26, 2024 02:28:43.524801970 CEST	51268	445	192.168.2.7	62.118.147.145
Jul 26, 2024 02:28:43.529772043 CEST	445	51268	62.118.147.145	192.168.2.7
Jul 26, 2024 02:28:43.529848099 CEST	51268	445	192.168.2.7	62.118.147.145
Jul 26, 2024 02:28:43.530009031 CEST	51268	445	192.168.2.7	62.118.147.145
Jul 26, 2024 02:28:43.534842014 CEST	445	51268	62.118.147.145	192.168.2.7
Jul 26, 2024 02:28:43.633759975 CEST	51239	445	192.168.2.7	62.118.136.167
Jul 26, 2024 02:28:43.634224892 CEST	51269	139	192.168.2.7	62.118.136.167
Jul 26, 2024 02:28:43.836189985 CEST	445	51256	62.118.165.34	192.168.2.7
Jul 26, 2024 02:28:43.836311102 CEST	51256	445	192.168.2.7	62.118.165.34
Jul 26, 2024 02:28:43.836433887 CEST	51256	445	192.168.2.7	62.118.165.34
Jul 26, 2024 02:28:43.836522102 CEST	51256	445	192.168.2.7	62.118.165.34
Jul 26, 2024 02:28:43.841291904 CEST	445	51256	62.118.165.34	192.168.2.7
Jul 26, 2024 02:28:43.841303110 CEST	445	51256	62.118.165.34	192.168.2.7
Jul 26, 2024 02:28:43.841316938 CEST	445	51256	62.118.165.34	192.168.2.7
Jul 26, 2024 02:28:43.841438055 CEST	445	51256	62.118.165.34	192.168.2.7
Jul 26, 2024 02:28:43.852438927 CEST	51262	139	192.168.2.7	62.118.253.30
Jul 26, 2024 02:28:43.946238995 CEST	51250	139	192.168.2.7	62.118.78.116
Jul 26, 2024 02:28:43.993129015 CEST	51263	139	192.168.2.7	62.118.249.2
Jul 26, 2024 02:28:44.477514982 CEST	51265	139	192.168.2.7	62.118.78.100
Jul 26, 2024 02:28:44.482162952 CEST	51251	139	192.168.2.7	62.118.153.81
Jul 26, 2024 02:28:44.493098021 CEST	51267	139	192.168.2.7	62.118.150.40
Jul 26, 2024 02:28:44.633888960 CEST	51269	139	192.168.2.7	62.118.136.167
Jul 26, 2024 02:28:44.962061882 CEST	51255	139	192.168.2.7	62.118.146.241
Jul 26, 2024 02:28:45.024471998 CEST	51241	445	192.168.2.7	62.118.150.7
Jul 26, 2024 02:28:45.024697065 CEST	51270	139	192.168.2.7	62.118.150.7
Jul 26, 2024 02:28:45.024718046 CEST	51271	139	192.168.2.7	62.118.132.3
Jul 26, 2024 02:28:45.024717093 CEST	51242	445	192.168.2.7	62.118.132.3
Jul 26, 2024 02:28:45.071909904 CEST	51272	445	192.168.2.7	62.118.140.194
Jul 26, 2024 02:28:45.076850891 CEST	445	51272	62.118.140.194	192.168.2.7
Jul 26, 2024 02:28:45.076951981 CEST	51272	445	192.168.2.7	62.118.140.194
Jul 26, 2024 02:28:45.077183962 CEST	51272	445	192.168.2.7	62.118.140.194
Jul 26, 2024 02:28:45.081965923 CEST	445	51272	62.118.140.194	192.168.2.7
Jul 26, 2024 02:28:45.165328026 CEST	51273	445	192.168.2.7	62.118.253.27
Jul 26, 2024 02:28:45.171196938 CEST	445	51273	62.118.253.27	192.168.2.7
Jul 26, 2024 02:28:45.171315908 CEST	51273	445	192.168.2.7	62.118.253.27
Jul 26, 2024 02:28:45.171439886 CEST	51273	445	192.168.2.7	62.118.253.27
Jul 26, 2024 02:28:45.176311970 CEST	445	51273	62.118.253.27	192.168.2.7
Jul 26, 2024 02:28:45.217654943 CEST	445	51266	62.118.143.145	192.168.2.7
Jul 26, 2024 02:28:45.217752934 CEST	51266	445	192.168.2.7	62.118.143.145
Jul 26, 2024 02:28:45.217950106 CEST	51266	445	192.168.2.7	62.118.143.145
Jul 26, 2024 02:28:45.218327045 CEST	51274	139	192.168.2.7	62.118.143.145
Jul 26, 2024 02:28:45.264478922 CEST	445	51268	62.118.147.145	192.168.2.7
Jul 26, 2024 02:28:45.264563084 CEST	51268	445	192.168.2.7	62.118.147.145
Jul 26, 2024 02:28:45.264621019 CEST	51268	445	192.168.2.7	62.118.147.145
Jul 26, 2024 02:28:45.264955044 CEST	51275	139	192.168.2.7	62.118.147.145
Jul 26, 2024 02:28:45.321729898 CEST	51276	445	192.168.2.7	62.118.132.5
Jul 26, 2024 02:28:45.326677084 CEST	445	51276	62.118.132.5	192.168.2.7
Jul 26, 2024 02:28:45.326793909 CEST	51276	445	192.168.2.7	62.118.132.5
Jul 26, 2024 02:28:45.326921940 CEST	51276	445	192.168.2.7	62.118.132.5
Jul 26, 2024 02:28:45.331798077 CEST	445	51276	62.118.132.5	192.168.2.7
Jul 26, 2024 02:28:45.446871042 CEST	51277	445	192.168.2.7	62.118.67.53
Jul 26, 2024 02:28:45.451761961 CEST	445	51277	62.118.67.53	192.168.2.7
Jul 26, 2024 02:28:45.451853037 CEST	51277	445	192.168.2.7	62.118.67.53
Jul 26, 2024 02:28:45.451966047 CEST	51277	445	192.168.2.7	62.118.67.53
Jul 26, 2024 02:28:45.457504988 CEST	445	51277	62.118.67.53	192.168.2.7
Jul 26, 2024 02:28:45.461833000 CEST	51257	139	192.168.2.7	62.118.155.156
Jul 26, 2024 02:28:45.464790106 CEST	51258	139	192.168.2.7	62.118.138.100
Jul 26, 2024 02:28:45.525055885 CEST	51278	445	192.168.2.7	62.118.249.109
Jul 26, 2024 02:28:45.530213118 CEST	445	51278	62.118.249.109	192.168.2.7
Jul 26, 2024 02:28:45.530338049 CEST	51278	445	192.168.2.7	62.118.249.109
Jul 26, 2024 02:28:45.530379057 CEST	51278	445	192.168.2.7	62.118.249.109
Jul 26, 2024 02:28:45.535430908 CEST	445	51278	62.118.249.109	192.168.2.7
Jul 26, 2024 02:28:45.841007948 CEST	51279	9988	192.168.2.7	62.118.165.34
Jul 26, 2024 02:28:45.846187115 CEST	9988	51279	62.118.165.34	192.168.2.7
Jul 26, 2024 02:28:45.846292973 CEST	51279	9988	192.168.2.7	62.118.165.34
Jul 26, 2024 02:28:45.852499008 CEST	51262	139	192.168.2.7	62.118.253.30
Jul 26, 2024 02:28:45.895064116 CEST	51279	9988	192.168.2.7	62.118.165.34
Jul 26, 2024 02:28:45.895064116 CEST	51279	9988	192.168.2.7	62.118.165.34
Jul 26, 2024 02:28:45.895064116 CEST	51279	9988	192.168.2.7	62.118.165.34
Jul 26, 2024 02:28:45.895064116 CEST	51279	9988	192.168.2.7	62.118.165.34
Jul 26, 2024 02:28:45.895195007 CEST	51279	9988	192.168.2.7	62.118.165.34
Jul 26, 2024 02:28:45.895195007 CEST	51279	9988	192.168.2.7	62.118.165.34
Jul 26, 2024 02:28:45.895195961 CEST	51279	9988	192.168.2.7	62.118.165.34
Jul 26, 2024 02:28:45.895195961 CEST	51279	9988	192.168.2.7	62.118.165.34
Jul 26, 2024 02:28:45.895195961 CEST	51279	9988	192.168.2.7	62.118.165.34
Jul 26, 2024 02:28:45.895245075 CEST	51279	9988	192.168.2.7	62.118.165.34
Jul 26, 2024 02:28:45.895245075 CEST	51279	9988	192.168.2.7	62.118.165.34
Jul 26, 2024 02:28:45.895245075 CEST	51279	9988	192.168.2.7	62.118.165.34
Jul 26, 2024 02:28:45.900134087 CEST	9988	51279	62.118.165.34	192.168.2.7
Jul 26, 2024 02:28:45.900151014 CEST	9988	51279	62.118.165.34	192.168.2.7
Jul 26, 2024 02:28:45.900161982 CEST	9988	51279	62.118.165.34	192.168.2.7
Jul 26, 2024 02:28:45.900175095 CEST	9988	51279	62.118.165.34	192.168.2.7
Jul 26, 2024 02:28:45.900185108 CEST	9988	51279	62.118.165.34	192.168.2.7
Jul 26, 2024 02:28:45.900193930 CEST	9988	51279	62.118.165.34	192.168.2.7
Jul 26, 2024 02:28:45.900254965 CEST	51279	9988	192.168.2.7	62.118.165.34
Jul 26, 2024 02:28:45.900295019 CEST	51279	9988	192.168.2.7	62.118.165.34
Jul 26, 2024 02:28:45.900300026 CEST	9988	51279	62.118.165.34	192.168.2.7
Jul 26, 2024 02:28:45.900310993 CEST	9988	51279	62.118.165.34	192.168.2.7
Jul 26, 2024 02:28:45.900321007 CEST	9988	51279	62.118.165.34	192.168.2.7
Jul 26, 2024 02:28:45.900365114 CEST	51279	9988	192.168.2.7	62.118.165.34
Jul 26, 2024 02:28:45.900365114 CEST	51279	9988	192.168.2.7	62.118.165.34
Jul 26, 2024 02:28:45.900475025 CEST	9988	51279	62.118.165.34	192.168.2.7
Jul 26, 2024 02:28:45.900492907 CEST	9988	51279	62.118.165.34	192.168.2.7
Jul 26, 2024 02:28:45.900506020 CEST	9988	51279	62.118.165.34	192.168.2.7
Jul 26, 2024 02:28:45.900516033 CEST	9988	51279	62.118.165.34	192.168.2.7
Jul 26, 2024 02:28:45.900546074 CEST	9988	51279	62.118.165.34	192.168.2.7
Jul 26, 2024 02:28:45.900553942 CEST	9988	51279	62.118.165.34	192.168.2.7
Jul 26, 2024 02:28:45.900563955 CEST	9988	51279	62.118.165.34	192.168.2.7
Jul 26, 2024 02:28:45.900568962 CEST	9988	51279	62.118.165.34	192.168.2.7
Jul 26, 2024 02:28:45.900573015 CEST	51279	9988	192.168.2.7	62.118.165.34
Jul 26, 2024 02:28:45.900608063 CEST	51279	9988	192.168.2.7	62.118.165.34
Jul 26, 2024 02:28:45.900643110 CEST	51279	9988	192.168.2.7	62.118.165.34
Jul 26, 2024 02:28:45.900643110 CEST	51279	9988	192.168.2.7	62.118.165.34
Jul 26, 2024 02:28:45.900643110 CEST	51279	9988	192.168.2.7	62.118.165.34
Jul 26, 2024 02:28:45.900679111 CEST	9988	51279	62.118.165.34	192.168.2.7
Jul 26, 2024 02:28:45.900752068 CEST	51279	9988	192.168.2.7	62.118.165.34
Jul 26, 2024 02:28:45.904779911 CEST	9988	51279	62.118.165.34	192.168.2.7
Jul 26, 2024 02:28:45.904891014 CEST	51279	9988	192.168.2.7	62.118.165.34
Jul 26, 2024 02:28:45.905163050 CEST	9988	51279	62.118.165.34	192.168.2.7
Jul 26, 2024 02:28:45.905236959 CEST	9988	51279	62.118.165.34	192.168.2.7
Jul 26, 2024 02:28:45.905277014 CEST	51279	9988	192.168.2.7	62.118.165.34
Jul 26, 2024 02:28:45.905344963 CEST	51279	9988	192.168.2.7	62.118.165.34
Jul 26, 2024 02:28:45.905345917 CEST	51279	9988	192.168.2.7	62.118.165.34
Jul 26, 2024 02:28:45.947370052 CEST	9988	51279	62.118.165.34	192.168.2.7
Jul 26, 2024 02:28:45.947650909 CEST	51279	9988	192.168.2.7	62.118.165.34
Jul 26, 2024 02:28:45.947705030 CEST	51279	9988	192.168.2.7	62.118.165.34
Jul 26, 2024 02:28:45.947761059 CEST	51279	9988	192.168.2.7	62.118.165.34
Jul 26, 2024 02:28:45.993163109 CEST	51263	139	192.168.2.7	62.118.249.2
Jul 26, 2024 02:28:45.994074106 CEST	9988	51279	62.118.165.34	192.168.2.7
Jul 26, 2024 02:28:45.994472027 CEST	51279	9988	192.168.2.7	62.118.165.34
Jul 26, 2024 02:28:45.998151064 CEST	51279	9988	192.168.2.7	62.118.165.34
Jul 26, 2024 02:28:46.024373055 CEST	51270	139	192.168.2.7	62.118.150.7
Jul 26, 2024 02:28:46.024398088 CEST	51271	139	192.168.2.7	62.118.132.3
Jul 26, 2024 02:28:46.042052984 CEST	9988	51279	62.118.165.34	192.168.2.7
Jul 26, 2024 02:28:46.227471113 CEST	51274	139	192.168.2.7	62.118.143.145
Jul 26, 2024 02:28:46.274343014 CEST	51275	139	192.168.2.7	62.118.147.145
Jul 26, 2024 02:28:46.352514029 CEST	51279	9988	192.168.2.7	62.118.165.34
Jul 26, 2024 02:28:46.357484102 CEST	9988	51279	62.118.165.34	192.168.2.7
Jul 26, 2024 02:28:46.493069887 CEST	51267	139	192.168.2.7	62.118.150.40
Jul 26, 2024 02:28:46.493083954 CEST	51265	139	192.168.2.7	62.118.78.100
Jul 26, 2024 02:28:46.649403095 CEST	51269	139	192.168.2.7	62.118.136.167
Jul 26, 2024 02:28:46.931206942 CEST	51280	445	192.168.2.7	62.118.78.116
Jul 26, 2024 02:28:46.936156034 CEST	445	51280	62.118.78.116	192.168.2.7
Jul 26, 2024 02:28:46.936233044 CEST	51280	445	192.168.2.7	62.118.78.116
Jul 26, 2024 02:28:46.936269999 CEST	51280	445	192.168.2.7	62.118.78.116
Jul 26, 2024 02:28:46.941111088 CEST	445	51280	62.118.78.116	192.168.2.7
Jul 26, 2024 02:28:46.961885929 CEST	51279	9988	192.168.2.7	62.118.165.34
Jul 26, 2024 02:28:46.967561960 CEST	9988	51279	62.118.165.34	192.168.2.7
Jul 26, 2024 02:28:47.204557896 CEST	445	51277	62.118.67.53	192.168.2.7
Jul 26, 2024 02:28:47.204684973 CEST	51277	445	192.168.2.7	62.118.67.53
Jul 26, 2024 02:28:47.204756975 CEST	51277	445	192.168.2.7	62.118.67.53
Jul 26, 2024 02:28:47.205121994 CEST	51281	139	192.168.2.7	62.118.67.53
Jul 26, 2024 02:28:47.477978945 CEST	51282	445	192.168.2.7	62.118.153.81
Jul 26, 2024 02:28:47.483042955 CEST	445	51282	62.118.153.81	192.168.2.7
Jul 26, 2024 02:28:47.483134031 CEST	51282	445	192.168.2.7	62.118.153.81
Jul 26, 2024 02:28:47.483206034 CEST	51282	445	192.168.2.7	62.118.153.81
Jul 26, 2024 02:28:47.487993002 CEST	445	51282	62.118.153.81	192.168.2.7
Jul 26, 2024 02:28:47.602557898 CEST	51252	445	192.168.2.7	62.118.253.46
Jul 26, 2024 02:28:47.602876902 CEST	51283	139	192.168.2.7	62.118.253.46
Jul 26, 2024 02:28:47.656776905 CEST	9988	51279	62.118.165.34	192.168.2.7
Jul 26, 2024 02:28:47.657141924 CEST	51284	139	192.168.2.7	62.118.165.34
Jul 26, 2024 02:28:47.930701971 CEST	51254	445	192.168.2.7	62.118.78.113
Jul 26, 2024 02:28:47.930994034 CEST	51285	139	192.168.2.7	62.118.78.113
Jul 26, 2024 02:28:47.946402073 CEST	51286	445	192.168.2.7	62.118.146.241
Jul 26, 2024 02:28:47.951205015 CEST	445	51286	62.118.146.241	192.168.2.7
Jul 26, 2024 02:28:47.951314926 CEST	51286	445	192.168.2.7	62.118.146.241
Jul 26, 2024 02:28:47.951452971 CEST	51286	445	192.168.2.7	62.118.146.241
Jul 26, 2024 02:28:47.956314087 CEST	445	51286	62.118.146.241	192.168.2.7
Jul 26, 2024 02:28:48.024420023 CEST	51271	139	192.168.2.7	62.118.132.3
Jul 26, 2024 02:28:48.024580002 CEST	51270	139	192.168.2.7	62.118.150.7
Jul 26, 2024 02:28:48.211863041 CEST	51281	139	192.168.2.7	62.118.67.53
Jul 26, 2024 02:28:48.227458954 CEST	51274	139	192.168.2.7	62.118.143.145
Jul 26, 2024 02:28:48.274331093 CEST	51275	139	192.168.2.7	62.118.147.145
Jul 26, 2024 02:28:48.462347984 CEST	51287	445	192.168.2.7	62.118.138.100
Jul 26, 2024 02:28:48.462379932 CEST	51288	445	192.168.2.7	62.118.155.156
Jul 26, 2024 02:28:48.467592001 CEST	445	51287	62.118.138.100	192.168.2.7
Jul 26, 2024 02:28:48.467637062 CEST	445	51288	62.118.155.156	192.168.2.7
Jul 26, 2024 02:28:48.467658997 CEST	51287	445	192.168.2.7	62.118.138.100
Jul 26, 2024 02:28:48.467694044 CEST	51288	445	192.168.2.7	62.118.155.156
Jul 26, 2024 02:28:48.467770100 CEST	51288	445	192.168.2.7	62.118.155.156
Jul 26, 2024 02:28:48.467847109 CEST	51287	445	192.168.2.7	62.118.138.100
Jul 26, 2024 02:28:48.472702026 CEST	445	51288	62.118.155.156	192.168.2.7
Jul 26, 2024 02:28:48.473628044 CEST	445	51287	62.118.138.100	192.168.2.7
Jul 26, 2024 02:28:48.618105888 CEST	51283	139	192.168.2.7	62.118.253.46
Jul 26, 2024 02:28:48.665024996 CEST	51284	139	192.168.2.7	62.118.165.34
Jul 26, 2024 02:28:48.680692911 CEST	51260	445	192.168.2.7	62.118.95.82
Jul 26, 2024 02:28:48.680813074 CEST	51259	445	192.168.2.7	62.118.253.29
Jul 26, 2024 02:28:48.681000948 CEST	51289	139	192.168.2.7	62.118.95.82
Jul 26, 2024 02:28:48.681083918 CEST	51290	139	192.168.2.7	62.118.253.29
Jul 26, 2024 02:28:48.743280888 CEST	51261	445	192.168.2.7	62.118.78.103
Jul 26, 2024 02:28:48.743469954 CEST	51291	139	192.168.2.7	62.118.78.103
Jul 26, 2024 02:28:48.868324041 CEST	51292	445	192.168.2.7	62.118.253.30
Jul 26, 2024 02:28:48.873298883 CEST	445	51292	62.118.253.30	192.168.2.7
Jul 26, 2024 02:28:48.873363972 CEST	51292	445	192.168.2.7	62.118.253.30
Jul 26, 2024 02:28:48.873425961 CEST	51292	445	192.168.2.7	62.118.253.30
Jul 26, 2024 02:28:48.879282951 CEST	445	51292	62.118.253.30	192.168.2.7
Jul 26, 2024 02:28:48.946212053 CEST	51285	139	192.168.2.7	62.118.78.113
Jul 26, 2024 02:28:49.009226084 CEST	51293	445	192.168.2.7	62.118.249.2
Jul 26, 2024 02:28:49.014693975 CEST	445	51293	62.118.249.2	192.168.2.7
Jul 26, 2024 02:28:49.016274929 CEST	51293	445	192.168.2.7	62.118.249.2
Jul 26, 2024 02:28:49.016350031 CEST	51293	445	192.168.2.7	62.118.249.2
Jul 26, 2024 02:28:49.021457911 CEST	445	51293	62.118.249.2	192.168.2.7
Jul 26, 2024 02:28:49.105127096 CEST	51264	445	192.168.2.7	62.118.138.85
Jul 26, 2024 02:28:49.105423927 CEST	51294	139	192.168.2.7	62.118.138.85
Jul 26, 2024 02:28:49.200171947 CEST	445	51282	62.118.153.81	192.168.2.7
Jul 26, 2024 02:28:49.200248957 CEST	51282	445	192.168.2.7	62.118.153.81
Jul 26, 2024 02:28:49.200282097 CEST	51282	445	192.168.2.7	62.118.153.81
Jul 26, 2024 02:28:49.200498104 CEST	51295	139	192.168.2.7	62.118.153.81
Jul 26, 2024 02:28:49.477938890 CEST	51296	445	192.168.2.7	62.118.78.100
Jul 26, 2024 02:28:49.484019995 CEST	445	51296	62.118.78.100	192.168.2.7
Jul 26, 2024 02:28:49.486219883 CEST	51296	445	192.168.2.7	62.118.78.100
Jul 26, 2024 02:28:49.486329079 CEST	51296	445	192.168.2.7	62.118.78.100
Jul 26, 2024 02:28:49.491683006 CEST	445	51296	62.118.78.100	192.168.2.7
Jul 26, 2024 02:28:49.493520975 CEST	51297	445	192.168.2.7	62.118.150.40
Jul 26, 2024 02:28:49.498795033 CEST	445	51297	62.118.150.40	192.168.2.7
Jul 26, 2024 02:28:49.498869896 CEST	51297	445	192.168.2.7	62.118.150.40
Jul 26, 2024 02:28:49.498980999 CEST	51297	445	192.168.2.7	62.118.150.40
Jul 26, 2024 02:28:49.503788948 CEST	445	51297	62.118.150.40	192.168.2.7
Jul 26, 2024 02:28:49.634085894 CEST	51298	445	192.168.2.7	62.118.136.167
Jul 26, 2024 02:28:49.639137030 CEST	445	51298	62.118.136.167	192.168.2.7
Jul 26, 2024 02:28:49.639225006 CEST	51298	445	192.168.2.7	62.118.136.167
Jul 26, 2024 02:28:49.639467955 CEST	51298	445	192.168.2.7	62.118.136.167
Jul 26, 2024 02:28:49.644285917 CEST	445	51298	62.118.136.167	192.168.2.7
Jul 26, 2024 02:28:49.696295977 CEST	51289	139	192.168.2.7	62.118.95.82
Jul 26, 2024 02:28:49.696300983 CEST	51290	139	192.168.2.7	62.118.253.29
Jul 26, 2024 02:28:49.711709023 CEST	445	51286	62.118.146.241	192.168.2.7
Jul 26, 2024 02:28:49.711939096 CEST	51286	445	192.168.2.7	62.118.146.241
Jul 26, 2024 02:28:49.712066889 CEST	51286	445	192.168.2.7	62.118.146.241
Jul 26, 2024 02:28:49.712373018 CEST	51299	139	192.168.2.7	62.118.146.241
Jul 26, 2024 02:28:49.758788109 CEST	51291	139	192.168.2.7	62.118.78.103
Jul 26, 2024 02:28:50.118151903 CEST	51294	139	192.168.2.7	62.118.138.85
Jul 26, 2024 02:28:50.198168993 CEST	51295	139	192.168.2.7	62.118.153.81
Jul 26, 2024 02:28:50.211846113 CEST	51281	139	192.168.2.7	62.118.67.53
Jul 26, 2024 02:28:50.618104935 CEST	51283	139	192.168.2.7	62.118.253.46
Jul 26, 2024 02:28:50.664999962 CEST	51284	139	192.168.2.7	62.118.165.34
Jul 26, 2024 02:28:50.711925983 CEST	51299	139	192.168.2.7	62.118.146.241
Jul 26, 2024 02:28:50.961920977 CEST	51285	139	192.168.2.7	62.118.78.113
Jul 26, 2024 02:28:51.025063992 CEST	51300	445	192.168.2.7	62.118.150.7
Jul 26, 2024 02:28:51.025070906 CEST	51301	445	192.168.2.7	62.118.132.3
Jul 26, 2024 02:28:51.030050039 CEST	445	51300	62.118.150.7	192.168.2.7
Jul 26, 2024 02:28:51.030077934 CEST	445	51301	62.118.132.3	192.168.2.7
Jul 26, 2024 02:28:51.030145884 CEST	51300	445	192.168.2.7	62.118.150.7
Jul 26, 2024 02:28:51.030175924 CEST	51301	445	192.168.2.7	62.118.132.3
Jul 26, 2024 02:28:51.030251980 CEST	51301	445	192.168.2.7	62.118.132.3
Jul 26, 2024 02:28:51.030292034 CEST	51300	445	192.168.2.7	62.118.150.7
Jul 26, 2024 02:28:51.035151005 CEST	445	51301	62.118.132.3	192.168.2.7
Jul 26, 2024 02:28:51.035168886 CEST	445	51300	62.118.150.7	192.168.2.7
Jul 26, 2024 02:28:51.086929083 CEST	51272	445	192.168.2.7	62.118.140.194
Jul 26, 2024 02:28:51.087270975 CEST	51302	139	192.168.2.7	62.118.140.194
Jul 26, 2024 02:28:51.180732012 CEST	51273	445	192.168.2.7	62.118.253.27
Jul 26, 2024 02:28:51.181042910 CEST	51303	139	192.168.2.7	62.118.253.27
Jul 26, 2024 02:28:51.227981091 CEST	51304	445	192.168.2.7	62.118.143.145
Jul 26, 2024 02:28:51.232806921 CEST	445	51304	62.118.143.145	192.168.2.7
Jul 26, 2024 02:28:51.232916117 CEST	51304	445	192.168.2.7	62.118.143.145
Jul 26, 2024 02:28:51.232989073 CEST	51304	445	192.168.2.7	62.118.143.145
Jul 26, 2024 02:28:51.233803034 CEST	445	51297	62.118.150.40	192.168.2.7
Jul 26, 2024 02:28:51.233864069 CEST	51297	445	192.168.2.7	62.118.150.40
Jul 26, 2024 02:28:51.233911991 CEST	51297	445	192.168.2.7	62.118.150.40
Jul 26, 2024 02:28:51.234186888 CEST	51297	445	192.168.2.7	62.118.150.40
Jul 26, 2024 02:28:51.237839937 CEST	445	51304	62.118.143.145	192.168.2.7
Jul 26, 2024 02:28:51.239032984 CEST	445	51297	62.118.150.40	192.168.2.7
Jul 26, 2024 02:28:51.239274979 CEST	445	51297	62.118.150.40	192.168.2.7
Jul 26, 2024 02:28:51.239337921 CEST	445	51297	62.118.150.40	192.168.2.7
Jul 26, 2024 02:28:51.239351988 CEST	445	51297	62.118.150.40	192.168.2.7
Jul 26, 2024 02:28:51.259274006 CEST	51305	445	192.168.2.7	62.118.147.145
Jul 26, 2024 02:28:51.265288115 CEST	445	51305	62.118.147.145	192.168.2.7
Jul 26, 2024 02:28:51.265393019 CEST	51305	445	192.168.2.7	62.118.147.145
Jul 26, 2024 02:28:51.265523911 CEST	51305	445	192.168.2.7	62.118.147.145
Jul 26, 2024 02:28:51.270431042 CEST	445	51305	62.118.147.145	192.168.2.7
Jul 26, 2024 02:28:51.337245941 CEST	51276	445	192.168.2.7	62.118.132.5
Jul 26, 2024 02:28:51.337517977 CEST	51306	139	192.168.2.7	62.118.132.5
Jul 26, 2024 02:28:51.540266991 CEST	51278	445	192.168.2.7	62.118.249.109
Jul 26, 2024 02:28:51.545243025 CEST	445	51278	62.118.249.109	192.168.2.7
Jul 26, 2024 02:28:51.545263052 CEST	445	51278	62.118.249.109	192.168.2.7
Jul 26, 2024 02:28:51.545280933 CEST	445	51278	62.118.249.109	192.168.2.7
Jul 26, 2024 02:28:51.545511961 CEST	445	51278	62.118.249.109	192.168.2.7
Jul 26, 2024 02:28:51.696243048 CEST	51289	139	192.168.2.7	62.118.95.82
Jul 26, 2024 02:28:51.696353912 CEST	51290	139	192.168.2.7	62.118.253.29
Jul 26, 2024 02:28:51.758718967 CEST	51291	139	192.168.2.7	62.118.78.103
Jul 26, 2024 02:28:52.102596998 CEST	51302	139	192.168.2.7	62.118.140.194
Jul 26, 2024 02:28:52.118196964 CEST	51294	139	192.168.2.7	62.118.138.85
Jul 26, 2024 02:28:52.196290016 CEST	51303	139	192.168.2.7	62.118.253.27
Jul 26, 2024 02:28:52.196291924 CEST	51295	139	192.168.2.7	62.118.153.81
Jul 26, 2024 02:28:52.336864948 CEST	51306	139	192.168.2.7	62.118.132.5
Jul 26, 2024 02:28:52.711904049 CEST	51299	139	192.168.2.7	62.118.146.241
Jul 26, 2024 02:28:52.946394920 CEST	51280	445	192.168.2.7	62.118.78.116
Jul 26, 2024 02:28:52.951396942 CEST	445	51280	62.118.78.116	192.168.2.7
Jul 26, 2024 02:28:52.951422930 CEST	445	51280	62.118.78.116	192.168.2.7
Jul 26, 2024 02:28:52.951436043 CEST	445	51280	62.118.78.116	192.168.2.7
Jul 26, 2024 02:28:52.951452971 CEST	445	51280	62.118.78.116	192.168.2.7
Jul 26, 2024 02:28:52.971373081 CEST	445	51304	62.118.143.145	192.168.2.7
Jul 26, 2024 02:28:52.971440077 CEST	51304	445	192.168.2.7	62.118.143.145
Jul 26, 2024 02:28:52.971492052 CEST	51304	445	192.168.2.7	62.118.143.145
Jul 26, 2024 02:28:52.971863031 CEST	51307	139	192.168.2.7	62.118.143.145
Jul 26, 2024 02:28:53.009598970 CEST	445	51305	62.118.147.145	192.168.2.7
Jul 26, 2024 02:28:53.009661913 CEST	51305	445	192.168.2.7	62.118.147.145
Jul 26, 2024 02:28:53.009754896 CEST	51305	445	192.168.2.7	62.118.147.145
Jul 26, 2024 02:28:53.196723938 CEST	51308	445	192.168.2.7	62.118.67.53
Jul 26, 2024 02:28:53.201742887 CEST	445	51308	62.118.67.53	192.168.2.7
Jul 26, 2024 02:28:53.201874971 CEST	51308	445	192.168.2.7	62.118.67.53
Jul 26, 2024 02:28:53.201984882 CEST	51308	445	192.168.2.7	62.118.67.53
Jul 26, 2024 02:28:53.207549095 CEST	445	51308	62.118.67.53	192.168.2.7
Jul 26, 2024 02:28:53.243602037 CEST	51309	9988	192.168.2.7	62.118.150.40
Jul 26, 2024 02:28:53.248519897 CEST	9988	51309	62.118.150.40	192.168.2.7
Jul 26, 2024 02:28:53.248646975 CEST	51309	9988	192.168.2.7	62.118.150.40
Jul 26, 2024 02:28:53.274735928 CEST	51310	139	192.168.2.7	62.118.147.145
Jul 26, 2024 02:28:53.296710968 CEST	51309	9988	192.168.2.7	62.118.150.40
Jul 26, 2024 02:28:53.296772003 CEST	51309	9988	192.168.2.7	62.118.150.40
Jul 26, 2024 02:28:53.296772003 CEST	51309	9988	192.168.2.7	62.118.150.40
Jul 26, 2024 02:28:53.296788931 CEST	51309	9988	192.168.2.7	62.118.150.40
Jul 26, 2024 02:28:53.296880007 CEST	51309	9988	192.168.2.7	62.118.150.40
Jul 26, 2024 02:28:53.296951056 CEST	51309	9988	192.168.2.7	62.118.150.40
Jul 26, 2024 02:28:53.297056913 CEST	51309	9988	192.168.2.7	62.118.150.40
Jul 26, 2024 02:28:53.297058105 CEST	51309	9988	192.168.2.7	62.118.150.40
Jul 26, 2024 02:28:53.297108889 CEST	51309	9988	192.168.2.7	62.118.150.40
Jul 26, 2024 02:28:53.297168970 CEST	51309	9988	192.168.2.7	62.118.150.40
Jul 26, 2024 02:28:53.297238111 CEST	51309	9988	192.168.2.7	62.118.150.40
Jul 26, 2024 02:28:53.301632881 CEST	9988	51309	62.118.150.40	192.168.2.7
Jul 26, 2024 02:28:53.301743984 CEST	9988	51309	62.118.150.40	192.168.2.7
Jul 26, 2024 02:28:53.301759958 CEST	9988	51309	62.118.150.40	192.168.2.7
Jul 26, 2024 02:28:53.301760912 CEST	51309	9988	192.168.2.7	62.118.150.40
Jul 26, 2024 02:28:53.301774025 CEST	9988	51309	62.118.150.40	192.168.2.7
Jul 26, 2024 02:28:53.301816940 CEST	51309	9988	192.168.2.7	62.118.150.40
Jul 26, 2024 02:28:53.301832914 CEST	51309	9988	192.168.2.7	62.118.150.40
Jul 26, 2024 02:28:53.301845074 CEST	51309	9988	192.168.2.7	62.118.150.40
Jul 26, 2024 02:28:53.301929951 CEST	9988	51309	62.118.150.40	192.168.2.7
Jul 26, 2024 02:28:53.301944017 CEST	9988	51309	62.118.150.40	192.168.2.7
Jul 26, 2024 02:28:53.301983118 CEST	9988	51309	62.118.150.40	192.168.2.7
Jul 26, 2024 02:28:53.301995993 CEST	9988	51309	62.118.150.40	192.168.2.7
Jul 26, 2024 02:28:53.301995993 CEST	51309	9988	192.168.2.7	62.118.150.40
Jul 26, 2024 02:28:53.302053928 CEST	51309	9988	192.168.2.7	62.118.150.40
Jul 26, 2024 02:28:53.302062035 CEST	9988	51309	62.118.150.40	192.168.2.7
Jul 26, 2024 02:28:53.302067041 CEST	51309	9988	192.168.2.7	62.118.150.40
Jul 26, 2024 02:28:53.302074909 CEST	9988	51309	62.118.150.40	192.168.2.7
Jul 26, 2024 02:28:53.302089930 CEST	9988	51309	62.118.150.40	192.168.2.7
Jul 26, 2024 02:28:53.302104950 CEST	9988	51309	62.118.150.40	192.168.2.7
Jul 26, 2024 02:28:53.302134037 CEST	51309	9988	192.168.2.7	62.118.150.40
Jul 26, 2024 02:28:53.302155018 CEST	51309	9988	192.168.2.7	62.118.150.40
Jul 26, 2024 02:28:53.302185059 CEST	51309	9988	192.168.2.7	62.118.150.40
Jul 26, 2024 02:28:53.302195072 CEST	9988	51309	62.118.150.40	192.168.2.7
Jul 26, 2024 02:28:53.302208900 CEST	9988	51309	62.118.150.40	192.168.2.7
Jul 26, 2024 02:28:53.302221060 CEST	9988	51309	62.118.150.40	192.168.2.7
Jul 26, 2024 02:28:53.302233934 CEST	9988	51309	62.118.150.40	192.168.2.7
Jul 26, 2024 02:28:53.302268982 CEST	51309	9988	192.168.2.7	62.118.150.40
Jul 26, 2024 02:28:53.302270889 CEST	9988	51309	62.118.150.40	192.168.2.7
Jul 26, 2024 02:28:53.302308083 CEST	51309	9988	192.168.2.7	62.118.150.40
Jul 26, 2024 02:28:53.302308083 CEST	51309	9988	192.168.2.7	62.118.150.40
Jul 26, 2024 02:28:53.302308083 CEST	51309	9988	192.168.2.7	62.118.150.40
Jul 26, 2024 02:28:53.302320004 CEST	51309	9988	192.168.2.7	62.118.150.40
Jul 26, 2024 02:28:53.302320004 CEST	51309	9988	192.168.2.7	62.118.150.40
Jul 26, 2024 02:28:53.306375980 CEST	9988	51309	62.118.150.40	192.168.2.7
Jul 26, 2024 02:28:53.306448936 CEST	51309	9988	192.168.2.7	62.118.150.40
Jul 26, 2024 02:28:53.306608915 CEST	9988	51309	62.118.150.40	192.168.2.7
Jul 26, 2024 02:28:53.306670904 CEST	51309	9988	192.168.2.7	62.118.150.40
Jul 26, 2024 02:28:53.306670904 CEST	51309	9988	192.168.2.7	62.118.150.40
Jul 26, 2024 02:28:53.306883097 CEST	9988	51309	62.118.150.40	192.168.2.7
Jul 26, 2024 02:28:53.306972027 CEST	51309	9988	192.168.2.7	62.118.150.40
Jul 26, 2024 02:28:53.306972027 CEST	51309	9988	192.168.2.7	62.118.150.40
Jul 26, 2024 02:28:53.307215929 CEST	9988	51309	62.118.150.40	192.168.2.7
Jul 26, 2024 02:28:53.307276011 CEST	51309	9988	192.168.2.7	62.118.150.40
Jul 26, 2024 02:28:53.307315111 CEST	51309	9988	192.168.2.7	62.118.150.40
Jul 26, 2024 02:28:53.350070000 CEST	9988	51309	62.118.150.40	192.168.2.7
Jul 26, 2024 02:28:53.350485086 CEST	51309	9988	192.168.2.7	62.118.150.40
Jul 26, 2024 02:28:53.350522995 CEST	51309	9988	192.168.2.7	62.118.150.40
Jul 26, 2024 02:28:53.398077011 CEST	9988	51309	62.118.150.40	192.168.2.7
Jul 26, 2024 02:28:53.398469925 CEST	51309	9988	192.168.2.7	62.118.150.40
Jul 26, 2024 02:28:53.398514986 CEST	51309	9988	192.168.2.7	62.118.150.40
Jul 26, 2024 02:28:53.446085930 CEST	9988	51309	62.118.150.40	192.168.2.7
Jul 26, 2024 02:28:53.602910995 CEST	51311	445	192.168.2.7	62.118.253.46
Jul 26, 2024 02:28:53.607887030 CEST	445	51311	62.118.253.46	192.168.2.7
Jul 26, 2024 02:28:53.607964039 CEST	51311	445	192.168.2.7	62.118.253.46
Jul 26, 2024 02:28:53.608047962 CEST	51311	445	192.168.2.7	62.118.253.46
Jul 26, 2024 02:28:53.612804890 CEST	445	51311	62.118.253.46	192.168.2.7
Jul 26, 2024 02:28:53.665523052 CEST	51312	445	192.168.2.7	62.118.165.34
Jul 26, 2024 02:28:53.670526981 CEST	445	51312	62.118.165.34	192.168.2.7
Jul 26, 2024 02:28:53.670628071 CEST	51312	445	192.168.2.7	62.118.165.34
Jul 26, 2024 02:28:53.670691013 CEST	51312	445	192.168.2.7	62.118.165.34
Jul 26, 2024 02:28:53.675461054 CEST	445	51312	62.118.165.34	192.168.2.7
Jul 26, 2024 02:28:53.758764029 CEST	51309	9988	192.168.2.7	62.118.150.40
Jul 26, 2024 02:28:53.767781973 CEST	9988	51309	62.118.150.40	192.168.2.7
Jul 26, 2024 02:28:53.946650982 CEST	51313	445	192.168.2.7	62.118.78.113
Jul 26, 2024 02:28:53.951611042 CEST	445	51313	62.118.78.113	192.168.2.7
Jul 26, 2024 02:28:53.951719999 CEST	51313	445	192.168.2.7	62.118.78.113
Jul 26, 2024 02:28:53.951823950 CEST	51313	445	192.168.2.7	62.118.78.113
Jul 26, 2024 02:28:53.956546068 CEST	445	51313	62.118.78.113	192.168.2.7
Jul 26, 2024 02:28:53.977536917 CEST	51307	139	192.168.2.7	62.118.143.145
Jul 26, 2024 02:28:54.118197918 CEST	51302	139	192.168.2.7	62.118.140.194
Jul 26, 2024 02:28:54.211909056 CEST	51303	139	192.168.2.7	62.118.253.27
Jul 26, 2024 02:28:54.290119886 CEST	51310	139	192.168.2.7	62.118.147.145
Jul 26, 2024 02:28:54.336900949 CEST	51306	139	192.168.2.7	62.118.132.5
Jul 26, 2024 02:28:54.368184090 CEST	51309	9988	192.168.2.7	62.118.150.40
Jul 26, 2024 02:28:54.373029947 CEST	9988	51309	62.118.150.40	192.168.2.7
Jul 26, 2024 02:28:54.461992025 CEST	51287	445	192.168.2.7	62.118.138.100
Jul 26, 2024 02:28:54.461991072 CEST	51288	445	192.168.2.7	62.118.155.156
Jul 26, 2024 02:28:54.462243080 CEST	51314	139	192.168.2.7	62.118.138.100
Jul 26, 2024 02:28:54.462251902 CEST	51315	139	192.168.2.7	62.118.155.156
Jul 26, 2024 02:28:54.681066990 CEST	51316	445	192.168.2.7	62.118.95.82
Jul 26, 2024 02:28:54.681065083 CEST	51317	445	192.168.2.7	62.118.253.29
Jul 26, 2024 02:28:54.686043978 CEST	445	51317	62.118.253.29	192.168.2.7
Jul 26, 2024 02:28:54.686072111 CEST	445	51316	62.118.95.82	192.168.2.7
Jul 26, 2024 02:28:54.686189890 CEST	51316	445	192.168.2.7	62.118.95.82
Jul 26, 2024 02:28:54.686191082 CEST	51317	445	192.168.2.7	62.118.253.29
Jul 26, 2024 02:28:54.686244011 CEST	51316	445	192.168.2.7	62.118.95.82
Jul 26, 2024 02:28:54.686331034 CEST	51317	445	192.168.2.7	62.118.253.29
Jul 26, 2024 02:28:54.691159010 CEST	445	51316	62.118.95.82	192.168.2.7
Jul 26, 2024 02:28:54.691245079 CEST	445	51317	62.118.253.29	192.168.2.7
Jul 26, 2024 02:28:54.743483067 CEST	51318	445	192.168.2.7	62.118.78.103
Jul 26, 2024 02:28:54.748402119 CEST	445	51318	62.118.78.103	192.168.2.7
Jul 26, 2024 02:28:54.748513937 CEST	51318	445	192.168.2.7	62.118.78.103
Jul 26, 2024 02:28:54.748605967 CEST	51318	445	192.168.2.7	62.118.78.103
Jul 26, 2024 02:28:54.753453970 CEST	445	51318	62.118.78.103	192.168.2.7
Jul 26, 2024 02:28:54.868216038 CEST	51292	445	192.168.2.7	62.118.253.30
Jul 26, 2024 02:28:54.868505955 CEST	51319	139	192.168.2.7	62.118.253.30
Jul 26, 2024 02:28:54.954258919 CEST	445	51308	62.118.67.53	192.168.2.7
Jul 26, 2024 02:28:54.954426050 CEST	51308	445	192.168.2.7	62.118.67.53
Jul 26, 2024 02:28:54.954543114 CEST	51308	445	192.168.2.7	62.118.67.53
Jul 26, 2024 02:28:54.981827021 CEST	9988	51309	62.118.150.40	192.168.2.7
Jul 26, 2024 02:28:54.982624054 CEST	51320	139	192.168.2.7	62.118.150.40
Jul 26, 2024 02:28:55.008865118 CEST	51293	445	192.168.2.7	62.118.249.2
Jul 26, 2024 02:28:55.009084940 CEST	51321	139	192.168.2.7	62.118.249.2
Jul 26, 2024 02:28:55.102945089 CEST	51322	445	192.168.2.7	62.118.138.85
Jul 26, 2024 02:28:55.107866049 CEST	445	51322	62.118.138.85	192.168.2.7
Jul 26, 2024 02:28:55.108001947 CEST	51322	445	192.168.2.7	62.118.138.85
Jul 26, 2024 02:28:55.108154058 CEST	51322	445	192.168.2.7	62.118.138.85
Jul 26, 2024 02:28:55.113010883 CEST	445	51322	62.118.138.85	192.168.2.7
Jul 26, 2024 02:28:55.196614027 CEST	51323	445	192.168.2.7	62.118.153.81
Jul 26, 2024 02:28:55.201705933 CEST	445	51323	62.118.153.81	192.168.2.7
Jul 26, 2024 02:28:55.201808929 CEST	51323	445	192.168.2.7	62.118.153.81
Jul 26, 2024 02:28:55.201849937 CEST	51323	445	192.168.2.7	62.118.153.81
Jul 26, 2024 02:28:55.206794024 CEST	445	51323	62.118.153.81	192.168.2.7
Jul 26, 2024 02:28:55.212177992 CEST	51324	139	192.168.2.7	62.118.67.53
Jul 26, 2024 02:28:55.462025881 CEST	51314	139	192.168.2.7	62.118.138.100
Jul 26, 2024 02:28:55.462029934 CEST	51315	139	192.168.2.7	62.118.155.156
Jul 26, 2024 02:28:55.477571964 CEST	51296	445	192.168.2.7	62.118.78.100
Jul 26, 2024 02:28:55.477906942 CEST	51325	139	192.168.2.7	62.118.78.100
Jul 26, 2024 02:28:55.480088949 CEST	445	51312	62.118.165.34	192.168.2.7
Jul 26, 2024 02:28:55.480161905 CEST	51312	445	192.168.2.7	62.118.165.34
Jul 26, 2024 02:28:55.480206966 CEST	51312	445	192.168.2.7	62.118.165.34
Jul 26, 2024 02:28:55.480361938 CEST	51326	139	192.168.2.7	62.118.165.34
Jul 26, 2024 02:28:55.649580956 CEST	51298	445	192.168.2.7	62.118.136.167
Jul 26, 2024 02:28:55.649902105 CEST	51327	139	192.168.2.7	62.118.136.167
Jul 26, 2024 02:28:55.731568098 CEST	51328	445	192.168.2.7	62.118.146.241
Jul 26, 2024 02:28:55.736500978 CEST	445	51328	62.118.146.241	192.168.2.7
Jul 26, 2024 02:28:55.736573935 CEST	51328	445	192.168.2.7	62.118.146.241
Jul 26, 2024 02:28:55.736689091 CEST	51328	445	192.168.2.7	62.118.146.241
Jul 26, 2024 02:28:55.741460085 CEST	445	51328	62.118.146.241	192.168.2.7
Jul 26, 2024 02:28:55.868148088 CEST	51319	139	192.168.2.7	62.118.253.30
Jul 26, 2024 02:28:55.993155003 CEST	51307	139	192.168.2.7	62.118.143.145
Jul 26, 2024 02:28:55.993180037 CEST	51320	139	192.168.2.7	62.118.150.40
Jul 26, 2024 02:28:56.008786917 CEST	51321	139	192.168.2.7	62.118.249.2
Jul 26, 2024 02:28:56.227519035 CEST	51324	139	192.168.2.7	62.118.67.53
Jul 26, 2024 02:28:56.290025949 CEST	51310	139	192.168.2.7	62.118.147.145
Jul 26, 2024 02:28:56.493175030 CEST	51325	139	192.168.2.7	62.118.78.100
Jul 26, 2024 02:28:56.493182898 CEST	51326	139	192.168.2.7	62.118.165.34
Jul 26, 2024 02:28:56.650187016 CEST	51327	139	192.168.2.7	62.118.136.167
Jul 26, 2024 02:28:56.960196018 CEST	445	51323	62.118.153.81	192.168.2.7
Jul 26, 2024 02:28:56.960278988 CEST	51323	445	192.168.2.7	62.118.153.81
Jul 26, 2024 02:28:56.960338116 CEST	51323	445	192.168.2.7	62.118.153.81
Jul 26, 2024 02:28:56.960371971 CEST	51323	445	192.168.2.7	62.118.153.81
Jul 26, 2024 02:28:56.965369940 CEST	445	51323	62.118.153.81	192.168.2.7
Jul 26, 2024 02:28:56.965384960 CEST	445	51323	62.118.153.81	192.168.2.7
Jul 26, 2024 02:28:56.965394020 CEST	445	51323	62.118.153.81	192.168.2.7
Jul 26, 2024 02:28:56.965662956 CEST	445	51323	62.118.153.81	192.168.2.7
Jul 26, 2024 02:28:57.040085077 CEST	51300	445	192.168.2.7	62.118.150.7
Jul 26, 2024 02:28:57.040263891 CEST	51301	445	192.168.2.7	62.118.132.3
Jul 26, 2024 02:28:57.040473938 CEST	51330	139	192.168.2.7	62.118.150.7
Jul 26, 2024 02:28:57.042186975 CEST	51329	139	192.168.2.7	62.118.132.3
Jul 26, 2024 02:28:57.102976084 CEST	51331	445	192.168.2.7	62.118.140.194
Jul 26, 2024 02:28:57.108139038 CEST	445	51331	62.118.140.194	192.168.2.7
Jul 26, 2024 02:28:57.110254049 CEST	51331	445	192.168.2.7	62.118.140.194
Jul 26, 2024 02:28:57.110369921 CEST	51331	445	192.168.2.7	62.118.140.194
Jul 26, 2024 02:28:57.116014004 CEST	445	51331	62.118.140.194	192.168.2.7
Jul 26, 2024 02:28:57.181065083 CEST	51332	445	192.168.2.7	62.118.253.27
Jul 26, 2024 02:28:57.186084032 CEST	445	51332	62.118.253.27	192.168.2.7
Jul 26, 2024 02:28:57.186367989 CEST	51332	445	192.168.2.7	62.118.253.27
Jul 26, 2024 02:28:57.186486959 CEST	51332	445	192.168.2.7	62.118.253.27
Jul 26, 2024 02:28:57.191395998 CEST	445	51332	62.118.253.27	192.168.2.7
Jul 26, 2024 02:28:57.352984905 CEST	51333	445	192.168.2.7	62.118.132.5
Jul 26, 2024 02:28:57.358112097 CEST	445	51333	62.118.132.5	192.168.2.7
Jul 26, 2024 02:28:57.358248949 CEST	51333	445	192.168.2.7	62.118.132.5
Jul 26, 2024 02:28:57.358310938 CEST	51333	445	192.168.2.7	62.118.132.5
Jul 26, 2024 02:28:57.363390923 CEST	445	51333	62.118.132.5	192.168.2.7
Jul 26, 2024 02:28:57.461985111 CEST	51314	139	192.168.2.7	62.118.138.100
Jul 26, 2024 02:28:57.461986065 CEST	51315	139	192.168.2.7	62.118.155.156
Jul 26, 2024 02:28:57.502664089 CEST	445	51328	62.118.146.241	192.168.2.7
Jul 26, 2024 02:28:57.502734900 CEST	51328	445	192.168.2.7	62.118.146.241
Jul 26, 2024 02:28:57.502808094 CEST	51328	445	192.168.2.7	62.118.146.241
Jul 26, 2024 02:28:57.503112078 CEST	51334	139	192.168.2.7	62.118.146.241
Jul 26, 2024 02:28:57.540082932 CEST	51278	445	192.168.2.7	62.118.249.109
Jul 26, 2024 02:28:57.868256092 CEST	51319	139	192.168.2.7	62.118.253.30
Jul 26, 2024 02:28:57.993236065 CEST	51320	139	192.168.2.7	62.118.150.40
Jul 26, 2024 02:28:58.008796930 CEST	51321	139	192.168.2.7	62.118.249.2
Jul 26, 2024 02:28:58.040035963 CEST	51329	139	192.168.2.7	62.118.132.3
Jul 26, 2024 02:28:58.040039062 CEST	51330	139	192.168.2.7	62.118.150.7
Jul 26, 2024 02:28:58.243145943 CEST	51324	139	192.168.2.7	62.118.67.53
Jul 26, 2024 02:28:58.446959019 CEST	51317	445	192.168.2.7	62.118.253.29
Jul 26, 2024 02:28:58.447437048 CEST	51332	445	192.168.2.7	62.118.253.27
Jul 26, 2024 02:28:58.447614908 CEST	51322	445	192.168.2.7	62.118.138.85
Jul 26, 2024 02:28:58.447675943 CEST	51331	445	192.168.2.7	62.118.140.194
Jul 26, 2024 02:28:58.447706938 CEST	51311	445	192.168.2.7	62.118.253.46
Jul 26, 2024 02:28:58.447738886 CEST	51313	445	192.168.2.7	62.118.78.113
Jul 26, 2024 02:28:58.447794914 CEST	51316	445	192.168.2.7	62.118.95.82
Jul 26, 2024 02:28:58.447827101 CEST	51280	445	192.168.2.7	62.118.78.116
Jul 26, 2024 02:28:58.447854996 CEST	51318	445	192.168.2.7	62.118.78.103
Jul 26, 2024 02:28:58.447968960 CEST	51333	445	192.168.2.7	62.118.132.5

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 26, 2024 02:26:54.942286968 CEST	58256	53	192.168.2.7	1.1.1.1
Jul 26, 2024 02:26:55.930443048 CEST	58256	53	192.168.2.7	1.1.1.1
Jul 26, 2024 02:26:56.946252108 CEST	58256	53	192.168.2.7	1.1.1.1
Jul 26, 2024 02:26:58.945740938 CEST	58256	53	192.168.2.7	1.1.1.1
Jul 26, 2024 02:27:00.493125916 CEST	53	58256	1.1.1.1	192.168.2.7
Jul 26, 2024 02:27:00.493140936 CEST	53	58256	1.1.1.1	192.168.2.7
Jul 26, 2024 02:27:00.493150949 CEST	53	58256	1.1.1.1	192.168.2.7
Jul 26, 2024 02:27:00.493221998 CEST	53	58256	1.1.1.1	192.168.2.7
Jul 26, 2024 02:27:24.546672106 CEST	53	64928	162.159.36.2	192.168.2.7
Jul 26, 2024 02:27:25.041059971 CEST	51068	53	192.168.2.7	1.1.1.1
Jul 26, 2024 02:27:25.048304081 CEST	53	51068	1.1.1.1	192.168.2.7

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Type
Jul 26, 2024 02:26:53.601080894 CEST	192.168.2.7	62.118.175.11	1253	Echo
Jul 26, 2024 02:26:53.608319998 CEST	192.168.2.7	62.118.104.174	1252	Echo
Jul 26, 2024 02:26:53.686122894 CEST	192.168.2.7	62.118.29.105	1251	Echo
Jul 26, 2024 02:26:53.713668108 CEST	192.168.2.7	62.118.154.173	1250	Echo
Jul 26, 2024 02:26:53.766392946 CEST	192.168.2.7	62.118.41.175	124f	Echo
Jul 26, 2024 02:26:53.819361925 CEST	192.168.2.7	62.118.240.65	124e	Echo
Jul 26, 2024 02:26:53.864905119 CEST	192.168.2.7	62.118.255.239	124d	Echo
Jul 26, 2024 02:26:53.868446112 CEST	192.168.2.7	62.118.63.149	124c	Echo
Jul 26, 2024 02:26:53.903215885 CEST	192.168.2.7	62.118.67.30	124b	Echo
Jul 26, 2024 02:26:53.936682940 CEST	192.168.2.7	62.118.204.103	124a	Echo
Jul 26, 2024 02:26:53.969080925 CEST	192.168.2.7	62.118.140.212	1249	Echo
Jul 26, 2024 02:26:54.061383963 CEST	192.168.2.7	62.118.61.175	1248	Echo
Jul 26, 2024 02:26:54.124377012 CEST	192.168.2.7	62.118.126.121	1247	Echo
Jul 26, 2024 02:26:54.161324978 CEST	192.168.2.7	62.118.113.126	1246	Echo
Jul 26, 2024 02:26:54.170358896 CEST	192.168.2.7	62.118.103.139	1245	Echo
Jul 26, 2024 02:26:54.311289072 CEST	192.168.2.7	62.118.255.146	1244	Echo
Jul 26, 2024 02:26:54.508765936 CEST	192.168.2.7	62.118.109.255	1243	Echo
Jul 26, 2024 02:26:54.761190891 CEST	192.168.2.7	62.118.28.237	1242	Echo
Jul 26, 2024 02:26:54.886152983 CEST	192.168.2.7	62.118.41.7	1241	Echo
Jul 26, 2024 02:26:54.960135937 CEST	192.168.2.7	62.118.177.245	1240	Echo
Jul 26, 2024 02:26:55.228533030 CEST	192.168.2.7	62.118.7.96	123f	Echo
Jul 26, 2024 02:26:55.279308081 CEST	192.168.2.7	62.118.80.136	123e	Echo
Jul 26, 2024 02:26:55.282819033 CEST	192.168.2.7	62.118.1.33	123d	Echo
Jul 26, 2024 02:26:55.306668997 CEST	192.168.2.7	62.118.205.202	123c	Echo
Jul 26, 2024 02:26:55.343122959 CEST	192.168.2.7	62.118.5.186	123b	Echo
Jul 26, 2024 02:26:55.376409054 CEST	192.168.2.7	62.118.40.113	123a	Echo
Jul 26, 2024 02:26:55.422164917 CEST	192.168.2.7	62.118.74.227	1239	Echo
Jul 26, 2024 02:26:55.447549105 CEST	192.168.2.7	62.118.115.25	1238	Echo
Jul 26, 2024 02:26:55.479640007 CEST	192.168.2.7	62.118.215.225	1237	Echo
Jul 26, 2024 02:26:55.503498077 CEST	192.168.2.7	62.118.175.11	1236	Echo
Jul 26, 2024 02:26:55.506761074 CEST	192.168.2.7	62.118.104.174	1235	Echo
Jul 26, 2024 02:26:55.508244991 CEST	192.168.2.7	62.118.29.105	1234	Echo
Jul 26, 2024 02:26:55.508869886 CEST	192.168.2.7	62.118.154.173	1233	Echo
Jul 26, 2024 02:26:55.509452105 CEST	192.168.2.7	62.118.41.175	1232	Echo
Jul 26, 2024 02:26:55.511077881 CEST	192.168.2.7	62.118.240.65	1231	Echo
Jul 26, 2024 02:26:55.511248112 CEST	192.168.2.7	62.118.20.179	1230	Echo
Jul 26, 2024 02:26:55.512135029 CEST	192.168.2.7	62.118.255.239	122f	Echo
Jul 26, 2024 02:26:55.513200998 CEST	192.168.2.7	62.118.63.149	122e	Echo
Jul 26, 2024 02:26:55.515233994 CEST	192.168.2.7	62.118.67.30	122d	Echo
Jul 26, 2024 02:26:55.515897989 CEST	192.168.2.7	62.118.204.103	122c	Echo
Jul 26, 2024 02:26:55.516747952 CEST	192.168.2.7	62.118.140.212	122b	Echo
Jul 26, 2024 02:26:55.540731907 CEST	192.168.2.7	62.118.143.222	122a	Echo
Jul 26, 2024 02:26:55.575683117 CEST	192.168.2.7	62.118.112.67	1229	Echo
Jul 26, 2024 02:26:55.622713089 CEST	192.168.2.7	62.118.56.60	1228	Echo
Jul 26, 2024 02:26:55.744570017 CEST	192.168.2.7	62.118.7.210	1227	Echo
Jul 26, 2024 02:26:55.752988100 CEST	192.168.2.7	62.118.161.70	1226	Echo
Jul 26, 2024 02:26:55.775747061 CEST	192.168.2.7	62.118.79.113	1225	Echo
Jul 26, 2024 02:26:55.809129000 CEST	192.168.2.7	62.118.72.168	1224	Echo
Jul 26, 2024 02:26:55.841239929 CEST	192.168.2.7	62.118.134.72	1223	Echo
Jul 26, 2024 02:26:55.869813919 CEST	192.168.2.7	62.118.68.1	1222	Echo
Jul 26, 2024 02:26:55.900490046 CEST	192.168.2.7	62.118.75.64	1221	Echo
Jul 26, 2024 02:26:55.931822062 CEST	192.168.2.7	62.118.199.78	1220	Echo
Jul 26, 2024 02:26:55.963179111 CEST	192.168.2.7	62.118.245.86	121f	Echo
Jul 26, 2024 02:26:55.993433952 CEST	192.168.2.7	62.118.61.175	121e	Echo
Jul 26, 2024 02:26:55.993813992 CEST	192.168.2.7	62.118.126.121	121d	Echo
Jul 26, 2024 02:26:55.994299889 CEST	192.168.2.7	62.118.113.126	121c	Echo
Jul 26, 2024 02:26:55.994518042 CEST	192.168.2.7	62.118.103.139	121b	Echo
Jul 26, 2024 02:26:55.994798899 CEST	192.168.2.7	62.118.255.146	121a	Echo
Jul 26, 2024 02:26:55.995242119 CEST	192.168.2.7	62.118.196.244	1219	Echo
Jul 26, 2024 02:26:56.027549982 CEST	192.168.2.7	62.118.135.124	1218	Echo
Jul 26, 2024 02:26:56.070574999 CEST	192.168.2.7	62.118.253.69	1217	Echo
Jul 26, 2024 02:26:56.087814093 CEST	192.168.2.7	62.118.178.211	1216	Echo
Jul 26, 2024 02:26:56.119309902 CEST	192.168.2.7	62.118.123.177	1215	Echo
Jul 26, 2024 02:26:56.150465012 CEST	192.168.2.7	62.118.119.118	1214	Echo
Jul 26, 2024 02:26:56.181476116 CEST	192.168.2.7	62.118.156.91	1213	Echo
Jul 26, 2024 02:26:56.212558031 CEST	192.168.2.7	62.118.225.62	1212	Echo
Jul 26, 2024 02:26:56.244259119 CEST	192.168.2.7	62.118.103.187	1211	Echo
Jul 26, 2024 02:26:56.275057077 CEST	192.168.2.7	62.118.50.199	1210	Echo
Jul 26, 2024 02:26:56.306632996 CEST	192.168.2.7	62.118.133.50	120f	Echo
Jul 26, 2024 02:26:56.338174105 CEST	192.168.2.7	62.118.88.65	120e	Echo
Jul 26, 2024 02:26:56.374913931 CEST	192.168.2.7	62.118.37.183	120d	Echo
Jul 26, 2024 02:26:56.415798903 CEST	192.168.2.7	62.118.7.144	120c	Echo
Jul 26, 2024 02:26:56.447875023 CEST	192.168.2.7	62.118.3.8	120b	Echo
Jul 26, 2024 02:26:56.478498936 CEST	192.168.2.7	62.118.188.223	120a	Echo
Jul 26, 2024 02:26:56.492934942 CEST	192.168.2.7	62.118.28.237	1208	Echo
Jul 26, 2024 02:26:56.493017912 CEST	192.168.2.7	62.118.109.255	1209	Echo
Jul 26, 2024 02:26:56.493275881 CEST	192.168.2.7	62.118.41.7	1207	Echo
Jul 26, 2024 02:26:56.493285894 CEST	192.168.2.7	62.118.177.245	1206	Echo
Jul 26, 2024 02:26:56.509959936 CEST	192.168.2.7	62.118.41.134	1205	Echo
Jul 26, 2024 02:26:56.541711092 CEST	192.168.2.7	62.118.2.214	1204	Echo
Jul 26, 2024 02:26:56.571971893 CEST	192.168.2.7	62.118.11.94	1203	Echo
Jul 26, 2024 02:26:56.609697104 CEST	192.168.2.7	62.118.247.146	1202	Echo
Jul 26, 2024 02:26:56.635020971 CEST	192.168.2.7	62.118.174.26	1201	Echo
Jul 26, 2024 02:26:56.665677071 CEST	192.168.2.7	62.118.112.200	1200	Echo
Jul 26, 2024 02:26:56.697030067 CEST	192.168.2.7	62.118.145.194	11ff	Echo
Jul 26, 2024 02:26:56.728163958 CEST	192.168.2.7	62.118.61.193	11fe	Echo
Jul 26, 2024 02:26:56.761321068 CEST	192.168.2.7	62.118.53.27	11fd	Echo
Jul 26, 2024 02:26:56.790786028 CEST	192.168.2.7	62.118.20.34	11fc	Echo
Jul 26, 2024 02:26:56.822074890 CEST	192.168.2.7	62.118.145.62	11fb	Echo
Jul 26, 2024 02:26:56.853168964 CEST	192.168.2.7	62.118.153.88	11fa	Echo
Jul 26, 2024 02:26:56.884530067 CEST	192.168.2.7	62.118.20.107	11f9	Echo
Jul 26, 2024 02:26:56.915800095 CEST	192.168.2.7	62.118.57.172	11f8	Echo
Jul 26, 2024 02:26:56.949522972 CEST	192.168.2.7	62.118.238.223	11f7	Echo
Jul 26, 2024 02:26:56.980561018 CEST	192.168.2.7	62.118.12.209	11f6	Echo
Jul 26, 2024 02:26:56.993485928 CEST	192.168.2.7	62.118.7.96	11f5	Echo
Jul 26, 2024 02:26:56.993598938 CEST	192.168.2.7	62.118.80.136	11f4	Echo
Jul 26, 2024 02:26:56.994010925 CEST	192.168.2.7	62.118.1.33	11f3	Echo
Jul 26, 2024 02:26:56.994487047 CEST	192.168.2.7	62.118.205.202	11f2	Echo
Jul 26, 2024 02:26:56.994884968 CEST	192.168.2.7	62.118.40.113	11f0	Echo
Jul 26, 2024 02:26:56.994937897 CEST	192.168.2.7	62.118.74.227	11ef	Echo
Jul 26, 2024 02:26:56.994995117 CEST	192.168.2.7	62.118.5.186	11f1	Echo
Jul 26, 2024 02:26:56.995112896 CEST	192.168.2.7	62.118.115.25	11ee	Echo
Jul 26, 2024 02:26:56.995208025 CEST	192.168.2.7	62.118.215.225	11ed	Echo
Jul 26, 2024 02:26:57.010345936 CEST	192.168.2.7	62.118.159.74	11ec	Echo
Jul 26, 2024 02:26:57.040498018 CEST	192.168.2.7	62.118.112.159	11eb	Echo
Jul 26, 2024 02:26:57.125996113 CEST	192.168.2.7	62.118.0.184	11ea	Echo
Jul 26, 2024 02:26:57.149935007 CEST	192.168.2.7	62.118.209.47	11e9	Echo
Jul 26, 2024 02:26:57.181508064 CEST	192.168.2.7	62.118.249.109	11e8	Echo
Jul 26, 2024 02:26:57.246485949 CEST	192.168.2.7	62.118.30.36	11e7	Echo
Jul 26, 2024 02:26:57.253716946 CEST	62.118.249.109	192.168.2.7	19e8	Echo Reply
Jul 26, 2024 02:26:57.270457029 CEST	192.168.2.7	62.118.249.109	11e6	Echo
Jul 26, 2024 02:26:57.271847010 CEST	192.168.2.7	62.118.247.85	11e5	Echo
Jul 26, 2024 02:26:57.306408882 CEST	192.168.2.7	62.118.83.231	11e4	Echo
Jul 26, 2024 02:26:57.342152119 CEST	62.118.249.109	192.168.2.7	19e6	Echo Reply
Jul 26, 2024 02:26:57.551079035 CEST	192.168.2.7	62.118.223.221	11e3	Echo
Jul 26, 2024 02:26:57.554836035 CEST	192.168.2.7	62.118.20.179	11e2	Echo
Jul 26, 2024 02:26:57.558691978 CEST	192.168.2.7	62.118.143.222	11e1	Echo
Jul 26, 2024 02:26:57.559103966 CEST	192.168.2.7	62.118.112.67	11e0	Echo
Jul 26, 2024 02:26:57.559230089 CEST	192.168.2.7	62.118.56.60	11df	Echo
Jul 26, 2024 02:26:57.559350014 CEST	192.168.2.7	62.118.7.210	11de	Echo
Jul 26, 2024 02:26:57.559457064 CEST	192.168.2.7	62.118.161.70	11dd	Echo
Jul 26, 2024 02:26:57.559562922 CEST	192.168.2.7	62.118.79.113	11dc	Echo
Jul 26, 2024 02:26:57.559654951 CEST	192.168.2.7	62.118.72.168	11db	Echo
Jul 26, 2024 02:26:57.559751034 CEST	192.168.2.7	62.118.134.72	11da	Echo
Jul 26, 2024 02:26:57.560048103 CEST	192.168.2.7	62.118.68.1	11d9	Echo
Jul 26, 2024 02:26:57.560165882 CEST	192.168.2.7	62.118.75.64	11d8	Echo
Jul 26, 2024 02:26:57.560276031 CEST	192.168.2.7	62.118.199.78	11d7	Echo
Jul 26, 2024 02:26:57.560381889 CEST	192.168.2.7	62.118.245.86	11d6	Echo
Jul 26, 2024 02:26:57.876188993 CEST	192.168.2.7	62.118.225.37	11d5	Echo
Jul 26, 2024 02:26:57.921786070 CEST	192.168.2.7	62.118.215.224	11d4	Echo
Jul 26, 2024 02:26:57.936362028 CEST	192.168.2.7	62.118.20.216	11d3	Echo
Jul 26, 2024 02:26:57.963176012 CEST	192.168.2.7	62.118.36.44	11d2	Echo
Jul 26, 2024 02:26:58.040627003 CEST	192.168.2.7	62.118.239.16	11d1	Echo
Jul 26, 2024 02:26:58.043683052 CEST	192.168.2.7	62.118.196.244	11d0	Echo
Jul 26, 2024 02:26:58.044502020 CEST	192.168.2.7	62.118.135.124	11cf	Echo
Jul 26, 2024 02:26:58.044601917 CEST	192.168.2.7	62.118.253.69	11ce	Echo
Jul 26, 2024 02:26:58.044720888 CEST	192.168.2.7	62.118.178.211	11cd	Echo
Jul 26, 2024 02:26:58.044816017 CEST	192.168.2.7	62.118.123.177	11cc	Echo
Jul 26, 2024 02:26:58.044939995 CEST	192.168.2.7	62.118.119.118	11cb	Echo
Jul 26, 2024 02:26:58.045015097 CEST	192.168.2.7	62.118.156.91	11ca	Echo
Jul 26, 2024 02:26:58.045097113 CEST	192.168.2.7	62.118.225.62	11c9	Echo
Jul 26, 2024 02:26:58.045298100 CEST	192.168.2.7	62.118.103.187	11c8	Echo
Jul 26, 2024 02:26:58.045324087 CEST	192.168.2.7	62.118.50.199	11c7	Echo
Jul 26, 2024 02:26:58.045454025 CEST	192.168.2.7	62.118.133.50	11c6	Echo
Jul 26, 2024 02:26:58.045497894 CEST	192.168.2.7	62.118.88.65	11c5	Echo
Jul 26, 2024 02:26:58.045634985 CEST	192.168.2.7	62.118.37.183	11c4	Echo
Jul 26, 2024 02:26:58.045696020 CEST	192.168.2.7	62.118.7.144	11c3	Echo
Jul 26, 2024 02:26:58.045788050 CEST	192.168.2.7	62.118.3.8	11c2	Echo
Jul 26, 2024 02:26:58.045876026 CEST	192.168.2.7	62.118.188.223	11c1	Echo
Jul 26, 2024 02:26:58.071871042 CEST	192.168.2.7	62.118.56.239	11c0	Echo
Jul 26, 2024 02:26:58.103344917 CEST	192.168.2.7	62.118.216.56	11bf	Echo
Jul 26, 2024 02:26:58.134202957 CEST	192.168.2.7	62.118.117.2	11be	Echo
Jul 26, 2024 02:26:58.165935993 CEST	192.168.2.7	62.118.114.221	11bd	Echo
Jul 26, 2024 02:26:58.217641115 CEST	192.168.2.7	62.118.136.175	11bc	Echo
Jul 26, 2024 02:26:58.243942022 CEST	192.168.2.7	62.118.190.136	11bb	Echo
Jul 26, 2024 02:26:58.275036097 CEST	192.168.2.7	62.118.71.76	11ba	Echo
Jul 26, 2024 02:26:58.317502975 CEST	192.168.2.7	62.118.149.149	11b9	Echo
Jul 26, 2024 02:26:58.353257895 CEST	192.168.2.7	62.118.73.149	11b8	Echo
Jul 26, 2024 02:26:58.384171963 CEST	192.168.2.7	62.118.185.154	11b7	Echo
Jul 26, 2024 02:26:58.433554888 CEST	192.168.2.7	62.118.147.90	11b6	Echo
Jul 26, 2024 02:26:58.462618113 CEST	192.168.2.7	62.118.24.99	11b5	Echo
Jul 26, 2024 02:26:58.497816086 CEST	192.168.2.7	62.118.230.44	11b4	Echo
Jul 26, 2024 02:26:58.498197079 CEST	192.168.2.7	62.118.41.134	11b3	Echo
Jul 26, 2024 02:26:58.498408079 CEST	192.168.2.7	62.118.2.214	11b2	Echo
Jul 26, 2024 02:26:58.498774052 CEST	192.168.2.7	62.118.11.94	11b1	Echo
Jul 26, 2024 02:26:58.498925924 CEST	192.168.2.7	62.118.247.146	11b0	Echo
Jul 26, 2024 02:26:58.499125004 CEST	192.168.2.7	62.118.174.26	11af	Echo
Jul 26, 2024 02:26:58.499321938 CEST	192.168.2.7	62.118.112.200	11ae	Echo
Jul 26, 2024 02:26:58.499522924 CEST	192.168.2.7	62.118.145.194	11ad	Echo
Jul 26, 2024 02:26:58.499522924 CEST	192.168.2.7	62.118.61.193	11ac	Echo
Jul 26, 2024 02:26:58.499685049 CEST	192.168.2.7	62.118.53.27	11ab	Echo
Jul 26, 2024 02:26:58.499742985 CEST	192.168.2.7	62.118.20.34	11aa	Echo
Jul 26, 2024 02:26:58.499948025 CEST	192.168.2.7	62.118.145.62	11a9	Echo
Jul 26, 2024 02:26:58.500135899 CEST	192.168.2.7	62.118.153.88	11a8	Echo
Jul 26, 2024 02:26:58.500164986 CEST	192.168.2.7	62.118.20.107	11a7	Echo
Jul 26, 2024 02:26:58.500302076 CEST	192.168.2.7	62.118.57.172	11a6	Echo
Jul 26, 2024 02:26:58.500411987 CEST	192.168.2.7	62.118.238.223	11a5	Echo
Jul 26, 2024 02:26:58.500549078 CEST	192.168.2.7	62.118.12.209	11a4	Echo
Jul 26, 2024 02:26:58.540040016 CEST	192.168.2.7	62.118.112.181	11a3	Echo
Jul 26, 2024 02:26:58.572134972 CEST	192.168.2.7	62.118.248.221	11a2	Echo
Jul 26, 2024 02:26:58.619025946 CEST	192.168.2.7	62.118.115.135	11a1	Echo
Jul 26, 2024 02:26:58.635174036 CEST	192.168.2.7	62.118.116.167	11a0	Echo
Jul 26, 2024 02:26:58.666074038 CEST	192.168.2.7	62.118.78.116	119f	Echo
Jul 26, 2024 02:26:58.696935892 CEST	192.168.2.7	62.118.180.23	119e	Echo
Jul 26, 2024 02:26:58.714217901 CEST	62.118.78.116	192.168.2.7	199f	Echo Reply
Jul 26, 2024 02:26:58.714977980 CEST	192.168.2.7	62.118.78.116	119d	Echo
Jul 26, 2024 02:26:58.728173971 CEST	192.168.2.7	62.118.170.132	119c	Echo
Jul 26, 2024 02:26:58.759800911 CEST	192.168.2.7	62.118.75.232	119b	Echo
Jul 26, 2024 02:26:58.763252974 CEST	62.118.78.116	192.168.2.7	199d	Echo Reply
Jul 26, 2024 02:26:58.824539900 CEST	192.168.2.7	62.118.14.16	119a	Echo
Jul 26, 2024 02:26:58.853691101 CEST	192.168.2.7	62.118.11.14	1199	Echo
Jul 26, 2024 02:26:58.887046099 CEST	192.168.2.7	62.118.60.11	1198	Echo
Jul 26, 2024 02:26:58.937880039 CEST	192.168.2.7	62.118.99.59	1197	Echo
Jul 26, 2024 02:26:58.962866068 CEST	192.168.2.7	62.118.74.142	1196	Echo
Jul 26, 2024 02:26:58.995903969 CEST	192.168.2.7	62.118.62.160	1195	Echo
Jul 26, 2024 02:26:58.996273041 CEST	192.168.2.7	62.118.159.74	1194	Echo
Jul 26, 2024 02:26:58.996542931 CEST	192.168.2.7	62.118.112.159	1193	Echo
Jul 26, 2024 02:26:58.996675014 CEST	192.168.2.7	62.118.0.184	1192	Echo
Jul 26, 2024 02:26:58.996716022 CEST	192.168.2.7	62.118.209.47	1191	Echo
Jul 26, 2024 02:26:58.996834040 CEST	192.168.2.7	62.118.30.36	1190	Echo
Jul 26, 2024 02:26:58.996880054 CEST	192.168.2.7	62.118.247.85	118f	Echo
Jul 26, 2024 02:26:58.996989012 CEST	192.168.2.7	62.118.83.231	118e	Echo
Jul 26, 2024 02:26:59.033720016 CEST	192.168.2.7	62.118.140.118	118d	Echo
Jul 26, 2024 02:26:59.056149006 CEST	192.168.2.7	62.118.100.119	118c	Echo
Jul 26, 2024 02:26:59.087548971 CEST	192.168.2.7	62.118.129.34	118b	Echo
Jul 26, 2024 02:26:59.150732994 CEST	192.168.2.7	62.118.216.208	118a	Echo
Jul 26, 2024 02:26:59.183171988 CEST	192.168.2.7	62.118.147.51	1189	Echo
Jul 26, 2024 02:26:59.228974104 CEST	192.168.2.7	62.118.5.246	1188	Echo
Jul 26, 2024 02:26:59.244368076 CEST	192.168.2.7	62.118.49.161	1187	Echo
Jul 26, 2024 02:26:59.275625944 CEST	192.168.2.7	62.118.56.113	1186	Echo
Jul 26, 2024 02:26:59.306041956 CEST	192.168.2.7	62.118.5.50	1185	Echo
Jul 26, 2024 02:26:59.338489056 CEST	192.168.2.7	62.118.17.91	1184	Echo
Jul 26, 2024 02:26:59.369000912 CEST	192.168.2.7	62.118.235.120	1183	Echo
Jul 26, 2024 02:26:59.400012970 CEST	192.168.2.7	62.118.243.196	1182	Echo
Jul 26, 2024 02:26:59.431260109 CEST	192.168.2.7	62.118.141.218	1181	Echo
Jul 26, 2024 02:26:59.462454081 CEST	192.168.2.7	62.118.154.37	1180	Echo
Jul 26, 2024 02:26:59.493325949 CEST	192.168.2.7	62.118.223.221	117f	Echo
Jul 26, 2024 02:26:59.494815111 CEST	192.168.2.7	62.118.76.43	117e	Echo
Jul 26, 2024 02:26:59.498246908 CEST	192.168.2.7	62.118.225.37	117d	Echo
Jul 26, 2024 02:26:59.498456955 CEST	192.168.2.7	62.118.215.224	117c	Echo
Jul 26, 2024 02:26:59.498794079 CEST	192.168.2.7	62.118.20.216	117b	Echo
Jul 26, 2024 02:26:59.498928070 CEST	192.168.2.7	62.118.36.44	117a	Echo
Jul 26, 2024 02:26:59.525201082 CEST	192.168.2.7	62.118.52.34	1179	Echo
Jul 26, 2024 02:26:59.556932926 CEST	192.168.2.7	62.118.46.129	1178	Echo
Jul 26, 2024 02:26:59.587204933 CEST	192.168.2.7	62.118.23.177	1177	Echo
Jul 26, 2024 02:26:59.618531942 CEST	192.168.2.7	62.118.54.127	1176	Echo
Jul 26, 2024 02:26:59.649611950 CEST	192.168.2.7	62.118.32.199	1175	Echo
Jul 26, 2024 02:26:59.681015015 CEST	192.168.2.7	62.118.122.166	1174	Echo
Jul 26, 2024 02:26:59.717346907 CEST	192.168.2.7	62.118.121.123	1173	Echo
Jul 26, 2024 02:26:59.744431973 CEST	192.168.2.7	62.118.178.121	1172	Echo
Jul 26, 2024 02:26:59.775072098 CEST	192.168.2.7	62.118.219.178	1171	Echo
Jul 26, 2024 02:26:59.808315039 CEST	192.168.2.7	62.118.246.219	1170	Echo
Jul 26, 2024 02:26:59.837223053 CEST	192.168.2.7	62.118.81.226	116f	Echo
Jul 26, 2024 02:26:59.871226072 CEST	192.168.2.7	62.118.194.184	116e	Echo
Jul 26, 2024 02:26:59.926752090 CEST	192.168.2.7	62.118.203.193	116d	Echo
Jul 26, 2024 02:27:00.020138025 CEST	192.168.2.7	62.118.239.16	116c	Echo
Jul 26, 2024 02:27:00.021821022 CEST	192.168.2.7	62.118.230.78	116b	Echo
Jul 26, 2024 02:27:00.132280111 CEST	192.168.2.7	62.118.152.80	116a	Echo
Jul 26, 2024 02:27:00.282854080 CEST	192.168.2.7	62.118.73.80	1169	Echo
Jul 26, 2024 02:27:00.294689894 CEST	192.168.2.7	62.118.11.45	1168	Echo
Jul 26, 2024 02:27:00.309545040 CEST	192.168.2.7	62.118.44.11	1167	Echo
Jul 26, 2024 02:27:00.328174114 CEST	192.168.2.7	62.118.56.239	1166	Echo
Jul 26, 2024 02:27:00.343374968 CEST	192.168.2.7	62.118.216.56	1165	Echo
Jul 26, 2024 02:27:00.365102053 CEST	192.168.2.7	62.118.117.2	1164	Echo
Jul 26, 2024 02:27:00.369164944 CEST	192.168.2.7	62.118.140.197	1163	Echo
Jul 26, 2024 02:27:00.371716022 CEST	192.168.2.7	62.118.114.221	1162	Echo
Jul 26, 2024 02:27:00.372189045 CEST	192.168.2.7	62.118.136.175	1161	Echo
Jul 26, 2024 02:27:00.373325109 CEST	192.168.2.7	62.118.190.136	1160	Echo
Jul 26, 2024 02:27:00.374254942 CEST	192.168.2.7	62.118.71.76	115f	Echo
Jul 26, 2024 02:27:00.378175020 CEST	192.168.2.7	62.118.149.149	115e	Echo
Jul 26, 2024 02:27:00.382582903 CEST	192.168.2.7	62.118.73.149	115d	Echo
Jul 26, 2024 02:27:00.401617050 CEST	192.168.2.7	62.118.185.154	115c	Echo
Jul 26, 2024 02:27:00.428839922 CEST	192.168.2.7	62.118.147.90	115b	Echo
Jul 26, 2024 02:27:00.450438023 CEST	192.168.2.7	62.118.250.193	115a	Echo
Jul 26, 2024 02:27:00.457873106 CEST	192.168.2.7	62.118.24.99	1159	Echo
Jul 26, 2024 02:27:00.537600040 CEST	192.168.2.7	62.118.230.44	1158	Echo
Jul 26, 2024 02:27:00.613796949 CEST	192.168.2.7	62.118.166.250	1157	Echo
Jul 26, 2024 02:27:00.614964962 CEST	192.168.2.7	62.118.82.54	1156	Echo
Jul 26, 2024 02:27:00.630697012 CEST	192.168.2.7	62.118.112.181	1155	Echo
Jul 26, 2024 02:27:00.630861044 CEST	192.168.2.7	62.118.248.221	1154	Echo
Jul 26, 2024 02:27:00.630888939 CEST	192.168.2.7	62.118.115.135	1153	Echo
Jul 26, 2024 02:27:00.630969048 CEST	192.168.2.7	62.118.116.167	1152	Echo
Jul 26, 2024 02:27:00.631014109 CEST	192.168.2.7	62.118.180.23	1151	Echo
Jul 26, 2024 02:27:00.631062031 CEST	192.168.2.7	62.118.75.232	1150	Echo
Jul 26, 2024 02:27:00.631078005 CEST	192.168.2.7	62.118.170.132	114f	Echo
Jul 26, 2024 02:27:00.631150007 CEST	192.168.2.7	62.118.14.16	114e	Echo
Jul 26, 2024 02:27:00.631217957 CEST	192.168.2.7	62.118.11.14	114d	Echo
Jul 26, 2024 02:27:00.631688118 CEST	192.168.2.7	62.118.60.11	114c	Echo
Jul 26, 2024 02:27:00.632894993 CEST	192.168.2.7	62.118.99.59	114b	Echo
Jul 26, 2024 02:27:00.633732080 CEST	192.168.2.7	62.118.74.142	114a	Echo
Jul 26, 2024 02:27:00.635670900 CEST	192.168.2.7	62.118.19.116	1149	Echo
Jul 26, 2024 02:27:00.671303988 CEST	192.168.2.7	62.118.93.120	1148	Echo
Jul 26, 2024 02:27:00.710875988 CEST	192.168.2.7	62.118.119.93	1147	Echo
Jul 26, 2024 02:27:00.762247086 CEST	192.168.2.7	62.118.136.151	1146	Echo
Jul 26, 2024 02:27:00.790776014 CEST	192.168.2.7	62.118.26.36	1145	Echo
Jul 26, 2024 02:27:00.825478077 CEST	192.168.2.7	62.118.84.6	1144	Echo
Jul 26, 2024 02:27:00.853120089 CEST	192.168.2.7	62.118.253.177	1143	Echo
Jul 26, 2024 02:27:00.885231972 CEST	192.168.2.7	62.118.15.253	1142	Echo
Jul 26, 2024 02:27:00.917072058 CEST	192.168.2.7	62.118.206.68	1141	Echo
Jul 26, 2024 02:27:00.949951887 CEST	192.168.2.7	62.118.59.198	1140	Echo
Jul 26, 2024 02:27:00.978282928 CEST	192.168.2.7	62.118.5.129	113f	Echo
Jul 26, 2024 02:27:00.993366003 CEST	192.168.2.7	62.118.62.160	113e	Echo
Jul 26, 2024 02:27:00.995899916 CEST	192.168.2.7	62.118.140.118	113d	Echo
Jul 26, 2024 02:27:00.996023893 CEST	192.168.2.7	62.118.100.119	113c	Echo
Jul 26, 2024 02:27:00.996319056 CEST	192.168.2.7	62.118.129.34	113b	Echo
Jul 26, 2024 02:27:00.996385098 CEST	192.168.2.7	62.118.216.208	113a	Echo
Jul 26, 2024 02:27:00.996407986 CEST	192.168.2.7	62.118.147.51	1139	Echo
Jul 26, 2024 02:27:00.996500969 CEST	192.168.2.7	62.118.5.246	1138	Echo
Jul 26, 2024 02:27:00.996597052 CEST	192.168.2.7	62.118.49.161	1137	Echo
Jul 26, 2024 02:27:00.996701002 CEST	192.168.2.7	62.118.56.113	1136	Echo
Jul 26, 2024 02:27:00.996835947 CEST	192.168.2.7	62.118.5.50	1135	Echo
Jul 26, 2024 02:27:00.997026920 CEST	192.168.2.7	62.118.235.120	1133	Echo
Jul 26, 2024 02:27:00.997026920 CEST	192.168.2.7	62.118.243.196	1132	Echo
Jul 26, 2024 02:27:00.997090101 CEST	192.168.2.7	62.118.17.91	1134	Echo
Jul 26, 2024 02:27:00.997117996 CEST	192.168.2.7	62.118.141.218	1131	Echo
Jul 26, 2024 02:27:00.997195005 CEST	192.168.2.7	62.118.154.37	1130	Echo
Jul 26, 2024 02:27:01.009278059 CEST	192.168.2.7	62.118.29.104	112f	Echo
Jul 26, 2024 02:27:01.041450024 CEST	192.168.2.7	62.118.62.29	112e	Echo
Jul 26, 2024 02:27:01.072738886 CEST	192.168.2.7	62.118.6.195	112d	Echo
Jul 26, 2024 02:27:01.105740070 CEST	192.168.2.7	62.118.160.204	112c	Echo
Jul 26, 2024 02:27:01.134514093 CEST	192.168.2.7	62.118.46.132	112b	Echo
Jul 26, 2024 02:27:01.166048050 CEST	192.168.2.7	62.118.4.161	112a	Echo
Jul 26, 2024 02:27:01.197590113 CEST	192.168.2.7	62.118.223.4	1129	Echo
Jul 26, 2024 02:27:01.228238106 CEST	192.168.2.7	62.118.0.207	1128	Echo
Jul 26, 2024 02:27:01.261235952 CEST	192.168.2.7	62.118.103.95	1127	Echo
Jul 26, 2024 02:27:01.290780067 CEST	192.168.2.7	62.118.29.38	1126	Echo
Jul 26, 2024 02:27:01.322241068 CEST	192.168.2.7	62.118.20.148	1125	Echo
Jul 26, 2024 02:27:01.353311062 CEST	192.168.2.7	62.118.94.64	1124	Echo
Jul 26, 2024 02:27:01.384362936 CEST	192.168.2.7	62.118.161.213	1123	Echo
Jul 26, 2024 02:27:01.415599108 CEST	192.168.2.7	62.118.43.224	1122	Echo
Jul 26, 2024 02:27:01.446747065 CEST	192.168.2.7	62.118.16.44	1121	Echo
Jul 26, 2024 02:27:01.477931976 CEST	192.168.2.7	62.118.29.91	1120	Echo
Jul 26, 2024 02:27:01.493391037 CEST	192.168.2.7	62.118.76.43	111f	Echo
Jul 26, 2024 02:27:01.494604111 CEST	192.168.2.7	62.118.52.34	111e	Echo
Jul 26, 2024 02:27:01.494719982 CEST	192.168.2.7	62.118.46.129	111d	Echo
Jul 26, 2024 02:27:01.494854927 CEST	192.168.2.7	62.118.23.177	111c	Echo
Jul 26, 2024 02:27:01.495069027 CEST	192.168.2.7	62.118.54.127	111b	Echo
Jul 26, 2024 02:27:01.495227098 CEST	192.168.2.7	62.118.32.199	111a	Echo
Jul 26, 2024 02:27:01.495280981 CEST	192.168.2.7	62.118.122.166	1119	Echo
Jul 26, 2024 02:27:01.495389938 CEST	192.168.2.7	62.118.121.123	1118	Echo
Jul 26, 2024 02:27:01.495455027 CEST	192.168.2.7	62.118.178.121	1117	Echo
Jul 26, 2024 02:27:01.495562077 CEST	192.168.2.7	62.118.219.178	1116	Echo
Jul 26, 2024 02:27:01.495636940 CEST	192.168.2.7	62.118.246.219	1115	Echo
Jul 26, 2024 02:27:01.495713949 CEST	192.168.2.7	62.118.81.226	1114	Echo
Jul 26, 2024 02:27:01.495795012 CEST	192.168.2.7	62.118.194.184	1113	Echo
Jul 26, 2024 02:27:01.495862007 CEST	192.168.2.7	62.118.203.193	1112	Echo
Jul 26, 2024 02:27:01.509298086 CEST	192.168.2.7	62.118.146.3	1111	Echo
Jul 26, 2024 02:27:01.540699005 CEST	192.168.2.7	62.118.153.205	1110	Echo
Jul 26, 2024 02:27:01.571841002 CEST	192.168.2.7	62.118.131.42	110f	Echo
Jul 26, 2024 02:27:01.603296995 CEST	192.168.2.7	62.118.203.222	110e	Echo
Jul 26, 2024 02:27:01.634627104 CEST	192.168.2.7	62.118.76.115	110d	Echo
Jul 26, 2024 02:27:01.665401936 CEST	192.168.2.7	62.118.16.190	110c	Echo
Jul 26, 2024 02:27:01.696693897 CEST	192.168.2.7	62.118.31.75	110b	Echo
Jul 26, 2024 02:27:01.727889061 CEST	192.168.2.7	62.118.13.120	110a	Echo
Jul 26, 2024 02:27:01.759331942 CEST	192.168.2.7	62.118.4.12	1109	Echo
Jul 26, 2024 02:27:01.790553093 CEST	192.168.2.7	62.118.201.165	1108	Echo
Jul 26, 2024 02:27:01.821964025 CEST	192.168.2.7	62.118.37.134	1107	Echo
Jul 26, 2024 02:27:01.853343964 CEST	192.168.2.7	62.118.24.54	1106	Echo
Jul 26, 2024 02:27:01.884251118 CEST	192.168.2.7	62.118.58.161	1105	Echo
Jul 26, 2024 02:27:01.915496111 CEST	192.168.2.7	62.118.161.247	1104	Echo
Jul 26, 2024 02:27:01.962665081 CEST	192.168.2.7	62.118.101.56	1103	Echo
Jul 26, 2024 02:27:01.994288921 CEST	192.168.2.7	62.118.143.137	1102	Echo
Jul 26, 2024 02:27:01.994676113 CEST	192.168.2.7	62.118.230.78	1101	Echo
Jul 26, 2024 02:27:01.995177031 CEST	192.168.2.7	62.118.152.80	1100	Echo
Jul 26, 2024 02:27:01.995445013 CEST	192.168.2.7	62.118.73.80	10ff	Echo
Jul 26, 2024 02:27:01.995512009 CEST	192.168.2.7	62.118.11.45	10fe	Echo
Jul 26, 2024 02:27:01.995568037 CEST	192.168.2.7	62.118.44.11	10fd	Echo
Jul 26, 2024 02:27:01.997245073 CEST	192.168.2.7	62.118.140.197	10fc	Echo
Jul 26, 2024 02:27:02.000936985 CEST	192.168.2.7	62.118.250.193	10fb	Echo
Jul 26, 2024 02:27:02.024772882 CEST	192.168.2.7	62.118.155.111	10fa	Echo
Jul 26, 2024 02:27:02.056066990 CEST	192.168.2.7	62.118.147.145	10f9	Echo
Jul 26, 2024 02:27:02.087137938 CEST	192.168.2.7	62.118.24.80	10f8	Echo
Jul 26, 2024 02:27:02.095274925 CEST	62.118.147.145	192.168.2.7	18f9	Echo Reply
Jul 26, 2024 02:27:02.095922947 CEST	192.168.2.7	62.118.147.145	10f7	Echo
Jul 26, 2024 02:27:02.118561983 CEST	192.168.2.7	62.118.138.24	10f6	Echo
Jul 26, 2024 02:27:02.134980917 CEST	62.118.147.145	192.168.2.7	18f7	Echo Reply
Jul 26, 2024 02:27:02.149960995 CEST	192.168.2.7	62.118.67.138	10f5	Echo
Jul 26, 2024 02:27:02.183706999 CEST	192.168.2.7	62.118.29.68	10f4	Echo
Jul 26, 2024 02:27:02.213892937 CEST	192.168.2.7	62.118.42.29	10f3	Echo
Jul 26, 2024 02:27:02.244853973 CEST	192.168.2.7	62.118.176.62	10f2	Echo
Jul 26, 2024 02:27:02.278492928 CEST	192.168.2.7	62.118.187.194	10f1	Echo
Jul 26, 2024 02:27:02.310169935 CEST	192.168.2.7	62.118.161.217	10f0	Echo
Jul 26, 2024 02:27:02.337718010 CEST	192.168.2.7	62.118.1.60	10ef	Echo
Jul 26, 2024 02:27:02.369199038 CEST	192.168.2.7	62.118.171.94	10ee	Echo
Jul 26, 2024 02:27:02.400340080 CEST	192.168.2.7	62.118.157.171	10ed	Echo
Jul 26, 2024 02:27:02.431248903 CEST	192.168.2.7	62.118.42.118	10ec	Echo
Jul 26, 2024 02:27:02.462326050 CEST	192.168.2.7	62.118.45.170	10eb	Echo
Jul 26, 2024 02:27:02.494482994 CEST	192.168.2.7	62.118.19.46	10ea	Echo
Jul 26, 2024 02:27:02.494626999 CEST	192.168.2.7	62.118.166.250	10e9	Echo
Jul 26, 2024 02:27:02.494807959 CEST	192.168.2.7	62.118.82.54	10e8	Echo
Jul 26, 2024 02:27:02.499507904 CEST	192.168.2.7	62.118.19.116	10e7	Echo
Jul 26, 2024 02:27:02.499553919 CEST	192.168.2.7	62.118.93.120	10e6	Echo
Jul 26, 2024 02:27:02.500024080 CEST	192.168.2.7	62.118.119.93	10e5	Echo
Jul 26, 2024 02:27:02.500109911 CEST	192.168.2.7	62.118.136.151	10e4	Echo
Jul 26, 2024 02:27:02.500272036 CEST	192.168.2.7	62.118.26.36	10e3	Echo
Jul 26, 2024 02:27:02.500348091 CEST	192.168.2.7	62.118.84.6	10e2	Echo
Jul 26, 2024 02:27:02.500416994 CEST	192.168.2.7	62.118.253.177	10e1	Echo
Jul 26, 2024 02:27:02.500451088 CEST	192.168.2.7	62.118.15.253	10e0	Echo
Jul 26, 2024 02:27:02.500530005 CEST	192.168.2.7	62.118.206.68	10df	Echo
Jul 26, 2024 02:27:02.500577927 CEST	192.168.2.7	62.118.59.198	10de	Echo
Jul 26, 2024 02:27:02.500668049 CEST	192.168.2.7	62.118.5.129	10dd	Echo
Jul 26, 2024 02:27:02.525151968 CEST	192.168.2.7	62.118.219.252	10dc	Echo
Jul 26, 2024 02:27:02.556138992 CEST	192.168.2.7	62.118.153.127	10db	Echo
Jul 26, 2024 02:27:02.587654114 CEST	192.168.2.7	62.118.15.223	10da	Echo
Jul 26, 2024 02:27:02.621824980 CEST	192.168.2.7	62.118.165.158	10d9	Echo
Jul 26, 2024 02:27:02.653187037 CEST	192.168.2.7	62.118.204.71	10d8	Echo
Jul 26, 2024 02:27:02.682250023 CEST	192.168.2.7	62.118.145.117	10d7	Echo
Jul 26, 2024 02:27:02.796242952 CEST	192.168.2.7	62.118.234.66	10d6	Echo
Jul 26, 2024 02:27:02.863398075 CEST	192.168.2.7	62.118.97.234	10d5	Echo
Jul 26, 2024 02:27:02.901652098 CEST	192.168.2.7	62.118.117.114	10d4	Echo
Jul 26, 2024 02:27:02.970869064 CEST	192.168.2.7	62.118.128.77	10d3	Echo
Jul 26, 2024 02:27:03.018255949 CEST	192.168.2.7	62.118.34.210	10d2	Echo
Jul 26, 2024 02:27:03.025245905 CEST	192.168.2.7	62.118.29.104	10d1	Echo
Jul 26, 2024 02:27:03.025437117 CEST	192.168.2.7	62.118.62.29	10d0	Echo
Jul 26, 2024 02:27:03.025535107 CEST	192.168.2.7	62.118.6.195	10cf	Echo
Jul 26, 2024 02:27:03.025902033 CEST	192.168.2.7	62.118.160.204	10ce	Echo
Jul 26, 2024 02:27:03.026103020 CEST	192.168.2.7	62.118.4.161	10cc	Echo
Jul 26, 2024 02:27:03.026108980 CEST	192.168.2.7	62.118.46.132	10cd	Echo
Jul 26, 2024 02:27:03.026185036 CEST	192.168.2.7	62.118.223.4	10cb	Echo
Jul 26, 2024 02:27:03.026427984 CEST	192.168.2.7	62.118.0.207	10ca	Echo
Jul 26, 2024 02:27:03.026647091 CEST	192.168.2.7	62.118.103.95	10c9	Echo
Jul 26, 2024 02:27:03.026731014 CEST	192.168.2.7	62.118.29.38	10c8	Echo
Jul 26, 2024 02:27:03.026906013 CEST	192.168.2.7	62.118.20.148	10c7	Echo
Jul 26, 2024 02:27:03.027220964 CEST	192.168.2.7	62.118.94.64	10c6	Echo
Jul 26, 2024 02:27:03.027364969 CEST	192.168.2.7	62.118.161.213	10c5	Echo
Jul 26, 2024 02:27:03.027447939 CEST	192.168.2.7	62.118.43.224	10c4	Echo
Jul 26, 2024 02:27:03.027538061 CEST	192.168.2.7	62.118.16.44	10c3	Echo
Jul 26, 2024 02:27:03.027816057 CEST	192.168.2.7	62.118.29.91	10c2	Echo
Jul 26, 2024 02:27:03.045900106 CEST	192.168.2.7	62.118.186.221	10c1	Echo
Jul 26, 2024 02:27:03.072314978 CEST	192.168.2.7	62.118.21.191	10c0	Echo
Jul 26, 2024 02:27:03.102878094 CEST	192.168.2.7	62.118.4.35	10bf	Echo
Jul 26, 2024 02:27:03.139590025 CEST	192.168.2.7	62.118.65.110	10be	Echo
Jul 26, 2024 02:27:03.174078941 CEST	192.168.2.7	62.118.41.21	10bd	Echo
Jul 26, 2024 02:27:03.211602926 CEST	192.168.2.7	62.118.41.4	10bc	Echo
Jul 26, 2024 02:27:03.245073080 CEST	192.168.2.7	62.118.244.32	10bb	Echo
Jul 26, 2024 02:27:03.275006056 CEST	192.168.2.7	62.118.29.107	10ba	Echo
Jul 26, 2024 02:27:03.306204081 CEST	192.168.2.7	62.118.230.63	10b9	Echo
Jul 26, 2024 02:27:03.337307930 CEST	192.168.2.7	62.118.72.44	10b8	Echo
Jul 26, 2024 02:27:03.368613005 CEST	192.168.2.7	62.118.69.74	10b7	Echo
Jul 26, 2024 02:27:03.399755955 CEST	192.168.2.7	62.118.173.36	10b6	Echo
Jul 26, 2024 02:27:03.430963993 CEST	192.168.2.7	62.118.41.197	10b5	Echo
Jul 26, 2024 02:27:03.462347984 CEST	192.168.2.7	62.118.4.163	10b4	Echo
Jul 26, 2024 02:27:03.494216919 CEST	192.168.2.7	62.118.171.134	10b3	Echo
Jul 26, 2024 02:27:03.497721910 CEST	192.168.2.7	62.118.146.3	10b2	Echo
Jul 26, 2024 02:27:03.497845888 CEST	192.168.2.7	62.118.153.205	10b1	Echo
Jul 26, 2024 02:27:03.497942924 CEST	192.168.2.7	62.118.131.42	10b0	Echo
Jul 26, 2024 02:27:03.498133898 CEST	192.168.2.7	62.118.203.222	10af	Echo
Jul 26, 2024 02:27:03.498133898 CEST	192.168.2.7	62.118.76.115	10ae	Echo
Jul 26, 2024 02:27:03.498287916 CEST	192.168.2.7	62.118.16.190	10ad	Echo
Jul 26, 2024 02:27:03.498327017 CEST	192.168.2.7	62.118.31.75	10ac	Echo
Jul 26, 2024 02:27:03.498426914 CEST	192.168.2.7	62.118.13.120	10ab	Echo
Jul 26, 2024 02:27:03.498464108 CEST	192.168.2.7	62.118.4.12	10aa	Echo
Jul 26, 2024 02:27:03.498581886 CEST	192.168.2.7	62.118.201.165	10a9	Echo
Jul 26, 2024 02:27:03.498678923 CEST	192.168.2.7	62.118.37.134	10a8	Echo
Jul 26, 2024 02:27:03.498755932 CEST	192.168.2.7	62.118.24.54	10a7	Echo
Jul 26, 2024 02:27:03.498874903 CEST	192.168.2.7	62.118.58.161	10a6	Echo
Jul 26, 2024 02:27:03.498912096 CEST	192.168.2.7	62.118.161.247	10a5	Echo
Jul 26, 2024 02:27:03.498997927 CEST	192.168.2.7	62.118.101.56	10a4	Echo
Jul 26, 2024 02:27:03.524801016 CEST	192.168.2.7	62.118.90.129	10a3	Echo
Jul 26, 2024 02:27:03.555963993 CEST	192.168.2.7	62.118.11.73	10a2	Echo
Jul 26, 2024 02:27:03.587251902 CEST	192.168.2.7	62.118.62.45	10a1	Echo
Jul 26, 2024 02:27:03.618660927 CEST	192.168.2.7	62.118.67.53	10a0	Echo
Jul 26, 2024 02:27:03.649725914 CEST	192.168.2.7	62.118.181.167	109f	Echo
Jul 26, 2024 02:27:03.655612946 CEST	62.118.67.53	192.168.2.7	18a0	Echo Reply
Jul 26, 2024 02:27:03.656114101 CEST	192.168.2.7	62.118.67.53	109e	Echo
Jul 26, 2024 02:27:03.681576014 CEST	192.168.2.7	62.118.173.26	109d	Echo
Jul 26, 2024 02:27:03.693087101 CEST	62.118.67.53	192.168.2.7	189e	Echo Reply
Jul 26, 2024 02:27:03.712275028 CEST	192.168.2.7	62.118.52.25	109c	Echo
Jul 26, 2024 02:27:03.743462086 CEST	192.168.2.7	62.118.9.110	109b	Echo
Jul 26, 2024 02:27:03.774655104 CEST	192.168.2.7	62.118.55.139	109a	Echo
Jul 26, 2024 02:27:03.805934906 CEST	192.168.2.7	62.118.48.20	1099	Echo
Jul 26, 2024 02:27:03.837500095 CEST	192.168.2.7	62.118.150.183	1098	Echo
Jul 26, 2024 02:27:03.868452072 CEST	192.168.2.7	62.118.154.181	1097	Echo
Jul 26, 2024 02:27:03.899735928 CEST	192.168.2.7	62.118.88.179	1096	Echo
Jul 26, 2024 02:27:03.930926085 CEST	192.168.2.7	62.118.155.33	1095	Echo
Jul 26, 2024 02:27:03.963838100 CEST	192.168.2.7	62.118.118.99	1094	Echo
Jul 26, 2024 02:27:03.993515015 CEST	192.168.2.7	62.118.143.137	1093	Echo
Jul 26, 2024 02:27:03.994278908 CEST	192.168.2.7	62.118.145.18	1092	Echo
Jul 26, 2024 02:27:03.996920109 CEST	192.168.2.7	62.118.155.111	1091	Echo
Jul 26, 2024 02:27:03.997082949 CEST	192.168.2.7	62.118.24.80	1090	Echo
Jul 26, 2024 02:27:03.997123003 CEST	192.168.2.7	62.118.138.24	108f	Echo
Jul 26, 2024 02:27:03.997250080 CEST	192.168.2.7	62.118.67.138	108e	Echo
Jul 26, 2024 02:27:03.997270107 CEST	192.168.2.7	62.118.29.68	108d	Echo
Jul 26, 2024 02:27:03.997406960 CEST	192.168.2.7	62.118.42.29	108c	Echo
Jul 26, 2024 02:27:03.997436047 CEST	192.168.2.7	62.118.176.62	108b	Echo
Jul 26, 2024 02:27:03.997556925 CEST	192.168.2.7	62.118.187.194	108a	Echo
Jul 26, 2024 02:27:03.997581959 CEST	192.168.2.7	62.118.161.217	1089	Echo
Jul 26, 2024 02:27:03.997714996 CEST	192.168.2.7	62.118.1.60	1088	Echo
Jul 26, 2024 02:27:03.997776985 CEST	192.168.2.7	62.118.171.94	1087	Echo
Jul 26, 2024 02:27:03.997832060 CEST	192.168.2.7	62.118.157.171	1086	Echo
Jul 26, 2024 02:27:03.997911930 CEST	192.168.2.7	62.118.42.118	1085	Echo
Jul 26, 2024 02:27:03.997977972 CEST	192.168.2.7	62.118.45.170	1084	Echo
Jul 26, 2024 02:27:04.024652004 CEST	192.168.2.7	62.118.179.205	1083	Echo
Jul 26, 2024 02:27:04.056251049 CEST	192.168.2.7	62.118.244.220	1082	Echo
Jul 26, 2024 02:27:04.087327003 CEST	192.168.2.7	62.118.78.245	1081	Echo
Jul 26, 2024 02:27:04.118516922 CEST	192.168.2.7	62.118.9.133	1080	Echo
Jul 26, 2024 02:27:04.150376081 CEST	192.168.2.7	62.118.183.217	107f	Echo
Jul 26, 2024 02:27:04.181828022 CEST	192.168.2.7	62.118.45.68	107e	Echo
Jul 26, 2024 02:27:04.212544918 CEST	192.168.2.7	62.118.99.34	107d	Echo
Jul 26, 2024 02:27:04.243558884 CEST	192.168.2.7	62.118.110.2	107c	Echo
Jul 26, 2024 02:27:04.275209904 CEST	192.168.2.7	62.118.27.23	107b	Echo
Jul 26, 2024 02:27:04.306369066 CEST	192.168.2.7	62.118.18.207	107a	Echo
Jul 26, 2024 02:27:04.337728024 CEST	192.168.2.7	62.118.140.33	1079	Echo
Jul 26, 2024 02:27:04.382169008 CEST	192.168.2.7	62.118.7.195	1078	Echo
Jul 26, 2024 02:27:04.415674925 CEST	192.168.2.7	62.118.32.94	1077	Echo
Jul 26, 2024 02:27:04.450994968 CEST	192.168.2.7	62.118.11.4	1076	Echo
Jul 26, 2024 02:27:04.478049994 CEST	192.168.2.7	62.118.23.54	1075	Echo
Jul 26, 2024 02:27:04.493051052 CEST	192.168.2.7	62.118.19.46	1074	Echo
Jul 26, 2024 02:27:04.496431112 CEST	192.168.2.7	62.118.219.252	1073	Echo
Jul 26, 2024 02:27:04.496629000 CEST	192.168.2.7	62.118.153.127	1072	Echo
Jul 26, 2024 02:27:04.496773958 CEST	192.168.2.7	62.118.15.223	1071	Echo
Jul 26, 2024 02:27:04.496813059 CEST	192.168.2.7	62.118.165.158	1070	Echo
Jul 26, 2024 02:27:04.496973038 CEST	192.168.2.7	62.118.145.117	106e	Echo
Jul 26, 2024 02:27:04.497061014 CEST	192.168.2.7	62.118.204.71	106f	Echo
Jul 26, 2024 02:27:04.497106075 CEST	192.168.2.7	62.118.234.66	106d	Echo
Jul 26, 2024 02:27:04.497153997 CEST	192.168.2.7	62.118.97.234	106c	Echo
Jul 26, 2024 02:27:04.497258902 CEST	192.168.2.7	62.118.117.114	106b	Echo
Jul 26, 2024 02:27:04.497328043 CEST	192.168.2.7	62.118.128.77	106a	Echo
Jul 26, 2024 02:27:04.509139061 CEST	192.168.2.7	62.118.110.54	1069	Echo
Jul 26, 2024 02:27:04.540800095 CEST	192.168.2.7	62.118.84.38	1068	Echo
Jul 26, 2024 02:27:04.571727991 CEST	192.168.2.7	62.118.56.194	1067	Echo
Jul 26, 2024 02:27:04.603271008 CEST	192.168.2.7	62.118.146.95	1066	Echo
Jul 26, 2024 02:27:04.634141922 CEST	192.168.2.7	62.118.2.147	1065	Echo
Jul 26, 2024 02:27:04.665298939 CEST	192.168.2.7	62.118.173.1	1064	Echo
Jul 26, 2024 02:27:04.698092937 CEST	192.168.2.7	62.118.65.105	1063	Echo
Jul 26, 2024 02:27:04.728040934 CEST	192.168.2.7	62.118.195.12	1062	Echo
Jul 26, 2024 02:27:04.759366989 CEST	192.168.2.7	62.118.145.151	1061	Echo
Jul 26, 2024 02:27:04.790543079 CEST	192.168.2.7	62.118.143.145	1060	Echo
Jul 26, 2024 02:27:04.821681976 CEST	192.168.2.7	62.118.104.242	105f	Echo
Jul 26, 2024 02:27:04.832504034 CEST	62.118.143.145	192.168.2.7	1860	Echo Reply
Jul 26, 2024 02:27:04.832945108 CEST	192.168.2.7	62.118.143.145	105e	Echo
Jul 26, 2024 02:27:04.852461100 CEST	192.168.2.7	62.118.90.237	105d	Echo
Jul 26, 2024 02:27:04.873450994 CEST	62.118.143.145	192.168.2.7	185e	Echo Reply
Jul 26, 2024 02:27:04.883661032 CEST	192.168.2.7	62.118.97.129	105c	Echo
Jul 26, 2024 02:27:04.914760113 CEST	192.168.2.7	62.118.55.93	105b	Echo
Jul 26, 2024 02:27:04.946311951 CEST	192.168.2.7	62.118.109.56	105a	Echo
Jul 26, 2024 02:27:04.979921103 CEST	192.168.2.7	62.118.225.138	1059	Echo
Jul 26, 2024 02:27:04.993077993 CEST	192.168.2.7	62.118.34.210	1058	Echo
Jul 26, 2024 02:27:04.999167919 CEST	192.168.2.7	62.118.186.221	1057	Echo
Jul 26, 2024 02:27:04.999425888 CEST	192.168.2.7	62.118.21.191	1056	Echo
Jul 26, 2024 02:27:04.999620914 CEST	192.168.2.7	62.118.4.35	1055	Echo
Jul 26, 2024 02:27:04.999811888 CEST	192.168.2.7	62.118.65.110	1054	Echo
Jul 26, 2024 02:27:05.000438929 CEST	192.168.2.7	62.118.41.21	1053	Echo
Jul 26, 2024 02:27:05.000951052 CEST	192.168.2.7	62.118.41.4	1052	Echo
Jul 26, 2024 02:27:05.001385927 CEST	192.168.2.7	62.118.244.32	1051	Echo
Jul 26, 2024 02:27:05.001812935 CEST	192.168.2.7	62.118.29.107	1050	Echo
Jul 26, 2024 02:27:05.002481937 CEST	192.168.2.7	62.118.230.63	104f	Echo
Jul 26, 2024 02:27:05.003153086 CEST	192.168.2.7	62.118.72.44	104e	Echo
Jul 26, 2024 02:27:05.003274918 CEST	192.168.2.7	62.118.69.74	104d	Echo
Jul 26, 2024 02:27:05.003379107 CEST	192.168.2.7	62.118.173.36	104c	Echo
Jul 26, 2024 02:27:05.003463030 CEST	192.168.2.7	62.118.41.197	104b	Echo
Jul 26, 2024 02:27:05.003678083 CEST	192.168.2.7	62.118.4.163	104a	Echo
Jul 26, 2024 02:27:05.008522987 CEST	192.168.2.7	62.118.167.113	1049	Echo
Jul 26, 2024 02:27:05.039866924 CEST	192.168.2.7	62.118.250.73	1048	Echo
Jul 26, 2024 02:27:05.071693897 CEST	192.168.2.7	62.118.166.8	1047	Echo
Jul 26, 2024 02:27:05.102273941 CEST	192.168.2.7	62.118.212.16	1046	Echo
Jul 26, 2024 02:27:05.133512974 CEST	192.168.2.7	62.118.113.243	1045	Echo
Jul 26, 2024 02:27:05.164711952 CEST	192.168.2.7	62.118.107.226	1044	Echo
Jul 26, 2024 02:27:05.196013927 CEST	192.168.2.7	62.118.119.245	1043	Echo
Jul 26, 2024 02:27:05.227818012 CEST	192.168.2.7	62.118.250.219	1042	Echo
Jul 26, 2024 02:27:05.259061098 CEST	192.168.2.7	62.118.246.147	1041	Echo
Jul 26, 2024 02:27:05.289814949 CEST	192.168.2.7	62.118.58.87	1040	Echo
Jul 26, 2024 02:27:05.321428061 CEST	192.168.2.7	62.118.4.59	103f	Echo
Jul 26, 2024 02:27:05.352472067 CEST	192.168.2.7	62.118.71.4	103e	Echo
Jul 26, 2024 02:27:05.389908075 CEST	192.168.2.7	62.118.64.175	103d	Echo
Jul 26, 2024 02:27:05.431958914 CEST	192.168.2.7	62.118.218.225	103c	Echo
Jul 26, 2024 02:27:05.461688042 CEST	192.168.2.7	62.118.28.36	103b	Echo
Jul 26, 2024 02:27:05.503088951 CEST	192.168.2.7	62.118.171.134	103a	Echo
Jul 26, 2024 02:27:05.504147053 CEST	192.168.2.7	62.118.42.43	1039	Echo
Jul 26, 2024 02:27:05.537143946 CEST	192.168.2.7	62.118.67.83	1038	Echo
Jul 26, 2024 02:27:05.546972990 CEST	192.168.2.7	62.118.90.129	1037	Echo
Jul 26, 2024 02:27:05.547243118 CEST	192.168.2.7	62.118.11.73	1036	Echo
Jul 26, 2024 02:27:05.547368050 CEST	192.168.2.7	62.118.62.45	1035	Echo
Jul 26, 2024 02:27:05.547547102 CEST	192.168.2.7	62.118.181.167	1034	Echo
Jul 26, 2024 02:27:05.547646999 CEST	192.168.2.7	62.118.173.26	1033	Echo
Jul 26, 2024 02:27:05.547955036 CEST	192.168.2.7	62.118.52.25	1032	Echo
Jul 26, 2024 02:27:05.548085928 CEST	192.168.2.7	62.118.9.110	1031	Echo
Jul 26, 2024 02:27:05.548187017 CEST	192.168.2.7	62.118.55.139	1030	Echo
Jul 26, 2024 02:27:05.548283100 CEST	192.168.2.7	62.118.48.20	102f	Echo
Jul 26, 2024 02:27:05.548384905 CEST	192.168.2.7	62.118.150.183	102e	Echo
Jul 26, 2024 02:27:05.548517942 CEST	192.168.2.7	62.118.154.181	102d	Echo
Jul 26, 2024 02:27:05.548677921 CEST	192.168.2.7	62.118.88.179	102c	Echo
Jul 26, 2024 02:27:05.548866987 CEST	192.168.2.7	62.118.155.33	102b	Echo
Jul 26, 2024 02:27:05.549118042 CEST	192.168.2.7	62.118.118.99	102a	Echo
Jul 26, 2024 02:27:05.562872887 CEST	192.168.2.7	62.118.240.167	1029	Echo
Jul 26, 2024 02:27:05.587929010 CEST	192.168.2.7	62.118.144.240	1028	Echo
Jul 26, 2024 02:27:05.631863117 CEST	192.168.2.7	62.118.14.68	1027	Echo
Jul 26, 2024 02:27:05.657449007 CEST	192.168.2.7	62.118.231.9	1026	Echo
Jul 26, 2024 02:27:05.688221931 CEST	192.168.2.7	62.118.198.230	1025	Echo
Jul 26, 2024 02:27:05.718712091 CEST	192.168.2.7	62.118.75.199	1024	Echo
Jul 26, 2024 02:27:05.798871994 CEST	192.168.2.7	62.118.25.76	1023	Echo
Jul 26, 2024 02:27:05.805422068 CEST	192.168.2.7	62.118.11.79	1022	Echo
Jul 26, 2024 02:27:05.836613894 CEST	192.168.2.7	62.118.179.76	1021	Echo
Jul 26, 2024 02:27:05.867938042 CEST	192.168.2.7	62.118.116.67	1020	Echo
Jul 26, 2024 02:27:05.899341106 CEST	192.168.2.7	62.118.246.93	101f	Echo
Jul 26, 2024 02:27:05.930712938 CEST	192.168.2.7	62.118.221.239	101e	Echo
Jul 26, 2024 02:27:05.961605072 CEST	192.168.2.7	62.118.0.72	101d	Echo
Jul 26, 2024 02:27:05.995614052 CEST	192.168.2.7	62.118.55.136	101c	Echo
Jul 26, 2024 02:27:05.995695114 CEST	192.168.2.7	62.118.145.18	101b	Echo
Jul 26, 2024 02:27:05.999562979 CEST	192.168.2.7	62.118.179.205	101a	Echo
Jul 26, 2024 02:27:05.999686003 CEST	192.168.2.7	62.118.244.220	1019	Echo
Jul 26, 2024 02:27:05.999762058 CEST	192.168.2.7	62.118.78.245	1018	Echo
Jul 26, 2024 02:27:05.999793053 CEST	192.168.2.7	62.118.9.133	1017	Echo
Jul 26, 2024 02:27:05.999891043 CEST	192.168.2.7	62.118.183.217	1016	Echo
Jul 26, 2024 02:27:05.999928951 CEST	192.168.2.7	62.118.45.68	1015	Echo
Jul 26, 2024 02:27:06.000024080 CEST	192.168.2.7	62.118.99.34	1014	Echo
Jul 26, 2024 02:27:06.000039101 CEST	192.168.2.7	62.118.110.2	1013	Echo
Jul 26, 2024 02:27:06.000116110 CEST	192.168.2.7	62.118.27.23	1012	Echo
Jul 26, 2024 02:27:06.000164986 CEST	192.168.2.7	62.118.18.207	1011	Echo
Jul 26, 2024 02:27:06.000215054 CEST	192.168.2.7	62.118.140.33	1010	Echo
Jul 26, 2024 02:27:06.000277996 CEST	192.168.2.7	62.118.7.195	100f	Echo
Jul 26, 2024 02:27:06.000322104 CEST	192.168.2.7	62.118.32.94	100e	Echo
Jul 26, 2024 02:27:06.000396967 CEST	192.168.2.7	62.118.11.4	100d	Echo
Jul 26, 2024 02:27:06.000433922 CEST	192.168.2.7	62.118.23.54	100c	Echo
Jul 26, 2024 02:27:06.024230003 CEST	192.168.2.7	62.118.23.180	100b	Echo
Jul 26, 2024 02:27:06.055360079 CEST	192.168.2.7	62.118.47.93	100a	Echo
Jul 26, 2024 02:27:06.086744070 CEST	192.168.2.7	62.118.45.221	1009	Echo
Jul 26, 2024 02:27:06.118024111 CEST	192.168.2.7	62.118.141.100	1008	Echo
Jul 26, 2024 02:27:06.149189949 CEST	192.168.2.7	62.118.165.62	1007	Echo
Jul 26, 2024 02:27:06.180337906 CEST	192.168.2.7	62.118.95.82	1006	Echo
Jul 26, 2024 02:27:06.211730957 CEST	192.168.2.7	62.118.19.111	1005	Echo
Jul 26, 2024 02:27:06.236721039 CEST	62.118.95.82	192.168.2.7	1806	Echo Reply
Jul 26, 2024 02:27:06.237377882 CEST	192.168.2.7	62.118.95.82	1004	Echo
Jul 26, 2024 02:27:06.242795944 CEST	192.168.2.7	62.118.106.50	1003	Echo
Jul 26, 2024 02:27:06.274215937 CEST	192.168.2.7	62.118.1.98	1002	Echo
Jul 26, 2024 02:27:06.291340113 CEST	62.118.95.82	192.168.2.7	1804	Echo Reply
Jul 26, 2024 02:27:06.305275917 CEST	192.168.2.7	62.118.22.169	1001	Echo
Jul 26, 2024 02:27:06.336579084 CEST	192.168.2.7	62.118.120.22	1000	Echo
Jul 26, 2024 02:27:06.368033886 CEST	192.168.2.7	62.118.153.57	fff	Echo
Jul 26, 2024 02:27:06.402307034 CEST	192.168.2.7	62.118.41.118	ffe	Echo
Jul 26, 2024 02:27:06.431090117 CEST	192.168.2.7	62.118.136.19	ffd	Echo
Jul 26, 2024 02:27:06.461580038 CEST	192.168.2.7	62.118.230.104	ffc	Echo
Jul 26, 2024 02:27:06.496844053 CEST	192.168.2.7	62.118.110.54	ffb	Echo
Jul 26, 2024 02:27:06.496886969 CEST	192.168.2.7	62.118.84.38	ffa	Echo
Jul 26, 2024 02:27:06.496985912 CEST	192.168.2.7	62.118.56.194	ff9	Echo
Jul 26, 2024 02:27:06.497098923 CEST	192.168.2.7	62.118.146.95	ff8	Echo
Jul 26, 2024 02:27:06.497222900 CEST	192.168.2.7	62.118.2.147	ff7	Echo
Jul 26, 2024 02:27:06.497425079 CEST	192.168.2.7	62.118.65.105	ff5	Echo
Jul 26, 2024 02:27:06.497425079 CEST	192.168.2.7	62.118.173.1	ff6	Echo
Jul 26, 2024 02:27:06.497483015 CEST	192.168.2.7	62.118.195.12	ff4	Echo
Jul 26, 2024 02:27:06.497590065 CEST	192.168.2.7	62.118.145.151	ff3	Echo
Jul 26, 2024 02:27:06.497697115 CEST	192.168.2.7	62.118.104.242	ff2	Echo
Jul 26, 2024 02:27:06.497782946 CEST	192.168.2.7	62.118.90.237	ff1	Echo
Jul 26, 2024 02:27:06.497876883 CEST	192.168.2.7	62.118.97.129	ff0	Echo
Jul 26, 2024 02:27:06.497910023 CEST	192.168.2.7	62.118.55.93	fef	Echo
Jul 26, 2024 02:27:06.497975111 CEST	192.168.2.7	62.118.109.56	fee	Echo
Jul 26, 2024 02:27:06.498023033 CEST	192.168.2.7	62.118.225.138	fed	Echo
Jul 26, 2024 02:27:06.508436918 CEST	192.168.2.7	62.118.14.83	fec	Echo
Jul 26, 2024 02:27:06.539828062 CEST	192.168.2.7	62.118.45.82	feb	Echo
Jul 26, 2024 02:27:06.571211100 CEST	192.168.2.7	62.118.148.40	fea	Echo
Jul 26, 2024 02:27:06.602336884 CEST	192.168.2.7	62.118.110.220	fe9	Echo
Jul 26, 2024 02:27:06.633903980 CEST	192.168.2.7	62.118.51.111	fe8	Echo
Jul 26, 2024 02:27:06.664860010 CEST	192.168.2.7	62.118.205.51	fe7	Echo
Jul 26, 2024 02:27:06.696002007 CEST	192.168.2.7	62.118.141.166	fe6	Echo
Jul 26, 2024 02:27:06.727547884 CEST	192.168.2.7	62.118.100.18	fe5	Echo
Jul 26, 2024 02:27:06.758651972 CEST	192.168.2.7	62.118.135.238	fe4	Echo
Jul 26, 2024 02:27:06.789819002 CEST	192.168.2.7	62.118.150.4	fe3	Echo
Jul 26, 2024 02:27:06.821289062 CEST	192.168.2.7	62.118.21.236	fe2	Echo
Jul 26, 2024 02:27:06.852910042 CEST	192.168.2.7	62.118.178.234	fe1	Echo
Jul 26, 2024 02:27:06.883601904 CEST	192.168.2.7	62.118.11.175	fe0	Echo
Jul 26, 2024 02:27:06.914932013 CEST	192.168.2.7	62.118.115.20	fdf	Echo
Jul 26, 2024 02:27:06.947634935 CEST	192.168.2.7	62.118.165.20	fde	Echo
Jul 26, 2024 02:27:06.977261066 CEST	192.168.2.7	62.118.213.74	fdd	Echo
Jul 26, 2024 02:27:06.998723984 CEST	192.168.2.7	62.118.167.113	fdc	Echo
Jul 26, 2024 02:27:06.998831034 CEST	192.168.2.7	62.118.250.73	fdb	Echo
Jul 26, 2024 02:27:06.998914003 CEST	192.168.2.7	62.118.166.8	fda	Echo
Jul 26, 2024 02:27:06.998989105 CEST	192.168.2.7	62.118.212.16	fd9	Echo
Jul 26, 2024 02:27:06.999068022 CEST	192.168.2.7	62.118.113.243	fd8	Echo
Jul 26, 2024 02:27:06.999201059 CEST	192.168.2.7	62.118.107.226	fd7	Echo
Jul 26, 2024 02:27:06.999260902 CEST	192.168.2.7	62.118.119.245	fd6	Echo
Jul 26, 2024 02:27:06.999325991 CEST	192.168.2.7	62.118.250.219	fd5	Echo
Jul 26, 2024 02:27:06.999387026 CEST	192.168.2.7	62.118.246.147	fd4	Echo
Jul 26, 2024 02:27:06.999464989 CEST	192.168.2.7	62.118.58.87	fd3	Echo
Jul 26, 2024 02:27:06.999542952 CEST	192.168.2.7	62.118.4.59	fd2	Echo
Jul 26, 2024 02:27:06.999623060 CEST	192.168.2.7	62.118.71.4	fd1	Echo
Jul 26, 2024 02:27:06.999710083 CEST	192.168.2.7	62.118.64.175	fd0	Echo
Jul 26, 2024 02:27:06.999784946 CEST	192.168.2.7	62.118.218.225	fcf	Echo
Jul 26, 2024 02:27:06.999859095 CEST	192.168.2.7	62.118.28.36	fce	Echo
Jul 26, 2024 02:27:07.008410931 CEST	192.168.2.7	62.118.178.158	fcd	Echo
Jul 26, 2024 02:27:07.039720058 CEST	192.168.2.7	62.118.61.204	fcc	Echo
Jul 26, 2024 02:27:07.071080923 CEST	192.168.2.7	62.118.188.99	fcb	Echo
Jul 26, 2024 02:27:07.102215052 CEST	192.168.2.7	62.118.133.192	fca	Echo
Jul 26, 2024 02:27:07.133799076 CEST	192.168.2.7	62.118.81.10	fc9	Echo
Jul 26, 2024 02:27:07.164812088 CEST	192.168.2.7	62.118.176.178	fc8	Echo
Jul 26, 2024 02:27:07.196002960 CEST	192.168.2.7	62.118.111.115	fc7	Echo
Jul 26, 2024 02:27:07.227370024 CEST	192.168.2.7	62.118.66.111	fc6	Echo
Jul 26, 2024 02:27:07.258764029 CEST	192.168.2.7	62.118.33.56	fc5	Echo
Jul 26, 2024 02:27:07.290052891 CEST	192.168.2.7	62.118.187.95	fc4	Echo
Jul 26, 2024 02:27:07.321295977 CEST	192.168.2.7	62.118.163.24	fc3	Echo
Jul 26, 2024 02:27:07.352607012 CEST	192.168.2.7	62.118.19.183	fc2	Echo
Jul 26, 2024 02:27:07.383625984 CEST	192.168.2.7	62.118.34.22	fc1	Echo
Jul 26, 2024 02:27:07.415103912 CEST	192.168.2.7	62.118.187.120	fc0	Echo
Jul 26, 2024 02:27:07.446161985 CEST	192.168.2.7	62.118.172.118	fbf	Echo
Jul 26, 2024 02:27:07.477360010 CEST	192.168.2.7	62.118.101.198	fbe	Echo
Jul 26, 2024 02:27:07.493766069 CEST	192.168.2.7	62.118.42.43	fbd	Echo
Jul 26, 2024 02:27:07.494054079 CEST	192.168.2.7	62.118.67.83	fbc	Echo
Jul 26, 2024 02:27:07.498137951 CEST	192.168.2.7	62.118.240.167	fbb	Echo
Jul 26, 2024 02:27:07.498373985 CEST	192.168.2.7	62.118.14.68	fb9	Echo
Jul 26, 2024 02:27:07.498375893 CEST	192.168.2.7	62.118.144.240	fba	Echo
Jul 26, 2024 02:27:07.498403072 CEST	192.168.2.7	62.118.231.9	fb8	Echo
Jul 26, 2024 02:27:07.498437881 CEST	192.168.2.7	62.118.198.230	fb7	Echo
Jul 26, 2024 02:27:07.498517036 CEST	192.168.2.7	62.118.75.199	fb6	Echo
Jul 26, 2024 02:27:07.498583078 CEST	192.168.2.7	62.118.25.76	fb5	Echo
Jul 26, 2024 02:27:07.498718977 CEST	192.168.2.7	62.118.179.76	fb3	Echo
Jul 26, 2024 02:27:07.498781919 CEST	192.168.2.7	62.118.11.79	fb4	Echo
Jul 26, 2024 02:27:07.498784065 CEST	192.168.2.7	62.118.116.67	fb2	Echo
Jul 26, 2024 02:27:07.498920918 CEST	192.168.2.7	62.118.246.93	fb1	Echo
Jul 26, 2024 02:27:07.498986006 CEST	192.168.2.7	62.118.221.239	fb0	Echo
Jul 26, 2024 02:27:07.499046087 CEST	192.168.2.7	62.118.0.72	faf	Echo
Jul 26, 2024 02:27:07.508569956 CEST	192.168.2.7	62.118.113.34	fae	Echo
Jul 26, 2024 02:27:07.539836884 CEST	192.168.2.7	62.118.92.37	fad	Echo
Jul 26, 2024 02:27:07.571723938 CEST	192.168.2.7	62.118.240.93	fac	Echo
Jul 26, 2024 02:27:07.602303028 CEST	192.168.2.7	62.118.114.84	fab	Echo
Jul 26, 2024 02:27:07.633451939 CEST	192.168.2.7	62.118.199.43	faa	Echo
Jul 26, 2024 02:27:07.664787054 CEST	192.168.2.7	62.118.113.142	fa9	Echo
Jul 26, 2024 02:27:07.696073055 CEST	192.168.2.7	62.118.128.173	fa8	Echo
Jul 26, 2024 02:27:07.727247953 CEST	192.168.2.7	62.118.2.2	fa7	Echo
Jul 26, 2024 02:27:07.758429050 CEST	192.168.2.7	62.118.72.33	fa6	Echo
Jul 26, 2024 02:27:07.790024996 CEST	192.168.2.7	62.118.53.82	fa5	Echo
Jul 26, 2024 02:27:07.821116924 CEST	192.168.2.7	62.118.108.42	fa4	Echo
Jul 26, 2024 02:27:07.853650093 CEST	192.168.2.7	62.118.55.112	fa3	Echo
Jul 26, 2024 02:27:07.907901049 CEST	192.168.2.7	62.118.251.185	fa2	Echo
Jul 26, 2024 02:27:07.931664944 CEST	192.168.2.7	62.118.143.93	fa1	Echo
Jul 26, 2024 02:27:07.961822987 CEST	192.168.2.7	62.118.45.179	fa0	Echo
Jul 26, 2024 02:27:07.993890047 CEST	192.168.2.7	62.118.55.136	f9f	Echo
Jul 26, 2024 02:27:07.994055986 CEST	192.168.2.7	62.118.174.138	f9e	Echo
Jul 26, 2024 02:27:07.999566078 CEST	192.168.2.7	62.118.23.180	f9d	Echo
Jul 26, 2024 02:27:07.999639988 CEST	192.168.2.7	62.118.47.93	f9c	Echo
Jul 26, 2024 02:27:07.999818087 CEST	192.168.2.7	62.118.141.100	f9a	Echo
Jul 26, 2024 02:27:07.999876976 CEST	192.168.2.7	62.118.45.221	f9b	Echo
Jul 26, 2024 02:27:07.999891996 CEST	192.168.2.7	62.118.165.62	f99	Echo
Jul 26, 2024 02:27:07.999960899 CEST	192.168.2.7	62.118.19.111	f98	Echo
Jul 26, 2024 02:27:08.000080109 CEST	192.168.2.7	62.118.106.50	f97	Echo
Jul 26, 2024 02:27:08.000128031 CEST	192.168.2.7	62.118.1.98	f96	Echo
Jul 26, 2024 02:27:08.000241041 CEST	192.168.2.7	62.118.22.169	f95	Echo
Jul 26, 2024 02:27:08.000282049 CEST	192.168.2.7	62.118.120.22	f94	Echo
Jul 26, 2024 02:27:08.000366926 CEST	192.168.2.7	62.118.153.57	f93	Echo
Jul 26, 2024 02:27:08.000504971 CEST	192.168.2.7	62.118.41.118	f92	Echo
Jul 26, 2024 02:27:08.000523090 CEST	192.168.2.7	62.118.136.19	f91	Echo
Jul 26, 2024 02:27:08.000601053 CEST	192.168.2.7	62.118.230.104	f90	Echo
Jul 26, 2024 02:27:08.057868004 CEST	192.168.2.7	62.118.238.11	f8f	Echo
Jul 26, 2024 02:27:08.121757984 CEST	192.168.2.7	62.118.224.112	f8e	Echo
Jul 26, 2024 02:27:08.130615950 CEST	192.168.2.7	62.118.50.214	f8d	Echo
Jul 26, 2024 02:27:08.179184914 CEST	192.168.2.7	62.118.137.131	f8c	Echo
Jul 26, 2024 02:27:08.211786032 CEST	192.168.2.7	62.118.7.129	f8b	Echo
Jul 26, 2024 02:27:08.246969938 CEST	192.168.2.7	62.118.5.25	f8a	Echo
Jul 26, 2024 02:27:08.275677919 CEST	192.168.2.7	62.118.6.202	f89	Echo
Jul 26, 2024 02:27:08.308305025 CEST	192.168.2.7	62.118.88.6	f88	Echo
Jul 26, 2024 02:27:08.340462923 CEST	192.168.2.7	62.118.177.88	f87	Echo
Jul 26, 2024 02:27:08.369307995 CEST	192.168.2.7	62.118.231.177	f86	Echo
Jul 26, 2024 02:27:08.400748968 CEST	192.168.2.7	62.118.109.52	f85	Echo
Jul 26, 2024 02:27:08.431099892 CEST	192.168.2.7	62.118.236.16	f84	Echo
Jul 26, 2024 02:27:08.462105036 CEST	192.168.2.7	62.118.46.84	f83	Echo
Jul 26, 2024 02:27:08.498708010 CEST	192.168.2.7	62.118.217.81	f82	Echo
Jul 26, 2024 02:27:08.546598911 CEST	192.168.2.7	62.118.102.194	f81	Echo
Jul 26, 2024 02:27:08.547032118 CEST	192.168.2.7	62.118.14.83	f80	Echo
Jul 26, 2024 02:27:08.548401117 CEST	192.168.2.7	62.118.45.82	f7f	Echo
Jul 26, 2024 02:27:08.550112963 CEST	192.168.2.7	62.118.148.40	f7e	Echo
Jul 26, 2024 02:27:08.550848961 CEST	192.168.2.7	62.118.110.220	f7d	Echo
Jul 26, 2024 02:27:08.550982952 CEST	192.168.2.7	62.118.51.111	f7c	Echo
Jul 26, 2024 02:27:08.551213980 CEST	192.168.2.7	62.118.205.51	f7b	Echo
Jul 26, 2024 02:27:08.551489115 CEST	192.168.2.7	62.118.141.166	f7a	Echo
Jul 26, 2024 02:27:08.551604033 CEST	192.168.2.7	62.118.100.18	f79	Echo
Jul 26, 2024 02:27:08.551712036 CEST	192.168.2.7	62.118.135.238	f78	Echo
Jul 26, 2024 02:27:08.551773071 CEST	192.168.2.7	62.118.150.4	f77	Echo
Jul 26, 2024 02:27:08.551908016 CEST	192.168.2.7	62.118.21.236	f76	Echo
Jul 26, 2024 02:27:08.552015066 CEST	192.168.2.7	62.118.178.234	f75	Echo
Jul 26, 2024 02:27:08.552095890 CEST	192.168.2.7	62.118.11.175	f74	Echo
Jul 26, 2024 02:27:08.552166939 CEST	192.168.2.7	62.118.115.20	f73	Echo
Jul 26, 2024 02:27:08.552210093 CEST	192.168.2.7	62.118.165.20	f72	Echo
Jul 26, 2024 02:27:08.552280903 CEST	192.168.2.7	62.118.213.74	f71	Echo
Jul 26, 2024 02:27:08.571147919 CEST	192.168.2.7	62.118.209.167	f70	Echo
Jul 26, 2024 02:27:08.602302074 CEST	192.168.2.7	62.118.205.119	f6f	Echo
Jul 26, 2024 02:27:08.633682966 CEST	192.168.2.7	62.118.164.144	f6e	Echo
Jul 26, 2024 02:27:08.664823055 CEST	192.168.2.7	62.118.20.182	f6d	Echo
Jul 26, 2024 02:27:08.696122885 CEST	192.168.2.7	62.118.205.209	f6c	Echo
Jul 26, 2024 02:27:08.727312088 CEST	192.168.2.7	62.118.22.206	f6b	Echo
Jul 26, 2024 02:27:08.758687019 CEST	192.168.2.7	62.118.58.174	f6a	Echo
Jul 26, 2024 02:27:08.790355921 CEST	192.168.2.7	62.118.55.191	f69	Echo
Jul 26, 2024 02:27:08.821103096 CEST	192.168.2.7	62.118.230.58	f68	Echo
Jul 26, 2024 02:27:08.853928089 CEST	192.168.2.7	62.118.89.247	f67	Echo
Jul 26, 2024 02:27:08.883821011 CEST	192.168.2.7	62.118.62.113	f66	Echo
Jul 26, 2024 02:27:08.914720058 CEST	192.168.2.7	62.118.72.48	f65	Echo
Jul 26, 2024 02:27:08.946213007 CEST	192.168.2.7	62.118.39.194	f64	Echo
Jul 26, 2024 02:27:08.977319002 CEST	192.168.2.7	62.118.86.144	f63	Echo
Jul 26, 2024 02:27:08.994527102 CEST	192.168.2.7	62.118.178.158	f62	Echo
Jul 26, 2024 02:27:08.994611025 CEST	192.168.2.7	62.118.61.204	f61	Echo
Jul 26, 2024 02:27:08.994669914 CEST	192.168.2.7	62.118.188.99	f60	Echo
Jul 26, 2024 02:27:08.994703054 CEST	192.168.2.7	62.118.133.192	f5f	Echo
Jul 26, 2024 02:27:08.994795084 CEST	192.168.2.7	62.118.81.10	f5e	Echo
Jul 26, 2024 02:27:08.994827986 CEST	192.168.2.7	62.118.176.178	f5d	Echo
Jul 26, 2024 02:27:08.994925022 CEST	192.168.2.7	62.118.111.115	f5c	Echo
Jul 26, 2024 02:27:08.994941950 CEST	192.168.2.7	62.118.66.111	f5b	Echo
Jul 26, 2024 02:27:08.995038986 CEST	192.168.2.7	62.118.33.56	f5a	Echo
Jul 26, 2024 02:27:08.995068073 CEST	192.168.2.7	62.118.187.95	f59	Echo
Jul 26, 2024 02:27:08.995138884 CEST	192.168.2.7	62.118.163.24	f58	Echo
Jul 26, 2024 02:27:08.995228052 CEST	192.168.2.7	62.118.19.183	f57	Echo
Jul 26, 2024 02:27:08.995276928 CEST	192.168.2.7	62.118.34.22	f56	Echo
Jul 26, 2024 02:27:08.995316029 CEST	192.168.2.7	62.118.187.120	f55	Echo
Jul 26, 2024 02:27:08.995410919 CEST	192.168.2.7	62.118.172.118	f54	Echo
Jul 26, 2024 02:27:08.995457888 CEST	192.168.2.7	62.118.101.198	f53	Echo
Jul 26, 2024 02:27:09.008596897 CEST	192.168.2.7	62.118.58.239	f52	Echo
Jul 26, 2024 02:27:09.040011883 CEST	192.168.2.7	62.118.62.223	f51	Echo
Jul 26, 2024 02:27:09.076297045 CEST	192.168.2.7	62.118.227.251	f50	Echo
Jul 26, 2024 02:27:09.103434086 CEST	192.168.2.7	62.118.74.228	f4f	Echo
Jul 26, 2024 02:27:09.133821011 CEST	192.168.2.7	62.118.192.244	f4e	Echo
Jul 26, 2024 02:27:09.164859056 CEST	192.168.2.7	62.118.162.220	f4d	Echo
Jul 26, 2024 02:27:09.196032047 CEST	192.168.2.7	62.118.128.127	f4c	Echo
Jul 26, 2024 02:27:09.227823973 CEST	192.168.2.7	62.118.169.128	f4b	Echo
Jul 26, 2024 02:27:09.258904934 CEST	192.168.2.7	62.118.232.219	f4a	Echo
Jul 26, 2024 02:27:09.289834976 CEST	192.168.2.7	62.118.127.206	f49	Echo
Jul 26, 2024 02:27:09.321134090 CEST	192.168.2.7	62.118.4.88	f48	Echo
Jul 26, 2024 02:27:09.352365017 CEST	192.168.2.7	62.118.111.31	f47	Echo
Jul 26, 2024 02:27:09.383599043 CEST	192.168.2.7	62.118.221.132	f46	Echo
Jul 26, 2024 02:27:09.419095993 CEST	192.168.2.7	62.118.18.221	f45	Echo
Jul 26, 2024 02:27:09.450754881 CEST	192.168.2.7	62.118.168.151	f44	Echo
Jul 26, 2024 02:27:09.481036901 CEST	192.168.2.7	62.118.14.213	f43	Echo
Jul 26, 2024 02:27:09.495665073 CEST	192.168.2.7	62.118.113.34	f42	Echo
Jul 26, 2024 02:27:09.495795965 CEST	192.168.2.7	62.118.92.37	f41	Echo
Jul 26, 2024 02:27:09.496031046 CEST	192.168.2.7	62.118.240.93	f40	Echo
Jul 26, 2024 02:27:09.496202946 CEST	192.168.2.7	62.118.114.84	f3f	Echo
Jul 26, 2024 02:27:09.496378899 CEST	192.168.2.7	62.118.199.43	f3e	Echo
Jul 26, 2024 02:27:09.496835947 CEST	192.168.2.7	62.118.113.142	f3d	Echo
Jul 26, 2024 02:27:09.496973991 CEST	192.168.2.7	62.118.128.173	f3c	Echo
Jul 26, 2024 02:27:09.500027895 CEST	192.168.2.7	62.118.2.2	f3b	Echo
Jul 26, 2024 02:27:09.500915051 CEST	192.168.2.7	62.118.72.33	f3a	Echo
Jul 26, 2024 02:27:09.501189947 CEST	192.168.2.7	62.118.53.82	f39	Echo
Jul 26, 2024 02:27:09.501666069 CEST	192.168.2.7	62.118.108.42	f38	Echo
Jul 26, 2024 02:27:09.501830101 CEST	192.168.2.7	62.118.55.112	f37	Echo
Jul 26, 2024 02:27:09.502039909 CEST	192.168.2.7	62.118.251.185	f36	Echo
Jul 26, 2024 02:27:09.502322912 CEST	192.168.2.7	62.118.143.93	f35	Echo
Jul 26, 2024 02:27:09.502485037 CEST	192.168.2.7	62.118.45.179	f34	Echo
Jul 26, 2024 02:27:09.508450985 CEST	192.168.2.7	62.118.24.157	f33	Echo
Jul 26, 2024 02:27:09.539908886 CEST	192.168.2.7	62.118.60.131	f32	Echo
Jul 26, 2024 02:27:09.578131914 CEST	192.168.2.7	62.118.200.96	f31	Echo
Jul 26, 2024 02:27:09.602271080 CEST	192.168.2.7	62.118.89.68	f30	Echo
Jul 26, 2024 02:27:09.633867025 CEST	192.168.2.7	62.118.81.122	f2f	Echo
Jul 26, 2024 02:27:09.665165901 CEST	192.168.2.7	62.118.150.215	f2e	Echo
Jul 26, 2024 02:27:09.696190119 CEST	192.168.2.7	62.118.75.106	f2d	Echo
Jul 26, 2024 02:27:09.727261066 CEST	192.168.2.7	62.118.166.202	f2c	Echo
Jul 26, 2024 02:27:09.759587049 CEST	192.168.2.7	62.118.239.195	f2b	Echo
Jul 26, 2024 02:27:09.790278912 CEST	192.168.2.7	62.118.12.48	f2a	Echo
Jul 26, 2024 02:27:09.821069002 CEST	192.168.2.7	62.118.131.121	f29	Echo
Jul 26, 2024 02:27:09.852936029 CEST	192.168.2.7	62.118.127.194	f28	Echo
Jul 26, 2024 02:27:09.889170885 CEST	192.168.2.7	62.118.171.197	f27	Echo
Jul 26, 2024 02:27:09.937856913 CEST	192.168.2.7	62.118.167.255	f26	Echo
Jul 26, 2024 02:27:09.961741924 CEST	192.168.2.7	62.118.136.15	f25	Echo
Jul 26, 2024 02:27:09.993894100 CEST	192.168.2.7	62.118.25.12	f24	Echo
Jul 26, 2024 02:27:09.994059086 CEST	192.168.2.7	62.118.174.138	f23	Echo
Jul 26, 2024 02:27:09.995758057 CEST	192.168.2.7	62.118.238.11	f22	Echo
Jul 26, 2024 02:27:09.995842934 CEST	192.168.2.7	62.118.224.112	f21	Echo
Jul 26, 2024 02:27:09.995961905 CEST	192.168.2.7	62.118.50.214	f20	Echo
Jul 26, 2024 02:27:09.996048927 CEST	192.168.2.7	62.118.137.131	f1f	Echo
Jul 26, 2024 02:27:09.996217012 CEST	192.168.2.7	62.118.5.25	f1d	Echo
Jul 26, 2024 02:27:09.996303082 CEST	192.168.2.7	62.118.6.202	f1c	Echo
Jul 26, 2024 02:27:09.996346951 CEST	192.168.2.7	62.118.7.129	f1e	Echo
Jul 26, 2024 02:27:09.996386051 CEST	192.168.2.7	62.118.88.6	f1b	Echo
Jul 26, 2024 02:27:09.996512890 CEST	192.168.2.7	62.118.177.88	f1a	Echo
Jul 26, 2024 02:27:09.996591091 CEST	192.168.2.7	62.118.231.177	f19	Echo
Jul 26, 2024 02:27:09.996673107 CEST	192.168.2.7	62.118.109.52	f18	Echo
Jul 26, 2024 02:27:09.996752977 CEST	192.168.2.7	62.118.236.16	f17	Echo
Jul 26, 2024 02:27:09.996912956 CEST	192.168.2.7	62.118.46.84	f16	Echo
Jul 26, 2024 02:27:10.024310112 CEST	192.168.2.7	62.118.224.216	f15	Echo
Jul 26, 2024 02:27:10.055659056 CEST	192.168.2.7	62.118.220.142	f14	Echo
Jul 26, 2024 02:27:10.091186047 CEST	192.168.2.7	62.118.133.123	f13	Echo
Jul 26, 2024 02:27:10.118566990 CEST	192.168.2.7	62.118.126.213	f12	Echo
Jul 26, 2024 02:27:10.149416924 CEST	192.168.2.7	62.118.39.71	f11	Echo
Jul 26, 2024 02:27:10.180958986 CEST	192.168.2.7	62.118.253.19	f10	Echo
Jul 26, 2024 02:27:10.212126970 CEST	192.168.2.7	62.118.82.97	f0f	Echo
Jul 26, 2024 02:27:10.243236065 CEST	192.168.2.7	62.118.37.247	f0e	Echo
Jul 26, 2024 02:27:10.274807930 CEST	192.168.2.7	62.118.149.227	f0d	Echo
Jul 26, 2024 02:27:10.305603981 CEST	192.168.2.7	62.118.67.54	f0c	Echo
Jul 26, 2024 02:27:10.336795092 CEST	192.168.2.7	62.118.98.99	f0b	Echo
Jul 26, 2024 02:27:10.368074894 CEST	192.168.2.7	62.118.46.155	f0a	Echo
Jul 26, 2024 02:27:10.399105072 CEST	192.168.2.7	62.118.209.74	f09	Echo
Jul 26, 2024 02:27:10.430705070 CEST	192.168.2.7	62.118.47.180	f08	Echo
Jul 26, 2024 02:27:10.461761951 CEST	192.168.2.7	62.118.1.78	f07	Echo
Jul 26, 2024 02:27:10.493159056 CEST	192.168.2.7	62.118.217.81	f06	Echo
Jul 26, 2024 02:27:10.493357897 CEST	192.168.2.7	62.118.11.9	f05	Echo
Jul 26, 2024 02:27:10.493374109 CEST	192.168.2.7	62.118.102.194	f04	Echo
Jul 26, 2024 02:27:10.495222092 CEST	192.168.2.7	62.118.209.167	f03	Echo
Jul 26, 2024 02:27:10.495270014 CEST	192.168.2.7	62.118.205.119	f02	Echo
Jul 26, 2024 02:27:10.495443106 CEST	192.168.2.7	62.118.164.144	f01	Echo
Jul 26, 2024 02:27:10.495527983 CEST	192.168.2.7	62.118.20.182	f00	Echo
Jul 26, 2024 02:27:10.495681047 CEST	192.168.2.7	62.118.205.209	eff	Echo
Jul 26, 2024 02:27:10.495718956 CEST	192.168.2.7	62.118.22.206	efe	Echo
Jul 26, 2024 02:27:10.495793104 CEST	192.168.2.7	62.118.58.174	efd	Echo
Jul 26, 2024 02:27:10.496041059 CEST	192.168.2.7	62.118.230.58	efb	Echo
Jul 26, 2024 02:27:10.496088028 CEST	192.168.2.7	62.118.89.247	efa	Echo
Jul 26, 2024 02:27:10.496095896 CEST	192.168.2.7	62.118.55.191	efc	Echo
Jul 26, 2024 02:27:10.496201038 CEST	192.168.2.7	62.118.62.113	ef9	Echo
Jul 26, 2024 02:27:10.496309042 CEST	192.168.2.7	62.118.72.48	ef8	Echo
Jul 26, 2024 02:27:10.496400118 CEST	192.168.2.7	62.118.39.194	ef7	Echo
Jul 26, 2024 02:27:10.496514082 CEST	192.168.2.7	62.118.86.144	ef6	Echo
Jul 26, 2024 02:27:10.524127007 CEST	192.168.2.7	62.118.241.32	ef5	Echo
Jul 26, 2024 02:27:10.560622931 CEST	192.168.2.7	62.118.90.84	ef4	Echo
Jul 26, 2024 02:27:10.586726904 CEST	192.168.2.7	62.118.101.200	ef3	Echo
Jul 26, 2024 02:27:10.628489017 CEST	192.168.2.7	62.118.252.101	ef2	Echo
Jul 26, 2024 02:27:10.651180983 CEST	192.168.2.7	62.118.179.251	ef1	Echo
Jul 26, 2024 02:27:10.694705009 CEST	192.168.2.7	62.118.213.156	ef0	Echo
Jul 26, 2024 02:27:10.715115070 CEST	192.168.2.7	62.118.46.35	eef	Echo
Jul 26, 2024 02:27:10.743038893 CEST	192.168.2.7	62.118.138.94	eee	Echo
Jul 26, 2024 02:27:10.966698885 CEST	192.168.2.7	62.118.18.88	eed	Echo
Jul 26, 2024 02:27:10.999609947 CEST	192.168.2.7	62.118.68.118	eec	Echo
Jul 26, 2024 02:27:11.000869989 CEST	192.168.2.7	62.118.56.21	eeb	Echo
Jul 26, 2024 02:27:11.039269924 CEST	192.168.2.7	62.118.42.157	eea	Echo
Jul 26, 2024 02:27:11.041513920 CEST	192.168.2.7	62.118.58.239	ee9	Echo
Jul 26, 2024 02:27:11.047629118 CEST	192.168.2.7	62.118.62.223	ee8	Echo
Jul 26, 2024 02:27:11.047831059 CEST	192.168.2.7	62.118.227.251	ee7	Echo
Jul 26, 2024 02:27:11.048274994 CEST	192.168.2.7	62.118.74.228	ee6	Echo
Jul 26, 2024 02:27:11.048429012 CEST	192.168.2.7	62.118.192.244	ee5	Echo
Jul 26, 2024 02:27:11.048747063 CEST	192.168.2.7	62.118.162.220	ee4	Echo
Jul 26, 2024 02:27:11.049319029 CEST	192.168.2.7	62.118.169.128	ee2	Echo
Jul 26, 2024 02:27:11.049411058 CEST	192.168.2.7	62.118.128.127	ee3	Echo
Jul 26, 2024 02:27:11.049411058 CEST	192.168.2.7	62.118.232.219	ee1	Echo
Jul 26, 2024 02:27:11.049689054 CEST	192.168.2.7	62.118.127.206	ee0	Echo
Jul 26, 2024 02:27:11.050112009 CEST	192.168.2.7	62.118.4.88	edf	Echo
Jul 26, 2024 02:27:11.050231934 CEST	192.168.2.7	62.118.111.31	ede	Echo
Jul 26, 2024 02:27:11.050348043 CEST	192.168.2.7	62.118.221.132	edd	Echo
Jul 26, 2024 02:27:11.050518036 CEST	192.168.2.7	62.118.18.221	edc	Echo
Jul 26, 2024 02:27:11.051027060 CEST	192.168.2.7	62.118.168.151	edb	Echo
Jul 26, 2024 02:27:11.051342964 CEST	192.168.2.7	62.118.14.213	eda	Echo
Jul 26, 2024 02:27:11.056183100 CEST	192.168.2.7	62.118.116.65	ed9	Echo
Jul 26, 2024 02:27:11.086810112 CEST	192.168.2.7	62.118.61.11	ed8	Echo
Jul 26, 2024 02:27:11.161087036 CEST	192.168.2.7	62.118.93.139	ed7	Echo
Jul 26, 2024 02:27:11.182045937 CEST	192.168.2.7	62.118.129.2	ed6	Echo
Jul 26, 2024 02:27:11.215977907 CEST	192.168.2.7	62.118.234.128	ed5	Echo
Jul 26, 2024 02:27:11.247397900 CEST	192.168.2.7	62.118.61.234	ed4	Echo
Jul 26, 2024 02:27:11.333204031 CEST	192.168.2.7	62.118.15.131	ed3	Echo
Jul 26, 2024 02:27:11.352366924 CEST	192.168.2.7	62.118.22.203	ed2	Echo
Jul 26, 2024 02:27:11.383506060 CEST	192.168.2.7	62.118.96.22	ed1	Echo
Jul 26, 2024 02:27:11.414798975 CEST	192.168.2.7	62.118.85.96	ed0	Echo
Jul 26, 2024 02:27:11.446233988 CEST	192.168.2.7	62.118.192.165	ecf	Echo
Jul 26, 2024 02:27:11.480634928 CEST	192.168.2.7	62.118.68.238	ece	Echo
Jul 26, 2024 02:27:11.496506929 CEST	192.168.2.7	62.118.24.157	ecd	Echo
Jul 26, 2024 02:27:11.496740103 CEST	192.168.2.7	62.118.60.131	ecc	Echo
Jul 26, 2024 02:27:11.497121096 CEST	192.168.2.7	62.118.200.96	ecb	Echo
Jul 26, 2024 02:27:11.497229099 CEST	192.168.2.7	62.118.89.68	eca	Echo
Jul 26, 2024 02:27:11.497499943 CEST	192.168.2.7	62.118.81.122	ec9	Echo
Jul 26, 2024 02:27:11.497615099 CEST	192.168.2.7	62.118.150.215	ec8	Echo
Jul 26, 2024 02:27:11.497690916 CEST	192.168.2.7	62.118.75.106	ec7	Echo
Jul 26, 2024 02:27:11.498189926 CEST	192.168.2.7	62.118.166.202	ec6	Echo
Jul 26, 2024 02:27:11.498464108 CEST	192.168.2.7	62.118.239.195	ec5	Echo
Jul 26, 2024 02:27:11.498842001 CEST	192.168.2.7	62.118.12.48	ec4	Echo
Jul 26, 2024 02:27:11.499175072 CEST	192.168.2.7	62.118.131.121	ec3	Echo
Jul 26, 2024 02:27:11.499377012 CEST	192.168.2.7	62.118.127.194	ec2	Echo
Jul 26, 2024 02:27:11.499891996 CEST	192.168.2.7	62.118.171.197	ec1	Echo
Jul 26, 2024 02:27:11.500148058 CEST	192.168.2.7	62.118.167.255	ec0	Echo
Jul 26, 2024 02:27:11.500261068 CEST	192.168.2.7	62.118.136.15	ebf	Echo
Jul 26, 2024 02:27:11.508693933 CEST	192.168.2.7	62.118.169.133	ebe	Echo
Jul 26, 2024 02:27:11.547487974 CEST	192.168.2.7	62.118.14.153	ebd	Echo
Jul 26, 2024 02:27:11.575354099 CEST	192.168.2.7	62.118.86.180	ebc	Echo
Jul 26, 2024 02:27:11.619652033 CEST	192.168.2.7	62.118.55.37	ebb	Echo
Jul 26, 2024 02:27:11.650049925 CEST	192.168.2.7	62.118.187.65	eba	Echo
Jul 26, 2024 02:27:11.680453062 CEST	192.168.2.7	62.118.21.48	eb9	Echo
Jul 26, 2024 02:27:11.711621046 CEST	192.168.2.7	62.118.81.251	eb8	Echo
Jul 26, 2024 02:27:11.742897034 CEST	192.168.2.7	62.118.33.120	eb7	Echo
Jul 26, 2024 02:27:11.774230957 CEST	192.168.2.7	62.118.146.241	eb6	Echo
Jul 26, 2024 02:27:11.805529118 CEST	192.168.2.7	62.118.85.252	eb5	Echo
Jul 26, 2024 02:27:11.816900015 CEST	62.118.146.241	192.168.2.7	16b6	Echo Reply
Jul 26, 2024 02:27:11.817315102 CEST	192.168.2.7	62.118.146.241	eb4	Echo
Jul 26, 2024 02:27:11.836595058 CEST	192.168.2.7	62.118.100.217	eb3	Echo
Jul 26, 2024 02:27:11.857351065 CEST	62.118.146.241	192.168.2.7	16b4	Echo Reply
Jul 26, 2024 02:27:11.867968082 CEST	192.168.2.7	62.118.5.37	eb2	Echo
Jul 26, 2024 02:27:11.899059057 CEST	192.168.2.7	62.118.140.73	eb1	Echo
Jul 26, 2024 02:27:11.930613041 CEST	192.168.2.7	62.118.140.139	eb0	Echo
Jul 26, 2024 02:27:11.961838961 CEST	192.168.2.7	62.118.156.140	eaf	Echo
Jul 26, 2024 02:27:11.993663073 CEST	192.168.2.7	62.118.25.12	eae	Echo
Jul 26, 2024 02:27:11.993738890 CEST	192.168.2.7	62.118.155.156	ead	Echo
Jul 26, 2024 02:27:11.995579958 CEST	192.168.2.7	62.118.224.216	eac	Echo
Jul 26, 2024 02:27:11.995628119 CEST	192.168.2.7	62.118.220.142	eab	Echo
Jul 26, 2024 02:27:11.995753050 CEST	192.168.2.7	62.118.133.123	eaa	Echo
Jul 26, 2024 02:27:11.995881081 CEST	192.168.2.7	62.118.126.213	ea9	Echo
Jul 26, 2024 02:27:11.995985031 CEST	192.168.2.7	62.118.39.71	ea8	Echo
Jul 26, 2024 02:27:11.996109962 CEST	192.168.2.7	62.118.253.19	ea7	Echo
Jul 26, 2024 02:27:11.996323109 CEST	192.168.2.7	62.118.82.97	ea6	Echo
Jul 26, 2024 02:27:11.996325016 CEST	192.168.2.7	62.118.37.247	ea5	Echo
Jul 26, 2024 02:27:11.996443987 CEST	192.168.2.7	62.118.149.227	ea4	Echo
Jul 26, 2024 02:27:11.996491909 CEST	192.168.2.7	62.118.67.54	ea3	Echo
Jul 26, 2024 02:27:11.996598005 CEST	192.168.2.7	62.118.98.99	ea2	Echo
Jul 26, 2024 02:27:11.996793032 CEST	192.168.2.7	62.118.209.74	ea0	Echo
Jul 26, 2024 02:27:11.996876955 CEST	192.168.2.7	62.118.47.180	e9f	Echo
Jul 26, 2024 02:27:11.996922016 CEST	192.168.2.7	62.118.1.78	e9e	Echo
Jul 26, 2024 02:27:11.996927977 CEST	192.168.2.7	62.118.46.155	ea1	Echo
Jul 26, 2024 02:27:12.024270058 CEST	192.168.2.7	62.118.170.205	e9d	Echo
Jul 26, 2024 02:27:12.033691883 CEST	62.118.155.156	192.168.2.7	16ad	Echo Reply
Jul 26, 2024 02:27:12.034044981 CEST	192.168.2.7	62.118.155.156	e9c	Echo
Jul 26, 2024 02:27:12.055531979 CEST	192.168.2.7	62.118.37.192	e9b	Echo
Jul 26, 2024 02:27:12.075150013 CEST	62.118.155.156	192.168.2.7	169c	Echo Reply
Jul 26, 2024 02:27:12.087292910 CEST	192.168.2.7	62.118.247.171	e9a	Echo
Jul 26, 2024 02:27:12.118194103 CEST	192.168.2.7	62.118.159.204	e99	Echo
Jul 26, 2024 02:27:12.149280071 CEST	192.168.2.7	62.118.190.159	e98	Echo
Jul 26, 2024 02:27:12.180537939 CEST	192.168.2.7	62.118.123.190	e97	Echo
Jul 26, 2024 02:27:12.211751938 CEST	192.168.2.7	62.118.190.123	e96	Echo
Jul 26, 2024 02:27:12.243264914 CEST	192.168.2.7	62.118.138.100	e95	Echo
Jul 26, 2024 02:27:12.279304981 CEST	192.168.2.7	62.118.16.45	e94	Echo
Jul 26, 2024 02:27:12.283241034 CEST	62.118.138.100	192.168.2.7	1695	Echo Reply
Jul 26, 2024 02:27:12.283756018 CEST	192.168.2.7	62.118.138.100	e93	Echo
Jul 26, 2024 02:27:12.306313038 CEST	192.168.2.7	62.118.113.67	e92	Echo
Jul 26, 2024 02:27:12.323811054 CEST	62.118.138.100	192.168.2.7	1693	Echo Reply
Jul 26, 2024 02:27:12.336669922 CEST	192.168.2.7	62.118.112.113	e91	Echo
Jul 26, 2024 02:27:12.367856979 CEST	192.168.2.7	62.118.54.235	e90	Echo
Jul 26, 2024 02:27:12.399271965 CEST	192.168.2.7	62.118.142.35	e8f	Echo
Jul 26, 2024 02:27:12.430314064 CEST	192.168.2.7	62.118.160.251	e8e	Echo
Jul 26, 2024 02:27:12.461558104 CEST	192.168.2.7	62.118.128.58	e8d	Echo
Jul 26, 2024 02:27:12.493074894 CEST	192.168.2.7	62.118.11.9	e8c	Echo
Jul 26, 2024 02:27:12.494611979 CEST	192.168.2.7	62.118.241.32	e8b	Echo
Jul 26, 2024 02:27:12.494626045 CEST	192.168.2.7	62.118.90.84	e8a	Echo
Jul 26, 2024 02:27:12.494851112 CEST	192.168.2.7	62.118.252.101	e88	Echo
Jul 26, 2024 02:27:12.494877100 CEST	192.168.2.7	62.118.101.200	e89	Echo
Jul 26, 2024 02:27:12.494915009 CEST	192.168.2.7	62.118.179.251	e87	Echo
Jul 26, 2024 02:27:12.494961023 CEST	192.168.2.7	62.118.213.156	e86	Echo
Jul 26, 2024 02:27:12.495026112 CEST	192.168.2.7	62.118.46.35	e85	Echo
Jul 26, 2024 02:27:12.495074987 CEST	192.168.2.7	62.118.138.94	e84	Echo
Jul 26, 2024 02:27:12.495140076 CEST	192.168.2.7	62.118.18.88	e83	Echo
Jul 26, 2024 02:27:12.508678913 CEST	192.168.2.7	62.118.69.161	e82	Echo
Jul 26, 2024 02:27:12.541872978 CEST	192.168.2.7	62.118.34.96	e81	Echo
Jul 26, 2024 02:27:12.571604013 CEST	192.168.2.7	62.118.201.103	e80	Echo
Jul 26, 2024 02:27:12.602408886 CEST	192.168.2.7	62.118.64.176	e7f	Echo
Jul 26, 2024 02:27:12.666392088 CEST	192.168.2.7	62.118.127.207	e7e	Echo
Jul 26, 2024 02:27:12.680425882 CEST	192.168.2.7	62.118.64.168	e7d	Echo
Jul 26, 2024 02:27:12.711946964 CEST	192.168.2.7	62.118.161.220	e7c	Echo
Jul 26, 2024 02:27:12.742958069 CEST	192.168.2.7	62.118.234.252	e7b	Echo
Jul 26, 2024 02:27:12.774187088 CEST	192.168.2.7	62.118.133.83	e7a	Echo
Jul 26, 2024 02:27:12.805500031 CEST	192.168.2.7	62.118.182.76	e79	Echo
Jul 26, 2024 02:27:12.836721897 CEST	192.168.2.7	62.118.152.102	e78	Echo
Jul 26, 2024 02:27:12.868005991 CEST	192.168.2.7	62.118.188.204	e77	Echo
Jul 26, 2024 02:27:12.899131060 CEST	192.168.2.7	62.118.84.156	e76	Echo
Jul 26, 2024 02:27:12.930389881 CEST	192.168.2.7	62.118.127.22	e75	Echo
Jul 26, 2024 02:27:12.962037086 CEST	192.168.2.7	62.118.182.127	e74	Echo
Jul 26, 2024 02:27:12.993630886 CEST	192.168.2.7	62.118.68.118	e73	Echo
Jul 26, 2024 02:27:12.994050026 CEST	192.168.2.7	62.118.56.21	e72	Echo
Jul 26, 2024 02:27:12.994050980 CEST	192.168.2.7	62.118.42.157	e71	Echo
Jul 26, 2024 02:27:12.995461941 CEST	192.168.2.7	62.118.116.65	e70	Echo
Jul 26, 2024 02:27:12.995767117 CEST	192.168.2.7	62.118.61.11	e6f	Echo
Jul 26, 2024 02:27:12.995856047 CEST	192.168.2.7	62.118.93.139	e6e	Echo
Jul 26, 2024 02:27:12.996028900 CEST	192.168.2.7	62.118.234.128	e6c	Echo
Jul 26, 2024 02:27:12.996108055 CEST	192.168.2.7	62.118.61.234	e6b	Echo
Jul 26, 2024 02:27:12.996201992 CEST	192.168.2.7	62.118.15.131	e6a	Echo
Jul 26, 2024 02:27:12.996275902 CEST	192.168.2.7	62.118.22.203	e69	Echo
Jul 26, 2024 02:27:12.996355057 CEST	192.168.2.7	62.118.96.22	e68	Echo
Jul 26, 2024 02:27:12.996438980 CEST	192.168.2.7	62.118.85.96	e67	Echo
Jul 26, 2024 02:27:12.996505022 CEST	192.168.2.7	62.118.129.2	e6d	Echo
Jul 26, 2024 02:27:12.996573925 CEST	192.168.2.7	62.118.192.165	e66	Echo
Jul 26, 2024 02:27:12.996608973 CEST	192.168.2.7	62.118.68.238	e65	Echo
Jul 26, 2024 02:27:13.009028912 CEST	192.168.2.7	62.118.179.181	e64	Echo
Jul 26, 2024 02:27:13.040157080 CEST	192.168.2.7	62.118.115.243	e63	Echo
Jul 26, 2024 02:27:13.071094990 CEST	192.168.2.7	62.118.160.227	e62	Echo
Jul 26, 2024 02:27:13.102732897 CEST	192.168.2.7	62.118.241.237	e61	Echo
Jul 26, 2024 02:27:13.133698940 CEST	192.168.2.7	62.118.46.71	e60	Echo
Jul 26, 2024 02:27:13.164968967 CEST	192.168.2.7	62.118.9.208	e5f	Echo
Jul 26, 2024 02:27:13.196239948 CEST	192.168.2.7	62.118.187.11	e5e	Echo
Jul 26, 2024 02:27:13.227358103 CEST	192.168.2.7	62.118.38.187	e5d	Echo
Jul 26, 2024 02:27:13.258749962 CEST	192.168.2.7	62.118.78.100	e5c	Echo
Jul 26, 2024 02:27:13.290010929 CEST	192.168.2.7	62.118.68.78	e5b	Echo
Jul 26, 2024 02:27:13.321036100 CEST	192.168.2.7	62.118.130.68	e5a	Echo
Jul 26, 2024 02:27:13.330707073 CEST	62.118.78.100	192.168.2.7	165c	Echo Reply
Jul 26, 2024 02:27:13.332014084 CEST	192.168.2.7	62.118.78.100	e59	Echo
Jul 26, 2024 02:27:13.368977070 CEST	192.168.2.7	62.118.132.130	e58	Echo
Jul 26, 2024 02:27:13.382543087 CEST	62.118.78.100	192.168.2.7	1659	Echo Reply
Jul 26, 2024 02:27:13.399382114 CEST	192.168.2.7	62.118.85.39	e57	Echo
Jul 26, 2024 02:27:13.430329084 CEST	192.168.2.7	62.118.199.157	e56	Echo
Jul 26, 2024 02:27:13.462055922 CEST	192.168.2.7	62.118.191.96	e55	Echo
Jul 26, 2024 02:27:13.495364904 CEST	192.168.2.7	62.118.191.33	e54	Echo
Jul 26, 2024 02:27:13.497368097 CEST	192.168.2.7	62.118.169.133	e53	Echo
Jul 26, 2024 02:27:13.497462988 CEST	192.168.2.7	62.118.14.153	e52	Echo
Jul 26, 2024 02:27:13.497651100 CEST	192.168.2.7	62.118.55.37	e50	Echo
Jul 26, 2024 02:27:13.498055935 CEST	192.168.2.7	62.118.81.251	e4d	Echo
Jul 26, 2024 02:27:13.498055935 CEST	192.168.2.7	62.118.21.48	e4e	Echo
Jul 26, 2024 02:27:13.498064041 CEST	192.168.2.7	62.118.86.180	e51	Echo
Jul 26, 2024 02:27:13.498069048 CEST	192.168.2.7	62.118.187.65	e4f	Echo
Jul 26, 2024 02:27:13.498239994 CEST	192.168.2.7	62.118.85.252	e4b	Echo
Jul 26, 2024 02:27:13.498332977 CEST	192.168.2.7	62.118.33.120	e4c	Echo
Jul 26, 2024 02:27:13.498332977 CEST	192.168.2.7	62.118.100.217	e4a	Echo
Jul 26, 2024 02:27:13.498437881 CEST	192.168.2.7	62.118.5.37	e49	Echo
Jul 26, 2024 02:27:13.498621941 CEST	192.168.2.7	62.118.140.73	e48	Echo
Jul 26, 2024 02:27:13.498621941 CEST	192.168.2.7	62.118.140.139	e47	Echo
Jul 26, 2024 02:27:13.499438047 CEST	192.168.2.7	62.118.156.140	e46	Echo
Jul 26, 2024 02:27:13.524111032 CEST	192.168.2.7	62.118.101.185	e45	Echo
Jul 26, 2024 02:27:13.555782080 CEST	192.168.2.7	62.118.115.108	e44	Echo
Jul 26, 2024 02:27:13.586781979 CEST	192.168.2.7	62.118.180.128	e43	Echo
Jul 26, 2024 02:27:13.617961884 CEST	192.168.2.7	62.118.195.214	e42	Echo
Jul 26, 2024 02:27:13.649230003 CEST	192.168.2.7	62.118.121.129	e41	Echo
Jul 26, 2024 02:27:13.683856964 CEST	192.168.2.7	62.118.108.121	e40	Echo
Jul 26, 2024 02:27:13.712421894 CEST	192.168.2.7	62.118.148.131	e3f	Echo
Jul 26, 2024 02:27:13.743607044 CEST	192.168.2.7	62.118.56.51	e3e	Echo
Jul 26, 2024 02:27:13.774147034 CEST	192.168.2.7	62.118.126.149	e3d	Echo
Jul 26, 2024 02:27:13.806334019 CEST	192.168.2.7	62.118.24.224	e3c	Echo
Jul 26, 2024 02:27:13.838362932 CEST	192.168.2.7	62.118.107.130	e3b	Echo
Jul 26, 2024 02:27:13.869607925 CEST	192.168.2.7	62.118.211.106	e3a	Echo
Jul 26, 2024 02:27:13.899281979 CEST	192.168.2.7	62.118.99.211	e39	Echo
Jul 26, 2024 02:27:13.930674076 CEST	192.168.2.7	62.118.1.92	e38	Echo
Jul 26, 2024 02:27:13.961754084 CEST	192.168.2.7	62.118.81.188	e37	Echo
Jul 26, 2024 02:27:13.995027065 CEST	192.168.2.7	62.118.29.144	e36	Echo
Jul 26, 2024 02:27:13.996460915 CEST	192.168.2.7	62.118.170.205	e35	Echo
Jul 26, 2024 02:27:13.996532917 CEST	192.168.2.7	62.118.37.192	e34	Echo
Jul 26, 2024 02:27:13.996732950 CEST	192.168.2.7	62.118.247.171	e33	Echo
Jul 26, 2024 02:27:13.996848106 CEST	192.168.2.7	62.118.190.159	e31	Echo
Jul 26, 2024 02:27:13.996849060 CEST	192.168.2.7	62.118.159.204	e32	Echo
Jul 26, 2024 02:27:13.996953011 CEST	192.168.2.7	62.118.123.190	e30	Echo
Jul 26, 2024 02:27:13.996953011 CEST	192.168.2.7	62.118.190.123	e2f	Echo
Jul 26, 2024 02:27:13.997008085 CEST	192.168.2.7	62.118.16.45	e2e	Echo
Jul 26, 2024 02:27:13.997059107 CEST	192.168.2.7	62.118.113.67	e2d	Echo
Jul 26, 2024 02:27:13.997117996 CEST	192.168.2.7	62.118.112.113	e2c	Echo
Jul 26, 2024 02:27:13.997170925 CEST	192.168.2.7	62.118.54.235	e2b	Echo
Jul 26, 2024 02:27:13.997272015 CEST	192.168.2.7	62.118.160.251	e29	Echo
Jul 26, 2024 02:27:13.997272015 CEST	192.168.2.7	62.118.142.35	e2a	Echo
Jul 26, 2024 02:27:13.997328997 CEST	192.168.2.7	62.118.128.58	e28	Echo
Jul 26, 2024 02:27:14.024552107 CEST	192.168.2.7	62.118.93.252	e27	Echo
Jul 26, 2024 02:27:14.055588961 CEST	192.168.2.7	62.118.27.80	e26	Echo
Jul 26, 2024 02:27:14.086704969 CEST	192.168.2.7	62.118.124.233	e25	Echo
Jul 26, 2024 02:27:14.118447065 CEST	192.168.2.7	62.118.78.121	e24	Echo
Jul 26, 2024 02:27:14.149139881 CEST	192.168.2.7	62.118.185.252	e23	Echo
Jul 26, 2024 02:27:14.196192980 CEST	192.168.2.7	62.118.163.15	e22	Echo
Jul 26, 2024 02:27:14.212348938 CEST	192.168.2.7	62.118.209.218	e21	Echo
Jul 26, 2024 02:27:14.243727922 CEST	192.168.2.7	62.118.91.159	e20	Echo
Jul 26, 2024 02:27:14.274374008 CEST	192.168.2.7	62.118.64.19	e1f	Echo
Jul 26, 2024 02:27:14.305392981 CEST	192.168.2.7	62.118.200.27	e1e	Echo
Jul 26, 2024 02:27:14.340096951 CEST	192.168.2.7	62.118.23.143	e1d	Echo
Jul 26, 2024 02:27:14.368388891 CEST	192.168.2.7	62.118.23.194	e1c	Echo
Jul 26, 2024 02:27:14.399163961 CEST	192.168.2.7	62.118.127.55	e1b	Echo
Jul 26, 2024 02:27:14.430345058 CEST	192.168.2.7	62.118.25.232	e1a	Echo
Jul 26, 2024 02:27:14.461600065 CEST	192.168.2.7	62.118.13.77	e19	Echo
Jul 26, 2024 02:27:14.493371010 CEST	192.168.2.7	62.118.201.216	e18	Echo
Jul 26, 2024 02:27:14.494591951 CEST	192.168.2.7	62.118.34.96	e16	Echo
Jul 26, 2024 02:27:14.494657993 CEST	192.168.2.7	62.118.201.103	e15	Echo
Jul 26, 2024 02:27:14.494782925 CEST	192.168.2.7	62.118.64.176	e14	Echo
Jul 26, 2024 02:27:14.494856119 CEST	192.168.2.7	62.118.127.207	e13	Echo
Jul 26, 2024 02:27:14.494977951 CEST	192.168.2.7	62.118.64.168	e12	Echo
Jul 26, 2024 02:27:14.495054007 CEST	192.168.2.7	62.118.161.220	e11	Echo
Jul 26, 2024 02:27:14.495155096 CEST	192.168.2.7	62.118.234.252	e10	Echo
Jul 26, 2024 02:27:14.495199919 CEST	192.168.2.7	62.118.133.83	e0f	Echo
Jul 26, 2024 02:27:14.495521069 CEST	192.168.2.7	62.118.152.102	e0d	Echo
Jul 26, 2024 02:27:14.495521069 CEST	192.168.2.7	62.118.188.204	e0c	Echo
Jul 26, 2024 02:27:14.495789051 CEST	192.168.2.7	62.118.182.127	e09	Echo
Jul 26, 2024 02:27:14.495954037 CEST	192.168.2.7	62.118.182.76	e0e	Echo
Jul 26, 2024 02:27:14.495954990 CEST	192.168.2.7	62.118.69.161	e17	Echo
Jul 26, 2024 02:27:14.495954037 CEST	192.168.2.7	62.118.84.156	e0b	Echo
Jul 26, 2024 02:27:14.495954037 CEST	192.168.2.7	62.118.127.22	e0a	Echo
Jul 26, 2024 02:27:14.524132967 CEST	192.168.2.7	62.118.1.235	e08	Echo
Jul 26, 2024 02:27:14.555447102 CEST	192.168.2.7	62.118.150.7	e07	Echo
Jul 26, 2024 02:27:14.586879969 CEST	192.168.2.7	62.118.204.58	e06	Echo
Jul 26, 2024 02:27:14.595727921 CEST	62.118.150.7	192.168.2.7	1607	Echo Reply
Jul 26, 2024 02:27:14.596127987 CEST	192.168.2.7	62.118.150.7	e05	Echo
Jul 26, 2024 02:27:14.618072033 CEST	192.168.2.7	62.118.109.220	e04	Echo
Jul 26, 2024 02:27:14.637753963 CEST	62.118.150.7	192.168.2.7	1605	Echo Reply
Jul 26, 2024 02:27:14.651880026 CEST	192.168.2.7	62.118.162.82	e03	Echo
Jul 26, 2024 02:27:14.680824995 CEST	192.168.2.7	62.118.21.162	e02	Echo
Jul 26, 2024 02:27:14.712344885 CEST	192.168.2.7	62.118.116.78	e01	Echo
Jul 26, 2024 02:27:14.743166924 CEST	192.168.2.7	62.118.197.120	e00	Echo
Jul 26, 2024 02:27:14.774226904 CEST	192.168.2.7	62.118.62.197	dff	Echo
Jul 26, 2024 02:27:14.805733919 CEST	192.168.2.7	62.118.124.218	dfe	Echo
Jul 26, 2024 02:27:14.836669922 CEST	192.168.2.7	62.118.86.66	dfd	Echo
Jul 26, 2024 02:27:14.868067980 CEST	192.168.2.7	62.118.246.243	dfc	Echo
Jul 26, 2024 02:27:14.900924921 CEST	192.168.2.7	62.118.17.17	dfb	Echo
Jul 26, 2024 02:27:14.930494070 CEST	192.168.2.7	62.118.34.214	dfa	Echo
Jul 26, 2024 02:27:14.961635113 CEST	192.168.2.7	62.118.75.201	df9	Echo
Jul 26, 2024 02:27:14.993724108 CEST	192.168.2.7	62.118.137.81	df8	Echo
Jul 26, 2024 02:27:14.995158911 CEST	192.168.2.7	62.118.179.181	df7	Echo
Jul 26, 2024 02:27:14.995533943 CEST	192.168.2.7	62.118.160.227	df5	Echo
Jul 26, 2024 02:27:14.995534897 CEST	192.168.2.7	62.118.115.243	df6	Echo
Jul 26, 2024 02:27:14.995567083 CEST	192.168.2.7	62.118.241.237	df4	Echo
Jul 26, 2024 02:27:14.995908022 CEST	192.168.2.7	62.118.46.71	df3	Echo
Jul 26, 2024 02:27:14.996010065 CEST	192.168.2.7	62.118.9.208	df2	Echo
Jul 26, 2024 02:27:14.996082067 CEST	192.168.2.7	62.118.187.11	df1	Echo
Jul 26, 2024 02:27:14.996306896 CEST	192.168.2.7	62.118.38.187	df0	Echo
Jul 26, 2024 02:27:14.996407032 CEST	192.168.2.7	62.118.68.78	def	Echo
Jul 26, 2024 02:27:14.996458054 CEST	192.168.2.7	62.118.130.68	dee	Echo
Jul 26, 2024 02:27:14.996555090 CEST	192.168.2.7	62.118.132.130	ded	Echo
Jul 26, 2024 02:27:14.996613026 CEST	192.168.2.7	62.118.85.39	dec	Echo
Jul 26, 2024 02:27:14.996831894 CEST	192.168.2.7	62.118.199.157	deb	Echo
Jul 26, 2024 02:27:14.996885061 CEST	192.168.2.7	62.118.191.96	dea	Echo
Jul 26, 2024 02:27:15.024637938 CEST	192.168.2.7	62.118.201.29	de9	Echo
Jul 26, 2024 02:27:15.055593014 CEST	192.168.2.7	62.118.97.163	de8	Echo
Jul 26, 2024 02:27:15.086998940 CEST	192.168.2.7	62.118.6.41	de7	Echo
Jul 26, 2024 02:27:15.118423939 CEST	192.168.2.7	62.118.240.235	de6	Echo
Jul 26, 2024 02:27:15.149281979 CEST	192.168.2.7	62.118.52.67	de5	Echo
Jul 26, 2024 02:27:15.180696964 CEST	192.168.2.7	62.118.142.97	de4	Echo
Jul 26, 2024 02:27:15.211920023 CEST	192.168.2.7	62.118.37.244	de3	Echo
Jul 26, 2024 02:27:15.243385077 CEST	192.168.2.7	62.118.41.124	de2	Echo
Jul 26, 2024 02:27:15.274385929 CEST	192.168.2.7	62.118.31.180	de1	Echo
Jul 26, 2024 02:27:15.307540894 CEST	192.168.2.7	62.118.83.31	de0	Echo
Jul 26, 2024 02:27:15.339582920 CEST	192.168.2.7	62.118.66.83	ddf	Echo
Jul 26, 2024 02:27:15.371783018 CEST	192.168.2.7	62.118.220.131	dde	Echo
Jul 26, 2024 02:27:15.425374985 CEST	192.168.2.7	62.118.246.88	ddd	Echo
Jul 26, 2024 02:27:15.446001053 CEST	192.168.2.7	62.118.91.198	ddc	Echo
Jul 26, 2024 02:27:15.477859974 CEST	192.168.2.7	62.118.213.212	ddb	Echo
Jul 26, 2024 02:27:15.493036985 CEST	192.168.2.7	62.118.191.33	dda	Echo
Jul 26, 2024 02:27:15.494643927 CEST	192.168.2.7	62.118.101.185	dd9	Echo
Jul 26, 2024 02:27:15.495174885 CEST	192.168.2.7	62.118.121.129	dd5	Echo
Jul 26, 2024 02:27:15.495335102 CEST	192.168.2.7	62.118.108.121	dd4	Echo
Jul 26, 2024 02:27:15.495335102 CEST	192.168.2.7	62.118.148.131	dd3	Echo
Jul 26, 2024 02:27:15.495501995 CEST	192.168.2.7	62.118.180.128	dd7	Echo
Jul 26, 2024 02:27:15.495502949 CEST	192.168.2.7	62.118.126.149	dd1	Echo
Jul 26, 2024 02:27:15.495501995 CEST	192.168.2.7	62.118.56.51	dd2	Echo
Jul 26, 2024 02:27:15.495661020 CEST	192.168.2.7	62.118.107.130	dcf	Echo
Jul 26, 2024 02:27:15.495666981 CEST	192.168.2.7	62.118.24.224	dd0	Echo
Jul 26, 2024 02:27:15.495825052 CEST	192.168.2.7	62.118.211.106	dce	Echo
Jul 26, 2024 02:27:15.495825052 CEST	192.168.2.7	62.118.99.211	dcd	Echo
Jul 26, 2024 02:27:15.495877981 CEST	192.168.2.7	62.118.115.108	dd8	Echo
Jul 26, 2024 02:27:15.495877981 CEST	192.168.2.7	62.118.195.214	dd6	Echo
Jul 26, 2024 02:27:15.495989084 CEST	192.168.2.7	62.118.81.188	dcb	Echo
Jul 26, 2024 02:27:15.495989084 CEST	192.168.2.7	62.118.1.92	dcc	Echo
Jul 26, 2024 02:27:15.508517027 CEST	192.168.2.7	62.118.33.213	dca	Echo
Jul 26, 2024 02:27:15.539860964 CEST	192.168.2.7	62.118.200.66	dc9	Echo
Jul 26, 2024 02:27:15.571119070 CEST	192.168.2.7	62.118.43.22	dc8	Echo
Jul 26, 2024 02:27:15.602329969 CEST	192.168.2.7	62.118.243.87	dc7	Echo
Jul 26, 2024 02:27:15.633591890 CEST	192.168.2.7	62.118.133.102	dc6	Echo
Jul 26, 2024 02:27:15.664776087 CEST	192.168.2.7	62.118.14.110	dc5	Echo
Jul 26, 2024 02:27:15.696202993 CEST	192.168.2.7	62.118.129.29	dc4	Echo
Jul 26, 2024 02:27:15.727348089 CEST	192.168.2.7	62.118.128.236	dc3	Echo
Jul 26, 2024 02:27:15.758666039 CEST	192.168.2.7	62.118.7.103	dc2	Echo
Jul 26, 2024 02:27:15.789975882 CEST	192.168.2.7	62.118.139.112	dc1	Echo
Jul 26, 2024 02:27:15.821007013 CEST	192.168.2.7	62.118.84.147	dc0	Echo
Jul 26, 2024 02:27:15.852386951 CEST	192.168.2.7	62.118.26.85	dbf	Echo
Jul 26, 2024 02:27:15.883683920 CEST	192.168.2.7	62.118.177.240	dbe	Echo
Jul 26, 2024 02:27:15.915205956 CEST	192.168.2.7	62.118.93.173	dbd	Echo
Jul 26, 2024 02:27:15.946424961 CEST	192.168.2.7	62.118.162.93	dbc	Echo
Jul 26, 2024 02:27:15.977766991 CEST	192.168.2.7	62.118.245.162	dbb	Echo
Jul 26, 2024 02:27:15.993391037 CEST	192.168.2.7	62.118.29.144	dba	Echo
Jul 26, 2024 02:27:15.994743109 CEST	192.168.2.7	62.118.93.252	db9	Echo
Jul 26, 2024 02:27:15.994889021 CEST	192.168.2.7	62.118.124.233	db7	Echo
Jul 26, 2024 02:27:15.994996071 CEST	192.168.2.7	62.118.185.252	db5	Echo
Jul 26, 2024 02:27:15.995074987 CEST	192.168.2.7	62.118.27.80	db8	Echo
Jul 26, 2024 02:27:15.995074987 CEST	192.168.2.7	62.118.78.121	db6	Echo
Jul 26, 2024 02:27:15.995074987 CEST	192.168.2.7	62.118.163.15	db4	Echo
Jul 26, 2024 02:27:15.995369911 CEST	192.168.2.7	62.118.209.218	db3	Echo
Jul 26, 2024 02:27:15.995373964 CEST	192.168.2.7	62.118.91.159	db2	Echo
Jul 26, 2024 02:27:15.995435953 CEST	192.168.2.7	62.118.64.19	db1	Echo
Jul 26, 2024 02:27:15.995598078 CEST	192.168.2.7	62.118.200.27	db0	Echo
Jul 26, 2024 02:27:15.995682001 CEST	192.168.2.7	62.118.23.143	daf	Echo
Jul 26, 2024 02:27:15.995779991 CEST	192.168.2.7	62.118.127.55	dae	Echo
Jul 26, 2024 02:27:15.995872021 CEST	192.168.2.7	62.118.23.194	dad	Echo
Jul 26, 2024 02:27:15.995919943 CEST	192.168.2.7	62.118.25.232	dac	Echo
Jul 26, 2024 02:27:15.996035099 CEST	192.168.2.7	62.118.13.77	dab	Echo
Jul 26, 2024 02:27:16.008549929 CEST	192.168.2.7	62.118.9.141	daa	Echo
Jul 26, 2024 02:27:16.041868925 CEST	192.168.2.7	62.118.253.98	da9	Echo
Jul 26, 2024 02:27:16.071140051 CEST	192.168.2.7	62.118.234.39	da8	Echo
Jul 26, 2024 02:27:16.105870008 CEST	192.168.2.7	62.118.74.34	da7	Echo
Jul 26, 2024 02:27:16.133716106 CEST	192.168.2.7	62.118.81.242	da6	Echo
Jul 26, 2024 02:27:16.164921999 CEST	192.168.2.7	62.118.104.208	da5	Echo
Jul 26, 2024 02:27:16.196296930 CEST	192.168.2.7	62.118.120.105	da4	Echo
Jul 26, 2024 02:27:16.227552891 CEST	192.168.2.7	62.118.195.119	da3	Echo
Jul 26, 2024 02:27:16.260510921 CEST	192.168.2.7	62.118.63.83	da2	Echo
Jul 26, 2024 02:27:16.292152882 CEST	192.168.2.7	62.118.201.79	da1	Echo
Jul 26, 2024 02:27:16.321285963 CEST	192.168.2.7	62.118.31.25	da0	Echo
Jul 26, 2024 02:27:16.352372885 CEST	192.168.2.7	62.118.58.98	d9f	Echo
Jul 26, 2024 02:27:16.383500099 CEST	192.168.2.7	62.118.186.84	d9e	Echo
Jul 26, 2024 02:27:16.414741993 CEST	192.168.2.7	62.118.57.133	d9d	Echo
Jul 26, 2024 02:27:16.446254969 CEST	192.168.2.7	62.118.134.191	d9c	Echo
Jul 26, 2024 02:27:16.477308989 CEST	192.168.2.7	62.118.162.180	d9b	Echo
Jul 26, 2024 02:27:16.492887974 CEST	192.168.2.7	62.118.201.216	d9a	Echo
Jul 26, 2024 02:27:16.494652987 CEST	192.168.2.7	62.118.1.235	d99	Echo
Jul 26, 2024 02:27:16.494801998 CEST	192.168.2.7	62.118.109.220	d97	Echo
Jul 26, 2024 02:27:16.494815111 CEST	192.168.2.7	62.118.204.58	d98	Echo
Jul 26, 2024 02:27:16.494908094 CEST	192.168.2.7	62.118.162.82	d96	Echo
Jul 26, 2024 02:27:16.495031118 CEST	192.168.2.7	62.118.21.162	d95	Echo
Jul 26, 2024 02:27:16.495152950 CEST	192.168.2.7	62.118.197.120	d93	Echo
Jul 26, 2024 02:27:16.495167017 CEST	192.168.2.7	62.118.116.78	d94	Echo
Jul 26, 2024 02:27:16.495243073 CEST	192.168.2.7	62.118.62.197	d92	Echo
Jul 26, 2024 02:27:16.495316982 CEST	192.168.2.7	62.118.124.218	d91	Echo
Jul 26, 2024 02:27:16.495340109 CEST	192.168.2.7	62.118.86.66	d90	Echo
Jul 26, 2024 02:27:16.495397091 CEST	192.168.2.7	62.118.246.243	d8f	Echo
Jul 26, 2024 02:27:16.495598078 CEST	192.168.2.7	62.118.17.17	d8e	Echo
Jul 26, 2024 02:27:16.495650053 CEST	192.168.2.7	62.118.34.214	d8d	Echo
Jul 26, 2024 02:27:16.495754957 CEST	192.168.2.7	62.118.75.201	d8c	Echo
Jul 26, 2024 02:27:16.508486032 CEST	192.168.2.7	62.118.213.162	d8b	Echo
Jul 26, 2024 02:27:16.539762020 CEST	192.168.2.7	62.118.29.236	d8a	Echo
Jul 26, 2024 02:27:16.571233988 CEST	192.168.2.7	62.118.181.191	d89	Echo
Jul 26, 2024 02:27:16.602298975 CEST	192.168.2.7	62.118.226.70	d88	Echo
Jul 26, 2024 02:27:16.633533955 CEST	192.168.2.7	62.118.180.134	d87	Echo
Jul 26, 2024 02:27:16.664758921 CEST	192.168.2.7	62.118.81.34	d86	Echo
Jul 26, 2024 02:27:16.695969105 CEST	192.168.2.7	62.118.31.170	d85	Echo
Jul 26, 2024 02:27:16.727216005 CEST	192.168.2.7	62.118.149.89	d84	Echo
Jul 26, 2024 02:27:16.758621931 CEST	192.168.2.7	62.118.27.185	d83	Echo
Jul 26, 2024 02:27:16.793740988 CEST	192.168.2.7	62.118.60.153	d82	Echo
Jul 26, 2024 02:27:16.821098089 CEST	192.168.2.7	62.118.79.231	d81	Echo
Jul 26, 2024 02:27:16.852233887 CEST	192.168.2.7	62.118.136.190	d80	Echo
Jul 26, 2024 02:27:16.883476973 CEST	192.168.2.7	62.118.0.172	d7f	Echo
Jul 26, 2024 02:27:16.914793968 CEST	192.168.2.7	62.118.186.77	d7e	Echo
Jul 26, 2024 02:27:16.946546078 CEST	192.168.2.7	62.118.72.81	d7d	Echo
Jul 26, 2024 02:27:16.977349043 CEST	192.168.2.7	62.118.62.242	d7c	Echo
Jul 26, 2024 02:27:16.993313074 CEST	192.168.2.7	62.118.137.81	d7b	Echo
Jul 26, 2024 02:27:16.995095015 CEST	192.168.2.7	62.118.201.29	d7a	Echo
Jul 26, 2024 02:27:16.995151997 CEST	192.168.2.7	62.118.97.163	d79	Echo
Jul 26, 2024 02:27:16.995258093 CEST	192.168.2.7	62.118.6.41	d78	Echo
Jul 26, 2024 02:27:16.995357037 CEST	192.168.2.7	62.118.240.235	d77	Echo
Jul 26, 2024 02:27:16.995496988 CEST	192.168.2.7	62.118.52.67	d76	Echo
Jul 26, 2024 02:27:16.995516062 CEST	192.168.2.7	62.118.142.97	d75	Echo
Jul 26, 2024 02:27:16.995685101 CEST	192.168.2.7	62.118.41.124	d73	Echo
Jul 26, 2024 02:27:16.995738983 CEST	192.168.2.7	62.118.37.244	d74	Echo
Jul 26, 2024 02:27:16.995778084 CEST	192.168.2.7	62.118.31.180	d72	Echo
Jul 26, 2024 02:27:16.995871067 CEST	192.168.2.7	62.118.83.31	d71	Echo
Jul 26, 2024 02:27:16.996001959 CEST	192.168.2.7	62.118.66.83	d70	Echo
Jul 26, 2024 02:27:16.996067047 CEST	192.168.2.7	62.118.220.131	d6f	Echo
Jul 26, 2024 02:27:16.996118069 CEST	192.168.2.7	62.118.246.88	d6e	Echo
Jul 26, 2024 02:27:16.996184111 CEST	192.168.2.7	62.118.91.198	d6d	Echo
Jul 26, 2024 02:27:16.996237040 CEST	192.168.2.7	62.118.213.212	d6c	Echo
Jul 26, 2024 02:27:17.008569956 CEST	192.168.2.7	62.118.237.47	d6b	Echo
Jul 26, 2024 02:27:17.039879084 CEST	192.168.2.7	62.118.167.181	d6a	Echo
Jul 26, 2024 02:27:17.071286917 CEST	192.168.2.7	62.118.5.8	d69	Echo
Jul 26, 2024 02:27:17.102701902 CEST	192.168.2.7	62.118.91.126	d68	Echo
Jul 26, 2024 02:27:17.133687973 CEST	192.168.2.7	62.118.58.42	d67	Echo
Jul 26, 2024 02:27:17.164784908 CEST	192.168.2.7	62.118.57.152	d66	Echo
Jul 26, 2024 02:27:17.196166039 CEST	192.168.2.7	62.118.80.8	d65	Echo
Jul 26, 2024 02:27:17.227473974 CEST	192.168.2.7	62.118.101.230	d64	Echo
Jul 26, 2024 02:27:17.258558989 CEST	192.168.2.7	62.118.244.41	d63	Echo
Jul 26, 2024 02:27:17.289968014 CEST	192.168.2.7	62.118.60.121	d62	Echo
Jul 26, 2024 02:27:17.321079969 CEST	192.168.2.7	62.118.5.175	d61	Echo
Jul 26, 2024 02:27:17.352510929 CEST	192.168.2.7	62.118.24.153	d60	Echo
Jul 26, 2024 02:27:17.383681059 CEST	192.168.2.7	62.118.134.157	d5f	Echo
Jul 26, 2024 02:27:17.414758921 CEST	192.168.2.7	62.118.47.241	d5e	Echo
Jul 26, 2024 02:27:17.446372986 CEST	192.168.2.7	62.118.185.20	d5d	Echo
Jul 26, 2024 02:27:17.477269888 CEST	192.168.2.7	62.118.164.242	d5c	Echo
Jul 26, 2024 02:27:17.495100975 CEST	192.168.2.7	62.118.33.213	d5b	Echo
Jul 26, 2024 02:27:17.495310068 CEST	192.168.2.7	62.118.200.66	d5a	Echo
Jul 26, 2024 02:27:17.495467901 CEST	192.168.2.7	62.118.43.22	d59	Echo
Jul 26, 2024 02:27:17.495707989 CEST	192.168.2.7	62.118.243.87	d58	Echo
Jul 26, 2024 02:27:17.496115923 CEST	192.168.2.7	62.118.133.102	d57	Echo
Jul 26, 2024 02:27:17.496221066 CEST	192.168.2.7	62.118.14.110	d56	Echo
Jul 26, 2024 02:27:17.496315956 CEST	192.168.2.7	62.118.129.29	d55	Echo
Jul 26, 2024 02:27:17.496401072 CEST	192.168.2.7	62.118.128.236	d54	Echo
Jul 26, 2024 02:27:17.496676922 CEST	192.168.2.7	62.118.7.103	d53	Echo
Jul 26, 2024 02:27:17.496905088 CEST	192.168.2.7	62.118.139.112	d52	Echo
Jul 26, 2024 02:27:17.497071028 CEST	192.168.2.7	62.118.84.147	d51	Echo
Jul 26, 2024 02:27:17.497221947 CEST	192.168.2.7	62.118.26.85	d50	Echo
Jul 26, 2024 02:27:17.497323990 CEST	192.168.2.7	62.118.177.240	d4f	Echo
Jul 26, 2024 02:27:17.497644901 CEST	192.168.2.7	62.118.93.173	d4e	Echo
Jul 26, 2024 02:27:17.497790098 CEST	192.168.2.7	62.118.162.93	d4d	Echo
Jul 26, 2024 02:27:17.497826099 CEST	192.168.2.7	62.118.245.162	d4c	Echo
Jul 26, 2024 02:27:17.508740902 CEST	192.168.2.7	62.118.121.233	d4b	Echo
Jul 26, 2024 02:27:17.539808035 CEST	192.168.2.7	62.118.63.132	d4a	Echo
Jul 26, 2024 02:27:17.571280956 CEST	192.168.2.7	62.118.148.63	d49	Echo
Jul 26, 2024 02:27:17.602296114 CEST	192.168.2.7	62.118.253.147	d48	Echo
Jul 26, 2024 02:27:17.633565903 CEST	192.168.2.7	62.118.107.61	d47	Echo
Jul 26, 2024 02:27:17.664953947 CEST	192.168.2.7	62.118.18.18	d46	Echo
Jul 26, 2024 02:27:17.696080923 CEST	192.168.2.7	62.118.143.151	d45	Echo
Jul 26, 2024 02:27:17.727288008 CEST	192.168.2.7	62.118.156.190	d44	Echo
Jul 26, 2024 02:27:17.758704901 CEST	192.168.2.7	62.118.209.121	d43	Echo
Jul 26, 2024 02:27:17.789876938 CEST	192.168.2.7	62.118.236.208	d42	Echo
Jul 26, 2024 02:27:17.822729111 CEST	192.168.2.7	62.118.107.9	d41	Echo
Jul 26, 2024 02:27:17.852437973 CEST	192.168.2.7	62.118.17.253	d40	Echo
Jul 26, 2024 02:27:17.883934021 CEST	192.168.2.7	62.118.179.50	d3f	Echo
Jul 26, 2024 02:27:17.914894104 CEST	192.168.2.7	62.118.5.57	d3e	Echo
Jul 26, 2024 02:27:17.946609020 CEST	192.168.2.7	62.118.207.254	d3d	Echo
Jul 26, 2024 02:27:17.977258921 CEST	192.168.2.7	62.118.107.124	d3c	Echo
Jul 26, 2024 02:27:17.995548010 CEST	192.168.2.7	62.118.9.141	d3b	Echo
Jul 26, 2024 02:27:17.995804071 CEST	192.168.2.7	62.118.253.98	d3a	Echo
Jul 26, 2024 02:27:17.996145964 CEST	192.168.2.7	62.118.234.39	d39	Echo
Jul 26, 2024 02:27:17.996239901 CEST	192.168.2.7	62.118.74.34	d38	Echo
Jul 26, 2024 02:27:17.996340036 CEST	192.168.2.7	62.118.81.242	d37	Echo
Jul 26, 2024 02:27:17.996421099 CEST	192.168.2.7	62.118.104.208	d36	Echo
Jul 26, 2024 02:27:17.996655941 CEST	192.168.2.7	62.118.120.105	d35	Echo
Jul 26, 2024 02:27:17.996848106 CEST	192.168.2.7	62.118.195.119	d34	Echo
Jul 26, 2024 02:27:17.997248888 CEST	192.168.2.7	62.118.201.79	d32	Echo
Jul 26, 2024 02:27:17.997603893 CEST	192.168.2.7	62.118.63.83	d33	Echo
Jul 26, 2024 02:27:17.997603893 CEST	192.168.2.7	62.118.31.25	d31	Echo
Jul 26, 2024 02:27:17.997754097 CEST	192.168.2.7	62.118.58.98	d30	Echo
Jul 26, 2024 02:27:17.997966051 CEST	192.168.2.7	62.118.186.84	d2f	Echo
Jul 26, 2024 02:27:17.998220921 CEST	192.168.2.7	62.118.57.133	d2e	Echo
Jul 26, 2024 02:27:17.998563051 CEST	192.168.2.7	62.118.162.180	d2c	Echo
Jul 26, 2024 02:27:17.998980999 CEST	192.168.2.7	62.118.134.191	d2d	Echo
Jul 26, 2024 02:27:18.008554935 CEST	192.168.2.7	62.118.88.107	d2b	Echo
Jul 26, 2024 02:27:18.039881945 CEST	192.168.2.7	62.118.47.248	d2a	Echo
Jul 26, 2024 02:27:18.071120024 CEST	192.168.2.7	62.118.208.199	d29	Echo
Jul 26, 2024 02:27:18.102595091 CEST	192.168.2.7	62.118.63.48	d28	Echo
Jul 26, 2024 02:27:18.133538008 CEST	192.168.2.7	62.118.12.190	d27	Echo
Jul 26, 2024 02:27:18.164874077 CEST	192.168.2.7	62.118.147.8	d26	Echo
Jul 26, 2024 02:27:18.196276903 CEST	192.168.2.7	62.118.141.55	d25	Echo
Jul 26, 2024 02:27:18.227400064 CEST	192.168.2.7	62.118.161.76	d24	Echo
Jul 26, 2024 02:27:18.259402990 CEST	192.168.2.7	62.118.203.59	d23	Echo
Jul 26, 2024 02:27:18.290065050 CEST	192.168.2.7	62.118.11.103	d22	Echo
Jul 26, 2024 02:27:18.321547985 CEST	192.168.2.7	62.118.40.80	d21	Echo
Jul 26, 2024 02:27:18.352390051 CEST	192.168.2.7	62.118.189.81	d20	Echo
Jul 26, 2024 02:27:18.383591890 CEST	192.168.2.7	62.118.202.42	d1f	Echo
Jul 26, 2024 02:27:18.414906979 CEST	192.168.2.7	62.118.79.173	d1e	Echo
Jul 26, 2024 02:27:18.446204901 CEST	192.168.2.7	62.118.142.163	d1d	Echo
Jul 26, 2024 02:27:18.477905035 CEST	192.168.2.7	62.118.118.216	d1c	Echo
Jul 26, 2024 02:27:18.495887995 CEST	192.168.2.7	62.118.213.162	d1b	Echo
Jul 26, 2024 02:27:18.496233940 CEST	192.168.2.7	62.118.29.236	d1a	Echo
Jul 26, 2024 02:27:18.496347904 CEST	192.168.2.7	62.118.181.191	d19	Echo
Jul 26, 2024 02:27:18.504998922 CEST	192.168.2.7	62.118.226.70	d18	Echo
Jul 26, 2024 02:27:18.505177021 CEST	192.168.2.7	62.118.180.134	d17	Echo
Jul 26, 2024 02:27:18.505366087 CEST	192.168.2.7	62.118.81.34	d16	Echo
Jul 26, 2024 02:27:18.505656004 CEST	192.168.2.7	62.118.31.170	d15	Echo
Jul 26, 2024 02:27:18.505655050 CEST	192.168.2.7	62.118.149.89	d14	Echo
Jul 26, 2024 02:27:18.505723953 CEST	192.168.2.7	62.118.27.185	d13	Echo
Jul 26, 2024 02:27:18.505764008 CEST	192.168.2.7	62.118.60.153	d12	Echo
Jul 26, 2024 02:27:18.505842924 CEST	192.168.2.7	62.118.79.231	d11	Echo
Jul 26, 2024 02:27:18.505943060 CEST	192.168.2.7	62.118.136.190	d10	Echo
Jul 26, 2024 02:27:18.505944967 CEST	192.168.2.7	62.118.0.172	d0f	Echo
Jul 26, 2024 02:27:18.506025076 CEST	192.168.2.7	62.118.186.77	d0e	Echo
Jul 26, 2024 02:27:18.506105900 CEST	192.168.2.7	62.118.72.81	d0d	Echo
Jul 26, 2024 02:27:18.506314993 CEST	192.168.2.7	62.118.62.242	d0c	Echo
Jul 26, 2024 02:27:18.508583069 CEST	192.168.2.7	62.118.75.127	d0b	Echo
Jul 26, 2024 02:27:18.540015936 CEST	192.168.2.7	62.118.26.63	d0a	Echo
Jul 26, 2024 02:27:18.571849108 CEST	192.168.2.7	62.118.124.62	d09	Echo
Jul 26, 2024 02:27:18.602335930 CEST	192.168.2.7	62.118.164.130	d08	Echo
Jul 26, 2024 02:27:18.633552074 CEST	192.168.2.7	62.118.27.191	d07	Echo
Jul 26, 2024 02:27:18.664762020 CEST	192.168.2.7	62.118.154.98	d06	Echo
Jul 26, 2024 02:27:18.696115971 CEST	192.168.2.7	62.118.46.109	d05	Echo
Jul 26, 2024 02:27:18.727313995 CEST	192.168.2.7	62.118.146.83	d04	Echo
Jul 26, 2024 02:27:18.758650064 CEST	192.168.2.7	62.118.199.175	d03	Echo
Jul 26, 2024 02:27:18.789809942 CEST	192.168.2.7	62.118.198.175	d02	Echo
Jul 26, 2024 02:27:18.821115971 CEST	192.168.2.7	62.118.141.199	d01	Echo
Jul 26, 2024 02:27:18.852585077 CEST	192.168.2.7	62.118.187.141	d00	Echo
Jul 26, 2024 02:27:18.883497000 CEST	192.168.2.7	62.118.138.85	cff	Echo
Jul 26, 2024 02:27:18.914990902 CEST	192.168.2.7	62.118.63.202	cfe	Echo
Jul 26, 2024 02:27:18.927054882 CEST	62.118.138.85	192.168.2.7	14ff	Echo Reply
Jul 26, 2024 02:27:18.927479029 CEST	192.168.2.7	62.118.138.85	cfd	Echo
Jul 26, 2024 02:27:18.946352005 CEST	192.168.2.7	62.118.35.18	cfc	Echo
Jul 26, 2024 02:27:18.968926907 CEST	62.118.138.85	192.168.2.7	14fd	Echo Reply
Jul 26, 2024 02:27:18.977677107 CEST	192.168.2.7	62.118.208.152	cfb	Echo
Jul 26, 2024 02:27:18.994307995 CEST	192.168.2.7	62.118.237.47	cfa	Echo
Jul 26, 2024 02:27:18.994402885 CEST	192.168.2.7	62.118.167.181	cf9	Echo
Jul 26, 2024 02:27:18.994529963 CEST	192.168.2.7	62.118.5.8	cf8	Echo
Jul 26, 2024 02:27:18.994573116 CEST	192.168.2.7	62.118.91.126	cf7	Echo
Jul 26, 2024 02:27:18.994653940 CEST	192.168.2.7	62.118.58.42	cf6	Echo
Jul 26, 2024 02:27:18.994801044 CEST	192.168.2.7	62.118.57.152	cf5	Echo
Jul 26, 2024 02:27:18.994894981 CEST	192.168.2.7	62.118.80.8	cf4	Echo
Jul 26, 2024 02:27:18.994945049 CEST	192.168.2.7	62.118.101.230	cf3	Echo
Jul 26, 2024 02:27:18.995007038 CEST	192.168.2.7	62.118.244.41	cf2	Echo
Jul 26, 2024 02:27:18.995059013 CEST	192.168.2.7	62.118.60.121	cf1	Echo
Jul 26, 2024 02:27:18.995112896 CEST	192.168.2.7	62.118.5.175	cf0	Echo
Jul 26, 2024 02:27:18.995193005 CEST	192.168.2.7	62.118.24.153	cef	Echo
Jul 26, 2024 02:27:18.995299101 CEST	192.168.2.7	62.118.134.157	cee	Echo
Jul 26, 2024 02:27:18.995351076 CEST	192.168.2.7	62.118.47.241	ced	Echo
Jul 26, 2024 02:27:18.995404959 CEST	192.168.2.7	62.118.185.20	cec	Echo
Jul 26, 2024 02:27:18.995460033 CEST	192.168.2.7	62.118.164.242	ceb	Echo
Jul 26, 2024 02:27:19.008598089 CEST	192.168.2.7	62.118.67.181	cea	Echo
Jul 26, 2024 02:27:19.039901972 CEST	192.168.2.7	62.118.182.183	ce9	Echo
Jul 26, 2024 02:27:19.071037054 CEST	192.168.2.7	62.118.43.236	ce8	Echo
Jul 26, 2024 02:27:19.102328062 CEST	192.168.2.7	62.118.144.39	ce7	Echo
Jul 26, 2024 02:27:19.133524895 CEST	192.168.2.7	62.118.4.169	ce6	Echo
Jul 26, 2024 02:27:19.167174101 CEST	192.168.2.7	62.118.34.85	ce5	Echo
Jul 26, 2024 02:27:19.196980000 CEST	192.168.2.7	62.118.131.67	ce4	Echo
Jul 26, 2024 02:27:19.227421045 CEST	192.168.2.7	62.118.45.254	ce3	Echo
Jul 26, 2024 02:27:19.258519888 CEST	192.168.2.7	62.118.220.77	ce2	Echo
Jul 26, 2024 02:27:19.290088892 CEST	192.168.2.7	62.118.170.190	ce1	Echo
Jul 26, 2024 02:27:19.321213961 CEST	192.168.2.7	62.118.220.25	ce0	Echo
Jul 26, 2024 02:27:19.352415085 CEST	192.168.2.7	62.118.7.221	cdf	Echo
Jul 26, 2024 02:27:19.384059906 CEST	192.168.2.7	62.118.121.169	cde	Echo
Jul 26, 2024 02:27:19.415205956 CEST	192.168.2.7	62.118.19.60	cdd	Echo
Jul 26, 2024 02:27:19.446346045 CEST	192.168.2.7	62.118.202.102	cdc	Echo
Jul 26, 2024 02:27:19.477343082 CEST	192.168.2.7	62.118.106.0	cdb	Echo
Jul 26, 2024 02:27:19.498954058 CEST	192.168.2.7	62.118.121.233	cda	Echo
Jul 26, 2024 02:27:19.498986959 CEST	192.168.2.7	62.118.63.132	cd9	Echo
Jul 26, 2024 02:27:19.499216080 CEST	192.168.2.7	62.118.253.147	cd7	Echo
Jul 26, 2024 02:27:19.499311924 CEST	192.168.2.7	62.118.107.61	cd6	Echo
Jul 26, 2024 02:27:19.499349117 CEST	192.168.2.7	62.118.18.18	cd5	Echo
Jul 26, 2024 02:27:19.499356031 CEST	192.168.2.7	62.118.148.63	cd8	Echo
Jul 26, 2024 02:27:19.499439001 CEST	192.168.2.7	62.118.143.151	cd4	Echo
Jul 26, 2024 02:27:19.499500990 CEST	192.168.2.7	62.118.156.190	cd3	Echo
Jul 26, 2024 02:27:19.499541044 CEST	192.168.2.7	62.118.209.121	cd2	Echo
Jul 26, 2024 02:27:19.499671936 CEST	192.168.2.7	62.118.236.208	cd1	Echo
Jul 26, 2024 02:27:19.499727964 CEST	192.168.2.7	62.118.107.9	cd0	Echo
Jul 26, 2024 02:27:19.499875069 CEST	192.168.2.7	62.118.179.50	cce	Echo
Jul 26, 2024 02:27:19.499980927 CEST	192.168.2.7	62.118.5.57	ccd	Echo
Jul 26, 2024 02:27:19.500051975 CEST	192.168.2.7	62.118.207.254	ccc	Echo
Jul 26, 2024 02:27:19.500149965 CEST	192.168.2.7	62.118.17.253	ccf	Echo
Jul 26, 2024 02:27:19.500149965 CEST	192.168.2.7	62.118.107.124	ccb	Echo
Jul 26, 2024 02:27:19.508704901 CEST	192.168.2.7	62.118.12.61	cca	Echo
Jul 26, 2024 02:27:19.540441990 CEST	192.168.2.7	62.118.42.199	cc9	Echo
Jul 26, 2024 02:27:19.571634054 CEST	192.168.2.7	62.118.208.156	cc8	Echo
Jul 26, 2024 02:27:19.602266073 CEST	192.168.2.7	62.118.42.12	cc7	Echo
Jul 26, 2024 02:27:19.633586884 CEST	192.168.2.7	62.118.233.242	cc6	Echo
Jul 26, 2024 02:27:19.665952921 CEST	192.168.2.7	62.118.44.163	cc5	Echo
Jul 26, 2024 02:27:19.697987080 CEST	192.168.2.7	62.118.176.222	cc4	Echo
Jul 26, 2024 02:27:19.727519989 CEST	192.168.2.7	62.118.166.48	cc3	Echo
Jul 26, 2024 02:27:19.759933949 CEST	192.168.2.7	62.118.131.111	cc2	Echo
Jul 26, 2024 02:27:19.793863058 CEST	192.168.2.7	62.118.101.62	cc1	Echo
Jul 26, 2024 02:27:19.822318077 CEST	192.168.2.7	62.118.30.101	cc0	Echo
Jul 26, 2024 02:27:19.853358984 CEST	192.168.2.7	62.118.67.187	cbf	Echo
Jul 26, 2024 02:27:19.883884907 CEST	192.168.2.7	62.118.193.242	cbe	Echo
Jul 26, 2024 02:27:19.914764881 CEST	192.168.2.7	62.118.101.193	cbd	Echo
Jul 26, 2024 02:27:19.946224928 CEST	192.168.2.7	62.118.200.242	cbc	Echo
Jul 26, 2024 02:27:19.977509975 CEST	192.168.2.7	62.118.238.195	cbb	Echo
Jul 26, 2024 02:27:19.994813919 CEST	192.168.2.7	62.118.88.107	cba	Echo
Jul 26, 2024 02:27:19.994880915 CEST	192.168.2.7	62.118.47.248	cb9	Echo
Jul 26, 2024 02:27:19.994982958 CEST	192.168.2.7	62.118.63.48	cb7	Echo
Jul 26, 2024 02:27:19.995090008 CEST	192.168.2.7	62.118.12.190	cb6	Echo
Jul 26, 2024 02:27:19.995135069 CEST	192.168.2.7	62.118.147.8	cb5	Echo
Jul 26, 2024 02:27:19.995152950 CEST	192.168.2.7	62.118.208.199	cb8	Echo
Jul 26, 2024 02:27:19.995243073 CEST	192.168.2.7	62.118.141.55	cb4	Echo
Jul 26, 2024 02:27:19.995378017 CEST	192.168.2.7	62.118.203.59	cb2	Echo
Jul 26, 2024 02:27:19.995414972 CEST	192.168.2.7	62.118.161.76	cb3	Echo
Jul 26, 2024 02:27:19.995505095 CEST	192.168.2.7	62.118.11.103	cb1	Echo
Jul 26, 2024 02:27:19.995543957 CEST	192.168.2.7	62.118.40.80	cb0	Echo
Jul 26, 2024 02:27:19.995671988 CEST	192.168.2.7	62.118.189.81	caf	Echo
Jul 26, 2024 02:27:19.995764017 CEST	192.168.2.7	62.118.202.42	cae	Echo
Jul 26, 2024 02:27:19.995943069 CEST	192.168.2.7	62.118.79.173	cad	Echo
Jul 26, 2024 02:27:19.995958090 CEST	192.168.2.7	62.118.142.163	cac	Echo
Jul 26, 2024 02:27:19.996061087 CEST	192.168.2.7	62.118.118.216	cab	Echo
Jul 26, 2024 02:27:20.008498907 CEST	192.168.2.7	62.118.6.94	caa	Echo
Jul 26, 2024 02:27:20.039762020 CEST	192.168.2.7	62.118.40.161	ca9	Echo
Jul 26, 2024 02:27:20.071352959 CEST	192.168.2.7	62.118.122.16	ca8	Echo
Jul 26, 2024 02:27:20.102408886 CEST	192.168.2.7	62.118.44.219	ca7	Echo
Jul 26, 2024 02:27:20.134032011 CEST	192.168.2.7	62.118.171.209	ca6	Echo
Jul 26, 2024 02:27:20.165201902 CEST	192.168.2.7	62.118.183.171	ca5	Echo
Jul 26, 2024 02:27:20.196198940 CEST	192.168.2.7	62.118.39.24	ca4	Echo
Jul 26, 2024 02:27:20.227442980 CEST	192.168.2.7	62.118.167.65	ca3	Echo
Jul 26, 2024 02:27:20.258599997 CEST	192.168.2.7	62.118.38.111	ca2	Echo
Jul 26, 2024 02:27:20.290204048 CEST	192.168.2.7	62.118.224.38	ca1	Echo
Jul 26, 2024 02:27:20.321073055 CEST	192.168.2.7	62.118.249.223	ca0	Echo
Jul 26, 2024 02:27:20.352430105 CEST	192.168.2.7	62.118.49.182	c9f	Echo
Jul 26, 2024 02:27:20.383548021 CEST	192.168.2.7	62.118.27.109	c9e	Echo
Jul 26, 2024 02:27:20.415117025 CEST	192.168.2.7	62.118.210.62	c9d	Echo
Jul 26, 2024 02:27:20.446074009 CEST	192.168.2.7	62.118.60.144	c9c	Echo
Jul 26, 2024 02:27:20.477355957 CEST	192.168.2.7	62.118.80.195	c9b	Echo
Jul 26, 2024 02:27:20.494615078 CEST	192.168.2.7	62.118.75.127	c9a	Echo
Jul 26, 2024 02:27:20.494657040 CEST	192.168.2.7	62.118.26.63	c99	Echo
Jul 26, 2024 02:27:20.494754076 CEST	192.168.2.7	62.118.124.62	c98	Echo
Jul 26, 2024 02:27:20.494854927 CEST	192.168.2.7	62.118.164.130	c97	Echo
Jul 26, 2024 02:27:20.494874954 CEST	192.168.2.7	62.118.27.191	c96	Echo
Jul 26, 2024 02:27:20.494960070 CEST	192.168.2.7	62.118.154.98	c95	Echo
Jul 26, 2024 02:27:20.495042086 CEST	192.168.2.7	62.118.46.109	c94	Echo
Jul 26, 2024 02:27:20.495148897 CEST	192.168.2.7	62.118.146.83	c93	Echo
Jul 26, 2024 02:27:20.495187998 CEST	192.168.2.7	62.118.199.175	c92	Echo
Jul 26, 2024 02:27:20.495244980 CEST	192.168.2.7	62.118.198.175	c91	Echo
Jul 26, 2024 02:27:20.495342970 CEST	192.168.2.7	62.118.141.199	c90	Echo
Jul 26, 2024 02:27:20.495577097 CEST	192.168.2.7	62.118.187.141	c8f	Echo
Jul 26, 2024 02:27:20.495579004 CEST	192.168.2.7	62.118.63.202	c8e	Echo
Jul 26, 2024 02:27:20.495646954 CEST	192.168.2.7	62.118.35.18	c8d	Echo
Jul 26, 2024 02:27:20.495681047 CEST	192.168.2.7	62.118.208.152	c8c	Echo
Jul 26, 2024 02:27:20.508605957 CEST	192.168.2.7	62.118.67.147	c8b	Echo
Jul 26, 2024 02:27:20.539760113 CEST	192.168.2.7	62.118.169.253	c8a	Echo
Jul 26, 2024 02:27:20.580156088 CEST	192.168.2.7	62.118.10.232	c89	Echo
Jul 26, 2024 02:27:20.602315903 CEST	192.168.2.7	62.118.19.224	c88	Echo
Jul 26, 2024 02:27:20.633810043 CEST	192.168.2.7	62.118.186.45	c87	Echo
Jul 26, 2024 02:27:20.664835930 CEST	192.168.2.7	62.118.116.68	c86	Echo
Jul 26, 2024 02:27:20.696551085 CEST	192.168.2.7	62.118.224.45	c85	Echo
Jul 26, 2024 02:27:20.727842093 CEST	192.168.2.7	62.118.34.207	c84	Echo
Jul 26, 2024 02:27:20.758595943 CEST	192.168.2.7	62.118.251.73	c83	Echo
Jul 26, 2024 02:27:20.789923906 CEST	192.168.2.7	62.118.188.6	c82	Echo
Jul 26, 2024 02:27:20.821144104 CEST	192.168.2.7	62.118.18.196	c81	Echo
Jul 26, 2024 02:27:20.852329969 CEST	192.168.2.7	62.118.132.5	c80	Echo
Jul 26, 2024 02:27:20.883636951 CEST	192.168.2.7	62.118.162.240	c7f	Echo
Jul 26, 2024 02:27:20.926496029 CEST	192.168.2.7	62.118.52.196	c7e	Echo
Jul 26, 2024 02:27:20.946266890 CEST	192.168.2.7	62.118.184.111	c7d	Echo
Jul 26, 2024 02:27:20.977613926 CEST	192.168.2.7	62.118.124.184	c7c	Echo
Jul 26, 2024 02:27:20.995260954 CEST	192.168.2.7	62.118.67.181	c7b	Echo
Jul 26, 2024 02:27:20.995286942 CEST	192.168.2.7	62.118.182.183	c7a	Echo
Jul 26, 2024 02:27:20.995379925 CEST	192.168.2.7	62.118.43.236	c79	Echo
Jul 26, 2024 02:27:20.995538950 CEST	192.168.2.7	62.118.144.39	c78	Echo
Jul 26, 2024 02:27:20.995601892 CEST	192.168.2.7	62.118.4.169	c77	Echo
Jul 26, 2024 02:27:20.995655060 CEST	192.168.2.7	62.118.34.85	c76	Echo
Jul 26, 2024 02:27:20.995738029 CEST	192.168.2.7	62.118.131.67	c75	Echo
Jul 26, 2024 02:27:20.995850086 CEST	192.168.2.7	62.118.45.254	c74	Echo
Jul 26, 2024 02:27:20.995933056 CEST	192.168.2.7	62.118.220.77	c73	Echo
Jul 26, 2024 02:27:20.995996952 CEST	192.168.2.7	62.118.170.190	c72	Echo
Jul 26, 2024 02:27:20.996047020 CEST	192.168.2.7	62.118.220.25	c71	Echo
Jul 26, 2024 02:27:20.996094942 CEST	192.168.2.7	62.118.7.221	c70	Echo
Jul 26, 2024 02:27:20.996150970 CEST	192.168.2.7	62.118.121.169	c6f	Echo
Jul 26, 2024 02:27:20.996198893 CEST	192.168.2.7	62.118.19.60	c6e	Echo
Jul 26, 2024 02:27:20.996265888 CEST	192.168.2.7	62.118.202.102	c6d	Echo
Jul 26, 2024 02:27:20.996419907 CEST	192.168.2.7	62.118.106.0	c6c	Echo
Jul 26, 2024 02:27:21.008588076 CEST	192.168.2.7	62.118.20.124	c6b	Echo
Jul 26, 2024 02:27:21.040015936 CEST	192.168.2.7	62.118.23.20	c6a	Echo
Jul 26, 2024 02:27:21.071310043 CEST	192.168.2.7	62.118.150.134	c69	Echo
Jul 26, 2024 02:27:21.102389097 CEST	192.168.2.7	62.118.238.8	c68	Echo
Jul 26, 2024 02:27:21.133719921 CEST	192.168.2.7	62.118.61.47	c67	Echo
Jul 26, 2024 02:27:21.153109074 CEST	62.118.132.5	192.168.2.7	1480	Echo Reply
Jul 26, 2024 02:27:21.153583050 CEST	192.168.2.7	62.118.132.5	c66	Echo
Jul 26, 2024 02:27:21.164984941 CEST	192.168.2.7	62.118.107.82	c65	Echo
Jul 26, 2024 02:27:21.194602966 CEST	62.118.132.5	192.168.2.7	1466	Echo Reply
Jul 26, 2024 02:27:21.196017027 CEST	192.168.2.7	62.118.102.19	c64	Echo
Jul 26, 2024 02:27:21.227377892 CEST	192.168.2.7	62.118.17.59	c63	Echo
Jul 26, 2024 02:27:21.259110928 CEST	192.168.2.7	62.118.204.45	c62	Echo
Jul 26, 2024 02:27:21.290021896 CEST	192.168.2.7	62.118.220.149	c61	Echo
Jul 26, 2024 02:27:21.321211100 CEST	192.168.2.7	62.118.31.207	c60	Echo
Jul 26, 2024 02:27:21.352401018 CEST	192.168.2.7	62.118.106.241	c5f	Echo
Jul 26, 2024 02:27:21.383654118 CEST	192.168.2.7	62.118.24.215	c5e	Echo
Jul 26, 2024 02:27:21.414984941 CEST	192.168.2.7	62.118.11.188	c5d	Echo
Jul 26, 2024 02:27:21.446110964 CEST	192.168.2.7	62.118.91.213	c5c	Echo
Jul 26, 2024 02:27:21.477305889 CEST	192.168.2.7	62.118.16.110	c5b	Echo
Jul 26, 2024 02:27:21.494772911 CEST	192.168.2.7	62.118.12.61	c5a	Echo
Jul 26, 2024 02:27:21.494792938 CEST	192.168.2.7	62.118.42.199	c59	Echo
Jul 26, 2024 02:27:21.494998932 CEST	192.168.2.7	62.118.208.156	c58	Echo
Jul 26, 2024 02:27:21.495091915 CEST	192.168.2.7	62.118.42.12	c57	Echo
Jul 26, 2024 02:27:21.495208025 CEST	192.168.2.7	62.118.233.242	c56	Echo
Jul 26, 2024 02:27:21.495316029 CEST	192.168.2.7	62.118.176.222	c54	Echo
Jul 26, 2024 02:27:21.495421886 CEST	192.168.2.7	62.118.44.163	c55	Echo
Jul 26, 2024 02:27:21.495546103 CEST	192.168.2.7	62.118.101.62	c51	Echo
Jul 26, 2024 02:27:21.495603085 CEST	192.168.2.7	62.118.30.101	c50	Echo
Jul 26, 2024 02:27:21.495616913 CEST	192.168.2.7	62.118.166.48	c53	Echo
Jul 26, 2024 02:27:21.495733976 CEST	192.168.2.7	62.118.193.242	c4e	Echo
Jul 26, 2024 02:27:21.495750904 CEST	192.168.2.7	62.118.131.111	c52	Echo
Jul 26, 2024 02:27:21.495752096 CEST	192.168.2.7	62.118.67.187	c4f	Echo
Jul 26, 2024 02:27:21.495796919 CEST	192.168.2.7	62.118.101.193	c4d	Echo
Jul 26, 2024 02:27:21.495866060 CEST	192.168.2.7	62.118.200.242	c4c	Echo
Jul 26, 2024 02:27:21.496030092 CEST	192.168.2.7	62.118.238.195	c4b	Echo
Jul 26, 2024 02:27:21.508903980 CEST	192.168.2.7	62.118.4.3	c4a	Echo
Jul 26, 2024 02:27:21.539880991 CEST	192.168.2.7	62.118.190.203	c49	Echo
Jul 26, 2024 02:27:21.571309090 CEST	192.168.2.7	62.118.110.209	c48	Echo
Jul 26, 2024 02:27:21.613466978 CEST	192.168.2.7	62.118.34.120	c47	Echo
Jul 26, 2024 02:27:21.634597063 CEST	192.168.2.7	62.118.189.34	c46	Echo
Jul 26, 2024 02:27:21.665433884 CEST	192.168.2.7	62.118.148.136	c45	Echo
Jul 26, 2024 02:27:21.696099043 CEST	192.168.2.7	62.118.249.115	c44	Echo
Jul 26, 2024 02:27:21.727514982 CEST	192.168.2.7	62.118.104.249	c43	Echo
Jul 26, 2024 02:27:21.758671999 CEST	192.168.2.7	62.118.197.63	c42	Echo
Jul 26, 2024 02:27:21.790090084 CEST	192.168.2.7	62.118.33.151	c41	Echo
Jul 26, 2024 02:27:21.821546078 CEST	192.168.2.7	62.118.67.122	c40	Echo
Jul 26, 2024 02:27:21.853214025 CEST	192.168.2.7	62.118.134.249	c3f	Echo
Jul 26, 2024 02:27:21.883683920 CEST	192.168.2.7	62.118.164.57	c3e	Echo
Jul 26, 2024 02:27:21.915514946 CEST	192.168.2.7	62.118.123.120	c3d	Echo
Jul 26, 2024 02:27:21.947455883 CEST	192.168.2.7	62.118.243.212	c3c	Echo
Jul 26, 2024 02:27:21.977591991 CEST	192.168.2.7	62.118.70.226	c3b	Echo
Jul 26, 2024 02:27:21.994544983 CEST	192.168.2.7	62.118.6.94	c3a	Echo
Jul 26, 2024 02:27:21.994585991 CEST	192.168.2.7	62.118.40.161	c39	Echo
Jul 26, 2024 02:27:21.994760036 CEST	192.168.2.7	62.118.122.16	c38	Echo
Jul 26, 2024 02:27:21.994853973 CEST	192.168.2.7	62.118.44.219	c37	Echo
Jul 26, 2024 02:27:21.994924068 CEST	192.168.2.7	62.118.171.209	c36	Echo
Jul 26, 2024 02:27:21.995006084 CEST	192.168.2.7	62.118.183.171	c35	Echo
Jul 26, 2024 02:27:21.995101929 CEST	192.168.2.7	62.118.39.24	c34	Echo
Jul 26, 2024 02:27:21.995126009 CEST	192.168.2.7	62.118.167.65	c33	Echo
Jul 26, 2024 02:27:21.995202065 CEST	192.168.2.7	62.118.38.111	c32	Echo
Jul 26, 2024 02:27:21.995258093 CEST	192.168.2.7	62.118.224.38	c31	Echo
Jul 26, 2024 02:27:21.995316029 CEST	192.168.2.7	62.118.249.223	c30	Echo
Jul 26, 2024 02:27:21.995368958 CEST	192.168.2.7	62.118.49.182	c2f	Echo
Jul 26, 2024 02:27:21.995424986 CEST	192.168.2.7	62.118.27.109	c2e	Echo
Jul 26, 2024 02:27:21.995474100 CEST	192.168.2.7	62.118.210.62	c2d	Echo
Jul 26, 2024 02:27:21.995527983 CEST	192.168.2.7	62.118.60.144	c2c	Echo
Jul 26, 2024 02:27:21.995603085 CEST	192.168.2.7	62.118.80.195	c2b	Echo
Jul 26, 2024 02:27:22.008641958 CEST	192.168.2.7	62.118.120.64	c2a	Echo
Jul 26, 2024 02:27:22.039721966 CEST	192.168.2.7	62.118.211.119	c29	Echo
Jul 26, 2024 02:27:22.071063042 CEST	192.168.2.7	62.118.111.211	c28	Echo
Jul 26, 2024 02:27:22.102220058 CEST	192.168.2.7	62.118.93.178	c27	Echo
Jul 26, 2024 02:27:22.133613110 CEST	192.168.2.7	62.118.98.21	c26	Echo
Jul 26, 2024 02:27:22.165031910 CEST	192.168.2.7	62.118.116.119	c25	Echo
Jul 26, 2024 02:27:22.196141958 CEST	192.168.2.7	62.118.192.116	c24	Echo
Jul 26, 2024 02:27:22.227767944 CEST	192.168.2.7	62.118.175.192	c23	Echo
Jul 26, 2024 02:27:22.258687019 CEST	192.168.2.7	62.118.116.99	c22	Echo
Jul 26, 2024 02:27:22.289841890 CEST	192.168.2.7	62.118.114.246	c21	Echo
Jul 26, 2024 02:27:22.321203947 CEST	192.168.2.7	62.118.80.112	c20	Echo
Jul 26, 2024 02:27:22.352504969 CEST	192.168.2.7	62.118.176.13	c1f	Echo
Jul 26, 2024 02:27:22.383713007 CEST	192.168.2.7	62.118.76.26	c1e	Echo
Jul 26, 2024 02:27:22.414777994 CEST	192.168.2.7	62.118.100.197	c1d	Echo
Jul 26, 2024 02:27:22.446080923 CEST	192.168.2.7	62.118.108.165	c1c	Echo
Jul 26, 2024 02:27:22.477283955 CEST	192.168.2.7	62.118.9.109	c1b	Echo
Jul 26, 2024 02:27:22.494771004 CEST	192.168.2.7	62.118.67.147	c1a	Echo
Jul 26, 2024 02:27:22.494807005 CEST	192.168.2.7	62.118.169.253	c19	Echo
Jul 26, 2024 02:27:22.494940996 CEST	192.168.2.7	62.118.10.232	c18	Echo
Jul 26, 2024 02:27:22.495055914 CEST	192.168.2.7	62.118.186.45	c16	Echo
Jul 26, 2024 02:27:22.495107889 CEST	192.168.2.7	62.118.116.68	c15	Echo
Jul 26, 2024 02:27:22.495170116 CEST	192.168.2.7	62.118.224.45	c14	Echo
Jul 26, 2024 02:27:22.495218992 CEST	192.168.2.7	62.118.34.207	c13	Echo
Jul 26, 2024 02:27:22.495326996 CEST	192.168.2.7	62.118.251.73	c12	Echo
Jul 26, 2024 02:27:22.495470047 CEST	192.168.2.7	62.118.188.6	c11	Echo
Jul 26, 2024 02:27:22.495582104 CEST	192.168.2.7	62.118.162.240	c0f	Echo
Jul 26, 2024 02:27:22.495671034 CEST	192.168.2.7	62.118.52.196	c0e	Echo
Jul 26, 2024 02:27:22.495776892 CEST	192.168.2.7	62.118.18.196	c10	Echo
Jul 26, 2024 02:27:22.495776892 CEST	192.168.2.7	62.118.184.111	c0d	Echo
Jul 26, 2024 02:27:22.495798111 CEST	192.168.2.7	62.118.19.224	c17	Echo
Jul 26, 2024 02:27:22.495874882 CEST	192.168.2.7	62.118.124.184	c0c	Echo
Jul 26, 2024 02:27:22.508552074 CEST	192.168.2.7	62.118.138.197	c0b	Echo
Jul 26, 2024 02:27:22.539803982 CEST	192.168.2.7	62.118.74.118	c0a	Echo
Jul 26, 2024 02:27:22.571177959 CEST	192.168.2.7	62.118.33.80	c09	Echo
Jul 26, 2024 02:27:22.602382898 CEST	192.168.2.7	62.118.234.170	c08	Echo
Jul 26, 2024 02:27:22.635513067 CEST	192.168.2.7	62.118.184.223	c07	Echo
Jul 26, 2024 02:27:22.664841890 CEST	192.168.2.7	62.118.30.51	c06	Echo
Jul 26, 2024 02:27:22.696113110 CEST	192.168.2.7	62.118.185.145	c05	Echo
Jul 26, 2024 02:27:22.727618933 CEST	192.168.2.7	62.118.46.124	c04	Echo
Jul 26, 2024 02:27:22.758759975 CEST	192.168.2.7	62.118.2.227	c03	Echo
Jul 26, 2024 02:27:22.791290998 CEST	192.168.2.7	62.118.241.223	c02	Echo
Jul 26, 2024 02:27:22.831258059 CEST	192.168.2.7	62.118.153.4	c01	Echo
Jul 26, 2024 02:27:22.853245974 CEST	192.168.2.7	62.118.49.124	c00	Echo
Jul 26, 2024 02:27:22.884052992 CEST	192.168.2.7	62.118.168.83	bff	Echo
Jul 26, 2024 02:27:22.915065050 CEST	192.168.2.7	62.118.33.132	bfe	Echo
Jul 26, 2024 02:27:22.946325064 CEST	192.168.2.7	62.118.139.212	bfd	Echo
Jul 26, 2024 02:27:22.977621078 CEST	192.168.2.7	62.118.97.213	bfc	Echo
Jul 26, 2024 02:27:22.995172024 CEST	192.168.2.7	62.118.20.124	bfb	Echo
Jul 26, 2024 02:27:22.995196104 CEST	192.168.2.7	62.118.23.20	bfa	Echo
Jul 26, 2024 02:27:22.995301008 CEST	192.168.2.7	62.118.150.134	bf9	Echo
Jul 26, 2024 02:27:22.995345116 CEST	192.168.2.7	62.118.238.8	bf8	Echo
Jul 26, 2024 02:27:22.995440960 CEST	192.168.2.7	62.118.61.47	bf7	Echo
Jul 26, 2024 02:27:22.995474100 CEST	192.168.2.7	62.118.107.82	bf6	Echo
Jul 26, 2024 02:27:22.995556116 CEST	192.168.2.7	62.118.102.19	bf5	Echo
Jul 26, 2024 02:27:22.995598078 CEST	192.168.2.7	62.118.17.59	bf4	Echo
Jul 26, 2024 02:27:22.995670080 CEST	192.168.2.7	62.118.204.45	bf3	Echo
Jul 26, 2024 02:27:22.995738029 CEST	192.168.2.7	62.118.220.149	bf2	Echo
Jul 26, 2024 02:27:22.995773077 CEST	192.168.2.7	62.118.31.207	bf1	Echo
Jul 26, 2024 02:27:22.995820999 CEST	192.168.2.7	62.118.106.241	bf0	Echo
Jul 26, 2024 02:27:22.995887995 CEST	192.168.2.7	62.118.24.215	bef	Echo
Jul 26, 2024 02:27:22.995937109 CEST	192.168.2.7	62.118.11.188	bee	Echo
Jul 26, 2024 02:27:22.996001005 CEST	192.168.2.7	62.118.91.213	bed	Echo
Jul 26, 2024 02:27:22.996042013 CEST	192.168.2.7	62.118.16.110	bec	Echo
Jul 26, 2024 02:27:23.008991957 CEST	192.168.2.7	62.118.46.147	beb	Echo
Jul 26, 2024 02:27:23.040410042 CEST	192.168.2.7	62.118.39.147	bea	Echo
Jul 26, 2024 02:27:23.071383953 CEST	192.168.2.7	62.118.196.140	be9	Echo
Jul 26, 2024 02:27:23.102650881 CEST	192.168.2.7	62.118.32.155	be8	Echo
Jul 26, 2024 02:27:23.133739948 CEST	192.168.2.7	62.118.85.92	be7	Echo
Jul 26, 2024 02:27:23.169871092 CEST	192.168.2.7	62.118.171.248	be6	Echo
Jul 26, 2024 02:27:23.196194887 CEST	192.168.2.7	62.118.68.172	be5	Echo
Jul 26, 2024 02:27:23.227454901 CEST	192.168.2.7	62.118.172.95	be4	Echo
Jul 26, 2024 02:27:23.258804083 CEST	192.168.2.7	62.118.104.152	be3	Echo
Jul 26, 2024 02:27:23.289999962 CEST	192.168.2.7	62.118.69.218	be2	Echo
Jul 26, 2024 02:27:23.321316004 CEST	192.168.2.7	62.118.42.250	be1	Echo
Jul 26, 2024 02:27:23.352332115 CEST	192.168.2.7	62.118.192.68	be0	Echo
Jul 26, 2024 02:27:23.383778095 CEST	192.168.2.7	62.118.101.191	bdf	Echo
Jul 26, 2024 02:27:23.416521072 CEST	192.168.2.7	62.118.31.133	bde	Echo
Jul 26, 2024 02:27:23.446091890 CEST	192.168.2.7	62.118.214.14	bdd	Echo
Jul 26, 2024 02:27:23.477524042 CEST	192.168.2.7	62.118.204.1	bdc	Echo
Jul 26, 2024 02:27:23.494514942 CEST	192.168.2.7	62.118.4.3	bdb	Echo
Jul 26, 2024 02:27:23.494533062 CEST	192.168.2.7	62.118.190.203	bda	Echo
Jul 26, 2024 02:27:23.494618893 CEST	192.168.2.7	62.118.110.209	bd9	Echo
Jul 26, 2024 02:27:23.494676113 CEST	192.168.2.7	62.118.34.120	bd8	Echo
Jul 26, 2024 02:27:23.494784117 CEST	192.168.2.7	62.118.148.136	bd6	Echo
Jul 26, 2024 02:27:23.494858027 CEST	192.168.2.7	62.118.249.115	bd5	Echo
Jul 26, 2024 02:27:23.494884014 CEST	192.168.2.7	62.118.189.34	bd7	Echo
Jul 26, 2024 02:27:23.494884014 CEST	192.168.2.7	62.118.104.249	bd4	Echo
Jul 26, 2024 02:27:23.494940996 CEST	192.168.2.7	62.118.197.63	bd3	Echo
Jul 26, 2024 02:27:23.495012999 CEST	192.168.2.7	62.118.33.151	bd2	Echo
Jul 26, 2024 02:27:23.495035887 CEST	192.168.2.7	62.118.67.122	bd1	Echo
Jul 26, 2024 02:27:23.495106936 CEST	192.168.2.7	62.118.134.249	bd0	Echo
Jul 26, 2024 02:27:23.495150089 CEST	192.168.2.7	62.118.164.57	bcf	Echo
Jul 26, 2024 02:27:23.495213985 CEST	192.168.2.7	62.118.123.120	bce	Echo
Jul 26, 2024 02:27:23.495251894 CEST	192.168.2.7	62.118.243.212	bcd	Echo
Jul 26, 2024 02:27:23.495315075 CEST	192.168.2.7	62.118.70.226	bcc	Echo
Jul 26, 2024 02:27:23.508671999 CEST	192.168.2.7	62.118.127.204	bcb	Echo
Jul 26, 2024 02:27:23.540256023 CEST	192.168.2.7	62.118.161.117	bca	Echo
Jul 26, 2024 02:27:23.571296930 CEST	192.168.2.7	62.118.12.240	bc9	Echo
Jul 26, 2024 02:27:23.602448940 CEST	192.168.2.7	62.118.132.157	bc8	Echo
Jul 26, 2024 02:27:23.633758068 CEST	192.168.2.7	62.118.185.191	bc7	Echo
Jul 26, 2024 02:27:23.674792051 CEST	192.168.2.7	62.118.111.148	bc6	Echo
Jul 26, 2024 02:27:23.697242975 CEST	192.168.2.7	62.118.66.233	bc5	Echo
Jul 26, 2024 02:27:23.727541924 CEST	192.168.2.7	62.118.42.152	bc4	Echo
Jul 26, 2024 02:27:23.759596109 CEST	192.168.2.7	62.118.65.50	bc3	Echo
Jul 26, 2024 02:27:23.790656090 CEST	192.168.2.7	62.118.0.200	bc2	Echo
Jul 26, 2024 02:27:23.840924978 CEST	192.168.2.7	62.118.180.143	bc1	Echo
Jul 26, 2024 02:27:23.872384071 CEST	192.168.2.7	62.118.35.5	bc0	Echo
Jul 26, 2024 02:27:23.905616999 CEST	192.168.2.7	62.118.207.204	bbf	Echo
Jul 26, 2024 02:27:23.936681032 CEST	192.168.2.7	62.118.63.227	bbe	Echo
Jul 26, 2024 02:27:23.962888002 CEST	192.168.2.7	62.118.195.64	bbd	Echo
Jul 26, 2024 02:27:24.023025036 CEST	192.168.2.7	62.118.10.201	bbc	Echo
Jul 26, 2024 02:27:24.026654959 CEST	192.168.2.7	62.118.120.64	bbb	Echo
Jul 26, 2024 02:27:24.026863098 CEST	192.168.2.7	62.118.211.119	bba	Echo
Jul 26, 2024 02:27:24.026961088 CEST	192.168.2.7	62.118.111.211	bb9	Echo
Jul 26, 2024 02:27:24.027071953 CEST	192.168.2.7	62.118.93.178	bb8	Echo
Jul 26, 2024 02:27:24.027314901 CEST	192.168.2.7	62.118.98.21	bb7	Echo
Jul 26, 2024 02:27:24.027441978 CEST	192.168.2.7	62.118.116.119	bb6	Echo
Jul 26, 2024 02:27:24.027620077 CEST	192.168.2.7	62.118.192.116	bb5	Echo
Jul 26, 2024 02:27:24.027723074 CEST	192.168.2.7	62.118.175.192	bb4	Echo
Jul 26, 2024 02:27:24.027879953 CEST	192.168.2.7	62.118.116.99	bb3	Echo
Jul 26, 2024 02:27:24.027978897 CEST	192.168.2.7	62.118.114.246	bb2	Echo
Jul 26, 2024 02:27:24.028523922 CEST	192.168.2.7	62.118.80.112	bb1	Echo
Jul 26, 2024 02:27:24.028682947 CEST	192.168.2.7	62.118.176.13	bb0	Echo
Jul 26, 2024 02:27:24.028779030 CEST	192.168.2.7	62.118.76.26	baf	Echo
Jul 26, 2024 02:27:24.028884888 CEST	192.168.2.7	62.118.100.197	bae	Echo
Jul 26, 2024 02:27:24.029089928 CEST	192.168.2.7	62.118.108.165	bad	Echo
Jul 26, 2024 02:27:24.029262066 CEST	192.168.2.7	62.118.9.109	bac	Echo
Jul 26, 2024 02:27:24.055886030 CEST	192.168.2.7	62.118.180.164	bab	Echo
Jul 26, 2024 02:27:24.086965084 CEST	192.168.2.7	62.118.20.208	baa	Echo
Jul 26, 2024 02:27:24.120687008 CEST	192.168.2.7	62.118.48.56	ba9	Echo
Jul 26, 2024 02:27:24.149460077 CEST	192.168.2.7	62.118.157.214	ba8	Echo
Jul 26, 2024 02:27:24.180493116 CEST	192.168.2.7	62.118.236.192	ba7	Echo
Jul 26, 2024 02:27:24.212192059 CEST	192.168.2.7	62.118.59.161	ba6	Echo
Jul 26, 2024 02:27:24.244674921 CEST	192.168.2.7	62.118.127.192	ba5	Echo
Jul 26, 2024 02:27:24.276048899 CEST	192.168.2.7	62.118.198.200	ba4	Echo
Jul 26, 2024 02:27:24.305790901 CEST	192.168.2.7	62.118.72.1	ba3	Echo
Jul 26, 2024 02:27:24.337167025 CEST	192.168.2.7	62.118.73.176	ba2	Echo
Jul 26, 2024 02:27:24.368132114 CEST	192.168.2.7	62.118.4.122	ba1	Echo
Jul 26, 2024 02:27:24.399163008 CEST	192.168.2.7	62.118.37.52	ba0	Echo
Jul 26, 2024 02:27:24.430613041 CEST	192.168.2.7	62.118.221.183	b9f	Echo
Jul 26, 2024 02:27:24.462039948 CEST	192.168.2.7	62.118.166.221	b9e	Echo
Jul 26, 2024 02:27:24.493326902 CEST	192.168.2.7	62.118.105.75	b9d	Echo
Jul 26, 2024 02:27:24.494637012 CEST	192.168.2.7	62.118.138.197	b9c	Echo
Jul 26, 2024 02:27:24.494663000 CEST	192.168.2.7	62.118.74.118	b9b	Echo
Jul 26, 2024 02:27:24.494801998 CEST	192.168.2.7	62.118.33.80	b9a	Echo
Jul 26, 2024 02:27:24.494874001 CEST	192.168.2.7	62.118.234.170	b99	Echo
Jul 26, 2024 02:27:24.494913101 CEST	192.168.2.7	62.118.184.223	b98	Echo
Jul 26, 2024 02:27:24.495009899 CEST	192.168.2.7	62.118.185.145	b96	Echo
Jul 26, 2024 02:27:24.495094061 CEST	192.168.2.7	62.118.46.124	b95	Echo
Jul 26, 2024 02:27:24.495135069 CEST	192.168.2.7	62.118.2.227	b94	Echo
Jul 26, 2024 02:27:24.495192051 CEST	192.168.2.7	62.118.30.51	b97	Echo
Jul 26, 2024 02:27:24.495192051 CEST	192.168.2.7	62.118.241.223	b93	Echo
Jul 26, 2024 02:27:24.495250940 CEST	192.168.2.7	62.118.153.4	b92	Echo
Jul 26, 2024 02:27:24.495320082 CEST	192.168.2.7	62.118.49.124	b91	Echo
Jul 26, 2024 02:27:24.495358944 CEST	192.168.2.7	62.118.168.83	b90	Echo
Jul 26, 2024 02:27:24.495419025 CEST	192.168.2.7	62.118.33.132	b8f	Echo
Jul 26, 2024 02:27:24.495512009 CEST	192.168.2.7	62.118.139.212	b8e	Echo
Jul 26, 2024 02:27:24.495512009 CEST	192.168.2.7	62.118.97.213	b8d	Echo
Jul 26, 2024 02:27:24.525887966 CEST	192.168.2.7	62.118.199.169	b8c	Echo
Jul 26, 2024 02:27:24.555433035 CEST	192.168.2.7	62.118.148.86	b8b	Echo
Jul 26, 2024 02:27:24.588893890 CEST	192.168.2.7	62.118.253.30	b8a	Echo
Jul 26, 2024 02:27:24.617963076 CEST	192.168.2.7	62.118.242.73	b89	Echo
Jul 26, 2024 02:27:24.649713039 CEST	192.168.2.7	62.118.12.62	b88	Echo
Jul 26, 2024 02:27:24.673652887 CEST	62.118.253.30	192.168.2.7	138a	Echo Reply
Jul 26, 2024 02:27:24.674257994 CEST	192.168.2.7	62.118.253.30	b87	Echo
Jul 26, 2024 02:27:24.686466932 CEST	192.168.2.7	62.118.105.12	b86	Echo
Jul 26, 2024 02:27:24.711855888 CEST	192.168.2.7	62.118.176.104	b85	Echo
Jul 26, 2024 02:27:24.742979050 CEST	192.168.2.7	62.118.113.251	b84	Echo
Jul 26, 2024 02:27:24.758778095 CEST	62.118.253.30	192.168.2.7	1387	Echo Reply
Jul 26, 2024 02:27:24.774496078 CEST	192.168.2.7	62.118.254.179	b83	Echo
Jul 26, 2024 02:27:24.805876970 CEST	192.168.2.7	62.118.92.255	b82	Echo
Jul 26, 2024 02:27:24.836905003 CEST	192.168.2.7	62.118.92.58	b81	Echo
Jul 26, 2024 02:27:24.868108988 CEST	192.168.2.7	62.118.217.93	b80	Echo
Jul 26, 2024 02:27:24.899498940 CEST	192.168.2.7	62.118.240.228	b7f	Echo
Jul 26, 2024 02:27:24.930561066 CEST	192.168.2.7	62.118.24.240	b7e	Echo
Jul 26, 2024 02:27:24.961779118 CEST	192.168.2.7	62.118.1.252	b7d	Echo
Jul 26, 2024 02:27:24.994086027 CEST	192.168.2.7	62.118.218.220	b7c	Echo
Jul 26, 2024 02:27:24.995368958 CEST	192.168.2.7	62.118.46.147	b7b	Echo
Jul 26, 2024 02:27:24.995480061 CEST	192.168.2.7	62.118.39.147	b7a	Echo
Jul 26, 2024 02:27:24.995567083 CEST	192.168.2.7	62.118.196.140	b79	Echo
Jul 26, 2024 02:27:24.995810032 CEST	192.168.2.7	62.118.32.155	b78	Echo
Jul 26, 2024 02:27:24.995912075 CEST	192.168.2.7	62.118.85.92	b77	Echo
Jul 26, 2024 02:27:24.996074915 CEST	192.168.2.7	62.118.172.95	b74	Echo
Jul 26, 2024 02:27:24.996119022 CEST	192.168.2.7	62.118.68.172	b75	Echo
Jul 26, 2024 02:27:24.996118069 CEST	192.168.2.7	62.118.171.248	b76	Echo
Jul 26, 2024 02:27:24.996179104 CEST	192.168.2.7	62.118.104.152	b73	Echo
Jul 26, 2024 02:27:24.996256113 CEST	192.168.2.7	62.118.69.218	b72	Echo
Jul 26, 2024 02:27:24.996294975 CEST	192.168.2.7	62.118.42.250	b71	Echo
Jul 26, 2024 02:27:24.996417999 CEST	192.168.2.7	62.118.192.68	b70	Echo
Jul 26, 2024 02:27:24.996516943 CEST	192.168.2.7	62.118.31.133	b6e	Echo
Jul 26, 2024 02:27:24.996519089 CEST	192.168.2.7	62.118.101.191	b6f	Echo
Jul 26, 2024 02:27:24.996550083 CEST	192.168.2.7	62.118.214.14	b6d	Echo
Jul 26, 2024 02:27:24.996617079 CEST	192.168.2.7	62.118.204.1	b6c	Echo
Jul 26, 2024 02:27:25.024549007 CEST	192.168.2.7	62.118.34.219	b6b	Echo
Jul 26, 2024 02:27:25.055522919 CEST	192.168.2.7	62.118.42.40	b6a	Echo
Jul 26, 2024 02:27:25.086991072 CEST	192.168.2.7	62.118.15.67	b69	Echo
Jul 26, 2024 02:27:25.118290901 CEST	192.168.2.7	62.118.115.15	b68	Echo
Jul 26, 2024 02:27:25.150387049 CEST	192.168.2.7	62.118.162.115	b67	Echo
Jul 26, 2024 02:27:25.180458069 CEST	192.168.2.7	62.118.128.216	b66	Echo
Jul 26, 2024 02:27:25.211776018 CEST	192.168.2.7	62.118.43.64	b65	Echo
Jul 26, 2024 02:27:25.243005037 CEST	192.168.2.7	62.118.194.42	b64	Echo
Jul 26, 2024 02:27:25.274425983 CEST	192.168.2.7	62.118.127.95	b63	Echo
Jul 26, 2024 02:27:25.305562019 CEST	192.168.2.7	62.118.39.106	b62	Echo
Jul 26, 2024 02:27:25.337495089 CEST	192.168.2.7	62.118.35.6	b61	Echo
Jul 26, 2024 02:27:25.379002094 CEST	192.168.2.7	62.118.148.43	b60	Echo
Jul 26, 2024 02:27:25.399280071 CEST	192.168.2.7	62.118.69.55	b5f	Echo
Jul 26, 2024 02:27:25.430622101 CEST	192.168.2.7	62.118.37.69	b5e	Echo
Jul 26, 2024 02:27:25.465878963 CEST	192.168.2.7	62.118.9.242	b5d	Echo
Jul 26, 2024 02:27:25.493525028 CEST	192.168.2.7	62.118.119.240	b5c	Echo
Jul 26, 2024 02:27:25.494821072 CEST	192.168.2.7	62.118.127.204	b5b	Echo
Jul 26, 2024 02:27:25.494925022 CEST	192.168.2.7	62.118.161.117	b5a	Echo
Jul 26, 2024 02:27:25.495002031 CEST	192.168.2.7	62.118.12.240	b59	Echo
Jul 26, 2024 02:27:25.495138884 CEST	192.168.2.7	62.118.132.157	b58	Echo
Jul 26, 2024 02:27:25.495224953 CEST	192.168.2.7	62.118.185.191	b57	Echo
Jul 26, 2024 02:27:25.495271921 CEST	192.168.2.7	62.118.111.148	b56	Echo
Jul 26, 2024 02:27:25.495480061 CEST	192.168.2.7	62.118.66.233	b55	Echo
Jul 26, 2024 02:27:25.495482922 CEST	192.168.2.7	62.118.42.152	b54	Echo
Jul 26, 2024 02:27:25.495538950 CEST	192.168.2.7	62.118.65.50	b53	Echo
Jul 26, 2024 02:27:25.495615959 CEST	192.168.2.7	62.118.0.200	b52	Echo
Jul 26, 2024 02:27:25.495764017 CEST	192.168.2.7	62.118.180.143	b51	Echo
Jul 26, 2024 02:27:25.495881081 CEST	192.168.2.7	62.118.35.5	b50	Echo
Jul 26, 2024 02:27:25.495906115 CEST	192.168.2.7	62.118.207.204	b4f	Echo
Jul 26, 2024 02:27:25.495939016 CEST	192.168.2.7	62.118.63.227	b4e	Echo
Jul 26, 2024 02:27:25.496505976 CEST	192.168.2.7	62.118.195.64	b4d	Echo
Jul 26, 2024 02:27:25.524094105 CEST	192.168.2.7	62.118.43.251	b4c	Echo
Jul 26, 2024 02:27:25.555890083 CEST	192.168.2.7	62.118.68.80	b4b	Echo
Jul 26, 2024 02:27:25.588089943 CEST	192.168.2.7	62.118.143.68	b4a	Echo
Jul 26, 2024 02:27:25.619048119 CEST	192.168.2.7	62.118.188.56	b49	Echo
Jul 26, 2024 02:27:25.649265051 CEST	192.168.2.7	62.118.175.2	b48	Echo
Jul 26, 2024 02:27:25.681595087 CEST	192.168.2.7	62.118.160.64	b47	Echo
Jul 26, 2024 02:27:25.721210003 CEST	192.168.2.7	62.118.114.104	b46	Echo
Jul 26, 2024 02:27:25.743546963 CEST	192.168.2.7	62.118.71.50	b45	Echo
Jul 26, 2024 02:27:25.774943113 CEST	192.168.2.7	62.118.113.215	b44	Echo
Jul 26, 2024 02:27:25.805716991 CEST	192.168.2.7	62.118.252.106	b43	Echo
Jul 26, 2024 02:27:25.836791992 CEST	192.168.2.7	62.118.187.146	b42	Echo
Jul 26, 2024 02:27:25.868065119 CEST	192.168.2.7	62.118.68.109	b41	Echo
Jul 26, 2024 02:27:25.899133921 CEST	192.168.2.7	62.118.202.79	b40	Echo
Jul 26, 2024 02:27:25.930512905 CEST	192.168.2.7	62.118.165.34	b3f	Echo
Jul 26, 2024 02:27:25.961688042 CEST	192.168.2.7	62.118.218.2	b3e	Echo
Jul 26, 2024 02:27:25.993027925 CEST	192.168.2.7	62.118.77.104	b3d	Echo
Jul 26, 2024 02:27:25.993083000 CEST	62.118.165.34	192.168.2.7	133f	Echo Reply
Jul 26, 2024 02:27:25.993267059 CEST	192.168.2.7	62.118.10.201	b3c	Echo
Jul 26, 2024 02:27:25.994895935 CEST	192.168.2.7	62.118.180.164	b3b	Echo
Jul 26, 2024 02:27:25.994951010 CEST	192.168.2.7	62.118.20.208	b3a	Echo
Jul 26, 2024 02:27:25.995019913 CEST	192.168.2.7	62.118.48.56	b39	Echo
Jul 26, 2024 02:27:25.995069027 CEST	192.168.2.7	62.118.157.214	b38	Echo
Jul 26, 2024 02:27:25.995145082 CEST	192.168.2.7	62.118.236.192	b37	Echo
Jul 26, 2024 02:27:25.995178938 CEST	192.168.2.7	62.118.59.161	b36	Echo
Jul 26, 2024 02:27:25.995249033 CEST	192.168.2.7	62.118.127.192	b35	Echo
Jul 26, 2024 02:27:25.995297909 CEST	192.168.2.7	62.118.198.200	b34	Echo
Jul 26, 2024 02:27:25.995459080 CEST	192.168.2.7	62.118.73.176	b32	Echo
Jul 26, 2024 02:27:25.995515108 CEST	192.168.2.7	62.118.4.122	b31	Echo
Jul 26, 2024 02:27:25.995563984 CEST	192.168.2.7	62.118.37.52	b30	Echo
Jul 26, 2024 02:27:25.995615959 CEST	192.168.2.7	62.118.221.183	b2f	Echo
Jul 26, 2024 02:27:25.995680094 CEST	192.168.2.7	62.118.166.221	b2e	Echo
Jul 26, 2024 02:27:25.995729923 CEST	192.168.2.7	62.118.165.34	b2d	Echo
Jul 26, 2024 02:27:25.996901035 CEST	192.168.2.7	62.118.72.1	b33	Echo
Jul 26, 2024 02:27:26.024203062 CEST	192.168.2.7	62.118.206.126	b2c	Echo
Jul 26, 2024 02:27:26.055613995 CEST	192.168.2.7	62.118.42.78	b2b	Echo
Jul 26, 2024 02:27:26.056478024 CEST	62.118.165.34	192.168.2.7	132d	Echo Reply
Jul 26, 2024 02:27:26.086710930 CEST	192.168.2.7	62.118.39.224	b2a	Echo
Jul 26, 2024 02:27:26.118014097 CEST	192.168.2.7	62.118.122.39	b29	Echo
Jul 26, 2024 02:27:26.149137020 CEST	192.168.2.7	62.118.13.47	b28	Echo
Jul 26, 2024 02:27:26.180473089 CEST	192.168.2.7	62.118.94.75	b27	Echo
Jul 26, 2024 02:27:26.212110996 CEST	192.168.2.7	62.118.29.83	b26	Echo
Jul 26, 2024 02:27:26.243418932 CEST	192.168.2.7	62.118.113.29	b25	Echo
Jul 26, 2024 02:27:26.274261951 CEST	192.168.2.7	62.118.221.254	b24	Echo
Jul 26, 2024 02:27:26.309422016 CEST	192.168.2.7	62.118.14.9	b23	Echo
Jul 26, 2024 02:27:26.337109089 CEST	192.168.2.7	62.118.255.13	b22	Echo
Jul 26, 2024 02:27:26.400202036 CEST	192.168.2.7	62.118.29.93	b21	Echo
Jul 26, 2024 02:27:26.401204109 CEST	192.168.2.7	62.118.138.28	b20	Echo
Jul 26, 2024 02:27:26.471242905 CEST	192.168.2.7	62.118.39.160	b1f	Echo
Jul 26, 2024 02:27:26.472898960 CEST	192.168.2.7	62.118.102.0	b1e	Echo
Jul 26, 2024 02:27:26.495677948 CEST	192.168.2.7	62.118.105.75	b1d	Echo
Jul 26, 2024 02:27:26.496387005 CEST	192.168.2.7	62.118.129.166	b1c	Echo
Jul 26, 2024 02:27:26.505152941 CEST	192.168.2.7	62.118.199.169	b1b	Echo
Jul 26, 2024 02:27:26.505309105 CEST	192.168.2.7	62.118.148.86	b1a	Echo
Jul 26, 2024 02:27:26.509627104 CEST	192.168.2.7	62.118.242.73	b19	Echo
Jul 26, 2024 02:27:26.510171890 CEST	192.168.2.7	62.118.12.62	b18	Echo
Jul 26, 2024 02:27:26.510662079 CEST	192.168.2.7	62.118.105.12	b17	Echo
Jul 26, 2024 02:27:26.510768890 CEST	192.168.2.7	62.118.176.104	b16	Echo
Jul 26, 2024 02:27:26.512025118 CEST	192.168.2.7	62.118.113.251	b15	Echo
Jul 26, 2024 02:27:26.512119055 CEST	192.168.2.7	62.118.254.179	b14	Echo
Jul 26, 2024 02:27:26.512833118 CEST	192.168.2.7	62.118.92.58	b12	Echo
Jul 26, 2024 02:27:26.513174057 CEST	192.168.2.7	62.118.92.255	b13	Echo
Jul 26, 2024 02:27:26.516554117 CEST	192.168.2.7	62.118.217.93	b11	Echo
Jul 26, 2024 02:27:26.516727924 CEST	192.168.2.7	62.118.240.228	b10	Echo
Jul 26, 2024 02:27:26.517100096 CEST	192.168.2.7	62.118.24.240	b0f	Echo
Jul 26, 2024 02:27:26.517203093 CEST	192.168.2.7	62.118.1.252	b0e	Echo
Jul 26, 2024 02:27:26.539098978 CEST	192.168.2.7	62.118.236.128	b0d	Echo
Jul 26, 2024 02:27:26.594501019 CEST	192.168.2.7	62.118.1.68	b0c	Echo
Jul 26, 2024 02:27:26.636204958 CEST	192.168.2.7	62.118.149.239	b0b	Echo
Jul 26, 2024 02:27:26.665155888 CEST	192.168.2.7	62.118.113.55	b0a	Echo
Jul 26, 2024 02:27:26.699434996 CEST	192.168.2.7	62.118.132.3	b09	Echo
Jul 26, 2024 02:27:26.727368116 CEST	192.168.2.7	62.118.176.89	b08	Echo
Jul 26, 2024 02:27:26.738934994 CEST	62.118.132.3	192.168.2.7	1309	Echo Reply
Jul 26, 2024 02:27:26.739583969 CEST	192.168.2.7	62.118.132.3	b07	Echo
Jul 26, 2024 02:27:26.758771896 CEST	192.168.2.7	62.118.153.245	b06	Echo
Jul 26, 2024 02:27:26.779242039 CEST	62.118.132.3	192.168.2.7	1307	Echo Reply
Jul 26, 2024 02:27:26.789846897 CEST	192.168.2.7	62.118.99.41	b05	Echo
Jul 26, 2024 02:27:26.825885057 CEST	192.168.2.7	62.118.215.26	b04	Echo
Jul 26, 2024 02:27:26.857353926 CEST	192.168.2.7	62.118.138.215	b03	Echo
Jul 26, 2024 02:27:26.884553909 CEST	192.168.2.7	62.118.243.163	b02	Echo
Jul 26, 2024 02:27:26.918627024 CEST	192.168.2.7	62.118.71.24	b01	Echo
Jul 26, 2024 02:27:26.947669029 CEST	192.168.2.7	62.118.211.212	b00	Echo
Jul 26, 2024 02:27:26.977477074 CEST	192.168.2.7	62.118.192.156	aff	Echo
Jul 26, 2024 02:27:26.994610071 CEST	192.168.2.7	62.118.34.219	afd	Echo
Jul 26, 2024 02:27:26.994630098 CEST	192.168.2.7	62.118.42.40	afc	Echo
Jul 26, 2024 02:27:26.994738102 CEST	192.168.2.7	62.118.15.67	afb	Echo
Jul 26, 2024 02:27:26.994801044 CEST	192.168.2.7	62.118.115.15	afa	Echo
Jul 26, 2024 02:27:26.994860888 CEST	192.168.2.7	62.118.162.115	af9	Echo
Jul 26, 2024 02:27:26.994904995 CEST	192.168.2.7	62.118.128.216	af8	Echo
Jul 26, 2024 02:27:26.994982004 CEST	192.168.2.7	62.118.43.64	af7	Echo
Jul 26, 2024 02:27:26.995029926 CEST	192.168.2.7	62.118.194.42	af6	Echo
Jul 26, 2024 02:27:26.995162964 CEST	192.168.2.7	62.118.39.106	af4	Echo
Jul 26, 2024 02:27:26.995265961 CEST	192.168.2.7	62.118.218.220	afe	Echo
Jul 26, 2024 02:27:26.995265961 CEST	192.168.2.7	62.118.148.43	af2	Echo
Jul 26, 2024 02:27:26.995421886 CEST	192.168.2.7	62.118.37.69	af0	Echo
Jul 26, 2024 02:27:26.995476007 CEST	192.168.2.7	62.118.35.6	af3	Echo
Jul 26, 2024 02:27:26.995476007 CEST	192.168.2.7	62.118.9.242	aef	Echo
Jul 26, 2024 02:27:26.995923042 CEST	192.168.2.7	62.118.127.95	af5	Echo
Jul 26, 2024 02:27:26.995923996 CEST	192.168.2.7	62.118.69.55	af1	Echo
Jul 26, 2024 02:27:27.008711100 CEST	192.168.2.7	62.118.169.189	aee	Echo
Jul 26, 2024 02:27:27.040085077 CEST	192.168.2.7	62.118.50.222	aed	Echo
Jul 26, 2024 02:27:27.071655989 CEST	192.168.2.7	62.118.114.251	aec	Echo
Jul 26, 2024 02:27:27.102463007 CEST	192.168.2.7	62.118.78.78	aeb	Echo
Jul 26, 2024 02:27:27.133703947 CEST	192.168.2.7	62.118.210.208	aea	Echo
Jul 26, 2024 02:27:27.164865017 CEST	192.168.2.7	62.118.76.149	ae9	Echo
Jul 26, 2024 02:27:27.196283102 CEST	192.168.2.7	62.118.233.177	ae8	Echo
Jul 26, 2024 02:27:27.228121996 CEST	192.168.2.7	62.118.241.13	ae7	Echo
Jul 26, 2024 02:27:27.258936882 CEST	192.168.2.7	62.118.47.210	ae6	Echo
Jul 26, 2024 02:27:27.289933920 CEST	192.168.2.7	62.118.42.48	ae5	Echo
Jul 26, 2024 02:27:27.321099997 CEST	192.168.2.7	62.118.121.231	ae4	Echo
Jul 26, 2024 02:27:27.352377892 CEST	192.168.2.7	62.118.79.129	ae3	Echo
Jul 26, 2024 02:27:27.383951902 CEST	192.168.2.7	62.118.237.138	ae2	Echo
Jul 26, 2024 02:27:27.415040970 CEST	192.168.2.7	62.118.4.238	ae1	Echo
Jul 26, 2024 02:27:27.446333885 CEST	192.168.2.7	62.118.162.15	ae0	Echo
Jul 26, 2024 02:27:27.477370977 CEST	192.168.2.7	62.118.68.58	adf	Echo
Jul 26, 2024 02:27:27.492953062 CEST	192.168.2.7	62.118.119.240	ade	Echo
Jul 26, 2024 02:27:27.494848967 CEST	192.168.2.7	62.118.43.251	add	Echo
Jul 26, 2024 02:27:27.495045900 CEST	192.168.2.7	62.118.143.68	adb	Echo
Jul 26, 2024 02:27:27.495066881 CEST	192.168.2.7	62.118.188.56	ada	Echo
Jul 26, 2024 02:27:27.495198011 CEST	192.168.2.7	62.118.175.2	ad9	Echo
Jul 26, 2024 02:27:27.495244026 CEST	192.168.2.7	62.118.160.64	ad8	Echo
Jul 26, 2024 02:27:27.495320082 CEST	192.168.2.7	62.118.114.104	ad7	Echo
Jul 26, 2024 02:27:27.495362043 CEST	192.168.2.7	62.118.68.80	adc	Echo
Jul 26, 2024 02:27:27.495362043 CEST	192.168.2.7	62.118.71.50	ad6	Echo
Jul 26, 2024 02:27:27.495435953 CEST	192.168.2.7	62.118.113.215	ad5	Echo
Jul 26, 2024 02:27:27.495482922 CEST	192.168.2.7	62.118.252.106	ad4	Echo
Jul 26, 2024 02:27:27.495538950 CEST	192.168.2.7	62.118.187.146	ad3	Echo
Jul 26, 2024 02:27:27.495587111 CEST	192.168.2.7	62.118.68.109	ad2	Echo
Jul 26, 2024 02:27:27.495685101 CEST	192.168.2.7	62.118.218.2	ad1	Echo
Jul 26, 2024 02:27:27.495719910 CEST	192.168.2.7	62.118.202.79	ad0	Echo
Jul 26, 2024 02:27:27.508542061 CEST	192.168.2.7	62.118.219.67	acf	Echo
Jul 26, 2024 02:27:27.541891098 CEST	192.168.2.7	62.118.95.218	ace	Echo
Jul 26, 2024 02:27:27.571134090 CEST	192.168.2.7	62.118.70.175	acd	Echo
Jul 26, 2024 02:27:27.602298975 CEST	192.168.2.7	62.118.237.35	acc	Echo
Jul 26, 2024 02:27:27.630888939 CEST	192.168.2.7	62.118.95.218	acb	Echo
Jul 26, 2024 02:27:27.633889914 CEST	192.168.2.7	62.118.105.222	aca	Echo
Jul 26, 2024 02:27:27.664908886 CEST	192.168.2.7	62.118.193.55	ac9	Echo
Jul 26, 2024 02:27:27.696067095 CEST	192.168.2.7	62.118.50.74	ac8	Echo
Jul 26, 2024 02:27:27.727288961 CEST	192.168.2.7	62.118.123.101	ac7	Echo
Jul 26, 2024 02:27:27.760507107 CEST	192.168.2.7	62.118.162.19	ac6	Echo
Jul 26, 2024 02:27:27.792828083 CEST	192.168.2.7	62.118.15.162	ac5	Echo
Jul 26, 2024 02:27:27.821316957 CEST	192.168.2.7	62.118.21.180	ac4	Echo
Jul 26, 2024 02:27:27.852606058 CEST	192.168.2.7	62.118.97.48	ac3	Echo
Jul 26, 2024 02:27:27.883543015 CEST	192.168.2.7	62.118.11.97	ac2	Echo
Jul 26, 2024 02:27:27.914874077 CEST	192.168.2.7	62.118.108.179	ac1	Echo
Jul 26, 2024 02:27:27.946595907 CEST	192.168.2.7	62.118.16.151	ac0	Echo
Jul 26, 2024 02:27:27.977740049 CEST	192.168.2.7	62.118.84.97	abf	Echo
Jul 26, 2024 02:27:27.993144989 CEST	192.168.2.7	62.118.77.104	abe	Echo
Jul 26, 2024 02:27:27.994791985 CEST	192.168.2.7	62.118.206.126	abd	Echo
Jul 26, 2024 02:27:27.994843960 CEST	192.168.2.7	62.118.42.78	abc	Echo
Jul 26, 2024 02:27:27.994927883 CEST	192.168.2.7	62.118.39.224	abb	Echo
Jul 26, 2024 02:27:27.994968891 CEST	192.168.2.7	62.118.122.39	aba	Echo
Jul 26, 2024 02:27:27.995047092 CEST	192.168.2.7	62.118.13.47	ab9	Echo
Jul 26, 2024 02:27:27.995083094 CEST	192.168.2.7	62.118.94.75	ab8	Echo
Jul 26, 2024 02:27:27.995161057 CEST	192.168.2.7	62.118.29.83	ab7	Echo
Jul 26, 2024 02:27:27.995201111 CEST	192.168.2.7	62.118.113.29	ab6	Echo
Jul 26, 2024 02:27:27.995265007 CEST	192.168.2.7	62.118.221.254	ab5	Echo
Jul 26, 2024 02:27:27.995306969 CEST	192.168.2.7	62.118.14.9	ab4	Echo
Jul 26, 2024 02:27:27.995424032 CEST	192.168.2.7	62.118.29.93	ab2	Echo
Jul 26, 2024 02:27:27.995531082 CEST	192.168.2.7	62.118.138.28	ab1	Echo
Jul 26, 2024 02:27:27.995531082 CEST	192.168.2.7	62.118.39.160	ab0	Echo
Jul 26, 2024 02:27:27.995575905 CEST	192.168.2.7	62.118.102.0	aaf	Echo
Jul 26, 2024 02:27:27.996355057 CEST	192.168.2.7	62.118.255.13	ab3	Echo
Jul 26, 2024 02:27:28.008567095 CEST	192.168.2.7	62.118.130.241	aae	Echo
Jul 26, 2024 02:27:28.039962053 CEST	192.168.2.7	62.118.104.62	aad	Echo
Jul 26, 2024 02:27:28.071264029 CEST	192.168.2.7	62.118.149.91	aac	Echo
Jul 26, 2024 02:27:28.102298021 CEST	192.168.2.7	62.118.190.113	aab	Echo
Jul 26, 2024 02:27:28.133887053 CEST	192.168.2.7	62.118.233.44	aaa	Echo
Jul 26, 2024 02:27:28.165678978 CEST	192.168.2.7	62.118.28.58	aa9	Echo
Jul 26, 2024 02:27:28.196270943 CEST	192.168.2.7	62.118.22.246	aa8	Echo
Jul 26, 2024 02:27:28.227627993 CEST	192.168.2.7	62.118.56.131	aa7	Echo
Jul 26, 2024 02:27:28.258960962 CEST	192.168.2.7	62.118.147.62	aa6	Echo
Jul 26, 2024 02:27:28.289936066 CEST	192.168.2.7	62.118.202.8	aa5	Echo
Jul 26, 2024 02:27:28.321115971 CEST	192.168.2.7	62.118.159.211	aa4	Echo
Jul 26, 2024 02:27:28.352405071 CEST	192.168.2.7	62.118.51.198	aa3	Echo
Jul 26, 2024 02:27:28.383682966 CEST	192.168.2.7	62.118.11.150	aa2	Echo
Jul 26, 2024 02:27:28.417507887 CEST	192.168.2.7	62.118.37.54	aa1	Echo
Jul 26, 2024 02:27:28.446316957 CEST	192.168.2.7	62.118.124.14	aa0	Echo
Jul 26, 2024 02:27:28.477381945 CEST	192.168.2.7	62.118.201.196	a9f	Echo
Jul 26, 2024 02:27:28.493571043 CEST	192.168.2.7	62.118.129.166	a9e	Echo
Jul 26, 2024 02:27:28.494761944 CEST	192.168.2.7	62.118.236.128	a9d	Echo
Jul 26, 2024 02:27:28.494853973 CEST	192.168.2.7	62.118.1.68	a9c	Echo
Jul 26, 2024 02:27:28.494934082 CEST	192.168.2.7	62.118.149.239	a9b	Echo
Jul 26, 2024 02:27:28.495018959 CEST	192.168.2.7	62.118.113.55	a9a	Echo
Jul 26, 2024 02:27:28.495115042 CEST	192.168.2.7	62.118.176.89	a99	Echo
Jul 26, 2024 02:27:28.495166063 CEST	192.168.2.7	62.118.153.245	a98	Echo
Jul 26, 2024 02:27:28.495254040 CEST	192.168.2.7	62.118.99.41	a97	Echo
Jul 26, 2024 02:27:28.495356083 CEST	192.168.2.7	62.118.215.26	a96	Echo
Jul 26, 2024 02:27:28.495428085 CEST	192.168.2.7	62.118.138.215	a95	Echo
Jul 26, 2024 02:27:28.495501041 CEST	192.168.2.7	62.118.243.163	a94	Echo
Jul 26, 2024 02:27:28.495578051 CEST	192.168.2.7	62.118.71.24	a93	Echo
Jul 26, 2024 02:27:28.495712042 CEST	192.168.2.7	62.118.211.212	a92	Echo
Jul 26, 2024 02:27:28.495765924 CEST	192.168.2.7	62.118.192.156	a91	Echo
Jul 26, 2024 02:27:28.508590937 CEST	192.168.2.7	62.118.192.234	a90	Echo
Jul 26, 2024 02:27:28.539908886 CEST	192.168.2.7	62.118.34.155	a8f	Echo
Jul 26, 2024 02:27:28.571140051 CEST	192.168.2.7	62.118.59.101	a8e	Echo
Jul 26, 2024 02:27:28.602365017 CEST	192.168.2.7	62.118.22.226	a8d	Echo
Jul 26, 2024 02:27:28.633615017 CEST	192.168.2.7	62.118.156.92	a8c	Echo
Jul 26, 2024 02:27:28.665895939 CEST	192.168.2.7	62.118.238.126	a8b	Echo
Jul 26, 2024 02:27:28.696187973 CEST	192.168.2.7	62.118.220.10	a8a	Echo
Jul 26, 2024 02:27:28.727458954 CEST	192.168.2.7	62.118.128.202	a89	Echo
Jul 26, 2024 02:27:28.758666992 CEST	192.168.2.7	62.118.153.206	a88	Echo
Jul 26, 2024 02:27:28.789908886 CEST	192.168.2.7	62.118.35.127	a87	Echo
Jul 26, 2024 02:27:28.822041035 CEST	192.168.2.7	62.118.42.79	a86	Echo
Jul 26, 2024 02:27:28.852385044 CEST	192.168.2.7	62.118.135.20	a85	Echo
Jul 26, 2024 02:27:28.883606911 CEST	192.168.2.7	62.118.50.135	a84	Echo
Jul 26, 2024 02:27:28.914912939 CEST	192.168.2.7	62.118.150.50	a83	Echo
Jul 26, 2024 02:27:28.946532011 CEST	192.168.2.7	62.118.152.149	a82	Echo
Jul 26, 2024 02:27:28.979898930 CEST	192.168.2.7	62.118.209.147	a81	Echo
Jul 26, 2024 02:27:28.997823954 CEST	192.168.2.7	62.118.169.189	a80	Echo
Jul 26, 2024 02:27:28.998179913 CEST	192.168.2.7	62.118.50.222	a7f	Echo
Jul 26, 2024 02:27:28.998707056 CEST	192.168.2.7	62.118.114.251	a7e	Echo
Jul 26, 2024 02:27:28.998874903 CEST	192.168.2.7	62.118.78.78	a7d	Echo
Jul 26, 2024 02:27:28.999281883 CEST	192.168.2.7	62.118.210.208	a7c	Echo
Jul 26, 2024 02:27:28.999380112 CEST	192.168.2.7	62.118.76.149	a7b	Echo
Jul 26, 2024 02:27:28.999617100 CEST	192.168.2.7	62.118.233.177	a7a	Echo
Jul 26, 2024 02:27:28.999947071 CEST	192.168.2.7	62.118.241.13	a79	Echo
Jul 26, 2024 02:27:29.001208067 CEST	192.168.2.7	62.118.121.231	a76	Echo
Jul 26, 2024 02:27:29.001723051 CEST	192.168.2.7	62.118.47.210	a78	Echo
Jul 26, 2024 02:27:29.004035950 CEST	192.168.2.7	62.118.42.48	a77	Echo
Jul 26, 2024 02:27:29.004499912 CEST	192.168.2.7	62.118.79.129	a75	Echo
Jul 26, 2024 02:27:29.004961967 CEST	192.168.2.7	62.118.4.238	a73	Echo
Jul 26, 2024 02:27:29.005300999 CEST	192.168.2.7	62.118.68.58	a71	Echo
Jul 26, 2024 02:27:29.007651091 CEST	192.168.2.7	62.118.237.138	a74	Echo
Jul 26, 2024 02:27:29.008328915 CEST	192.168.2.7	62.118.162.15	a72	Echo
Jul 26, 2024 02:27:29.012419939 CEST	192.168.2.7	62.118.131.159	a70	Echo
Jul 26, 2024 02:27:29.039958954 CEST	192.168.2.7	62.118.23.250	a6f	Echo
Jul 26, 2024 02:27:29.071760893 CEST	192.168.2.7	62.118.109.32	a6e	Echo
Jul 26, 2024 02:27:29.102246046 CEST	192.168.2.7	62.118.48.19	a6d	Echo
Jul 26, 2024 02:27:29.133661985 CEST	192.168.2.7	62.118.60.64	a6c	Echo
Jul 26, 2024 02:27:29.164959908 CEST	192.168.2.7	62.118.254.201	a6b	Echo
Jul 26, 2024 02:27:29.196064949 CEST	192.168.2.7	62.118.232.105	a6a	Echo
Jul 26, 2024 02:27:29.227588892 CEST	192.168.2.7	62.118.161.228	a69	Echo
Jul 26, 2024 02:27:29.258944035 CEST	192.168.2.7	62.118.192.242	a68	Echo
Jul 26, 2024 02:27:29.289866924 CEST	192.168.2.7	62.118.64.76	a67	Echo
Jul 26, 2024 02:27:29.321109056 CEST	192.168.2.7	62.118.63.75	a66	Echo
Jul 26, 2024 02:27:29.352519989 CEST	192.168.2.7	62.118.84.105	a65	Echo
Jul 26, 2024 02:27:29.383668900 CEST	192.168.2.7	62.118.253.46	a64	Echo
Jul 26, 2024 02:27:29.414843082 CEST	192.168.2.7	62.118.174.253	a63	Echo
Jul 26, 2024 02:27:29.436181068 CEST	62.118.253.46	192.168.2.7	1264	Echo Reply
Jul 26, 2024 02:27:29.436759949 CEST	192.168.2.7	62.118.253.46	a62	Echo
Jul 26, 2024 02:27:29.446110010 CEST	192.168.2.7	62.118.237.121	a61	Echo
Jul 26, 2024 02:27:29.478203058 CEST	192.168.2.7	62.118.211.3	a60	Echo
Jul 26, 2024 02:27:29.489202976 CEST	62.118.253.46	192.168.2.7	1262	Echo Reply
Jul 26, 2024 02:27:29.495594978 CEST	192.168.2.7	62.118.219.67	a5f	Echo
Jul 26, 2024 02:27:29.503633022 CEST	192.168.2.7	62.118.70.175	a5e	Echo
Jul 26, 2024 02:27:29.504050970 CEST	192.168.2.7	62.118.237.35	a5d	Echo
Jul 26, 2024 02:27:29.504606962 CEST	192.168.2.7	62.118.105.222	a5c	Echo
Jul 26, 2024 02:27:29.504653931 CEST	192.168.2.7	62.118.193.55	a5b	Echo
Jul 26, 2024 02:27:29.504754066 CEST	192.168.2.7	62.118.50.74	a5a	Echo
Jul 26, 2024 02:27:29.504810095 CEST	192.168.2.7	62.118.123.101	a59	Echo
Jul 26, 2024 02:27:29.504901886 CEST	192.168.2.7	62.118.162.19	a58	Echo
Jul 26, 2024 02:27:29.504941940 CEST	192.168.2.7	62.118.15.162	a57	Echo
Jul 26, 2024 02:27:29.505027056 CEST	192.168.2.7	62.118.21.180	a56	Echo
Jul 26, 2024 02:27:29.505172014 CEST	192.168.2.7	62.118.97.48	a55	Echo
Jul 26, 2024 02:27:29.505248070 CEST	192.168.2.7	62.118.11.97	a54	Echo
Jul 26, 2024 02:27:29.505342007 CEST	192.168.2.7	62.118.108.179	a53	Echo
Jul 26, 2024 02:27:29.505417109 CEST	192.168.2.7	62.118.16.151	a52	Echo
Jul 26, 2024 02:27:29.505489111 CEST	192.168.2.7	62.118.84.97	a51	Echo
Jul 26, 2024 02:27:29.508830070 CEST	192.168.2.7	62.118.234.210	a50	Echo
Jul 26, 2024 02:27:29.539839983 CEST	192.168.2.7	62.118.228.45	a4f	Echo
Jul 26, 2024 02:27:29.571166992 CEST	192.168.2.7	62.118.14.185	a4e	Echo
Jul 26, 2024 02:27:29.602607965 CEST	192.168.2.7	62.118.153.116	a4d	Echo
Jul 26, 2024 02:27:29.633667946 CEST	192.168.2.7	62.118.222.161	a4c	Echo
Jul 26, 2024 02:27:29.665251017 CEST	192.168.2.7	62.118.40.222	a4b	Echo
Jul 26, 2024 02:27:29.696280003 CEST	192.168.2.7	62.118.78.113	a4a	Echo
Jul 26, 2024 02:27:29.727519989 CEST	192.168.2.7	62.118.140.149	a49	Echo
Jul 26, 2024 02:27:29.745731115 CEST	62.118.78.113	192.168.2.7	124a	Echo Reply
Jul 26, 2024 02:27:29.746212006 CEST	192.168.2.7	62.118.78.113	a48	Echo
Jul 26, 2024 02:27:29.758702040 CEST	192.168.2.7	62.118.193.228	a47	Echo
Jul 26, 2024 02:27:29.789900064 CEST	192.168.2.7	62.118.37.17	a46	Echo
Jul 26, 2024 02:27:29.798396111 CEST	62.118.78.113	192.168.2.7	1248	Echo Reply
Jul 26, 2024 02:27:29.821225882 CEST	192.168.2.7	62.118.238.232	a45	Echo
Jul 26, 2024 02:27:29.852842093 CEST	192.168.2.7	62.118.44.240	a44	Echo
Jul 26, 2024 02:27:29.884064913 CEST	192.168.2.7	62.118.240.32	a43	Echo
Jul 26, 2024 02:27:29.915186882 CEST	192.168.2.7	62.118.49.48	a42	Echo
Jul 26, 2024 02:27:29.946609974 CEST	192.168.2.7	62.118.227.135	a41	Echo
Jul 26, 2024 02:27:29.977336884 CEST	192.168.2.7	62.118.59.119	a40	Echo
Jul 26, 2024 02:27:29.994697094 CEST	192.168.2.7	62.118.130.241	a3f	Echo
Jul 26, 2024 02:27:29.994745970 CEST	192.168.2.7	62.118.104.62	a3e	Echo
Jul 26, 2024 02:27:29.994851112 CEST	192.168.2.7	62.118.149.91	a3d	Echo
Jul 26, 2024 02:27:29.994910955 CEST	192.168.2.7	62.118.190.113	a3c	Echo
Jul 26, 2024 02:27:29.995021105 CEST	192.168.2.7	62.118.233.44	a3b	Echo
Jul 26, 2024 02:27:29.995141029 CEST	192.168.2.7	62.118.22.246	a39	Echo
Jul 26, 2024 02:27:29.995256901 CEST	192.168.2.7	62.118.147.62	a37	Echo
Jul 26, 2024 02:27:29.995352983 CEST	192.168.2.7	62.118.202.8	a36	Echo
Jul 26, 2024 02:27:29.995445967 CEST	192.168.2.7	62.118.159.211	a35	Echo
Jul 26, 2024 02:27:29.995596886 CEST	192.168.2.7	62.118.11.150	a33	Echo
Jul 26, 2024 02:27:29.995676994 CEST	192.168.2.7	62.118.37.54	a32	Echo
Jul 26, 2024 02:27:29.995737076 CEST	192.168.2.7	62.118.124.14	a31	Echo
Jul 26, 2024 02:27:29.995793104 CEST	192.168.2.7	62.118.201.196	a30	Echo
Jul 26, 2024 02:27:29.997164965 CEST	192.168.2.7	62.118.56.131	a38	Echo
Jul 26, 2024 02:27:29.997165918 CEST	192.168.2.7	62.118.28.58	a3a	Echo
Jul 26, 2024 02:27:29.997167110 CEST	192.168.2.7	62.118.51.198	a34	Echo
Jul 26, 2024 02:27:30.008516073 CEST	192.168.2.7	62.118.120.225	a2f	Echo
Jul 26, 2024 02:27:30.040133953 CEST	192.168.2.7	62.118.227.111	a2e	Echo
Jul 26, 2024 02:27:30.071095943 CEST	192.168.2.7	62.118.47.154	a2d	Echo
Jul 26, 2024 02:27:30.102890015 CEST	192.168.2.7	62.118.229.234	a2c	Echo
Jul 26, 2024 02:27:30.133611917 CEST	192.168.2.7	62.118.74.67	a2b	Echo
Jul 26, 2024 02:27:30.165071964 CEST	192.168.2.7	62.118.210.65	a2a	Echo
Jul 26, 2024 02:27:30.197151899 CEST	192.168.2.7	62.118.22.22	a29	Echo
Jul 26, 2024 02:27:30.227344990 CEST	192.168.2.7	62.118.247.131	a28	Echo
Jul 26, 2024 02:27:30.260324001 CEST	192.168.2.7	62.118.230.218	a27	Echo
Jul 26, 2024 02:27:30.290141106 CEST	192.168.2.7	62.118.187.230	a26	Echo
Jul 26, 2024 02:27:30.321347952 CEST	192.168.2.7	62.118.122.137	a25	Echo
Jul 26, 2024 02:27:30.353332996 CEST	192.168.2.7	62.118.45.230	a24	Echo
Jul 26, 2024 02:27:30.383661985 CEST	192.168.2.7	62.118.87.187	a23	Echo
Jul 26, 2024 02:27:30.415040016 CEST	192.168.2.7	62.118.104.162	a22	Echo
Jul 26, 2024 02:27:30.446120024 CEST	192.168.2.7	62.118.82.118	a21	Echo
Jul 26, 2024 02:27:30.477416992 CEST	192.168.2.7	62.118.168.123	a20	Echo
Jul 26, 2024 02:27:30.495609045 CEST	192.168.2.7	62.118.192.234	a1f	Echo
Jul 26, 2024 02:27:30.495924950 CEST	192.168.2.7	62.118.34.155	a1e	Echo
Jul 26, 2024 02:27:30.496017933 CEST	192.168.2.7	62.118.59.101	a1d	Echo
Jul 26, 2024 02:27:30.496166945 CEST	192.168.2.7	62.118.22.226	a1c	Echo
Jul 26, 2024 02:27:30.496233940 CEST	192.168.2.7	62.118.156.92	a1b	Echo
Jul 26, 2024 02:27:30.496400118 CEST	192.168.2.7	62.118.220.10	a19	Echo
Jul 26, 2024 02:27:30.496437073 CEST	192.168.2.7	62.118.238.126	a1a	Echo
Jul 26, 2024 02:27:30.496478081 CEST	192.168.2.7	62.118.128.202	a18	Echo
Jul 26, 2024 02:27:30.496561050 CEST	192.168.2.7	62.118.153.206	a17	Echo
Jul 26, 2024 02:27:30.496731997 CEST	192.168.2.7	62.118.35.127	a16	Echo
Jul 26, 2024 02:27:30.496756077 CEST	192.168.2.7	62.118.42.79	a15	Echo
Jul 26, 2024 02:27:30.496783018 CEST	192.168.2.7	62.118.135.20	a14	Echo
Jul 26, 2024 02:27:30.496834993 CEST	192.168.2.7	62.118.50.135	a13	Echo
Jul 26, 2024 02:27:30.496958017 CEST	192.168.2.7	62.118.150.50	a12	Echo
Jul 26, 2024 02:27:30.497005939 CEST	192.168.2.7	62.118.152.149	a11	Echo
Jul 26, 2024 02:27:30.497139931 CEST	192.168.2.7	62.118.209.147	a10	Echo
Jul 26, 2024 02:27:30.508625984 CEST	192.168.2.7	62.118.87.137	a0f	Echo
Jul 26, 2024 02:27:30.539941072 CEST	192.168.2.7	62.118.174.195	a0e	Echo
Jul 26, 2024 02:27:30.571158886 CEST	192.168.2.7	62.118.95.240	a0d	Echo
Jul 26, 2024 02:27:30.602358103 CEST	192.168.2.7	62.118.0.152	a0c	Echo
Jul 26, 2024 02:27:30.633687019 CEST	192.168.2.7	62.118.6.185	a0b	Echo
Jul 26, 2024 02:27:30.664985895 CEST	192.168.2.7	62.118.38.231	a0a	Echo
Jul 26, 2024 02:27:30.696511030 CEST	192.168.2.7	62.118.157.226	a09	Echo
Jul 26, 2024 02:27:30.727832079 CEST	192.168.2.7	62.118.75.159	a08	Echo
Jul 26, 2024 02:27:30.758804083 CEST	192.168.2.7	62.118.26.84	a07	Echo
Jul 26, 2024 02:27:30.789896011 CEST	192.168.2.7	62.118.98.236	a06	Echo
Jul 26, 2024 02:27:30.821115971 CEST	192.168.2.7	62.118.3.151	a05	Echo
Jul 26, 2024 02:27:30.852524996 CEST	192.168.2.7	62.118.23.219	a04	Echo
Jul 26, 2024 02:27:30.883709908 CEST	192.168.2.7	62.118.119.176	a03	Echo
Jul 26, 2024 02:27:30.914952040 CEST	192.168.2.7	62.118.177.119	a02	Echo
Jul 26, 2024 02:27:30.946212053 CEST	192.168.2.7	62.118.50.177	a01	Echo
Jul 26, 2024 02:27:30.977598906 CEST	192.168.2.7	62.118.26.50	a00	Echo
Jul 26, 2024 02:27:30.994843006 CEST	192.168.2.7	62.118.131.159	9ff	Echo
Jul 26, 2024 02:27:30.994906902 CEST	192.168.2.7	62.118.23.250	9fe	Echo
Jul 26, 2024 02:27:30.994986057 CEST	192.168.2.7	62.118.109.32	9fd	Echo
Jul 26, 2024 02:27:30.995017052 CEST	192.168.2.7	62.118.48.19	9fc	Echo
Jul 26, 2024 02:27:30.995075941 CEST	192.168.2.7	62.118.60.64	9fb	Echo
Jul 26, 2024 02:27:30.995126963 CEST	192.168.2.7	62.118.254.201	9fa	Echo
Jul 26, 2024 02:27:30.995292902 CEST	192.168.2.7	62.118.232.105	9f9	Echo
Jul 26, 2024 02:27:30.995292902 CEST	192.168.2.7	62.118.192.242	9f7	Echo
Jul 26, 2024 02:27:30.995340109 CEST	192.168.2.7	62.118.64.76	9f6	Echo
Jul 26, 2024 02:27:30.995389938 CEST	192.168.2.7	62.118.161.228	9f8	Echo
Jul 26, 2024 02:27:30.995400906 CEST	192.168.2.7	62.118.63.75	9f5	Echo
Jul 26, 2024 02:27:30.995462894 CEST	192.168.2.7	62.118.84.105	9f4	Echo
Jul 26, 2024 02:27:30.995515108 CEST	192.168.2.7	62.118.174.253	9f3	Echo
Jul 26, 2024 02:27:30.995558977 CEST	192.168.2.7	62.118.237.121	9f2	Echo
Jul 26, 2024 02:27:30.995618105 CEST	192.168.2.7	62.118.211.3	9f1	Echo
Jul 26, 2024 02:27:31.008528948 CEST	192.168.2.7	62.118.120.107	9f0	Echo
Jul 26, 2024 02:27:31.040507078 CEST	192.168.2.7	62.118.110.242	9ef	Echo
Jul 26, 2024 02:27:31.071269989 CEST	192.168.2.7	62.118.41.182	9ee	Echo
Jul 26, 2024 02:27:31.102396965 CEST	192.168.2.7	62.118.78.0	9ed	Echo
Jul 26, 2024 02:27:31.133687019 CEST	192.168.2.7	62.118.224.234	9ec	Echo
Jul 26, 2024 02:27:31.164974928 CEST	192.168.2.7	62.118.138.41	9eb	Echo
Jul 26, 2024 02:27:31.196204901 CEST	192.168.2.7	62.118.35.76	9ea	Echo
Jul 26, 2024 02:27:31.227650881 CEST	192.168.2.7	62.118.150.171	9e9	Echo
Jul 26, 2024 02:27:31.261414051 CEST	192.168.2.7	62.118.17.191	9e8	Echo
Jul 26, 2024 02:27:31.294833899 CEST	192.168.2.7	62.118.216.192	9e7	Echo
Jul 26, 2024 02:27:31.324112892 CEST	192.168.2.7	62.118.25.98	9e6	Echo
Jul 26, 2024 02:27:31.353909016 CEST	192.168.2.7	62.118.250.122	9e5	Echo
Jul 26, 2024 02:27:31.384116888 CEST	192.168.2.7	62.118.102.58	9e4	Echo
Jul 26, 2024 02:27:31.415570974 CEST	192.168.2.7	62.118.123.57	9e3	Echo
Jul 26, 2024 02:27:31.446361065 CEST	192.168.2.7	62.118.9.124	9e2	Echo
Jul 26, 2024 02:27:31.478009939 CEST	192.168.2.7	62.118.227.234	9e1	Echo
Jul 26, 2024 02:27:31.494712114 CEST	192.168.2.7	62.118.234.210	9e0	Echo
Jul 26, 2024 02:27:31.494801998 CEST	192.168.2.7	62.118.228.45	9df	Echo
Jul 26, 2024 02:27:31.494884014 CEST	192.168.2.7	62.118.14.185	9de	Echo
Jul 26, 2024 02:27:31.494981050 CEST	192.168.2.7	62.118.153.116	9dd	Echo
Jul 26, 2024 02:27:31.495069027 CEST	192.168.2.7	62.118.222.161	9dc	Echo
Jul 26, 2024 02:27:31.495153904 CEST	192.168.2.7	62.118.40.222	9db	Echo
Jul 26, 2024 02:27:31.495234013 CEST	192.168.2.7	62.118.140.149	9da	Echo
Jul 26, 2024 02:27:31.495317936 CEST	192.168.2.7	62.118.193.228	9d9	Echo
Jul 26, 2024 02:27:31.495397091 CEST	192.168.2.7	62.118.37.17	9d8	Echo
Jul 26, 2024 02:27:31.495589018 CEST	192.168.2.7	62.118.44.240	9d6	Echo
Jul 26, 2024 02:27:31.496031046 CEST	192.168.2.7	62.118.238.232	9d7	Echo
Jul 26, 2024 02:27:31.496092081 CEST	192.168.2.7	62.118.240.32	9d5	Echo
Jul 26, 2024 02:27:31.496186972 CEST	192.168.2.7	62.118.49.48	9d4	Echo
Jul 26, 2024 02:27:31.496273994 CEST	192.168.2.7	62.118.227.135	9d3	Echo
Jul 26, 2024 02:27:31.496540070 CEST	192.168.2.7	62.118.59.119	9d2	Echo
Jul 26, 2024 02:27:31.508774042 CEST	192.168.2.7	62.118.25.28	9d1	Echo
Jul 26, 2024 02:27:31.539858103 CEST	192.168.2.7	62.118.100.90	9d0	Echo
Jul 26, 2024 02:27:31.571265936 CEST	192.168.2.7	62.118.197.61	9cf	Echo
Jul 26, 2024 02:27:31.602372885 CEST	192.168.2.7	62.118.100.3	9ce	Echo
Jul 26, 2024 02:27:31.633935928 CEST	192.168.2.7	62.118.31.200	9cd	Echo
Jul 26, 2024 02:27:31.665121078 CEST	192.168.2.7	62.118.87.184	9cc	Echo
Jul 26, 2024 02:27:31.696099997 CEST	192.168.2.7	62.118.22.192	9cb	Echo
Jul 26, 2024 02:27:31.727359056 CEST	192.168.2.7	62.118.91.181	9ca	Echo
Jul 26, 2024 02:27:31.758688927 CEST	192.168.2.7	62.118.16.62	9c9	Echo
Jul 26, 2024 02:27:31.790050983 CEST	192.168.2.7	62.118.66.200	9c8	Echo
Jul 26, 2024 02:27:31.821127892 CEST	192.168.2.7	62.118.32.50	9c7	Echo
Jul 26, 2024 02:27:31.852407932 CEST	192.168.2.7	62.118.185.218	9c6	Echo
Jul 26, 2024 02:27:31.887801886 CEST	192.168.2.7	62.118.80.34	9c5	Echo
Jul 26, 2024 02:27:31.915256977 CEST	192.168.2.7	62.118.98.229	9c4	Echo
Jul 26, 2024 02:27:31.946513891 CEST	192.168.2.7	62.118.167.3	9c3	Echo
Jul 26, 2024 02:27:31.977427959 CEST	192.168.2.7	62.118.98.147	9c2	Echo
Jul 26, 2024 02:27:31.994757891 CEST	192.168.2.7	62.118.120.225	9c1	Echo
Jul 26, 2024 02:27:31.994793892 CEST	192.168.2.7	62.118.227.111	9c0	Echo
Jul 26, 2024 02:27:31.994888067 CEST	192.168.2.7	62.118.47.154	9bf	Echo
Jul 26, 2024 02:27:31.995009899 CEST	192.168.2.7	62.118.74.67	9bd	Echo
Jul 26, 2024 02:27:31.995039940 CEST	192.168.2.7	62.118.229.234	9be	Echo
Jul 26, 2024 02:27:31.995142937 CEST	192.168.2.7	62.118.22.22	9bb	Echo
Jul 26, 2024 02:27:31.995177031 CEST	192.168.2.7	62.118.210.65	9bc	Echo
Jul 26, 2024 02:27:31.995218992 CEST	192.168.2.7	62.118.247.131	9ba	Echo
Jul 26, 2024 02:27:31.995275974 CEST	192.168.2.7	62.118.230.218	9b9	Echo
Jul 26, 2024 02:27:31.995433092 CEST	192.168.2.7	62.118.187.230	9b8	Echo
Jul 26, 2024 02:27:31.995476007 CEST	192.168.2.7	62.118.122.137	9b7	Echo
Jul 26, 2024 02:27:31.995603085 CEST	192.168.2.7	62.118.45.230	9b6	Echo
Jul 26, 2024 02:27:31.995707989 CEST	192.168.2.7	62.118.104.162	9b4	Echo
Jul 26, 2024 02:27:31.995759964 CEST	192.168.2.7	62.118.82.118	9b3	Echo
Jul 26, 2024 02:27:31.995774984 CEST	192.168.2.7	62.118.87.187	9b5	Echo
Jul 26, 2024 02:27:31.995830059 CEST	192.168.2.7	62.118.168.123	9b2	Echo
Jul 26, 2024 02:27:32.008730888 CEST	192.168.2.7	62.118.21.220	9b1	Echo
Jul 26, 2024 02:27:32.039906979 CEST	192.168.2.7	62.118.135.167	9b0	Echo
Jul 26, 2024 02:27:32.071244001 CEST	192.168.2.7	62.118.109.111	9af	Echo
Jul 26, 2024 02:27:32.102422953 CEST	192.168.2.7	62.118.126.135	9ae	Echo
Jul 26, 2024 02:27:32.133671045 CEST	192.168.2.7	62.118.105.206	9ad	Echo
Jul 26, 2024 02:27:32.165013075 CEST	192.168.2.7	62.118.248.59	9ac	Echo
Jul 26, 2024 02:27:32.196130991 CEST	192.168.2.7	62.118.5.47	9ab	Echo
Jul 26, 2024 02:27:32.227607965 CEST	192.168.2.7	62.118.39.161	9aa	Echo
Jul 26, 2024 02:27:32.259027958 CEST	192.168.2.7	62.118.13.39	9a9	Echo
Jul 26, 2024 02:27:32.290296078 CEST	192.168.2.7	62.118.156.61	9a8	Echo
Jul 26, 2024 02:27:32.321187973 CEST	192.168.2.7	62.118.25.156	9a7	Echo
Jul 26, 2024 02:27:32.352431059 CEST	192.168.2.7	62.118.145.25	9a6	Echo
Jul 26, 2024 02:27:32.384107113 CEST	192.168.2.7	62.118.5.38	9a5	Echo
Jul 26, 2024 02:27:32.414979935 CEST	192.168.2.7	62.118.58.152	9a4	Echo
Jul 26, 2024 02:27:32.446382046 CEST	192.168.2.7	62.118.133.119	9a3	Echo
Jul 26, 2024 02:27:32.480511904 CEST	192.168.2.7	62.118.93.86	9a2	Echo
Jul 26, 2024 02:27:32.526676893 CEST	192.168.2.7	62.118.211.92	9a1	Echo
Jul 26, 2024 02:27:32.529527903 CEST	192.168.2.7	62.118.87.137	9a0	Echo
Jul 26, 2024 02:27:32.529717922 CEST	192.168.2.7	62.118.174.195	99f	Echo
Jul 26, 2024 02:27:32.529848099 CEST	192.168.2.7	62.118.95.240	99e	Echo
Jul 26, 2024 02:27:32.529983044 CEST	192.168.2.7	62.118.0.152	99d	Echo
Jul 26, 2024 02:27:32.530107021 CEST	192.168.2.7	62.118.6.185	99c	Echo
Jul 26, 2024 02:27:32.530260086 CEST	192.168.2.7	62.118.38.231	99b	Echo
Jul 26, 2024 02:27:32.530380011 CEST	192.168.2.7	62.118.157.226	99a	Echo
Jul 26, 2024 02:27:32.530515909 CEST	192.168.2.7	62.118.75.159	999	Echo
Jul 26, 2024 02:27:32.530625105 CEST	192.168.2.7	62.118.26.84	998	Echo
Jul 26, 2024 02:27:32.530745983 CEST	192.168.2.7	62.118.98.236	997	Echo
Jul 26, 2024 02:27:32.530860901 CEST	192.168.2.7	62.118.3.151	996	Echo
Jul 26, 2024 02:27:32.530992985 CEST	192.168.2.7	62.118.23.219	995	Echo
Jul 26, 2024 02:27:32.531115055 CEST	192.168.2.7	62.118.119.176	994	Echo
Jul 26, 2024 02:27:32.531246901 CEST	192.168.2.7	62.118.177.119	993	Echo
Jul 26, 2024 02:27:32.531368971 CEST	192.168.2.7	62.118.50.177	992	Echo
Jul 26, 2024 02:27:32.531492949 CEST	192.168.2.7	62.118.26.50	991	Echo
Jul 26, 2024 02:27:32.539912939 CEST	192.168.2.7	62.118.31.78	990	Echo
Jul 26, 2024 02:27:32.581953049 CEST	192.168.2.7	62.118.1.108	98f	Echo
Jul 26, 2024 02:27:32.602873087 CEST	192.168.2.7	62.118.75.154	98e	Echo
Jul 26, 2024 02:27:32.633840084 CEST	192.168.2.7	62.118.241.142	98d	Echo
Jul 26, 2024 02:27:32.665534019 CEST	192.168.2.7	62.118.150.219	98c	Echo
Jul 26, 2024 02:27:32.696177006 CEST	192.168.2.7	62.118.222.15	98b	Echo
Jul 26, 2024 02:27:32.727344990 CEST	192.168.2.7	62.118.135.160	98a	Echo
Jul 26, 2024 02:27:32.758641958 CEST	192.168.2.7	62.118.18.74	989	Echo
Jul 26, 2024 02:27:32.790018082 CEST	192.168.2.7	62.118.236.218	988	Echo
Jul 26, 2024 02:27:32.821295023 CEST	192.168.2.7	62.118.81.114	987	Echo
Jul 26, 2024 02:27:32.852546930 CEST	192.168.2.7	62.118.77.48	986	Echo
Jul 26, 2024 02:27:32.884011030 CEST	192.168.2.7	62.118.155.133	985	Echo
Jul 26, 2024 02:27:32.915014029 CEST	192.168.2.7	62.118.98.42	984	Echo
Jul 26, 2024 02:27:32.959167004 CEST	192.168.2.7	62.118.39.31	983	Echo
Jul 26, 2024 02:27:32.993809938 CEST	192.168.2.7	62.118.177.203	982	Echo
Jul 26, 2024 02:27:32.995095968 CEST	192.168.2.7	62.118.120.107	981	Echo
Jul 26, 2024 02:27:32.995193005 CEST	192.168.2.7	62.118.110.242	980	Echo
Jul 26, 2024 02:27:32.995273113 CEST	192.168.2.7	62.118.41.182	97f	Echo
Jul 26, 2024 02:27:32.995361090 CEST	192.168.2.7	62.118.78.0	97e	Echo
Jul 26, 2024 02:27:32.995444059 CEST	192.168.2.7	62.118.224.234	97d	Echo
Jul 26, 2024 02:27:32.995599031 CEST	192.168.2.7	62.118.35.76	97b	Echo
Jul 26, 2024 02:27:32.995759010 CEST	192.168.2.7	62.118.17.191	979	Echo
Jul 26, 2024 02:27:32.995846033 CEST	192.168.2.7	62.118.216.192	978	Echo
Jul 26, 2024 02:27:32.995884895 CEST	192.168.2.7	62.118.138.41	97c	Echo
Jul 26, 2024 02:27:32.995884895 CEST	192.168.2.7	62.118.150.171	97a	Echo
Jul 26, 2024 02:27:32.995923042 CEST	192.168.2.7	62.118.25.98	977	Echo
Jul 26, 2024 02:27:32.996092081 CEST	192.168.2.7	62.118.102.58	975	Echo
Jul 26, 2024 02:27:32.996176958 CEST	192.168.2.7	62.118.123.57	974	Echo
Jul 26, 2024 02:27:32.996248960 CEST	192.168.2.7	62.118.9.124	973	Echo
Jul 26, 2024 02:27:32.996339083 CEST	192.168.2.7	62.118.227.234	972	Echo
Jul 26, 2024 02:27:32.996470928 CEST	192.168.2.7	62.118.250.122	976	Echo
Jul 26, 2024 02:27:33.024290085 CEST	192.168.2.7	62.118.142.251	971	Echo
Jul 26, 2024 02:27:33.056391001 CEST	192.168.2.7	62.118.68.130	970	Echo
Jul 26, 2024 02:27:33.088911057 CEST	192.168.2.7	62.118.155.74	96f	Echo
Jul 26, 2024 02:27:33.118087053 CEST	192.168.2.7	62.118.2.8	96e	Echo
Jul 26, 2024 02:27:33.149280071 CEST	192.168.2.7	62.118.48.190	96d	Echo
Jul 26, 2024 02:27:33.180433035 CEST	192.168.2.7	62.118.17.209	96c	Echo
Jul 26, 2024 02:27:33.211920023 CEST	192.168.2.7	62.118.131.88	96b	Echo
Jul 26, 2024 02:27:33.243021011 CEST	192.168.2.7	62.118.247.1	96a	Echo
Jul 26, 2024 02:27:33.274419069 CEST	192.168.2.7	62.118.223.139	969	Echo
Jul 26, 2024 02:27:33.305922031 CEST	192.168.2.7	62.118.28.178	968	Echo
Jul 26, 2024 02:27:33.336700916 CEST	192.168.2.7	62.118.42.71	967	Echo
Jul 26, 2024 02:27:33.368117094 CEST	192.168.2.7	62.118.155.55	966	Echo
Jul 26, 2024 02:27:33.399337053 CEST	192.168.2.7	62.118.51.189	965	Echo
Jul 26, 2024 02:27:33.430695057 CEST	192.168.2.7	62.118.7.189	964	Echo
Jul 26, 2024 02:27:33.461833954 CEST	192.168.2.7	62.118.124.140	963	Echo
Jul 26, 2024 02:27:33.494746923 CEST	192.168.2.7	62.118.25.28	962	Echo
Jul 26, 2024 02:27:33.494780064 CEST	192.168.2.7	62.118.100.90	961	Echo
Jul 26, 2024 02:27:33.494925022 CEST	192.168.2.7	62.118.197.61	960	Echo
Jul 26, 2024 02:27:33.494995117 CEST	192.168.2.7	62.118.100.3	95f	Echo
Jul 26, 2024 02:27:33.495107889 CEST	192.168.2.7	62.118.31.200	95e	Echo
Jul 26, 2024 02:27:33.495270967 CEST	192.168.2.7	62.118.22.192	95c	Echo
Jul 26, 2024 02:27:33.495279074 CEST	192.168.2.7	62.118.87.184	95d	Echo
Jul 26, 2024 02:27:33.495321035 CEST	192.168.2.7	62.118.91.181	95b	Echo
Jul 26, 2024 02:27:33.495383024 CEST	192.168.2.7	62.118.16.62	95a	Echo
Jul 26, 2024 02:27:33.495438099 CEST	192.168.2.7	62.118.66.200	959	Echo
Jul 26, 2024 02:27:33.495532036 CEST	192.168.2.7	62.118.32.50	958	Echo
Jul 26, 2024 02:27:33.495624065 CEST	192.168.2.7	62.118.185.218	957	Echo
Jul 26, 2024 02:27:33.495718002 CEST	192.168.2.7	62.118.80.34	956	Echo
Jul 26, 2024 02:27:33.495752096 CEST	192.168.2.7	62.118.98.229	955	Echo
Jul 26, 2024 02:27:33.495822906 CEST	192.168.2.7	62.118.167.3	954	Echo
Jul 26, 2024 02:27:33.495876074 CEST	192.168.2.7	62.118.98.147	953	Echo
Jul 26, 2024 02:27:33.508898020 CEST	192.168.2.7	62.118.13.173	952	Echo
Jul 26, 2024 02:27:33.540469885 CEST	192.168.2.7	62.118.95.119	951	Echo
Jul 26, 2024 02:27:33.571122885 CEST	192.168.2.7	62.118.163.95	950	Echo
Jul 26, 2024 02:27:33.602386951 CEST	192.168.2.7	62.118.48.230	94f	Echo
Jul 26, 2024 02:27:33.626023054 CEST	192.168.2.7	62.118.95.119	94e	Echo
Jul 26, 2024 02:27:33.634043932 CEST	192.168.2.7	62.118.222.210	94d	Echo
Jul 26, 2024 02:27:33.665030956 CEST	192.168.2.7	62.118.20.236	94c	Echo
Jul 26, 2024 02:27:33.696208000 CEST	192.168.2.7	62.118.52.218	94b	Echo
Jul 26, 2024 02:27:33.727392912 CEST	192.168.2.7	62.118.10.19	94a	Echo
Jul 26, 2024 02:27:33.758722067 CEST	192.168.2.7	62.118.127.112	949	Echo
Jul 26, 2024 02:27:33.789947033 CEST	192.168.2.7	62.118.216.48	948	Echo
Jul 26, 2024 02:27:33.821191072 CEST	192.168.2.7	62.118.220.8	947	Echo
Jul 26, 2024 02:27:33.852386951 CEST	192.168.2.7	62.118.42.214	946	Echo
Jul 26, 2024 02:27:33.883644104 CEST	192.168.2.7	62.118.94.43	945	Echo
Jul 26, 2024 02:27:33.914948940 CEST	192.168.2.7	62.118.30.94	944	Echo
Jul 26, 2024 02:27:33.946415901 CEST	192.168.2.7	62.118.27.30	943	Echo
Jul 26, 2024 02:27:33.977849960 CEST	192.168.2.7	62.118.26.27	942	Echo
Jul 26, 2024 02:27:33.994982958 CEST	192.168.2.7	62.118.21.220	941	Echo
Jul 26, 2024 02:27:33.995249987 CEST	192.168.2.7	62.118.109.111	93f	Echo
Jul 26, 2024 02:27:33.995279074 CEST	192.168.2.7	62.118.135.167	940	Echo
Jul 26, 2024 02:27:33.995326042 CEST	192.168.2.7	62.118.126.135	93e	Echo
Jul 26, 2024 02:27:33.995418072 CEST	192.168.2.7	62.118.105.206	93d	Echo
Jul 26, 2024 02:27:33.995512009 CEST	192.168.2.7	62.118.248.59	93c	Echo
Jul 26, 2024 02:27:33.995629072 CEST	192.168.2.7	62.118.5.47	93b	Echo
Jul 26, 2024 02:27:33.995738029 CEST	192.168.2.7	62.118.39.161	93a	Echo
Jul 26, 2024 02:27:33.995836020 CEST	192.168.2.7	62.118.13.39	939	Echo
Jul 26, 2024 02:27:33.995904922 CEST	192.168.2.7	62.118.156.61	938	Echo
Jul 26, 2024 02:27:33.996058941 CEST	192.168.2.7	62.118.25.156	937	Echo
Jul 26, 2024 02:27:33.996133089 CEST	192.168.2.7	62.118.145.25	936	Echo
Jul 26, 2024 02:27:33.996315002 CEST	192.168.2.7	62.118.58.152	934	Echo
Jul 26, 2024 02:27:33.996320963 CEST	192.168.2.7	62.118.5.38	935	Echo
Jul 26, 2024 02:27:33.996457100 CEST	192.168.2.7	62.118.133.119	933	Echo
Jul 26, 2024 02:27:33.996510983 CEST	192.168.2.7	62.118.93.86	932	Echo
Jul 26, 2024 02:27:34.008723021 CEST	192.168.2.7	62.118.125.148	931	Echo
Jul 26, 2024 02:27:34.039974928 CEST	192.168.2.7	62.118.32.5	930	Echo
Jul 26, 2024 02:27:34.071115017 CEST	192.168.2.7	62.118.58.225	92f	Echo
Jul 26, 2024 02:27:34.102534056 CEST	192.168.2.7	62.118.51.132	92e	Echo
Jul 26, 2024 02:27:34.133691072 CEST	192.168.2.7	62.118.197.17	92d	Echo
Jul 26, 2024 02:27:34.165004015 CEST	192.168.2.7	62.118.27.201	92c	Echo
Jul 26, 2024 02:27:34.196140051 CEST	192.168.2.7	62.118.172.157	92b	Echo
Jul 26, 2024 02:27:34.227379084 CEST	192.168.2.7	62.118.222.57	92a	Echo
Jul 26, 2024 02:27:34.258791924 CEST	192.168.2.7	62.118.87.192	929	Echo
Jul 26, 2024 02:27:34.291553974 CEST	192.168.2.7	62.118.188.251	928	Echo
Jul 26, 2024 02:27:34.321331024 CEST	192.168.2.7	62.118.65.150	927	Echo
Jul 26, 2024 02:27:34.352617025 CEST	192.168.2.7	62.118.150.40	926	Echo
Jul 26, 2024 02:27:34.383774042 CEST	192.168.2.7	62.118.24.140	925	Echo
Jul 26, 2024 02:27:34.392771006 CEST	62.118.150.40	192.168.2.7	1126	Echo Reply
Jul 26, 2024 02:27:34.393433094 CEST	192.168.2.7	62.118.150.40	924	Echo
Jul 26, 2024 02:27:34.414911985 CEST	192.168.2.7	62.118.157.252	923	Echo
Jul 26, 2024 02:27:34.434806108 CEST	62.118.150.40	192.168.2.7	1124	Echo Reply
Jul 26, 2024 02:27:34.446238041 CEST	192.168.2.7	62.118.76.116	922	Echo
Jul 26, 2024 02:27:34.477454901 CEST	192.168.2.7	62.118.186.155	921	Echo
Jul 26, 2024 02:27:34.493208885 CEST	192.168.2.7	62.118.211.92	920	Echo
Jul 26, 2024 02:27:34.494899035 CEST	192.168.2.7	62.118.31.78	91f	Echo
Jul 26, 2024 02:27:34.495023012 CEST	192.168.2.7	62.118.1.108	91e	Echo
Jul 26, 2024 02:27:34.495114088 CEST	192.168.2.7	62.118.75.154	91d	Echo
Jul 26, 2024 02:27:34.495127916 CEST	192.168.2.7	62.118.241.142	91c	Echo
Jul 26, 2024 02:27:34.495223999 CEST	192.168.2.7	62.118.150.219	91b	Echo
Jul 26, 2024 02:27:34.495265961 CEST	192.168.2.7	62.118.222.15	91a	Echo
Jul 26, 2024 02:27:34.495336056 CEST	192.168.2.7	62.118.135.160	919	Echo
Jul 26, 2024 02:27:34.495400906 CEST	192.168.2.7	62.118.18.74	918	Echo
Jul 26, 2024 02:27:34.495498896 CEST	192.168.2.7	62.118.236.218	917	Echo
Jul 26, 2024 02:27:34.495709896 CEST	192.168.2.7	62.118.77.48	915	Echo
Jul 26, 2024 02:27:34.495762110 CEST	192.168.2.7	62.118.155.133	914	Echo
Jul 26, 2024 02:27:34.495826006 CEST	192.168.2.7	62.118.81.114	916	Echo
Jul 26, 2024 02:27:34.495826960 CEST	192.168.2.7	62.118.98.42	913	Echo
Jul 26, 2024 02:27:34.495903015 CEST	192.168.2.7	62.118.39.31	912	Echo
Jul 26, 2024 02:27:34.508606911 CEST	192.168.2.7	62.118.188.35	911	Echo
Jul 26, 2024 02:27:34.540265083 CEST	192.168.2.7	62.118.160.99	910	Echo
Jul 26, 2024 02:27:34.571191072 CEST	192.168.2.7	62.118.18.138	90f	Echo
Jul 26, 2024 02:27:34.602601051 CEST	192.168.2.7	62.118.234.251	90e	Echo
Jul 26, 2024 02:27:34.633960962 CEST	192.168.2.7	62.118.190.101	90d	Echo
Jul 26, 2024 02:27:34.664973021 CEST	192.168.2.7	62.118.86.170	90c	Echo
Jul 26, 2024 02:27:34.696229935 CEST	192.168.2.7	62.118.167.164	90b	Echo
Jul 26, 2024 02:27:34.727478981 CEST	192.168.2.7	62.118.115.35	90a	Echo
Jul 26, 2024 02:27:34.758892059 CEST	192.168.2.7	62.118.213.34	909	Echo
Jul 26, 2024 02:27:34.790113926 CEST	192.168.2.7	62.118.7.14	908	Echo
Jul 26, 2024 02:27:34.821923018 CEST	192.168.2.7	62.118.17.147	907	Echo
Jul 26, 2024 02:27:34.853928089 CEST	192.168.2.7	62.118.73.189	906	Echo
Jul 26, 2024 02:27:34.885055065 CEST	192.168.2.7	62.118.28.109	905	Echo
Jul 26, 2024 02:27:34.915137053 CEST	192.168.2.7	62.118.188.5	904	Echo
Jul 26, 2024 02:27:34.946502924 CEST	192.168.2.7	62.118.251.84	903	Echo
Jul 26, 2024 02:27:34.977686882 CEST	192.168.2.7	62.118.234.140	902	Echo
Jul 26, 2024 02:27:34.993598938 CEST	192.168.2.7	62.118.177.203	901	Echo
Jul 26, 2024 02:27:34.994880915 CEST	192.168.2.7	62.118.142.251	900	Echo
Jul 26, 2024 02:27:34.995172024 CEST	192.168.2.7	62.118.68.130	8ff	Echo
Jul 26, 2024 02:27:34.995172024 CEST	192.168.2.7	62.118.155.74	8fe	Echo
Jul 26, 2024 02:27:34.995769024 CEST	192.168.2.7	62.118.2.8	8fd	Echo
Jul 26, 2024 02:27:34.995975018 CEST	192.168.2.7	62.118.48.190	8fc	Echo
Jul 26, 2024 02:27:35.002751112 CEST	192.168.2.7	62.118.17.209	8fb	Echo
Jul 26, 2024 02:27:35.003071070 CEST	192.168.2.7	62.118.247.1	8f9	Echo
Jul 26, 2024 02:27:35.003328085 CEST	192.168.2.7	62.118.223.139	8f8	Echo
Jul 26, 2024 02:27:35.003431082 CEST	192.168.2.7	62.118.28.178	8f7	Echo
Jul 26, 2024 02:27:35.003587961 CEST	192.168.2.7	62.118.155.55	8f5	Echo
Jul 26, 2024 02:27:35.003612995 CEST	192.168.2.7	62.118.42.71	8f6	Echo
Jul 26, 2024 02:27:35.003720999 CEST	192.168.2.7	62.118.51.189	8f4	Echo
Jul 26, 2024 02:27:35.003829956 CEST	192.168.2.7	62.118.7.189	8f3	Echo
Jul 26, 2024 02:27:35.003889084 CEST	192.168.2.7	62.118.124.140	8f2	Echo
Jul 26, 2024 02:27:35.004228115 CEST	192.168.2.7	62.118.131.88	8fa	Echo
Jul 26, 2024 02:27:35.008622885 CEST	192.168.2.7	62.118.92.120	8f1	Echo
Jul 26, 2024 02:27:35.039969921 CEST	192.168.2.7	62.118.188.242	8f0	Echo
Jul 26, 2024 02:27:35.071203947 CEST	192.168.2.7	62.118.19.188	8ef	Echo
Jul 26, 2024 02:27:35.102484941 CEST	192.168.2.7	62.118.54.171	8ee	Echo
Jul 26, 2024 02:27:35.133733034 CEST	192.168.2.7	62.118.73.222	8ed	Echo
Jul 26, 2024 02:27:35.164969921 CEST	192.168.2.7	62.118.31.146	8ec	Echo
Jul 26, 2024 02:27:35.196154118 CEST	192.168.2.7	62.118.7.215	8eb	Echo
Jul 26, 2024 02:27:35.227353096 CEST	192.168.2.7	62.118.108.211	8ea	Echo
Jul 26, 2024 02:27:35.258630991 CEST	192.168.2.7	62.118.28.104	8e9	Echo
Jul 26, 2024 02:27:35.290180922 CEST	192.168.2.7	62.118.31.96	8e8	Echo
Jul 26, 2024 02:27:35.325453043 CEST	192.168.2.7	62.118.103.110	8e7	Echo
Jul 26, 2024 02:27:35.352490902 CEST	192.168.2.7	62.118.225.103	8e6	Echo
Jul 26, 2024 02:27:35.383811951 CEST	192.168.2.7	62.118.196.224	8e5	Echo
Jul 26, 2024 02:27:35.414889097 CEST	192.168.2.7	62.118.162.89	8e4	Echo
Jul 26, 2024 02:27:35.446096897 CEST	192.168.2.7	62.118.133.173	8e3	Echo
Jul 26, 2024 02:27:35.477678061 CEST	192.168.2.7	62.118.100.193	8e2	Echo
Jul 26, 2024 02:27:35.497004986 CEST	192.168.2.7	62.118.13.173	8e1	Echo
Jul 26, 2024 02:27:35.497303009 CEST	192.168.2.7	62.118.163.95	8e0	Echo
Jul 26, 2024 02:27:35.497423887 CEST	192.168.2.7	62.118.48.230	8df	Echo
Jul 26, 2024 02:27:35.497515917 CEST	192.168.2.7	62.118.222.210	8de	Echo
Jul 26, 2024 02:27:35.497920036 CEST	192.168.2.7	62.118.20.236	8dd	Echo
Jul 26, 2024 02:27:35.498480082 CEST	192.168.2.7	62.118.52.218	8dc	Echo
Jul 26, 2024 02:27:35.498585939 CEST	192.168.2.7	62.118.10.19	8db	Echo
Jul 26, 2024 02:27:35.498905897 CEST	192.168.2.7	62.118.127.112	8da	Echo
Jul 26, 2024 02:27:35.499214888 CEST	192.168.2.7	62.118.220.8	8d8	Echo
Jul 26, 2024 02:27:35.499300003 CEST	192.168.2.7	62.118.42.214	8d7	Echo
Jul 26, 2024 02:27:35.499363899 CEST	192.168.2.7	62.118.94.43	8d6	Echo
Jul 26, 2024 02:27:35.499488115 CEST	192.168.2.7	62.118.216.48	8d9	Echo
Jul 26, 2024 02:27:35.499655008 CEST	192.168.2.7	62.118.30.94	8d5	Echo
Jul 26, 2024 02:27:35.499727964 CEST	192.168.2.7	62.118.27.30	8d4	Echo
Jul 26, 2024 02:27:35.499828100 CEST	192.168.2.7	62.118.26.27	8d3	Echo
Jul 26, 2024 02:27:35.508749962 CEST	192.168.2.7	62.118.18.28	8d2	Echo
Jul 26, 2024 02:27:35.540280104 CEST	192.168.2.7	62.118.213.189	8d1	Echo
Jul 26, 2024 02:27:35.571614981 CEST	192.168.2.7	62.118.39.241	8d0	Echo
Jul 26, 2024 02:27:35.602468014 CEST	192.168.2.7	62.118.51.81	8cf	Echo
Jul 26, 2024 02:27:35.633867025 CEST	192.168.2.7	62.118.120.131	8ce	Echo
Jul 26, 2024 02:27:35.665035963 CEST	192.168.2.7	62.118.48.73	8cd	Echo
Jul 26, 2024 02:27:35.696278095 CEST	192.168.2.7	62.118.60.76	8cc	Echo
Jul 26, 2024 02:27:35.727590084 CEST	192.168.2.7	62.118.152.219	8cb	Echo
Jul 26, 2024 02:27:35.758760929 CEST	192.168.2.7	62.118.9.253	8ca	Echo
Jul 26, 2024 02:27:35.790087938 CEST	192.168.2.7	62.118.59.183	8c9	Echo
Jul 26, 2024 02:27:35.821235895 CEST	192.168.2.7	62.118.17.118	8c8	Echo
Jul 26, 2024 02:27:35.852408886 CEST	192.168.2.7	62.118.236.19	8c7	Echo
Jul 26, 2024 02:27:35.883996010 CEST	192.168.2.7	62.118.163.86	8c6	Echo
Jul 26, 2024 02:27:35.914948940 CEST	192.168.2.7	62.118.23.141	8c5	Echo
Jul 26, 2024 02:27:35.946434021 CEST	192.168.2.7	62.118.197.169	8c4	Echo
Jul 26, 2024 02:27:35.977447987 CEST	192.168.2.7	62.118.57.198	8c3	Echo
Jul 26, 2024 02:27:35.994884968 CEST	192.168.2.7	62.118.125.148	8c2	Echo
Jul 26, 2024 02:27:35.994980097 CEST	192.168.2.7	62.118.32.5	8c1	Echo
Jul 26, 2024 02:27:35.995070934 CEST	192.168.2.7	62.118.58.225	8c0	Echo
Jul 26, 2024 02:27:35.995152950 CEST	192.168.2.7	62.118.51.132	8bf	Echo
Jul 26, 2024 02:27:35.995251894 CEST	192.168.2.7	62.118.197.17	8be	Echo
Jul 26, 2024 02:27:35.995322943 CEST	192.168.2.7	62.118.27.201	8bd	Echo
Jul 26, 2024 02:27:35.995404005 CEST	192.168.2.7	62.118.172.157	8bc	Echo
Jul 26, 2024 02:27:35.995579004 CEST	192.168.2.7	62.118.222.57	8bb	Echo
Jul 26, 2024 02:27:35.995826960 CEST	192.168.2.7	62.118.87.192	8ba	Echo
Jul 26, 2024 02:27:35.995965004 CEST	192.168.2.7	62.118.65.150	8b8	Echo
Jul 26, 2024 02:27:35.996087074 CEST	192.168.2.7	62.118.24.140	8b7	Echo
Jul 26, 2024 02:27:35.996088028 CEST	192.168.2.7	62.118.188.251	8b9	Echo
Jul 26, 2024 02:27:35.996128082 CEST	192.168.2.7	62.118.157.252	8b6	Echo
Jul 26, 2024 02:27:35.996242046 CEST	192.168.2.7	62.118.76.116	8b5	Echo
Jul 26, 2024 02:27:35.996272087 CEST	192.168.2.7	62.118.186.155	8b4	Echo
Jul 26, 2024 02:27:36.008538008 CEST	192.168.2.7	62.118.112.194	8b3	Echo
Jul 26, 2024 02:27:36.050903082 CEST	192.168.2.7	62.118.14.172	8b2	Echo
Jul 26, 2024 02:27:36.071404934 CEST	192.168.2.7	62.118.178.78	8b1	Echo
Jul 26, 2024 02:27:36.102427959 CEST	192.168.2.7	62.118.51.3	8b0	Echo
Jul 26, 2024 02:27:36.133656979 CEST	192.168.2.7	62.118.180.119	8af	Echo
Jul 26, 2024 02:27:36.165064096 CEST	192.168.2.7	62.118.153.48	8ae	Echo
Jul 26, 2024 02:27:36.196394920 CEST	192.168.2.7	62.118.247.69	8ad	Echo
Jul 26, 2024 02:27:36.227448940 CEST	192.168.2.7	62.118.92.197	8ac	Echo
Jul 26, 2024 02:27:36.258555889 CEST	192.168.2.7	62.118.126.71	8ab	Echo
Jul 26, 2024 02:27:36.290096998 CEST	192.168.2.7	62.118.250.143	8aa	Echo
Jul 26, 2024 02:27:36.321177959 CEST	192.168.2.7	62.118.70.244	8a9	Echo
Jul 26, 2024 02:27:36.352549076 CEST	192.168.2.7	62.118.70.119	8a8	Echo
Jul 26, 2024 02:27:36.383574963 CEST	192.168.2.7	62.118.21.45	8a7	Echo
Jul 26, 2024 02:27:36.414959908 CEST	192.168.2.7	62.118.98.192	8a6	Echo
Jul 26, 2024 02:27:36.446115971 CEST	192.168.2.7	62.118.102.204	8a5	Echo
Jul 26, 2024 02:27:36.477406025 CEST	192.168.2.7	62.118.160.253	8a4	Echo
Jul 26, 2024 02:27:36.494626045 CEST	192.168.2.7	62.118.188.35	8a3	Echo
Jul 26, 2024 02:27:36.494666100 CEST	192.168.2.7	62.118.160.99	8a2	Echo
Jul 26, 2024 02:27:36.494848013 CEST	192.168.2.7	62.118.18.138	8a1	Echo
Jul 26, 2024 02:27:36.494995117 CEST	192.168.2.7	62.118.234.251	8a0	Echo
Jul 26, 2024 02:27:36.495074987 CEST	192.168.2.7	62.118.190.101	89f	Echo
Jul 26, 2024 02:27:36.495140076 CEST	192.168.2.7	62.118.86.170	89e	Echo
Jul 26, 2024 02:27:36.495199919 CEST	192.168.2.7	62.118.167.164	89d	Echo
Jul 26, 2024 02:27:36.495290995 CEST	192.168.2.7	62.118.115.35	89c	Echo
Jul 26, 2024 02:27:36.495410919 CEST	192.168.2.7	62.118.213.34	89b	Echo
Jul 26, 2024 02:27:36.495518923 CEST	192.168.2.7	62.118.7.14	89a	Echo
Jul 26, 2024 02:27:36.495606899 CEST	192.168.2.7	62.118.17.147	899	Echo
Jul 26, 2024 02:27:36.495668888 CEST	192.168.2.7	62.118.73.189	898	Echo
Jul 26, 2024 02:27:36.495714903 CEST	192.168.2.7	62.118.28.109	897	Echo
Jul 26, 2024 02:27:36.495762110 CEST	192.168.2.7	62.118.188.5	896	Echo
Jul 26, 2024 02:27:36.495811939 CEST	192.168.2.7	62.118.251.84	895	Echo
Jul 26, 2024 02:27:36.495934010 CEST	192.168.2.7	62.118.234.140	894	Echo
Jul 26, 2024 02:27:36.508701086 CEST	192.168.2.7	62.118.135.209	893	Echo
Jul 26, 2024 02:27:36.539921999 CEST	192.168.2.7	62.118.37.211	892	Echo
Jul 26, 2024 02:27:36.548140049 CEST	192.168.2.7	62.118.135.209	891	Echo
Jul 26, 2024 02:27:36.571372986 CEST	192.168.2.7	62.118.36.73	890	Echo
Jul 26, 2024 02:27:36.602510929 CEST	192.168.2.7	62.118.28.116	88f	Echo
Jul 26, 2024 02:27:36.633738995 CEST	192.168.2.7	62.118.70.137	88e	Echo
Jul 26, 2024 02:27:36.664980888 CEST	192.168.2.7	62.118.14.240	88d	Echo
Jul 26, 2024 02:27:36.696703911 CEST	192.168.2.7	62.118.110.67	88c	Echo
Jul 26, 2024 02:27:36.728949070 CEST	192.168.2.7	62.118.91.173	88b	Echo
Jul 26, 2024 02:27:36.758610964 CEST	192.168.2.7	62.118.148.91	88a	Echo
Jul 26, 2024 02:27:36.789892912 CEST	192.168.2.7	62.118.161.148	889	Echo
Jul 26, 2024 02:27:36.821351051 CEST	192.168.2.7	62.118.4.125	888	Echo
Jul 26, 2024 02:27:36.852375984 CEST	192.168.2.7	62.118.16.77	887	Echo
Jul 26, 2024 02:27:36.890163898 CEST	192.168.2.7	62.118.51.4	886	Echo
Jul 26, 2024 02:27:36.916512966 CEST	192.168.2.7	62.118.166.183	885	Echo
Jul 26, 2024 02:27:36.946788073 CEST	192.168.2.7	62.118.0.211	884	Echo
Jul 26, 2024 02:27:36.979918003 CEST	192.168.2.7	62.118.174.128	883	Echo
Jul 26, 2024 02:27:36.995318890 CEST	192.168.2.7	62.118.92.120	882	Echo
Jul 26, 2024 02:27:36.995363951 CEST	192.168.2.7	62.118.188.242	881	Echo
Jul 26, 2024 02:27:36.995472908 CEST	192.168.2.7	62.118.19.188	880	Echo
Jul 26, 2024 02:27:36.995517015 CEST	192.168.2.7	62.118.54.171	87f	Echo
Jul 26, 2024 02:27:36.995603085 CEST	192.168.2.7	62.118.73.222	87e	Echo
Jul 26, 2024 02:27:36.995655060 CEST	192.168.2.7	62.118.31.146	87d	Echo
Jul 26, 2024 02:27:36.995713949 CEST	192.168.2.7	62.118.7.215	87c	Echo
Jul 26, 2024 02:27:36.995759964 CEST	192.168.2.7	62.118.108.211	87b	Echo
Jul 26, 2024 02:27:36.995827913 CEST	192.168.2.7	62.118.28.104	87a	Echo
Jul 26, 2024 02:27:36.995871067 CEST	192.168.2.7	62.118.31.96	879	Echo
Jul 26, 2024 02:27:36.995918989 CEST	192.168.2.7	62.118.103.110	878	Echo
Jul 26, 2024 02:27:36.995991945 CEST	192.168.2.7	62.118.225.103	877	Echo
Jul 26, 2024 02:27:36.996056080 CEST	192.168.2.7	62.118.196.224	876	Echo
Jul 26, 2024 02:27:36.996110916 CEST	192.168.2.7	62.118.162.89	875	Echo
Jul 26, 2024 02:27:36.996154070 CEST	192.168.2.7	62.118.133.173	874	Echo
Jul 26, 2024 02:27:36.996208906 CEST	192.168.2.7	62.118.100.193	873	Echo
Jul 26, 2024 02:27:37.008810043 CEST	192.168.2.7	62.118.62.1	872	Echo
Jul 26, 2024 02:27:37.040641069 CEST	192.168.2.7	62.118.3.75	871	Echo
Jul 26, 2024 02:27:37.071589947 CEST	192.168.2.7	62.118.65.25	870	Echo
Jul 26, 2024 02:27:37.102760077 CEST	192.168.2.7	62.118.105.64	86f	Echo
Jul 26, 2024 02:27:37.133799076 CEST	192.168.2.7	62.118.117.209	86e	Echo
Jul 26, 2024 02:27:37.165116072 CEST	192.168.2.7	62.118.44.211	86d	Echo
Jul 26, 2024 02:27:37.196469069 CEST	192.168.2.7	62.118.224.73	86c	Echo
Jul 26, 2024 02:27:37.227634907 CEST	192.168.2.7	62.118.10.50	86b	Echo
Jul 26, 2024 02:27:37.263945103 CEST	192.168.2.7	62.118.69.203	86a	Echo
Jul 26, 2024 02:27:37.290036917 CEST	192.168.2.7	62.118.26.119	869	Echo
Jul 26, 2024 02:27:37.322211981 CEST	192.168.2.7	62.118.179.224	868	Echo
Jul 26, 2024 02:27:37.356556892 CEST	192.168.2.7	62.118.221.157	867	Echo
Jul 26, 2024 02:27:37.398405075 CEST	192.168.2.7	62.118.166.182	866	Echo
Jul 26, 2024 02:27:37.452676058 CEST	192.168.2.7	62.118.121.135	865	Echo
Jul 26, 2024 02:27:37.477924109 CEST	192.168.2.7	62.118.136.167	864	Echo
Jul 26, 2024 02:27:37.509371042 CEST	192.168.2.7	62.118.20.45	863	Echo
Jul 26, 2024 02:27:37.516788960 CEST	192.168.2.7	62.118.18.28	862	Echo
Jul 26, 2024 02:27:37.517247915 CEST	192.168.2.7	62.118.39.241	860	Echo
Jul 26, 2024 02:27:37.517462969 CEST	192.168.2.7	62.118.51.81	85f	Echo
Jul 26, 2024 02:27:37.517739058 CEST	192.168.2.7	62.118.120.131	85e	Echo
Jul 26, 2024 02:27:37.517854929 CEST	192.168.2.7	62.118.213.189	861	Echo
Jul 26, 2024 02:27:37.518035889 CEST	192.168.2.7	62.118.48.73	85d	Echo
Jul 26, 2024 02:27:37.518166065 CEST	192.168.2.7	62.118.60.76	85c	Echo
Jul 26, 2024 02:27:37.518253088 CEST	192.168.2.7	62.118.152.219	85b	Echo
Jul 26, 2024 02:27:37.518445969 CEST	192.168.2.7	62.118.9.253	85a	Echo
Jul 26, 2024 02:27:37.518568039 CEST	192.168.2.7	62.118.59.183	859	Echo
Jul 26, 2024 02:27:37.518743992 CEST	192.168.2.7	62.118.236.19	857	Echo
Jul 26, 2024 02:27:37.518829107 CEST	192.168.2.7	62.118.163.86	856	Echo
Jul 26, 2024 02:27:37.518847942 CEST	192.168.2.7	62.118.17.118	858	Echo
Jul 26, 2024 02:27:37.518912077 CEST	192.168.2.7	62.118.23.141	855	Echo
Jul 26, 2024 02:27:37.518994093 CEST	192.168.2.7	62.118.197.169	854	Echo
Jul 26, 2024 02:27:37.519074917 CEST	192.168.2.7	62.118.57.198	853	Echo
Jul 26, 2024 02:27:37.520972013 CEST	62.118.136.167	192.168.2.7	1064	Echo Reply
Jul 26, 2024 02:27:37.521365881 CEST	192.168.2.7	62.118.136.167	852	Echo
Jul 26, 2024 02:27:37.540195942 CEST	192.168.2.7	62.118.177.3	851	Echo
Jul 26, 2024 02:27:37.561295986 CEST	62.118.136.167	192.168.2.7	1052	Echo Reply
Jul 26, 2024 02:27:37.574613094 CEST	192.168.2.7	62.118.19.225	850	Echo
Jul 26, 2024 02:27:37.626799107 CEST	192.168.2.7	62.118.139.243	84f	Echo
Jul 26, 2024 02:27:37.649808884 CEST	192.168.2.7	62.118.40.208	84e	Echo
Jul 26, 2024 02:27:37.680644989 CEST	192.168.2.7	62.118.137.130	84d	Echo
Jul 26, 2024 02:27:37.720786095 CEST	192.168.2.7	62.118.223.136	84c	Echo
Jul 26, 2024 02:27:37.746999025 CEST	192.168.2.7	62.118.24.62	84b	Echo
Jul 26, 2024 02:27:37.775115013 CEST	192.168.2.7	62.118.122.99	84a	Echo
Jul 26, 2024 02:27:37.805921078 CEST	192.168.2.7	62.118.25.214	849	Echo
Jul 26, 2024 02:27:37.837076902 CEST	192.168.2.7	62.118.133.229	848	Echo
Jul 26, 2024 02:27:37.868094921 CEST	192.168.2.7	62.118.240.61	847	Echo
Jul 26, 2024 02:27:37.899394989 CEST	192.168.2.7	62.118.92.250	846	Echo
Jul 26, 2024 02:27:37.930661917 CEST	192.168.2.7	62.118.165.238	845	Echo
Jul 26, 2024 02:27:37.962028980 CEST	192.168.2.7	62.118.181.128	844	Echo
Jul 26, 2024 02:27:37.993377924 CEST	192.168.2.7	62.118.194.122	843	Echo
Jul 26, 2024 02:27:37.994755030 CEST	192.168.2.7	62.118.112.194	842	Echo
Jul 26, 2024 02:27:37.994872093 CEST	192.168.2.7	62.118.14.172	841	Echo
Jul 26, 2024 02:27:37.994946003 CEST	192.168.2.7	62.118.178.78	840	Echo
Jul 26, 2024 02:27:37.995024920 CEST	192.168.2.7	62.118.51.3	83f	Echo
Jul 26, 2024 02:27:37.995188951 CEST	192.168.2.7	62.118.153.48	83d	Echo
Jul 26, 2024 02:27:37.995359898 CEST	192.168.2.7	62.118.92.197	83b	Echo
Jul 26, 2024 02:27:37.995388031 CEST	192.168.2.7	62.118.180.119	83e	Echo
Jul 26, 2024 02:27:37.995388031 CEST	192.168.2.7	62.118.247.69	83c	Echo
Jul 26, 2024 02:27:37.995435953 CEST	192.168.2.7	62.118.126.71	83a	Echo
Jul 26, 2024 02:27:37.995515108 CEST	192.168.2.7	62.118.250.143	839	Echo
Jul 26, 2024 02:27:37.995600939 CEST	192.168.2.7	62.118.70.244	838	Echo
Jul 26, 2024 02:27:37.995671034 CEST	192.168.2.7	62.118.70.119	837	Echo
Jul 26, 2024 02:27:37.995745897 CEST	192.168.2.7	62.118.21.45	836	Echo
Jul 26, 2024 02:27:37.995825052 CEST	192.168.2.7	62.118.98.192	835	Echo
Jul 26, 2024 02:27:37.995913982 CEST	192.168.2.7	62.118.102.204	834	Echo
Jul 26, 2024 02:27:37.995999098 CEST	192.168.2.7	62.118.160.253	833	Echo
Jul 26, 2024 02:27:38.024538040 CEST	192.168.2.7	62.118.19.178	832	Echo
Jul 26, 2024 02:27:38.058198929 CEST	192.168.2.7	62.118.89.19	831	Echo
Jul 26, 2024 02:27:38.087157965 CEST	192.168.2.7	62.118.68.60	830	Echo
Jul 26, 2024 02:27:38.118083000 CEST	192.168.2.7	62.118.197.252	82f	Echo
Jul 26, 2024 02:27:38.149359941 CEST	192.168.2.7	62.118.112.48	82e	Echo
Jul 26, 2024 02:27:38.180583000 CEST	192.168.2.7	62.118.128.185	82d	Echo
Jul 26, 2024 02:27:38.211848974 CEST	192.168.2.7	62.118.15.129	82c	Echo
Jul 26, 2024 02:27:38.243767977 CEST	192.168.2.7	62.118.230.109	82b	Echo
Jul 26, 2024 02:27:38.274401903 CEST	192.168.2.7	62.118.27.192	82a	Echo
Jul 26, 2024 02:27:38.305840969 CEST	192.168.2.7	62.118.97.4	829	Echo
Jul 26, 2024 02:27:38.336941957 CEST	192.168.2.7	62.118.228.200	828	Echo
Jul 26, 2024 02:27:38.368038893 CEST	192.168.2.7	62.118.158.27	827	Echo
Jul 26, 2024 02:27:38.400120974 CEST	192.168.2.7	62.118.46.89	826	Echo
Jul 26, 2024 02:27:38.430854082 CEST	192.168.2.7	62.118.119.194	825	Echo
Jul 26, 2024 02:27:38.461925983 CEST	192.168.2.7	62.118.123.54	824	Echo
Jul 26, 2024 02:27:38.493379116 CEST	192.168.2.7	62.118.20.83	823	Echo
Jul 26, 2024 02:27:38.495194912 CEST	192.168.2.7	62.118.37.211	822	Echo
Jul 26, 2024 02:27:38.495462894 CEST	192.168.2.7	62.118.36.73	821	Echo
Jul 26, 2024 02:27:38.495552063 CEST	192.168.2.7	62.118.28.116	820	Echo
Jul 26, 2024 02:27:38.495665073 CEST	192.168.2.7	62.118.70.137	81f	Echo
Jul 26, 2024 02:27:38.495795965 CEST	192.168.2.7	62.118.14.240	81e	Echo
Jul 26, 2024 02:27:38.495865107 CEST	192.168.2.7	62.118.110.67	81d	Echo
Jul 26, 2024 02:27:38.496011019 CEST	192.168.2.7	62.118.91.173	81c	Echo
Jul 26, 2024 02:27:38.496083975 CEST	192.168.2.7	62.118.148.91	81b	Echo
Jul 26, 2024 02:27:38.496170998 CEST	192.168.2.7	62.118.161.148	81a	Echo
Jul 26, 2024 02:27:38.496254921 CEST	192.168.2.7	62.118.4.125	819	Echo
Jul 26, 2024 02:27:38.496365070 CEST	192.168.2.7	62.118.16.77	818	Echo
Jul 26, 2024 02:27:38.496402025 CEST	192.168.2.7	62.118.51.4	817	Echo
Jul 26, 2024 02:27:38.496511936 CEST	192.168.2.7	62.118.166.183	816	Echo
Jul 26, 2024 02:27:38.496550083 CEST	192.168.2.7	62.118.0.211	815	Echo
Jul 26, 2024 02:27:38.496642113 CEST	192.168.2.7	62.118.174.128	814	Echo
Jul 26, 2024 02:27:38.524329901 CEST	192.168.2.7	62.118.71.240	813	Echo
Jul 26, 2024 02:27:38.555531979 CEST	192.168.2.7	62.118.80.71	812	Echo
Jul 26, 2024 02:27:38.587064981 CEST	192.168.2.7	62.118.184.219	811	Echo
Jul 26, 2024 02:27:38.618109941 CEST	192.168.2.7	62.118.29.60	810	Echo
Jul 26, 2024 02:27:38.649466038 CEST	192.168.2.7	62.118.242.210	80f	Echo
Jul 26, 2024 02:27:38.680691004 CEST	192.168.2.7	62.118.131.113	80e	Echo
Jul 26, 2024 02:27:38.712109089 CEST	192.168.2.7	62.118.103.217	80d	Echo
Jul 26, 2024 02:27:38.743032932 CEST	192.168.2.7	62.118.186.43	80c	Echo
Jul 26, 2024 02:27:38.774475098 CEST	192.168.2.7	62.118.80.214	80b	Echo
Jul 26, 2024 02:27:38.805844069 CEST	192.168.2.7	62.118.111.111	80a	Echo
Jul 26, 2024 02:27:38.836914062 CEST	192.168.2.7	62.118.212.2	809	Echo
Jul 26, 2024 02:27:38.868283987 CEST	192.168.2.7	62.118.11.212	808	Echo
Jul 26, 2024 02:27:38.899379015 CEST	192.168.2.7	62.118.217.11	807	Echo
Jul 26, 2024 02:27:38.930702925 CEST	192.168.2.7	62.118.187.216	806	Echo
Jul 26, 2024 02:27:38.961920023 CEST	192.168.2.7	62.118.23.231	805	Echo
Jul 26, 2024 02:27:38.993558884 CEST	192.168.2.7	62.118.237.44	804	Echo
Jul 26, 2024 02:27:38.994807959 CEST	192.168.2.7	62.118.62.1	803	Echo
Jul 26, 2024 02:27:38.994834900 CEST	192.168.2.7	62.118.3.75	802	Echo
Jul 26, 2024 02:27:38.994932890 CEST	192.168.2.7	62.118.65.25	801	Echo
Jul 26, 2024 02:27:38.994968891 CEST	192.168.2.7	62.118.105.64	800	Echo
Jul 26, 2024 02:27:38.995048046 CEST	192.168.2.7	62.118.117.209	7ff	Echo
Jul 26, 2024 02:27:38.995110035 CEST	192.168.2.7	62.118.44.211	7fe	Echo
Jul 26, 2024 02:27:38.995158911 CEST	192.168.2.7	62.118.224.73	7fd	Echo
Jul 26, 2024 02:27:38.995229006 CEST	192.168.2.7	62.118.10.50	7fc	Echo
Jul 26, 2024 02:27:38.995290041 CEST	192.168.2.7	62.118.69.203	7fb	Echo
Jul 26, 2024 02:27:38.995399952 CEST	192.168.2.7	62.118.179.224	7f9	Echo
Jul 26, 2024 02:27:38.995450020 CEST	192.168.2.7	62.118.221.157	7f8	Echo
Jul 26, 2024 02:27:38.995506048 CEST	192.168.2.7	62.118.166.182	7f7	Echo
Jul 26, 2024 02:27:38.995553017 CEST	192.168.2.7	62.118.121.135	7f6	Echo
Jul 26, 2024 02:27:38.997924089 CEST	192.168.2.7	62.118.26.119	7fa	Echo
Jul 26, 2024 02:27:39.024349928 CEST	192.168.2.7	62.118.237.9	7f5	Echo
Jul 26, 2024 02:27:39.055421114 CEST	192.168.2.7	62.118.179.27	7f4	Echo
Jul 26, 2024 02:27:39.086833000 CEST	192.168.2.7	62.118.40.211	7f3	Echo
Jul 26, 2024 02:27:39.128159046 CEST	192.168.2.7	62.118.69.192	7f2	Echo
Jul 26, 2024 02:27:39.149506092 CEST	192.168.2.7	62.118.44.54	7f1	Echo
Jul 26, 2024 02:27:39.180557966 CEST	192.168.2.7	62.118.8.230	7f0	Echo
Jul 26, 2024 02:27:39.211846113 CEST	192.168.2.7	62.118.212.185	7ef	Echo
Jul 26, 2024 02:27:39.243120909 CEST	192.168.2.7	62.118.25.94	7ee	Echo
Jul 26, 2024 02:27:39.274353027 CEST	192.168.2.7	62.118.55.34	7ed	Echo
Jul 26, 2024 02:27:39.305552959 CEST	192.168.2.7	62.118.89.209	7ec	Echo
Jul 26, 2024 02:27:39.336811066 CEST	192.168.2.7	62.118.116.89	7eb	Echo
Jul 26, 2024 02:27:39.367997885 CEST	192.168.2.7	62.118.182.116	7ea	Echo
Jul 26, 2024 02:27:39.399291992 CEST	192.168.2.7	62.118.55.42	7e9	Echo
Jul 26, 2024 02:27:39.431076050 CEST	192.168.2.7	62.118.242.98	7e8	Echo
Jul 26, 2024 02:27:39.462250948 CEST	192.168.2.7	62.118.1.81	7e7	Echo
Jul 26, 2024 02:27:39.493172884 CEST	192.168.2.7	62.118.20.45	7e6	Echo
Jul 26, 2024 02:27:39.493560076 CEST	192.168.2.7	62.118.187.99	7e5	Echo
Jul 26, 2024 02:27:39.495127916 CEST	192.168.2.7	62.118.177.3	7e4	Echo
Jul 26, 2024 02:27:39.495341063 CEST	192.168.2.7	62.118.139.243	7e2	Echo
Jul 26, 2024 02:27:39.495346069 CEST	192.168.2.7	62.118.19.225	7e3	Echo
Jul 26, 2024 02:27:39.495400906 CEST	192.168.2.7	62.118.40.208	7e1	Echo
Jul 26, 2024 02:27:39.495609999 CEST	192.168.2.7	62.118.137.130	7e0	Echo
Jul 26, 2024 02:27:39.495702982 CEST	192.168.2.7	62.118.223.136	7df	Echo
Jul 26, 2024 02:27:39.495735884 CEST	192.168.2.7	62.118.24.62	7de	Echo
Jul 26, 2024 02:27:39.495853901 CEST	192.168.2.7	62.118.122.99	7dd	Echo
Jul 26, 2024 02:27:39.495893002 CEST	192.168.2.7	62.118.25.214	7dc	Echo
Jul 26, 2024 02:27:39.496001005 CEST	192.168.2.7	62.118.133.229	7db	Echo
Jul 26, 2024 02:27:39.496206999 CEST	192.168.2.7	62.118.240.61	7da	Echo
Jul 26, 2024 02:27:39.496289015 CEST	192.168.2.7	62.118.92.250	7d9	Echo
Jul 26, 2024 02:27:39.496444941 CEST	192.168.2.7	62.118.165.238	7d8	Echo
Jul 26, 2024 02:27:39.496444941 CEST	192.168.2.7	62.118.181.128	7d7	Echo
Jul 26, 2024 02:27:39.524389982 CEST	192.168.2.7	62.118.72.207	7d6	Echo
Jul 26, 2024 02:27:39.555638075 CEST	192.168.2.7	62.118.201.146	7d5	Echo
Jul 26, 2024 02:27:39.586904049 CEST	192.168.2.7	62.118.205.102	7d4	Echo
Jul 26, 2024 02:27:39.618415117 CEST	192.168.2.7	62.118.96.205	7d3	Echo
Jul 26, 2024 02:27:39.649504900 CEST	192.168.2.7	62.118.185.194	7d2	Echo
Jul 26, 2024 02:27:39.680849075 CEST	192.168.2.7	62.118.173.59	7d1	Echo
Jul 26, 2024 02:27:39.711980104 CEST	192.168.2.7	62.118.9.240	7d0	Echo
Jul 26, 2024 02:27:39.743051052 CEST	192.168.2.7	62.118.152.43	7cf	Echo
Jul 26, 2024 02:27:39.776371956 CEST	192.168.2.7	62.118.16.115	7ce	Echo
Jul 26, 2024 02:27:39.808113098 CEST	192.168.2.7	62.118.244.161	7cd	Echo
Jul 26, 2024 02:27:39.836857080 CEST	192.168.2.7	62.118.156.244	7cc	Echo
Jul 26, 2024 02:27:39.868280888 CEST	192.168.2.7	62.118.204.53	7cb	Echo
Jul 26, 2024 02:27:39.899583101 CEST	192.168.2.7	62.118.231.122	7ca	Echo
Jul 26, 2024 02:27:39.930531025 CEST	192.168.2.7	62.118.42.235	7c9	Echo
Jul 26, 2024 02:27:39.961829901 CEST	192.168.2.7	62.118.198.186	7c8	Echo
Jul 26, 2024 02:27:39.993560076 CEST	192.168.2.7	62.118.194.122	7c7	Echo
Jul 26, 2024 02:27:39.995479107 CEST	192.168.2.7	62.118.247.164	7c6	Echo
Jul 26, 2024 02:27:39.997107029 CEST	192.168.2.7	62.118.19.178	7c5	Echo
Jul 26, 2024 02:27:39.997201920 CEST	192.168.2.7	62.118.89.19	7c4	Echo
Jul 26, 2024 02:27:39.997307062 CEST	192.168.2.7	62.118.68.60	7c3	Echo
Jul 26, 2024 02:27:39.997402906 CEST	192.168.2.7	62.118.197.252	7c2	Echo
Jul 26, 2024 02:27:39.997497082 CEST	192.168.2.7	62.118.112.48	7c1	Echo
Jul 26, 2024 02:27:39.997590065 CEST	192.168.2.7	62.118.128.185	7c0	Echo
Jul 26, 2024 02:27:39.997683048 CEST	192.168.2.7	62.118.15.129	7bf	Echo
Jul 26, 2024 02:27:39.997773886 CEST	192.168.2.7	62.118.230.109	7be	Echo
Jul 26, 2024 02:27:39.997869968 CEST	192.168.2.7	62.118.27.192	7bd	Echo
Jul 26, 2024 02:27:39.997965097 CEST	192.168.2.7	62.118.97.4	7bc	Echo
Jul 26, 2024 02:27:39.998051882 CEST	192.168.2.7	62.118.228.200	7bb	Echo
Jul 26, 2024 02:27:39.998136044 CEST	192.168.2.7	62.118.158.27	7ba	Echo
Jul 26, 2024 02:27:39.998217106 CEST	192.168.2.7	62.118.46.89	7b9	Echo
Jul 26, 2024 02:27:39.998298883 CEST	192.168.2.7	62.118.119.194	7b8	Echo
Jul 26, 2024 02:27:39.998795033 CEST	192.168.2.7	62.118.123.54	7b7	Echo
Jul 26, 2024 02:27:40.024354935 CEST	192.168.2.7	62.118.194.239	7b6	Echo
Jul 26, 2024 02:27:40.056687117 CEST	192.168.2.7	62.118.79.195	7b5	Echo
Jul 26, 2024 02:27:40.086893082 CEST	192.168.2.7	62.118.59.196	7b4	Echo
Jul 26, 2024 02:27:40.122452021 CEST	192.168.2.7	62.118.153.81	7b3	Echo
Jul 26, 2024 02:27:40.163916111 CEST	62.118.153.81	192.168.2.7	fb3	Echo Reply
Jul 26, 2024 02:27:40.174966097 CEST	192.168.2.7	62.118.153.81	7b2	Echo
Jul 26, 2024 02:27:40.175328970 CEST	192.168.2.7	62.118.140.15	7b1	Echo
Jul 26, 2024 02:27:40.196476936 CEST	192.168.2.7	62.118.7.238	7b0	Echo
Jul 26, 2024 02:27:40.215962887 CEST	62.118.153.81	192.168.2.7	fb2	Echo Reply
Jul 26, 2024 02:27:40.227489948 CEST	192.168.2.7	62.118.9.173	7af	Echo
Jul 26, 2024 02:27:40.259021997 CEST	192.168.2.7	62.118.12.167	7ae	Echo
Jul 26, 2024 02:27:40.290000916 CEST	192.168.2.7	62.118.153.191	7ad	Echo
Jul 26, 2024 02:27:40.321254015 CEST	192.168.2.7	62.118.217.22	7ac	Echo
Jul 26, 2024 02:27:40.357996941 CEST	192.168.2.7	62.118.40.71	7ab	Echo
Jul 26, 2024 02:27:40.383701086 CEST	192.168.2.7	62.118.52.211	7aa	Echo
Jul 26, 2024 02:27:40.415298939 CEST	192.168.2.7	62.118.46.48	7a9	Echo
Jul 26, 2024 02:27:40.450366020 CEST	192.168.2.7	62.118.33.36	7a8	Echo
Jul 26, 2024 02:27:40.481386900 CEST	192.168.2.7	62.118.223.33	7a7	Echo
Jul 26, 2024 02:27:40.494201899 CEST	192.168.2.7	62.118.20.83	7a6	Echo
Jul 26, 2024 02:27:40.498238087 CEST	192.168.2.7	62.118.71.240	7a5	Echo
Jul 26, 2024 02:27:40.498651028 CEST	192.168.2.7	62.118.184.219	7a3	Echo
Jul 26, 2024 02:27:40.498785019 CEST	192.168.2.7	62.118.80.71	7a4	Echo
Jul 26, 2024 02:27:40.499006987 CEST	192.168.2.7	62.118.29.60	7a2	Echo
Jul 26, 2024 02:27:40.499208927 CEST	192.168.2.7	62.118.242.210	7a1	Echo
Jul 26, 2024 02:27:40.499488115 CEST	192.168.2.7	62.118.131.113	7a0	Echo
Jul 26, 2024 02:27:40.499692917 CEST	192.168.2.7	62.118.186.43	79e	Echo
Jul 26, 2024 02:27:40.500046015 CEST	192.168.2.7	62.118.80.214	79d	Echo
Jul 26, 2024 02:27:40.500113964 CEST	192.168.2.7	62.118.103.217	79f	Echo
Jul 26, 2024 02:27:40.500245094 CEST	192.168.2.7	62.118.111.111	79c	Echo
Jul 26, 2024 02:27:40.500663996 CEST	192.168.2.7	62.118.11.212	79a	Echo
Jul 26, 2024 02:27:40.500756025 CEST	192.168.2.7	62.118.217.11	799	Echo
Jul 26, 2024 02:27:40.500844002 CEST	192.168.2.7	62.118.212.2	79b	Echo
Jul 26, 2024 02:27:40.501051903 CEST	192.168.2.7	62.118.187.216	798	Echo
Jul 26, 2024 02:27:40.501225948 CEST	192.168.2.7	62.118.23.231	797	Echo
Jul 26, 2024 02:27:40.509469032 CEST	192.168.2.7	62.118.220.168	796	Echo
Jul 26, 2024 02:27:40.540011883 CEST	192.168.2.7	62.118.250.255	795	Echo
Jul 26, 2024 02:27:40.571280003 CEST	192.168.2.7	62.118.63.41	794	Echo
Jul 26, 2024 02:27:40.602530003 CEST	192.168.2.7	62.118.17.63	793	Echo
Jul 26, 2024 02:27:40.634151936 CEST	192.168.2.7	62.118.47.90	792	Echo
Jul 26, 2024 02:27:40.665538073 CEST	192.168.2.7	62.118.98.145	791	Echo
Jul 26, 2024 02:27:40.696188927 CEST	192.168.2.7	62.118.126.98	790	Echo
Jul 26, 2024 02:27:40.727504015 CEST	192.168.2.7	62.118.242.100	78f	Echo
Jul 26, 2024 02:27:40.758727074 CEST	192.168.2.7	62.118.178.193	78e	Echo
Jul 26, 2024 02:27:40.789993048 CEST	192.168.2.7	62.118.43.187	78d	Echo
Jul 26, 2024 02:27:40.821192980 CEST	192.168.2.7	62.118.146.144	78c	Echo
Jul 26, 2024 02:27:40.852809906 CEST	192.168.2.7	62.118.78.166	78b	Echo
Jul 26, 2024 02:27:40.883754969 CEST	192.168.2.7	62.118.6.79	78a	Echo
Jul 26, 2024 02:27:40.915088892 CEST	192.168.2.7	62.118.184.75	789	Echo
Jul 26, 2024 02:27:40.946934938 CEST	192.168.2.7	62.118.214.22	788	Echo
Jul 26, 2024 02:27:40.977709055 CEST	192.168.2.7	62.118.17.190	787	Echo
Jul 26, 2024 02:27:40.993283987 CEST	192.168.2.7	62.118.237.44	786	Echo
Jul 26, 2024 02:27:40.995234966 CEST	192.168.2.7	62.118.237.9	785	Echo
Jul 26, 2024 02:27:40.995345116 CEST	192.168.2.7	62.118.179.27	784	Echo
Jul 26, 2024 02:27:40.995444059 CEST	192.168.2.7	62.118.40.211	783	Echo
Jul 26, 2024 02:27:40.995522022 CEST	192.168.2.7	62.118.69.192	782	Echo
Jul 26, 2024 02:27:40.995635033 CEST	192.168.2.7	62.118.44.54	781	Echo
Jul 26, 2024 02:27:40.995840073 CEST	192.168.2.7	62.118.212.185	77f	Echo
Jul 26, 2024 02:27:40.995855093 CEST	192.168.2.7	62.118.8.230	780	Echo
Jul 26, 2024 02:27:40.996025085 CEST	192.168.2.7	62.118.55.34	77d	Echo
Jul 26, 2024 02:27:40.996062040 CEST	192.168.2.7	62.118.25.94	77e	Echo
Jul 26, 2024 02:27:40.996128082 CEST	192.168.2.7	62.118.89.209	77c	Echo
Jul 26, 2024 02:27:40.996212959 CEST	192.168.2.7	62.118.116.89	77b	Echo
Jul 26, 2024 02:27:40.996385098 CEST	192.168.2.7	62.118.55.42	779	Echo
Jul 26, 2024 02:27:40.996467113 CEST	192.168.2.7	62.118.242.98	778	Echo
Jul 26, 2024 02:27:40.996505022 CEST	192.168.2.7	62.118.182.116	77a	Echo
Jul 26, 2024 02:27:40.996563911 CEST	192.168.2.7	62.118.1.81	777	Echo
Jul 26, 2024 02:27:41.009310007 CEST	192.168.2.7	62.118.129.178	776	Echo
Jul 26, 2024 02:27:41.040215969 CEST	192.168.2.7	62.118.161.102	775	Echo
Jul 26, 2024 02:27:41.071329117 CEST	192.168.2.7	62.118.231.75	774	Echo
Jul 26, 2024 02:27:41.102579117 CEST	192.168.2.7	62.118.240.174	773	Echo
Jul 26, 2024 02:27:41.133907080 CEST	192.168.2.7	62.118.92.18	772	Echo
Jul 26, 2024 02:27:41.165328979 CEST	192.168.2.7	62.118.88.52	771	Echo
Jul 26, 2024 02:27:41.196542978 CEST	192.168.2.7	62.118.154.15	770	Echo
Jul 26, 2024 02:27:41.227600098 CEST	192.168.2.7	62.118.81.69	76f	Echo
Jul 26, 2024 02:27:41.258692980 CEST	192.168.2.7	62.118.229.156	76e	Echo
Jul 26, 2024 02:27:41.289896011 CEST	192.168.2.7	62.118.172.110	76d	Echo
Jul 26, 2024 02:27:41.321227074 CEST	192.168.2.7	62.118.203.229	76c	Echo
Jul 26, 2024 02:27:41.352472067 CEST	192.168.2.7	62.118.238.86	76b	Echo
Jul 26, 2024 02:27:41.383878946 CEST	192.168.2.7	62.118.58.237	76a	Echo
Jul 26, 2024 02:27:41.415132046 CEST	192.168.2.7	62.118.38.238	769	Echo
Jul 26, 2024 02:27:41.446224928 CEST	192.168.2.7	62.118.132.250	768	Echo
Jul 26, 2024 02:27:41.477483988 CEST	192.168.2.7	62.118.28.70	767	Echo
Jul 26, 2024 02:27:41.494407892 CEST	192.168.2.7	62.118.187.99	766	Echo
Jul 26, 2024 02:27:41.496756077 CEST	192.168.2.7	62.118.72.207	765	Echo
Jul 26, 2024 02:27:41.496867895 CEST	192.168.2.7	62.118.201.146	764	Echo
Jul 26, 2024 02:27:41.496994019 CEST	192.168.2.7	62.118.205.102	763	Echo
Jul 26, 2024 02:27:41.497087002 CEST	192.168.2.7	62.118.96.205	762	Echo
Jul 26, 2024 02:27:41.497201920 CEST	192.168.2.7	62.118.185.194	761	Echo
Jul 26, 2024 02:27:41.497267962 CEST	192.168.2.7	62.118.173.59	760	Echo
Jul 26, 2024 02:27:41.497380972 CEST	192.168.2.7	62.118.9.240	75f	Echo
Jul 26, 2024 02:27:41.497529030 CEST	192.168.2.7	62.118.152.43	75e	Echo
Jul 26, 2024 02:27:41.497550011 CEST	192.168.2.7	62.118.16.115	75d	Echo
Jul 26, 2024 02:27:41.497665882 CEST	192.168.2.7	62.118.244.161	75c	Echo
Jul 26, 2024 02:27:41.497704029 CEST	192.168.2.7	62.118.156.244	75b	Echo
Jul 26, 2024 02:27:41.497791052 CEST	192.168.2.7	62.118.204.53	75a	Echo
Jul 26, 2024 02:27:41.497874975 CEST	192.168.2.7	62.118.231.122	759	Echo
Jul 26, 2024 02:27:41.497920990 CEST	192.168.2.7	62.118.42.235	758	Echo
Jul 26, 2024 02:27:41.498033047 CEST	192.168.2.7	62.118.198.186	757	Echo
Jul 26, 2024 02:27:41.518405914 CEST	192.168.2.7	62.118.69.117	756	Echo
Jul 26, 2024 02:27:41.540148973 CEST	192.168.2.7	62.118.94.69	755	Echo
Jul 26, 2024 02:27:41.571307898 CEST	192.168.2.7	62.118.108.94	754	Echo
Jul 26, 2024 02:27:41.602487087 CEST	192.168.2.7	62.118.54.108	753	Echo
Jul 26, 2024 02:27:41.633918047 CEST	192.168.2.7	62.118.149.53	752	Echo
Jul 26, 2024 02:27:41.665873051 CEST	192.168.2.7	62.118.77.109	751	Echo
Jul 26, 2024 02:27:41.696329117 CEST	192.168.2.7	62.118.165.217	750	Echo
Jul 26, 2024 02:27:41.727545977 CEST	192.168.2.7	62.118.174.88	74f	Echo
Jul 26, 2024 02:27:41.758730888 CEST	192.168.2.7	62.118.26.88	74e	Echo
Jul 26, 2024 02:27:41.790159941 CEST	192.168.2.7	62.118.14.30	74d	Echo
Jul 26, 2024 02:27:41.821176052 CEST	192.168.2.7	62.118.109.154	74c	Echo
Jul 26, 2024 02:27:41.852586985 CEST	192.168.2.7	62.118.67.109	74b	Echo
Jul 26, 2024 02:27:41.883898973 CEST	192.168.2.7	62.118.106.197	74a	Echo
Jul 26, 2024 02:27:41.915014982 CEST	192.168.2.7	62.118.111.234	749	Echo
Jul 26, 2024 02:27:41.946660042 CEST	192.168.2.7	62.118.9.112	748	Echo
Jul 26, 2024 02:27:41.977545023 CEST	192.168.2.7	62.118.54.153	747	Echo
Jul 26, 2024 02:27:41.993360043 CEST	192.168.2.7	62.118.247.164	746	Echo
Jul 26, 2024 02:27:41.994699001 CEST	192.168.2.7	62.118.194.239	745	Echo
Jul 26, 2024 02:27:41.994726896 CEST	192.168.2.7	62.118.79.195	744	Echo
Jul 26, 2024 02:27:41.994822979 CEST	192.168.2.7	62.118.59.196	743	Echo
Jul 26, 2024 02:27:41.994869947 CEST	192.168.2.7	62.118.140.15	742	Echo
Jul 26, 2024 02:27:41.994946003 CEST	192.168.2.7	62.118.7.238	741	Echo
Jul 26, 2024 02:27:41.995007992 CEST	192.168.2.7	62.118.9.173	740	Echo
Jul 26, 2024 02:27:41.995055914 CEST	192.168.2.7	62.118.12.167	73f	Echo
Jul 26, 2024 02:27:41.995131016 CEST	192.168.2.7	62.118.153.191	73e	Echo
Jul 26, 2024 02:27:41.995196104 CEST	192.168.2.7	62.118.217.22	73d	Echo
Jul 26, 2024 02:27:41.995256901 CEST	192.168.2.7	62.118.40.71	73c	Echo
Jul 26, 2024 02:27:41.995316029 CEST	192.168.2.7	62.118.52.211	73b	Echo
Jul 26, 2024 02:27:41.995366096 CEST	192.168.2.7	62.118.46.48	73a	Echo
Jul 26, 2024 02:27:41.995434999 CEST	192.168.2.7	62.118.33.36	739	Echo
Jul 26, 2024 02:27:41.995470047 CEST	192.168.2.7	62.118.223.33	738	Echo
Jul 26, 2024 02:27:42.008896112 CEST	192.168.2.7	62.118.193.148	737	Echo
Jul 26, 2024 02:27:42.039904118 CEST	192.168.2.7	62.118.35.59	736	Echo
Jul 26, 2024 02:27:42.071177006 CEST	192.168.2.7	62.118.239.249	735	Echo
Jul 26, 2024 02:27:42.102540970 CEST	192.168.2.7	62.118.103.206	734	Echo
Jul 26, 2024 02:27:42.133871078 CEST	192.168.2.7	62.118.206.15	733	Echo
Jul 26, 2024 02:27:42.165107012 CEST	192.168.2.7	62.118.253.29	732	Echo
Jul 26, 2024 02:27:42.196279049 CEST	192.168.2.7	62.118.7.126	731	Echo
Jul 26, 2024 02:27:42.227654934 CEST	192.168.2.7	62.118.231.141	730	Echo
Jul 26, 2024 02:27:42.258917093 CEST	192.168.2.7	62.118.10.141	72f	Echo
Jul 26, 2024 02:27:42.267539978 CEST	62.118.253.29	192.168.2.7	f32	Echo Reply
Jul 26, 2024 02:27:42.267997026 CEST	192.168.2.7	62.118.253.29	72e	Echo
Jul 26, 2024 02:27:42.290090084 CEST	192.168.2.7	62.118.245.18	72d	Echo
Jul 26, 2024 02:27:42.321320057 CEST	192.168.2.7	62.118.175.204	72c	Echo
Jul 26, 2024 02:27:42.352734089 CEST	192.168.2.7	62.118.187.175	72b	Echo
Jul 26, 2024 02:27:42.369955063 CEST	62.118.253.29	192.168.2.7	f2e	Echo Reply
Jul 26, 2024 02:27:42.384008884 CEST	192.168.2.7	62.118.137.185	72a	Echo
Jul 26, 2024 02:27:42.415127039 CEST	192.168.2.7	62.118.251.213	729	Echo
Jul 26, 2024 02:27:42.446225882 CEST	192.168.2.7	62.118.80.225	728	Echo
Jul 26, 2024 02:27:42.477682114 CEST	192.168.2.7	62.118.166.187	727	Echo
Jul 26, 2024 02:27:42.496211052 CEST	192.168.2.7	62.118.220.168	726	Echo
Jul 26, 2024 02:27:42.496282101 CEST	192.168.2.7	62.118.250.255	725	Echo
Jul 26, 2024 02:27:42.496443033 CEST	192.168.2.7	62.118.63.41	724	Echo
Jul 26, 2024 02:27:42.496486902 CEST	192.168.2.7	62.118.17.63	723	Echo
Jul 26, 2024 02:27:42.496562958 CEST	192.168.2.7	62.118.47.90	722	Echo
Jul 26, 2024 02:27:42.496620893 CEST	192.168.2.7	62.118.98.145	721	Echo
Jul 26, 2024 02:27:42.496743917 CEST	192.168.2.7	62.118.126.98	720	Echo
Jul 26, 2024 02:27:42.496840000 CEST	192.168.2.7	62.118.242.100	71f	Echo
Jul 26, 2024 02:27:42.496898890 CEST	192.168.2.7	62.118.178.193	71e	Echo
Jul 26, 2024 02:27:42.496957064 CEST	192.168.2.7	62.118.43.187	71d	Echo
Jul 26, 2024 02:27:42.497011900 CEST	192.168.2.7	62.118.146.144	71c	Echo
Jul 26, 2024 02:27:42.497087002 CEST	192.168.2.7	62.118.78.166	71b	Echo
Jul 26, 2024 02:27:42.497127056 CEST	192.168.2.7	62.118.6.79	71a	Echo
Jul 26, 2024 02:27:42.497215986 CEST	192.168.2.7	62.118.184.75	719	Echo
Jul 26, 2024 02:27:42.497345924 CEST	192.168.2.7	62.118.214.22	718	Echo
Jul 26, 2024 02:27:42.497399092 CEST	192.168.2.7	62.118.17.190	717	Echo
Jul 26, 2024 02:27:42.508874893 CEST	192.168.2.7	62.118.78.103	716	Echo
Jul 26, 2024 02:27:42.540517092 CEST	192.168.2.7	62.118.40.99	715	Echo
Jul 26, 2024 02:27:42.560127020 CEST	62.118.78.103	192.168.2.7	f16	Echo Reply
Jul 26, 2024 02:27:42.567601919 CEST	192.168.2.7	62.118.78.103	714	Echo
Jul 26, 2024 02:27:42.571254969 CEST	192.168.2.7	62.118.106.199	713	Echo
Jul 26, 2024 02:27:42.602536917 CEST	192.168.2.7	62.118.73.75	712	Echo
Jul 26, 2024 02:27:42.615923882 CEST	62.118.78.103	192.168.2.7	f14	Echo Reply
Jul 26, 2024 02:27:42.633955002 CEST	192.168.2.7	62.118.113.57	711	Echo
Jul 26, 2024 02:27:42.664977074 CEST	192.168.2.7	62.118.68.52	710	Echo
Jul 26, 2024 02:27:42.724684954 CEST	192.168.2.7	62.118.60.196	70f	Echo
Jul 26, 2024 02:27:42.744240999 CEST	192.168.2.7	62.118.186.205	70e	Echo
Jul 26, 2024 02:27:42.774964094 CEST	192.168.2.7	62.118.99.40	70d	Echo
Jul 26, 2024 02:27:42.805879116 CEST	192.168.2.7	62.118.96.49	70c	Echo
Jul 26, 2024 02:27:42.837033033 CEST	192.168.2.7	62.118.252.215	70b	Echo
Jul 26, 2024 02:27:42.869235992 CEST	192.168.2.7	62.118.9.138	70a	Echo
Jul 26, 2024 02:27:42.899811983 CEST	192.168.2.7	62.118.252.9	709	Echo
Jul 26, 2024 02:27:42.930674076 CEST	192.168.2.7	62.118.164.252	708	Echo
Jul 26, 2024 02:27:42.961957932 CEST	192.168.2.7	62.118.131.166	707	Echo
Jul 26, 2024 02:27:42.993503094 CEST	192.168.2.7	62.118.163.101	706	Echo
Jul 26, 2024 02:27:42.994729042 CEST	192.168.2.7	62.118.129.178	705	Echo
Jul 26, 2024 02:27:42.994785070 CEST	192.168.2.7	62.118.161.102	704	Echo
Jul 26, 2024 02:27:42.994841099 CEST	192.168.2.7	62.118.231.75	703	Echo
Jul 26, 2024 02:27:42.994910955 CEST	192.168.2.7	62.118.240.174	702	Echo
Jul 26, 2024 02:27:42.994965076 CEST	192.168.2.7	62.118.92.18	701	Echo
Jul 26, 2024 02:27:42.995008945 CEST	192.168.2.7	62.118.88.52	700	Echo
Jul 26, 2024 02:27:42.995076895 CEST	192.168.2.7	62.118.154.15	6ff	Echo
Jul 26, 2024 02:27:42.995109081 CEST	192.168.2.7	62.118.81.69	6fe	Echo
Jul 26, 2024 02:27:42.995177984 CEST	192.168.2.7	62.118.229.156	6fd	Echo
Jul 26, 2024 02:27:42.995225906 CEST	192.168.2.7	62.118.172.110	6fc	Echo
Jul 26, 2024 02:27:42.995280027 CEST	192.168.2.7	62.118.203.229	6fb	Echo
Jul 26, 2024 02:27:42.995331049 CEST	192.168.2.7	62.118.238.86	6fa	Echo
Jul 26, 2024 02:27:42.995379925 CEST	192.168.2.7	62.118.58.237	6f9	Echo
Jul 26, 2024 02:27:42.995440006 CEST	192.168.2.7	62.118.38.238	6f8	Echo
Jul 26, 2024 02:27:42.995486975 CEST	192.168.2.7	62.118.132.250	6f7	Echo
Jul 26, 2024 02:27:42.995531082 CEST	192.168.2.7	62.118.28.70	6f6	Echo
Jul 26, 2024 02:27:43.024363041 CEST	192.168.2.7	62.118.107.240	6f5	Echo
Jul 26, 2024 02:27:43.055650949 CEST	192.168.2.7	62.118.154.235	6f4	Echo
Jul 26, 2024 02:27:43.087089062 CEST	192.168.2.7	62.118.94.239	6f3	Echo
Jul 26, 2024 02:27:43.120546103 CEST	192.168.2.7	62.118.130.94	6f2	Echo
Jul 26, 2024 02:27:43.150522947 CEST	192.168.2.7	62.118.24.252	6f1	Echo
Jul 26, 2024 02:27:43.180860996 CEST	192.168.2.7	62.118.42.51	6f0	Echo
Jul 26, 2024 02:27:43.214776039 CEST	192.168.2.7	62.118.198.254	6ef	Echo
Jul 26, 2024 02:27:43.247453928 CEST	192.168.2.7	62.118.127.46	6ee	Echo
Jul 26, 2024 02:27:43.274301052 CEST	192.168.2.7	62.118.191.78	6ed	Echo
Jul 26, 2024 02:27:43.305599928 CEST	192.168.2.7	62.118.83.208	6ec	Echo
Jul 26, 2024 02:27:43.336812973 CEST	192.168.2.7	62.118.113.228	6eb	Echo
Jul 26, 2024 02:27:43.368410110 CEST	192.168.2.7	62.118.39.222	6ea	Echo
Jul 26, 2024 02:27:43.399468899 CEST	192.168.2.7	62.118.184.40	6e9	Echo
Jul 26, 2024 02:27:43.431041956 CEST	192.168.2.7	62.118.85.139	6e8	Echo
Jul 26, 2024 02:27:43.461884975 CEST	192.168.2.7	62.118.167.71	6e7	Echo
Jul 26, 2024 02:27:43.493415117 CEST	192.168.2.7	62.118.176.118	6e6	Echo
Jul 26, 2024 02:27:43.494844913 CEST	192.168.2.7	62.118.69.117	6e5	Echo
Jul 26, 2024 02:27:43.494904995 CEST	192.168.2.7	62.118.94.69	6e4	Echo
Jul 26, 2024 02:27:43.494961023 CEST	192.168.2.7	62.118.108.94	6e3	Echo
Jul 26, 2024 02:27:43.495078087 CEST	192.168.2.7	62.118.54.108	6e2	Echo
Jul 26, 2024 02:27:43.495243073 CEST	192.168.2.7	62.118.77.109	6e0	Echo
Jul 26, 2024 02:27:43.495249033 CEST	192.168.2.7	62.118.149.53	6e1	Echo
Jul 26, 2024 02:27:43.495333910 CEST	192.168.2.7	62.118.165.217	6df	Echo
Jul 26, 2024 02:27:43.495448112 CEST	192.168.2.7	62.118.174.88	6de	Echo
Jul 26, 2024 02:27:43.495491982 CEST	192.168.2.7	62.118.26.88	6dd	Echo
Jul 26, 2024 02:27:43.495630026 CEST	192.168.2.7	62.118.14.30	6dc	Echo
Jul 26, 2024 02:27:43.495662928 CEST	192.168.2.7	62.118.109.154	6db	Echo
Jul 26, 2024 02:27:43.495769024 CEST	192.168.2.7	62.118.67.109	6da	Echo
Jul 26, 2024 02:27:43.495809078 CEST	192.168.2.7	62.118.106.197	6d9	Echo
Jul 26, 2024 02:27:43.495877981 CEST	192.168.2.7	62.118.111.234	6d8	Echo
Jul 26, 2024 02:27:43.495913029 CEST	192.168.2.7	62.118.9.112	6d7	Echo
Jul 26, 2024 02:27:43.496001959 CEST	192.168.2.7	62.118.54.153	6d6	Echo
Jul 26, 2024 02:27:43.524312973 CEST	192.168.2.7	62.118.102.218	6d5	Echo
Jul 26, 2024 02:27:43.556181908 CEST	192.168.2.7	62.118.185.133	6d4	Echo
Jul 26, 2024 02:27:43.586977959 CEST	192.168.2.7	62.118.87.51	6d3	Echo
Jul 26, 2024 02:27:43.618232965 CEST	192.168.2.7	62.118.220.89	6d2	Echo
Jul 26, 2024 02:27:43.649470091 CEST	192.168.2.7	62.118.144.220	6d1	Echo
Jul 26, 2024 02:27:43.680636883 CEST	192.168.2.7	62.118.45.145	6d0	Echo
Jul 26, 2024 02:27:43.712050915 CEST	192.168.2.7	62.118.33.123	6cf	Echo
Jul 26, 2024 02:27:43.743119955 CEST	192.168.2.7	62.118.9.238	6ce	Echo
Jul 26, 2024 02:27:43.774486065 CEST	192.168.2.7	62.118.6.207	6cd	Echo
Jul 26, 2024 02:27:43.805672884 CEST	192.168.2.7	62.118.94.134	6cc	Echo
Jul 26, 2024 02:27:43.836929083 CEST	192.168.2.7	62.118.105.227	6cb	Echo
Jul 26, 2024 02:27:43.868072033 CEST	192.168.2.7	62.118.234.184	6ca	Echo
Jul 26, 2024 02:27:43.899362087 CEST	192.168.2.7	62.118.186.234	6c9	Echo
Jul 26, 2024 02:27:43.930604935 CEST	192.168.2.7	62.118.155.82	6c8	Echo
Jul 26, 2024 02:27:43.961991072 CEST	192.168.2.7	62.118.11.64	6c7	Echo
Jul 26, 2024 02:27:43.993438959 CEST	192.168.2.7	62.118.86.72	6c6	Echo
Jul 26, 2024 02:27:43.994843006 CEST	192.168.2.7	62.118.193.148	6c5	Echo
Jul 26, 2024 02:27:43.994870901 CEST	192.168.2.7	62.118.35.59	6c4	Echo
Jul 26, 2024 02:27:43.994951963 CEST	192.168.2.7	62.118.239.249	6c3	Echo
Jul 26, 2024 02:27:43.995004892 CEST	192.168.2.7	62.118.103.206	6c2	Echo
Jul 26, 2024 02:27:43.995069027 CEST	192.168.2.7	62.118.206.15	6c1	Echo
Jul 26, 2024 02:27:43.995129108 CEST	192.168.2.7	62.118.7.126	6c0	Echo
Jul 26, 2024 02:27:43.995183945 CEST	192.168.2.7	62.118.231.141	6bf	Echo
Jul 26, 2024 02:27:43.995245934 CEST	192.168.2.7	62.118.10.141	6be	Echo
Jul 26, 2024 02:27:43.995279074 CEST	192.168.2.7	62.118.245.18	6bd	Echo
Jul 26, 2024 02:27:43.995353937 CEST	192.168.2.7	62.118.175.204	6bc	Echo
Jul 26, 2024 02:27:43.995434999 CEST	192.168.2.7	62.118.187.175	6bb	Echo
Jul 26, 2024 02:27:43.995467901 CEST	192.168.2.7	62.118.137.185	6ba	Echo
Jul 26, 2024 02:27:43.995565891 CEST	192.168.2.7	62.118.251.213	6b9	Echo
Jul 26, 2024 02:27:43.995594978 CEST	192.168.2.7	62.118.80.225	6b8	Echo
Jul 26, 2024 02:27:43.995659113 CEST	192.168.2.7	62.118.166.187	6b7	Echo
Jul 26, 2024 02:27:44.024419069 CEST	192.168.2.7	62.118.86.86	6b6	Echo
Jul 26, 2024 02:27:44.055649042 CEST	192.168.2.7	62.118.149.182	6b5	Echo
Jul 26, 2024 02:27:44.086853027 CEST	192.168.2.7	62.118.63.251	6b4	Echo
Jul 26, 2024 02:27:44.118115902 CEST	192.168.2.7	62.118.160.142	6b3	Echo
Jul 26, 2024 02:27:44.149462938 CEST	192.168.2.7	62.118.115.181	6b2	Echo
Jul 26, 2024 02:27:44.180675983 CEST	192.168.2.7	62.118.3.226	6b1	Echo
Jul 26, 2024 02:27:44.211961031 CEST	192.168.2.7	62.118.109.105	6b0	Echo
Jul 26, 2024 02:27:44.243208885 CEST	192.168.2.7	62.118.121.243	6af	Echo
Jul 26, 2024 02:27:44.274907112 CEST	192.168.2.7	62.118.93.217	6ae	Echo
Jul 26, 2024 02:27:44.305938005 CEST	192.168.2.7	62.118.60.94	6ad	Echo
Jul 26, 2024 02:27:44.337021112 CEST	192.168.2.7	62.118.57.60	6ac	Echo
Jul 26, 2024 02:27:44.368150949 CEST	192.168.2.7	62.118.5.250	6ab	Echo
Jul 26, 2024 02:27:44.399724007 CEST	192.168.2.7	62.118.157.124	6aa	Echo
Jul 26, 2024 02:27:44.430572987 CEST	192.168.2.7	62.118.46.137	6a9	Echo
Jul 26, 2024 02:27:44.461893082 CEST	192.168.2.7	62.118.28.245	6a8	Echo
Jul 26, 2024 02:27:44.493385077 CEST	192.168.2.7	62.118.92.151	6a7	Echo
Jul 26, 2024 02:27:44.495116949 CEST	192.168.2.7	62.118.40.99	6a6	Echo
Jul 26, 2024 02:27:44.495197058 CEST	192.168.2.7	62.118.106.199	6a5	Echo
Jul 26, 2024 02:27:44.495239019 CEST	192.168.2.7	62.118.73.75	6a4	Echo
Jul 26, 2024 02:27:44.495311022 CEST	192.168.2.7	62.118.113.57	6a3	Echo
Jul 26, 2024 02:27:44.495342970 CEST	192.168.2.7	62.118.68.52	6a2	Echo
Jul 26, 2024 02:27:44.495455027 CEST	192.168.2.7	62.118.60.196	6a1	Echo
Jul 26, 2024 02:27:44.495542049 CEST	192.168.2.7	62.118.186.205	6a0	Echo
Jul 26, 2024 02:27:44.495635033 CEST	192.168.2.7	62.118.99.40	69f	Echo
Jul 26, 2024 02:27:44.495661020 CEST	192.168.2.7	62.118.96.49	69e	Echo
Jul 26, 2024 02:27:44.495759964 CEST	192.168.2.7	62.118.252.215	69d	Echo
Jul 26, 2024 02:27:44.495815039 CEST	192.168.2.7	62.118.9.138	69c	Echo
Jul 26, 2024 02:27:44.495872021 CEST	192.168.2.7	62.118.252.9	69b	Echo
Jul 26, 2024 02:27:44.495935917 CEST	192.168.2.7	62.118.164.252	69a	Echo
Jul 26, 2024 02:27:44.496085882 CEST	192.168.2.7	62.118.131.166	699	Echo
Jul 26, 2024 02:27:44.524554968 CEST	192.168.2.7	62.118.63.96	698	Echo
Jul 26, 2024 02:27:44.556015015 CEST	192.168.2.7	62.118.109.253	697	Echo
Jul 26, 2024 02:27:44.587155104 CEST	192.168.2.7	62.118.46.125	696	Echo
Jul 26, 2024 02:27:44.618232965 CEST	192.168.2.7	62.118.192.117	695	Echo
Jul 26, 2024 02:27:44.649434090 CEST	192.168.2.7	62.118.47.192	694	Echo
Jul 26, 2024 02:27:44.680716991 CEST	192.168.2.7	62.118.114.47	693	Echo
Jul 26, 2024 02:27:44.711853981 CEST	192.168.2.7	62.118.188.114	692	Echo
Jul 26, 2024 02:27:44.743150949 CEST	192.168.2.7	62.118.121.204	691	Echo
Jul 26, 2024 02:27:44.774346113 CEST	192.168.2.7	62.118.140.71	690	Echo
Jul 26, 2024 02:27:44.805937052 CEST	192.168.2.7	62.118.103.66	68f	Echo
Jul 26, 2024 02:27:44.837007999 CEST	192.168.2.7	62.118.184.38	68e	Echo
Jul 26, 2024 02:27:44.868242025 CEST	192.168.2.7	62.118.85.113	68d	Echo
Jul 26, 2024 02:27:44.899328947 CEST	192.168.2.7	62.118.140.194	68c	Echo
Jul 26, 2024 02:27:44.930969954 CEST	192.168.2.7	62.118.39.25	68b	Echo
Jul 26, 2024 02:27:44.949753046 CEST	62.118.140.194	192.168.2.7	e8c	Echo Reply
Jul 26, 2024 02:27:44.953227997 CEST	192.168.2.7	62.118.140.194	68a	Echo
Jul 26, 2024 02:27:44.962891102 CEST	192.168.2.7	62.118.87.230	689	Echo
Jul 26, 2024 02:27:44.993223906 CEST	192.168.2.7	62.118.118.26	688	Echo
Jul 26, 2024 02:27:44.993454933 CEST	192.168.2.7	62.118.163.101	687	Echo
Jul 26, 2024 02:27:44.995501995 CEST	192.168.2.7	62.118.107.240	686	Echo
Jul 26, 2024 02:27:44.995569944 CEST	192.168.2.7	62.118.154.235	685	Echo
Jul 26, 2024 02:27:44.995696068 CEST	192.168.2.7	62.118.94.239	684	Echo
Jul 26, 2024 02:27:44.995739937 CEST	192.168.2.7	62.118.130.94	683	Echo
Jul 26, 2024 02:27:44.995918036 CEST	192.168.2.7	62.118.24.252	682	Echo
Jul 26, 2024 02:27:44.995925903 CEST	192.168.2.7	62.118.42.51	681	Echo
Jul 26, 2024 02:27:44.995987892 CEST	192.168.2.7	62.118.198.254	680	Echo
Jul 26, 2024 02:27:44.996033907 CEST	192.168.2.7	62.118.127.46	67f	Echo
Jul 26, 2024 02:27:44.996290922 CEST	192.168.2.7	62.118.191.78	67e	Echo
Jul 26, 2024 02:27:44.996411085 CEST	192.168.2.7	62.118.83.208	67d	Echo
Jul 26, 2024 02:27:44.996469975 CEST	192.168.2.7	62.118.113.228	67c	Echo
Jul 26, 2024 02:27:44.996541977 CEST	192.168.2.7	62.118.39.222	67b	Echo
Jul 26, 2024 02:27:44.996613026 CEST	192.168.2.7	62.118.184.40	67a	Echo
Jul 26, 2024 02:27:44.996735096 CEST	192.168.2.7	62.118.85.139	679	Echo
Jul 26, 2024 02:27:44.996784925 CEST	192.168.2.7	62.118.167.71	678	Echo
Jul 26, 2024 02:27:45.005115986 CEST	62.118.140.194	192.168.2.7	e8a	Echo Reply
Jul 26, 2024 02:27:45.024301052 CEST	192.168.2.7	62.118.153.82	677	Echo
Jul 26, 2024 02:27:45.055692911 CEST	192.168.2.7	62.118.241.29	676	Echo
Jul 26, 2024 02:27:45.086793900 CEST	192.168.2.7	62.118.7.185	675	Echo
Jul 26, 2024 02:27:45.117969036 CEST	192.168.2.7	62.118.111.20	674	Echo
Jul 26, 2024 02:27:45.149286032 CEST	192.168.2.7	62.118.21.219	673	Echo
Jul 26, 2024 02:27:45.180768967 CEST	192.168.2.7	62.118.54.173	672	Echo
Jul 26, 2024 02:27:45.211903095 CEST	192.168.2.7	62.118.65.5	671	Echo
Jul 26, 2024 02:27:45.243043900 CEST	192.168.2.7	62.118.80.236	670	Echo
Jul 26, 2024 02:27:45.274485111 CEST	192.168.2.7	62.118.123.175	66f	Echo
Jul 26, 2024 02:27:45.305599928 CEST	192.168.2.7	62.118.22.162	66e	Echo
Jul 26, 2024 02:27:45.336926937 CEST	192.168.2.7	62.118.45.66	66d	Echo
Jul 26, 2024 02:27:45.367949009 CEST	192.168.2.7	62.118.32.92	66c	Echo
Jul 26, 2024 02:27:45.399313927 CEST	192.168.2.7	62.118.65.42	66b	Echo
Jul 26, 2024 02:27:45.430638075 CEST	192.168.2.7	62.118.157.221	66a	Echo
Jul 26, 2024 02:27:45.462100983 CEST	192.168.2.7	62.118.101.25	669	Echo
Jul 26, 2024 02:27:45.493447065 CEST	192.168.2.7	62.118.176.118	668	Echo
Jul 26, 2024 02:27:45.493791103 CEST	192.168.2.7	62.118.143.100	667	Echo
Jul 26, 2024 02:27:45.495646000 CEST	192.168.2.7	62.118.102.218	666	Echo
Jul 26, 2024 02:27:45.495728016 CEST	192.168.2.7	62.118.185.133	665	Echo
Jul 26, 2024 02:27:45.495798111 CEST	192.168.2.7	62.118.87.51	664	Echo
Jul 26, 2024 02:27:45.495882034 CEST	192.168.2.7	62.118.220.89	663	Echo
Jul 26, 2024 02:27:45.495948076 CEST	192.168.2.7	62.118.144.220	662	Echo
Jul 26, 2024 02:27:45.496026039 CEST	192.168.2.7	62.118.45.145	661	Echo
Jul 26, 2024 02:27:45.496177912 CEST	192.168.2.7	62.118.33.123	660	Echo
Jul 26, 2024 02:27:45.496284008 CEST	192.168.2.7	62.118.9.238	65f	Echo
Jul 26, 2024 02:27:45.496429920 CEST	192.168.2.7	62.118.6.207	65e	Echo
Jul 26, 2024 02:27:45.496432066 CEST	192.168.2.7	62.118.94.134	65d	Echo
Jul 26, 2024 02:27:45.496490955 CEST	192.168.2.7	62.118.105.227	65c	Echo
Jul 26, 2024 02:27:45.496624947 CEST	192.168.2.7	62.118.234.184	65b	Echo
Jul 26, 2024 02:27:45.496665955 CEST	192.168.2.7	62.118.186.234	65a	Echo
Jul 26, 2024 02:27:45.496774912 CEST	192.168.2.7	62.118.155.82	659	Echo
Jul 26, 2024 02:27:45.496848106 CEST	192.168.2.7	62.118.11.64	658	Echo
Jul 26, 2024 02:27:45.524341106 CEST	192.168.2.7	62.118.101.21	657	Echo
Jul 26, 2024 02:27:45.555969000 CEST	192.168.2.7	62.118.27.126	656	Echo
Jul 26, 2024 02:27:45.587028980 CEST	192.168.2.7	62.118.90.206	655	Echo
Jul 26, 2024 02:27:45.620122910 CEST	192.168.2.7	62.118.35.203	654	Echo
Jul 26, 2024 02:27:45.649525881 CEST	192.168.2.7	62.118.159.15	653	Echo
Jul 26, 2024 02:27:45.680731058 CEST	192.168.2.7	62.118.135.230	652	Echo
Jul 26, 2024 02:27:45.712090015 CEST	192.168.2.7	62.118.138.177	651	Echo
Jul 26, 2024 02:27:45.743211985 CEST	192.168.2.7	62.118.36.66	650	Echo
Jul 26, 2024 02:27:45.774652958 CEST	192.168.2.7	62.118.249.204	64f	Echo
Jul 26, 2024 02:27:45.805854082 CEST	192.168.2.7	62.118.64.39	64e	Echo
Jul 26, 2024 02:27:45.836942911 CEST	192.168.2.7	62.118.165.53	64d	Echo
Jul 26, 2024 02:27:45.868319035 CEST	192.168.2.7	62.118.185.77	64c	Echo
Jul 26, 2024 02:27:45.899538040 CEST	192.168.2.7	62.118.18.111	64b	Echo
Jul 26, 2024 02:27:45.930787086 CEST	192.168.2.7	62.118.184.18	64a	Echo
Jul 26, 2024 02:27:45.962083101 CEST	192.168.2.7	62.118.91.86	649	Echo
Jul 26, 2024 02:27:45.993798971 CEST	192.168.2.7	62.118.86.72	648	Echo
Jul 26, 2024 02:27:45.993972063 CEST	192.168.2.7	62.118.56.146	647	Echo
Jul 26, 2024 02:27:45.995300055 CEST	192.168.2.7	62.118.86.86	646	Echo
Jul 26, 2024 02:27:45.995394945 CEST	192.168.2.7	62.118.149.182	645	Echo
Jul 26, 2024 02:27:45.995480061 CEST	192.168.2.7	62.118.63.251	644	Echo
Jul 26, 2024 02:27:45.995570898 CEST	192.168.2.7	62.118.160.142	643	Echo
Jul 26, 2024 02:27:45.995645046 CEST	192.168.2.7	62.118.115.181	642	Echo
Jul 26, 2024 02:27:45.995728016 CEST	192.168.2.7	62.118.3.226	641	Echo
Jul 26, 2024 02:27:45.995809078 CEST	192.168.2.7	62.118.109.105	640	Echo
Jul 26, 2024 02:27:45.996032953 CEST	192.168.2.7	62.118.121.243	63f	Echo
Jul 26, 2024 02:27:45.996196032 CEST	192.168.2.7	62.118.93.217	63e	Echo
Jul 26, 2024 02:27:45.996300936 CEST	192.168.2.7	62.118.60.94	63d	Echo
Jul 26, 2024 02:27:45.996392965 CEST	192.168.2.7	62.118.57.60	63c	Echo
Jul 26, 2024 02:27:45.996485949 CEST	192.168.2.7	62.118.5.250	63b	Echo
Jul 26, 2024 02:27:45.996567965 CEST	192.168.2.7	62.118.157.124	63a	Echo
Jul 26, 2024 02:27:45.996658087 CEST	192.168.2.7	62.118.46.137	639	Echo
Jul 26, 2024 02:27:45.996746063 CEST	192.168.2.7	62.118.28.245	638	Echo
Jul 26, 2024 02:27:46.024445057 CEST	192.168.2.7	62.118.168.214	637	Echo
Jul 26, 2024 02:27:46.040652037 CEST	192.168.2.7	62.118.91.86	636	Echo
Jul 26, 2024 02:27:46.055496931 CEST	192.168.2.7	62.118.90.241	635	Echo
Jul 26, 2024 02:27:46.087165117 CEST	192.168.2.7	62.118.14.109	634	Echo
Jul 26, 2024 02:27:46.118176937 CEST	192.168.2.7	62.118.2.69	633	Echo
Jul 26, 2024 02:27:46.149359941 CEST	192.168.2.7	62.118.172.202	632	Echo
Jul 26, 2024 02:27:46.180650949 CEST	192.168.2.7	62.118.50.153	631	Echo
Jul 26, 2024 02:27:46.211940050 CEST	192.168.2.7	62.118.160.24	630	Echo
Jul 26, 2024 02:27:46.243230104 CEST	192.168.2.7	62.118.54.159	62f	Echo
Jul 26, 2024 02:27:46.274274111 CEST	192.168.2.7	62.118.156.54	62e	Echo
Jul 26, 2024 02:27:46.305648088 CEST	192.168.2.7	62.118.231.114	62d	Echo
Jul 26, 2024 02:27:46.337789059 CEST	192.168.2.7	62.118.201.248	62c	Echo
Jul 26, 2024 02:27:46.368235111 CEST	192.168.2.7	62.118.109.70	62b	Echo
Jul 26, 2024 02:27:46.399360895 CEST	192.168.2.7	62.118.59.109	62a	Echo
Jul 26, 2024 02:27:46.430567026 CEST	192.168.2.7	62.118.72.59	629	Echo
Jul 26, 2024 02:27:46.461967945 CEST	192.168.2.7	62.118.147.102	628	Echo
Jul 26, 2024 02:27:46.493263960 CEST	192.168.2.7	62.118.92.151	627	Echo
Jul 26, 2024 02:27:46.493701935 CEST	192.168.2.7	62.118.56.245	626	Echo
Jul 26, 2024 02:27:46.495174885 CEST	192.168.2.7	62.118.63.96	625	Echo
Jul 26, 2024 02:27:46.495215893 CEST	192.168.2.7	62.118.109.253	624	Echo
Jul 26, 2024 02:27:46.495361090 CEST	192.168.2.7	62.118.46.125	623	Echo
Jul 26, 2024 02:27:46.495377064 CEST	192.168.2.7	62.118.192.117	622	Echo
Jul 26, 2024 02:27:46.495549917 CEST	192.168.2.7	62.118.47.192	621	Echo
Jul 26, 2024 02:27:46.495590925 CEST	192.168.2.7	62.118.114.47	620	Echo
Jul 26, 2024 02:27:46.495713949 CEST	192.168.2.7	62.118.188.114	61f	Echo
Jul 26, 2024 02:27:46.495798111 CEST	192.168.2.7	62.118.121.204	61e	Echo
Jul 26, 2024 02:27:46.495910883 CEST	192.168.2.7	62.118.140.71	61d	Echo
Jul 26, 2024 02:27:46.495986938 CEST	192.168.2.7	62.118.103.66	61c	Echo
Jul 26, 2024 02:27:46.496068001 CEST	192.168.2.7	62.118.184.38	61b	Echo
Jul 26, 2024 02:27:46.496148109 CEST	192.168.2.7	62.118.85.113	61a	Echo
Jul 26, 2024 02:27:46.496242046 CEST	192.168.2.7	62.118.39.25	619	Echo
Jul 26, 2024 02:27:46.496360064 CEST	192.168.2.7	62.118.87.230	618	Echo
Jul 26, 2024 02:27:46.524302006 CEST	192.168.2.7	62.118.158.15	617	Echo
Jul 26, 2024 02:27:46.555548906 CEST	192.168.2.7	62.118.157.190	616	Echo
Jul 26, 2024 02:27:46.587001085 CEST	192.168.2.7	62.118.67.246	615	Echo
Jul 26, 2024 02:27:46.618208885 CEST	192.168.2.7	62.118.128.169	614	Echo
Jul 26, 2024 02:27:46.649599075 CEST	192.168.2.7	62.118.250.228	613	Echo
Jul 26, 2024 02:27:46.680507898 CEST	192.168.2.7	62.118.62.244	612	Echo
Jul 26, 2024 02:27:46.712234020 CEST	192.168.2.7	62.118.11.50	611	Echo
Jul 26, 2024 02:27:46.743521929 CEST	192.168.2.7	62.118.143.149	610	Echo
Jul 26, 2024 02:27:46.774769068 CEST	192.168.2.7	62.118.167.197	60f	Echo
Jul 26, 2024 02:27:46.805784941 CEST	192.168.2.7	62.118.238.12	60e	Echo
Jul 26, 2024 02:27:46.837093115 CEST	192.168.2.7	62.118.190.237	60d	Echo
Jul 26, 2024 02:27:46.868066072 CEST	192.168.2.7	62.118.43.135	60c	Echo
Jul 26, 2024 02:27:46.899492979 CEST	192.168.2.7	62.118.142.43	60b	Echo
Jul 26, 2024 02:27:46.930726051 CEST	192.168.2.7	62.118.222.111	60a	Echo
Jul 26, 2024 02:27:46.961994886 CEST	192.168.2.7	62.118.111.47	609	Echo
Jul 26, 2024 02:27:46.994044065 CEST	192.168.2.7	62.118.118.26	608	Echo
Jul 26, 2024 02:27:46.994220972 CEST	192.168.2.7	62.118.185.129	607	Echo
Jul 26, 2024 02:27:46.995795965 CEST	192.168.2.7	62.118.153.82	606	Echo
Jul 26, 2024 02:27:46.995938063 CEST	192.168.2.7	62.118.241.29	605	Echo
Jul 26, 2024 02:27:46.996054888 CEST	192.168.2.7	62.118.7.185	604	Echo
Jul 26, 2024 02:27:46.996061087 CEST	192.168.2.7	62.118.111.20	603	Echo
Jul 26, 2024 02:27:46.996098995 CEST	192.168.2.7	62.118.21.219	602	Echo
Jul 26, 2024 02:27:46.996182919 CEST	192.168.2.7	62.118.54.173	601	Echo
Jul 26, 2024 02:27:46.996249914 CEST	192.168.2.7	62.118.65.5	600	Echo
Jul 26, 2024 02:27:46.996298075 CEST	192.168.2.7	62.118.80.236	5ff	Echo
Jul 26, 2024 02:27:46.996361971 CEST	192.168.2.7	62.118.123.175	5fe	Echo
Jul 26, 2024 02:27:46.996404886 CEST	192.168.2.7	62.118.22.162	5fd	Echo
Jul 26, 2024 02:27:46.996473074 CEST	192.168.2.7	62.118.45.66	5fc	Echo
Jul 26, 2024 02:27:46.996536016 CEST	192.168.2.7	62.118.32.92	5fb	Echo
Jul 26, 2024 02:27:46.996587992 CEST	192.168.2.7	62.118.65.42	5fa	Echo
Jul 26, 2024 02:27:46.996642113 CEST	192.168.2.7	62.118.157.221	5f9	Echo
Jul 26, 2024 02:27:46.996694088 CEST	192.168.2.7	62.118.101.25	5f8	Echo
Jul 26, 2024 02:27:47.024710894 CEST	192.168.2.7	62.118.10.221	5f7	Echo
Jul 26, 2024 02:27:47.055679083 CEST	192.168.2.7	62.118.14.140	5f6	Echo
Jul 26, 2024 02:27:47.086793900 CEST	192.168.2.7	62.118.5.33	5f5	Echo
Jul 26, 2024 02:27:47.118065119 CEST	192.168.2.7	62.118.178.224	5f4	Echo
Jul 26, 2024 02:27:47.149488926 CEST	192.168.2.7	62.118.129.179	5f3	Echo
Jul 26, 2024 02:27:47.180685043 CEST	192.168.2.7	62.118.199.107	5f2	Echo
Jul 26, 2024 02:27:47.211882114 CEST	192.168.2.7	62.118.104.181	5f1	Echo
Jul 26, 2024 02:27:47.243149996 CEST	192.168.2.7	62.118.160.146	5f0	Echo
Jul 26, 2024 02:27:47.274548054 CEST	192.168.2.7	62.118.199.140	5ef	Echo
Jul 26, 2024 02:27:47.305629969 CEST	192.168.2.7	62.118.23.179	5ee	Echo
Jul 26, 2024 02:27:47.339832067 CEST	192.168.2.7	62.118.210.111	5ed	Echo
Jul 26, 2024 02:27:47.379018068 CEST	192.168.2.7	62.118.77.240	5ec	Echo
Jul 26, 2024 02:27:47.400789022 CEST	192.168.2.7	62.118.68.17	5eb	Echo
Jul 26, 2024 02:27:47.430773973 CEST	192.168.2.7	62.118.154.203	5ea	Echo
Jul 26, 2024 02:27:47.462363958 CEST	192.168.2.7	62.118.99.249	5e9	Echo
Jul 26, 2024 02:27:47.493572950 CEST	192.168.2.7	62.118.143.100	5e7	Echo
Jul 26, 2024 02:27:47.493580103 CEST	192.168.2.7	62.118.19.75	5e8	Echo
Jul 26, 2024 02:27:47.495166063 CEST	192.168.2.7	62.118.101.21	5e6	Echo
Jul 26, 2024 02:27:47.495292902 CEST	192.168.2.7	62.118.27.126	5e5	Echo
Jul 26, 2024 02:27:47.495335102 CEST	192.168.2.7	62.118.90.206	5e4	Echo
Jul 26, 2024 02:27:47.495435953 CEST	192.168.2.7	62.118.35.203	5e3	Echo
Jul 26, 2024 02:27:47.495543957 CEST	192.168.2.7	62.118.159.15	5e2	Echo
Jul 26, 2024 02:27:47.495599985 CEST	192.168.2.7	62.118.135.230	5e1	Echo
Jul 26, 2024 02:27:47.495707035 CEST	192.168.2.7	62.118.138.177	5e0	Echo
Jul 26, 2024 02:27:47.495801926 CEST	192.168.2.7	62.118.36.66	5df	Echo
Jul 26, 2024 02:27:47.495914936 CEST	192.168.2.7	62.118.249.204	5de	Echo
Jul 26, 2024 02:27:47.496068954 CEST	192.168.2.7	62.118.64.39	5dd	Echo
Jul 26, 2024 02:27:47.496073008 CEST	192.168.2.7	62.118.165.53	5dc	Echo
Jul 26, 2024 02:27:47.496135950 CEST	192.168.2.7	62.118.185.77	5db	Echo
Jul 26, 2024 02:27:47.496201038 CEST	192.168.2.7	62.118.18.111	5da	Echo
Jul 26, 2024 02:27:47.496282101 CEST	192.168.2.7	62.118.184.18	5d9	Echo
Jul 26, 2024 02:27:47.524318933 CEST	192.168.2.7	62.118.73.249	5d8	Echo
Jul 26, 2024 02:27:47.555775881 CEST	192.168.2.7	62.118.25.138	5d7	Echo
Jul 26, 2024 02:27:47.587855101 CEST	192.168.2.7	62.118.139.165	5d6	Echo
Jul 26, 2024 02:27:47.618242979 CEST	192.168.2.7	62.118.18.37	5d5	Echo
Jul 26, 2024 02:27:47.649388075 CEST	192.168.2.7	62.118.55.152	5d4	Echo
Jul 26, 2024 02:27:47.680800915 CEST	192.168.2.7	62.118.9.83	5d3	Echo
Jul 26, 2024 02:27:47.710339069 CEST	192.168.2.7	62.118.56.245	5d2	Echo
Jul 26, 2024 02:27:47.711956024 CEST	192.168.2.7	62.118.39.15	5d1	Echo
Jul 26, 2024 02:27:47.743319035 CEST	192.168.2.7	62.118.28.49	5d0	Echo
Jul 26, 2024 02:27:47.774725914 CEST	192.168.2.7	62.118.172.64	5cf	Echo
Jul 26, 2024 02:27:47.805896044 CEST	192.168.2.7	62.118.242.128	5ce	Echo
Jul 26, 2024 02:27:47.836936951 CEST	192.168.2.7	62.118.71.242	5cd	Echo
Jul 26, 2024 02:27:47.868379116 CEST	192.168.2.7	62.118.20.46	5cc	Echo
Jul 26, 2024 02:27:47.899837017 CEST	192.168.2.7	62.118.208.121	5cb	Echo
Jul 26, 2024 02:27:47.930824995 CEST	192.168.2.7	62.118.139.70	5ca	Echo
Jul 26, 2024 02:27:47.961945057 CEST	192.168.2.7	62.118.95.55	5c9	Echo
Jul 26, 2024 02:27:47.993844986 CEST	192.168.2.7	62.118.24.108	5c8	Echo
Jul 26, 2024 02:27:47.993875027 CEST	192.168.2.7	62.118.56.146	5c7	Echo
Jul 26, 2024 02:27:47.995430946 CEST	192.168.2.7	62.118.168.214	5c6	Echo
Jul 26, 2024 02:27:47.995678902 CEST	192.168.2.7	62.118.90.241	5c5	Echo
Jul 26, 2024 02:27:47.995759964 CEST	192.168.2.7	62.118.14.109	5c4	Echo
Jul 26, 2024 02:27:47.995891094 CEST	192.168.2.7	62.118.2.69	5c3	Echo
Jul 26, 2024 02:27:47.995932102 CEST	192.168.2.7	62.118.172.202	5c2	Echo
Jul 26, 2024 02:27:47.996032953 CEST	192.168.2.7	62.118.50.153	5c1	Echo
Jul 26, 2024 02:27:47.996130943 CEST	192.168.2.7	62.118.160.24	5c0	Echo
Jul 26, 2024 02:27:47.996207952 CEST	192.168.2.7	62.118.54.159	5bf	Echo
Jul 26, 2024 02:27:47.996294022 CEST	192.168.2.7	62.118.156.54	5be	Echo
Jul 26, 2024 02:27:47.996377945 CEST	192.168.2.7	62.118.231.114	5bd	Echo
Jul 26, 2024 02:27:47.996459007 CEST	192.168.2.7	62.118.201.248	5bc	Echo
Jul 26, 2024 02:27:47.996543884 CEST	192.168.2.7	62.118.109.70	5bb	Echo
Jul 26, 2024 02:27:47.996640921 CEST	192.168.2.7	62.118.59.109	5ba	Echo
Jul 26, 2024 02:27:47.996745110 CEST	192.168.2.7	62.118.72.59	5b9	Echo
Jul 26, 2024 02:27:47.996834040 CEST	192.168.2.7	62.118.147.102	5b8	Echo
Jul 26, 2024 02:27:48.026607037 CEST	192.168.2.7	62.118.37.6	5b7	Echo
Jul 26, 2024 02:27:48.056237936 CEST	192.168.2.7	62.118.194.170	5b6	Echo
Jul 26, 2024 02:27:48.087161064 CEST	192.168.2.7	62.118.54.194	5b5	Echo
Jul 26, 2024 02:27:48.118169069 CEST	192.168.2.7	62.118.219.209	5b4	Echo
Jul 26, 2024 02:27:48.149501085 CEST	192.168.2.7	62.118.180.138	5b3	Echo
Jul 26, 2024 02:27:48.180948973 CEST	192.168.2.7	62.118.30.244	5b2	Echo
Jul 26, 2024 02:27:48.212151051 CEST	192.168.2.7	62.118.174.130	5b1	Echo
Jul 26, 2024 02:27:48.243407011 CEST	192.168.2.7	62.118.179.174	5b0	Echo
Jul 26, 2024 02:27:48.274614096 CEST	192.168.2.7	62.118.64.94	5af	Echo
Jul 26, 2024 02:27:48.305902958 CEST	192.168.2.7	62.118.59.71	5ae	Echo
Jul 26, 2024 02:27:48.337188005 CEST	192.168.2.7	62.118.221.66	5ad	Echo
Jul 26, 2024 02:27:48.371335030 CEST	192.168.2.7	62.118.51.146	5ac	Echo
Jul 26, 2024 02:27:48.399760008 CEST	192.168.2.7	62.118.63.22	5ab	Echo
Jul 26, 2024 02:27:48.438646078 CEST	192.168.2.7	62.118.38.226	5aa	Echo
Jul 26, 2024 02:27:48.462833881 CEST	192.168.2.7	62.118.221.142	5a9	Echo
Jul 26, 2024 02:27:48.494520903 CEST	192.168.2.7	62.118.107.221	5a8	Echo
Jul 26, 2024 02:27:48.497834921 CEST	192.168.2.7	62.118.158.15	5a7	Echo
Jul 26, 2024 02:27:48.497931957 CEST	192.168.2.7	62.118.157.190	5a6	Echo
Jul 26, 2024 02:27:48.498327971 CEST	192.168.2.7	62.118.67.246	5a5	Echo
Jul 26, 2024 02:27:48.498498917 CEST	192.168.2.7	62.118.128.169	5a4	Echo
Jul 26, 2024 02:27:48.498799086 CEST	192.168.2.7	62.118.250.228	5a3	Echo
Jul 26, 2024 02:27:48.498951912 CEST	192.168.2.7	62.118.62.244	5a2	Echo
Jul 26, 2024 02:27:48.499317884 CEST	192.168.2.7	62.118.11.50	5a1	Echo
Jul 26, 2024 02:27:48.499485016 CEST	192.168.2.7	62.118.143.149	5a0	Echo
Jul 26, 2024 02:27:48.499799013 CEST	192.168.2.7	62.118.167.197	59f	Echo
Jul 26, 2024 02:27:48.499914885 CEST	192.168.2.7	62.118.238.12	59e	Echo
Jul 26, 2024 02:27:48.500103951 CEST	192.168.2.7	62.118.190.237	59d	Echo
Jul 26, 2024 02:27:48.500387907 CEST	192.168.2.7	62.118.43.135	59c	Echo
Jul 26, 2024 02:27:48.500528097 CEST	192.168.2.7	62.118.142.43	59b	Echo
Jul 26, 2024 02:27:48.500824928 CEST	192.168.2.7	62.118.222.111	59a	Echo
Jul 26, 2024 02:27:48.500958920 CEST	192.168.2.7	62.118.111.47	599	Echo
Jul 26, 2024 02:27:48.524514914 CEST	192.168.2.7	62.118.116.108	598	Echo
Jul 26, 2024 02:27:48.555979013 CEST	192.168.2.7	62.118.81.117	597	Echo
Jul 26, 2024 02:27:48.587755919 CEST	192.168.2.7	62.118.49.168	596	Echo
Jul 26, 2024 02:27:48.618098021 CEST	192.168.2.7	62.118.190.143	595	Echo
Jul 26, 2024 02:27:48.649713993 CEST	192.168.2.7	62.118.34.205	594	Echo
Jul 26, 2024 02:27:48.681333065 CEST	192.168.2.7	62.118.103.255	593	Echo
Jul 26, 2024 02:27:48.713882923 CEST	192.168.2.7	62.118.249.2	592	Echo
Jul 26, 2024 02:27:48.743206978 CEST	192.168.2.7	62.118.31.229	591	Echo
Jul 26, 2024 02:27:48.808371067 CEST	62.118.249.2	192.168.2.7	d92	Echo Reply
Jul 26, 2024 02:27:48.829497099 CEST	192.168.2.7	62.118.152.15	590	Echo
Jul 26, 2024 02:27:48.829966068 CEST	192.168.2.7	62.118.249.2	58f	Echo
Jul 26, 2024 02:27:48.830249071 CEST	192.168.2.7	62.118.88.152	58e	Echo
Jul 26, 2024 02:27:48.856075048 CEST	192.168.2.7	62.118.86.88	58d	Echo
Jul 26, 2024 02:27:48.886218071 CEST	192.168.2.7	62.118.156.242	58c	Echo
Jul 26, 2024 02:27:48.915518999 CEST	192.168.2.7	62.118.199.243	58b	Echo
Jul 26, 2024 02:27:48.923660994 CEST	62.118.249.2	192.168.2.7	d8f	Echo Reply
Jul 26, 2024 02:27:48.956995010 CEST	192.168.2.7	62.118.147.157	58a	Echo
Jul 26, 2024 02:27:48.977782011 CEST	192.168.2.7	62.118.43.161	589	Echo
Jul 26, 2024 02:27:48.997992039 CEST	192.168.2.7	62.118.185.129	588	Echo
Jul 26, 2024 02:27:48.999293089 CEST	192.168.2.7	62.118.10.221	587	Echo
Jul 26, 2024 02:27:48.999368906 CEST	192.168.2.7	62.118.14.140	586	Echo
Jul 26, 2024 02:27:48.999471903 CEST	192.168.2.7	62.118.5.33	585	Echo
Jul 26, 2024 02:27:48.999542952 CEST	192.168.2.7	62.118.178.224	584	Echo
Jul 26, 2024 02:27:48.999629021 CEST	192.168.2.7	62.118.129.179	583	Echo
Jul 26, 2024 02:27:48.999710083 CEST	192.168.2.7	62.118.199.107	582	Echo
Jul 26, 2024 02:27:48.999789953 CEST	192.168.2.7	62.118.104.181	581	Echo
Jul 26, 2024 02:27:48.999875069 CEST	192.168.2.7	62.118.160.146	580	Echo
Jul 26, 2024 02:27:48.999958038 CEST	192.168.2.7	62.118.199.140	57f	Echo
Jul 26, 2024 02:27:49.000184059 CEST	192.168.2.7	62.118.23.179	57e	Echo
Jul 26, 2024 02:27:49.000271082 CEST	192.168.2.7	62.118.210.111	57d	Echo
Jul 26, 2024 02:27:49.000363111 CEST	192.168.2.7	62.118.77.240	57c	Echo
Jul 26, 2024 02:27:49.000446081 CEST	192.168.2.7	62.118.68.17	57b	Echo
Jul 26, 2024 02:27:49.000539064 CEST	192.168.2.7	62.118.154.203	57a	Echo
Jul 26, 2024 02:27:49.000633955 CEST	192.168.2.7	62.118.99.249	579	Echo
Jul 26, 2024 02:27:49.008876085 CEST	192.168.2.7	62.118.100.72	578	Echo
Jul 26, 2024 02:27:49.040107012 CEST	192.168.2.7	62.118.202.190	577	Echo
Jul 26, 2024 02:27:49.087737083 CEST	192.168.2.7	62.118.28.105	576	Echo
Jul 26, 2024 02:27:49.118767023 CEST	192.168.2.7	62.118.13.3	575	Echo
Jul 26, 2024 02:27:49.149539948 CEST	192.168.2.7	62.118.29.227	574	Echo
Jul 26, 2024 02:27:49.199161053 CEST	192.168.2.7	62.118.17.29	573	Echo
Jul 26, 2024 02:27:49.227823019 CEST	192.168.2.7	62.118.134.17	572	Echo
Jul 26, 2024 02:27:49.260627985 CEST	192.168.2.7	62.118.161.49	571	Echo
Jul 26, 2024 02:27:49.290179968 CEST	192.168.2.7	62.118.199.146	570	Echo
Jul 26, 2024 02:27:49.321269989 CEST	192.168.2.7	62.118.78.188	56f	Echo
Jul 26, 2024 02:27:49.352611065 CEST	192.168.2.7	62.118.60.237	56e	Echo
Jul 26, 2024 02:27:49.383891106 CEST	192.168.2.7	62.118.252.246	56d	Echo
Jul 26, 2024 02:27:49.415081024 CEST	192.168.2.7	62.118.247.151	56c	Echo
Jul 26, 2024 02:27:49.446974039 CEST	192.168.2.7	62.118.82.66	56b	Echo
Jul 26, 2024 02:27:49.477579117 CEST	192.168.2.7	62.118.19.247	56a	Echo
Jul 26, 2024 02:27:49.493732929 CEST	192.168.2.7	62.118.19.75	569	Echo
Jul 26, 2024 02:27:49.495119095 CEST	192.168.2.7	62.118.73.249	568	Echo
Jul 26, 2024 02:27:49.495156050 CEST	192.168.2.7	62.118.25.138	567	Echo
Jul 26, 2024 02:27:49.495242119 CEST	192.168.2.7	62.118.139.165	566	Echo
Jul 26, 2024 02:27:49.495373011 CEST	192.168.2.7	62.118.18.37	565	Echo
Jul 26, 2024 02:27:49.495460033 CEST	192.168.2.7	62.118.55.152	564	Echo
Jul 26, 2024 02:27:49.495532036 CEST	192.168.2.7	62.118.9.83	563	Echo
Jul 26, 2024 02:27:49.495632887 CEST	192.168.2.7	62.118.39.15	562	Echo
Jul 26, 2024 02:27:49.495779037 CEST	192.168.2.7	62.118.28.49	561	Echo
Jul 26, 2024 02:27:49.495874882 CEST	192.168.2.7	62.118.172.64	560	Echo
Jul 26, 2024 02:27:49.495974064 CEST	192.168.2.7	62.118.242.128	55f	Echo
Jul 26, 2024 02:27:49.496073961 CEST	192.168.2.7	62.118.71.242	55e	Echo
Jul 26, 2024 02:27:49.496212006 CEST	192.168.2.7	62.118.20.46	55d	Echo
Jul 26, 2024 02:27:49.496227026 CEST	192.168.2.7	62.118.208.121	55c	Echo
Jul 26, 2024 02:27:49.496313095 CEST	192.168.2.7	62.118.139.70	55b	Echo
Jul 26, 2024 02:27:49.496361971 CEST	192.168.2.7	62.118.95.55	55a	Echo
Jul 26, 2024 02:27:49.508719921 CEST	192.168.2.7	62.118.234.157	559	Echo
Jul 26, 2024 02:27:49.540039062 CEST	192.168.2.7	62.118.101.209	558	Echo
Jul 26, 2024 02:27:49.571556091 CEST	192.168.2.7	62.118.4.75	557	Echo
Jul 26, 2024 02:27:49.602504969 CEST	192.168.2.7	62.118.102.96	556	Echo
Jul 26, 2024 02:27:49.633975029 CEST	192.168.2.7	62.118.108.5	555	Echo
Jul 26, 2024 02:27:49.665124893 CEST	192.168.2.7	62.118.53.32	554	Echo
Jul 26, 2024 02:27:49.696181059 CEST	192.168.2.7	62.118.87.76	553	Echo
Jul 26, 2024 02:27:49.727524996 CEST	192.168.2.7	62.118.233.216	552	Echo
Jul 26, 2024 02:27:49.758793116 CEST	192.168.2.7	62.118.18.187	551	Echo
Jul 26, 2024 02:27:49.790510893 CEST	192.168.2.7	62.118.22.103	550	Echo
Jul 26, 2024 02:27:49.821382999 CEST	192.168.2.7	62.118.17.20	54f	Echo
Jul 26, 2024 02:27:49.852545023 CEST	192.168.2.7	62.118.223.50	54e	Echo
Jul 26, 2024 02:27:49.883887053 CEST	192.168.2.7	62.118.147.192	54d	Echo
Jul 26, 2024 02:27:49.915067911 CEST	192.168.2.7	62.118.91.255	54c	Echo
Jul 26, 2024 02:27:49.946409941 CEST	192.168.2.7	62.118.241.84	54b	Echo
Jul 26, 2024 02:27:49.977602005 CEST	192.168.2.7	62.118.93.240	54a	Echo
Jul 26, 2024 02:27:49.993196964 CEST	192.168.2.7	62.118.24.108	549	Echo
Jul 26, 2024 02:27:49.994987011 CEST	192.168.2.7	62.118.194.170	547	Echo
Jul 26, 2024 02:27:49.994987011 CEST	192.168.2.7	62.118.37.6	548	Echo
Jul 26, 2024 02:27:49.995029926 CEST	192.168.2.7	62.118.54.194	546	Echo
Jul 26, 2024 02:27:49.995031118 CEST	192.168.2.7	62.118.219.209	545	Echo
Jul 26, 2024 02:27:49.995110989 CEST	192.168.2.7	62.118.180.138	544	Echo
Jul 26, 2024 02:27:49.995162010 CEST	192.168.2.7	62.118.30.244	543	Echo
Jul 26, 2024 02:27:49.995208025 CEST	192.168.2.7	62.118.174.130	542	Echo
Jul 26, 2024 02:27:49.995290041 CEST	192.168.2.7	62.118.179.174	541	Echo
Jul 26, 2024 02:27:49.995328903 CEST	192.168.2.7	62.118.64.94	540	Echo
Jul 26, 2024 02:27:49.995412111 CEST	192.168.2.7	62.118.59.71	53f	Echo
Jul 26, 2024 02:27:49.995465040 CEST	192.168.2.7	62.118.221.66	53e	Echo
Jul 26, 2024 02:27:49.995532036 CEST	192.168.2.7	62.118.51.146	53d	Echo
Jul 26, 2024 02:27:49.995584965 CEST	192.168.2.7	62.118.63.22	53c	Echo
Jul 26, 2024 02:27:49.995650053 CEST	192.168.2.7	62.118.38.226	53b	Echo
Jul 26, 2024 02:27:49.995693922 CEST	192.168.2.7	62.118.221.142	53a	Echo
Jul 26, 2024 02:27:50.009269953 CEST	192.168.2.7	62.118.115.249	539	Echo
Jul 26, 2024 02:27:50.040091038 CEST	192.168.2.7	62.118.69.213	538	Echo
Jul 26, 2024 02:27:50.071280956 CEST	192.168.2.7	62.118.29.155	537	Echo
Jul 26, 2024 02:27:50.102485895 CEST	192.168.2.7	62.118.86.34	536	Echo
Jul 26, 2024 02:27:50.134095907 CEST	192.168.2.7	62.118.220.85	535	Echo
Jul 26, 2024 02:27:50.165112019 CEST	192.168.2.7	62.118.41.125	534	Echo
Jul 26, 2024 02:27:50.196321011 CEST	192.168.2.7	62.118.26.71	533	Echo
Jul 26, 2024 02:27:50.227529049 CEST	192.168.2.7	62.118.107.51	532	Echo
Jul 26, 2024 02:27:50.259144068 CEST	192.168.2.7	62.118.148.202	531	Echo
Jul 26, 2024 02:27:50.289999008 CEST	192.168.2.7	62.118.37.173	530	Echo
Jul 26, 2024 02:27:50.321325064 CEST	192.168.2.7	62.118.15.95	52f	Echo
Jul 26, 2024 02:27:50.352575064 CEST	192.168.2.7	62.118.51.15	52e	Echo
Jul 26, 2024 02:27:50.383838892 CEST	192.168.2.7	62.118.73.51	52d	Echo
Jul 26, 2024 02:27:50.415100098 CEST	192.168.2.7	62.118.133.64	52c	Echo
Jul 26, 2024 02:27:50.446939945 CEST	192.168.2.7	62.118.86.166	52b	Echo
Jul 26, 2024 02:27:50.455085993 CEST	192.168.2.7	62.118.133.64	52a	Echo
Jul 26, 2024 02:27:50.489928961 CEST	192.168.2.7	62.118.57.231	529	Echo
Jul 26, 2024 02:27:50.493588924 CEST	192.168.2.7	62.118.107.221	528	Echo
Jul 26, 2024 02:27:50.496525049 CEST	192.168.2.7	62.118.116.108	527	Echo
Jul 26, 2024 02:27:50.496758938 CEST	192.168.2.7	62.118.81.117	526	Echo
Jul 26, 2024 02:27:50.496982098 CEST	192.168.2.7	62.118.49.168	525	Echo
Jul 26, 2024 02:27:50.497031927 CEST	192.168.2.7	62.118.190.143	524	Echo
Jul 26, 2024 02:27:50.497246027 CEST	192.168.2.7	62.118.34.205	523	Echo
Jul 26, 2024 02:27:50.497550011 CEST	192.168.2.7	62.118.103.255	522	Echo
Jul 26, 2024 02:27:50.497658968 CEST	192.168.2.7	62.118.31.229	521	Echo
Jul 26, 2024 02:27:50.497746944 CEST	192.168.2.7	62.118.152.15	520	Echo
Jul 26, 2024 02:27:50.497957945 CEST	192.168.2.7	62.118.88.152	51f	Echo
Jul 26, 2024 02:27:50.498162031 CEST	192.168.2.7	62.118.86.88	51e	Echo
Jul 26, 2024 02:27:50.498334885 CEST	192.168.2.7	62.118.156.242	51d	Echo
Jul 26, 2024 02:27:50.498563051 CEST	192.168.2.7	62.118.199.243	51c	Echo
Jul 26, 2024 02:27:50.498668909 CEST	192.168.2.7	62.118.147.157	51b	Echo
Jul 26, 2024 02:27:50.498776913 CEST	192.168.2.7	62.118.43.161	51a	Echo
Jul 26, 2024 02:27:50.508970976 CEST	192.168.2.7	62.118.193.186	519	Echo
Jul 26, 2024 02:27:50.540082932 CEST	192.168.2.7	62.118.38.63	518	Echo
Jul 26, 2024 02:27:50.571230888 CEST	192.168.2.7	62.118.151.22	517	Echo
Jul 26, 2024 02:27:50.602519035 CEST	192.168.2.7	62.118.46.15	516	Echo
Jul 26, 2024 02:27:50.633702993 CEST	192.168.2.7	62.118.61.19	515	Echo
Jul 26, 2024 02:27:50.665143013 CEST	192.168.2.7	62.118.47.91	514	Echo
Jul 26, 2024 02:27:50.696530104 CEST	192.168.2.7	62.118.89.4	513	Echo
Jul 26, 2024 02:27:50.727720976 CEST	192.168.2.7	62.118.57.26	512	Echo
Jul 26, 2024 02:27:50.758945942 CEST	192.168.2.7	62.118.255.28	511	Echo
Jul 26, 2024 02:27:50.790611982 CEST	192.168.2.7	62.118.174.68	510	Echo
Jul 26, 2024 02:27:50.821461916 CEST	192.168.2.7	62.118.213.159	50f	Echo
Jul 26, 2024 02:27:50.853790045 CEST	192.168.2.7	62.118.103.96	50e	Echo
Jul 26, 2024 02:27:50.883902073 CEST	192.168.2.7	62.118.90.143	50d	Echo
Jul 26, 2024 02:27:50.915241003 CEST	192.168.2.7	62.118.151.38	50c	Echo
Jul 26, 2024 02:27:50.946428061 CEST	192.168.2.7	62.118.115.188	50b	Echo
Jul 26, 2024 02:27:50.977643967 CEST	192.168.2.7	62.118.196.236	50a	Echo
Jul 26, 2024 02:27:50.995003939 CEST	192.168.2.7	62.118.100.72	509	Echo
Jul 26, 2024 02:27:50.995027065 CEST	192.168.2.7	62.118.202.190	508	Echo
Jul 26, 2024 02:27:50.995181084 CEST	192.168.2.7	62.118.13.3	506	Echo
Jul 26, 2024 02:27:50.995187044 CEST	192.168.2.7	62.118.28.105	507	Echo
Jul 26, 2024 02:27:50.995321035 CEST	192.168.2.7	62.118.29.227	505	Echo
Jul 26, 2024 02:27:50.995353937 CEST	192.168.2.7	62.118.17.29	504	Echo
Jul 26, 2024 02:27:50.995445013 CEST	192.168.2.7	62.118.134.17	503	Echo
Jul 26, 2024 02:27:50.995491028 CEST	192.168.2.7	62.118.161.49	502	Echo
Jul 26, 2024 02:27:50.995539904 CEST	192.168.2.7	62.118.199.146	501	Echo
Jul 26, 2024 02:27:50.995600939 CEST	192.168.2.7	62.118.78.188	500	Echo
Jul 26, 2024 02:27:50.995663881 CEST	192.168.2.7	62.118.60.237	4ff	Echo
Jul 26, 2024 02:27:50.995709896 CEST	192.168.2.7	62.118.252.246	4fe	Echo
Jul 26, 2024 02:27:50.995760918 CEST	192.168.2.7	62.118.247.151	4fd	Echo
Jul 26, 2024 02:27:50.995800018 CEST	192.168.2.7	62.118.82.66	4fc	Echo
Jul 26, 2024 02:27:50.995853901 CEST	192.168.2.7	62.118.19.247	4fb	Echo
Jul 26, 2024 02:27:51.008856058 CEST	192.168.2.7	62.118.137.73	4fa	Echo
Jul 26, 2024 02:27:51.040154934 CEST	192.168.2.7	62.118.154.125	4f9	Echo
Jul 26, 2024 02:27:51.071301937 CEST	192.168.2.7	62.118.7.3	4f8	Echo
Jul 26, 2024 02:27:51.102679968 CEST	192.168.2.7	62.118.169.158	4f7	Echo
Jul 26, 2024 02:27:51.133960009 CEST	192.168.2.7	62.118.225.244	4f6	Echo
Jul 26, 2024 02:27:51.165087938 CEST	192.168.2.7	62.118.79.74	4f5	Echo
Jul 26, 2024 02:27:51.196176052 CEST	192.168.2.7	62.118.96.253	4f4	Echo
Jul 26, 2024 02:27:51.228071928 CEST	192.168.2.7	62.118.108.96	4f3	Echo
Jul 26, 2024 02:27:51.258800983 CEST	192.168.2.7	62.118.39.122	4f2	Echo
Jul 26, 2024 02:27:51.290036917 CEST	192.168.2.7	62.118.82.150	4f1	Echo
Jul 26, 2024 02:27:51.321723938 CEST	192.168.2.7	62.118.123.153	4f0	Echo
Jul 26, 2024 02:27:51.352590084 CEST	192.168.2.7	62.118.195.218	4ef	Echo
Jul 26, 2024 02:27:51.388278008 CEST	192.168.2.7	62.118.139.122	4ee	Echo
Jul 26, 2024 02:27:51.415848017 CEST	192.168.2.7	62.118.133.25	4ed	Echo
Jul 26, 2024 02:27:51.474529982 CEST	192.168.2.7	62.118.11.133	4ec	Echo
Jul 26, 2024 02:27:51.525593042 CEST	192.168.2.7	62.118.173.176	4eb	Echo
Jul 26, 2024 02:27:51.546181917 CEST	192.168.2.7	62.118.77.120	4ea	Echo
Jul 26, 2024 02:27:51.568447113 CEST	192.168.2.7	62.118.234.157	4e9	Echo
Jul 26, 2024 02:27:51.568675041 CEST	192.168.2.7	62.118.101.209	4e8	Echo
Jul 26, 2024 02:27:51.568775892 CEST	192.168.2.7	62.118.4.75	4e7	Echo
Jul 26, 2024 02:27:51.569267988 CEST	192.168.2.7	62.118.102.96	4e6	Echo
Jul 26, 2024 02:27:51.569468975 CEST	192.168.2.7	62.118.108.5	4e5	Echo
Jul 26, 2024 02:27:51.569555044 CEST	192.168.2.7	62.118.53.32	4e4	Echo
Jul 26, 2024 02:27:51.569891930 CEST	192.168.2.7	62.118.87.76	4e3	Echo
Jul 26, 2024 02:27:51.570245028 CEST	192.168.2.7	62.118.233.216	4e2	Echo
Jul 26, 2024 02:27:51.570342064 CEST	192.168.2.7	62.118.18.187	4e1	Echo
Jul 26, 2024 02:27:51.570420980 CEST	192.168.2.7	62.118.22.103	4e0	Echo
Jul 26, 2024 02:27:51.570763111 CEST	192.168.2.7	62.118.17.20	4df	Echo
Jul 26, 2024 02:27:51.570880890 CEST	192.168.2.7	62.118.223.50	4de	Echo
Jul 26, 2024 02:27:51.571012020 CEST	192.168.2.7	62.118.147.192	4dd	Echo
Jul 26, 2024 02:27:51.571470976 CEST	192.168.2.7	62.118.91.255	4dc	Echo
Jul 26, 2024 02:27:51.571640968 CEST	192.168.2.7	62.118.48.115	4db	Echo
Jul 26, 2024 02:27:51.571715117 CEST	192.168.2.7	62.118.241.84	4da	Echo
Jul 26, 2024 02:27:51.571871996 CEST	192.168.2.7	62.118.93.240	4d9	Echo
Jul 26, 2024 02:27:51.605829000 CEST	192.168.2.7	62.118.91.48	4d8	Echo
Jul 26, 2024 02:27:51.633836031 CEST	192.168.2.7	62.118.250.95	4d7	Echo
Jul 26, 2024 02:27:51.665524006 CEST	192.168.2.7	62.118.189.239	4d6	Echo
Jul 26, 2024 02:27:51.697206974 CEST	192.168.2.7	62.118.130.64	4d5	Echo
Jul 26, 2024 02:27:51.728461027 CEST	192.168.2.7	62.118.140.168	4d4	Echo
Jul 26, 2024 02:27:51.760345936 CEST	192.168.2.7	62.118.43.71	4d3	Echo
Jul 26, 2024 02:27:51.790965080 CEST	192.168.2.7	62.118.31.126	4d2	Echo
Jul 26, 2024 02:27:51.823046923 CEST	192.168.2.7	62.118.211.229	4d1	Echo
Jul 26, 2024 02:27:51.922106981 CEST	192.168.2.7	62.118.9.155	4d0	Echo
Jul 26, 2024 02:27:51.950248003 CEST	192.168.2.7	62.118.141.185	4cf	Echo
Jul 26, 2024 02:27:51.977829933 CEST	192.168.2.7	62.118.93.189	4ce	Echo
Jul 26, 2024 02:27:51.995615005 CEST	192.168.2.7	62.118.115.249	4cd	Echo
Jul 26, 2024 02:27:51.995630026 CEST	192.168.2.7	62.118.69.213	4cc	Echo
Jul 26, 2024 02:27:51.995824099 CEST	192.168.2.7	62.118.29.155	4cb	Echo
Jul 26, 2024 02:27:51.995918036 CEST	192.168.2.7	62.118.86.34	4ca	Echo
Jul 26, 2024 02:27:51.995990038 CEST	192.168.2.7	62.118.220.85	4c9	Echo
Jul 26, 2024 02:27:51.996148109 CEST	192.168.2.7	62.118.41.125	4c8	Echo
Jul 26, 2024 02:27:51.996165991 CEST	192.168.2.7	62.118.26.71	4c7	Echo
Jul 26, 2024 02:27:51.996279955 CEST	192.168.2.7	62.118.107.51	4c6	Echo
Jul 26, 2024 02:27:51.996316910 CEST	192.168.2.7	62.118.148.202	4c5	Echo
Jul 26, 2024 02:27:51.996402025 CEST	192.168.2.7	62.118.37.173	4c4	Echo
Jul 26, 2024 02:27:51.996524096 CEST	192.168.2.7	62.118.15.95	4c3	Echo
Jul 26, 2024 02:27:51.996699095 CEST	192.168.2.7	62.118.51.15	4c2	Echo
Jul 26, 2024 02:27:51.996788025 CEST	192.168.2.7	62.118.73.51	4c1	Echo
Jul 26, 2024 02:27:51.996925116 CEST	192.168.2.7	62.118.86.166	4c0	Echo
Jul 26, 2024 02:27:51.997163057 CEST	192.168.2.7	62.118.57.231	4bf	Echo
Jul 26, 2024 02:27:52.011362076 CEST	192.168.2.7	62.118.10.71	4be	Echo
Jul 26, 2024 02:27:52.040246010 CEST	192.168.2.7	62.118.161.53	4bd	Echo
Jul 26, 2024 02:27:52.071378946 CEST	192.168.2.7	62.118.45.57	4bc	Echo
Jul 26, 2024 02:27:52.102714062 CEST	192.168.2.7	62.118.153.199	4bb	Echo
Jul 26, 2024 02:27:52.133795023 CEST	192.168.2.7	62.118.11.130	4ba	Echo
Jul 26, 2024 02:27:52.167031050 CEST	192.168.2.7	62.118.126.105	4b9	Echo
Jul 26, 2024 02:27:52.198749065 CEST	192.168.2.7	62.118.42.174	4b8	Echo
Jul 26, 2024 02:27:52.227905035 CEST	192.168.2.7	62.118.15.91	4b7	Echo
Jul 26, 2024 02:27:52.259032011 CEST	192.168.2.7	62.118.203.215	4b6	Echo
Jul 26, 2024 02:27:52.290313005 CEST	192.168.2.7	62.118.16.37	4b5	Echo
Jul 26, 2024 02:27:52.321490049 CEST	192.168.2.7	62.118.4.52	4b4	Echo
Jul 26, 2024 02:27:52.352669954 CEST	192.168.2.7	62.118.102.85	4b3	Echo
Jul 26, 2024 02:27:52.384074926 CEST	192.168.2.7	62.118.150.95	4b2	Echo
Jul 26, 2024 02:27:52.415395975 CEST	192.168.2.7	62.118.11.26	4b1	Echo
Jul 26, 2024 02:27:52.446418047 CEST	192.168.2.7	62.118.89.3	4b0	Echo
Jul 26, 2024 02:27:52.477897882 CEST	192.168.2.7	62.118.57.34	4af	Echo
Jul 26, 2024 02:27:52.497941017 CEST	192.168.2.7	62.118.193.186	4ae	Echo
Jul 26, 2024 02:27:52.498068094 CEST	192.168.2.7	62.118.38.63	4ad	Echo
Jul 26, 2024 02:27:52.498106956 CEST	192.168.2.7	62.118.151.22	4ac	Echo
Jul 26, 2024 02:27:52.498224020 CEST	192.168.2.7	62.118.46.15	4ab	Echo
Jul 26, 2024 02:27:52.498274088 CEST	192.168.2.7	62.118.61.19	4aa	Echo
Jul 26, 2024 02:27:52.498368025 CEST	192.168.2.7	62.118.47.91	4a9	Echo
Jul 26, 2024 02:27:52.498470068 CEST	192.168.2.7	62.118.89.4	4a8	Echo
Jul 26, 2024 02:27:52.498596907 CEST	192.168.2.7	62.118.57.26	4a7	Echo
Jul 26, 2024 02:27:52.498632908 CEST	192.168.2.7	62.118.255.28	4a6	Echo
Jul 26, 2024 02:27:52.498722076 CEST	192.168.2.7	62.118.174.68	4a5	Echo
Jul 26, 2024 02:27:52.498771906 CEST	192.168.2.7	62.118.213.159	4a4	Echo
Jul 26, 2024 02:27:52.498904943 CEST	192.168.2.7	62.118.103.96	4a3	Echo
Jul 26, 2024 02:27:52.498986959 CEST	192.168.2.7	62.118.90.143	4a2	Echo
Jul 26, 2024 02:27:52.499074936 CEST	192.168.2.7	62.118.151.38	4a1	Echo
Jul 26, 2024 02:27:52.499118090 CEST	192.168.2.7	62.118.115.188	4a0	Echo
Jul 26, 2024 02:27:52.499247074 CEST	192.168.2.7	62.118.196.236	49f	Echo
Jul 26, 2024 02:27:52.530349970 CEST	192.168.2.7	62.118.4.218	49e	Echo
Jul 26, 2024 02:27:52.542808056 CEST	192.168.2.7	62.118.215.94	49d	Echo
Jul 26, 2024 02:27:52.571885109 CEST	192.168.2.7	62.118.192.235	49c	Echo
Jul 26, 2024 02:27:52.602639914 CEST	192.168.2.7	62.118.197.174	49b	Echo
Jul 26, 2024 02:27:52.634272099 CEST	192.168.2.7	62.118.239.197	49a	Echo
Jul 26, 2024 02:27:52.665302038 CEST	192.168.2.7	62.118.13.240	499	Echo
Jul 26, 2024 02:27:52.696661949 CEST	192.168.2.7	62.118.240.41	498	Echo
Jul 26, 2024 02:27:52.727931976 CEST	192.168.2.7	62.118.153.24	497	Echo
Jul 26, 2024 02:27:52.758950949 CEST	192.168.2.7	62.118.84.163	496	Echo
Jul 26, 2024 02:27:52.790153027 CEST	192.168.2.7	62.118.33.228	495	Echo
Jul 26, 2024 02:27:52.821475983 CEST	192.168.2.7	62.118.77.150	494	Echo
Jul 26, 2024 02:27:52.853444099 CEST	192.168.2.7	62.118.203.186	493	Echo
Jul 26, 2024 02:27:52.884150028 CEST	192.168.2.7	62.118.41.63	492	Echo
Jul 26, 2024 02:27:52.915683985 CEST	192.168.2.7	62.118.121.98	491	Echo
Jul 26, 2024 02:27:52.946543932 CEST	192.168.2.7	62.118.35.215	490	Echo
Jul 26, 2024 02:27:52.977847099 CEST	192.168.2.7	62.118.232.94	48f	Echo
Jul 26, 2024 02:27:52.994873047 CEST	192.168.2.7	62.118.137.73	48e	Echo
Jul 26, 2024 02:27:52.994873047 CEST	192.168.2.7	62.118.154.125	48d	Echo
Jul 26, 2024 02:27:52.994920969 CEST	192.168.2.7	62.118.7.3	48c	Echo
Jul 26, 2024 02:27:52.994959116 CEST	192.168.2.7	62.118.169.158	48b	Echo
Jul 26, 2024 02:27:52.995074987 CEST	192.168.2.7	62.118.225.244	48a	Echo
Jul 26, 2024 02:27:52.995142937 CEST	192.168.2.7	62.118.79.74	489	Echo
Jul 26, 2024 02:27:52.995210886 CEST	192.168.2.7	62.118.96.253	488	Echo
Jul 26, 2024 02:27:52.995352030 CEST	192.168.2.7	62.118.108.96	487	Echo
Jul 26, 2024 02:27:52.995393991 CEST	192.168.2.7	62.118.39.122	486	Echo
Jul 26, 2024 02:27:52.995480061 CEST	192.168.2.7	62.118.82.150	485	Echo
Jul 26, 2024 02:27:52.995534897 CEST	192.168.2.7	62.118.123.153	484	Echo
Jul 26, 2024 02:27:52.995609999 CEST	192.168.2.7	62.118.195.218	483	Echo
Jul 26, 2024 02:27:52.995675087 CEST	192.168.2.7	62.118.139.122	482	Echo
Jul 26, 2024 02:27:52.995738983 CEST	192.168.2.7	62.118.133.25	481	Echo
Jul 26, 2024 02:27:52.995795965 CEST	192.168.2.7	62.118.11.133	480	Echo
Jul 26, 2024 02:27:53.008886099 CEST	192.168.2.7	62.118.28.195	47f	Echo
Jul 26, 2024 02:27:53.040370941 CEST	192.168.2.7	62.118.197.249	47e	Echo
Jul 26, 2024 02:27:53.071671963 CEST	192.168.2.7	62.118.0.248	47d	Echo
Jul 26, 2024 02:27:53.102669001 CEST	192.168.2.7	62.118.33.135	47c	Echo
Jul 26, 2024 02:27:53.134104967 CEST	192.168.2.7	62.118.38.218	47b	Echo
Jul 26, 2024 02:27:53.165064096 CEST	192.168.2.7	62.118.68.253	47a	Echo
Jul 26, 2024 02:27:53.196455002 CEST	192.168.2.7	62.118.132.183	479	Echo
Jul 26, 2024 02:27:53.228400946 CEST	192.168.2.7	62.118.175.55	478	Echo
Jul 26, 2024 02:27:53.262340069 CEST	192.168.2.7	62.118.175.57	477	Echo
Jul 26, 2024 02:27:53.296375990 CEST	192.168.2.7	62.118.36.174	476	Echo
Jul 26, 2024 02:27:53.324986935 CEST	192.168.2.7	62.118.83.245	475	Echo
Jul 26, 2024 02:27:53.352763891 CEST	192.168.2.7	62.118.253.229	474	Echo
Jul 26, 2024 02:27:53.384017944 CEST	192.168.2.7	62.118.108.155	473	Echo
Jul 26, 2024 02:27:53.415363073 CEST	192.168.2.7	62.118.55.96	472	Echo
Jul 26, 2024 02:27:53.446348906 CEST	192.168.2.7	62.118.22.23	471	Echo
Jul 26, 2024 02:27:53.477899075 CEST	192.168.2.7	62.118.84.193	470	Echo
Jul 26, 2024 02:27:53.493597031 CEST	192.168.2.7	62.118.173.176	46f	Echo
Jul 26, 2024 02:27:53.494013071 CEST	192.168.2.7	62.118.77.120	46e	Echo
Jul 26, 2024 02:27:53.495594025 CEST	192.168.2.7	62.118.48.115	46d	Echo
Jul 26, 2024 02:27:53.495960951 CEST	192.168.2.7	62.118.91.48	46c	Echo
Jul 26, 2024 02:27:53.496083975 CEST	192.168.2.7	62.118.250.95	46b	Echo
Jul 26, 2024 02:27:53.496129036 CEST	192.168.2.7	62.118.189.239	46a	Echo
Jul 26, 2024 02:27:53.496210098 CEST	192.168.2.7	62.118.130.64	469	Echo
Jul 26, 2024 02:27:53.496320963 CEST	192.168.2.7	62.118.140.168	468	Echo
Jul 26, 2024 02:27:53.496413946 CEST	192.168.2.7	62.118.43.71	467	Echo
Jul 26, 2024 02:27:53.496535063 CEST	192.168.2.7	62.118.31.126	466	Echo
Jul 26, 2024 02:27:53.496596098 CEST	192.168.2.7	62.118.211.229	465	Echo
Jul 26, 2024 02:27:53.496685028 CEST	192.168.2.7	62.118.9.155	464	Echo
Jul 26, 2024 02:27:53.496789932 CEST	192.168.2.7	62.118.141.185	463	Echo
Jul 26, 2024 02:27:53.496963978 CEST	192.168.2.7	62.118.93.189	462	Echo
Jul 26, 2024 02:27:53.509454966 CEST	192.168.2.7	62.118.221.84	461	Echo
Jul 26, 2024 02:27:53.541090965 CEST	192.168.2.7	62.118.204.220	460	Echo
Jul 26, 2024 02:27:53.572869062 CEST	192.168.2.7	62.118.194.10	45f	Echo
Jul 26, 2024 02:27:53.602778912 CEST	192.168.2.7	62.118.232.175	45e	Echo
Jul 26, 2024 02:27:53.634023905 CEST	192.168.2.7	62.118.57.181	45d	Echo
Jul 26, 2024 02:27:53.665476084 CEST	192.168.2.7	62.118.12.39	45c	Echo
Jul 26, 2024 02:27:53.696984053 CEST	192.168.2.7	62.118.83.57	45b	Echo
Jul 26, 2024 02:27:53.728192091 CEST	192.168.2.7	62.118.6.206	45a	Echo
Jul 26, 2024 02:27:53.753973961 CEST	192.168.2.7	62.118.143.162	459	Echo
Jul 26, 2024 02:27:53.774806976 CEST	192.168.2.7	62.118.71.149	458	Echo
Jul 26, 2024 02:27:53.806672096 CEST	192.168.2.7	62.118.228.185	457	Echo
Jul 26, 2024 02:27:53.837186098 CEST	192.168.2.7	62.118.104.196	456	Echo
Jul 26, 2024 02:27:53.871474981 CEST	192.168.2.7	62.118.36.108	455	Echo
Jul 26, 2024 02:27:53.900554895 CEST	192.168.2.7	62.118.67.19	454	Echo
Jul 26, 2024 02:27:53.932518959 CEST	192.168.2.7	62.118.219.246	453	Echo
Jul 26, 2024 02:27:53.962546110 CEST	192.168.2.7	62.118.143.106	452	Echo
Jul 26, 2024 02:27:53.995455980 CEST	192.168.2.7	62.118.140.179	451	Echo
Jul 26, 2024 02:27:54.003988028 CEST	192.168.2.7	62.118.10.71	450	Echo
Jul 26, 2024 02:27:54.004422903 CEST	192.168.2.7	62.118.161.53	44f	Echo
Jul 26, 2024 02:27:54.004959106 CEST	192.168.2.7	62.118.45.57	44e	Echo
Jul 26, 2024 02:27:54.005100965 CEST	192.168.2.7	62.118.153.199	44d	Echo
Jul 26, 2024 02:27:54.005572081 CEST	192.168.2.7	62.118.11.130	44c	Echo
Jul 26, 2024 02:27:54.005784988 CEST	192.168.2.7	62.118.126.105	44b	Echo
Jul 26, 2024 02:27:54.005872011 CEST	192.168.2.7	62.118.42.174	44a	Echo
Jul 26, 2024 02:27:54.006326914 CEST	192.168.2.7	62.118.15.91	449	Echo
Jul 26, 2024 02:27:54.006439924 CEST	192.168.2.7	62.118.203.215	448	Echo
Jul 26, 2024 02:27:54.006719112 CEST	192.168.2.7	62.118.16.37	447	Echo
Jul 26, 2024 02:27:54.006921053 CEST	192.168.2.7	62.118.4.52	446	Echo
Jul 26, 2024 02:27:54.007071018 CEST	192.168.2.7	62.118.102.85	445	Echo
Jul 26, 2024 02:27:54.007297993 CEST	192.168.2.7	62.118.150.95	444	Echo
Jul 26, 2024 02:27:54.007586956 CEST	192.168.2.7	62.118.11.26	443	Echo
Jul 26, 2024 02:27:54.007734060 CEST	192.168.2.7	62.118.89.3	442	Echo
Jul 26, 2024 02:27:54.008353949 CEST	192.168.2.7	62.118.57.34	441	Echo
Jul 26, 2024 02:27:54.024610043 CEST	192.168.2.7	62.118.117.52	440	Echo
Jul 26, 2024 02:27:54.056417942 CEST	192.168.2.7	62.118.112.117	43f	Echo
Jul 26, 2024 02:27:54.087445974 CEST	192.168.2.7	62.118.213.111	43e	Echo
Jul 26, 2024 02:27:54.118566036 CEST	192.168.2.7	62.118.180.167	43d	Echo
Jul 26, 2024 02:27:54.149735928 CEST	192.168.2.7	62.118.86.201	43c	Echo
Jul 26, 2024 02:27:54.181036949 CEST	192.168.2.7	62.118.56.88	43b	Echo
Jul 26, 2024 02:27:54.212342024 CEST	192.168.2.7	62.118.115.66	43a	Echo
Jul 26, 2024 02:27:54.243313074 CEST	192.168.2.7	62.118.101.115	439	Echo
Jul 26, 2024 02:27:54.275715113 CEST	192.168.2.7	62.118.232.100	438	Echo
Jul 26, 2024 02:27:54.307837963 CEST	192.168.2.7	62.118.29.109	437	Echo
Jul 26, 2024 02:27:54.338980913 CEST	192.168.2.7	62.118.208.245	436	Echo
Jul 26, 2024 02:27:54.369092941 CEST	192.168.2.7	62.118.60.249	435	Echo
Jul 26, 2024 02:27:54.400301933 CEST	192.168.2.7	62.118.119.207	434	Echo
Jul 26, 2024 02:27:54.431315899 CEST	192.168.2.7	62.118.96.135	433	Echo
Jul 26, 2024 02:27:54.463586092 CEST	192.168.2.7	62.118.54.105	432	Echo
Jul 26, 2024 02:27:54.499277115 CEST	192.168.2.7	62.118.36.189	431	Echo
Jul 26, 2024 02:27:54.503274918 CEST	192.168.2.7	62.118.4.218	430	Echo
Jul 26, 2024 02:27:54.503379107 CEST	192.168.2.7	62.118.215.94	42f	Echo
Jul 26, 2024 02:27:54.503449917 CEST	192.168.2.7	62.118.192.235	42e	Echo
Jul 26, 2024 02:27:54.503599882 CEST	192.168.2.7	62.118.197.174	42d	Echo
Jul 26, 2024 02:27:54.503648996 CEST	192.168.2.7	62.118.239.197	42c	Echo
Jul 26, 2024 02:27:54.503774881 CEST	192.168.2.7	62.118.13.240	42b	Echo
Jul 26, 2024 02:27:54.503982067 CEST	192.168.2.7	62.118.240.41	42a	Echo
Jul 26, 2024 02:27:54.504245996 CEST	192.168.2.7	62.118.153.24	429	Echo
Jul 26, 2024 02:27:54.504281998 CEST	192.168.2.7	62.118.84.163	428	Echo
Jul 26, 2024 02:27:54.504494905 CEST	192.168.2.7	62.118.33.228	427	Echo
Jul 26, 2024 02:27:54.504637957 CEST	192.168.2.7	62.118.77.150	426	Echo
Jul 26, 2024 02:27:54.504764080 CEST	192.168.2.7	62.118.203.186	425	Echo
Jul 26, 2024 02:27:54.504936934 CEST	192.168.2.7	62.118.41.63	424	Echo
Jul 26, 2024 02:27:54.505094051 CEST	192.168.2.7	62.118.121.98	423	Echo
Jul 26, 2024 02:27:54.505162001 CEST	192.168.2.7	62.118.35.215	422	Echo
Jul 26, 2024 02:27:54.505247116 CEST	192.168.2.7	62.118.232.94	421	Echo
Jul 26, 2024 02:27:54.525398016 CEST	192.168.2.7	62.118.146.109	420	Echo
Jul 26, 2024 02:27:54.559350967 CEST	192.168.2.7	62.118.206.0	41f	Echo
Jul 26, 2024 02:27:54.613733053 CEST	192.168.2.7	62.118.49.14	41e	Echo
Jul 26, 2024 02:27:54.634387016 CEST	192.168.2.7	62.118.122.49	41d	Echo
Jul 26, 2024 02:27:54.665397882 CEST	192.168.2.7	62.118.102.192	41c	Echo
Jul 26, 2024 02:27:54.681906939 CEST	192.168.2.7	62.118.210.114	41b	Echo
Jul 26, 2024 02:27:54.697982073 CEST	192.168.2.7	62.118.86.199	41a	Echo
Jul 26, 2024 02:27:54.727586031 CEST	192.168.2.7	62.118.39.214	419	Echo
Jul 26, 2024 02:27:54.754456043 CEST	192.168.2.7	62.118.49.137	418	Echo
Jul 26, 2024 02:27:54.774852037 CEST	192.168.2.7	62.118.90.50	417	Echo
Jul 26, 2024 02:27:54.790318966 CEST	192.168.2.7	62.118.214.214	416	Echo
Jul 26, 2024 02:27:54.806129932 CEST	192.168.2.7	62.118.14.22	415	Echo
Jul 26, 2024 02:27:54.821724892 CEST	192.168.2.7	62.118.53.123	414	Echo
Jul 26, 2024 02:27:54.837065935 CEST	192.168.2.7	62.118.225.120	413	Echo
Jul 26, 2024 02:27:54.852721930 CEST	192.168.2.7	62.118.240.63	412	Echo
Jul 26, 2024 02:27:54.868195057 CEST	192.168.2.7	62.118.150.128	411	Echo
Jul 26, 2024 02:27:54.883980036 CEST	192.168.2.7	62.118.47.183	410	Echo
Jul 26, 2024 02:27:54.899574041 CEST	192.168.2.7	62.118.105.34	40f	Echo
Jul 26, 2024 02:27:54.915297031 CEST	192.168.2.7	62.118.53.221	40e	Echo
Jul 26, 2024 02:27:54.931807995 CEST	192.168.2.7	62.118.83.75	40d	Echo
Jul 26, 2024 02:27:54.962583065 CEST	192.168.2.7	62.118.114.88	40c	Echo
Jul 26, 2024 02:27:54.993357897 CEST	192.168.2.7	62.118.191.61	40b	Echo
Jul 26, 2024 02:27:54.994781017 CEST	192.168.2.7	62.118.28.195	40a	Echo
Jul 26, 2024 02:27:54.994823933 CEST	192.168.2.7	62.118.197.249	409	Echo
Jul 26, 2024 02:27:54.994918108 CEST	192.168.2.7	62.118.0.248	408	Echo
Jul 26, 2024 02:27:54.994978905 CEST	192.168.2.7	62.118.33.135	407	Echo
Jul 26, 2024 02:27:54.995043993 CEST	192.168.2.7	62.118.38.218	406	Echo
Jul 26, 2024 02:27:54.995110989 CEST	192.168.2.7	62.118.68.253	405	Echo
Jul 26, 2024 02:27:54.995158911 CEST	192.168.2.7	62.118.132.183	404	Echo
Jul 26, 2024 02:27:54.995279074 CEST	192.168.2.7	62.118.175.55	403	Echo
Jul 26, 2024 02:27:54.995311022 CEST	192.168.2.7	62.118.175.57	402	Echo
Jul 26, 2024 02:27:54.995340109 CEST	192.168.2.7	62.118.36.174	401	Echo
Jul 26, 2024 02:27:54.995405912 CEST	192.168.2.7	62.118.83.245	400	Echo
Jul 26, 2024 02:27:54.995490074 CEST	192.168.2.7	62.118.253.229	3ff	Echo
Jul 26, 2024 02:27:54.995522022 CEST	192.168.2.7	62.118.108.155	3fe	Echo
Jul 26, 2024 02:27:54.995574951 CEST	192.168.2.7	62.118.55.96	3fd	Echo
Jul 26, 2024 02:27:54.995640039 CEST	192.168.2.7	62.118.22.23	3fc	Echo
Jul 26, 2024 02:27:54.995714903 CEST	192.168.2.7	62.118.84.193	3fb	Echo
Jul 26, 2024 02:27:55.008960009 CEST	192.168.2.7	62.118.77.191	3fa	Echo
Jul 26, 2024 02:27:55.024701118 CEST	192.168.2.7	62.118.216.77	3f9	Echo
Jul 26, 2024 02:27:55.040477991 CEST	192.168.2.7	62.118.236.216	3f8	Echo
Jul 26, 2024 02:27:55.055711985 CEST	192.168.2.7	62.118.144.236	3f7	Echo
Jul 26, 2024 02:27:55.071538925 CEST	192.168.2.7	62.118.67.29	3f6	Echo
Jul 26, 2024 02:27:55.087002039 CEST	192.168.2.7	62.118.127.36	3f5	Echo
Jul 26, 2024 02:27:55.102890015 CEST	192.168.2.7	62.118.174.5	3f4	Echo
Jul 26, 2024 02:27:55.118366003 CEST	192.168.2.7	62.118.62.0	3f3	Echo
Jul 26, 2024 02:27:55.133976936 CEST	192.168.2.7	62.118.66.186	3f2	Echo
Jul 26, 2024 02:27:55.149633884 CEST	192.168.2.7	62.118.86.61	3f1	Echo
Jul 26, 2024 02:27:55.165154934 CEST	192.168.2.7	62.118.185.50	3f0	Echo
Jul 26, 2024 02:27:55.180577040 CEST	192.168.2.7	62.118.26.199	3ef	Echo
Jul 26, 2024 02:27:55.196275949 CEST	192.168.2.7	62.118.76.233	3ee	Echo
Jul 26, 2024 02:27:55.211950064 CEST	192.168.2.7	62.118.22.60	3ed	Echo
Jul 26, 2024 02:27:55.227741003 CEST	192.168.2.7	62.118.179.146	3ec	Echo
Jul 26, 2024 02:27:55.243355036 CEST	192.168.2.7	62.118.46.16	3eb	Echo
Jul 26, 2024 02:27:55.258814096 CEST	192.168.2.7	62.118.220.45	3ea	Echo
Jul 26, 2024 02:27:55.274715900 CEST	192.168.2.7	62.118.108.203	3e9	Echo
Jul 26, 2024 02:27:55.290668011 CEST	192.168.2.7	62.118.220.132	3e8	Echo
Jul 26, 2024 02:27:55.305908918 CEST	192.168.2.7	62.118.159.64	3e7	Echo
Jul 26, 2024 02:27:55.321429968 CEST	192.168.2.7	62.118.65.75	3e6	Echo
Jul 26, 2024 02:27:55.337188959 CEST	192.168.2.7	62.118.70.65	3e5	Echo
Jul 26, 2024 02:27:55.352863073 CEST	192.168.2.7	62.118.139.69	3e4	Echo
Jul 26, 2024 02:27:55.368202925 CEST	192.168.2.7	62.118.19.139	3e3	Echo
Jul 26, 2024 02:27:55.384042978 CEST	192.168.2.7	62.118.112.215	3e2	Echo
Jul 26, 2024 02:27:55.399636984 CEST	192.168.2.7	62.118.238.255	3e1	Echo
Jul 26, 2024 02:27:55.415194988 CEST	192.168.2.7	62.118.72.239	3e0	Echo
Jul 26, 2024 02:27:55.430979967 CEST	192.168.2.7	62.118.45.105	3df	Echo
Jul 26, 2024 02:27:55.446418047 CEST	192.168.2.7	62.118.231.64	3de	Echo
Jul 26, 2024 02:27:55.462055922 CEST	192.168.2.7	62.118.14.72	3dd	Echo
Jul 26, 2024 02:27:55.478174925 CEST	192.168.2.7	62.118.196.118	3dc	Echo
Jul 26, 2024 02:27:55.495347977 CEST	192.168.2.7	62.118.221.84	3db	Echo
Jul 26, 2024 02:27:55.495417118 CEST	192.168.2.7	62.118.204.220	3da	Echo
Jul 26, 2024 02:27:55.495517969 CEST	192.168.2.7	62.118.194.10	3d9	Echo
Jul 26, 2024 02:27:55.495723009 CEST	192.168.2.7	62.118.57.181	3d7	Echo
Jul 26, 2024 02:27:55.495803118 CEST	192.168.2.7	62.118.12.39	3d6	Echo
Jul 26, 2024 02:27:55.495873928 CEST	192.168.2.7	62.118.83.57	3d5	Echo
Jul 26, 2024 02:27:55.495879889 CEST	192.168.2.7	62.118.232.175	3d8	Echo
Jul 26, 2024 02:27:55.496005058 CEST	192.168.2.7	62.118.6.206	3d4	Echo
Jul 26, 2024 02:27:55.496150017 CEST	192.168.2.7	62.118.71.149	3d2	Echo
Jul 26, 2024 02:27:55.496184111 CEST	192.168.2.7	62.118.143.162	3d3	Echo
Jul 26, 2024 02:27:55.496184111 CEST	192.168.2.7	62.118.228.185	3d1	Echo
Jul 26, 2024 02:27:55.496274948 CEST	192.168.2.7	62.118.104.196	3d0	Echo
Jul 26, 2024 02:27:55.496395111 CEST	192.168.2.7	62.118.36.108	3cf	Echo
Jul 26, 2024 02:27:55.496471882 CEST	192.168.2.7	62.118.67.19	3ce	Echo
Jul 26, 2024 02:27:55.496615887 CEST	192.168.2.7	62.118.219.246	3cd	Echo
Jul 26, 2024 02:27:55.496699095 CEST	192.168.2.7	62.118.143.106	3cc	Echo
Jul 26, 2024 02:27:55.510580063 CEST	192.168.2.7	62.118.38.64	3cb	Echo
Jul 26, 2024 02:27:55.524475098 CEST	192.168.2.7	62.118.47.21	3ca	Echo
Jul 26, 2024 02:27:55.540478945 CEST	192.168.2.7	62.118.249.187	3c9	Echo
Jul 26, 2024 02:27:55.555919886 CEST	192.168.2.7	62.118.253.238	3c8	Echo
Jul 26, 2024 02:27:55.571626902 CEST	192.168.2.7	62.118.97.254	3c7	Echo
Jul 26, 2024 02:27:55.589097977 CEST	192.168.2.7	62.118.56.83	3c6	Echo
Jul 26, 2024 02:27:55.620955944 CEST	192.168.2.7	62.118.62.211	3c5	Echo
Jul 26, 2024 02:27:55.649662971 CEST	192.168.2.7	62.118.241.234	3c4	Echo
Jul 26, 2024 02:27:55.665118933 CEST	192.168.2.7	62.118.34.132	3c3	Echo
Jul 26, 2024 02:27:55.680936098 CEST	192.168.2.7	62.118.148.0	3c2	Echo
Jul 26, 2024 02:27:55.700330973 CEST	192.168.2.7	62.118.97.148	3c1	Echo
Jul 26, 2024 02:27:55.727499962 CEST	192.168.2.7	62.118.224.158	3c0	Echo
Jul 26, 2024 02:27:55.744592905 CEST	192.168.2.7	62.118.216.212	3bf	Echo
Jul 26, 2024 02:27:55.775175095 CEST	192.168.2.7	62.118.151.109	3be	Echo
Jul 26, 2024 02:27:55.790098906 CEST	192.168.2.7	62.118.110.215	3bd	Echo
Jul 26, 2024 02:27:55.806073904 CEST	192.168.2.7	62.118.240.20	3bc	Echo
Jul 26, 2024 02:27:55.821547985 CEST	192.168.2.7	62.118.39.240	3bb	Echo
Jul 26, 2024 02:27:55.837177992 CEST	192.168.2.7	62.118.49.98	3ba	Echo
Jul 26, 2024 02:27:55.852582932 CEST	192.168.2.7	62.118.90.26	3b9	Echo
Jul 26, 2024 02:27:55.868437052 CEST	192.168.2.7	62.118.190.22	3b8	Echo
Jul 26, 2024 02:27:55.883868933 CEST	192.168.2.7	62.118.12.24	3b7	Echo
Jul 26, 2024 02:27:55.899535894 CEST	192.168.2.7	62.118.139.242	3b6	Echo
Jul 26, 2024 02:27:55.915112019 CEST	192.168.2.7	62.118.25.192	3b5	Echo
Jul 26, 2024 02:27:55.930702925 CEST	192.168.2.7	62.118.202.252	3b4	Echo
Jul 26, 2024 02:27:55.946361065 CEST	192.168.2.7	62.118.14.160	3b3	Echo
Jul 26, 2024 02:27:55.988719940 CEST	192.168.2.7	62.118.44.122	3b2	Echo
Jul 26, 2024 02:27:55.989068985 CEST	192.168.2.7	62.118.117.224	3b1	Echo
Jul 26, 2024 02:27:55.993196964 CEST	192.168.2.7	62.118.140.179	3b0	Echo
Jul 26, 2024 02:27:55.994657993 CEST	192.168.2.7	62.118.112.117	3ae	Echo
Jul 26, 2024 02:27:55.994683027 CEST	192.168.2.7	62.118.117.52	3af	Echo
Jul 26, 2024 02:27:55.994761944 CEST	192.168.2.7	62.118.213.111	3ad	Echo
Jul 26, 2024 02:27:55.994827986 CEST	192.168.2.7	62.118.180.167	3ac	Echo
Jul 26, 2024 02:27:55.994895935 CEST	192.168.2.7	62.118.86.201	3ab	Echo
Jul 26, 2024 02:27:55.994942904 CEST	192.168.2.7	62.118.56.88	3aa	Echo
Jul 26, 2024 02:27:55.995029926 CEST	192.168.2.7	62.118.115.66	3a9	Echo
Jul 26, 2024 02:27:55.995052099 CEST	192.168.2.7	62.118.101.115	3a8	Echo
Jul 26, 2024 02:27:55.995125055 CEST	192.168.2.7	62.118.232.100	3a7	Echo
Jul 26, 2024 02:27:55.995174885 CEST	192.168.2.7	62.118.29.109	3a6	Echo
Jul 26, 2024 02:27:55.995227098 CEST	192.168.2.7	62.118.208.245	3a5	Echo
Jul 26, 2024 02:27:55.995292902 CEST	192.168.2.7	62.118.60.249	3a4	Echo
Jul 26, 2024 02:27:55.995341063 CEST	192.168.2.7	62.118.119.207	3a3	Echo
Jul 26, 2024 02:27:55.995382071 CEST	192.168.2.7	62.118.96.135	3a2	Echo
Jul 26, 2024 02:27:55.995470047 CEST	192.168.2.7	62.118.54.105	3a1	Echo
Jul 26, 2024 02:27:56.008893013 CEST	192.168.2.7	62.118.233.172	3a0	Echo
Jul 26, 2024 02:27:56.024774075 CEST	192.168.2.7	62.118.111.44	39f	Echo
Jul 26, 2024 02:27:56.040131092 CEST	192.168.2.7	62.118.62.187	39e	Echo
Jul 26, 2024 02:27:56.055833101 CEST	192.168.2.7	62.118.212.153	39d	Echo
Jul 26, 2024 02:27:56.071335077 CEST	192.168.2.7	62.118.37.218	39c	Echo
Jul 26, 2024 02:27:56.086945057 CEST	192.168.2.7	62.118.218.155	39b	Echo
Jul 26, 2024 02:27:56.102456093 CEST	192.168.2.7	62.118.31.158	39a	Echo
Jul 26, 2024 02:27:56.118196011 CEST	192.168.2.7	62.118.24.18	399	Echo
Jul 26, 2024 02:27:56.134010077 CEST	192.168.2.7	62.118.122.138	398	Echo
Jul 26, 2024 02:27:56.149615049 CEST	192.168.2.7	62.118.131.46	397	Echo
Jul 26, 2024 02:27:56.165116072 CEST	192.168.2.7	62.118.244.37	396	Echo
Jul 26, 2024 02:27:56.180733919 CEST	192.168.2.7	62.118.8.10	395	Echo
Jul 26, 2024 02:27:56.196197033 CEST	192.168.2.7	62.118.33.177	394	Echo
Jul 26, 2024 02:27:56.212213993 CEST	192.168.2.7	62.118.50.56	393	Echo
Jul 26, 2024 02:27:56.227569103 CEST	192.168.2.7	62.118.40.50	392	Echo
Jul 26, 2024 02:27:56.243529081 CEST	192.168.2.7	62.118.29.41	391	Echo
Jul 26, 2024 02:27:56.258673906 CEST	192.168.2.7	62.118.33.173	390	Echo
Jul 26, 2024 02:27:56.277321100 CEST	192.168.2.7	62.118.134.250	38f	Echo
Jul 26, 2024 02:27:56.290010929 CEST	192.168.2.7	62.118.227.24	38e	Echo
Jul 26, 2024 02:27:56.306341887 CEST	192.168.2.7	62.118.59.242	38d	Echo
Jul 26, 2024 02:27:56.336966991 CEST	192.168.2.7	62.118.247.253	38c	Echo
Jul 26, 2024 02:27:56.352839947 CEST	192.168.2.7	62.118.97.206	38b	Echo
Jul 26, 2024 02:27:56.368227959 CEST	192.168.2.7	62.118.162.117	38a	Echo
Jul 26, 2024 02:27:56.383799076 CEST	192.168.2.7	62.118.140.67	389	Echo
Jul 26, 2024 02:27:56.399442911 CEST	192.168.2.7	62.118.125.196	388	Echo
Jul 26, 2024 02:27:56.415231943 CEST	192.168.2.7	62.118.113.125	387	Echo
Jul 26, 2024 02:27:56.430814028 CEST	192.168.2.7	62.118.34.113	386	Echo
Jul 26, 2024 02:27:56.446499109 CEST	192.168.2.7	62.118.49.217	385	Echo
Jul 26, 2024 02:27:56.462001085 CEST	192.168.2.7	62.118.225.126	384	Echo
Jul 26, 2024 02:27:56.478064060 CEST	192.168.2.7	62.118.147.32	383	Echo
Jul 26, 2024 02:27:56.493988037 CEST	192.168.2.7	62.118.36.189	382	Echo
Jul 26, 2024 02:27:56.494044065 CEST	192.168.2.7	62.118.32.40	381	Echo
Jul 26, 2024 02:27:56.495822906 CEST	192.168.2.7	62.118.146.109	380	Echo
Jul 26, 2024 02:27:56.495919943 CEST	192.168.2.7	62.118.206.0	37f	Echo
Jul 26, 2024 02:27:56.496099949 CEST	192.168.2.7	62.118.49.14	37e	Echo
Jul 26, 2024 02:27:56.496128082 CEST	192.168.2.7	62.118.122.49	37d	Echo
Jul 26, 2024 02:27:56.496184111 CEST	192.168.2.7	62.118.102.192	37c	Echo
Jul 26, 2024 02:27:56.496294975 CEST	192.168.2.7	62.118.210.114	37b	Echo
Jul 26, 2024 02:27:56.496449947 CEST	192.168.2.7	62.118.39.214	379	Echo
Jul 26, 2024 02:27:56.496452093 CEST	192.168.2.7	62.118.86.199	37a	Echo
Jul 26, 2024 02:27:56.496503115 CEST	192.168.2.7	62.118.49.137	378	Echo
Jul 26, 2024 02:27:56.496682882 CEST	192.168.2.7	62.118.90.50	377	Echo
Jul 26, 2024 02:27:56.496682882 CEST	192.168.2.7	62.118.214.214	376	Echo
Jul 26, 2024 02:27:56.496834040 CEST	192.168.2.7	62.118.14.22	375	Echo
Jul 26, 2024 02:27:56.496834040 CEST	192.168.2.7	62.118.53.123	374	Echo
Jul 26, 2024 02:27:56.496927977 CEST	192.168.2.7	62.118.225.120	373	Echo
Jul 26, 2024 02:27:56.497088909 CEST	192.168.2.7	62.118.240.63	372	Echo
Jul 26, 2024 02:27:56.497304916 CEST	192.168.2.7	62.118.150.128	371	Echo
Jul 26, 2024 02:27:56.497487068 CEST	192.168.2.7	62.118.105.34	36f	Echo
Jul 26, 2024 02:27:56.497556925 CEST	192.168.2.7	62.118.53.221	36e	Echo
Jul 26, 2024 02:27:56.497661114 CEST	192.168.2.7	62.118.83.75	36d	Echo
Jul 26, 2024 02:27:56.497719049 CEST	192.168.2.7	62.118.114.88	36c	Echo
Jul 26, 2024 02:27:56.498064041 CEST	192.168.2.7	62.118.47.183	370	Echo
Jul 26, 2024 02:27:56.509160042 CEST	192.168.2.7	62.118.208.11	36b	Echo
Jul 26, 2024 02:27:56.524394989 CEST	192.168.2.7	62.118.36.214	36a	Echo
Jul 26, 2024 02:27:56.540374994 CEST	192.168.2.7	62.118.86.79	369	Echo
Jul 26, 2024 02:27:56.555793047 CEST	192.168.2.7	62.118.230.133	368	Echo
Jul 26, 2024 02:27:56.571332932 CEST	192.168.2.7	62.118.24.51	367	Echo
Jul 26, 2024 02:27:56.587203979 CEST	192.168.2.7	62.118.190.24	366	Echo
Jul 26, 2024 02:27:56.602710962 CEST	192.168.2.7	62.118.86.214	365	Echo
Jul 26, 2024 02:27:56.619245052 CEST	192.168.2.7	62.118.152.249	364	Echo
Jul 26, 2024 02:27:56.633763075 CEST	192.168.2.7	62.118.253.27	363	Echo
Jul 26, 2024 02:27:56.650006056 CEST	192.168.2.7	62.118.71.97	362	Echo
Jul 26, 2024 02:27:56.678124905 CEST	192.168.2.7	62.118.69.208	361	Echo
Jul 26, 2024 02:27:56.680890083 CEST	192.168.2.7	62.118.117.91	360	Echo
Jul 26, 2024 02:27:56.696517944 CEST	192.168.2.7	62.118.81.200	35f	Echo
Jul 26, 2024 02:27:56.711880922 CEST	192.168.2.7	62.118.224.50	35e	Echo
Jul 26, 2024 02:27:56.728074074 CEST	192.168.2.7	62.118.206.254	35d	Echo
Jul 26, 2024 02:27:56.743340969 CEST	192.168.2.7	62.118.27.81	35c	Echo
Jul 26, 2024 02:27:56.758768082 CEST	192.168.2.7	62.118.95.0	35b	Echo
Jul 26, 2024 02:27:56.774863005 CEST	192.168.2.7	62.118.91.123	35a	Echo
Jul 26, 2024 02:27:56.790234089 CEST	192.168.2.7	62.118.72.117	359	Echo
Jul 26, 2024 02:27:56.805669069 CEST	192.168.2.7	62.118.30.186	358	Echo
Jul 26, 2024 02:27:56.821604967 CEST	192.168.2.7	62.118.57.167	357	Echo
Jul 26, 2024 02:27:56.836967945 CEST	192.168.2.7	62.118.233.95	356	Echo
Jul 26, 2024 02:27:56.852612019 CEST	192.168.2.7	62.118.102.6	355	Echo
Jul 26, 2024 02:27:56.868247986 CEST	192.168.2.7	62.118.47.223	354	Echo
Jul 26, 2024 02:27:56.883806944 CEST	192.168.2.7	62.118.208.241	353	Echo
Jul 26, 2024 02:27:56.899718046 CEST	192.168.2.7	62.118.45.142	352	Echo
Jul 26, 2024 02:27:56.915016890 CEST	192.168.2.7	62.118.237.182	351	Echo
Jul 26, 2024 02:27:56.930887938 CEST	192.168.2.7	62.118.149.237	350	Echo
Jul 26, 2024 02:27:56.936790943 CEST	62.118.253.27	192.168.2.7	b63	Echo Reply
Jul 26, 2024 02:27:56.937259912 CEST	192.168.2.7	62.118.253.27	34f	Echo
Jul 26, 2024 02:27:56.946562052 CEST	192.168.2.7	62.118.240.188	34e	Echo
Jul 26, 2024 02:27:56.961903095 CEST	192.168.2.7	62.118.177.4	34d	Echo
Jul 26, 2024 02:27:56.978605986 CEST	192.168.2.7	62.118.78.161	34c	Echo
Jul 26, 2024 02:27:57.003652096 CEST	192.168.2.7	62.118.191.61	34b	Echo
Jul 26, 2024 02:27:57.003901005 CEST	192.168.2.7	62.118.90.227	34a	Echo
Jul 26, 2024 02:27:57.005212069 CEST	192.168.2.7	62.118.77.191	349	Echo
Jul 26, 2024 02:27:57.005289078 CEST	192.168.2.7	62.118.216.77	348	Echo
Jul 26, 2024 02:27:57.005364895 CEST	192.168.2.7	62.118.236.216	347	Echo
Jul 26, 2024 02:27:57.005434990 CEST	192.168.2.7	62.118.144.236	346	Echo
Jul 26, 2024 02:27:57.005526066 CEST	192.168.2.7	62.118.67.29	345	Echo
Jul 26, 2024 02:27:57.005594015 CEST	192.168.2.7	62.118.127.36	344	Echo
Jul 26, 2024 02:27:57.005673885 CEST	192.168.2.7	62.118.174.5	343	Echo
Jul 26, 2024 02:27:57.005739927 CEST	192.168.2.7	62.118.62.0	342	Echo
Jul 26, 2024 02:27:57.005827904 CEST	192.168.2.7	62.118.66.186	341	Echo
Jul 26, 2024 02:27:57.005891085 CEST	192.168.2.7	62.118.86.61	340	Echo
Jul 26, 2024 02:27:57.005980968 CEST	192.168.2.7	62.118.185.50	33f	Echo
Jul 26, 2024 02:27:57.006045103 CEST	192.168.2.7	62.118.26.199	33e	Echo
Jul 26, 2024 02:27:57.006124020 CEST	192.168.2.7	62.118.76.233	33d	Echo
Jul 26, 2024 02:27:57.006213903 CEST	192.168.2.7	62.118.22.60	33c	Echo
Jul 26, 2024 02:27:57.006283998 CEST	192.168.2.7	62.118.179.146	33b	Echo
Jul 26, 2024 02:27:57.006362915 CEST	192.168.2.7	62.118.46.16	33a	Echo
Jul 26, 2024 02:27:57.006443977 CEST	192.168.2.7	62.118.220.45	339	Echo
Jul 26, 2024 02:27:57.006517887 CEST	192.168.2.7	62.118.108.203	338	Echo
Jul 26, 2024 02:27:57.006598949 CEST	192.168.2.7	62.118.220.132	337	Echo
Jul 26, 2024 02:27:57.006664991 CEST	192.168.2.7	62.118.159.64	336	Echo
Jul 26, 2024 02:27:57.006745100 CEST	192.168.2.7	62.118.65.75	335	Echo
Jul 26, 2024 02:27:57.006814003 CEST	192.168.2.7	62.118.70.65	334	Echo
Jul 26, 2024 02:27:57.006887913 CEST	192.168.2.7	62.118.139.69	333	Echo
Jul 26, 2024 02:27:57.006958008 CEST	192.168.2.7	62.118.19.139	332	Echo
Jul 26, 2024 02:27:57.007031918 CEST	192.168.2.7	62.118.112.215	331	Echo
Jul 26, 2024 02:27:57.007256031 CEST	192.168.2.7	62.118.238.255	330	Echo
Jul 26, 2024 02:27:57.007354021 CEST	192.168.2.7	62.118.72.239	32f	Echo
Jul 26, 2024 02:27:57.007442951 CEST	192.168.2.7	62.118.45.105	32e	Echo
Jul 26, 2024 02:27:57.007519960 CEST	192.168.2.7	62.118.231.64	32d	Echo
Jul 26, 2024 02:27:57.007657051 CEST	192.168.2.7	62.118.14.72	32c	Echo
Jul 26, 2024 02:27:57.007687092 CEST	192.168.2.7	62.118.196.118	32b	Echo
Jul 26, 2024 02:27:57.024507999 CEST	192.168.2.7	62.118.179.220	32a	Echo
Jul 26, 2024 02:27:57.040113926 CEST	192.168.2.7	62.118.111.141	329	Echo
Jul 26, 2024 02:27:57.055780888 CEST	192.168.2.7	62.118.18.4	328	Echo
Jul 26, 2024 02:27:57.071456909 CEST	192.168.2.7	62.118.217.73	327	Echo
Jul 26, 2024 02:27:57.086802006 CEST	192.168.2.7	62.118.154.69	326	Echo
Jul 26, 2024 02:27:57.099673986 CEST	62.118.253.27	192.168.2.7	b4f	Echo Reply
Jul 26, 2024 02:27:57.494988918 CEST	192.168.2.7	62.118.38.64	325	Echo
Jul 26, 2024 02:27:57.495027065 CEST	192.168.2.7	62.118.47.21	324	Echo
Jul 26, 2024 02:27:57.495152950 CEST	192.168.2.7	62.118.249.187	323	Echo
Jul 26, 2024 02:27:57.495228052 CEST	192.168.2.7	62.118.253.238	322	Echo
Jul 26, 2024 02:27:57.495271921 CEST	192.168.2.7	62.118.97.254	321	Echo
Jul 26, 2024 02:27:57.495369911 CEST	192.168.2.7	62.118.56.83	320	Echo
Jul 26, 2024 02:27:57.495452881 CEST	192.168.2.7	62.118.62.211	31f	Echo
Jul 26, 2024 02:27:57.495537043 CEST	192.168.2.7	62.118.241.234	31e	Echo
Jul 26, 2024 02:27:57.495618105 CEST	192.168.2.7	62.118.34.132	31d	Echo
Jul 26, 2024 02:27:57.495707989 CEST	192.168.2.7	62.118.148.0	31c	Echo
Jul 26, 2024 02:27:57.495794058 CEST	192.168.2.7	62.118.97.148	31b	Echo
Jul 26, 2024 02:27:57.495872974 CEST	192.168.2.7	62.118.224.158	31a	Echo
Jul 26, 2024 02:27:57.495954037 CEST	192.168.2.7	62.118.216.212	319	Echo
Jul 26, 2024 02:27:57.496071100 CEST	192.168.2.7	62.118.151.109	318	Echo
Jul 26, 2024 02:27:57.496109962 CEST	192.168.2.7	62.118.110.215	317	Echo
Jul 26, 2024 02:27:57.496191978 CEST	192.168.2.7	62.118.240.20	316	Echo
Jul 26, 2024 02:27:57.496269941 CEST	192.168.2.7	62.118.39.240	315	Echo
Jul 26, 2024 02:27:57.496431112 CEST	192.168.2.7	62.118.90.26	313	Echo
Jul 26, 2024 02:27:57.496503115 CEST	192.168.2.7	62.118.190.22	312	Echo
Jul 26, 2024 02:27:57.496583939 CEST	192.168.2.7	62.118.12.24	311	Echo
Jul 26, 2024 02:27:57.496634007 CEST	192.168.2.7	62.118.49.98	314	Echo
Jul 26, 2024 02:27:57.496668100 CEST	192.168.2.7	62.118.139.242	310	Echo
Jul 26, 2024 02:27:57.496743917 CEST	192.168.2.7	62.118.25.192	30f	Echo
Jul 26, 2024 02:27:57.496819973 CEST	192.168.2.7	62.118.202.252	30e	Echo
Jul 26, 2024 02:27:57.496908903 CEST	192.168.2.7	62.118.14.160	30d	Echo
Jul 26, 2024 02:27:57.496989012 CEST	192.168.2.7	62.118.44.122	30c	Echo
Jul 26, 2024 02:27:57.497088909 CEST	192.168.2.7	62.118.117.224	30b	Echo
Jul 26, 2024 02:27:58.000957966 CEST	192.168.2.7	62.118.233.172	30a	Echo
Jul 26, 2024 02:27:58.001390934 CEST	192.168.2.7	62.118.111.44	309	Echo
Jul 26, 2024 02:27:58.001425982 CEST	192.168.2.7	62.118.62.187	308	Echo
Jul 26, 2024 02:27:58.001689911 CEST	192.168.2.7	62.118.212.153	307	Echo
Jul 26, 2024 02:27:58.001857996 CEST	192.168.2.7	62.118.37.218	306	Echo
Jul 26, 2024 02:27:58.001951933 CEST	192.168.2.7	62.118.218.155	305	Echo
Jul 26, 2024 02:27:58.002320051 CEST	192.168.2.7	62.118.31.158	304	Echo
Jul 26, 2024 02:27:58.002413988 CEST	192.168.2.7	62.118.24.18	303	Echo
Jul 26, 2024 02:27:58.002496958 CEST	192.168.2.7	62.118.122.138	302	Echo
Jul 26, 2024 02:27:58.002582073 CEST	192.168.2.7	62.118.131.46	301	Echo
Jul 26, 2024 02:27:58.002866983 CEST	192.168.2.7	62.118.244.37	300	Echo
Jul 26, 2024 02:27:58.003026962 CEST	192.168.2.7	62.118.8.10	2ff	Echo
Jul 26, 2024 02:27:58.003256083 CEST	192.168.2.7	62.118.33.177	2fe	Echo
Jul 26, 2024 02:27:58.003396034 CEST	192.168.2.7	62.118.50.56	2fd	Echo
Jul 26, 2024 02:27:58.003464937 CEST	192.168.2.7	62.118.40.50	2fc	Echo
Jul 26, 2024 02:27:58.003602028 CEST	192.168.2.7	62.118.29.41	2fb	Echo
Jul 26, 2024 02:27:58.003709078 CEST	192.168.2.7	62.118.33.173	2fa	Echo
Jul 26, 2024 02:27:58.007729053 CEST	192.168.2.7	62.118.134.250	2f9	Echo
Jul 26, 2024 02:27:58.007817984 CEST	192.168.2.7	62.118.227.24	2f8	Echo
Jul 26, 2024 02:27:58.008136988 CEST	192.168.2.7	62.118.59.242	2f7	Echo
Jul 26, 2024 02:27:58.008239031 CEST	192.168.2.7	62.118.247.253	2f6	Echo
Jul 26, 2024 02:27:58.008431911 CEST	192.168.2.7	62.118.97.206	2f5	Echo
Jul 26, 2024 02:27:58.008889914 CEST	192.168.2.7	62.118.162.117	2f4	Echo
Jul 26, 2024 02:27:58.009011030 CEST	192.168.2.7	62.118.140.67	2f3	Echo
Jul 26, 2024 02:27:58.009089947 CEST	192.168.2.7	62.118.125.196	2f2	Echo
Jul 26, 2024 02:27:58.009512901 CEST	192.168.2.7	62.118.113.125	2f1	Echo
Jul 26, 2024 02:27:58.009640932 CEST	192.168.2.7	62.118.34.113	2f0	Echo
Jul 26, 2024 02:27:58.009699106 CEST	192.168.2.7	62.118.49.217	2ef	Echo
Jul 26, 2024 02:27:58.010076046 CEST	192.168.2.7	62.118.225.126	2ee	Echo
Jul 26, 2024 02:27:58.010165930 CEST	192.168.2.7	62.118.147.32	2ed	Echo
Jul 26, 2024 02:27:58.493566036 CEST	192.168.2.7	62.118.32.40	2ec	Echo
Jul 26, 2024 02:27:58.495151997 CEST	192.168.2.7	62.118.208.11	2eb	Echo
Jul 26, 2024 02:27:58.495186090 CEST	192.168.2.7	62.118.36.214	2ea	Echo
Jul 26, 2024 02:27:58.495304108 CEST	192.168.2.7	62.118.86.79	2e9	Echo
Jul 26, 2024 02:27:58.495352983 CEST	192.168.2.7	62.118.230.133	2e8	Echo
Jul 26, 2024 02:27:58.495418072 CEST	192.168.2.7	62.118.24.51	2e7	Echo
Jul 26, 2024 02:27:58.495469093 CEST	192.168.2.7	62.118.190.24	2e6	Echo
Jul 26, 2024 02:27:58.495548010 CEST	192.168.2.7	62.118.86.214	2e5	Echo
Jul 26, 2024 02:27:58.495592117 CEST	192.168.2.7	62.118.152.249	2e4	Echo
Jul 26, 2024 02:27:58.495651960 CEST	192.168.2.7	62.118.71.97	2e3	Echo
Jul 26, 2024 02:27:58.495676994 CEST	192.168.2.7	62.118.69.208	2e2	Echo
Jul 26, 2024 02:27:58.495752096 CEST	192.168.2.7	62.118.117.91	2e1	Echo
Jul 26, 2024 02:27:58.495810986 CEST	192.168.2.7	62.118.81.200	2e0	Echo
Jul 26, 2024 02:27:58.495870113 CEST	192.168.2.7	62.118.224.50	2df	Echo
Jul 26, 2024 02:27:58.495914936 CEST	192.168.2.7	62.118.206.254	2de	Echo
Jul 26, 2024 02:27:58.495968103 CEST	192.168.2.7	62.118.27.81	2dd	Echo
Jul 26, 2024 02:27:58.496018887 CEST	192.168.2.7	62.118.95.0	2dc	Echo
Jul 26, 2024 02:27:58.496083021 CEST	192.168.2.7	62.118.91.123	2db	Echo
Jul 26, 2024 02:27:58.496154070 CEST	192.168.2.7	62.118.72.117	2da	Echo
Jul 26, 2024 02:27:58.496200085 CEST	192.168.2.7	62.118.30.186	2d9	Echo
Jul 26, 2024 02:27:58.496265888 CEST	192.168.2.7	62.118.57.167	2d8	Echo
Jul 26, 2024 02:27:58.496316910 CEST	192.168.2.7	62.118.233.95	2d7	Echo
Jul 26, 2024 02:27:58.496370077 CEST	192.168.2.7	62.118.102.6	2d6	Echo
Jul 26, 2024 02:27:58.496423006 CEST	192.168.2.7	62.118.47.223	2d5	Echo
Jul 26, 2024 02:27:58.496468067 CEST	192.168.2.7	62.118.208.241	2d4	Echo
Jul 26, 2024 02:27:58.496521950 CEST	192.168.2.7	62.118.45.142	2d3	Echo
Jul 26, 2024 02:27:58.496567965 CEST	192.168.2.7	62.118.237.182	2d2	Echo
Jul 26, 2024 02:27:58.496629000 CEST	192.168.2.7	62.118.149.237	2d1	Echo
Jul 26, 2024 02:27:58.496670961 CEST	192.168.2.7	62.118.240.188	2d0	Echo
Jul 26, 2024 02:27:58.496735096 CEST	192.168.2.7	62.118.177.4	2cf	Echo
Jul 26, 2024 02:27:58.496798038 CEST	192.168.2.7	62.118.78.161	2ce	Echo
Jul 26, 2024 02:27:58.993647099 CEST	192.168.2.7	62.118.90.227	2cd	Echo
Jul 26, 2024 02:27:58.996256113 CEST	192.168.2.7	62.118.179.220	2cc	Echo
Jul 26, 2024 02:27:58.996326923 CEST	192.168.2.7	62.118.111.141	2cb	Echo
Jul 26, 2024 02:27:58.996450901 CEST	192.168.2.7	62.118.18.4	2ca	Echo
Jul 26, 2024 02:27:58.996556997 CEST	192.168.2.7	62.118.217.73	2c9	Echo
Jul 26, 2024 02:27:58.996674061 CEST	192.168.2.7	62.118.154.69	2c8	Echo

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jul 26, 2024 02:26:54.942286968 CEST	192.168.2.7	1.1.1.1	0x9c18	Standard query (0)	ddos.dnsnb8.net	A (IP address)	IN (0x0001)	false
Jul 26, 2024 02:26:55.930443048 CEST	192.168.2.7	1.1.1.1	0x9c18	Standard query (0)	ddos.dnsnb8.net	A (IP address)	IN (0x0001)	false
Jul 26, 2024 02:26:56.946252108 CEST	192.168.2.7	1.1.1.1	0x9c18	Standard query (0)	ddos.dnsnb8.net	A (IP address)	IN (0x0001)	false
Jul 26, 2024 02:26:58.945740938 CEST	192.168.2.7	1.1.1.1	0x9c18	Standard query (0)	ddos.dnsnb8.net	A (IP address)	IN (0x0001)	false
Jul 26, 2024 02:27:25.041059971 CEST	192.168.2.7	1.1.1.1	0x9492	Standard query (0)	15.164.165.52.in-addr.arpa	PTR (Pointer record)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jul 26, 2024 02:27:00.493125916 CEST	1.1.1.1	192.168.2.7	0x9c18	Server failure (2)	ddos.dnsnb8.net	none	none	A (IP address)	IN (0x0001)	false
Jul 26, 2024 02:27:00.493140936 CEST	1.1.1.1	192.168.2.7	0x9c18	Server failure (2)	ddos.dnsnb8.net	none	none	A (IP address)	IN (0x0001)	false
Jul 26, 2024 02:27:00.493150949 CEST	1.1.1.1	192.168.2.7	0x9c18	Server failure (2)	ddos.dnsnb8.net	none	none	A (IP address)	IN (0x0001)	false
Jul 26, 2024 02:27:00.493221998 CEST	1.1.1.1	192.168.2.7	0x9c18	Server failure (2)	ddos.dnsnb8.net	none	none	A (IP address)	IN (0x0001)	false
Jul 26, 2024 02:27:25.048304081 CEST	1.1.1.1	192.168.2.7	0x9492	Name error (3)	15.164.165.52.in-addr.arpa	none	none	PTR (Pointer record)	IN (0x0001)	false

Target ID:	2
Start time:	20:26:52
Start date:	25/07/2024
Path:	C:\Users\user\Desktop\7Y18r(223).exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\7Y18r(223).exe"
Imagebase:	0x400000
File size:	345'088 bytes
MD5 hash:	B77A751DBE5DE08BE02A2E38CEDECCBF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Linux_Trojan_Rbot_96625c8c, Description: unknown, Source: 00000002.00000002.2567412345.0000000000610000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Linux_Trojan_Rbot_96625c8c, Description: unknown, Source: 00000002.00000003.1321149619.00000000004C0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Linux_Trojan_Rbot_96625c8c, Description: unknown, Source: 00000002.00000002.2567487790.000000000068E000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: Linux_Trojan_Rbot_96625c8c, Description: unknown, Source: 00000002.00000002.2567949608.0000000000745000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: Linux_Trojan_Rbot_96625c8c, Description: unknown, Source: 00000002.00000002.2567487790.0000000000726000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	20:26:52
Start date:	25/07/2024
Path:	C:\Users\user\AppData\Local\Temp\JdaybS.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user~1\AppData\Local\Temp\JdaybS.exe
Imagebase:	0x1a0000
File size:	15'872 bytes
MD5 hash:	F7D21DE5C4E81341ECCD280C11DDCC9A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 92%, ReversingLabs Detection: 93%, Virustotal, Browse
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	20:26:58
Start date:	25/07/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 6676 -s 1364
Imagebase:	0xa00000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	9.6%
Dynamic/Decrypted Code Coverage:	99.2%
Signature Coverage:	14.4%
Total number of Nodes:	1449
Total number of Limit Nodes:	27

Executed Functions

Function 00617A10 Relevance: 57.9, APIs: 31, Strings: 2, Instructions: 197
threadsynchronizationsleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00617D20: IsBadReadPtr.KERNEL32(?,00000400,?,?,?,?,00617A15), ref: 00617D40

SetErrorMode.KERNEL32(00008003), ref: 00617A1A

Part of subcall function 00617FC0: GetModuleFileNameA.KERNEL32(00000000,C:\Users\user\Desktop\7Y18r(223).exe,00000258,?,?,?,00617A24,00008003), ref: 00617FCF
Part of subcall function 00617FC0: LoadLibraryA.KERNEL32(icmp.dll,00000000,C:\Users\user\Desktop\7Y18r(223).exe,00000258,?,?,?,00617A24,00008003), ref: 00617FE3
Part of subcall function 00617FC0: GetProcAddress.KERNEL32(00000000,IcmpCreateFile), ref: 00617FF4
Part of subcall function 00617FC0: GetProcAddress.KERNEL32(00000000,IcmpSendEcho), ref: 00618008
Part of subcall function 00617FC0: GetProcAddress.KERNEL32(00000000,IcmpParseReplies), ref: 0061801C
Part of subcall function 00617FC0: GetProcAddress.KERNEL32(00000000,IcmpCloseHandle), ref: 00618030
Part of subcall function 00617FC0: InitializeCriticalSection.KERNEL32(0062AFD6,icmp.dll,00000000,C:\Users\user\Desktop\7Y18r(223).exe,00000258,?,?,?,00617A24,00008003), ref: 0061804D
Part of subcall function 00617FC0: InitializeCriticalSection.KERNEL32(0062AFBE,0062AFD6,icmp.dll,00000000,C:\Users\user\Desktop\7Y18r(223).exe,00000258,?,?,?,00617A24,00008003), ref: 00618057

Part of subcall function 00617E30: GetModuleFileNameA.KERNEL32(00000000,?,0000012C,?,0000012C,00000000,?,00000064,00000000,?,?,?,?,00617A29,00008003), ref: 00617E6D

InitializeCriticalSection.KERNEL32(0062B442,00008003), ref: 00617A2E
InitializeCriticalSection.KERNEL32(0062B45A,0062B442,00008003), ref: 00617A38
InitializeCriticalSection.KERNEL32(0062B472,0062B45A,0062B442,00008003), ref: 00617A42
InitializeCriticalSection.KERNEL32(0062B48A,0062B472,0062B45A,0062B442,00008003), ref: 00617A4C
InitializeCriticalSection.KERNEL32(0062B4A2,0062B48A,0062B472,0062B45A,0062B442,00008003), ref: 00617A56
WSAStartup.WS2_32(00000202,0062BA46), ref: 00617A65
GetVersionExA.KERNEL32(0062BCB0,0062B4A2,0062B48A,0062B472,0062B45A,0062B442,00008003), ref: 00617A81

Part of subcall function 006110C0: GetCommandLineW.KERNEL32(?,?,?,?,00617A8B,0062BCB0,0062B4A2,0062B48A,0062B472,0062B45A,0062B442,00008003), ref: 006110CC
Part of subcall function 006110C0: CommandLineToArgvW.SHELL32(00000000,0062BD78,?,?,?,?,00617A8B,0062BCB0,0062B4A2,0062B48A,0062B472,0062B45A,0062B442,00008003), ref: 006110D9

CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,0062BCB0,0062B4A2,0062B48A,0062B472,0062B45A,0062B442,00008003), ref: 00617A98
ExitProcess.KERNEL32(00000000,0062B4A2,0062B48A,0062B472,0062B45A,0062B442,00008003), ref: 00617B60
CreateMutexA.KERNEL32(00000000,00000001,jhdheruhfrthkgjhtjkghjk5trh,-embedding,0062BBE0), ref: 00617B95
GetLastError.KERNEL32(00000000,00000001,jhdheruhfrthkgjhtjkghjk5trh,-embedding,0062BBE0), ref: 00617B9F
CloseHandle.KERNEL32(00000000,00000001,jhdheruhfrthkgjhtjkghjk5trh,-embedding,0062BBE0), ref: 00617BAE
ExitProcess.KERNEL32(00000000,00000000,00000001,jhdheruhfrthkgjhtjkghjk5trh,-embedding,0062BBE0), ref: 00617BB5
CoTaskMemAlloc.OLE32(0000000C,00000000,00000001,jhdheruhfrthkgjhtjkghjk5trh,-embedding,0062BBE0), ref: 00617BBC
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,0000000C,00000000,00000001,jhdheruhfrthkgjhtjkghjk5trh,-embedding,0062BBE0), ref: 00617BCE
CreateThread.KERNEL32(00000000,00000000,006131F0,00000000,00000001,?), ref: 00617BEB
CreateThread.KERNEL32(00000000,00000000,00612040,00000000,00000001,?), ref: 00617C04
CloseHandle.KERNEL32(00000000,00000000,00000000,00612040,00000000,00000001,?,00000000,00000000,00000000,00000000,0000000C,00000000,00000001,jhdheruhfrthkgjhtjkghjk5trh,-embedding), ref: 00617C0A
CreateThread.KERNEL32(00000000,00000000,00617C90,?,00000001,?), ref: 00617C21
CloseHandle.KERNEL32(00000000,00000000,00000000,00617C90,?,00000001,?,00000000,00000000,00000000,00612040,00000000,00000001,?,00000000,00000000), ref: 00617C27
CreateThread.KERNEL32(00000000,00000000,00612750,00000000,00000004,?), ref: 00617C41
WaitForSingleObject.KERNEL32(000000FF,00000000,00000000,00612750,00000000,00000004,?,00000000,00000000,00000000,00617C90,?,00000001,?,00000000,00000000), ref: 00617C51
Sleep.KERNEL32(000003E8,00000000,00000001,000000FF,00000000,00000000,00612750,00000000,00000004,?,00000000,00000000,00000000,00617C90,?,00000001), ref: 00617C6D
ExitProcess.KERNEL32(00000000,000000FF,00000000,00000000,00612750,00000000,00000004,?,00000000,00000000,00000000,00617C90,?,00000001,?,00000000), ref: 00617C7D
Sleep.KERNEL32(000000C8,?,00000000,00000004), ref: 00617C9E
CoTaskMemFree.OLE32(00000000,?,?,?,000000C8,?,00000000,00000004), ref: 00617CC1
WaitForSingleObject.KERNEL32(00000000,0036EE80,00000000,?,?,?,000000C8,?,00000000,00000004), ref: 00617CCE
ResumeThread.KERNEL32(00000000,00000000,0036EE80,00000000,0036EE80,00000000,?,?,?,000000C8,?,00000000,00000004), ref: 00617CDC
SuspendThread.KERNEL32(00000000,00000000,00000000,0036EE80,00000000,0036EE80,00000000,?,?,?,000000C8,?,00000000,00000004), ref: 00617CE4

Part of subcall function 006113D0: GetLastError.KERNEL32 ref: 0061140C

Strings

-embedding, xrefs: 00617B78
jhdheruhfrthkgjhtjkghjk5trh, xrefs: 00617B8C

Memory Dump Source

Source File: 00000002.00000002.2567412345.0000000000610000.00000040.00001000.00020000.00000000.sdmp, Offset: 00610000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_610000_7Y18r(223).jbxd

Yara matches

Similarity

API ID: CreateCriticalInitializeSection$Thread$AddressProc$CloseErrorExitHandleProcess$CommandEventFileLastLineModuleNameObjectSingleSleepTaskWait$AllocArgvFreeLibraryLoadModeMutexReadResumeStartupSuspendVersion
String ID: -embedding$jhdheruhfrthkgjhtjkghjk5trh
API String ID: 920258727-2388181652
Opcode ID: 218dea3c89b82eed23bd489a1a360fab0fd8eabd4d29fb0eefb3cf8d6c5ba160
Instruction ID: ea5c01e7035f5ad866f7782946dd058bc35c6254f8333f655496a782f914cdb8
Opcode Fuzzy Hash: 218dea3c89b82eed23bd489a1a360fab0fd8eabd4d29fb0eefb3cf8d6c5ba160
Instruction Fuzzy Hash: 8B616C30A88704AEEBA1BBA09C03BDD3673EF05B51F2C5109B6106A1D2CFB115C1966E

Function 00462044 Relevance: 33.4, APIs: 4, Strings: 15, Instructions: 171
fileprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(?,C0000000,00000000,00000000,00000002,00000080,00000000), ref: 00462223
WriteFile.KERNELBASE(00000000,FFF9F6AB,00003E00,?,00000000), ref: 00462252
FindCloseChangeNotification.KERNELBASE(00000000), ref: 00462256
WinExec.KERNEL32(?,00000005), ref: 00462262

Strings

GetM, xrefs: 004620B6
dleA, xrefs: 004620D0
Kern, xrefs: 004620F4
Writ, xrefs: 00462148
.dll, xrefs: 00462102
odul, xrefs: 0046222D
WinE, xrefs: 00462110
JdaybS.exe, xrefs: 004621FD, 00462200
lstr, xrefs: 004621A7
athA, xrefs: 00462199
Clos, xrefs: 00462129
catA, xrefs: 004621AF
el32, xrefs: 004620FB
Crea, xrefs: 00462169
GetT, xrefs: 00462188

Memory Dump Source

Source File: 00000002.00000002.2567188962.0000000000462000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2567016652.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2567034359.0000000000401000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2567055275.0000000000404000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2567075416.0000000000405000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2567075416.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2567075416.0000000000410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2567075416.0000000000415000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2567155186.0000000000420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2567207031.0000000000463000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_7Y18r(223).jbxd

Similarity

API ID: File$ChangeCloseCreateExecFindNotificationWrite
String ID: .dll$Clos$Crea$GetM$GetT$JdaybS.exe$Kern$WinE$Writ$athA$catA$dleA$el32$lstr$odul
API String ID: 2234911746-565700817
Opcode ID: 6a044a79e2ab6b89305325f5b14eefe5a09cc18762676af92a795dcb8c5dbbae
Instruction ID: d4292efc7cebfd55cb17ea6bf17c7f8b7552f9afc8cd28c97dda1a7f0f902067
Opcode Fuzzy Hash: 6a044a79e2ab6b89305325f5b14eefe5a09cc18762676af92a795dcb8c5dbbae
Instruction Fuzzy Hash: 28614E74D04615EBCF24CF90CA846EEB7B0BF45311F1581ABD6056B301E7B88E81CB9A

Function 00612100 Relevance: 33.3, APIs: 16, Strings: 3, Instructions: 90
filesleepmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoTaskMemAlloc.OLE32(0000026A), ref: 0061210E
wsprintfA.USER32 ref: 00612130
FindFirstFileA.KERNEL32(0000013E,00000000,0000026A), ref: 00612140
wsprintfA.USER32 ref: 00612169
Sleep.KERNEL32(00000064,?,?,0000013E,00000000,0000026A), ref: 00612184
FindNextFileA.KERNEL32(00000000,00000000,0000013E,00000000,0000026A), ref: 00612208
FindClose.KERNEL32(00000000,00000000,00000000,0000013E,00000000,0000026A), ref: 00612216
CoTaskMemFree.OLE32(00000000,00000000,00000000,00000000,0000013E,00000000,0000026A), ref: 0061221C

Strings

.htm, xrefs: 006121D0, 006121D3
%s\%s, xrefs: 00612124, 0061215D
*.*, xrefs: 0061211C

Memory Dump Source

Source File: 00000002.00000002.2567412345.0000000000610000.00000040.00001000.00020000.00000000.sdmp, Offset: 00610000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_610000_7Y18r(223).jbxd

Yara matches

Similarity

API ID: Find$FileTaskwsprintf$AllocCloseFirstFreeNextSleep
String ID: %s\%s$*.*$.htm
API String ID: 2299822837-2292242013
Opcode ID: 65eaac1fd4637287fd3f62d439c0ada4161d627d3c4e6e71e4c327e7b40b6873
Instruction ID: 0736635e12268f431655e86e5a55386667c882b0b00418292793a07885aa7326
Opcode Fuzzy Hash: 65eaac1fd4637287fd3f62d439c0ada4161d627d3c4e6e71e4c327e7b40b6873
Instruction Fuzzy Hash: A931C2718007157DCB61FBB08C42FDE7BEAAF05310F584618F665A20D2DF70A7908B99

Function 00617FC0 Relevance: 24.5, APIs: 8, Strings: 6, Instructions: 46
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameA.KERNEL32(00000000,C:\Users\user\Desktop\7Y18r(223).exe,00000258,?,?,?,00617A24,00008003), ref: 00617FCF
LoadLibraryA.KERNEL32(icmp.dll,00000000,C:\Users\user\Desktop\7Y18r(223).exe,00000258,?,?,?,00617A24,00008003), ref: 00617FE3
GetProcAddress.KERNEL32(00000000,IcmpCreateFile), ref: 00617FF4
GetProcAddress.KERNEL32(00000000,IcmpSendEcho), ref: 00618008
GetProcAddress.KERNEL32(00000000,IcmpParseReplies), ref: 0061801C
GetProcAddress.KERNEL32(00000000,IcmpCloseHandle), ref: 00618030
InitializeCriticalSection.KERNEL32(0062AFD6,icmp.dll,00000000,C:\Users\user\Desktop\7Y18r(223).exe,00000258,?,?,?,00617A24,00008003), ref: 0061804D
InitializeCriticalSection.KERNEL32(0062AFBE,0062AFD6,icmp.dll,00000000,C:\Users\user\Desktop\7Y18r(223).exe,00000258,?,?,?,00617A24,00008003), ref: 00618057

Strings

IcmpParseReplies, xrefs: 00618016
IcmpCreateFile, xrefs: 00617FEE
IcmpCloseHandle, xrefs: 0061802A
icmp.dll, xrefs: 00617FDE
C:\Users\user\Desktop\7Y18r(223).exe, xrefs: 00617FC8
IcmpSendEcho, xrefs: 00618002

Memory Dump Source

Source File: 00000002.00000002.2567412345.0000000000610000.00000040.00001000.00020000.00000000.sdmp, Offset: 00610000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_610000_7Y18r(223).jbxd

Yara matches

Similarity

API ID: AddressProc$CriticalInitializeSection$FileLibraryLoadModuleName
String ID: C:\Users\user\Desktop\7Y18r(223).exe$IcmpCloseHandle$IcmpCreateFile$IcmpParseReplies$IcmpSendEcho$icmp.dll
API String ID: 2957778358-2868117570
Opcode ID: 50b825330850e8b631f7b5c087038b2bd591cfa8f9c00bca305fefd1ab7256cd
Instruction ID: ba9e5572e2238cd60337ecfb07d16d93dce3e01f6cb99df215754a775f7bff9c
Opcode Fuzzy Hash: 50b825330850e8b631f7b5c087038b2bd591cfa8f9c00bca305fefd1ab7256cd
Instruction Fuzzy Hash: 0EF0A7706C1A206DD3A167B16C42EED1697DF51F41F4D1819B82463181DFA8498ACE69

Function 0061EF90 Relevance: 13.6, APIs: 9, Instructions: 114networkCOMMON

Download Yara Rule

APIs

select.WS2_32(00000000,00000000,?,00000000,?), ref: 0061EFD5
send.WS2_32(?,?,?,00000000), ref: 0061EFF2
select.WS2_32(00000000,?,00000000,00000000,?), ref: 0061F029
recv.WS2_32(?,?,?,00000000), ref: 0061F04F
htonl.WS2_32(?), ref: 0061F06E
recv.WS2_32(?,?,-00000004,00000000), ref: 0061F0A3
SetLastError.KERNEL32(45724474,?,?,?,00000000,?,00000000,?,00000000,?,00000000,00000000,?,?,?,?), ref: 0061F0C4
WSAGetLastError.WS2_32(00000000,00000000,?,00000000,?,?,?,?,?), ref: 0061F0E5
SetLastError.KERNEL32(00000000,00000000,00000000,?,00000000,?,?,?,?,?), ref: 0061F0EB

Memory Dump Source

Source File: 00000002.00000002.2567412345.0000000000610000.00000040.00001000.00020000.00000000.sdmp, Offset: 00610000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_610000_7Y18r(223).jbxd

Yara matches

Similarity

API ID: ErrorLast$recvselect$htonlsend
String ID:
API String ID: 1510305636-0
Opcode ID: 2f329da13bc04a85d5105a457cd6c53658aa2ee6f4a6404148ce5ece75761215
Instruction ID: 108b9671d5a1156a042dad463c5efd08dd0bbc09cedfd52662b6f00e3c0db9c2
Opcode Fuzzy Hash: 2f329da13bc04a85d5105a457cd6c53658aa2ee6f4a6404148ce5ece75761215
Instruction Fuzzy Hash: 7941B67190020AAFDF10DFA4CD91BEF7BB6EB08325F284626F511A72C2D7B159818B61

Function 00612040 Relevance: 13.6, APIs: 9, Instructions: 50stringthreadsleepCOMMON

Download Yara Rule

APIs

GetLogicalDriveStringsA.KERNEL32(0000012C,?), ref: 0061205E
GetDriveTypeA.KERNEL32(?), ref: 0061206C
CoTaskMemAlloc.OLE32(00000032,?), ref: 00612078
lstrcpyA.KERNEL32(?,?,00000032,?), ref: 0061208A
CreateThread.KERNEL32(00000000,00000000,00612100,?,00000001,?), ref: 006120B1
SetThreadPriority.KERNEL32(?,000000FE,00000000,00000000,00612100,?,00000001,?,?,?,00000032,?), ref: 006120C4
WaitForSingleObject.KERNEL32(?,000000FF,?,000000FE,00000000,00000000,00612100,?,00000001,?,?,?,00000032,?), ref: 006120D1
lstrlenA.KERNEL32(?,?), ref: 006120D7
Sleep.KERNEL32(0CDFE600,?,?), ref: 006120E9

Memory Dump Source

Source File: 00000002.00000002.2567412345.0000000000610000.00000040.00001000.00020000.00000000.sdmp, Offset: 00610000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_610000_7Y18r(223).jbxd

Yara matches

Similarity

API ID: DriveThread$AllocCreateLogicalObjectPrioritySingleSleepStringsTaskTypeWaitlstrcpylstrlen
String ID:
API String ID: 1053226204-0
Opcode ID: 3f4f8cae69d6ecb2192d93a9bef8b141992d276719a0589dcb7f2231293ef310
Instruction ID: 24ef81c463bfeb87cd352386727fc636af1980ea56d378b87f76a8557d9242cf
Opcode Fuzzy Hash: 3f4f8cae69d6ecb2192d93a9bef8b141992d276719a0589dcb7f2231293ef310
Instruction Fuzzy Hash: 4E116130804229BDDB71AAA08C52FDEB67AAF05710F5C0299F218B3192DF711ED2DB59

Function 00617860 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 78networkCOMMON

Download Yara Rule

APIs

htonl.WS2_32(?), ref: 006178A8
send.WS2_32(?,?,?,00000000), ref: 006178F9
select.WS2_32(00000000,00000001,00000000,00000000,00000006), ref: 00617940
recv.WS2_32(?,?,00000200,00000000), ref: 0061795F

Strings

, xrefs: 00617882

Memory Dump Source

Source File: 00000002.00000002.2567412345.0000000000610000.00000040.00001000.00020000.00000000.sdmp, Offset: 00610000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_610000_7Y18r(223).jbxd

Yara matches

Similarity

API ID: htonlrecvselectsend
String ID:
API String ID: 3511235689-3916222277
Opcode ID: 5569af4bf08f1f35bca5c99620ac4d7db9c057b32442e614ea261103e6af9406
Instruction ID: 96a989f8d6aa0eaf112b5c4b515cc3f6390f6e02ef61a8a868a6a0ce7aa10190
Opcode Fuzzy Hash: 5569af4bf08f1f35bca5c99620ac4d7db9c057b32442e614ea261103e6af9406
Instruction Fuzzy Hash: AE31C271904219AADB20DF58CC45BCDB7B6EF00320F148295E128672D1DB746BC5DF95

Function 00617790 Relevance: 4.6, APIs: 3, Instructions: 65memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,?,?,?,00000000), ref: 006177B2
htonl.WS2_32(?), ref: 00617826

Part of subcall function 0061EF90: select.WS2_32(00000000,00000000,?,00000000,?), ref: 0061EFD5
Part of subcall function 0061EF90: send.WS2_32(?,?,?,00000000), ref: 0061EFF2
Part of subcall function 0061EF90: select.WS2_32(00000000,?,00000000,00000000,?), ref: 0061F029
Part of subcall function 0061EF90: recv.WS2_32(?,?,?,00000000), ref: 0061F04F
Part of subcall function 0061EF90: htonl.WS2_32(?), ref: 0061F06E

LocalFree.KERNEL32(00000000,?,00000000,?,00000000,00000200,?,?,00000000,0000000A,-0000003F,?,?), ref: 0061784A

Memory Dump Source

Source File: 00000002.00000002.2567412345.0000000000610000.00000040.00001000.00020000.00000000.sdmp, Offset: 00610000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_610000_7Y18r(223).jbxd

Yara matches

Similarity

API ID: Localhtonlselect$AllocFreerecvsend
String ID:
API String ID: 2996792744-0
Opcode ID: e414fe19fbf19fcf1ac922e99fa7f693cdb5bc03f2ca4003eb304202178a8cbe
Instruction ID: 8913b3f80b9eeb6fcc80d99aab7aa1794fb2e1d675926b831be3cbb782682c93
Opcode Fuzzy Hash: e414fe19fbf19fcf1ac922e99fa7f693cdb5bc03f2ca4003eb304202178a8cbe
Instruction Fuzzy Hash: B911DB71500782ABD7009F58CC84F8BBB66FF01364F188218F5281B781E775A520C3D9

Function 006133E0 Relevance: 4.5, APIs: 3, Instructions: 25encryptionCOMMON

Download Yara Rule

APIs

CryptAcquireContextA.ADVAPI32(?,00000000,00000000,00000001,F0000000), ref: 006133F8
CryptGenRandom.ADVAPI32(?,0001FFFE,?,?,00000000,00000000,00000001,F0000000), ref: 00613408
CryptReleaseContext.ADVAPI32(?,00000000,?,0001FFFE,?,?,00000000,00000000,00000001,F0000000), ref: 00613412

Memory Dump Source

Source File: 00000002.00000002.2567412345.0000000000610000.00000040.00001000.00020000.00000000.sdmp, Offset: 00610000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_610000_7Y18r(223).jbxd

Yara matches

Similarity

API ID: Crypt$Context$AcquireRandomRelease
String ID:
API String ID: 1815803762-0
Opcode ID: 874f4adde20ee1c1b45c5d1310c7072652b3ce6abe6ccdbfe09a98d306ab98ad
Instruction ID: 2ffc4616ef5aefa75fc0fa83d66442ccdab55c7d83a5bd7d430bda8160027072
Opcode Fuzzy Hash: 874f4adde20ee1c1b45c5d1310c7072652b3ce6abe6ccdbfe09a98d306ab98ad
Instruction Fuzzy Hash: AAE0C232644209B9EF60AA94DC43FCFBAAE9B41B64F304135B300B90D1DEB15B9092AD

Function 0061EBB0 Relevance: 4.5, APIs: 3, Instructions: 25encryptionCOMMON

Download Yara Rule

APIs

CryptAcquireContextA.ADVAPI32(?,00000000,00000000,00000001,F0000000,?,?,?), ref: 0061EBC8
CryptGenRandom.ADVAPI32(?,000003FF,?,?,00000000,00000000,00000001,F0000000,?,?,?), ref: 0061EBD8
CryptReleaseContext.ADVAPI32(?,00000000,?,000003FF,?,?,00000000,00000000,00000001,F0000000,?,?,?), ref: 0061EBE2

Memory Dump Source

Source File: 00000002.00000002.2567412345.0000000000610000.00000040.00001000.00020000.00000000.sdmp, Offset: 00610000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_610000_7Y18r(223).jbxd

Yara matches

Similarity

API ID: Crypt$Context$AcquireRandomRelease
String ID:
API String ID: 1815803762-0
Opcode ID: 7b269ce65e588c9a49dec8ea355f1546645db1eb814b210a09b551820673e043
Instruction ID: fff28c897f407494d79077acb7f152912c6d9190595d4e495a5a0ab62a9b46f9
Opcode Fuzzy Hash: 7b269ce65e588c9a49dec8ea355f1546645db1eb814b210a09b551820673e043
Instruction Fuzzy Hash: 88E0CD31640209BEEF60A694DC43FCF7A6DDB40754F2041317700750D1DEB15B50925D

Function 00620A80 Relevance: 3.1, APIs: 2, Instructions: 75COMMON

Download Yara Rule

APIs

htonl.WS2_32(00000072), ref: 00620AF1

Part of subcall function 0061EF90: select.WS2_32(00000000,00000000,?,00000000,?), ref: 0061EFD5
Part of subcall function 0061EF90: send.WS2_32(?,?,?,00000000), ref: 0061EFF2
Part of subcall function 0061EF90: select.WS2_32(00000000,?,00000000,00000000,?), ref: 0061F029
Part of subcall function 0061EF90: recv.WS2_32(?,?,?,00000000), ref: 0061F04F
Part of subcall function 0061EF90: htonl.WS2_32(?), ref: 0061F06E

htonl.WS2_32 ref: 00620B15

Memory Dump Source

Source File: 00000002.00000002.2567412345.0000000000610000.00000040.00001000.00020000.00000000.sdmp, Offset: 00610000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_610000_7Y18r(223).jbxd

Yara matches

Similarity

API ID: htonl$select$recvsend
String ID:
API String ID: 4003896710-0
Opcode ID: 58266d7afe74977b6e90c510490d3d0f8671c5cc51634d1b1ae4836f8ebe51f6
Instruction ID: 06951d34d7a15415d6548bb965ac2c88cccb15b56a258a67a0f18f87c414442e
Opcode Fuzzy Hash: 58266d7afe74977b6e90c510490d3d0f8671c5cc51634d1b1ae4836f8ebe51f6
Instruction Fuzzy Hash: 8D213D729006616BE7309F28DC40A8FBBA6BF45324F188619FC68673C2D731DD50C790

Function 006179D0 Relevance: 45.7, APIs: 24, Strings: 2, Instructions: 177
threadmemorysynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSAStartup.WS2_32(00000202,0062BA46), ref: 00617A65
GetVersionExA.KERNEL32(0062BCB0,0062B4A2,0062B48A,0062B472,0062B45A,0062B442,00008003), ref: 00617A81
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,0062BCB0,0062B4A2,0062B48A,0062B472,0062B45A,0062B442,00008003), ref: 00617A98
ExitProcess.KERNEL32(00000000,0062B4A2,0062B48A,0062B472,0062B45A,0062B442,00008003), ref: 00617B60
CreateMutexA.KERNEL32(00000000,00000001,jhdheruhfrthkgjhtjkghjk5trh,-embedding,0062BBE0), ref: 00617B95
GetLastError.KERNEL32(00000000,00000001,jhdheruhfrthkgjhtjkghjk5trh,-embedding,0062BBE0), ref: 00617B9F
CloseHandle.KERNEL32(00000000,00000001,jhdheruhfrthkgjhtjkghjk5trh,-embedding,0062BBE0), ref: 00617BAE
ExitProcess.KERNEL32(00000000,00000000,00000001,jhdheruhfrthkgjhtjkghjk5trh,-embedding,0062BBE0), ref: 00617BB5
CoTaskMemAlloc.OLE32(0000000C,00000000,00000001,jhdheruhfrthkgjhtjkghjk5trh,-embedding,0062BBE0), ref: 00617BBC
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,0000000C,00000000,00000001,jhdheruhfrthkgjhtjkghjk5trh,-embedding,0062BBE0), ref: 00617BCE
CreateThread.KERNEL32(00000000,00000000,006131F0,00000000,00000001,?), ref: 00617BEB
CreateThread.KERNEL32(00000000,00000000,00612040,00000000,00000001,?), ref: 00617C04
CloseHandle.KERNEL32(00000000,00000000,00000000,00612040,00000000,00000001,?,00000000,00000000,00000000,00000000,0000000C,00000000,00000001,jhdheruhfrthkgjhtjkghjk5trh,-embedding), ref: 00617C0A
CreateThread.KERNEL32(00000000,00000000,00617C90,?,00000001,?), ref: 00617C21
CloseHandle.KERNEL32(00000000,00000000,00000000,00617C90,?,00000001,?,00000000,00000000,00000000,00612040,00000000,00000001,?,00000000,00000000), ref: 00617C27

Strings

-embedding, xrefs: 00617B78
jhdheruhfrthkgjhtjkghjk5trh, xrefs: 00617B8C

Memory Dump Source

Source File: 00000002.00000002.2567412345.0000000000610000.00000040.00001000.00020000.00000000.sdmp, Offset: 00610000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_610000_7Y18r(223).jbxd

Yara matches

Similarity

API ID: Create$CloseHandleThread$EventExitProcess$AllocErrorLastMutexStartupTaskVersion
String ID: -embedding$jhdheruhfrthkgjhtjkghjk5trh
API String ID: 2193678037-2388181652
Opcode ID: 10cf0f7ea9724adbd1e482ef02c8fa0712ce87be13fd7057de6e64c13900bffd
Instruction ID: 51728aad0efd22502071eef86ec99710d4f2057ca2e23112d5ca9ef05cccdb3e
Opcode Fuzzy Hash: 10cf0f7ea9724adbd1e482ef02c8fa0712ce87be13fd7057de6e64c13900bffd
Instruction Fuzzy Hash: AD51D170A88704BEEBA1ABA08C03FDD7B67AF05B11F1C4159F6146B1D2DFB066C18799

Function 00617B65 Relevance: 42.1, APIs: 22, Strings: 2, Instructions: 129
threadsynchronizationsleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00618060: GetModuleFileNameA.KERNEL32(00000000,?,0000012C,?,?,?,?,00617B73), ref: 0061807A
Part of subcall function 00618060: GetSystemDirectoryA.KERNEL32(?,00000258), ref: 0061809D
Part of subcall function 00618060: lstrcatA.KERNEL32(?,irdvxc.exe ,?,00000258,00000000,?,0000012C,?,?,?,?,00617B73), ref: 006180C1
Part of subcall function 00618060: CopyFileA.KERNEL32(?,?,00000000), ref: 006180D6
Part of subcall function 00618060: lstrcpyA.KERNEL32(?,?,?,irdvxc.exe ,?,00000258,00000000,?,0000012C,?,?,?,?,00617B73), ref: 006180E9
Part of subcall function 00618060: lstrcpyA.KERNEL32(?,?,?,?,?,irdvxc.exe ,?,00000258,00000000,?,0000012C,?,?,?,?,00617B73), ref: 006180FC
Part of subcall function 00618060: lstrcatA.KERNEL32(?,/installservice,?,?,?,?,?,irdvxc.exe ,?,00000258,00000000,?,0000012C), ref: 0061810D
Part of subcall function 00618060: lstrcatA.KERNEL32(?,/start,?,/installservice,?,?,?,?,?,irdvxc.exe ,?,00000258,00000000,?,0000012C), ref: 0061811E
Part of subcall function 00618060: Sleep.KERNEL32(000007D0,?,?,/start,?,/installservice,?,?,?,?,?,irdvxc.exe ,?,00000258,00000000,?), ref: 00618134
Part of subcall function 00618060: ExitProcess.KERNEL32(00000000,?,000007D0,?,?,/start,?,/installservice,?,?,?,?,?,irdvxc.exe ,?,00000258), ref: 00618147

Part of subcall function 00611000: lstrlenA.KERNEL32(?,?,?,?,?,00617B82,-embedding,0062BBE0), ref: 00611011

CreateMutexA.KERNEL32(00000000,00000001,jhdheruhfrthkgjhtjkghjk5trh,-embedding,0062BBE0), ref: 00617B95
GetLastError.KERNEL32(00000000,00000001,jhdheruhfrthkgjhtjkghjk5trh,-embedding,0062BBE0), ref: 00617B9F
CloseHandle.KERNEL32(00000000,00000001,jhdheruhfrthkgjhtjkghjk5trh,-embedding,0062BBE0), ref: 00617BAE
ExitProcess.KERNEL32(00000000,00000000,00000001,jhdheruhfrthkgjhtjkghjk5trh,-embedding,0062BBE0), ref: 00617BB5
CoTaskMemAlloc.OLE32(0000000C,00000000,00000001,jhdheruhfrthkgjhtjkghjk5trh,-embedding,0062BBE0), ref: 00617BBC
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,0000000C,00000000,00000001,jhdheruhfrthkgjhtjkghjk5trh,-embedding,0062BBE0), ref: 00617BCE
CreateThread.KERNEL32(00000000,00000000,006131F0,00000000,00000001,?), ref: 00617BEB
CreateThread.KERNEL32(00000000,00000000,00612040,00000000,00000001,?), ref: 00617C04
CloseHandle.KERNEL32(00000000,00000000,00000000,00612040,00000000,00000001,?,00000000,00000000,00000000,00000000,0000000C,00000000,00000001,jhdheruhfrthkgjhtjkghjk5trh,-embedding), ref: 00617C0A
CreateThread.KERNEL32(00000000,00000000,00617C90,?,00000001,?), ref: 00617C21
CloseHandle.KERNEL32(00000000,00000000,00000000,00617C90,?,00000001,?,00000000,00000000,00000000,00612040,00000000,00000001,?,00000000,00000000), ref: 00617C27
CreateThread.KERNEL32(00000000,00000000,00612750,00000000,00000004,?), ref: 00617C41
WaitForSingleObject.KERNEL32(000000FF,00000000,00000000,00612750,00000000,00000004,?,00000000,00000000,00000000,00617C90,?,00000001,?,00000000,00000000), ref: 00617C51
Sleep.KERNEL32(000003E8,00000000,00000001,000000FF,00000000,00000000,00612750,00000000,00000004,?,00000000,00000000,00000000,00617C90,?,00000001), ref: 00617C6D
ExitProcess.KERNEL32(00000000,000000FF,00000000,00000000,00612750,00000000,00000004,?,00000000,00000000,00000000,00617C90,?,00000001,?,00000000), ref: 00617C7D
Sleep.KERNEL32(000000C8,?,00000000,00000004), ref: 00617C9E
CoTaskMemFree.OLE32(00000000,?,?,?,000000C8,?,00000000,00000004), ref: 00617CC1
WaitForSingleObject.KERNEL32(00000000,0036EE80,00000000,?,?,?,000000C8,?,00000000,00000004), ref: 00617CCE

Part of subcall function 00617DA0: CoInitialize.OLE32(00000000), ref: 00617DAE
Part of subcall function 00617DA0: CoRegisterClassObject.OLE32(0062B8EA,00000004,00000001,0062BCAC,00629FB8,?,?,?,?,00617B8C,-embedding,0062BBE0), ref: 00617DD6
Part of subcall function 00617DA0: GetModuleFileNameA.KERNEL32(00000000,?,0000012C,0062B8EA,00000004,00000001,0062BCAC,00629FB8,?,?,?,?,00617B8C,-embedding,0062BBE0), ref: 00617DE9
Part of subcall function 00617DA0: CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00000044,0062BBE0), ref: 00617E19
Part of subcall function 00617DA0: ExitProcess.KERNEL32(00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00000044,0062BBE0), ref: 00617E20

ResumeThread.KERNEL32(00000000,00000000,0036EE80,00000000,0036EE80,00000000,?,?,?,000000C8,?,00000000,00000004), ref: 00617CDC
SuspendThread.KERNEL32(00000000,00000000,00000000,0036EE80,00000000,0036EE80,00000000,?,?,?,000000C8,?,00000000,00000004), ref: 00617CE4
ResumeThread.KERNEL32(00000000,00000000,0036EE80,00000000,?,?,?,000000C8,?,00000000,00000004), ref: 00617CFB
SuspendThread.KERNEL32(00000000,00000000,00000000,0036EE80,00000000,?,?,?,000000C8,?,00000000,00000004), ref: 00617D03

Strings

-embedding, xrefs: 00617B78
jhdheruhfrthkgjhtjkghjk5trh, xrefs: 00617B8C

Memory Dump Source

Source File: 00000002.00000002.2567412345.0000000000610000.00000040.00001000.00020000.00000000.sdmp, Offset: 00610000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_610000_7Y18r(223).jbxd

Yara matches

Similarity

API ID: Thread$Create$Process$Exit$CloseFileHandleObjectSleeplstrcat$ModuleNameResumeSingleSuspendTaskWaitlstrcpy$AllocClassCopyDirectoryErrorEventFreeInitializeLastMutexRegisterSystemlstrlen
String ID: -embedding$jhdheruhfrthkgjhtjkghjk5trh
API String ID: 3284096771-2388181652
Opcode ID: 4f0de45ccf5b180603967989296663680b8d68a08dcc744e8027e30d7f421a88
Instruction ID: 5e30bd9c46731560814f649a90a611314d64176f4314e49702487a530adbde7c
Opcode Fuzzy Hash: 4f0de45ccf5b180603967989296663680b8d68a08dcc744e8027e30d7f421a88
Instruction Fuzzy Hash: 8D415C30A84719BEEBA16BE08C03FDD7A77AF00B11F184518B6147A1E1DFB166C09799

Function 0061F6B0 Relevance: 38.7, APIs: 21, Strings: 1, Instructions: 187
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

inet_addr.WS2_32(?), ref: 0061F6C6
socket.WS2_32(00000002,00000001,00000006), ref: 0061F6D3
htons.WS2_32(0000008B), ref: 0061F6F2
ioctlsocket.WS2_32(?,8004667E,00000001), ref: 0061F71A
setsockopt.WS2_32(?,0000FFFF,00000080,00000001,00000004), ref: 0061F74A
connect.WS2_32(?,?,00000010), ref: 0061F75B
WSAGetLastError.WS2_32 ref: 0061F769
select.WS2_32(00000000,00000000,00000001,00000000,00000006), ref: 0061F7B7
send.WS2_32(?,0062A970,0000004C,00000000), ref: 0061F7DC
select.WS2_32(00000000,00000001,00000000,00000000,00000006), ref: 0061F829
recv.WS2_32(?,?,00000400,00000000), ref: 0061F84B
closesocket.WS2_32(?), ref: 0061F890
socket.WS2_32(00000002,00000001,00000006), ref: 0061F89B
htons.WS2_32(000001BD), ref: 0061F8B4
ioctlsocket.WS2_32(?,8004667E,00000001), ref: 0061F8DC
setsockopt.WS2_32(?,0000FFFF,00000080,00000001,00000004), ref: 0061F90C
connect.WS2_32(?,?,00000010), ref: 0061F91D
WSAGetLastError.WS2_32(?,?,00000010,?,0000FFFF,00000080,00000001,00000004,?,8004667E,00000001,000001BD,00000002,00000001,00000006), ref: 0061F92B
select.WS2_32(00000000,00000000,00000001,00000000,00000006), ref: 0061F975

Strings

\srvsvc, xrefs: 0061F6B9

Memory Dump Source

Source File: 00000002.00000002.2567412345.0000000000610000.00000040.00001000.00020000.00000000.sdmp, Offset: 00610000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_610000_7Y18r(223).jbxd

Yara matches

Similarity

API ID: select$ErrorLastconnecthtonsioctlsocketsetsockoptsocket$closesocketinet_addrrecvsend
String ID: \srvsvc
API String ID: 3001725260-3263190950
Opcode ID: bb11b99bca2d534b6e2e17c45beb256941286fc8c640e9a467db4ea9e547cb48
Instruction ID: aa80d769797e1a53d26aff26083c1a8093dfac12f18a79c55cb95dda31b3b2ae
Opcode Fuzzy Hash: bb11b99bca2d534b6e2e17c45beb256941286fc8c640e9a467db4ea9e547cb48
Instruction Fuzzy Hash: 3B71C4B0A00118AADB70AB60CC41BEDB6B6AF08324F5446E5F318B61D1DBB14EC89F5D

Function 00616F40 Relevance: 35.5, APIs: 11, Strings: 9, Instructions: 484
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnterCriticalSection.KERNEL32(0062AFBE), ref: 00616F58
inet_ntoa.WS2_32(?), ref: 00616F69
lstrcpyA.KERNEL32(00613812,00000000), ref: 00616F73
LeaveCriticalSection.KERNEL32(0062AFBE,00613812,00000000), ref: 00616F7D
InterlockedIncrement.KERNEL32(0062BDD0), ref: 00616F87

Part of subcall function 0061F9D0: GetCurrentProcessId.KERNEL32(00000000,?,?,?,?,\srvsvc), ref: 0061FA16
Part of subcall function 0061F9D0: VirtualAlloc.KERNEL32(00000000,00002000,00003000,00000004,00000000,?,?,?,?,\srvsvc), ref: 0061FA2F
Part of subcall function 0061F9D0: CharUpperA.USER32(?,?,?,?,?,00000000,00000060,?,0062A9E8,?,?,00000000,00000060,00000000,00002000,00003000), ref: 0061FAAB
Part of subcall function 0061F9D0: lstrlenA.KERNEL32(?,?,?,?,?,?,00000000,00000060,?,0062A9E8,?,?,00000000,00000060,00000000,00002000), ref: 0061FAB3
Part of subcall function 0061F9D0: closesocket.WS2_32(00000000), ref: 0061FB07
Part of subcall function 0061F9D0: VirtualFree.KERNEL32(00000000,00000000,00008000,00000000,00000000,00002000,00003000,00000004,00000000,?,?,?,?,\srvsvc), ref: 0061FB1C
Part of subcall function 0061F9D0: GetLastError.KERNEL32(00000000,00000000,00008000,00000000,00000000,00002000,00003000,00000004,00000000,?,?,?,?,\srvsvc), ref: 0061FB25

InterlockedDecrement.KERNEL32(0062BDD0), ref: 006176F7

Strings

\\*SMBSERVER\IPC$, xrefs: 00617005, 0061723C, 006173B9, 0061755D
\ntsvcs, xrefs: 006171E1, 00617267
\srvsvc, xrefs: 00616F8C, 00617030
C:\Users\user\Desktop\7Y18r(223).exe, xrefs: 0061719F, 00617328, 006174CC, 00617670, 006176CB
\browser, xrefs: 00616FC5, 0061721A
\samr, xrefs: 00617588
\epmapper, xrefs: 006173E4
Admin, xrefs: 00616F94, 00616F99, 006171E9, 006171EE, 0061736C, 00617371, 00617510, 00617515
Wind, xrefs: 00616FE6

Memory Dump Source

Source File: 00000002.00000002.2567412345.0000000000610000.00000040.00001000.00020000.00000000.sdmp, Offset: 00610000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_610000_7Y18r(223).jbxd

Yara matches

Similarity

API ID: CriticalInterlockedSectionVirtual$AllocCharCurrentDecrementEnterErrorFreeIncrementLastLeaveProcessUpperclosesocketinet_ntoalstrcpylstrlen
String ID: Admin$C:\Users\user\Desktop\7Y18r(223).exe$Wind$\\*SMBSERVER\IPC$$\browser$\epmapper$\ntsvcs$\samr$\srvsvc
API String ID: 3698622247-1971379272
Opcode ID: d367bacc60eae64b836ad48340eeada1b2166dfec6f9f1a2f2767e76ef816e9b
Instruction ID: 6555316ec1bce01d960f4b08d9396d97dceca9db25e0dbe83a7098ff7b3bc52a
Opcode Fuzzy Hash: d367bacc60eae64b836ad48340eeada1b2166dfec6f9f1a2f2767e76ef816e9b
Instruction Fuzzy Hash: 51129430949A28B9DF717B30EC4ABDCB773AF10724F384295F229751E2CA715AC19E49

Function 006135C8 Relevance: 34.7, APIs: 23, Instructions: 176
networkthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitThread.KERNEL32(00000000), ref: 006135CA

Part of subcall function 00613850: Icmp6CreateFile.IPHLPAPI ref: 00613869
Part of subcall function 00613850: lstrcpyA.KERNEL32(?,Babcdefghijklmnopqrstuvwabcdefghi), ref: 00613898
Part of subcall function 00613850: IcmpCloseHandle.IPHLPAPI(00000000), ref: 00613914

InterlockedIncrement.KERNEL32(0062BDD0), ref: 0061361C
socket.WS2_32(00000002,00000001,00000000), ref: 00613627
ioctlsocket.WS2_32(?,8004667E,00000001), ref: 0061364B
setsockopt.WS2_32(?,0000FFFF,00000080,00000001,00000004), ref: 0061366F
htons.WS2_32(0000008B), ref: 00613685
connect.WS2_32(?,00000002,00000010), ref: 00613697
WSAGetLastError.WS2_32(?,00000002,00000010,0000008B,?,0000FFFF,00000080,00000001,00000004,?,8004667E,00000001,0062BDD0,00000000,?,006179DD), ref: 006136A1
select.WS2_32(00000000,00000000,00000001,00000000,00000006), ref: 006136D6
InterlockedIncrement.KERNEL32(0062BDE0), ref: 006136E9
closesocket.WS2_32(?), ref: 006136FF
closesocket.WS2_32(?), ref: 00613714
socket.WS2_32(00000002,00000001,00000000), ref: 0061371F
ioctlsocket.WS2_32(?,8004667E,00000001), ref: 00613743
setsockopt.WS2_32(?,0000FFFF,00000080,00000001,00000004), ref: 00613767
htons.WS2_32(000001BD), ref: 0061377D
connect.WS2_32(?,00000002,00000010), ref: 0061378F
WSAGetLastError.WS2_32(?,00000002,00000010,000001BD,?,0000FFFF,00000080,00000001,00000004,?,8004667E,00000001,00000002,00000001,00000000,0062BDD0), ref: 00613799
select.WS2_32(00000000,00000000,00000001,00000000,00000006), ref: 006137CE
InterlockedIncrement.KERNEL32(0062BDE0), ref: 006137E1
closesocket.WS2_32(?), ref: 006137FF
InterlockedDecrement.KERNEL32(0062BDD0), ref: 00613817
ExitThread.KERNEL32(00000000), ref: 0061383E

Memory Dump Source

Source File: 00000002.00000002.2567412345.0000000000610000.00000040.00001000.00020000.00000000.sdmp, Offset: 00610000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_610000_7Y18r(223).jbxd

Yara matches

Similarity

API ID: Interlocked$Incrementclosesocket$ErrorExitLastThreadconnecthtonsioctlsocketselectsetsockoptsocket$CloseCreateDecrementFileHandleIcmpIcmp6lstrcpy
String ID:
API String ID: 861548258-0
Opcode ID: 9c77b17755339aebadadde6bc34b710b52b99b41e43e37d0714061f286ffd108
Instruction ID: 0bd6dfffe95b4f509d20fa8e6691632ba389f8ff7d2d27ede767f7cb24e41ddf
Opcode Fuzzy Hash: 9c77b17755339aebadadde6bc34b710b52b99b41e43e37d0714061f286ffd108
Instruction Fuzzy Hash: 73615FB0940219AEEF60EBE0CC46BEDBBB6FF04714F180119F511BA2D1DBB55A84CB59

Function 006165C0 Relevance: 33.5, APIs: 9, Strings: 10, Instructions: 247
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnterCriticalSection.KERNEL32(0062AFD6,?,?,\ntsvcs,?,006176F2,00000000,C:\Users\user\Desktop\7Y18r(223).exe,00613812,00002704,000007D0,00613812,00613812,Admin,Admin,00000000), ref: 006165D1
inet_ntoa.WS2_32(?), ref: 006165E2
lstrcpyA.KERNEL32(?,00000000,?,?,0062AFD6,?,?,\ntsvcs,?,006176F2,00000000,C:\Users\user\Desktop\7Y18r(223).exe,00613812,00002704,000007D0,00613812), ref: 006165EF
LeaveCriticalSection.KERNEL32(0062AFD6,?,00000000,?,?,0062AFD6,?,?,\ntsvcs,?,006176F2,00000000,C:\Users\user\Desktop\7Y18r(223).exe,00613812,00002704,000007D0), ref: 006165F9
InterlockedIncrement.KERNEL32(0062BDD0), ref: 00616603

Part of subcall function 0061F9D0: GetCurrentProcessId.KERNEL32(00000000,?,?,?,?,\srvsvc), ref: 0061FA16
Part of subcall function 0061F9D0: VirtualAlloc.KERNEL32(00000000,00002000,00003000,00000004,00000000,?,?,?,?,\srvsvc), ref: 0061FA2F
Part of subcall function 0061F9D0: CharUpperA.USER32(?,?,?,?,?,00000000,00000060,?,0062A9E8,?,?,00000000,00000060,00000000,00002000,00003000), ref: 0061FAAB
Part of subcall function 0061F9D0: lstrlenA.KERNEL32(?,?,?,?,?,?,00000000,00000060,?,0062A9E8,?,?,00000000,00000060,00000000,00002000), ref: 0061FAB3
Part of subcall function 0061F9D0: closesocket.WS2_32(00000000), ref: 0061FB07
Part of subcall function 0061F9D0: VirtualFree.KERNEL32(00000000,00000000,00008000,00000000,00000000,00002000,00003000,00000004,00000000,?,?,?,?,\srvsvc), ref: 0061FB1C
Part of subcall function 0061F9D0: GetLastError.KERNEL32(00000000,00000000,00008000,00000000,00000000,00002000,00003000,00000004,00000000,?,?,?,?,\srvsvc), ref: 0061FB25

InterlockedDecrement.KERNEL32(0062BDD0), ref: 00616984

Part of subcall function 00620400: IsBadReadPtr.KERNEL32(?,0000031A,?,?,\ntsvcs,?,0061620E,?,?,\\*SMBSERVER\IPC$,?,Administrator,password,00000000,?,00000000), ref: 0062040F

Strings

Admin, xrefs: 006166BE
\\*SMBSERVER\IPC$, xrefs: 00616774
\ntsvcs, xrefs: 006165C9, 00616728, 006168F1
%s (%s) %s:%s, xrefs: 006168C7, 00616903
Administrator, xrefs: 006166B6
Wind, xrefs: 00616632
c:\temp.exe, xrefs: 00616824
C:\Users\user\Desktop\7Y18r(223).exe, xrefs: 006168A1, 006168DD
\atsvc, xrefs: 0061679D
Wind, xrefs: 00616758

Memory Dump Source

Source File: 00000002.00000002.2567412345.0000000000610000.00000040.00001000.00020000.00000000.sdmp, Offset: 00610000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_610000_7Y18r(223).jbxd

Yara matches

Similarity

API ID: CriticalInterlockedSectionVirtual$AllocCharCurrentDecrementEnterErrorFreeIncrementLastLeaveProcessReadUpperclosesocketinet_ntoalstrcpylstrlen
String ID: %s (%s) %s:%s$Admin$Administrator$C:\Users\user\Desktop\7Y18r(223).exe$Wind$Wind$\\*SMBSERVER\IPC$$\atsvc$\ntsvcs$c:\temp.exe
API String ID: 2053271108-430362485
Opcode ID: 256b9ef1e0556b598301a73a78d51f99c06a6e330836d5914e5e2c70e280b2d2
Instruction ID: 3f5e1b595ddc4f721ce4c9f77e9f8e0667b9eb3a339c211d0a3aea2eb6adae86
Opcode Fuzzy Hash: 256b9ef1e0556b598301a73a78d51f99c06a6e330836d5914e5e2c70e280b2d2
Instruction Fuzzy Hash: E6B16B7180061AEFDF219F60CC45BDEBBBAAF04324F2446AAF165621A1DB305BD1DF45

Function 00616D90 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 133
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

gethostbyname.WS2_32(?), ref: 00616DA2
inet_addr.WS2_32(?), ref: 00616DB7
htons.WS2_32(?), ref: 00616DC2
socket.WS2_32(00000002,00000001,00000006), ref: 00616DD1
ioctlsocket.WS2_32(?,8004667E,?), ref: 00616DF3
setsockopt.WS2_32(?,0000FFFF,00000080,?,00000004), ref: 00616E17
connect.WS2_32(?,?,00000010), ref: 00616E25
WSAGetLastError.WS2_32(?,?,00000010,?,0000FFFF,00000080,?,00000004,?,8004667E,?,00000002,00000001,00000006,?,?), ref: 00616E33
select.WS2_32(00000000,00000000,?,00000000,?), ref: 00616E6C
select.WS2_32(00000000,00000000,?,00000000,?), ref: 00616EC3
send.WS2_32(?,?,000000FF,00000000), ref: 00616ED8
VirtualFree.KERNEL32(?,00000000,00008000,00000000,00000000,?,00000000,?,?,?,?,?,00000010,?,0000FFFF,00000080), ref: 00616F11
shutdown.WS2_32(?,00000002), ref: 00616F26
closesocket.WS2_32(?), ref: 00616F2E

Strings

\ntsvcs, xrefs: 00616D96

Memory Dump Source

Source File: 00000002.00000002.2567412345.0000000000610000.00000040.00001000.00020000.00000000.sdmp, Offset: 00610000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_610000_7Y18r(223).jbxd

Yara matches

Similarity

API ID: select$ErrorFreeLastVirtualclosesocketconnectgethostbynamehtonsinet_addrioctlsocketsendsetsockoptshutdownsocket
String ID: \ntsvcs
API String ID: 2499211422-3919542250
Opcode ID: c1710526dbbf1420f95261b391b2256f3205156a5a140ea35e8094095f663699
Instruction ID: 12c5d9ed86b89e0c3a00346c9790db84260940fa0e4e7863b5554096b54f7ecc
Opcode Fuzzy Hash: c1710526dbbf1420f95261b391b2256f3205156a5a140ea35e8094095f663699
Instruction Fuzzy Hash: 2E418274D0020AAEDF60DBA4DC86FEEBBB7AF04314F184125F610B72D1DBB599858B58

Function 00615CC6 Relevance: 19.6, APIs: 6, Strings: 5, Instructions: 377
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

inet_ntoa.WS2_32(?), ref: 00615CDF
lstrcpyA.KERNEL32(?,00000000,?,?,?,\ntsvcs), ref: 00615CEC

Part of subcall function 0061F9D0: GetCurrentProcessId.KERNEL32(00000000,?,?,?,?,\srvsvc), ref: 0061FA16
Part of subcall function 0061F9D0: VirtualAlloc.KERNEL32(00000000,00002000,00003000,00000004,00000000,?,?,?,?,\srvsvc), ref: 0061FA2F
Part of subcall function 0061F9D0: CharUpperA.USER32(?,?,?,?,?,00000000,00000060,?,0062A9E8,?,?,00000000,00000060,00000000,00002000,00003000), ref: 0061FAAB
Part of subcall function 0061F9D0: lstrlenA.KERNEL32(?,?,?,?,?,?,00000000,00000060,?,0062A9E8,?,?,00000000,00000060,00000000,00002000), ref: 0061FAB3
Part of subcall function 0061F9D0: closesocket.WS2_32(00000000), ref: 0061FB07
Part of subcall function 0061F9D0: VirtualFree.KERNEL32(00000000,00000000,00008000,00000000,00000000,00002000,00003000,00000004,00000000,?,?,?,?,\srvsvc), ref: 0061FB1C
Part of subcall function 0061F9D0: GetLastError.KERNEL32(00000000,00000000,00008000,00000000,00000000,00002000,00003000,00000004,00000000,?,?,?,?,\srvsvc), ref: 0061FB25

Strings

\ntsvcs, xrefs: 00615CCF
\lsarpc, xrefs: 00615D68
Administrator, xrefs: 00615CF8
password, xrefs: 00615CF3
\\*SMBSERVER\IPC$, xrefs: 00615D49

Memory Dump Source

Source File: 00000002.00000002.2567412345.0000000000610000.00000040.00001000.00020000.00000000.sdmp, Offset: 00610000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_610000_7Y18r(223).jbxd

Yara matches

Similarity

API ID: Virtual$AllocCharCurrentErrorFreeLastProcessUpperclosesocketinet_ntoalstrcpylstrlen
String ID: Administrator$\\*SMBSERVER\IPC$$\lsarpc$\ntsvcs$password
API String ID: 3545477113-3637742070
Opcode ID: 67eafaf5c72cef0c507d576a128febb9ee701cdbb2c4784cba38ef8262d9782b
Instruction ID: c54170e8bea400ec21737ff6adf7e1e42cdf341a8facb22056508b060e427fa1
Opcode Fuzzy Hash: 67eafaf5c72cef0c507d576a128febb9ee701cdbb2c4784cba38ef8262d9782b
Instruction Fuzzy Hash: E5E14271D00529EBEF309B64CC85FEDB77ABB04310F1882AAF619A6192DB715AC5CF50

Function 006135D0 Relevance: 18.1, APIs: 12, Instructions: 102
networkthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00613850: Icmp6CreateFile.IPHLPAPI ref: 00613869
Part of subcall function 00613850: lstrcpyA.KERNEL32(?,Babcdefghijklmnopqrstuvwabcdefghi), ref: 00613898
Part of subcall function 00613850: IcmpCloseHandle.IPHLPAPI(00000000), ref: 00613914

InterlockedIncrement.KERNEL32(0062BDD0), ref: 0061361C
socket.WS2_32(00000002,00000001,00000000), ref: 00613627
ioctlsocket.WS2_32(?,8004667E,00000001), ref: 0061364B
setsockopt.WS2_32(?,0000FFFF,00000080,00000001,00000004), ref: 0061366F
htons.WS2_32(0000008B), ref: 00613685
connect.WS2_32(?,00000002,00000010), ref: 00613697
WSAGetLastError.WS2_32(?,00000002,00000010,0000008B,?,0000FFFF,00000080,00000001,00000004,?,8004667E,00000001,0062BDD0,00000000,?,006179DD), ref: 006136A1
select.WS2_32(00000000,00000000,00000001,00000000,00000006), ref: 006136D6
InterlockedIncrement.KERNEL32(0062BDE0), ref: 006136E9
closesocket.WS2_32(?), ref: 006136FF
closesocket.WS2_32(?), ref: 00613714
socket.WS2_32(00000002,00000001,00000000), ref: 0061371F
ioctlsocket.WS2_32(?,8004667E,00000001), ref: 00613743
setsockopt.WS2_32(?,0000FFFF,00000080,00000001,00000004), ref: 00613767
htons.WS2_32(000001BD), ref: 0061377D
connect.WS2_32(?,00000002,00000010), ref: 0061378F
WSAGetLastError.WS2_32(?,00000002,00000010,000001BD,?,0000FFFF,00000080,00000001,00000004,?,8004667E,00000001,00000002,00000001,00000000,0062BDD0), ref: 00613799
select.WS2_32(00000000,00000000,00000001,00000000,00000006), ref: 006137CE
InterlockedIncrement.KERNEL32(0062BDE0), ref: 006137E1
closesocket.WS2_32(?), ref: 006137FF
InterlockedDecrement.KERNEL32(0062BDD0), ref: 00613817
ExitThread.KERNEL32(00000000), ref: 0061383E

Memory Dump Source

Source File: 00000002.00000002.2567412345.0000000000610000.00000040.00001000.00020000.00000000.sdmp, Offset: 00610000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_610000_7Y18r(223).jbxd

Yara matches

Similarity

API ID: Interlocked$Incrementclosesocket$ErrorLastconnecthtonsioctlsocketselectsetsockoptsocket$CloseCreateDecrementExitFileHandleIcmpIcmp6Threadlstrcpy
String ID:
API String ID: 1528004712-0
Opcode ID: 30fb36df8d20b87b79ea277e3056943dd2704cb7f29b3534a291bbb73331a38f
Instruction ID: da3bba3b728aa0f3a2eb7282bb40bba760d2aa9ed6384f453cfc53d1181df390
Opcode Fuzzy Hash: 30fb36df8d20b87b79ea277e3056943dd2704cb7f29b3534a291bbb73331a38f
Instruction Fuzzy Hash: 753180B1940219AEDB60ABD0DC46BEDBBB6FF00714F180129F111BA2D1DBB65984CB59

Function 0061F9D0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 120
memorystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0061F6B0: inet_addr.WS2_32(?), ref: 0061F6C6
Part of subcall function 0061F6B0: socket.WS2_32(00000002,00000001,00000006), ref: 0061F6D3
Part of subcall function 0061F6B0: htons.WS2_32(0000008B), ref: 0061F6F2
Part of subcall function 0061F6B0: ioctlsocket.WS2_32(?,8004667E,00000001), ref: 0061F71A
Part of subcall function 0061F6B0: setsockopt.WS2_32(?,0000FFFF,00000080,00000001,00000004), ref: 0061F74A
Part of subcall function 0061F6B0: connect.WS2_32(?,?,00000010), ref: 0061F75B
Part of subcall function 0061F6B0: WSAGetLastError.WS2_32 ref: 0061F769
Part of subcall function 0061F6B0: select.WS2_32(00000000,00000000,00000001,00000000,00000006), ref: 0061F7B7
Part of subcall function 0061F6B0: send.WS2_32(?,0062A970,0000004C,00000000), ref: 0061F7DC
Part of subcall function 0061F6B0: closesocket.WS2_32(?), ref: 0061F890
Part of subcall function 0061F6B0: socket.WS2_32(00000002,00000001,00000006), ref: 0061F89B
Part of subcall function 0061F6B0: htons.WS2_32(000001BD), ref: 0061F8B4
Part of subcall function 0061F6B0: ioctlsocket.WS2_32(?,8004667E,00000001), ref: 0061F8DC
Part of subcall function 0061F6B0: setsockopt.WS2_32(?,0000FFFF,00000080,00000001,00000004), ref: 0061F90C

Part of subcall function 0062091B: InitializeCriticalSection.KERNEL32(0062C1A0), ref: 00620932
Part of subcall function 0062091B: VirtualAlloc.KERNEL32(00000000,000C6800,00003000,00000004,0062C1A0), ref: 00620950
Part of subcall function 0062091B: Sleep.KERNEL32(000007D0), ref: 0062096B
Part of subcall function 0062091B: EnterCriticalSection.KERNEL32(0062C1A0), ref: 00620975
Part of subcall function 0062091B: InterlockedIncrement.KERNEL32(0062C1B8), ref: 006209B8
Part of subcall function 0062091B: LeaveCriticalSection.KERNEL32(0062C1A0,0062C1B8,0062C1A0), ref: 006209C5

GetCurrentProcessId.KERNEL32(00000000,?,?,?,?,\srvsvc), ref: 0061FA16
VirtualAlloc.KERNEL32(00000000,00002000,00003000,00000004,00000000,?,?,?,?,\srvsvc), ref: 0061FA2F
CharUpperA.USER32(?,?,?,?,?,00000000,00000060,?,0062A9E8,?,?,00000000,00000060,00000000,00002000,00003000), ref: 0061FAAB
lstrlenA.KERNEL32(?,?,?,?,?,?,00000000,00000060,?,0062A9E8,?,?,00000000,00000060,00000000,00002000), ref: 0061FAB3

Part of subcall function 0061FB50: htonl.WS2_32(00000073), ref: 0061FC58
Part of subcall function 0061FB50: htonl.WS2_32 ref: 0061FC77
Part of subcall function 0061FB50: lstrcpyA.KERNEL32(?,?,?,?,?,?,?,000001F4,00000073,?,Windows 2000 2195,00000023,?), ref: 0061FCAF
Part of subcall function 0061FB50: lstrlenA.KERNEL32(?,?,?,?,?,?,?,?,000001F4,00000073,?,Windows 2000 2195,00000023,?), ref: 0061FCB5

GetLastError.KERNEL32(00000000,00002000,00003000,00000004,00000000,?,?,?,?,\srvsvc), ref: 0061FAEC
closesocket.WS2_32(00000000), ref: 0061FB07
VirtualFree.KERNEL32(00000000,00000000,00008000,00000000,00000000,00002000,00003000,00000004,00000000,?,?,?,?,\srvsvc), ref: 0061FB1C
GetLastError.KERNEL32(00000000,00000000,00008000,00000000,00000000,00002000,00003000,00000004,00000000,?,?,?,?,\srvsvc), ref: 0061FB25

Part of subcall function 00620A80: htonl.WS2_32(00000072), ref: 00620AF1
Part of subcall function 00620A80: htonl.WS2_32 ref: 00620B15

Part of subcall function 00620B60: lstrcpyA.KERNEL32(?,?,?,00000000,00000400,?,00000000,00000030,00000000,?,?,?,0061FAA8,?,?,?), ref: 00620B9C

closesocket.WS2_32(00000000), ref: 0061FB35

Strings

\srvsvc, xrefs: 0061F9D9

Memory Dump Source

Source File: 00000002.00000002.2567412345.0000000000610000.00000040.00001000.00020000.00000000.sdmp, Offset: 00610000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_610000_7Y18r(223).jbxd

Yara matches

Similarity

API ID: htonl$CriticalErrorLastSectionVirtualclosesocket$Allochtonsioctlsocketlstrcpylstrlensetsockoptsocket$CharCurrentEnterFreeIncrementInitializeInterlockedLeaveProcessSleepUpperconnectinet_addrselectsend
String ID: \srvsvc
API String ID: 1150074405-3263190950
Opcode ID: dde3966ea848fb6f87747defffe2e045459df37c98bd66b289dc15141064b477
Instruction ID: aecc082964176dbf6b5a49ff8ec27f5e3fd4d67f9559d20725063c253d58d171
Opcode Fuzzy Hash: dde3966ea848fb6f87747defffe2e045459df37c98bd66b289dc15141064b477
Instruction Fuzzy Hash: 9C419130944208FADF61AFA0CC42BDD7B66AF00710F2C8175B519AA1E2DBB49AC1DB55

Function 00613450 Relevance: 15.1, APIs: 10, Instructions: 86
sleepthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 0061349E
InterlockedIncrement.KERNEL32(0062BDD4), ref: 006134F5
CreateThread.KERNEL32(00000000,00000500,006135D0,00000004,?,00002710), ref: 0061351A
GetLastError.KERNEL32(00000000,00000500,006135D0,00000004,?,00002710), ref: 00613523
ResumeThread.KERNEL32(?,00000000,00000500,006135D0,00000004,?,00002710), ref: 00613534
CloseHandle.KERNEL32(?,?,00000000,00000500,006135D0,00000004,?,00002710), ref: 0061353F
Sleep.KERNEL32(00000014,?,?,00000000,00000500,006135D0,00000004,?,00002710), ref: 00613546
Sleep.KERNEL32(00002710), ref: 006135A2

Memory Dump Source

Source File: 00000002.00000002.2567412345.0000000000610000.00000040.00001000.00020000.00000000.sdmp, Offset: 00610000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_610000_7Y18r(223).jbxd

Yara matches

Similarity

API ID: SleepThread$CloseCountCreateErrorHandleIncrementInterlockedLastResumeTick
String ID:
API String ID: 2577224563-0
Opcode ID: 7b74dfb16a1559045e927a6c8af921996398bfac84fb228e0f6ce4bd29e70933
Instruction ID: 888670cf050fd38a6aee74dafb62b8625ca2753571c1e31aed0071e0d05587c5
Opcode Fuzzy Hash: 7b74dfb16a1559045e927a6c8af921996398bfac84fb228e0f6ce4bd29e70933
Instruction Fuzzy Hash: 1631E271500A25DEEB30AB84EC06BE977A3FF00F05F0C256AE516262E0CB7406C5CF59

Function 00613850 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 60stringfileCOMMON

Download Yara Rule

APIs

Icmp6CreateFile.IPHLPAPI ref: 00613869
lstrcpyA.KERNEL32(?,Babcdefghijklmnopqrstuvwabcdefghi), ref: 00613898
lstrlenA.KERNEL32(?,?,Babcdefghijklmnopqrstuvwabcdefghi), ref: 006138B3
IcmpSendEcho.IPHLPAPI(00000000,?,?,00000000,00000000,?,00000064,000007D0), ref: 006138D6
IcmpParseReplies.IPHLPAPI(?,00000064), ref: 006138E6
IcmpCloseHandle.IPHLPAPI(00000000), ref: 00613914

Strings

Babcdefghijklmnopqrstuvwabcdefghi, xrefs: 0061388C

Memory Dump Source

Source File: 00000002.00000002.2567412345.0000000000610000.00000040.00001000.00020000.00000000.sdmp, Offset: 00610000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_610000_7Y18r(223).jbxd

Yara matches

Similarity

API ID: Icmp$CloseCreateEchoFileHandleIcmp6ParseRepliesSendlstrcpylstrlen
String ID: Babcdefghijklmnopqrstuvwabcdefghi
API String ID: 3801491608-1868642686
Opcode ID: 6d0d007bc906725621f0045be23719b924291e14f7965382098244f941681487
Instruction ID: 246a18e605d252118754e47ee265c399722c522165cf50e2a67b5b469bf8c130
Opcode Fuzzy Hash: 6d0d007bc906725621f0045be23719b924291e14f7965382098244f941681487
Instruction Fuzzy Hash: 31214F71904228DFEB309B70DC49FDABB7AEB00314F185995E50EA6292E7B05AC5CF50

Function 00613280 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 54filememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000,?,?,\ntsvcs), ref: 0061329E
GetFileSize.KERNEL32(?,00000000,?,80000000,00000001,00000000,00000003,00000080,00000000,?,?,\ntsvcs), ref: 006132B0
VirtualAlloc.KERNEL32(00000000,-000003E8,00001000,00000040,?,00000000,?,80000000,00000001,00000000,00000003,00000080,00000000,?,?,\ntsvcs), ref: 006132C6
ReadFile.KERNEL32(?,00000000,00000000,?,00000000,00000000,-000003E8,00001000,00000040,?,00000000,?,80000000,00000001,00000000,00000003), ref: 006132DE
CloseHandle.KERNEL32(?,?,00000000,00000000,?,00000000,00000000,-000003E8,00001000,00000040,?,00000000,?,80000000,00000001,00000000), ref: 006132E6

Strings

\ntsvcs, xrefs: 00613286

Memory Dump Source

Source File: 00000002.00000002.2567412345.0000000000610000.00000040.00001000.00020000.00000000.sdmp, Offset: 00610000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_610000_7Y18r(223).jbxd

Yara matches

Similarity

API ID: File$AllocCloseCreateHandleReadSizeVirtual
String ID: \ntsvcs
API String ID: 2717999310-3919542250
Opcode ID: 5e9812aebf10b0bf155bed80e4c6b595b03f497aaf336a87f444227434d674d4
Instruction ID: 60557245629af9e0e71ef9c79578e0cd652a1d5c0c0985fdebecaa05220047f6
Opcode Fuzzy Hash: 5e9812aebf10b0bf155bed80e4c6b595b03f497aaf336a87f444227434d674d4
Instruction Fuzzy Hash: 4801A771340204BBEB616BA4DC43FCE765ADB41B74F284229F620BA2D0DAB19A519258

Function 0061ECF0 Relevance: 9.1, APIs: 6, Instructions: 68memoryCOMMON

Download Yara Rule

APIs

CoTaskMemAlloc.OLE32(0000FA00,?,00000000), ref: 0061ED08

Part of subcall function 0061EBB0: CryptAcquireContextA.ADVAPI32(?,00000000,00000000,00000001,F0000000,?,?,?), ref: 0061EBC8
Part of subcall function 0061EBB0: CryptGenRandom.ADVAPI32(?,000003FF,?,?,00000000,00000000,00000001,F0000000,?,?,?), ref: 0061EBD8
Part of subcall function 0061EBB0: CryptReleaseContext.ADVAPI32(?,00000000,?,000003FF,?,?,00000000,00000000,00000001,F0000000,?,?,?), ref: 0061EBE2

CoTaskMemAlloc.OLE32(0000FA00,?,?,00000000,0000FA00,0000FA00,?,00000000), ref: 0061ED39
CoTaskMemAlloc.OLE32(0000FA00,0000FA00,?,?,00000000,0000FA00,0000FA00,?,00000000), ref: 0061ED51
CoTaskMemAlloc.OLE32(0000FA00,0000FA00,0000FA00,?,?,00000000,0000FA00,0000FA00,?,00000000), ref: 0061ED61

Part of subcall function 0061EE30: CoTaskMemAlloc.OLE32(FFFFFFFF,?,?), ref: 0061EE3F
Part of subcall function 0061EE30: CoTaskMemFree.OLE32(?,?,?,?,?,?,0062A780,FFFFFFFF,?,?), ref: 0061EEB2

CoTaskMemFree.OLE32(?,?,?,000000FF,?,00000010,?,?,000000FF,?,0000001D,?,0062A8D8,00000090,?,0062A7D3), ref: 0061EDDA
CoTaskMemFree.OLE32(?,?,?,?,000000FF,?,00000010,?,?,000000FF,?,0000001D,?,0062A8D8,00000090,?), ref: 0061EDE5

Memory Dump Source

Source File: 00000002.00000002.2567412345.0000000000610000.00000040.00001000.00020000.00000000.sdmp, Offset: 00610000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_610000_7Y18r(223).jbxd

Yara matches

Similarity

API ID: Task$Alloc$CryptFree$Context$AcquireRandomRelease
String ID:
API String ID: 3066166821-0
Opcode ID: e4068be3c04d0decb6d530e310bca5df91c005fab12cf13bd842a68561dd27ac
Instruction ID: e94c4d7bfe540d1f5a1531a86620f34df1e03b59fccc637b4d938b4e0e8ec734
Opcode Fuzzy Hash: e4068be3c04d0decb6d530e310bca5df91c005fab12cf13bd842a68561dd27ac
Instruction Fuzzy Hash: DC21A1B0A402267EDB60AB60CC02FD8BA66AF00710F584278BB18761E1DFB199D1DE1C

Function 0062091B Relevance: 9.1, APIs: 6, Instructions: 54sleepmemoryCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(0062C1A0), ref: 00620932
VirtualAlloc.KERNEL32(00000000,000C6800,00003000,00000004,0062C1A0), ref: 00620950
Sleep.KERNEL32(000007D0), ref: 0062096B
EnterCriticalSection.KERNEL32(0062C1A0), ref: 00620975
InterlockedIncrement.KERNEL32(0062C1B8), ref: 006209B8
LeaveCriticalSection.KERNEL32(0062C1A0,0062C1B8,0062C1A0), ref: 006209C5

Memory Dump Source

Source File: 00000002.00000002.2567412345.0000000000610000.00000040.00001000.00020000.00000000.sdmp, Offset: 00610000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_610000_7Y18r(223).jbxd

Yara matches

Similarity

API ID: CriticalSection$AllocEnterIncrementInitializeInterlockedLeaveSleepVirtual
String ID:
API String ID: 688543581-0
Opcode ID: 6f1dea2fd31db08eae8d48264cf76e4e97d2216274c2cc0cbc63378c53163446
Instruction ID: b32404e191fc76097605f210e3868f4f38d31507c99a12cbfd7aa2f30f01e034
Opcode Fuzzy Hash: 6f1dea2fd31db08eae8d48264cf76e4e97d2216274c2cc0cbc63378c53163446
Instruction Fuzzy Hash: C6014472A40E209FF3615B94AC87BCE36539B84B30F282024A11A633C3CAB118C1CA89

Function 00612A9F Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 90memoryCOMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,0000012C,?,?,\ntsvcs), ref: 00612AC0

Part of subcall function 00613280: CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000,?,?,\ntsvcs), ref: 0061329E
Part of subcall function 00613280: GetFileSize.KERNEL32(?,00000000,?,80000000,00000001,00000000,00000003,00000080,00000000,?,?,\ntsvcs), ref: 006132B0
Part of subcall function 00613280: VirtualAlloc.KERNEL32(00000000,-000003E8,00001000,00000040,?,00000000,?,80000000,00000001,00000000,00000003,00000080,00000000,?,?,\ntsvcs), ref: 006132C6
Part of subcall function 00613280: ReadFile.KERNEL32(?,00000000,00000000,?,00000000,00000000,-000003E8,00001000,00000040,?,00000000,?,80000000,00000001,00000000,00000003), ref: 006132DE
Part of subcall function 00613280: CloseHandle.KERNEL32(?,?,00000000,00000000,?,00000000,00000000,-000003E8,00001000,00000040,?,00000000,?,80000000,00000001,00000000), ref: 006132E6

GetModuleHandleA.KERNEL32(00000000,?,?,?,00000000,?,0000012C,?,?,\ntsvcs), ref: 00612AED
VirtualAlloc.KERNEL32(00000000,?,00001000,00000040,?,?,?,?,00405010,000003E8,00000000,?,?,?,00000000,?), ref: 00612B5A

Part of subcall function 00612BF0: memset.MSVCRT ref: 00612C0A
Part of subcall function 00612BF0: VirtualAlloc.KERNEL32(00000000,?,00001000,00000040), ref: 00612C21
Part of subcall function 00612BF0: CoCreateGuid.OLE32(?,?,?,?,00000000,?,00001000,00000040), ref: 00612C44

VirtualFree.KERNEL32(?,00000000,00008000,0062BD80,?,?,?,00000000,?,00001000,00000040,?,?,?,?,00405010), ref: 00612BD0

Strings

\ntsvcs, xrefs: 00612AA8

Memory Dump Source

Source File: 00000002.00000002.2567412345.0000000000610000.00000040.00001000.00020000.00000000.sdmp, Offset: 00610000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_610000_7Y18r(223).jbxd

Yara matches

Similarity

API ID: FileVirtual$Alloc$CreateHandleModule$CloseFreeGuidNameReadSizememset
String ID: \ntsvcs
API String ID: 4205641286-3919542250
Opcode ID: 463d72ef44f5a2c385c1f5ad87ffd64ee25379c7ae96ebe02391f849dd7ce33e
Instruction ID: d27afc059d8d4d41932a420934ec025bae3e4560605a64228f81e73beb3f78b0
Opcode Fuzzy Hash: 463d72ef44f5a2c385c1f5ad87ffd64ee25379c7ae96ebe02391f849dd7ce33e
Instruction Fuzzy Hash: DE3189B2D01608AFDB60DF98CC81BDEB7B6FF48700F189459E908A7391D7716A918F94

Function 00617E30 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 50COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,0000012C,?,0000012C,00000000,?,00000064,00000000,?,?,?,?,00617A29,00008003), ref: 00617E6D

Part of subcall function 006124E0: wsprintfA.USER32 ref: 00612523

Part of subcall function 00612700: CoCreateGuid.OLE32(?), ref: 00612719

Part of subcall function 00612470: wsprintfA.USER32 ref: 00612487
Part of subcall function 00612470: RegCreateKeyA.ADVAPI32(?,?,?), ref: 006124A0
Part of subcall function 00612470: lstrlenA.KERNEL32(?), ref: 006124AC
Part of subcall function 00612470: RegSetValueExA.ADVAPI32(?,00000000,00000000,00000001,?,00000001,?), ref: 006124C2
Part of subcall function 00612470: RegCloseKey.ADVAPI32(?,?,00000000,00000000,00000001,?,00000001,?), ref: 006124CD

Strings

{%08lX-%04X-%04X-%02X%02X-%02X%02X%02X%02X%02X%02X}, xrefs: 00617E8E
{5B4A3B5F-0954-749D-3B07-839E07C9953B}, xrefs: 00617E89, 00617EB5, 00617ED0
CLSID\%s, xrefs: 00617EB0
CLSID\%s\LocalServer32, xrefs: 00617ECB

Memory Dump Source

Source File: 00000002.00000002.2567412345.0000000000610000.00000040.00001000.00020000.00000000.sdmp, Offset: 00610000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_610000_7Y18r(223).jbxd

Yara matches

Similarity

API ID: Createwsprintf$CloseFileGuidModuleNameValuelstrlen
String ID: CLSID\%s$CLSID\%s\LocalServer32${%08lX-%04X-%04X-%02X%02X-%02X%02X%02X%02X%02X%02X}${5B4A3B5F-0954-749D-3B07-839E07C9953B}
API String ID: 2581233984-1135521076
Opcode ID: c1542521fbbeb361101f4c19886da0fb3dae4b808be41b7325cf945e58876a0c
Instruction ID: 089b0a4de2f49e7eceb4dca2bfbdd4537246ceca7cb0428b6cc922ca3730d0eb
Opcode Fuzzy Hash: c1542521fbbeb361101f4c19886da0fb3dae4b808be41b7325cf945e58876a0c
Instruction Fuzzy Hash: AB01887164031879E690E6A0DC53FDE736EEB05B15F040055F358B30C1DAB49BA48A68

Function 006131E1 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 35sleepsynchronizationthreadCOMMON

Download Yara Rule

APIs

Part of subcall function 0062091B: InitializeCriticalSection.KERNEL32(0062C1A0), ref: 00620932
Part of subcall function 0062091B: VirtualAlloc.KERNEL32(00000000,000C6800,00003000,00000004,0062C1A0), ref: 00620950
Part of subcall function 0062091B: Sleep.KERNEL32(000007D0), ref: 0062096B
Part of subcall function 0062091B: EnterCriticalSection.KERNEL32(0062C1A0), ref: 00620975
Part of subcall function 0062091B: InterlockedIncrement.KERNEL32(0062C1B8), ref: 006209B8
Part of subcall function 0062091B: LeaveCriticalSection.KERNEL32(0062C1A0,0062C1B8,0062C1A0), ref: 006209C5

Part of subcall function 00613340: VirtualAlloc.KERNEL32(00000000,0001FFFE,00001000,00000040), ref: 00613357
Part of subcall function 00613340: VirtualAlloc.KERNEL32(00000000,0001FFFE,00001000,00000040,00000000,0001FFFE,00001000,00000040), ref: 0061336D
Part of subcall function 00613340: VirtualFree.KERNEL32(?,00000000,00008000,?,?,00000000,0001FFFE,00001000,00000040,00000000,0001FFFE,00001000,00000040), ref: 006133CB

Part of subcall function 00613310: CoCreateGuid.OLE32(00613216), ref: 0061331D

CreateThread.KERNEL32(00000000,00000300,Function_00003450,?,00000001,?), ref: 00613233
WaitForSingleObject.KERNEL32(?,000000FF,00000000,00000300,Function_00003450,?,00000001,?,00624BC4,00000031,0062BDE4,00000000), ref: 00613240
CloseHandle.KERNEL32(?,?,000000FF,00000000,00000300,Function_00003450,?,00000001,?,00624BC4,00000031,0062BDE4,00000000), ref: 00613248
Sleep.KERNEL32(0000EA60,?,?,000000FF,00000000,00000300,Function_00003450,?,00000001,?,00624BC4,00000031,0062BDE4,00000000), ref: 00613252

Strings

WVSj, xrefs: 006131F6

Memory Dump Source

Source File: 00000002.00000002.2567412345.0000000000610000.00000040.00001000.00020000.00000000.sdmp, Offset: 00610000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_610000_7Y18r(223).jbxd

Yara matches

Similarity

API ID: Virtual$AllocCriticalSection$CreateSleep$CloseEnterFreeGuidHandleIncrementInitializeInterlockedLeaveObjectSingleThreadWait
String ID: WVSj
API String ID: 882813272-593378516
Opcode ID: 594fd52f449dc059f3d2b3b2fc7f8e774eaad2f5c3250de188aba2e7773ebb06
Instruction ID: 6585c87b812706c1222fb9bb310b12c1e1f01d7b9d8da4c83d9cb43a8e1a1489
Opcode Fuzzy Hash: 594fd52f449dc059f3d2b3b2fc7f8e774eaad2f5c3250de188aba2e7773ebb06
Instruction Fuzzy Hash: 21F0BB30A446187DEB6137908C43FCDBA6BDF01B50F180619B535761D2DFB017D04B9A

Function 006131F0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 32sleepsynchronizationthreadCOMMON

Download Yara Rule

APIs

Part of subcall function 0062091B: InitializeCriticalSection.KERNEL32(0062C1A0), ref: 00620932
Part of subcall function 0062091B: VirtualAlloc.KERNEL32(00000000,000C6800,00003000,00000004,0062C1A0), ref: 00620950
Part of subcall function 0062091B: Sleep.KERNEL32(000007D0), ref: 0062096B
Part of subcall function 0062091B: EnterCriticalSection.KERNEL32(0062C1A0), ref: 00620975
Part of subcall function 0062091B: InterlockedIncrement.KERNEL32(0062C1B8), ref: 006209B8
Part of subcall function 0062091B: LeaveCriticalSection.KERNEL32(0062C1A0,0062C1B8,0062C1A0), ref: 006209C5

Part of subcall function 00613340: VirtualAlloc.KERNEL32(00000000,0001FFFE,00001000,00000040), ref: 00613357
Part of subcall function 00613340: VirtualAlloc.KERNEL32(00000000,0001FFFE,00001000,00000040,00000000,0001FFFE,00001000,00000040), ref: 0061336D
Part of subcall function 00613340: VirtualFree.KERNEL32(?,00000000,00008000,?,?,00000000,0001FFFE,00001000,00000040,00000000,0001FFFE,00001000,00000040), ref: 006133CB

Part of subcall function 00613310: CoCreateGuid.OLE32(00613216), ref: 0061331D

CreateThread.KERNEL32(00000000,00000300,Function_00003450,?,00000001,?), ref: 00613233
WaitForSingleObject.KERNEL32(?,000000FF,00000000,00000300,Function_00003450,?,00000001,?,00624BC4,00000031,0062BDE4,00000000), ref: 00613240
CloseHandle.KERNEL32(?,?,000000FF,00000000,00000300,Function_00003450,?,00000001,?,00624BC4,00000031,0062BDE4,00000000), ref: 00613248
Sleep.KERNEL32(0000EA60,?,?,000000FF,00000000,00000300,Function_00003450,?,00000001,?,00624BC4,00000031,0062BDE4,00000000), ref: 00613252

Strings

WVSj, xrefs: 006131F6

Memory Dump Source

Source File: 00000002.00000002.2567412345.0000000000610000.00000040.00001000.00020000.00000000.sdmp, Offset: 00610000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_610000_7Y18r(223).jbxd

Yara matches

Similarity

API ID: Virtual$AllocCriticalSection$CreateSleep$CloseEnterFreeGuidHandleIncrementInitializeInterlockedLeaveObjectSingleThreadWait
String ID: WVSj
API String ID: 882813272-593378516
Opcode ID: 78d965ab6a783c3ed25f4e927b3cfff0602bd431e841791476a8ff827e319f93
Instruction ID: b88c6dc0a870e1c621fee3b41f6792ef208fdf01a35dcd436c15868d08acf0a8
Opcode Fuzzy Hash: 78d965ab6a783c3ed25f4e927b3cfff0602bd431e841791476a8ff827e319f93
Instruction Fuzzy Hash: 3FF08230A446287DEB9237D18C43FCDBA2B9F01F50F180219B121752D2DEB117C05A5A

Function 00616F01 Relevance: 7.5, APIs: 5, Instructions: 47networkCOMMON

Download Yara Rule

APIs

select.WS2_32(00000000,00000000,?,00000000,?), ref: 00616EC3
send.WS2_32(?,?,000000FF,00000000), ref: 00616ED8
VirtualFree.KERNEL32(?,00000000,00008000,00000000,00000000,?,00000000,?,?,?,?,?,00000010,?,0000FFFF,00000080), ref: 00616F11
shutdown.WS2_32(?,00000002), ref: 00616F26
closesocket.WS2_32(?), ref: 00616F2E

Memory Dump Source

Source File: 00000002.00000002.2567412345.0000000000610000.00000040.00001000.00020000.00000000.sdmp, Offset: 00610000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_610000_7Y18r(223).jbxd

Yara matches

Similarity

API ID: FreeVirtualclosesocketselectsendshutdown
String ID:
API String ID: 1011238728-0
Opcode ID: d533ccf8217f125f337d93286260cf11cdc831c1badabbd71e41d68b6b693577
Instruction ID: dcad825e5a8cd47804516f3318b21c314eed27037740c74b7d64a9516b9e361d
Opcode Fuzzy Hash: d533ccf8217f125f337d93286260cf11cdc831c1badabbd71e41d68b6b693577
Instruction Fuzzy Hash: 7C018475A0420AAEDF609BE4DC46FEEBAB3EF04314F284226F211B51D1DBB154C68B64

Function 00612470 Relevance: 7.5, APIs: 5, Instructions: 33registrystringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00612487
RegCreateKeyA.ADVAPI32(?,?,?), ref: 006124A0
lstrlenA.KERNEL32(?), ref: 006124AC
RegSetValueExA.ADVAPI32(?,00000000,00000000,00000001,?,00000001,?), ref: 006124C2
RegCloseKey.ADVAPI32(?,?,00000000,00000000,00000001,?,00000001,?), ref: 006124CD

Memory Dump Source

Source File: 00000002.00000002.2567412345.0000000000610000.00000040.00001000.00020000.00000000.sdmp, Offset: 00610000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_610000_7Y18r(223).jbxd

Yara matches

Similarity

API ID: CloseCreateValuelstrlenwsprintf
String ID:
API String ID: 3978583755-0
Opcode ID: 89b4492d92d0ed7c9c5e74286af9d63890b267e9782dcac567c97415fceb705a
Instruction ID: 5603e10ef6c232116bf83e2aae9cdab0c031c7478cf94a0bd3b5a84d557bd453
Opcode Fuzzy Hash: 89b4492d92d0ed7c9c5e74286af9d63890b267e9782dcac567c97415fceb705a
Instruction Fuzzy Hash: E4F03A7181010D6ECF62AE60DC02FDE37AAEF15700F084065BA05A21A1EA719BA0AA99

Function 00617C90 Relevance: 7.5, APIs: 5, Instructions: 30threadinjectionsleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000000C8,?,00000000,00000004), ref: 00617C9E
CoTaskMemFree.OLE32(00000000,?,?,?,000000C8,?,00000000,00000004), ref: 00617CC1
WaitForSingleObject.KERNEL32(00000000,0036EE80,00000000,?,?,?,000000C8,?,00000000,00000004), ref: 00617CCE
ResumeThread.KERNEL32(00000000,00000000,0036EE80,00000000,0036EE80,00000000,?,?,?,000000C8,?,00000000,00000004), ref: 00617CDC
SuspendThread.KERNEL32(00000000,00000000,00000000,0036EE80,00000000,0036EE80,00000000,?,?,?,000000C8,?,00000000,00000004), ref: 00617CE4
ResumeThread.KERNEL32(00000000,00000000,0036EE80,00000000,?,?,?,000000C8,?,00000000,00000004), ref: 00617CFB
SuspendThread.KERNEL32(00000000,00000000,00000000,0036EE80,00000000,?,?,?,000000C8,?,00000000,00000004), ref: 00617D03

Strings

-embedding, xrefs: 00617B78
jhdheruhfrthkgjhtjkghjk5trh, xrefs: 00617B8C

Memory Dump Source

Source File: 00000002.00000002.2567412345.0000000000610000.00000040.00001000.00020000.00000000.sdmp, Offset: 00610000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_610000_7Y18r(223).jbxd

Yara matches

Similarity

API ID: Thread$ResumeSuspend$FreeObjectSingleSleepTaskWait
String ID: -embedding$jhdheruhfrthkgjhtjkghjk5trh
API String ID: 1528747566-2388181652
Opcode ID: 9aec9855139ca21d28a25d59b01f557d523c876c360daf6adc1245949a85d244
Instruction ID: bb1c478ebd57bd78cc19eb2269a31cb446a559cda1d53057e08d91c3e6c5138a
Opcode Fuzzy Hash: 9aec9855139ca21d28a25d59b01f557d523c876c360daf6adc1245949a85d244
Instruction Fuzzy Hash: 73F0F435804119FEDF516BD0CD01ADEBA76AF04710F188658A460221A1CBB26A90AB94

Function 00616FFE Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 30COMMON

Download Yara Rule

APIs

Part of subcall function 0061F100: lstrlenA.KERNEL32(?,00000000,?,0000031A,00000000,?,?,\ntsvcs), ref: 0061F147
Part of subcall function 0061F100: htonl.WS2_32(00000075), ref: 0061F1E8

InterlockedDecrement.KERNEL32(0062BDD0), ref: 006176F7

Part of subcall function 00620400: IsBadReadPtr.KERNEL32(?,0000031A,?,?,\ntsvcs,?,0061620E,?,?,\\*SMBSERVER\IPC$,?,Administrator,password,00000000,?,00000000), ref: 0062040F

Strings

\\*SMBSERVER\IPC$, xrefs: 00617005
\ntsvcs, xrefs: 006171E1
Admin, xrefs: 006171E9, 006171EE

Memory Dump Source

Source File: 00000002.00000002.2567412345.0000000000610000.00000040.00001000.00020000.00000000.sdmp, Offset: 00610000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_610000_7Y18r(223).jbxd

Yara matches

Similarity

API ID: DecrementInterlockedReadhtonllstrlen
String ID: Admin$\\*SMBSERVER\IPC$$\ntsvcs
API String ID: 1404068322-1949679209
Opcode ID: 16d27af3bda9a54ce9cd6031ee565cf1889b5befa3e7bbd7e879e0c710291df8
Instruction ID: 890c5522f3bec4539068b14fd8003aef71fb4de35488c4ab6cdd500bf3760b03
Opcode Fuzzy Hash: 16d27af3bda9a54ce9cd6031ee565cf1889b5befa3e7bbd7e879e0c710291df8
Instruction Fuzzy Hash: 1AF08272A09A25A9CB30AB64BC16FC87333EB40324F785666F225B51E0DB7055C29F18

Function 00612BF0 Relevance: 6.2, APIs: 4, Instructions: 177memoryCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00612C0A
VirtualAlloc.KERNEL32(00000000,?,00001000,00000040), ref: 00612C21
CoCreateGuid.OLE32(?,?,?,?,00000000,?,00001000,00000040), ref: 00612C44
VirtualFree.KERNEL32(?,00000000,00008000,?,?,?,?,00000774,?,00000774,00000770,?,?,00000000,?,?), ref: 00612E99

Memory Dump Source

Source File: 00000002.00000002.2567412345.0000000000610000.00000040.00001000.00020000.00000000.sdmp, Offset: 00610000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_610000_7Y18r(223).jbxd

Yara matches

Similarity

API ID: Virtual$AllocCreateFreeGuidmemset
String ID:
API String ID: 486042396-0
Opcode ID: a4cfac227f7db333810e55b22cc186079e8812afefa7f0934dfefb8786c6f636
Instruction ID: 835662ebf9c0e18c3ded0a6e9efebc9159c6caef046c6497cbb5043dd4bcf527
Opcode Fuzzy Hash: a4cfac227f7db333810e55b22cc186079e8812afefa7f0934dfefb8786c6f636
Instruction Fuzzy Hash: 208109769012189FDFA0EF64CC89B99B7B6FF04300F4885D9E948A7266DA31ADD1CF44

Function 00617720 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36stringCOMMON

Download Yara Rule

APIs

lstrcpyA.KERNEL32(?,?,?,?,\ntsvcs), ref: 00617737

Part of subcall function 0061F6B0: inet_addr.WS2_32(?), ref: 0061F6C6
Part of subcall function 0061F6B0: socket.WS2_32(00000002,00000001,00000006), ref: 0061F6D3
Part of subcall function 0061F6B0: htons.WS2_32(0000008B), ref: 0061F6F2
Part of subcall function 0061F6B0: ioctlsocket.WS2_32(?,8004667E,00000001), ref: 0061F71A
Part of subcall function 0061F6B0: setsockopt.WS2_32(?,0000FFFF,00000080,00000001,00000004), ref: 0061F74A
Part of subcall function 0061F6B0: connect.WS2_32(?,?,00000010), ref: 0061F75B
Part of subcall function 0061F6B0: WSAGetLastError.WS2_32 ref: 0061F769
Part of subcall function 0061F6B0: select.WS2_32(00000000,00000000,00000001,00000000,00000006), ref: 0061F7B7
Part of subcall function 0061F6B0: send.WS2_32(?,0062A970,0000004C,00000000), ref: 0061F7DC
Part of subcall function 0061F6B0: closesocket.WS2_32(?), ref: 0061F890
Part of subcall function 0061F6B0: socket.WS2_32(00000002,00000001,00000006), ref: 0061F89B
Part of subcall function 0061F6B0: htons.WS2_32(000001BD), ref: 0061F8B4
Part of subcall function 0061F6B0: ioctlsocket.WS2_32(?,8004667E,00000001), ref: 0061F8DC
Part of subcall function 0061F6B0: setsockopt.WS2_32(?,0000FFFF,00000080,00000001,00000004), ref: 0061F90C

Part of subcall function 00617860: htonl.WS2_32(?), ref: 006178A8
Part of subcall function 00617860: send.WS2_32(?,?,?,00000000), ref: 006178F9

Part of subcall function 00617790: LocalAlloc.KERNEL32(00000040,?,?,?,00000000), ref: 006177B2
Part of subcall function 00617790: htonl.WS2_32(?), ref: 00617826
Part of subcall function 00617790: LocalFree.KERNEL32(00000000,?,00000000,?,00000000,00000200,?,?,00000000,0000000A,-0000003F,?,?), ref: 0061784A

closesocket.WS2_32(00000000), ref: 00617771

Strings

\ntsvcs, xrefs: 00617726

Memory Dump Source

Source File: 00000002.00000002.2567412345.0000000000610000.00000040.00001000.00020000.00000000.sdmp, Offset: 00610000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_610000_7Y18r(223).jbxd

Yara matches

Similarity

API ID: Localclosesockethtonlhtonsioctlsocketsendsetsockoptsocket$AllocErrorFreeLastconnectinet_addrlstrcpyselect
String ID: \ntsvcs
API String ID: 3907301152-3919542250
Opcode ID: 49df18a68ca2994e6c5dd146bc194b4cfb2839b49824c7d2ac8c38920a336799
Instruction ID: 0f3f8bd13c5647a054f2d5a2e4bd32271467d7357443d7638d7ad7bd1e9d9ce4
Opcode Fuzzy Hash: 49df18a68ca2994e6c5dd146bc194b4cfb2839b49824c7d2ac8c38920a336799
Instruction Fuzzy Hash: 1BF0BB7190430865CB20ABB58C89EDEB6BD9B51734F144314F138AB2D0DB744481CB94

Function 0061E180 Relevance: 3.8, APIs: 3, Instructions: 83memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0061EBB0: CryptAcquireContextA.ADVAPI32(?,00000000,00000000,00000001,F0000000,?,?,?), ref: 0061EBC8
Part of subcall function 0061EBB0: CryptGenRandom.ADVAPI32(?,000003FF,?,?,00000000,00000000,00000001,F0000000,?,?,?), ref: 0061EBD8
Part of subcall function 0061EBB0: CryptReleaseContext.ADVAPI32(?,00000000,?,000003FF,?,?,00000000,00000000,00000001,F0000000,?,?,?), ref: 0061EBE2

VirtualAlloc.KERNEL32(00000000,00008000,00001000,00000040,?,?,?,?), ref: 0061E1F1
VirtualAlloc.KERNEL32(00000000,00008000,00001000,00000040,?,?,00000000,?,?,00000000,00008000,00001000,00000040,?,?,?), ref: 0061E235
VirtualFree.KERNEL32(00000000,00000000,00008000,00000000,00000000,00000000,?,?,?,?,00000000,00008000,00001000,00000040,?,?), ref: 0061E287

Memory Dump Source

Source File: 00000002.00000002.2567412345.0000000000610000.00000040.00001000.00020000.00000000.sdmp, Offset: 00610000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_610000_7Y18r(223).jbxd

Yara matches

Similarity

API ID: CryptVirtual$AllocContext$AcquireFreeRandomRelease
String ID:
API String ID: 2050082855-0
Opcode ID: 1425e3ec0edfdd941ae5c6ea4a1d030ac2993dc462fac306712c6788c3360ab6
Instruction ID: ed34f7196b152a730d518cd9ae9c46385869d5344ad8b9aeaad0b8e642704ee2
Opcode Fuzzy Hash: 1425e3ec0edfdd941ae5c6ea4a1d030ac2993dc462fac306712c6788c3360ab6
Instruction Fuzzy Hash: 3731A771A0121C9FFB658A58CC41FED7777EB89710F148099F608662D2DB71AD818F58

Function 00613340 Relevance: 3.8, APIs: 3, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,0001FFFE,00001000,00000040), ref: 00613357
VirtualAlloc.KERNEL32(00000000,0001FFFE,00001000,00000040,00000000,0001FFFE,00001000,00000040), ref: 0061336D

Part of subcall function 006133E0: CryptAcquireContextA.ADVAPI32(?,00000000,00000000,00000001,F0000000), ref: 006133F8
Part of subcall function 006133E0: CryptGenRandom.ADVAPI32(?,0001FFFE,?,?,00000000,00000000,00000001,F0000000), ref: 00613408
Part of subcall function 006133E0: CryptReleaseContext.ADVAPI32(?,00000000,?,0001FFFE,?,?,00000000,00000000,00000001,F0000000), ref: 00613412

VirtualFree.KERNEL32(?,00000000,00008000,?,?,00000000,0001FFFE,00001000,00000040,00000000,0001FFFE,00001000,00000040), ref: 006133CB

Memory Dump Source

Source File: 00000002.00000002.2567412345.0000000000610000.00000040.00001000.00020000.00000000.sdmp, Offset: 00610000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_610000_7Y18r(223).jbxd

Yara matches

Similarity

API ID: CryptVirtual$AllocContext$AcquireFreeRandomRelease
String ID:
API String ID: 2050082855-0
Opcode ID: 3809aefa08de13d6d158bc9b875a40840f8c36b3b899ba079867d60d30df6d60
Instruction ID: f4c9b30495f3223302e73b25fab98b508294fe96b70887615a58352377e96656
Opcode Fuzzy Hash: 3809aefa08de13d6d158bc9b875a40840f8c36b3b899ba079867d60d30df6d60
Instruction Fuzzy Hash: FB010030600216BAEB609F958C42BECB763EF00B54F344179F7257B3C1DAB16A82928C

Function 00612700 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 33COMMON

Download Yara Rule

APIs

CoCreateGuid.OLE32(?), ref: 00612719

Strings

qwertshertshjklzxcvbnjklbnjklzxcvbnmzxcvbnm, xrefs: 0061271E

Memory Dump Source

Source File: 00000002.00000002.2567412345.0000000000610000.00000040.00001000.00020000.00000000.sdmp, Offset: 00610000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_610000_7Y18r(223).jbxd

Yara matches

Similarity

API ID: CreateGuid
String ID: qwertshertshjklzxcvbnjklbnjklzxcvbnmzxcvbnm
API String ID: 2531319410-202909216
Opcode ID: 236c5f9d061020c5594db5e50e8981427b11db6af6290afc88a0d196e5e75a12
Instruction ID: e9a595ccd421433aaa7898051cad35d7f406cab778ab6097cb764bafece55e4d
Opcode Fuzzy Hash: 236c5f9d061020c5594db5e50e8981427b11db6af6290afc88a0d196e5e75a12
Instruction Fuzzy Hash: 2AF0A73190512D9FCB14CE59EC80ECEB7FAFB4A364F054136E514A3250DB3469468A90

Function 0061203B Relevance: 3.0, APIs: 2, Instructions: 20stringthreadsleepCOMMON

Download Yara Rule

APIs

GetLogicalDriveStringsA.KERNEL32(0000012C,?), ref: 0061205E
GetDriveTypeA.KERNEL32(?), ref: 0061206C
CoTaskMemAlloc.OLE32(00000032,?), ref: 00612078
lstrcpyA.KERNEL32(?,?,00000032,?), ref: 0061208A
CreateThread.KERNEL32(00000000,00000000,00612100,?,00000001,?), ref: 006120B1
SetThreadPriority.KERNEL32(?,000000FE,00000000,00000000,00612100,?,00000001,?,?,?,00000032,?), ref: 006120C4
WaitForSingleObject.KERNEL32(?,000000FF,?,000000FE,00000000,00000000,00612100,?,00000001,?,?,?,00000032,?), ref: 006120D1
lstrlenA.KERNEL32(?,?), ref: 006120D7
Sleep.KERNEL32(0CDFE600,?,?), ref: 006120E9

Memory Dump Source

Source File: 00000002.00000002.2567412345.0000000000610000.00000040.00001000.00020000.00000000.sdmp, Offset: 00610000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_610000_7Y18r(223).jbxd

Yara matches

Similarity

API ID: DriveThread$AllocCreateLogicalObjectPrioritySingleSleepStringsTaskTypeWaitlstrcpylstrlen
String ID:
API String ID: 1053226204-0
Opcode ID: 81227ca4ea33b1364cadc5a13beb3c03ea71301a743b09e2c7f6e937596728ea
Instruction ID: 94364f57acf86e39b304f1ed405bef56faf6866e8f93970737669c807f1e834f
Opcode Fuzzy Hash: 81227ca4ea33b1364cadc5a13beb3c03ea71301a743b09e2c7f6e937596728ea
Instruction Fuzzy Hash: FCE0267080015CA9CB30DA918C55BCBB7BDAB08700F1C0548A204A3141EA706BC0C6A5

Function 0061693E Relevance: 3.0, APIs: 2, Instructions: 19sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000000FA,?,?,\ntsvcs,00000000,00000000,?,?,00000000,00000000,00000000,0062BDD0,0062AFD6,?,00000000,?), ref: 00616954
InterlockedDecrement.KERNEL32(0062BDD0), ref: 00616984

Memory Dump Source

Source File: 00000002.00000002.2567412345.0000000000610000.00000040.00001000.00020000.00000000.sdmp, Offset: 00610000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_610000_7Y18r(223).jbxd

Yara matches

Similarity

API ID: DecrementInterlockedSleep
String ID:
API String ID: 1117356746-0
Opcode ID: 6e962da37ee126186ca999ee245473c8404801fe399dae70d7ad95a73c8a2158
Instruction ID: c5626c8ce5c873760bd90e3f5620b2c7f8f05e14dc4fb6ed8b71825c33468ca8
Opcode Fuzzy Hash: 6e962da37ee126186ca999ee245473c8404801fe399dae70d7ad95a73c8a2158
Instruction Fuzzy Hash: DED0C267A012179BEA20929CD8153E873224760734F2C4632F116211C4427048C1D902

Function 0061EC70 Relevance: 3.0, APIs: 2, Instructions: 11COMMON

Download Yara Rule

APIs

CoTaskMemFree.OLE32(?,00000000,?,0061E8DD,?,?,?,?,-0000000E,?,-00000008,hZ}@,00000006,00000000,0062A648,00000008), ref: 0061EC79
CoTaskMemFree.OLE32(?,?,00000000,?,0061E8DD,?,?,?,?,-0000000E,?,-00000008,hZ}@,00000006,00000000,0062A648), ref: 0061EC81

Memory Dump Source

Source File: 00000002.00000002.2567412345.0000000000610000.00000040.00001000.00020000.00000000.sdmp, Offset: 00610000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_610000_7Y18r(223).jbxd

Yara matches

Similarity

API ID: FreeTask
String ID:
API String ID: 734271698-0
Opcode ID: bc2d5d28a5188b08236354e4d3f7e33be2ae29eb3bc666d10ae6bc6a222b2b44
Instruction ID: a049106b3e8dd00c939602306526677dc02a28fc5a197ef76d5808aafb8d4177
Opcode Fuzzy Hash: bc2d5d28a5188b08236354e4d3f7e33be2ae29eb3bc666d10ae6bc6a222b2b44
Instruction Fuzzy Hash: 64C08C3600000A7B9A00BB0AC8028C9FBEEAFA1390B848025B900130218F72ECA186A8

Function 00611130 Relevance: 1.3, APIs: 1, Instructions: 25stringCOMMON

Download Yara Rule

APIs

lstrcmpiA.KERNEL32(006A7010,?), ref: 0061114B

Memory Dump Source

Source File: 00000002.00000002.2567412345.0000000000610000.00000040.00001000.00020000.00000000.sdmp, Offset: 00610000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_610000_7Y18r(223).jbxd

Yara matches

Similarity

API ID: lstrcmpi
String ID:
API String ID: 1586166983-0
Opcode ID: 5728a87a0606ff31550e691bf31e66bed91eb9089ebac3ea41aad2b0ef31835c
Instruction ID: ec20c826f2749e62492c74d3e471a2207ab2871fdce56e5dd28f03c24936b4fc
Opcode Fuzzy Hash: 5728a87a0606ff31550e691bf31e66bed91eb9089ebac3ea41aad2b0ef31835c
Instruction Fuzzy Hash: 6EE0CD37604404F757705A57DCC18D2FB5BDBD33643081636EB0597310D2A17C46D6A0

Non-executed Functions

Function 0061285E Relevance: 38.6, APIs: 19, Strings: 3, Instructions: 124networkencryptionCOMMON

Download Yara Rule

APIs

CryptAcquireContextA.ADVAPI32(?,00000000,00000000,00000001,F0000000), ref: 00612878
socket.WS2_32(00000002,00000001,00000000), ref: 00612883
gethostbyname.WS2_32(www.online.if.ee), ref: 00612899
htons.WS2_32(000001BB), ref: 006128BE
htons.WS2_32(00000061), ref: 006128DB
CryptGenRandom.ADVAPI32(?,00000020,?,00000061,000001BB,www.online.if.ee,00000002,00000001,00000000,?,00000000,00000000,00000001,F0000000), ref: 006128FB
CryptGenRandom.ADVAPI32(?,00000020,?,?,00000020,?,00000061,000001BB,www.online.if.ee,00000002,00000001,00000000,?,00000000,00000000,00000001), ref: 0061290D
htons.WS2_32(00000016), ref: 00612914
memcpy.MSVCRT ref: 00612928
connect.WS2_32(?,00000002,00000010), ref: 00612941
send.WS2_32(?,?,00000066,00000000), ref: 00612955
closesocket.WS2_32(?), ref: 0061295D
CryptReleaseContext.ADVAPI32(?,00000000,00000002,00000001,00000000,?,00000000,00000000,00000001,F0000000), ref: 00612967
socket.WS2_32(00000002,00000001,00000000), ref: 00612972
gethostbyname.WS2_32(www.if.ee), ref: 00612984
htons.WS2_32(00000050), ref: 0061299E
connect.WS2_32(?,00000002,00000010), ref: 006129B6
send.WS2_32(?,GET / HTTP/1.1Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/vnd.ms-powerpoint, application/vnd.ms-excel, application/msword, application/x-shockwave-flash, */*Accept-Language: en-usAccept-Encoding: gzip, deflateUser-Agent: Mo,00000174,00000000), ref: 006129CE
closesocket.WS2_32(?), ref: 006129D6

Strings

www.online.if.ee, xrefs: 00612894
www.if.ee, xrefs: 0061297F
GET / HTTP/1.1Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/vnd.ms-powerpoint, application/vnd.ms-excel, application/msword, application/x-shockwave-flash, */*Accept-Language: en-usAccept-Encoding: gzip, deflateUser-Agent: Mo, xrefs: 006129C6

Memory Dump Source

Source File: 00000002.00000002.2567412345.0000000000610000.00000040.00001000.00020000.00000000.sdmp, Offset: 00610000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_610000_7Y18r(223).jbxd

Yara matches

Similarity

API ID: Crypthtons$ContextRandomclosesocketconnectgethostbynamesendsocket$AcquireReleasememcpy
String ID: GET / HTTP/1.1Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/vnd.ms-powerpoint, application/vnd.ms-excel, application/msword, application/x-shockwave-flash, */*Accept-Language: en-usAccept-Encoding: gzip, deflateUser-Agent: Mo$www.if.ee$www.online.if.ee
API String ID: 2345021784-3941698025
Opcode ID: ed53a53e2da4ce8c3e4752a09339be4dbb73220386afab581eec942958f68d06
Instruction ID: 14340c93604bd237ca26115a456d8858594bc6b16122fb263f62adca6b08a7a1
Opcode Fuzzy Hash: ed53a53e2da4ce8c3e4752a09339be4dbb73220386afab581eec942958f68d06
Instruction Fuzzy Hash: 1B41A730650305BDDF60EBA4CC86FDD7BA6AF04714F184159F604AF2E2EFB195909B19

Function 0061FB50 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 133stringCOMMON

Download Yara Rule

APIs

htonl.WS2_32(00000073), ref: 0061FC58
htonl.WS2_32 ref: 0061FC77
lstrcpyA.KERNEL32(?,?,?,?,?,?,?,000001F4,00000073,?,Windows 2000 2195,00000023,?), ref: 0061FCAF
lstrlenA.KERNEL32(?,?,?,?,?,?,?,?,000001F4,00000073,?,Windows 2000 2195,00000023,?), ref: 0061FCB5
lstrlenA.KERNEL32(?,?,?,?,?,?,?,?,?,000001F4,00000073,?,Windows 2000 2195,00000023,?), ref: 0061FCBE
lstrcpyA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,000001F4,00000073,?,Windows 2000 2195,00000023), ref: 0061FCCE

Strings

Windows 2000 2195, xrefs: 0061FC41

Memory Dump Source

Source File: 00000002.00000002.2567412345.0000000000610000.00000040.00001000.00020000.00000000.sdmp, Offset: 00610000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_610000_7Y18r(223).jbxd

Yara matches

Similarity

API ID: htonllstrcpylstrlen
String ID: Windows 2000 2195
API String ID: 2004599197-3821944694
Opcode ID: ad98d3464cbf5d9c44b69ff23cc393215395446456a78cfee95d31c9476477d0
Instruction ID: 0ea772309db743cc60b6df16d2c24414ea85be3a16e2ccc89887f07e426e23be
Opcode Fuzzy Hash: ad98d3464cbf5d9c44b69ff23cc393215395446456a78cfee95d31c9476477d0
Instruction Fuzzy Hash: BE41E071800616DADB209F64C841ADF7BB6EF10324F18853DE865AB381E7749AD1CBE6

Function 0061F100 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 102stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0062091B: InitializeCriticalSection.KERNEL32(0062C1A0), ref: 00620932
Part of subcall function 0062091B: VirtualAlloc.KERNEL32(00000000,000C6800,00003000,00000004,0062C1A0), ref: 00620950
Part of subcall function 0062091B: Sleep.KERNEL32(000007D0), ref: 0062096B
Part of subcall function 0062091B: EnterCriticalSection.KERNEL32(0062C1A0), ref: 00620975
Part of subcall function 0062091B: InterlockedIncrement.KERNEL32(0062C1B8), ref: 006209B8
Part of subcall function 0062091B: LeaveCriticalSection.KERNEL32(0062C1A0,0062C1B8,0062C1A0), ref: 006209C5

lstrlenA.KERNEL32(?,00000000,?,0000031A,00000000,?,?,\ntsvcs), ref: 0061F147
htonl.WS2_32(00000075), ref: 0061F1E8

Part of subcall function 0061EF90: select.WS2_32(00000000,00000000,?,00000000,?), ref: 0061EFD5
Part of subcall function 0061EF90: send.WS2_32(?,?,?,00000000), ref: 0061EFF2
Part of subcall function 0061EF90: select.WS2_32(00000000,?,00000000,00000000,?), ref: 0061F029
Part of subcall function 0061EF90: recv.WS2_32(?,?,?,00000000), ref: 0061F04F
Part of subcall function 0061EF90: htonl.WS2_32(?), ref: 0061F06E

SetLastError.KERNEL32(00000000,?,?,?,?,00002000,00000075,?,?????,00000006,?,?,?,00000000,?,?), ref: 0061F218

Strings

\ntsvcs, xrefs: 0061F106
?????, xrefs: 0061F1D1

Memory Dump Source

Source File: 00000002.00000002.2567412345.0000000000610000.00000040.00001000.00020000.00000000.sdmp, Offset: 00610000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_610000_7Y18r(223).jbxd

Yara matches

Similarity

API ID: CriticalSection$htonlselect$AllocEnterErrorIncrementInitializeInterlockedLastLeaveSleepVirtuallstrlenrecvsend
String ID: ?????$\ntsvcs
API String ID: 2799264126-2481814201
Opcode ID: dbd13c687743058b6585e251fff305041a126996adaccb635ea5768b50fb4df7
Instruction ID: dce05ef689dc2901ea8c6b137e9f25047d27a737b5224be1285877430feda6ad
Opcode Fuzzy Hash: dbd13c687743058b6585e251fff305041a126996adaccb635ea5768b50fb4df7
Instruction Fuzzy Hash: 7B31D9B1D00754ABDB209FA4CC45ACEBBB6AF11320F18826CF4696B3C2E7759641CB55

Function 00620590 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 58COMMON

Download Yara Rule

APIs

htonl.WS2_32(00000074), ref: 006205E9

Part of subcall function 0061EF90: select.WS2_32(00000000,00000000,?,00000000,?), ref: 0061EFD5
Part of subcall function 0061EF90: send.WS2_32(?,?,?,00000000), ref: 0061EFF2
Part of subcall function 0061EF90: select.WS2_32(00000000,?,00000000,00000000,?), ref: 0061F029
Part of subcall function 0061EF90: recv.WS2_32(?,?,?,00000000), ref: 0061F04F
Part of subcall function 0061EF90: htonl.WS2_32(?), ref: 0061F06E

closesocket.WS2_32(?), ref: 00620607
VirtualFree.KERNEL32(?,00000000,00008000,?,?,?,\ntsvcs), ref: 00620616
GetLastError.KERNEL32(?,00000000,00008000,?,?,?,\ntsvcs), ref: 0062061F

Strings

\ntsvcs, xrefs: 00620596

Memory Dump Source

Source File: 00000002.00000002.2567412345.0000000000610000.00000040.00001000.00020000.00000000.sdmp, Offset: 00610000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_610000_7Y18r(223).jbxd

Yara matches

Similarity

API ID: htonlselect$ErrorFreeLastVirtualclosesocketrecvsend
String ID: \ntsvcs
API String ID: 375165098-3919542250
Opcode ID: 04272ce2537648c5113e4e74b65f48fb037ea523af7e956550a12016adaa2499
Instruction ID: 700aedb1184993b342e924d5c89a7628d9239059761a17059ce13b2654f612be
Opcode Fuzzy Hash: 04272ce2537648c5113e4e74b65f48fb037ea523af7e956550a12016adaa2499
Instruction Fuzzy Hash: B81129719007516EE730AF648C41F8BBFD6AF41760F1C862CF9986F283DAB19940C7A8

Function 0061F250 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 102stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0062091B: InitializeCriticalSection.KERNEL32(0062C1A0), ref: 00620932
Part of subcall function 0062091B: VirtualAlloc.KERNEL32(00000000,000C6800,00003000,00000004,0062C1A0), ref: 00620950
Part of subcall function 0062091B: Sleep.KERNEL32(000007D0), ref: 0062096B
Part of subcall function 0062091B: EnterCriticalSection.KERNEL32(0062C1A0), ref: 00620975
Part of subcall function 0062091B: InterlockedIncrement.KERNEL32(0062C1B8), ref: 006209B8
Part of subcall function 0062091B: LeaveCriticalSection.KERNEL32(0062C1A0,0062C1B8,0062C1A0), ref: 006209C5

lstrlenA.KERNEL32(?,00000000,?,0000031A,00000000,?,?,\ntsvcs), ref: 0061F297
htonl.WS2_32(000000A2), ref: 0061F340

Part of subcall function 0061EF90: select.WS2_32(00000000,00000000,?,00000000,?), ref: 0061EFD5
Part of subcall function 0061EF90: send.WS2_32(?,?,?,00000000), ref: 0061EFF2
Part of subcall function 0061EF90: select.WS2_32(00000000,?,00000000,00000000,?), ref: 0061F029
Part of subcall function 0061EF90: recv.WS2_32(?,?,?,00000000), ref: 0061F04F
Part of subcall function 0061EF90: htonl.WS2_32(?), ref: 0061F06E

SetLastError.KERNEL32(?,00000016,?,?,?,00001000,000000A2,?,?,?,00000000,?,?,00000000,000000B7,?), ref: 0061F376

Strings

\ntsvcs, xrefs: 0061F256

Memory Dump Source

Source File: 00000002.00000002.2567412345.0000000000610000.00000040.00001000.00020000.00000000.sdmp, Offset: 00610000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_610000_7Y18r(223).jbxd

Yara matches

Similarity

API ID: CriticalSection$htonlselect$AllocEnterErrorIncrementInitializeInterlockedLastLeaveSleepVirtuallstrlenrecvsend
String ID: \ntsvcs
API String ID: 2799264126-3919542250
Opcode ID: 039f69e46c667e679ad6ddea62009e5e4212a8770a1e8a2e3eb2e36984986b00
Instruction ID: 1ed5dd3eab7d7027fadbc2938f70d93a9816c45e33c664c3b470c4b2e8096cd3
Opcode Fuzzy Hash: 039f69e46c667e679ad6ddea62009e5e4212a8770a1e8a2e3eb2e36984986b00
Instruction Fuzzy Hash: 9641A271900744ABDB209F69C844ACEBBB2FF45320F18875CF4A96B2D2DB75A640CB94

Function 0061F3B0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 102COMMON

Download Yara Rule

APIs

htonl.WS2_32(00000010), ref: 0061F4D9

Part of subcall function 0061EF90: select.WS2_32(00000000,00000000,?,00000000,?), ref: 0061EFD5
Part of subcall function 0061EF90: send.WS2_32(?,?,?,00000000), ref: 0061EFF2
Part of subcall function 0061EF90: select.WS2_32(00000000,?,00000000,00000000,?), ref: 0061F029
Part of subcall function 0061EF90: recv.WS2_32(?,?,?,00000000), ref: 0061F04F
Part of subcall function 0061EF90: htonl.WS2_32(?), ref: 0061F06E

Strings

\PIPE\, xrefs: 0061F468
\ntsvcs, xrefs: 0061F3B6

Memory Dump Source

Source File: 00000002.00000002.2567412345.0000000000610000.00000040.00001000.00020000.00000000.sdmp, Offset: 00610000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_610000_7Y18r(223).jbxd

Yara matches

Similarity

API ID: htonlselect$recvsend
String ID: \PIPE\$\ntsvcs
API String ID: 183163812-3850501885
Opcode ID: dc78c408ee6cfd28989716bf24ad68377f88eaff2eb501b9a2a54a281d404d43
Instruction ID: d8ec000e5746156736dc11f1b0674d686a371886c01292cdd4387f8e3c2edcaf
Opcode Fuzzy Hash: dc78c408ee6cfd28989716bf24ad68377f88eaff2eb501b9a2a54a281d404d43
Instruction Fuzzy Hash: AC31B56250079097E3309F58C845B87B6F1EF14314F08951CE89A9B792F3B5EA84C3D9

Function 00620640 Relevance: 4.6, APIs: 3, Instructions: 104stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0062091B: InitializeCriticalSection.KERNEL32(0062C1A0), ref: 00620932
Part of subcall function 0062091B: VirtualAlloc.KERNEL32(00000000,000C6800,00003000,00000004,0062C1A0), ref: 00620950
Part of subcall function 0062091B: Sleep.KERNEL32(000007D0), ref: 0062096B
Part of subcall function 0062091B: EnterCriticalSection.KERNEL32(0062C1A0), ref: 00620975
Part of subcall function 0062091B: InterlockedIncrement.KERNEL32(0062C1B8), ref: 006209B8
Part of subcall function 0062091B: LeaveCriticalSection.KERNEL32(0062C1A0,0062C1B8,0062C1A0), ref: 006209C5

lstrlenA.KERNEL32(?,00000000,?,0000031A,00000000,?,FFFFFFFF,?), ref: 00620687
htonl.WS2_32(000000A2), ref: 0062073B

Part of subcall function 0061EF90: select.WS2_32(00000000,00000000,?,00000000,?), ref: 0061EFD5
Part of subcall function 0061EF90: send.WS2_32(?,?,?,00000000), ref: 0061EFF2
Part of subcall function 0061EF90: select.WS2_32(00000000,?,00000000,00000000,?), ref: 0061F029
Part of subcall function 0061EF90: recv.WS2_32(?,?,?,00000000), ref: 0061F04F
Part of subcall function 0061EF90: htonl.WS2_32(?), ref: 0061F06E

SetLastError.KERNEL32(?,00000016,?,?,?,00001000,000000A2,?,?,?,00000000,?,?,00000000,000000B7,?), ref: 00620771

Memory Dump Source

Source File: 00000002.00000002.2567412345.0000000000610000.00000040.00001000.00020000.00000000.sdmp, Offset: 00610000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_610000_7Y18r(223).jbxd

Yara matches

Similarity

API ID: CriticalSection$htonlselect$AllocEnterErrorIncrementInitializeInterlockedLastLeaveSleepVirtuallstrlenrecvsend
String ID:
API String ID: 2799264126-0
Opcode ID: ad475195fbd483a14176ca3356ddf3e775c44a2b30d4e6d1ed6671389edfca8d
Instruction ID: 0810239d75919eb007098180781e72fcef54ca40c4f4ba702eae7f3314310151
Opcode Fuzzy Hash: ad475195fbd483a14176ca3356ddf3e775c44a2b30d4e6d1ed6671389edfca8d
Instruction Fuzzy Hash: FE41BC70900B54ABEB709F69C844A8FBBF2AF05320F14875CE4A96B2D2D775A640CF94

Function 0061F510 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 128COMMON

Download Yara Rule

APIs

htonl.WS2_32(00000010), ref: 0061F61F

Part of subcall function 0061EF90: select.WS2_32(00000000,00000000,?,00000000,?), ref: 0061EFD5
Part of subcall function 0061EF90: send.WS2_32(?,?,?,00000000), ref: 0061EFF2
Part of subcall function 0061EF90: select.WS2_32(00000000,?,00000000,00000000,?), ref: 0061F029
Part of subcall function 0061EF90: recv.WS2_32(?,?,?,00000000), ref: 0061F04F
Part of subcall function 0061EF90: htonl.WS2_32(?), ref: 0061F06E

Strings

\PIPE\, xrefs: 0061F5CF

Memory Dump Source

Source File: 00000002.00000002.2567412345.0000000000610000.00000040.00001000.00020000.00000000.sdmp, Offset: 00610000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_610000_7Y18r(223).jbxd

Yara matches

Similarity

API ID: htonlselect$recvsend
String ID: \PIPE\
API String ID: 183163812-2548971900
Opcode ID: 89c57fe621287c68459a20f02817aad1d560823af656d9afebe1e846a2d6d49d
Instruction ID: 5363112ad3a39b044a3da6f88601e218526b60f1f4ddf2a2ba68974d94379f7c
Opcode Fuzzy Hash: 89c57fe621287c68459a20f02817aad1d560823af656d9afebe1e846a2d6d49d
Instruction Fuzzy Hash: 01519DB29007559BDB20CF68C845B8BBBF1EF15314F088A1DE89997391E374EA84CBD5

Function 00620460 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 57COMMON

Download Yara Rule

APIs

htonl.WS2_32(00000004), ref: 006204D7

Part of subcall function 0061EF90: select.WS2_32(00000000,00000000,?,00000000,?), ref: 0061EFD5
Part of subcall function 0061EF90: send.WS2_32(?,?,?,00000000), ref: 0061EFF2
Part of subcall function 0061EF90: select.WS2_32(00000000,?,00000000,00000000,?), ref: 0061F029
Part of subcall function 0061EF90: recv.WS2_32(?,?,?,00000000), ref: 0061F04F
Part of subcall function 0061EF90: htonl.WS2_32(?), ref: 0061F06E

Strings

\ntsvcs, xrefs: 00620466

Memory Dump Source

Source File: 00000002.00000002.2567412345.0000000000610000.00000040.00001000.00020000.00000000.sdmp, Offset: 00610000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_610000_7Y18r(223).jbxd

Yara matches

Similarity

API ID: htonlselect$recvsend
String ID: \ntsvcs
API String ID: 183163812-3919542250
Opcode ID: ebfbe4526169d3b1eb5738ab9d2c893864a43a5c2dbb23105102a389c84635df
Instruction ID: cdbbd755b2ad4aea88eac97ef9b25cb12812ed7c23ed3fb6e9adcacfe09fd248
Opcode Fuzzy Hash: ebfbe4526169d3b1eb5738ab9d2c893864a43a5c2dbb23105102a389c84635df
Instruction Fuzzy Hash: CA11B6715006509BD730EF68CC84A8BBBE9AF41360F148618ED995B382E774A940C7E4

Function 00620510 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 47COMMON

Download Yara Rule

APIs

htonl.WS2_32(00000071), ref: 00620569

Part of subcall function 0061EF90: select.WS2_32(00000000,00000000,?,00000000,?), ref: 0061EFD5
Part of subcall function 0061EF90: send.WS2_32(?,?,?,00000000), ref: 0061EFF2
Part of subcall function 0061EF90: select.WS2_32(00000000,?,00000000,00000000,?), ref: 0061F029
Part of subcall function 0061EF90: recv.WS2_32(?,?,?,00000000), ref: 0061F04F
Part of subcall function 0061EF90: htonl.WS2_32(?), ref: 0061F06E

Strings

\ntsvcs, xrefs: 00620516

Memory Dump Source

Source File: 00000002.00000002.2567412345.0000000000610000.00000040.00001000.00020000.00000000.sdmp, Offset: 00610000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_610000_7Y18r(223).jbxd

Yara matches

Similarity

API ID: htonlselect$recvsend
String ID: \ntsvcs
API String ID: 183163812-3919542250
Opcode ID: 02eac7413d6e63da82de8a3429d1e2ecb0219451e3da7e55dd084c90423ba9cf
Instruction ID: 9b3536ee9983e79c6b7bf602afffb7abdbaa413a6557f0f1bdfcc3342ac4bc59
Opcode Fuzzy Hash: 02eac7413d6e63da82de8a3429d1e2ecb0219451e3da7e55dd084c90423ba9cf
Instruction Fuzzy Hash: CD01D4719002606BE730EF688C85E8BBBA9DF41350F044518FC896B287DA74E940C7E8

Function 006224C0 Relevance: 1.6, APIs: 1, Instructions: 87COMMON

Download Yara Rule

APIs

htonl.WS2_32(00000010), ref: 00622599

Part of subcall function 0061EF90: select.WS2_32(00000000,00000000,?,00000000,?), ref: 0061EFD5
Part of subcall function 0061EF90: send.WS2_32(?,?,?,00000000), ref: 0061EFF2
Part of subcall function 0061EF90: select.WS2_32(00000000,?,00000000,00000000,?), ref: 0061F029
Part of subcall function 0061EF90: recv.WS2_32(?,?,?,00000000), ref: 0061F04F
Part of subcall function 0061EF90: htonl.WS2_32(?), ref: 0061F06E

Memory Dump Source

Source File: 00000002.00000002.2567412345.0000000000610000.00000040.00001000.00020000.00000000.sdmp, Offset: 00610000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_610000_7Y18r(223).jbxd

Yara matches

Similarity

API ID: htonlselect$recvsend
String ID:
API String ID: 183163812-0
Opcode ID: 3fa54cf60ae5b955b6195b1b08a2814378cee2ae1a2bab300288c2153edb36b1
Instruction ID: 83c07b63205e21990945343d5b17f5f1bce00d2752b0f625474f66fe289fb767
Opcode Fuzzy Hash: 3fa54cf60ae5b955b6195b1b08a2814378cee2ae1a2bab300288c2153edb36b1
Instruction Fuzzy Hash: 3D31C2315007919BD730DF68C844A8BBBF1AF15320B048A1DFCA99B392E370E944C7E5

Function 006223D0 Relevance: 1.6, APIs: 1, Instructions: 74COMMON

Download Yara Rule

APIs

htonl.WS2_32(0000002F), ref: 0062247D

Part of subcall function 0061EF90: select.WS2_32(00000000,00000000,?,00000000,?), ref: 0061EFD5
Part of subcall function 0061EF90: send.WS2_32(?,?,?,00000000), ref: 0061EFF2
Part of subcall function 0061EF90: select.WS2_32(00000000,?,00000000,00000000,?), ref: 0061F029
Part of subcall function 0061EF90: recv.WS2_32(?,?,?,00000000), ref: 0061F04F
Part of subcall function 0061EF90: htonl.WS2_32(?), ref: 0061F06E

Memory Dump Source

Source File: 00000002.00000002.2567412345.0000000000610000.00000040.00001000.00020000.00000000.sdmp, Offset: 00610000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_610000_7Y18r(223).jbxd

Yara matches

Similarity

API ID: htonlselect$recvsend
String ID:
API String ID: 183163812-0
Opcode ID: a3456d8f365397bfbe2da6812bb9ea031b40d9dc0639d7566cb63a156b2886c0
Instruction ID: 5af9b97498bce8f7133d0d3af22552bf11839a3e83aadb93341fd7cfb53ac4bb
Opcode Fuzzy Hash: a3456d8f365397bfbe2da6812bb9ea031b40d9dc0639d7566cb63a156b2886c0
Instruction Fuzzy Hash: DF219E755007519BD730DF68C844A8BBBF6AF45320B18862DFCA99B3D2E330E940C7A6

Function 00622640 Relevance: .7, Instructions: 652COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2567412345.0000000000610000.00000040.00001000.00020000.00000000.sdmp, Offset: 00610000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_610000_7Y18r(223).jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86e1fc953f9734f122b5cf9138eeacf0118e62c53451ba632b2d76c7faa63c28
Instruction ID: eb35deafee5a148e98e8bfd7d17763f272ec6adeb0cd97324e3dbf259a8d3c2a
Opcode Fuzzy Hash: 86e1fc953f9734f122b5cf9138eeacf0118e62c53451ba632b2d76c7faa63c28
Instruction Fuzzy Hash: 89128273B716180BC344CD7DCC852C27293ABD452875FCA3CAD68CB706F66AED1A6684

Function 0061BA3C Relevance: .3, Instructions: 342COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2567412345.0000000000610000.00000040.00001000.00020000.00000000.sdmp, Offset: 00610000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_610000_7Y18r(223).jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3b63372f37d762def7111b8c50c737e7ff2c5ba6e83a97b0a4b39a573d0d558
Instruction ID: a1a6a6e0692602a2f2018863a4f52306b50d1a2887dc09d9eabc6d62e20b64bb
Opcode Fuzzy Hash: e3b63372f37d762def7111b8c50c737e7ff2c5ba6e83a97b0a4b39a573d0d558
Instruction Fuzzy Hash: EE12B678A10209EFCB48CF98C19099EFBF1FF4C314B61859A9855AB355D731AE82DF84

Function 0061B6F0 Relevance: .2, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2567412345.0000000000610000.00000040.00001000.00020000.00000000.sdmp, Offset: 00610000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_610000_7Y18r(223).jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9677b711d38563a2825f7443332c50510bb0d061cf18ff5f3934303797e00e56
Instruction ID: 06c8dcf234c073cf2128930e27d269e5ee84f71e8c96b240d06059f51f6e5a5f
Opcode Fuzzy Hash: 9677b711d38563a2825f7443332c50510bb0d061cf18ff5f3934303797e00e56
Instruction Fuzzy Hash: 58614276E2968A5ADF1ACBB8C8617FEBB739F65200F0C91F8C98267782C5351604C715

Function 0061B6FF Relevance: .2, Instructions: 162COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2567412345.0000000000610000.00000040.00001000.00020000.00000000.sdmp, Offset: 00610000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_610000_7Y18r(223).jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ebb76b40e6964e572e2cc5e439abef018727318bb9ea2ad3fe63a29ba666e07
Instruction ID: e52fe2ca6133cfeee8c95605e7f90b8be864958e09c4c7a8a774a2b4b4ae8ad4
Opcode Fuzzy Hash: 0ebb76b40e6964e572e2cc5e439abef018727318bb9ea2ad3fe63a29ba666e07
Instruction Fuzzy Hash: 12615176E2968A9ADF1ACBB8C8617FEBF73AF65200F0C91F8C58267782C5351604C715

Function 0042F5E0 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2567155186.0000000000420000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2567016652.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2567034359.0000000000401000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2567055275.0000000000404000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2567075416.0000000000405000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2567075416.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2567075416.0000000000410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2567075416.0000000000415000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2567188962.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2567207031.0000000000463000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_7Y18r(223).jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e22bd9c3ea003a364fc1a0b7a8689fdbf222e3206a6726eeb9f26b097506e6a
Instruction ID: 74cdb5c15c7fcda3bb419acac69f0a2c6899bca75c1378c06822a8028fdd990d
Opcode Fuzzy Hash: 1e22bd9c3ea003a364fc1a0b7a8689fdbf222e3206a6726eeb9f26b097506e6a
Instruction Fuzzy Hash: F9D0A732E099344756185C2C389517A91F4A255350FF6637EC6261365544604C45C1CA

Function 00612228 Relevance: 33.4, APIs: 16, Strings: 3, Instructions: 138stringmemoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(0062B4A2), ref: 00612241
lstrcpyA.KERNEL32(?,?,0062B4A2), ref: 00612250
CoTaskMemFree.OLE32(?,?,?,0062B4A2), ref: 00612258
LeaveCriticalSection.KERNEL32(0062B4A2,?,?,?,0062B4A2), ref: 00612262
SetFileAttributesA.KERNEL32(?,00000020,0062B4A2,?,?,?,0062B4A2), ref: 00612270
lstrcpyA.KERNEL32(?,?,?,00000020,0062B4A2,?,?,?,0062B4A2), ref: 00612283

Part of subcall function 006125A0: lstrcpyA.KERNEL32(?,?,?,0000012C,00000000,?,00000064,00000000), ref: 006125E3
Part of subcall function 006125A0: lstrlenA.KERNEL32(?,?,?,?,?,0000012C,00000000,?,00000064,00000000), ref: 00612642
Part of subcall function 006125A0: wsprintfA.USER32 ref: 00612671

Part of subcall function 00612680: lstrcpyA.KERNEL32(?,?,?,0000012C,00000000), ref: 006126A9

Part of subcall function 00617F40: CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 00617F5B
Part of subcall function 00617F40: GetFileSize.KERNEL32(?,00000000,?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 00617F6D
Part of subcall function 00617F40: CoTaskMemAlloc.OLE32(00000000,?,00000000,?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 00617F75
Part of subcall function 00617F40: ReadFile.KERNEL32(?,00000000,00000000,?,00000000,00000000,?,00000000,?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 00617F91
Part of subcall function 00617F40: CloseHandle.KERNEL32(?,?,00000000,00000000,?,00000000,00000000,?,00000000,?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 00617F99

CoTaskMemAlloc.OLE32(000002BC,?,?,?,?,?,?,?,?,?,?,?,00000020,0062B4A2,?,?), ref: 006122DB
lstrcpyA.KERNEL32(?,?,000002BC,?,?,?,?,?,?,?,?,?,?,?,00000020,0062B4A2), ref: 006122E9
CharLowerA.USER32(?,?,?,000002BC,?,?,?,?,?,?,?,?,?,?,?,00000020), ref: 006122F1
lstrcpynA.KERNEL32(?,?,00000000,?,-00000001,00000001,?,<html>,?,?,?,000002BC,?,?,?,?), ref: 00612340
lstrcatA.KERNEL32(?,?,?,?,00000000,?,-00000001,00000001,?,<html>,?,?,?,000002BC,?,?), ref: 00612351
lstrcatA.KERNEL32(?,?,?,?,?,?,00000000,?,-00000001,00000001,?,<html>,?,?,?,000002BC), ref: 0061235A
lstrlenA.KERNEL32(?,?,?,?,?,?,?,00000000,?,-00000001,00000001,?,<html>,?,?,?), ref: 00612362

Part of subcall function 00612540: CreateFileA.KERNEL32(?,40000000,00000003,00000000,00000004,00000080,00000000,-00000001,?), ref: 0061255E
Part of subcall function 00612540: SetFilePointer.KERNEL32(?,00000000,00000000,00000000,?,40000000,00000003,00000000,00000004,00000080,00000000,-00000001,?), ref: 00612574
Part of subcall function 00612540: WriteFile.KERNEL32(?,?,?,?,00000000,?,00000000,00000000,00000000,?,40000000,00000003,00000000,00000004,00000080,00000000), ref: 00612585
Part of subcall function 00612540: CloseHandle.KERNEL32(?,?,?,?,?,00000000,?,00000000,00000000,00000000,?,40000000,00000003,00000000,00000004,00000080), ref: 0061258D

Part of subcall function 00612A9F: GetModuleFileNameA.KERNEL32(00000000,?,0000012C,?,?,\ntsvcs), ref: 00612AC0
Part of subcall function 00612A9F: GetModuleHandleA.KERNEL32(00000000,?,?,?,00000000,?,0000012C,?,?,\ntsvcs), ref: 00612AED
Part of subcall function 00612A9F: VirtualAlloc.KERNEL32(00000000,?,00001000,00000040,?,?,?,?,00405010,000003E8,00000000,?,?,?,00000000,?), ref: 00612B5A
Part of subcall function 00612A9F: VirtualFree.KERNEL32(?,00000000,00008000,0062BD80,?,?,?,00000000,?,00001000,00000040,?,?,?,?,00405010), ref: 00612BD0

VirtualFree.KERNEL32(?,00000000,00008000,?,?,?,?,?,?,?,00000000,?,?,?,?,?), ref: 006123AF

Part of subcall function 00612700: CoCreateGuid.OLE32(?), ref: 00612719

Part of subcall function 00612470: wsprintfA.USER32 ref: 00612487
Part of subcall function 00612470: RegCreateKeyA.ADVAPI32(?,?,?), ref: 006124A0
Part of subcall function 00612470: lstrlenA.KERNEL32(?), ref: 006124AC
Part of subcall function 00612470: RegSetValueExA.ADVAPI32(?,00000000,00000000,00000001,?,00000001,?), ref: 006124C2
Part of subcall function 00612470: RegCloseKey.ADVAPI32(?,?,00000000,00000000,00000001,?,00000001,?), ref: 006124CD

CoTaskMemFree.OLE32(?,00000001,?,<html>,?,?,?,000002BC,?,?,?,?,?,?,?,?), ref: 006123FD
CoTaskMemFree.OLE32(?,?,00000001,?,<html>,?,?,?,000002BC,?,?,?,?,?,?,?), ref: 00612405

Part of subcall function 00612420: lstrlenA.KERNEL32(?,-00000001,?), ref: 0061242F
Part of subcall function 00612420: lstrcpyA.KERNEL32(?,?,?,-00000001,?), ref: 00612441
Part of subcall function 00612420: lstrcpynA.KERNEL32(?,?,00000001,?,?,?,-00000001,?), ref: 00612451
Part of subcall function 00612420: lstrcmpA.KERNEL32(?,?,?,?,00000001,?,?,?,-00000001,?), ref: 00612464

Strings

CLSID\%s, xrefs: 006123C7
<html>, xrefs: 006122F6
CLSID\%s\LocalServer32, xrefs: 006123E4

Memory Dump Source

Source File: 00000002.00000002.2567412345.0000000000610000.00000040.00001000.00020000.00000000.sdmp, Offset: 00610000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_610000_7Y18r(223).jbxd

Yara matches

Similarity

API ID: File$lstrcpy$FreeTask$Createlstrlen$AllocCloseHandleVirtual$CriticalModuleSectionlstrcatlstrcpynwsprintf$AttributesCharEnterGuidLeaveLowerNamePointerReadSizeValueWritelstrcmp
String ID: <html>$CLSID\%s$CLSID\%s\LocalServer32
API String ID: 1698267736-849937109
Opcode ID: 17b9397ccde45fab5ae2529cf91feb6e157e8876e746febc215032143aacd809
Instruction ID: bc867049353858ce32ef8b33def120ba3f50e84685611c1595248de9fb89acbf
Opcode Fuzzy Hash: 17b9397ccde45fab5ae2529cf91feb6e157e8876e746febc215032143aacd809
Instruction Fuzzy Hash: C6412F71C0421DBECF91ABA0DC95EDEB7BEEF04300F1841A9B518A2051EF75AB949F64

Function 00612230 Relevance: 33.4, APIs: 16, Strings: 3, Instructions: 136stringmemoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(0062B4A2), ref: 00612241
lstrcpyA.KERNEL32(?,?,0062B4A2), ref: 00612250
CoTaskMemFree.OLE32(?,?,?,0062B4A2), ref: 00612258
LeaveCriticalSection.KERNEL32(0062B4A2,?,?,?,0062B4A2), ref: 00612262
SetFileAttributesA.KERNEL32(?,00000020,0062B4A2,?,?,?,0062B4A2), ref: 00612270
lstrcpyA.KERNEL32(?,?,?,00000020,0062B4A2,?,?,?,0062B4A2), ref: 00612283

Part of subcall function 006125A0: lstrcpyA.KERNEL32(?,?,?,0000012C,00000000,?,00000064,00000000), ref: 006125E3
Part of subcall function 006125A0: lstrlenA.KERNEL32(?,?,?,?,?,0000012C,00000000,?,00000064,00000000), ref: 00612642
Part of subcall function 006125A0: wsprintfA.USER32 ref: 00612671

Part of subcall function 00612680: lstrcpyA.KERNEL32(?,?,?,0000012C,00000000), ref: 006126A9

Part of subcall function 00617F40: CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 00617F5B
Part of subcall function 00617F40: GetFileSize.KERNEL32(?,00000000,?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 00617F6D
Part of subcall function 00617F40: CoTaskMemAlloc.OLE32(00000000,?,00000000,?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 00617F75
Part of subcall function 00617F40: ReadFile.KERNEL32(?,00000000,00000000,?,00000000,00000000,?,00000000,?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 00617F91
Part of subcall function 00617F40: CloseHandle.KERNEL32(?,?,00000000,00000000,?,00000000,00000000,?,00000000,?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 00617F99

CoTaskMemAlloc.OLE32(000002BC,?,?,?,?,?,?,?,?,?,?,?,00000020,0062B4A2,?,?), ref: 006122DB
lstrcpyA.KERNEL32(?,?,000002BC,?,?,?,?,?,?,?,?,?,?,?,00000020,0062B4A2), ref: 006122E9
CharLowerA.USER32(?,?,?,000002BC,?,?,?,?,?,?,?,?,?,?,?,00000020), ref: 006122F1
lstrcpynA.KERNEL32(?,?,00000000,?,-00000001,00000001,?,<html>,?,?,?,000002BC,?,?,?,?), ref: 00612340
lstrcatA.KERNEL32(?,?,?,?,00000000,?,-00000001,00000001,?,<html>,?,?,?,000002BC,?,?), ref: 00612351
lstrcatA.KERNEL32(?,?,?,?,?,?,00000000,?,-00000001,00000001,?,<html>,?,?,?,000002BC), ref: 0061235A
lstrlenA.KERNEL32(?,?,?,?,?,?,?,00000000,?,-00000001,00000001,?,<html>,?,?,?), ref: 00612362

Part of subcall function 00612540: CreateFileA.KERNEL32(?,40000000,00000003,00000000,00000004,00000080,00000000,-00000001,?), ref: 0061255E
Part of subcall function 00612540: SetFilePointer.KERNEL32(?,00000000,00000000,00000000,?,40000000,00000003,00000000,00000004,00000080,00000000,-00000001,?), ref: 00612574
Part of subcall function 00612540: WriteFile.KERNEL32(?,?,?,?,00000000,?,00000000,00000000,00000000,?,40000000,00000003,00000000,00000004,00000080,00000000), ref: 00612585
Part of subcall function 00612540: CloseHandle.KERNEL32(?,?,?,?,?,00000000,?,00000000,00000000,00000000,?,40000000,00000003,00000000,00000004,00000080), ref: 0061258D

Part of subcall function 00612A9F: GetModuleFileNameA.KERNEL32(00000000,?,0000012C,?,?,\ntsvcs), ref: 00612AC0
Part of subcall function 00612A9F: GetModuleHandleA.KERNEL32(00000000,?,?,?,00000000,?,0000012C,?,?,\ntsvcs), ref: 00612AED
Part of subcall function 00612A9F: VirtualAlloc.KERNEL32(00000000,?,00001000,00000040,?,?,?,?,00405010,000003E8,00000000,?,?,?,00000000,?), ref: 00612B5A
Part of subcall function 00612A9F: VirtualFree.KERNEL32(?,00000000,00008000,0062BD80,?,?,?,00000000,?,00001000,00000040,?,?,?,?,00405010), ref: 00612BD0

VirtualFree.KERNEL32(?,00000000,00008000,?,?,?,?,?,?,?,00000000,?,?,?,?,?), ref: 006123AF

Part of subcall function 00612700: CoCreateGuid.OLE32(?), ref: 00612719

Part of subcall function 00612470: wsprintfA.USER32 ref: 00612487
Part of subcall function 00612470: RegCreateKeyA.ADVAPI32(?,?,?), ref: 006124A0
Part of subcall function 00612470: lstrlenA.KERNEL32(?), ref: 006124AC
Part of subcall function 00612470: RegSetValueExA.ADVAPI32(?,00000000,00000000,00000001,?,00000001,?), ref: 006124C2
Part of subcall function 00612470: RegCloseKey.ADVAPI32(?,?,00000000,00000000,00000001,?,00000001,?), ref: 006124CD

CoTaskMemFree.OLE32(?,00000001,?,<html>,?,?,?,000002BC,?,?,?,?,?,?,?,?), ref: 006123FD
CoTaskMemFree.OLE32(?,?,00000001,?,<html>,?,?,?,000002BC,?,?,?,?,?,?,?), ref: 00612405

Part of subcall function 00612420: lstrlenA.KERNEL32(?,-00000001,?), ref: 0061242F
Part of subcall function 00612420: lstrcpyA.KERNEL32(?,?,?,-00000001,?), ref: 00612441
Part of subcall function 00612420: lstrcpynA.KERNEL32(?,?,00000001,?,?,?,-00000001,?), ref: 00612451
Part of subcall function 00612420: lstrcmpA.KERNEL32(?,?,?,?,00000001,?,?,?,-00000001,?), ref: 00612464

Strings

CLSID\%s, xrefs: 006123C7
<html>, xrefs: 006122F6
CLSID\%s\LocalServer32, xrefs: 006123E4

Memory Dump Source

Source File: 00000002.00000002.2567412345.0000000000610000.00000040.00001000.00020000.00000000.sdmp, Offset: 00610000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_610000_7Y18r(223).jbxd

Yara matches

Similarity

API ID: File$lstrcpy$FreeTask$Createlstrlen$AllocCloseHandleVirtual$CriticalModuleSectionlstrcatlstrcpynwsprintf$AttributesCharEnterGuidLeaveLowerNamePointerReadSizeValueWritelstrcmp
String ID: <html>$CLSID\%s$CLSID\%s\LocalServer32
API String ID: 1698267736-849937109
Opcode ID: adf33df59298b0e8542e38f46856bb99f0718416b122d5210abf939e644ec5b6
Instruction ID: 3cc6fe8bf73f61cf7e4172a06dd2e459b71ef74202bd96e34dc7d2d69990bc41
Opcode Fuzzy Hash: adf33df59298b0e8542e38f46856bb99f0718416b122d5210abf939e644ec5b6
Instruction Fuzzy Hash: A4412071C0411DBECF91ABA0DC95EDEB7BEEF04300F1841A9B518A2051EF75AB949F64

Function 00618EC0 Relevance: 28.7, APIs: 19, Instructions: 193networkmemoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00003000,00001000,00000040,FFFFFFFF), ref: 00618EDC

Part of subcall function 0061856C: VirtualAlloc.KERNEL32(00000000,00002061,00001000,00000040,00618EF6,?,00000050,00000000,00000000,00003000,00001000,00000040,FFFFFFFF), ref: 0061857A

socket.WS2_32(00000002,00000001,00000000), ref: 00618F1A
htons.WS2_32(?), ref: 00618F34
gethostbyname.WS2_32(?), ref: 00618F40
inet_addr.WS2_32(?), ref: 00618F55

Part of subcall function 0061D4E0: htonl.WS2_32(?), ref: 0061D505
Part of subcall function 0061D4E0: htonl.WS2_32(00000000), ref: 0061D51B

connect.WS2_32(?,?,00000010), ref: 00618F6F
send.WS2_32(?,?,?,00000000), ref: 00618F94
recv.WS2_32(?,?,00000300,00000000), ref: 00618FAF
send.WS2_32(?,?,?,00000000), ref: 0061900E
recv.WS2_32(?,?,00003000,00000000), ref: 00619029

Part of subcall function 00618500: lstrcpyA.KERNEL32(?,?,?,00000100,00000000), ref: 00618529

send.WS2_32(?,?,?,00000000), ref: 00619066
recv.WS2_32(?,?,00003000,00000000), ref: 00619078

Part of subcall function 0061D540: htonl.WS2_32(?), ref: 0061D558
Part of subcall function 0061D540: htonl.WS2_32(00000000), ref: 0061D578

VirtualFree.KERNEL32(?,00000000,00008000,?,00000000,?,?,00003000,00000000,?,?,?,00000000,?,00000004,0000001A), ref: 00619095
VirtualFree.KERNEL32(?,00000000,00008000,?,00000000,?,?,00003000,00000000,?,?,?,00000000,?,00000004,0000001A), ref: 006190B8
VirtualFree.KERNEL32(?,00000000,00008000,?,00000000,00008000,?,00000000,?,?,00003000,00000000,?,?,?,00000000), ref: 006190C7
closesocket.WS2_32(?), ref: 006190CF

Memory Dump Source

Source File: 00000002.00000002.2567412345.0000000000610000.00000040.00001000.00020000.00000000.sdmp, Offset: 00610000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_610000_7Y18r(223).jbxd

Yara matches

Similarity

API ID: Virtual$htonl$Freerecvsend$Alloc$closesocketconnectgethostbynamehtonsinet_addrlstrcpysocket
String ID:
API String ID: 2835327832-0
Opcode ID: 5a685eafd782a1ad7ab7b56893306bdb6068a846cf2647d5c40c2342f536241c
Instruction ID: 38a1de9594628035bd2779621a8faa14982a1cb41867e25eaa858925d4c7a067
Opcode Fuzzy Hash: 5a685eafd782a1ad7ab7b56893306bdb6068a846cf2647d5c40c2342f536241c
Instruction Fuzzy Hash: B3516231A00219BEDF71ABA4CC42FDDB67BBF04710F284119F614BB1E2DB7169919B68

Function 00611F00 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 97registrystringCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000000,\CLSID,00000000,000F003F,?), ref: 00611F21
RegEnumKeyExA.ADVAPI32(?,00000000,?,00000258,00000000,00000000,00000000,00000000), ref: 00611F4C
wsprintfA.USER32 ref: 00611F6D
RegOpenKeyA.ADVAPI32(?,?,?), ref: 00611F83
RegQueryValueA.ADVAPI32(?,00000000,?,00000258), ref: 00611FA5
CharLowerA.USER32(?), ref: 00611FB5
strstr.MSVCRT ref: 00611FD0

Part of subcall function 00611BF0: OpenFileMappingA.KERNEL32(00000004,00000000,Global\1CKPUPP), ref: 00611C05
Part of subcall function 00611BF0: MapViewOfFile.KERNEL32(?,00000004,00000000,00000000,00000000), ref: 00611C22
Part of subcall function 00611BF0: VirtualAlloc.KERNEL32(00000000,?,00001000,00000040,?,00000004,00000000,00000000,00000000), ref: 00611C49
Part of subcall function 00611BF0: lstrlenA.KERNEL32(?,?,?,?,00000000,?,?,?,00000000,?,00000258), ref: 00611CDC
Part of subcall function 00611BF0: lstrcpyA.KERNEL32(?,?,?,00000000,00000000,?,?,?,?,00000000,?,?,?,00000000,?,00000258), ref: 00611CEE
Part of subcall function 00611BF0: VirtualFree.KERNEL32(?,00000000,00008000,?,?,?,?,?,?,?,00000000,00000000,?,?,?,?), ref: 00611D1C

Part of subcall function 00611E50: CreateFileA.KERNEL32(?,C0000000,00000000,00000000,00000003,00000080,00000000), ref: 00611E6D
Part of subcall function 00611E50: CreateFileMappingA.KERNEL32(?,00000000,00000004,00000000,00000000,00000000), ref: 00611E83
Part of subcall function 00611E50: MapViewOfFile.KERNEL32(?,000F001F,00000000,00000000,00000000,?,C0000000,00000000,00000000,00000003,00000080,00000000), ref: 00611E96
Part of subcall function 00611E50: GetFileSize.KERNEL32(?,00000000,?,000F001F,00000000,00000000,00000000,?,C0000000,00000000,00000000,00000003,00000080,00000000), ref: 00611EA2
Part of subcall function 00611E50: CheckSumMappedFile.IMAGEHLP(?,?,?,?,?,00000000,?,000F001F,00000000,00000000,00000000,?,C0000000,00000000,00000000,00000003), ref: 00611EC7
Part of subcall function 00611E50: FlushViewOfFile.KERNEL32(?,00000000,?,?,?,?,?,00000000,?,000F001F,00000000,00000000,00000000,?,C0000000,00000000), ref: 00611ED6
Part of subcall function 00611E50: UnmapViewOfFile.KERNEL32(?,?,00000000,?,?,?,?,?,00000000,?,000F001F,00000000,00000000,00000000,?,C0000000), ref: 00611EDE
Part of subcall function 00611E50: CloseHandle.KERNEL32(?,?,?,00000000,?,?,?,?,?,00000000,?,000F001F,00000000,00000000,00000000,?), ref: 00611EE6
Part of subcall function 00611E50: CloseHandle.KERNEL32(?,?,?,?,00000000,?,?,?,?,?,00000000,?,000F001F,00000000,00000000,00000000), ref: 00611EEE

lstrlenA.KERNEL32(?,?), ref: 00611FFD
RegSetValueA.ADVAPI32(?,00000000,00000001,?,00000000), ref: 00612011
RegCloseKey.ADVAPI32(?), ref: 00612021
RegCloseKey.ADVAPI32(?,?,00000001,?,00000258,00000000,00000000,00000000,00000000), ref: 0061202F

Strings

\CLSID, xrefs: 00611F17
%s\InprocServer32, xrefs: 00611F61
.Hb, xrefs: 00611FBF, 00611FC7, 00611FE3

Memory Dump Source

Source File: 00000002.00000002.2567412345.0000000000610000.00000040.00001000.00020000.00000000.sdmp, Offset: 00610000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_610000_7Y18r(223).jbxd

Yara matches

Similarity

API ID: File$CloseView$Open$CreateHandleMappingValueVirtuallstrlen$AllocCharCheckEnumFlushFreeLowerMappedQuerySizeUnmaplstrcpystrstrwsprintf
String ID: %s\InprocServer32$.Hb$\CLSID
API String ID: 2310014955-1843317235
Opcode ID: d5dfe1ad61857d5f793888afe7de3a61eee3967bd6aaf4f91ba760af9902414c
Instruction ID: 2f9db07155e25557e2f339949702637802f767630e1811526997121ec0d6afcb
Opcode Fuzzy Hash: d5dfe1ad61857d5f793888afe7de3a61eee3967bd6aaf4f91ba760af9902414c
Instruction Fuzzy Hash: 7C314371944119AEDBA096A0CC45FDE77BEEB04300F1801A6B608B2051EF75ABD49B68

Function 00618060 Relevance: 22.8, APIs: 10, Strings: 3, Instructions: 66stringsleepfileCOMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,0000012C,?,?,?,?,00617B73), ref: 0061807A
GetSystemDirectoryA.KERNEL32(?,00000258), ref: 0061809D
lstrcatA.KERNEL32(?,irdvxc.exe ,?,00000258,00000000,?,0000012C,?,?,?,?,00617B73), ref: 006180C1
CopyFileA.KERNEL32(?,?,00000000), ref: 006180D6
lstrcpyA.KERNEL32(?,?,?,irdvxc.exe ,?,00000258,00000000,?,0000012C,?,?,?,?,00617B73), ref: 006180E9
lstrcpyA.KERNEL32(?,?,?,?,?,irdvxc.exe ,?,00000258,00000000,?,0000012C,?,?,?,?,00617B73), ref: 006180FC
lstrcatA.KERNEL32(?,/installservice,?,?,?,?,?,irdvxc.exe ,?,00000258,00000000,?,0000012C), ref: 0061810D
lstrcatA.KERNEL32(?,/start,?,/installservice,?,?,?,?,?,irdvxc.exe ,?,00000258,00000000,?,0000012C), ref: 0061811E
Sleep.KERNEL32(000007D0,?,?,/start,?,/installservice,?,?,?,?,?,irdvxc.exe ,?,00000258,00000000,?), ref: 00618134
ExitProcess.KERNEL32(00000000,?,000007D0,?,?,/start,?,/installservice,?,?,?,?,?,irdvxc.exe ,?,00000258), ref: 00618147

Strings

/start, xrefs: 00618112
irdvxc.exe , xrefs: 006180B5
/installservice, xrefs: 00618101

Memory Dump Source

Source File: 00000002.00000002.2567412345.0000000000610000.00000040.00001000.00020000.00000000.sdmp, Offset: 00610000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_610000_7Y18r(223).jbxd

Yara matches

Similarity

API ID: lstrcat$Filelstrcpy$CopyDirectoryExitModuleNameProcessSleepSystem
String ID: /installservice$/start$irdvxc.exe
API String ID: 3309304594-2903410889
Opcode ID: 9e98e4174df14d6d6c5fd1393a1d3f01b0d4588ab28a95b9e8e08ea1a3ca65bb
Instruction ID: d4fb51a4bd5bfec15cf88dfe57d137c72901d8fc8dd5e63f59aabe023ca2198d
Opcode Fuzzy Hash: 9e98e4174df14d6d6c5fd1393a1d3f01b0d4588ab28a95b9e8e08ea1a3ca65bb
Instruction Fuzzy Hash: 5321007290066C6DDB60E6E08C4AFCA77AD5F44701F4805D5B208B7052DEB49BC58F69

Function 00612F20 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 180stringlibraryCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00612F3A
memset.MSVCRT ref: 00612F50
memset.MSVCRT ref: 00612F63
CoCreateGuid.OLE32(?), ref: 00612F87
CoCreateGuid.OLE32(?,?), ref: 00612F90
LoadLibraryA.KERNEL32(KERNEL32.dll,?,?), ref: 00612F9A
lstrlenA.KERNEL32(KERNEL32.dll,KERNEL32.dll,?,?), ref: 00612FD5
lstrcpyA.KERNEL32(?,KERNEL32.dll,KERNEL32.dll,KERNEL32.dll,?,?), ref: 00612FEC
lstrlenA.KERNEL32(KERNEL32.dll,?,KERNEL32.dll,KERNEL32.dll,KERNEL32.dll,?,?), ref: 00612FF6
lstrcpyA.KERNEL32(?,?,KERNEL32.dll,?,KERNEL32.dll,KERNEL32.dll,KERNEL32.dll,?,?), ref: 00613059
lstrlenA.KERNEL32(?,?,?,KERNEL32.dll,?,KERNEL32.dll,KERNEL32.dll,KERNEL32.dll,?,?), ref: 0061305F

Strings

KERNEL32.dll, xrefs: 00612F95, 00612FD0, 00612FE1, 00612FF1

Memory Dump Source

Source File: 00000002.00000002.2567412345.0000000000610000.00000040.00001000.00020000.00000000.sdmp, Offset: 00610000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_610000_7Y18r(223).jbxd

Yara matches

Similarity

API ID: lstrlenmemset$CreateGuidlstrcpy$LibraryLoad
String ID: KERNEL32.dll
API String ID: 3946968259-254546324
Opcode ID: 3a4bd268f05f201a349779e6ba3abfb690326764aba9513133ec52cba3915f66
Instruction ID: 82307c767486376080c31cdddb77c6de5e7b0b03d13edee464f352aff5785190
Opcode Fuzzy Hash: 3a4bd268f05f201a349779e6ba3abfb690326764aba9513133ec52cba3915f66
Instruction Fuzzy Hash: 31710872D013289FDB61DF54CC81ADDB3BAFF54714F1900A9E809A7241EB356E868F54

Function 00616990 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 125stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0061F100: lstrlenA.KERNEL32(?,00000000,?,0000031A,00000000,?,?,\ntsvcs), ref: 0061F147
Part of subcall function 0061F100: htonl.WS2_32(00000075), ref: 0061F1E8

lstrcpyA.KERNEL32(?,c:\,?,\\*SMBSERVER\IPC$,?,?,?,\ntsvcs,?,006168F1,?,?,C:\Users\user\Desktop\7Y18r(223).exe,?,00000000,00000003), ref: 006169C7

Part of subcall function 00616C50: wsprintfA.USER32 ref: 00616C70

lstrcpyA.KERNEL32(?,d:\,?,?,00624119,?,?,c:\,?,\\*SMBSERVER\IPC$,?,?,?,\ntsvcs,?,006168F1), ref: 006169F6
lstrlenA.KERNEL32(?,?,?,00624119,?,?,c:\,?,\\*SMBSERVER\IPC$,?,?,?,\ntsvcs,?,006168F1,?), ref: 00616A25
lstrcpyA.KERNEL32(?,?,?,?,?,00624119,?,?,c:\,?,\\*SMBSERVER\IPC$,?,?,?,\ntsvcs), ref: 00616A3E
lstrlenA.KERNEL32(?,?,?,?,?,00624119,?,?,?,?,?,?,?,00624119,?,?), ref: 00616ACA
lstrcpyA.KERNEL32(?,?,?,?,?,?,?,00624119,?,?,?,?,?,?,?,00624119), ref: 00616AEA
lstrcatA.KERNEL32(?,?,?,?,?,?,?,?,?,00624119,?,?,?,?,?,?), ref: 00616AF7

Strings

\\*SMBSERVER\IPC$, xrefs: 006169A2
\ntsvcs, xrefs: 00616999
d:\, xrefs: 006169EA
c:\, xrefs: 006169BB

Memory Dump Source

Source File: 00000002.00000002.2567412345.0000000000610000.00000040.00001000.00020000.00000000.sdmp, Offset: 00610000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_610000_7Y18r(223).jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$htonllstrcatwsprintf
String ID: \\*SMBSERVER\IPC$$\ntsvcs$c:\$d:\
API String ID: 463789060-3727734714
Opcode ID: 7cef239432c30721a6fbe34bbfe595ebdef85080eb5b0f3ab97badb24d0af299
Instruction ID: c8e81e69780b56e298be0c612c136dfaba2d47df131dc35dd052ac82be3f82d6
Opcode Fuzzy Hash: 7cef239432c30721a6fbe34bbfe595ebdef85080eb5b0f3ab97badb24d0af299
Instruction Fuzzy Hash: AF41B076900118AEDF60DBA4CC45EDE7BBEEF54310F1841AAF218F2191DB309AE18F54

Function 00611990 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 72synchronizationCOMMON

Download Yara Rule

APIs

CreateMutexA.KERNEL32(00000000,00000001,jhdheruhfrthkgjhtjkghjk5trh,?,?,?,?,0061189B), ref: 006119A5
GetLastError.KERNEL32(00000000,00000001,jhdheruhfrthkgjhtjkghjk5trh,?,?,?,?,0061189B), ref: 006119AF
CloseHandle.KERNEL32(00000000,00000001,jhdheruhfrthkgjhtjkghjk5trh,?,?,?,?,0061189B), ref: 006119C2
GetModuleFileNameA.KERNEL32(?,0000012C,00000000,00000001,jhdheruhfrthkgjhtjkghjk5trh,?,?,?,?,0061189B), ref: 006119D9
GetSystemDirectoryA.KERNEL32(?,0000012C), ref: 006119EA
wsprintfA.USER32 ref: 00611A15
VirtualFree.KERNEL32(?,00000000,00008000,?,?,?,?,?,?), ref: 00611A8B
CloseHandle.KERNEL32(00000000,00000001,jhdheruhfrthkgjhtjkghjk5trh,?,?,?,?,0061189B), ref: 00611A96

Strings

jhdheruhfrthkgjhtjkghjk5trh, xrefs: 0061199C
%sirdvxc.exe, xrefs: 00611A09

Memory Dump Source

Source File: 00000002.00000002.2567412345.0000000000610000.00000040.00001000.00020000.00000000.sdmp, Offset: 00610000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_610000_7Y18r(223).jbxd

Yara matches

Similarity

API ID: CloseHandle$CreateDirectoryErrorFileFreeLastModuleMutexNameSystemVirtualwsprintf
String ID: %sirdvxc.exe$jhdheruhfrthkgjhtjkghjk5trh
API String ID: 3243624013-1590512144
Opcode ID: cfba34903941b4aa09649d69315ebe0cdd036e6d78aabc5c57fa2944792f97b6
Instruction ID: b336d2b2ad9628ed4a1ed9f3e688a69635f5ff61faa39e421e4883f2b3c69470
Opcode Fuzzy Hash: cfba34903941b4aa09649d69315ebe0cdd036e6d78aabc5c57fa2944792f97b6
Instruction Fuzzy Hash: 66219571900718AADFA1ABA0DC45FC977BEAF01700F5851D5F204A60A1EF749BD48B98

Function 0061DE30 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 72synchronizationCOMMON

Download Yara Rule

APIs

CreateMutexA.KERNEL32(00000000,00000001,jhdheruhfrthkgjhtjkghjk5trh), ref: 0061DE45
GetLastError.KERNEL32(00000000,00000001,jhdheruhfrthkgjhtjkghjk5trh), ref: 0061DE4F
CloseHandle.KERNEL32(00000000,00000001,jhdheruhfrthkgjhtjkghjk5trh), ref: 0061DE62
GetModuleFileNameA.KERNEL32(?,0000012C,00000000,00000001,jhdheruhfrthkgjhtjkghjk5trh), ref: 0061DE79
GetSystemDirectoryA.KERNEL32(?,00000104), ref: 0061DE8A
wsprintfA.USER32 ref: 0061DEB5
VirtualFree.KERNEL32(?,00000000,00008000,?,?,?,?,?,?), ref: 0061DF2B
CloseHandle.KERNEL32(00000000,00000001,jhdheruhfrthkgjhtjkghjk5trh), ref: 0061DF36

Strings

jhdheruhfrthkgjhtjkghjk5trh, xrefs: 0061DE3C
%sirdvxc.exe, xrefs: 0061DEA9

Memory Dump Source

Source File: 00000002.00000002.2567412345.0000000000610000.00000040.00001000.00020000.00000000.sdmp, Offset: 00610000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_610000_7Y18r(223).jbxd

Yara matches

Similarity

API ID: CloseHandle$CreateDirectoryErrorFileFreeLastModuleMutexNameSystemVirtualwsprintf
String ID: %sirdvxc.exe$jhdheruhfrthkgjhtjkghjk5trh
API String ID: 3243624013-1590512144
Opcode ID: 1a1696ee51b89fcf48023a2f682ca6e78b5eae6b0865214e01b1b1035ae1ba0d
Instruction ID: 007448c4e37b1d8ecdcce0f169274a1889a049f43c11260b136d118f1391c27c
Opcode Fuzzy Hash: 1a1696ee51b89fcf48023a2f682ca6e78b5eae6b0865214e01b1b1035ae1ba0d
Instruction Fuzzy Hash: 80215371800618AFDF61ABA0DC45FC9737EAB11710F5841E5F114A60A1EFB4ABD58B98

Function 00611790 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 68libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(advapi32.dll,00000000,00000000,00000000), ref: 0061179E
GetProcAddress.KERNEL32(00000000,AdjustTokenPrivileges), ref: 006117AB
GetProcAddress.KERNEL32(00000000,LookupPrivilegeValueA), ref: 006117C3
GetProcAddress.KERNEL32(00000000,OpenProcessToken), ref: 006117D7
GetCurrentProcess.KERNEL32 ref: 006117FF
CloseHandle.KERNEL32(00000000), ref: 0061183E

Strings

OpenProcessToken, xrefs: 006117D1
advapi32.dll, xrefs: 00611799
LookupPrivilegeValueA, xrefs: 006117BD
AdjustTokenPrivileges, xrefs: 006117A5

Memory Dump Source

Source File: 00000002.00000002.2567412345.0000000000610000.00000040.00001000.00020000.00000000.sdmp, Offset: 00610000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_610000_7Y18r(223).jbxd

Yara matches

Similarity

API ID: AddressProc$Handle$CloseCurrentModuleProcess
String ID: AdjustTokenPrivileges$LookupPrivilegeValueA$OpenProcessToken$advapi32.dll
API String ID: 594060487-4270423970
Opcode ID: 0afb03ef2a16bdaed24933ada99924a0644fe5ff5b3dc1ad8507ab7de8a74f2f
Instruction ID: 24e291ee94496c77a6f031a63b32d25b4d1585700b9f6916ca89d74d26a1e49f
Opcode Fuzzy Hash: 0afb03ef2a16bdaed24933ada99924a0644fe5ff5b3dc1ad8507ab7de8a74f2f
Instruction Fuzzy Hash: A711DD716006157ECBA0ABE0AC85DDF7BBFEB82B01B1C5025B501D6185EF348A81CBB0

Function 00611170 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 114COMMON

Download Yara Rule

APIs

Part of subcall function 00611720: GetModuleHandleA.KERNEL32(advapi32.dll,?,00000000,00000004), ref: 00611737

GetModuleFileNameA.KERNEL32(00000000,?,00000200,?,?,?,?,00617B08,00000000,00000000,00000000,00000000,0062BCB0,0062B4A2,0062B48A,0062B472), ref: 00611196
wsprintfA.USER32 ref: 006111B2
GetLastError.KERNEL32 ref: 0061126F
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,SeDebugPrivilege), ref: 00611304

Strings

"%s" /service, xrefs: 006111A6
Network helper Service, xrefs: 006111EE
MSDisk, xrefs: 006111F3, 0061123B
Network service for disk management requests, xrefs: 00611251
SeDebugPrivilege, xrefs: 00611274

Memory Dump Source

Source File: 00000002.00000002.2567412345.0000000000610000.00000040.00001000.00020000.00000000.sdmp, Offset: 00610000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_610000_7Y18r(223).jbxd

Yara matches

Similarity

API ID: ErrorLastModule$FileHandleNamewsprintf
String ID: "%s" /service$MSDisk$Network helper Service$Network service for disk management requests$SeDebugPrivilege
API String ID: 585799429-1939460879
Opcode ID: a471c2e01f87633557546b3249bb43334cf5921878c298bb8c059ea7bfc574d2
Instruction ID: d4276008ea2f9ec99074df1d3d1f49607ad7efe0cf663ccc1863c9d0648ca08d
Opcode Fuzzy Hash: a471c2e01f87633557546b3249bb43334cf5921878c298bb8c059ea7bfc574d2
Instruction Fuzzy Hash: C641B4B1A016286ED7319B10DC89FEF7BBEAF85B04F080094F305E6146DBB54AC58F69

Function 00611BF0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 93filestringmemoryCOMMON

Download Yara Rule

APIs

OpenFileMappingA.KERNEL32(00000004,00000000,Global\1CKPUPP), ref: 00611C05
MapViewOfFile.KERNEL32(?,00000004,00000000,00000000,00000000), ref: 00611C22
VirtualAlloc.KERNEL32(00000000,?,00001000,00000040,?,00000004,00000000,00000000,00000000), ref: 00611C49
GetModuleFileNameA.KERNEL32(00000000,?,00000258), ref: 00611C76
lstrlenA.KERNEL32(?,?,?,?,00000000,?,?,?,00000000,?,00000258), ref: 00611CDC
lstrcpyA.KERNEL32(?,?,?,00000000,00000000,?,?,?,?,00000000,?,?,?,00000000,?,00000258), ref: 00611CEE
VirtualFree.KERNEL32(?,00000000,00008000,?,?,?,?,?,?,?,00000000,00000000,?,?,?,?), ref: 00611D1C

Strings

Global\1CKPUPP, xrefs: 00611BFC

Memory Dump Source

Source File: 00000002.00000002.2567412345.0000000000610000.00000040.00001000.00020000.00000000.sdmp, Offset: 00610000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_610000_7Y18r(223).jbxd

Yara matches

Similarity

API ID: File$Virtual$AllocFreeMappingModuleNameOpenViewlstrcpylstrlen
String ID: Global\1CKPUPP
API String ID: 4097676156-1834102913
Opcode ID: df1d2e7f587319cd2c01c77e57d27424e1b96252f36356a4b782007ec9e35eb9
Instruction ID: 8015b0d1883ffcc2e4cfeb74fb841ece1009eecd989f8a85cd42102223541654
Opcode Fuzzy Hash: df1d2e7f587319cd2c01c77e57d27424e1b96252f36356a4b782007ec9e35eb9
Instruction Fuzzy Hash: AD3165B1940318AEEBA19B50CC42FE9B77AAF41B40F180099F7056B192DB78EDC19F5C

Function 00611640 Relevance: 14.0, APIs: 5, Strings: 3, Instructions: 44registrystringCOMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000200,?,?,?,?,00617B0F,00000000,00000000,00000000,00000000,0062BCB0,0062B4A2,0062B48A,0062B472), ref: 0061165B
lstrcatA.KERNEL32(?, /service,00000000,?,00000200,?,?,?,?,00617B0F,00000000,00000000,00000000,00000000,0062BCB0,0062B4A2), ref: 00611670
RegCreateKeyA.ADVAPI32(80000002,SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices,?), ref: 00611686
RegSetValueExA.ADVAPI32(?,MSDisk,00000000,00000001,?,00000104,80000002,SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices,?,?, /service,00000000,?,00000200), ref: 006116A9
RegCloseKey.ADVAPI32(?,80000002,SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices,?,?, /service,00000000,?,00000200,?,?,?,?,00617B0F,00000000,00000000), ref: 006116B9

Strings

SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices, xrefs: 0061167C
/service, xrefs: 00611664
MSDisk, xrefs: 0061169E

Memory Dump Source

Source File: 00000002.00000002.2567412345.0000000000610000.00000040.00001000.00020000.00000000.sdmp, Offset: 00610000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_610000_7Y18r(223).jbxd

Yara matches

Similarity

API ID: CloseCreateFileModuleNameValuelstrcat
String ID: /service$MSDisk$SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
API String ID: 169220164-3412843157
Opcode ID: 6a4c0f7d32ee3134323a88820e35d7ee6a5fc231a310a2549dcc32e245466b2f
Instruction ID: 1b9ab62050cdd35431604386ba55286e201b16a94c83c0824383f7ea12042543
Opcode Fuzzy Hash: 6a4c0f7d32ee3134323a88820e35d7ee6a5fc231a310a2549dcc32e245466b2f
Instruction Fuzzy Hash: 56F0FC7170032439DE30B5419C8AFEF767FD781B10F1C0155B714E2042EE7149C089A9

Function 006115E0 Relevance: 14.0, APIs: 6, Strings: 2, Instructions: 34libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,?,?,?,00617AC6,00000000,00000000,00000000,00000000,0062BCB0,0062B4A2,0062B48A,0062B472,0062B45A,0062B442,00008003), ref: 006115EA
GetProcAddress.KERNEL32(00000000,RegisterServiceProcess), ref: 006115FB
GetCurrentProcessId.KERNEL32(00000000,RegisterServiceProcess,kernel32.dll,?,?,?,00617AC6,00000000,00000000,00000000,00000000,0062BCB0,0062B4A2,0062B48A,0062B472,0062B45A), ref: 00611606
GetCurrentProcessId.KERNEL32(kernel32.dll,?,?,?,00617AC6,00000000,00000000,00000000,00000000,0062BCB0,0062B4A2,0062B48A,0062B472,0062B45A,0062B442,00008003), ref: 00611619
GetCurrentProcess.KERNEL32(kernel32.dll,?,?,?,00617AC6,00000000,00000000,00000000,00000000,0062BCB0,0062B4A2,0062B48A,0062B472,0062B45A,0062B442,00008003), ref: 00611622
TerminateProcess.KERNEL32(00000000,00000000,kernel32.dll,?,?,?,00617AC6,00000000,00000000,00000000,00000000,0062BCB0,0062B4A2,0062B48A,0062B472,0062B45A), ref: 00611629

Strings

kernel32.dll, xrefs: 006115E5
RegisterServiceProcess, xrefs: 006115F5

Memory Dump Source

Source File: 00000002.00000002.2567412345.0000000000610000.00000040.00001000.00020000.00000000.sdmp, Offset: 00610000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_610000_7Y18r(223).jbxd

Yara matches

Similarity

API ID: Process$Current$AddressHandleModuleProcTerminate
String ID: RegisterServiceProcess$kernel32.dll
API String ID: 2793901505-4020013434
Opcode ID: 2d6e6a19b6e40f960111330df72a5842e92b9adbad34aea7155aa046c23bf849
Instruction ID: 3b8cbf1a4dccdfcab42daeec041661307c59901568bc994bc0bf4e2c8a546c0d
Opcode Fuzzy Hash: 2d6e6a19b6e40f960111330df72a5842e92b9adbad34aea7155aa046c23bf849
Instruction Fuzzy Hash: 04E08061A04960388DF133B52C8ACDF842F5FD2F5071F0A1DB1319B505DC6649C184FD

Function 00611E50 Relevance: 13.6, APIs: 9, Instructions: 65fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,C0000000,00000000,00000000,00000003,00000080,00000000), ref: 00611E6D
CreateFileMappingA.KERNEL32(?,00000000,00000004,00000000,00000000,00000000), ref: 00611E83
MapViewOfFile.KERNEL32(?,000F001F,00000000,00000000,00000000,?,C0000000,00000000,00000000,00000003,00000080,00000000), ref: 00611E96
GetFileSize.KERNEL32(?,00000000,?,000F001F,00000000,00000000,00000000,?,C0000000,00000000,00000000,00000003,00000080,00000000), ref: 00611EA2
CheckSumMappedFile.IMAGEHLP(?,?,?,?,?,00000000,?,000F001F,00000000,00000000,00000000,?,C0000000,00000000,00000000,00000003), ref: 00611EC7
FlushViewOfFile.KERNEL32(?,00000000,?,?,?,?,?,00000000,?,000F001F,00000000,00000000,00000000,?,C0000000,00000000), ref: 00611ED6
UnmapViewOfFile.KERNEL32(?,?,00000000,?,?,?,?,?,00000000,?,000F001F,00000000,00000000,00000000,?,C0000000), ref: 00611EDE
CloseHandle.KERNEL32(?,?,?,00000000,?,?,?,?,?,00000000,?,000F001F,00000000,00000000,00000000,?), ref: 00611EE6
CloseHandle.KERNEL32(?,?,?,?,00000000,?,?,?,?,?,00000000,?,000F001F,00000000,00000000,00000000), ref: 00611EEE

Memory Dump Source

Source File: 00000002.00000002.2567412345.0000000000610000.00000040.00001000.00020000.00000000.sdmp, Offset: 00610000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_610000_7Y18r(223).jbxd

Yara matches

Similarity

API ID: File$View$CloseCreateHandle$CheckFlushMappedMappingSizeUnmap
String ID:
API String ID: 4174232114-0
Opcode ID: dab78f62ffa08beae657bef584c81920e287fb7673d88d64d9321e0af284a8f7
Instruction ID: ea96ec0c3235165ebc0d65ef3b0a54bd25b95aa2b3f262079cdba373aa87a823
Opcode Fuzzy Hash: dab78f62ffa08beae657bef584c81920e287fb7673d88d64d9321e0af284a8f7
Instruction Fuzzy Hash: 07113D71C00148BECF619B96CC46DDFBFBAEFC2B10F144169B510B2161DB711A50DB64

Function 00611BE6 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 83filestringmemoryCOMMON

Download Yara Rule

APIs

OpenFileMappingA.KERNEL32(00000004,00000000,Global\1CKPUPP), ref: 00611C05
MapViewOfFile.KERNEL32(?,00000004,00000000,00000000,00000000), ref: 00611C22
VirtualAlloc.KERNEL32(00000000,?,00001000,00000040,?,00000004,00000000,00000000,00000000), ref: 00611C49
GetModuleFileNameA.KERNEL32(00000000,?,00000258), ref: 00611C76
lstrlenA.KERNEL32(?,?,?,?,00000000,?,?,?,00000000,?,00000258), ref: 00611CDC
lstrcpyA.KERNEL32(?,?,?,00000000,00000000,?,?,?,?,00000000,?,?,?,00000000,?,00000258), ref: 00611CEE
VirtualFree.KERNEL32(?,00000000,00008000,?,?,?,?,?,?,?,00000000,00000000,?,?,?,?), ref: 00611D1C

Strings

Global\1CKPUPP, xrefs: 00611BFC

Memory Dump Source

Source File: 00000002.00000002.2567412345.0000000000610000.00000040.00001000.00020000.00000000.sdmp, Offset: 00610000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_610000_7Y18r(223).jbxd

Yara matches

Similarity

API ID: File$Virtual$AllocFreeMappingModuleNameOpenViewlstrcpylstrlen
String ID: Global\1CKPUPP
API String ID: 4097676156-1834102913
Opcode ID: 5e0c388b1d9200a7713932fd8c14f8ceb733336e02286fcf6fe564bee74d560e
Instruction ID: d6f721a73cb62872cbcda50ad7c4fd93094b1c37d8716b659d09fa31ec4644d1
Opcode Fuzzy Hash: 5e0c388b1d9200a7713932fd8c14f8ceb733336e02286fcf6fe564bee74d560e
Instruction Fuzzy Hash: 1C3193B1940214AFEBA16B50CC42FE9B77AEF41B40F184098F7056B292DB78AD91DF5C

Function 00612781 Relevance: 12.1, APIs: 8, Instructions: 74networkCOMMON

Download Yara Rule

APIs

gethostbyname.WS2_32(?), ref: 0061279E
socket.WS2_32(00000002,00000001,00000000), ref: 006127BA
ioctlsocket.WS2_32(?,8004667E,00000001), ref: 006127DE
htons.WS2_32(00000050), ref: 006127F1
connect.WS2_32(?,00000002,00000010), ref: 00612803
WSAGetLastError.WS2_32(?,00000002,00000010,00000050,?,8004667E,00000001,00000002,00000001,00000000,?), ref: 0061280D
select.WS2_32(00000000,00000000,00000001,00000000,00000006), ref: 0061283B
closesocket.WS2_32(?), ref: 00612850

Memory Dump Source

Source File: 00000002.00000002.2567412345.0000000000610000.00000040.00001000.00020000.00000000.sdmp, Offset: 00610000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_610000_7Y18r(223).jbxd

Yara matches

Similarity

API ID: ErrorLastclosesocketconnectgethostbynamehtonsioctlsocketselectsocket
String ID:
API String ID: 872677982-0
Opcode ID: 1d09caa3c303277e2db75f6c72a56d980a4b5edc38f1e6deb7d21359b1215a90
Instruction ID: 75d164cf1e585fc307def5bd74382af0a8cc649f3fc6761f1a716e732239cffe
Opcode Fuzzy Hash: 1d09caa3c303277e2db75f6c72a56d980a4b5edc38f1e6deb7d21359b1215a90
Instruction Fuzzy Hash: 7C219070800109EFCF60DF94CC42BEEBBBAEF44324F180219F514B72A1EB705A949B65

Function 00612790 Relevance: 12.1, APIs: 8, Instructions: 72networkCOMMON

Download Yara Rule

APIs

gethostbyname.WS2_32(?), ref: 0061279E
socket.WS2_32(00000002,00000001,00000000), ref: 006127BA
ioctlsocket.WS2_32(?,8004667E,00000001), ref: 006127DE
htons.WS2_32(00000050), ref: 006127F1
connect.WS2_32(?,00000002,00000010), ref: 00612803
WSAGetLastError.WS2_32(?,00000002,00000010,00000050,?,8004667E,00000001,00000002,00000001,00000000,?), ref: 0061280D
select.WS2_32(00000000,00000000,00000001,00000000,00000006), ref: 0061283B
closesocket.WS2_32(?), ref: 00612850

Memory Dump Source

Source File: 00000002.00000002.2567412345.0000000000610000.00000040.00001000.00020000.00000000.sdmp, Offset: 00610000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_610000_7Y18r(223).jbxd

Yara matches

Similarity

API ID: ErrorLastclosesocketconnectgethostbynamehtonsioctlsocketselectsocket
String ID:
API String ID: 872677982-0
Opcode ID: f77c5aadc0c11dd1899a947d248b6e020723fb98717527d92c8c64ea88e9946b
Instruction ID: 79548453dc3d2352df5d15ca1f00dc4fe1160168237db409dfbdcfccdda0419a
Opcode Fuzzy Hash: f77c5aadc0c11dd1899a947d248b6e020723fb98717527d92c8c64ea88e9946b
Instruction Fuzzy Hash: 94217F71900109AEDF60DFA4CC45AEEBBBAEF44320F28021AF510B72A1DB755A949B65

Function 006186F9 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 82networkstringCOMMON

Download Yara Rule

APIs

Part of subcall function 00618EC0: VirtualAlloc.KERNEL32(00000000,00003000,00001000,00000040,FFFFFFFF), ref: 00618EDC
Part of subcall function 00618EC0: socket.WS2_32(00000002,00000001,00000000), ref: 00618F1A
Part of subcall function 00618EC0: htons.WS2_32(?), ref: 00618F34
Part of subcall function 00618EC0: gethostbyname.WS2_32(?), ref: 00618F40
Part of subcall function 00618EC0: connect.WS2_32(?,?,00000010), ref: 00618F6F
Part of subcall function 00618EC0: send.WS2_32(?,?,?,00000000), ref: 00618F94
Part of subcall function 00618EC0: recv.WS2_32(?,?,00000300,00000000), ref: 00618FAF

lstrcpyA.KERNEL32(00628A84,08qWjb+kgRxkUt3PeOyKqWFvsW0cp8XUcxxq6y43hcs+PRiHSQX+slLM9J4f7-BmzTyAa0iKRhYeNP5aZDaZhBL2,01000000,?,?,?,?), ref: 0061874D

Part of subcall function 0061D4E0: htonl.WS2_32(?), ref: 0061D505
Part of subcall function 0061D4E0: htonl.WS2_32(00000000), ref: 0061D51B

send.WS2_32(?,?,?,00000000), ref: 006187C1
recv.WS2_32(?,?,00000258,00000000), ref: 006187DA

Part of subcall function 0061D540: htonl.WS2_32(?), ref: 0061D558
Part of subcall function 0061D540: htonl.WS2_32(00000000), ref: 0061D578

closesocket.WS2_32(?), ref: 00618808
VirtualFree.KERNEL32(?,00000000,00008000,?,?,00000000,?,?,00000258,00000000,?,?,?,00000000,?,000000F1), ref: 0061881A

Strings

08qWjb+kgRxkUt3PeOyKqWFvsW0cp8XUcxxq6y43hcs+PRiHSQX+slLM9J4f7-BmzTyAa0iKRhYeNP5aZDaZhBL2, xrefs: 00618743

Memory Dump Source

Source File: 00000002.00000002.2567412345.0000000000610000.00000040.00001000.00020000.00000000.sdmp, Offset: 00610000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_610000_7Y18r(223).jbxd

Yara matches

Similarity

API ID: htonl$Virtualrecvsend$AllocFreeclosesocketconnectgethostbynamehtonslstrcpysocket
String ID: 08qWjb+kgRxkUt3PeOyKqWFvsW0cp8XUcxxq6y43hcs+PRiHSQX+slLM9J4f7-BmzTyAa0iKRhYeNP5aZDaZhBL2
API String ID: 1428826756-161492147
Opcode ID: d096e0dfa0bc22ceb7199ab02391698b0952da86d8ebdb94405815137d844092
Instruction ID: 76d58328b2306fe1c504a5defb6182a249d3ef65c3bc52ed4de7c87bb1eb47ec
Opcode Fuzzy Hash: d096e0dfa0bc22ceb7199ab02391698b0952da86d8ebdb94405815137d844092
Instruction Fuzzy Hash: 1521B2719406587EEBB09A90CC86FEE776EEB04701F184199F615A70D1DFB09EC08F28

Function 00618700 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 82networkstringCOMMON

Download Yara Rule

APIs

Part of subcall function 00618EC0: VirtualAlloc.KERNEL32(00000000,00003000,00001000,00000040,FFFFFFFF), ref: 00618EDC
Part of subcall function 00618EC0: socket.WS2_32(00000002,00000001,00000000), ref: 00618F1A
Part of subcall function 00618EC0: htons.WS2_32(?), ref: 00618F34
Part of subcall function 00618EC0: gethostbyname.WS2_32(?), ref: 00618F40
Part of subcall function 00618EC0: connect.WS2_32(?,?,00000010), ref: 00618F6F
Part of subcall function 00618EC0: send.WS2_32(?,?,?,00000000), ref: 00618F94
Part of subcall function 00618EC0: recv.WS2_32(?,?,00000300,00000000), ref: 00618FAF

lstrcpyA.KERNEL32(00628A84,08qWjb+kgRxkUt3PeOyKqWFvsW0cp8XUcxxq6y43hcs+PRiHSQX+slLM9J4f7-BmzTyAa0iKRhYeNP5aZDaZhBL2,01000000,?,?,?,?), ref: 0061874D

Part of subcall function 0061D4E0: htonl.WS2_32(?), ref: 0061D505
Part of subcall function 0061D4E0: htonl.WS2_32(00000000), ref: 0061D51B

send.WS2_32(?,?,?,00000000), ref: 006187C1
recv.WS2_32(?,?,00000258,00000000), ref: 006187DA

Part of subcall function 0061D540: htonl.WS2_32(?), ref: 0061D558
Part of subcall function 0061D540: htonl.WS2_32(00000000), ref: 0061D578

closesocket.WS2_32(?), ref: 00618808
VirtualFree.KERNEL32(?,00000000,00008000,?,?,00000000,?,?,00000258,00000000,?,?,?,00000000,?,000000F1), ref: 0061881A

Strings

08qWjb+kgRxkUt3PeOyKqWFvsW0cp8XUcxxq6y43hcs+PRiHSQX+slLM9J4f7-BmzTyAa0iKRhYeNP5aZDaZhBL2, xrefs: 00618743

Memory Dump Source

Source File: 00000002.00000002.2567412345.0000000000610000.00000040.00001000.00020000.00000000.sdmp, Offset: 00610000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_610000_7Y18r(223).jbxd

Yara matches

Similarity

API ID: htonl$Virtualrecvsend$AllocFreeclosesocketconnectgethostbynamehtonslstrcpysocket
String ID: 08qWjb+kgRxkUt3PeOyKqWFvsW0cp8XUcxxq6y43hcs+PRiHSQX+slLM9J4f7-BmzTyAa0iKRhYeNP5aZDaZhBL2
API String ID: 1428826756-161492147
Opcode ID: 46ba21abdfca267ae6659056dfda814f6b657acce87f8d537c6a1beb045ce6b9
Instruction ID: abe3353a243d15b5f7eb8b09769cbe7aa5411e39434e550523563889375a71db
Opcode Fuzzy Hash: 46ba21abdfca267ae6659056dfda814f6b657acce87f8d537c6a1beb045ce6b9
Instruction Fuzzy Hash: 292192719406587EEBB096908C86FEE776EEB04711F184299F625A70D1DFB09EC48E28

Function 0061D9D0 Relevance: 10.6, APIs: 7, Instructions: 69registrystringCOMMON

Download Yara Rule

APIs

Part of subcall function 0061DDD6: GetModuleFileNameA.KERNEL32(0000012C,00000000,0000012C,?,?,?,0061D9E1), ref: 0061DDFC

wsprintfA.USER32 ref: 0061DA0D
RegCreateKeyExA.ADVAPI32(?,?,00000000,00000000,00000000,00000000,00000000,?,?), ref: 0061DA30
RegCloseKey.ADVAPI32(?,?,?,00000000,00000000,00000000,00000000,00000000,?,?), ref: 0061DA38
RegOpenKeyA.ADVAPI32(?,?,?), ref: 0061DA4A
lstrlenA.KERNEL32(?,?,?,?,?,?,?,00000000,00000000,00000000,00000000,00000000,?,?), ref: 0061DA55
RegSetValueExA.ADVAPI32(?,?,00000000,00000001,?,00000000,?,?,?,?,?,?,?,00000000,00000000,00000000), ref: 0061DA69
RegCloseKey.ADVAPI32(?,?,?,00000000,00000001,?,00000000,?,?,?,?,?,?,?,00000000,00000000), ref: 0061DA71

Memory Dump Source

Source File: 00000002.00000002.2567412345.0000000000610000.00000040.00001000.00020000.00000000.sdmp, Offset: 00610000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_610000_7Y18r(223).jbxd

Yara matches

Similarity

API ID: Close$CreateFileModuleNameOpenValuelstrlenwsprintf
String ID:
API String ID: 722868360-0
Opcode ID: 3a958351af88ec1710b8b6f99160355e9ebbd8b95689e422a78a378f24a06134
Instruction ID: 983b275d101b848ede454e80188c84ccff468c84c7918bb4118616b052158f1b
Opcode Fuzzy Hash: 3a958351af88ec1710b8b6f99160355e9ebbd8b95689e422a78a378f24a06134
Instruction Fuzzy Hash: 07118CB2400109BFDB60EB90CC81EEBB7BEEF45710F244559A90163111EB31AE80DBA4

Function 00617DA0 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 46processCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00617DAE

Part of subcall function 0061D700: CoTaskMemAlloc.OLE32(?), ref: 0061D715

CoRegisterClassObject.OLE32(0062B8EA,00000004,00000001,0062BCAC,00629FB8,?,?,?,?,00617B8C,-embedding,0062BBE0), ref: 00617DD6
GetModuleFileNameA.KERNEL32(00000000,?,0000012C,0062B8EA,00000004,00000001,0062BCAC,00629FB8,?,?,?,?,00617B8C,-embedding,0062BBE0), ref: 00617DE9
CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00000044,0062BBE0), ref: 00617E19
ExitProcess.KERNEL32(00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00000044,0062BBE0), ref: 00617E20

Strings

D, xrefs: 00617DFA

Memory Dump Source

Source File: 00000002.00000002.2567412345.0000000000610000.00000040.00001000.00020000.00000000.sdmp, Offset: 00610000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_610000_7Y18r(223).jbxd

Yara matches

Similarity

API ID: Process$AllocClassCreateExitFileInitializeModuleNameObjectRegisterTask
String ID: D
API String ID: 630855772-2746444292
Opcode ID: e293f08d1ede4510b8541daac894d90c630daea2f781a1ebf983076cc6f58ec2
Instruction ID: 5f8ef784efd895dcb6b868776b1181c42d22fbd4d1d3407d779f56e5754fdbbe
Opcode Fuzzy Hash: e293f08d1ede4510b8541daac894d90c630daea2f781a1ebf983076cc6f58ec2
Instruction Fuzzy Hash: E30162716442187EDBA1AAE0CC42FEB77AFEB44B00F044019B705A60C1DEB456444AA9

Function 00620400 Relevance: 9.0, APIs: 1, Strings: 5, Instructions: 36COMMON

Download Yara Rule

APIs

IsBadReadPtr.KERNEL32(?,0000031A,?,?,\ntsvcs,?,0061620E,?,?,\\*SMBSERVER\IPC$,?,Administrator,password,00000000,?,00000000), ref: 0062040F

Part of subcall function 00620460: htonl.WS2_32(00000004), ref: 006204D7

Strings

\ntsvcs, xrefs: 00620403
EPIP, xrefs: 0062042A
SSES, xrefs: 0062043A
RAHS, xrefs: 0062044A
ELIF, xrefs: 0062041A

Memory Dump Source

Source File: 00000002.00000002.2567412345.0000000000610000.00000040.00001000.00020000.00000000.sdmp, Offset: 00610000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_610000_7Y18r(223).jbxd

Yara matches

Similarity

API ID: Readhtonl
String ID: ELIF$EPIP$RAHS$SSES$\ntsvcs
API String ID: 770454940-4068246509
Opcode ID: 565ccfb9671571d893a5961c1c09603e90acbf6da4ab637a9490e4c3ef8f7444
Instruction ID: 400f4f288046ad98fa31fbb4587cfc608e4e1d2ab261800da023e147ea6e7496
Opcode Fuzzy Hash: 565ccfb9671571d893a5961c1c09603e90acbf6da4ab637a9490e4c3ef8f7444
Instruction Fuzzy Hash: A3F0A025501D79E57CE436107C818EE5ACB6D32775B30C01EF30332A03691419914EBF

Function 00611DA0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 49COMMON

Download Yara Rule

APIs

GetSystemDirectoryA.KERNEL32(?,0000012C), ref: 00611DC2
CoCreateGuid.OLE32(?,?,0000012C,?,?,?), ref: 00611DE1
wsprintfA.USER32 ref: 00611E38

Strings

qwertshertshjklzxcvbnjklbnjklzxcvbnmzxcvbnm, xrefs: 00611DEB
%s%s.dll, xrefs: 00611E30

Memory Dump Source

Source File: 00000002.00000002.2567412345.0000000000610000.00000040.00001000.00020000.00000000.sdmp, Offset: 00610000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_610000_7Y18r(223).jbxd

Yara matches

Similarity

API ID: CreateDirectoryGuidSystemwsprintf
String ID: %s%s.dll$qwertshertshjklzxcvbnjklbnjklzxcvbnmzxcvbnm
API String ID: 3533429245-3826233531
Opcode ID: 7be9c243c7409887d9139b24872027de6d7a8be4dc8a2b0f6e9eeaa943aac579
Instruction ID: 37664c85be1b7c7914cd8981a92c483cf04c9a5984a5369e2db2168789063ed6
Opcode Fuzzy Hash: 7be9c243c7409887d9139b24872027de6d7a8be4dc8a2b0f6e9eeaa943aac579
Instruction Fuzzy Hash: 4711C4319005299FDB24DB54DC88FDAB7BAEF46300F4441F9E508A7151EBB45AC58F84

Function 0061DCD0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 39stringCOMMON

Download Yara Rule

APIs

lstrcpyA.KERNEL32(?,?), ref: 0061DCE9
PathFindFileNameA.SHLWAPI(?,?,?), ref: 0061DCF5
lstrcmpiA.KERNEL32(00000000,taskmrg.exe), ref: 0061DD06

Strings

taskmrg.exe, xrefs: 0061DCFC, 0061DD04, 0061DD16

Memory Dump Source

Source File: 00000002.00000002.2567412345.0000000000610000.00000040.00001000.00020000.00000000.sdmp, Offset: 00610000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_610000_7Y18r(223).jbxd

Yara matches

Similarity

API ID: FileFindNamePathlstrcmpilstrcpy
String ID: taskmrg.exe
API String ID: 1786267875-211820915
Opcode ID: 732c5c441840189fe30f2b081e20ce6ef57f63c50681469b52a9c131abe42c9a
Instruction ID: 6c718f9529307f8dcfe38c7ab9b60f46234d209ec202be2389caf6b23113cdab
Opcode Fuzzy Hash: 732c5c441840189fe30f2b081e20ce6ef57f63c50681469b52a9c131abe42c9a
Instruction Fuzzy Hash: ADF0E2339001156ACB60A6A5AC85ECBB3AEFBA5364F180126F616E3101EA74D9D2C7A4

Function 006116D0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 28registryCOMMON

Download Yara Rule

APIs

RegOpenKeyA.ADVAPI32(80000002,SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices,?), ref: 006116E9
RegDeleteValueA.ADVAPI32(?,MSDisk), ref: 006116FA
RegCloseKey.ADVAPI32(?,?,MSDisk), ref: 00611707

Strings

SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices, xrefs: 006116DF
MSDisk, xrefs: 006116F2

Memory Dump Source

Source File: 00000002.00000002.2567412345.0000000000610000.00000040.00001000.00020000.00000000.sdmp, Offset: 00610000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_610000_7Y18r(223).jbxd

Yara matches

Similarity

API ID: CloseDeleteOpenValue
String ID: MSDisk$SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
API String ID: 849931509-454317057
Opcode ID: 8a5c38b23040dae5d034cd5e5910ec87eb96642c89b227f02403664a6b723905
Instruction ID: 2172cd1a73db03921fca8def3a27369a2c41eb445a00a83c5af4d20f78bc9434
Opcode Fuzzy Hash: 8a5c38b23040dae5d034cd5e5910ec87eb96642c89b227f02403664a6b723905
Instruction Fuzzy Hash: DFE026222006647ECD31B585AC83CCFBB9FEBC2321B380125F501E1292ED114E809119

Function 006125A0 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 66stringCOMMON

Download Yara Rule

APIs

lstrcpyA.KERNEL32(?,?,?,0000012C,00000000,?,00000064,00000000), ref: 006125E3
lstrlenA.KERNEL32(?,?,?,?,?,0000012C,00000000,?,00000064,00000000), ref: 00612642
wsprintfA.USER32 ref: 00612671

Strings

%s%s.exe, xrefs: 00612669
qwertshertshjklzxcvbnjklbnjklzxcvbnmzxcvbnm, xrefs: 00612604

Memory Dump Source

Source File: 00000002.00000002.2567412345.0000000000610000.00000040.00001000.00020000.00000000.sdmp, Offset: 00610000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_610000_7Y18r(223).jbxd

Yara matches

Similarity

API ID: lstrcpylstrlenwsprintf
String ID: %s%s.exe$qwertshertshjklzxcvbnjklbnjklzxcvbnmzxcvbnm
API String ID: 2027951250-2265713164
Opcode ID: dab884587c0985e9769606286174be126aa1e81b66859c0f2dbdd6f4e3f6bc40
Instruction ID: 41ceb3a9569ed03b51cc8d20a5dfc3e82d0e4ced2541dea7e1c57571f6c1fead
Opcode Fuzzy Hash: dab884587c0985e9769606286174be126aa1e81b66859c0f2dbdd6f4e3f6bc40
Instruction Fuzzy Hash: F421D53190066E9FDFA0DA54CC89FDAB7BAEB45304F0441E5A108B7191DBB0ABD98F94

Function 00618671 Relevance: 7.6, APIs: 5, Instructions: 53filememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 00618694
GetFileSize.KERNEL32(?,00000000,?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 006186A6
VirtualAlloc.KERNEL32(00000000,?,00001000,00000040,?,00000000,?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 006186BA
ReadFile.KERNEL32(?,00000000,?,?,00000000,00000000,?,00001000,00000040,?,00000000,?,80000000,00000001,00000000,00000003), ref: 006186D8
CloseHandle.KERNEL32(?,?,00000000,?,?,00000000,00000000,?,00001000,00000040,?,00000000,?,80000000,00000001,00000000), ref: 006186E0

Memory Dump Source

Source File: 00000002.00000002.2567412345.0000000000610000.00000040.00001000.00020000.00000000.sdmp, Offset: 00610000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_610000_7Y18r(223).jbxd

Yara matches

Similarity

API ID: File$AllocCloseCreateHandleReadSizeVirtual
String ID:
API String ID: 2717999310-0
Opcode ID: b4a5b2c79ebfd71cf3f6719df22bd91c8f7f2e9a11d82265150009e984952cd5
Instruction ID: 98669cac43a4dedd1b2b14ee9c7a6f0337ac47f0d947b9728eb4abbefa42692d
Opcode Fuzzy Hash: b4a5b2c79ebfd71cf3f6719df22bd91c8f7f2e9a11d82265150009e984952cd5
Instruction Fuzzy Hash: 2001B530640204BFDB615FA4CC42FCE7A66EB41720F280224B620BB2E0DF719A90D69C

Function 00611B60 Relevance: 7.6, APIs: 5, Instructions: 52filememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 00611B83
GetFileSize.KERNEL32(?,00000000,?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 00611B95
VirtualAlloc.KERNEL32(00000000,?,00001000,00000040,?,00000000,?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 00611BA9
ReadFile.KERNEL32(?,00000000,?,?,00000000,00000000,?,00001000,00000040,?,00000000,?,80000000,00000001,00000000,00000003), ref: 00611BC7
CloseHandle.KERNEL32(?,?,00000000,?,?,00000000,00000000,?,00001000,00000040,?,00000000,?,80000000,00000001,00000000), ref: 00611BCF

Memory Dump Source

Source File: 00000002.00000002.2567412345.0000000000610000.00000040.00001000.00020000.00000000.sdmp, Offset: 00610000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_610000_7Y18r(223).jbxd

Yara matches

Similarity

API ID: File$AllocCloseCreateHandleReadSizeVirtual
String ID:
API String ID: 2717999310-0
Opcode ID: 833b68484ed8781310dd08fd1930ec1d11228123d048afd06d8947e8d1f7a0fa
Instruction ID: 046a96c2ddf64c0d53a733cd832880fc0502db60e1dde31e59a8617885f9d616
Opcode Fuzzy Hash: 833b68484ed8781310dd08fd1930ec1d11228123d048afd06d8947e8d1f7a0fa
Instruction Fuzzy Hash: 68018871640208BBDF615BA5CC42FCD7A76EB45764F280264F620BA2E0DA715A50D658

Function 0061DFE5 Relevance: 7.6, APIs: 5, Instructions: 52filememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 0061E008
GetFileSize.KERNEL32(?,00000000,?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 0061E01A
VirtualAlloc.KERNEL32(00000000,?,00001000,00000040,?,00000000,?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 0061E02E
ReadFile.KERNEL32(?,00000000,?,?,00000000,00000000,?,00001000,00000040,?,00000000,?,80000000,00000001,00000000,00000003), ref: 0061E04C
CloseHandle.KERNEL32(?,?,00000000,?,?,00000000,00000000,?,00001000,00000040,?,00000000,?,80000000,00000001,00000000), ref: 0061E054

Memory Dump Source

Source File: 00000002.00000002.2567412345.0000000000610000.00000040.00001000.00020000.00000000.sdmp, Offset: 00610000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_610000_7Y18r(223).jbxd

Yara matches

Similarity

API ID: File$AllocCloseCreateHandleReadSizeVirtual
String ID:
API String ID: 2717999310-0
Opcode ID: 833b68484ed8781310dd08fd1930ec1d11228123d048afd06d8947e8d1f7a0fa
Instruction ID: 4cefe26541105f04dd4045076edf5c1aa48b9ddd729b48663b9909f92110d2ab
Opcode Fuzzy Hash: 833b68484ed8781310dd08fd1930ec1d11228123d048afd06d8947e8d1f7a0fa
Instruction Fuzzy Hash: 5401D830640204FBDF215BA4CC42FCD7A76EB45B20F284224F620BA2E0DAB29A90D658

Function 00620840 Relevance: 7.6, APIs: 5, Instructions: 51filememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000,?,FFFFFFFF,?), ref: 00620863
GetFileSize.KERNEL32(?,00000000,?,80000000,00000001,00000000,00000003,00000080,00000000,?,FFFFFFFF,?), ref: 00620875
VirtualAlloc.KERNEL32(00000000,-000003E8,00003000,00000004,?,00000000,?,80000000,00000001,00000000,00000003,00000080,00000000,?,FFFFFFFF,?), ref: 0062088C
ReadFile.KERNEL32(?,00000000,?,?,00000000,00000000,-000003E8,00003000,00000004,?,00000000,?,80000000,00000001,00000000,00000003), ref: 006208A6
CloseHandle.KERNEL32(?,00000000,-000003E8,00003000,00000004,?,00000000,?,80000000,00000001,00000000,00000003,00000080,00000000,?,FFFFFFFF), ref: 006208B7

Memory Dump Source

Source File: 00000002.00000002.2567412345.0000000000610000.00000040.00001000.00020000.00000000.sdmp, Offset: 00610000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_610000_7Y18r(223).jbxd

Yara matches

Similarity

API ID: File$AllocCloseCreateHandleReadSizeVirtual
String ID:
API String ID: 2717999310-0
Opcode ID: aa6965ff42ce8b682f28ff37f476de479aa448bf2c2d938119473f21eacdd63e
Instruction ID: 03e965326abbc89ba67172cc1025f15610b7c0a959a67076df251299c4a62603
Opcode Fuzzy Hash: aa6965ff42ce8b682f28ff37f476de479aa448bf2c2d938119473f21eacdd63e
Instruction Fuzzy Hash: B3018471640304BFEF615BA4CC43FCE7A66EB41B24F240228F620BA2E1DA715A51D658

Function 00617F40 Relevance: 7.5, APIs: 5, Instructions: 43filememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 00617F5B
GetFileSize.KERNEL32(?,00000000,?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 00617F6D
CoTaskMemAlloc.OLE32(00000000,?,00000000,?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 00617F75
ReadFile.KERNEL32(?,00000000,00000000,?,00000000,00000000,?,00000000,?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 00617F91
CloseHandle.KERNEL32(?,?,00000000,00000000,?,00000000,00000000,?,00000000,?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 00617F99

Memory Dump Source

Source File: 00000002.00000002.2567412345.0000000000610000.00000040.00001000.00020000.00000000.sdmp, Offset: 00610000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_610000_7Y18r(223).jbxd

Yara matches

Similarity

API ID: File$AllocCloseCreateHandleReadSizeTask
String ID:
API String ID: 1558414354-0
Opcode ID: 0abf5d08377ef93596ff0174a87a08320c9b07d8cca742332d91f49d30dd1658
Instruction ID: 56b19971cc1dc7a981b5329d9b1425daaddb921b3660f0fdadc453c61466c013
Opcode Fuzzy Hash: 0abf5d08377ef93596ff0174a87a08320c9b07d8cca742332d91f49d30dd1658
Instruction Fuzzy Hash: 98F06830250205FFDB61AB70CC43FDF7666AB41764F284228B520BB2E1DE71DE51D658

Function 00618160 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 36processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,?,?), ref: 00618190
CloseHandle.KERNEL32(?,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,?,?), ref: 0061819A
CloseHandle.KERNEL32(?,?,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,?,?), ref: 006181A2

Strings

D, xrefs: 00618175

Memory Dump Source

Source File: 00000002.00000002.2567412345.0000000000610000.00000040.00001000.00020000.00000000.sdmp, Offset: 00610000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_610000_7Y18r(223).jbxd

Yara matches

Similarity

API ID: CloseHandle$CreateProcess
String ID: D
API String ID: 2922976086-2746444292
Opcode ID: c6533bcba2dae8f130cc2cd31c7b12e8d641a8d8cffe2b33c3926953872a7f4d
Instruction ID: 80c9b6cd2ba1780e2e86177ae95b6475f12744944390b8a4f3e206a2926860b0
Opcode Fuzzy Hash: c6533bcba2dae8f130cc2cd31c7b12e8d641a8d8cffe2b33c3926953872a7f4d
Instruction Fuzzy Hash: CFF030B750010C6EDB51EAE4CC41DEFBBBFFB81350F188135AA05A6154DE359A149698

Function 00611B10 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 30processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,?,?,?), ref: 00611B3E
CloseHandle.KERNEL32(?,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,?,?,?), ref: 00611B46
CloseHandle.KERNEL32(?,?,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,?,?,?), ref: 00611B4E

Strings

D, xrefs: 00611B23

Memory Dump Source

Source File: 00000002.00000002.2567412345.0000000000610000.00000040.00001000.00020000.00000000.sdmp, Offset: 00610000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_610000_7Y18r(223).jbxd

Yara matches

Similarity

API ID: CloseHandle$CreateProcess
String ID: D
API String ID: 2922976086-2746444292
Opcode ID: 3d28765c5981823cbb77300238f7934fc2abcb81104780dbdb0b902f99a0ed61
Instruction ID: 7b74259d2418bf8398fea202ab812ad189f24385b2df11be3d391e85d04ce67c
Opcode Fuzzy Hash: 3d28765c5981823cbb77300238f7934fc2abcb81104780dbdb0b902f99a0ed61
Instruction Fuzzy Hash: 5AE092B680010C6ECF42EBD4CC019EF77BABB81300F088229AA02A6154DE399B549698

Function 0061DF9D Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 30processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,?,?,?), ref: 0061DFCB
CloseHandle.KERNEL32(?,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,?,?,?), ref: 0061DFD3
CloseHandle.KERNEL32(?,?,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,?,?,?), ref: 0061DFDB

Strings

D, xrefs: 0061DFB0

Memory Dump Source

Source File: 00000002.00000002.2567412345.0000000000610000.00000040.00001000.00020000.00000000.sdmp, Offset: 00610000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_610000_7Y18r(223).jbxd

Yara matches

Similarity

API ID: CloseHandle$CreateProcess
String ID: D
API String ID: 2922976086-2746444292
Opcode ID: 3d28765c5981823cbb77300238f7934fc2abcb81104780dbdb0b902f99a0ed61
Instruction ID: 7b74259d2418bf8398fea202ab812ad189f24385b2df11be3d391e85d04ce67c
Opcode Fuzzy Hash: 3d28765c5981823cbb77300238f7934fc2abcb81104780dbdb0b902f99a0ed61
Instruction Fuzzy Hash: 5AE092B680010C6ECF42EBD4CC019EF77BABB81300F088229AA02A6154DE399B549698

Function 00616C50 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 61COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00616C70

Part of subcall function 0061F250: lstrlenA.KERNEL32(?,00000000,?,0000031A,00000000,?,?,\ntsvcs), ref: 0061F297
Part of subcall function 0061F250: htonl.WS2_32(000000A2), ref: 0061F340

Part of subcall function 0061F3B0: htonl.WS2_32(00000010), ref: 0061F4D9

Strings

\ntsvcs, xrefs: 00616C59
\srvsvc, xrefs: 00616C78
\\%s, xrefs: 00616C64

Memory Dump Source

Source File: 00000002.00000002.2567412345.0000000000610000.00000040.00001000.00020000.00000000.sdmp, Offset: 00610000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_610000_7Y18r(223).jbxd

Yara matches

Similarity

API ID: htonl$lstrlenwsprintf
String ID: \\%s$\ntsvcs$\srvsvc
API String ID: 3077497419-2563309316
Opcode ID: 634cc2d1d4dc93eec8c7c45c272589bb16c3b42f8be25a460926d27aaf1eb744
Instruction ID: d3b1b6b2c9ad3499f1964fb292db78883a2a503314eac1f3d466551e2a1b7e0f
Opcode Fuzzy Hash: 634cc2d1d4dc93eec8c7c45c272589bb16c3b42f8be25a460926d27aaf1eb744
Instruction Fuzzy Hash: DC11307290012CAACF21AB94DD42EDEB77AAF05324F1842A5F618B11A1D7719FD4DF90

Function 00616380 Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 49memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,00000258,?,?,\ntsvcs), ref: 00616393
wsprintfA.USER32 ref: 006163B1

Part of subcall function 0061FDA0: MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,?,?,-00000004), ref: 0061FDB9
Part of subcall function 0061FDA0: MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,00000000,00000000,00000000,?,000000FF,00000000,00000000,?,?,-00000004), ref: 0061FDDF

Strings

\\%s, xrefs: 006163A5
\ntsvcs, xrefs: 00616389

Memory Dump Source

Source File: 00000002.00000002.2567412345.0000000000610000.00000040.00001000.00020000.00000000.sdmp, Offset: 00610000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_610000_7Y18r(223).jbxd

Yara matches

Similarity

API ID: ByteCharMultiWide$AllocLocalwsprintf
String ID: \\%s$\ntsvcs
API String ID: 3118936483-1502965181
Opcode ID: fa594fd6c773f3e7ae7d5ac9a285a3b2e62e8beb294e9c9f53acdd317be991a1
Instruction ID: b45e831cb93d50c26e460c28caae9c127074087027e5b1cf6a8178b1c5852c78
Opcode Fuzzy Hash: fa594fd6c773f3e7ae7d5ac9a285a3b2e62e8beb294e9c9f53acdd317be991a1
Instruction Fuzzy Hash: 1E01B5F3E0120A9FEB408F58CC01A89BBA6EFE1720F3A0224E519973C1FB749610CB50

Function 006110C0 Relevance: 6.0, APIs: 4, Instructions: 38stringCOMMON

Download Yara Rule

APIs

GetCommandLineW.KERNEL32(?,?,?,?,00617A8B,0062BCB0,0062B4A2,0062B48A,0062B472,0062B45A,0062B442,00008003), ref: 006110CC
CommandLineToArgvW.SHELL32(00000000,0062BD78,?,?,?,?,00617A8B,0062BCB0,0062B4A2,0062B48A,0062B472,0062B45A,0062B442,00008003), ref: 006110D9
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,?,00000258,00000000,00000000,00000000,0062BD78,?,?,?,?,00617A8B,0062BCB0), ref: 00611106
lstrcpyA.KERNEL32(00000000,?,00000000,00000000,00000000,000000FF,?,00000258,00000000,00000000,00000000,0062BD78), ref: 00611114

Memory Dump Source

Source File: 00000002.00000002.2567412345.0000000000610000.00000040.00001000.00020000.00000000.sdmp, Offset: 00610000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_610000_7Y18r(223).jbxd

Yara matches

Similarity

API ID: CommandLine$ArgvByteCharMultiWidelstrcpy
String ID:
API String ID: 1316659709-0
Opcode ID: f7fb5eddd49d608e19670c134353757fe1b9f9e87bb3cf15ebe57ce599952a1c
Instruction ID: 247e9b47237d3efc6bebfd02fc5652d1553c4f56bf1babde0d959fefe62284ca
Opcode Fuzzy Hash: f7fb5eddd49d608e19670c134353757fe1b9f9e87bb3cf15ebe57ce599952a1c
Instruction Fuzzy Hash: C2F05931640A20BEE6B066A18C83FE673AADF40B11F180725BA00AA1D1EEF06C814A5C

Function 00612540 Relevance: 6.0, APIs: 4, Instructions: 35fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000003,00000000,00000004,00000080,00000000,-00000001,?), ref: 0061255E
SetFilePointer.KERNEL32(?,00000000,00000000,00000000,?,40000000,00000003,00000000,00000004,00000080,00000000,-00000001,?), ref: 00612574
WriteFile.KERNEL32(?,?,?,?,00000000,?,00000000,00000000,00000000,?,40000000,00000003,00000000,00000004,00000080,00000000), ref: 00612585
CloseHandle.KERNEL32(?,?,?,?,?,00000000,?,00000000,00000000,00000000,?,40000000,00000003,00000000,00000004,00000080), ref: 0061258D

Memory Dump Source

Source File: 00000002.00000002.2567412345.0000000000610000.00000040.00001000.00020000.00000000.sdmp, Offset: 00610000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_610000_7Y18r(223).jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandlePointerWrite
String ID:
API String ID: 3604237281-0
Opcode ID: 07d8b7123e876c7d53b202f14eeb438d6be907954ed4a5a641798fdfbd545a5f
Instruction ID: 887ed196aad256c40b3325a39b628d2aac86072487cc0343950d714da8975b0b
Opcode Fuzzy Hash: 07d8b7123e876c7d53b202f14eeb438d6be907954ed4a5a641798fdfbd545a5f
Instruction Fuzzy Hash: 89F01C71680208BAEF716A949C43FCE7A26AB01B64F284215B724790E09AB16A60A65C

Function 00618617 Relevance: 6.0, APIs: 4, Instructions: 35fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000003,00000000,00000004,00000080,00000000), ref: 00618635
SetFilePointer.KERNEL32(?,?,00000000,00000000,?,40000000,00000003,00000000,00000004,00000080,00000000), ref: 0061864C
WriteFile.KERNEL32(?,?,?,?,00000000,?,?,00000000,00000000,?,40000000,00000003,00000000,00000004,00000080,00000000), ref: 0061865D
CloseHandle.KERNEL32(?,?,?,?,?,00000000,?,?,00000000,00000000,?,40000000,00000003,00000000,00000004,00000080), ref: 00618665

Memory Dump Source

Source File: 00000002.00000002.2567412345.0000000000610000.00000040.00001000.00020000.00000000.sdmp, Offset: 00610000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_610000_7Y18r(223).jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandlePointerWrite
String ID:
API String ID: 3604237281-0
Opcode ID: 423b9b83735415f1c02b61d3225fbe924228d6f3cf9d3ede445870fb42b72eda
Instruction ID: ad3368c5e725cfc38996d37e8b8a3d8e995e9ae45b2e0b611cb7c61baa9bcfd1
Opcode Fuzzy Hash: 423b9b83735415f1c02b61d3225fbe924228d6f3cf9d3ede445870fb42b72eda
Instruction Fuzzy Hash: D0F01231640208BEEF715E94DD03FCE7A26EF01B64F284215F724790E19BB15E60A65D

Function 00611AB0 Relevance: 6.0, APIs: 4, Instructions: 35fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000003,00000000,00000004,00000080,00000000,?,?,?), ref: 00611ACE
SetFilePointer.KERNEL32(?,00000000,00000000,00000000,?,40000000,00000003,00000000,00000004,00000080,00000000,?,?,?), ref: 00611AE4
WriteFile.KERNEL32(?,?,?,?,00000000,?,00000000,00000000,00000000,?,40000000,00000003,00000000,00000004,00000080,00000000), ref: 00611AF5
CloseHandle.KERNEL32(?,?,?,?,?,00000000,?,00000000,00000000,00000000,?,40000000,00000003,00000000,00000004,00000080), ref: 00611AFD

Memory Dump Source

Source File: 00000002.00000002.2567412345.0000000000610000.00000040.00001000.00020000.00000000.sdmp, Offset: 00610000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_610000_7Y18r(223).jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandlePointerWrite
String ID:
API String ID: 3604237281-0
Opcode ID: 07d8b7123e876c7d53b202f14eeb438d6be907954ed4a5a641798fdfbd545a5f
Instruction ID: ce2d77dba326693736bbc58c202f29338e78a049dd66e0796db5b00e0205d955
Opcode Fuzzy Hash: 07d8b7123e876c7d53b202f14eeb438d6be907954ed4a5a641798fdfbd545a5f
Instruction Fuzzy Hash: 17F03071680208BAEF716A94DD03FCE7A26EF01B74F384215F724790E09BB16F60A65C

Function 0061DF44 Relevance: 6.0, APIs: 4, Instructions: 35fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000003,00000000,00000004,00000080,00000000,?,?,?), ref: 0061DF62
SetFilePointer.KERNEL32(?,00000000,00000000,00000000,?,40000000,00000003,00000000,00000004,00000080,00000000,?,?,?), ref: 0061DF78
WriteFile.KERNEL32(?,?,?,?,00000000,?,00000000,00000000,00000000,?,40000000,00000003,00000000,00000004,00000080,00000000), ref: 0061DF89
CloseHandle.KERNEL32(?,?,?,?,?,00000000,?,00000000,00000000,00000000,?,40000000,00000003,00000000,00000004,00000080), ref: 0061DF91

Memory Dump Source

Source File: 00000002.00000002.2567412345.0000000000610000.00000040.00001000.00020000.00000000.sdmp, Offset: 00610000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_610000_7Y18r(223).jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandlePointerWrite
String ID:
API String ID: 3604237281-0
Opcode ID: 07d8b7123e876c7d53b202f14eeb438d6be907954ed4a5a641798fdfbd545a5f
Instruction ID: ce08c6228106f6281b23a0de128f45e7d66b462efb687ccc5599b783b100ea49
Opcode Fuzzy Hash: 07d8b7123e876c7d53b202f14eeb438d6be907954ed4a5a641798fdfbd545a5f
Instruction Fuzzy Hash: 3EF01C31680208BEEF716A949D03FCE7A66AB01B64F284215B724790E09AB16B60A65C

Function 00611720 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(advapi32.dll,?,00000000,00000004), ref: 00611737
GetProcAddress.KERNEL32(00000000,00000000), ref: 00611758

Strings

advapi32.dll, xrefs: 00611732

Memory Dump Source

Source File: 00000002.00000002.2567412345.0000000000610000.00000040.00001000.00020000.00000000.sdmp, Offset: 00610000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_610000_7Y18r(223).jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProc
String ID: advapi32.dll
API String ID: 1646373207-4050573280
Opcode ID: 2dd36e319a9f3ce1ab8a5fdda9818a8360ce71ebbdc515d2e4da729d44b7b15e
Instruction ID: 556fb3f0056249d9f9bc5a877339e325545d1f56dec8906331f86f4749fe8cb5
Opcode Fuzzy Hash: 2dd36e319a9f3ce1ab8a5fdda9818a8360ce71ebbdc515d2e4da729d44b7b15e
Instruction Fuzzy Hash: 67F0F631900144DFDB208B90EC406C977F7E701324F181125D615AA391EB755BC2DF40

Function 00617EF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 25sleepfileCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000001F4,?,?,?,?,00617B22,00000000,00000000,00000000,00000000,0062BCB0,0062B4A2,0062B48A,0062B472,0062B45A,0062B442), ref: 00617F03

Part of subcall function 00611000: lstrlenA.KERNEL32(?,?,?,?,?,00617B82,-embedding,0062BBE0), ref: 00611011

DeleteFileA.KERNEL32(?,patch:,?,000001F4,?,?,?,?,00617B22,00000000,00000000,00000000,00000000,0062BCB0,0062B4A2,0062B48A), ref: 00617F25

Strings

patch:, xrefs: 00617F0F

Memory Dump Source

Source File: 00000002.00000002.2567412345.0000000000610000.00000040.00001000.00020000.00000000.sdmp, Offset: 00610000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_610000_7Y18r(223).jbxd

Yara matches

Similarity

API ID: DeleteFileSleeplstrlen
String ID: patch:
API String ID: 2750215711-3679881264
Opcode ID: c3af21a21be8a48f291b672681344d300d317d796f2d5b485f514091bdcb4a61
Instruction ID: 6ccb4ba50e2749709f68cc1327f6dbf359c04722160a3a6e68abc2ed4879e14b
Opcode Fuzzy Hash: c3af21a21be8a48f291b672681344d300d317d796f2d5b485f514091bdcb4a61
Instruction Fuzzy Hash: C2E0EB3260A2282EC9B0B5F84CC6CCFF35DF701394F040279FA08C2080EE30D9C000A0

Function 00611000 Relevance: 5.0, APIs: 4, Instructions: 42stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?,?,?,?,?,00617B82,-embedding,0062BBE0), ref: 00611011
lstrcpynA.KERNEL32(?,006A7010,?,?,?,?,?,?,00617B82,-embedding,0062BBE0), ref: 0061103A
lstrcmpiA.KERNEL32(?,?), ref: 00611049
lstrcpyA.KERNEL32(?,?,?,006A7010,?,?,?,?,?,?,00617B82,-embedding,0062BBE0), ref: 0061105F

Memory Dump Source

Source File: 00000002.00000002.2567412345.0000000000610000.00000040.00001000.00020000.00000000.sdmp, Offset: 00610000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_610000_7Y18r(223).jbxd

Yara matches

Similarity

API ID: lstrcmpilstrcpylstrcpynlstrlen
String ID:
API String ID: 4224384254-0
Opcode ID: 25e7a39d2c93ca66547f0d389539579c5a48a7e132b0774723051afdb513191c
Instruction ID: b5f003244580d5dcd2b4965dfff7112cd5b330525a97885b80ce082ebfb2169b
Opcode Fuzzy Hash: 25e7a39d2c93ca66547f0d389539579c5a48a7e132b0774723051afdb513191c
Instruction Fuzzy Hash: 64F0D6319004089FCF20AF65CC80DDA77BAEB88310F084165E64897110DB31AED2DB94

Function 00612420 Relevance: 5.0, APIs: 4, Instructions: 29stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?,-00000001,?), ref: 0061242F
lstrcpyA.KERNEL32(?,?,?,-00000001,?), ref: 00612441
lstrcpynA.KERNEL32(?,?,00000001,?,?,?,-00000001,?), ref: 00612451
lstrcmpA.KERNEL32(?,?,?,?,00000001,?,?,?,-00000001,?), ref: 00612464

Memory Dump Source

Source File: 00000002.00000002.2567412345.0000000000610000.00000040.00001000.00020000.00000000.sdmp, Offset: 00610000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_610000_7Y18r(223).jbxd

Yara matches

Similarity

API ID: lstrcmplstrcpylstrcpynlstrlen
String ID:
API String ID: 2000052532-0
Opcode ID: 72f4f7472a497a786a8d05ffe0befcc114fea98bfa83ad6341e26ed9f0bd6e92
Instruction ID: 925c76c17e25e6e0dee5e0b36dae1fca2d4b729ecbbfcd5d6798e44dc679dc98
Opcode Fuzzy Hash: 72f4f7472a497a786a8d05ffe0befcc114fea98bfa83ad6341e26ed9f0bd6e92
Instruction Fuzzy Hash: 07E0657240011C7FCF51AAE4DC85DDB776DFB18754F080169B619D3011EA30DB958BA4

Analysis Process: JdaybS.exePID: 6676, Parent PID: 1796COMMON

Execution Graph

Execution Coverage:	30.8%
Dynamic/Decrypted Code Coverage:	10.5%
Signature Coverage:	3.4%
Total number of Nodes:	296
Total number of Limit Nodes:	11

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 001A29E2 Relevance: 31.6, APIs: 15, Strings: 3, Instructions: 128
stringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 001A2A02
wsprintfA.USER32 ref: 001A2A1A
memset.MSVCRT ref: 001A2A44
lstrlen.KERNEL32(?), ref: 001A2A54
lstrcpyn.KERNEL32(?,?,-00000001), ref: 001A2A6C
strrchr.MSVCRT ref: 001A2A7C
lstrcmpiA.KERNEL32(?,Documents and Settings), ref: 001A2A9F
lstrlen.KERNEL32(Documents and Settings), ref: 001A2AAE
memset.MSVCRT ref: 001A2AC6
memset.MSVCRT ref: 001A2ADA
FindFirstFileA.KERNELBASE(?,?), ref: 001A2AEF
memset.MSVCRT ref: 001A2B13
lstrcmpiA.KERNEL32(?,?), ref: 001A2B42
FindNextFileA.KERNELBASE(00000000,?,?,?,?), ref: 001A2B67
FindClose.KERNELBASE(00000000), ref: 001A2B6E

Strings

%s*, xrefs: 001A2A14
C:\, xrefs: 001A2A2F
Documents and Settings, xrefs: 001A2A8D, 001A2A92, 001A2A9A, 001A2AAD

Memory Dump Source

Source File: 00000003.00000002.1536802905.00000000001A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000003.00000002.1536783269.00000000001A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.1536822008.00000000001A3000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.1536840558.00000000001A4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.1536859722.00000000001A6000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1a0000_JdaybS.jbxd

Similarity

API ID: memset$Find$Filelstrcmpilstrlen$CloseFirstNextlstrcpynstrrchrwsprintf
String ID: %s*$C:\$Documents and Settings
API String ID: 2826467728-110786608
Opcode ID: 1bc7f247fe23ffdb4514430961a0d0b8c2ccd8770e74ac31aa1d12a08d5b7cbe
Instruction ID: 570ac9a0368e174e42e713bbd1fc6e1ef36bf1dde2568050d08b606eaacc1031
Opcode Fuzzy Hash: 1bc7f247fe23ffdb4514430961a0d0b8c2ccd8770e74ac31aa1d12a08d5b7cbe
Instruction Fuzzy Hash: 554165B6404349AFD721DBA4DC49EDBB7ECEB96315F04082AF554D3111E734DA4887A2

Function 001A1718 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 65
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemTimeAsFileTime.KERNEL32(?,?,00000104,C:\Users\user~1\AppData\Local\Temp\JdaybS.exe), ref: 001A1729
SHSetValueA.SHLWAPI(80000002,SOFTWARE\GTplus,Time,00000003,?,00000008), ref: 001A174C
SHGetValueA.SHLWAPI(80000002,SOFTWARE\GTplus,Time,?,?,00000001), ref: 001A177C
__aulldiv.LIBCMT ref: 001A1796
__aulldiv.LIBCMT ref: 001A17A8

Strings

Time, xrefs: 001A173D, 001A1766
SOFTWARE\GTplus, xrefs: 001A1742, 001A176B
C:\Users\user~1\AppData\Local\Temp\JdaybS.exe, xrefs: 001A1722

Memory Dump Source

Source File: 00000003.00000002.1536802905.00000000001A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000003.00000002.1536783269.00000000001A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.1536822008.00000000001A3000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.1536840558.00000000001A4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.1536859722.00000000001A6000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1a0000_JdaybS.jbxd

Similarity

API ID: TimeValue__aulldiv$FileSystem
String ID: C:\Users\user~1\AppData\Local\Temp\JdaybS.exe$SOFTWARE\GTplus$Time
API String ID: 541852442-417269678
Opcode ID: 0fb0bcd0d3979ffe18b5d76810d82ce0518cb0f467887313e2ace8174ba6da48
Instruction ID: 30a4fcc0bfa37b2f7528ca432f9ffd9b45cb91ecfde05c13595039e38a098bc6
Opcode Fuzzy Hash: 0fb0bcd0d3979ffe18b5d76810d82ce0518cb0f467887313e2ace8174ba6da48
Instruction Fuzzy Hash: BD11587AA00209BBDB109BD4CC86FFFBBBDEB46B14F108115F911B6140D7719A44CB60

Function 001A6076 Relevance: 11.1, APIs: 7, Instructions: 616
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,00001800,00001000,00000004), ref: 001A60BE
VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004,?,?,?), ref: 001A60DF
VirtualFree.KERNELBASE(?,00000000,00008000,?,?,?), ref: 001A6189
VirtualFree.KERNELBASE(?,00000000,00008000), ref: 001A61A5

Memory Dump Source

Source File: 00000003.00000002.1536859722.00000000001A6000.00000040.00000001.01000000.00000004.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000003.00000002.1536783269.00000000001A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.1536802905.00000000001A1000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.1536822008.00000000001A3000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.1536840558.00000000001A4000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1a0000_JdaybS.jbxd

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 964212cc2982e6f70a40ed944ff09072b4bf2ef928195d8144e0570243bb98db
Instruction ID: 41d5c886247bb8178cc8893f0d20f568effc5900fd84fa611f100ff97a561fc0
Opcode Fuzzy Hash: 964212cc2982e6f70a40ed944ff09072b4bf2ef928195d8144e0570243bb98db
Instruction Fuzzy Hash: 9A1210B65087858FDB368F64CC55BEA3BB0EF13310F1D45AEE8898B292D774A901CB51

Function 001A1E6E Relevance: 30.4, APIs: 20, Instructions: 380
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFileAttributesA.KERNELBASE(?,00000080,?,001A32B0,00000164,001A2986,?), ref: 001A1EB9
CreateFileA.KERNELBASE(?,C0000000,00000000,00000000,00000003,00000080,00000000), ref: 001A1ECD
SetFilePointer.KERNELBASE(000000FF,00000000,00000000,00000002,00000000,00000000), ref: 001A1EF3
CreateFileMappingA.KERNEL32(000000FF,00000000,00000004,00000000,00000000,00000000), ref: 001A1F07
MapViewOfFile.KERNELBASE(00000000,000F001F,00000000,00000000,00000400), ref: 001A1F1D
FlushViewOfFile.KERNEL32(?,00000400,?,00000000,00000000,?,00000000,00000002), ref: 001A201E
memset.MSVCRT ref: 001A20D8
memset.MSVCRT ref: 001A20EA
memcpy.MSVCRT ref: 001A222D
UnmapViewOfFile.KERNEL32(?,?,00000002,?,?,?,?,00000000,00000000,?,00000000,00000002), ref: 001A2238
FindCloseChangeNotification.KERNELBASE(?,?,?,?,00000000,00000000,?,00000000,00000002), ref: 001A224A
SetFilePointer.KERNELBASE(000000FF,?,00000000,00000002,?,?,?,?,00000000,00000000,?,00000000,00000002), ref: 001A22C6
SetEndOfFile.KERNELBASE(000000FF,?,?,?,00000000,00000000,?,00000000,00000002), ref: 001A22CB
SetFilePointer.KERNELBASE(000000FF,?,00000000,00000002,?,?,?,00000000,00000000,?,00000000,00000002), ref: 001A22DD
WriteFile.KERNELBASE(000000FF,001A4008,00000271,?,00000000,?,?,?,00000000,00000000,?,00000000,00000002), ref: 001A22F7
WriteFile.KERNELBASE(000000FF,?,00000000,?,?,?,00000000,00000000,?,00000000,00000002), ref: 001A230D
CloseHandle.KERNEL32(000000FF,000000FF,00000001,?,?,?,00000000,00000000,?,00000000,00000002), ref: 001A2322
UnmapViewOfFile.KERNEL32(?,?,001A32B0,00000164,001A2986,?), ref: 001A2340
FindCloseChangeNotification.KERNELBASE(?,?,001A32B0,00000164,001A2986,?), ref: 001A234E
CloseHandle.KERNEL32(000000FF,?,001A32B0,00000164,001A2986,?), ref: 001A2359

Memory Dump Source

Source File: 00000003.00000002.1536802905.00000000001A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000003.00000002.1536783269.00000000001A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.1536822008.00000000001A3000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.1536840558.00000000001A4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.1536859722.00000000001A6000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1a0000_JdaybS.jbxd

Similarity

API ID: File$CloseView$Pointer$ChangeCreateFindHandleNotificationUnmapWritememset$AttributesFlushMappingmemcpy
String ID:
API String ID: 3349749541-0
Opcode ID: 5badb0d958b777e49af0a93bebc2d2c65a009424d94db41f60cc0119f8ff25cc
Instruction ID: 965ed32fa0e180d505fcafd686a3ab354f0f01a0263b699f9c6be0af35575d46
Opcode Fuzzy Hash: 5badb0d958b777e49af0a93bebc2d2c65a009424d94db41f60cc0119f8ff25cc
Instruction Fuzzy Hash: 6AF16B79900208EFCB24DFA8DD84AADBBB5FF1A314F10852AF519A7661D730AD81CF50

Function 001A1973 Relevance: 28.1, APIs: 12, Strings: 4, Instructions: 144
filesleepmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PathFileExistsA.KERNELBASE(001A4E5C,00000000,C:\Users\user~1\AppData\Local\Temp\JdaybS.exe), ref: 001A1992
CreateFileA.KERNELBASE(001A4E5C,80000000,00000001,00000000,00000003,00000000,00000000,00000000), ref: 001A19BA
Sleep.KERNEL32(00000064), ref: 001A19C6
wsprintfA.USER32 ref: 001A19EC
CopyFileA.KERNEL32(001A4E5C,?,00000000), ref: 001A1A00
CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 001A1A1E
GetFileSize.KERNEL32(001A4E5C,00000000), ref: 001A1A2C
VirtualAlloc.KERNELBASE(00000000,00000000,00003000,00000004), ref: 001A1A46
ReadFile.KERNELBASE(001A4E5C,001A4E60,00000000,?,00000000), ref: 001A1A65
FindCloseChangeNotification.KERNELBASE(000000FF), ref: 001A1A90
DeleteFileA.KERNEL32(?), ref: 001A1AA7
VirtualFree.KERNEL32(001A4E60,00000000,00008000), ref: 001A1AC1

Strings

C:\Users\user~1\AppData\Local\Temp\, xrefs: 001A19DB
2, xrefs: 001A19CF
%s%.8X.data, xrefs: 001A19E6
C:\Users\user~1\AppData\Local\Temp\JdaybS.exe, xrefs: 001A197C

Memory Dump Source

Source File: 00000003.00000002.1536802905.00000000001A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000003.00000002.1536783269.00000000001A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.1536822008.00000000001A3000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.1536840558.00000000001A4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.1536859722.00000000001A6000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1a0000_JdaybS.jbxd

Similarity

API ID: File$CreateVirtual$AllocChangeCloseCopyDeleteExistsFindFreeNotificationPathReadSizeSleepwsprintf
String ID: %s%.8X.data$2$C:\Users\user~1\AppData\Local\Temp\$C:\Users\user~1\AppData\Local\Temp\JdaybS.exe
API String ID: 2523042076-2996059253
Opcode ID: 9636ac8c19b215937bebfe5a97f42500f118634f23dd1db2c7ea932c4c37d60f
Instruction ID: be8b02d27c5988367af598356c93515635c5ee130dae6968129e644f73669619
Opcode Fuzzy Hash: 9636ac8c19b215937bebfe5a97f42500f118634f23dd1db2c7ea932c4c37d60f
Instruction Fuzzy Hash: 8B515E75901259FFCF209FA8CD84AAEBBB9FB06354F104569F525E7190C3709E80CB50

Function 001A28B8 Relevance: 24.6, APIs: 9, Strings: 5, Instructions: 100
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 001A28D3
wsprintfA.USER32 ref: 001A28F7
memset.MSVCRT ref: 001A2925
wsprintfA.USER32 ref: 001A2940

Part of subcall function 001A29E2: memset.MSVCRT ref: 001A2A02
Part of subcall function 001A29E2: wsprintfA.USER32 ref: 001A2A1A
Part of subcall function 001A29E2: memset.MSVCRT ref: 001A2A44
Part of subcall function 001A29E2: lstrlen.KERNEL32(?), ref: 001A2A54
Part of subcall function 001A29E2: lstrcpyn.KERNEL32(?,?,-00000001), ref: 001A2A6C
Part of subcall function 001A29E2: strrchr.MSVCRT ref: 001A2A7C
Part of subcall function 001A29E2: lstrcmpiA.KERNEL32(?,Documents and Settings), ref: 001A2A9F
Part of subcall function 001A29E2: lstrlen.KERNEL32(Documents and Settings), ref: 001A2AAE
Part of subcall function 001A29E2: memset.MSVCRT ref: 001A2AC6
Part of subcall function 001A29E2: memset.MSVCRT ref: 001A2ADA
Part of subcall function 001A29E2: FindFirstFileA.KERNELBASE(?,?), ref: 001A2AEF
Part of subcall function 001A29E2: memset.MSVCRT ref: 001A2B13

strrchr.MSVCRT ref: 001A2959
lstrcmpiA.KERNEL32(00000001,exe), ref: 001A2974

Strings

C:\Users\user~1\AppData\Local\Temp\, xrefs: 001A29B3
exe, xrefs: 001A296D
%s\, xrefs: 001A293A
%s%s, xrefs: 001A28F1
rar, xrefs: 001A2988

Memory Dump Source

Source File: 00000003.00000002.1536802905.00000000001A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000003.00000002.1536783269.00000000001A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.1536822008.00000000001A3000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.1536840558.00000000001A4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.1536859722.00000000001A6000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1a0000_JdaybS.jbxd

Similarity

API ID: memset$wsprintf$lstrcmpilstrlenstrrchr$FileFindFirstlstrcpyn
String ID: %s%s$%s\$C:\Users\user~1\AppData\Local\Temp\$exe$rar
API String ID: 3004273771-4092107658
Opcode ID: 2735a6c55d3ffefee3033ebd67dd15d06ac6fb1d0b4b747881a4ef407103c5c6
Instruction ID: 2cde33a1e895999de2a68cd617a4413e890904d8ccd308f8bba0a374cb9fa1c7
Opcode Fuzzy Hash: 2735a6c55d3ffefee3033ebd67dd15d06ac6fb1d0b4b747881a4ef407103c5c6
Instruction Fuzzy Hash: 9D31C779A4031C7BDB209768DC85FCB776C9F23714F040452F555A2081E7B4DAC98B60

Function 001A1099 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 74
stringsleepprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 001A185B: GetSystemTimeAsFileTime.KERNEL32(?,ddos.dnsnb8.net,75A38400,http://%s:%d/%s/%s,?,?,?,001A1118), ref: 001A1867
Part of subcall function 001A185B: srand.MSVCRT ref: 001A1878
Part of subcall function 001A185B: rand.MSVCRT ref: 001A1880
Part of subcall function 001A185B: srand.MSVCRT ref: 001A1890
Part of subcall function 001A185B: rand.MSVCRT ref: 001A1894

WinExec.KERNEL32(?,00000005), ref: 001A10F1
lstrlen.KERNEL32(001A4748), ref: 001A10FA
wsprintfA.USER32 ref: 001A112A
wsprintfA.USER32 ref: 001A1143
URLDownloadToFileA.URLMON(00000000,?,?,00000000,00000000), ref: 001A115B
lstrlen.KERNEL32(ddos.dnsnb8.net,00000000,?,?,00000000,00000000), ref: 001A1169
Sleep.KERNEL32 ref: 001A1179

Strings

C:\Users\user~1\AppData\Local\Temp\, xrefs: 001A1119
%s%.8X.exe, xrefs: 001A1124
ddos.dnsnb8.net, xrefs: 001A10C8, 001A10CF, 001A1140, 001A1168
cj/, xrefs: 001A1135
http://%s:%d/%s/%s, xrefs: 001A10C2, 001A1141

Memory Dump Source

Source File: 00000003.00000002.1536802905.00000000001A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000003.00000002.1536783269.00000000001A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.1536822008.00000000001A3000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.1536840558.00000000001A4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.1536859722.00000000001A6000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1a0000_JdaybS.jbxd

Similarity

API ID: FileTimelstrlenrandsrandwsprintf$DownloadExecSleepSystem
String ID: %s%.8X.exe$C:\Users\user~1\AppData\Local\Temp\$cj/$ddos.dnsnb8.net$http://%s:%d/%s/%s
API String ID: 1280626985-4120842960
Opcode ID: f404e75d52b794914bd76e171db3e8025f0ba65ee57a2c6e49dbe68a564bec8a
Instruction ID: d3d67c1b22495673cf936362f36b29c932eef66bc5f32bbce92872a2caf0be76
Opcode Fuzzy Hash: f404e75d52b794914bd76e171db3e8025f0ba65ee57a2c6e49dbe68a564bec8a
Instruction Fuzzy Hash: 2821ACB9900208BBDB20DBA0DD49BAFBBBDEB47315F114095F501A2451D7B49B84CFA0

Function 001A1638 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 70
stringsynchronizationthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTempPathA.KERNEL32(00000104,C:\Users\user~1\AppData\Local\Temp\,?,00000005,00000000), ref: 001A164F
GetSystemDirectoryA.KERNEL32(C:\Windows\system32,00000104), ref: 001A165B
GetModuleFileNameA.KERNEL32(C:\Users\user~1\AppData\Local\Temp\JdaybS.exe,00000104), ref: 001A166E
CreateThread.KERNELBASE(00000000,00000000,Function_00001099,00000000,00000000,00000000), ref: 001A16AC
WaitForSingleObject.KERNEL32(00000000,000000FF,00000000), ref: 001A16BD

Part of subcall function 001A139F: GetVersionExA.KERNEL32(?,?,00000104,C:\Users\user~1\AppData\Local\Temp\JdaybS.exe), ref: 001A13BC
Part of subcall function 001A139F: LookupPrivilegeValueA.ADVAPI32(00000000,SeDebugPrivilege,?), ref: 001A13DA
Part of subcall function 001A139F: GetCurrentProcessId.KERNEL32(-00000094,0000000C,0000000C,00000001), ref: 001A1448

lstrcpy.KERNEL32(?,C:\Users\user~1\AppData\Local\Temp\JdaybS.exe), ref: 001A16E5

Strings

C:\Users\user~1\AppData\Local\Temp\, xrefs: 001A1644
C:\Windows\system32, xrefs: 001A1656
C:\Users\user~1\AppData\Local\Temp\JdaybS.exe, xrefs: 001A1662, 001A1667, 001A16DD
Documents and Settings, xrefs: 001A1696

Memory Dump Source

Source File: 00000003.00000002.1536802905.00000000001A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000003.00000002.1536783269.00000000001A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.1536822008.00000000001A3000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.1536840558.00000000001A4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.1536859722.00000000001A6000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1a0000_JdaybS.jbxd

Similarity

API ID: CreateCurrentDirectoryFileLookupModuleNameObjectPathPrivilegeProcessSingleSystemTempThreadValueVersionWaitlstrcpy
String ID: C:\Users\user~1\AppData\Local\Temp\$C:\Users\user~1\AppData\Local\Temp\JdaybS.exe$C:\Windows\system32$Documents and Settings
API String ID: 123563730-3962632476
Opcode ID: f75ad133ac38f3aa890efa9d105b73eb63510319b1a4cc095e922573a6727b72
Instruction ID: 9cc485931d450789016c7c0f780aa9ccb5fbd0821c0a71515db2aab1ab45e383
Opcode Fuzzy Hash: f75ad133ac38f3aa890efa9d105b73eb63510319b1a4cc095e922573a6727b72
Instruction Fuzzy Hash: A711B679901224BBDB216BE4AE4EFAB7E6DEB57361F100111F21DD54A0D7B08980CBB1

Function 001A2B8C Relevance: 10.6, APIs: 7, Instructions: 74
threadstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 001A2BA6
GetLogicalDriveStringsA.KERNEL32(00000050,?), ref: 001A2BB4
GetDriveTypeA.KERNELBASE(?), ref: 001A2BD3
CreateThread.KERNELBASE(00000000,00000000,001A2B7D,?,00000000,00000000), ref: 001A2BEE
lstrlen.KERNEL32(?), ref: 001A2BFB
WaitForMultipleObjects.KERNEL32(?,?,00000001,000000FF), ref: 001A2C16
CreateThread.KERNEL32(00000000,00000000,001A2845,00000000,00000000,00000000), ref: 001A2C3A

Memory Dump Source

Source File: 00000003.00000002.1536802905.00000000001A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000003.00000002.1536783269.00000000001A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.1536822008.00000000001A3000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.1536840558.00000000001A4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.1536859722.00000000001A6000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1a0000_JdaybS.jbxd

Similarity

API ID: CreateDriveThread$LogicalMultipleObjectsStringsTypeWaitlstrlenmemset
String ID:
API String ID: 1073171358-0
Opcode ID: c02b399f97e8a91ee0bd5878e225fb7928376f4888480da7381b53f99317b013
Instruction ID: 03635c98bb06dfef6879b519b36408aa38edf2c085a3392b22574b90c1b3d37b
Opcode Fuzzy Hash: c02b399f97e8a91ee0bd5878e225fb7928376f4888480da7381b53f99317b013
Instruction Fuzzy Hash: 812124B580014CAFE7209F68AC84EAE7BACFF07354B140129F95293051D3358E46CB70

Function 001A2C48 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 50
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 001A2C57

Part of subcall function 001A1973: PathFileExistsA.KERNELBASE(001A4E5C,00000000,C:\Users\user~1\AppData\Local\Temp\JdaybS.exe), ref: 001A1992
Part of subcall function 001A1973: CreateFileA.KERNELBASE(001A4E5C,80000000,00000001,00000000,00000003,00000000,00000000,00000000), ref: 001A19BA
Part of subcall function 001A1973: Sleep.KERNEL32(00000064), ref: 001A19C6
Part of subcall function 001A1973: wsprintfA.USER32 ref: 001A19EC
Part of subcall function 001A1973: CopyFileA.KERNEL32(001A4E5C,?,00000000), ref: 001A1A00
Part of subcall function 001A1973: CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 001A1A1E
Part of subcall function 001A1973: GetFileSize.KERNEL32(001A4E5C,00000000), ref: 001A1A2C
Part of subcall function 001A1973: VirtualAlloc.KERNELBASE(00000000,00000000,00003000,00000004), ref: 001A1A46
Part of subcall function 001A1973: ReadFile.KERNELBASE(001A4E5C,001A4E60,00000000,?,00000000), ref: 001A1A65

CreateThread.KERNELBASE(00000000,00000000,Function_00002B8C,00000000,00000000,00000000), ref: 001A2C99
WaitForMultipleObjects.KERNEL32(00000001,001A16BA,00000001,000000FF,?,001A16BA,00000000), ref: 001A2CAC
VirtualFree.KERNEL32(00B00000,00000000,00008000,C:\Users\user~1\AppData\Local\Temp\JdaybS.exe,001A4E5C,001A4E60,?,001A16BA,00000000), ref: 001A2CC2

Strings

C:\Users\user~1\AppData\Local\Temp\JdaybS.exe, xrefs: 001A2C69

Memory Dump Source

Source File: 00000003.00000002.1536802905.00000000001A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000003.00000002.1536783269.00000000001A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.1536822008.00000000001A3000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.1536840558.00000000001A4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.1536859722.00000000001A6000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1a0000_JdaybS.jbxd

Similarity

API ID: File$Create$Virtual$AllocCopyExistsFreeMultipleObjectsPathReadSizeSleepThreadWaitmemsetwsprintf
String ID: C:\Users\user~1\AppData\Local\Temp\JdaybS.exe
API String ID: 2042498389-3675173926
Opcode ID: b30fbca47e896ebe4ddf94c611e0b8d0a619225fd2f983712007b7e7f45afaae
Instruction ID: 4683d6b8b335ffea37af9fe18cbb8b40b95caace699f027e695ff06ec48e5e82
Opcode Fuzzy Hash: b30fbca47e896ebe4ddf94c611e0b8d0a619225fd2f983712007b7e7f45afaae
Instruction Fuzzy Hash: 7E018F79641220BBD710ABA99C0AEAF7E6CEF43B60F104110F515D61C5E7F09A44C7F1

Function 001A14E1 Relevance: 4.6, APIs: 3, Instructions: 55
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(00000000), ref: 001A1504
VirtualQuery.KERNEL32(001A14E1,?,0000001C), ref: 001A1525
ExitProcess.KERNEL32 ref: 001A157A

Memory Dump Source

Source File: 00000003.00000002.1536802905.00000000001A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000003.00000002.1536783269.00000000001A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.1536822008.00000000001A3000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.1536840558.00000000001A4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.1536859722.00000000001A6000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1a0000_JdaybS.jbxd

Similarity

API ID: ExitHandleModuleProcessQueryVirtual
String ID:
API String ID: 3946701194-0
Opcode ID: cbe6583ff7bf3fb3f3509ae6e3657bcb1a32030f8820d7c9fda859ff721c5afe
Instruction ID: 757c1aca2f7f1e56a659f2f8faaa42804a071c3c982b942c61db7f24ddcda78f
Opcode Fuzzy Hash: cbe6583ff7bf3fb3f3509ae6e3657bcb1a32030f8820d7c9fda859ff721c5afe
Instruction Fuzzy Hash: 11118E79D40214FFEB22DFA5A884A7DB7BCEBE7710F10402AF416E2550D3B48981DB50

Function 001A1915 Relevance: 4.5, APIs: 3, Instructions: 41
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 001A1933
GetFileTime.KERNEL32(000000FF,?,?,?), ref: 001A1947

Memory Dump Source

Source File: 00000003.00000002.1536802905.00000000001A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000003.00000002.1536783269.00000000001A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.1536822008.00000000001A3000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.1536840558.00000000001A4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.1536859722.00000000001A6000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1a0000_JdaybS.jbxd

Similarity

API ID: FileTimememset
String ID:
API String ID: 176422537-0
Opcode ID: 10b4bf289eea300be1c9491e8d300ae426412d7f6e4af45ebab8eefcfc833b61
Instruction ID: ba215f41aa4e9e0fd62764567b7b58c5b6e410eec676a6761e030cab847251fc
Opcode Fuzzy Hash: 10b4bf289eea300be1c9491e8d300ae426412d7f6e4af45ebab8eefcfc833b61
Instruction Fuzzy Hash: DCF06836200309BBD720DE26DC04BE777ACAB52365F008936F526D5450E730D645CBB0

Function 001A6158 Relevance: 2.6, APIs: 2, Instructions: 56
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004,?,?,?), ref: 001A60DF
VirtualFree.KERNELBASE(?,00000000,00008000,?,?,?), ref: 001A6189
VirtualFree.KERNELBASE(?,00000000,00008000), ref: 001A61A5

Memory Dump Source

Source File: 00000003.00000002.1536859722.00000000001A6000.00000040.00000001.01000000.00000004.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000003.00000002.1536783269.00000000001A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.1536802905.00000000001A1000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.1536822008.00000000001A3000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.1536840558.00000000001A4000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1a0000_JdaybS.jbxd

Similarity

API ID: Virtual$Free$Alloc
String ID:
API String ID: 1852963964-0
Opcode ID: 2409c9cc2a58e72e462e3af1e3a8b9bcbd3293f96dea1b4f564600dc33109ec6
Instruction ID: 6af9beb7f0f611b9bcd38b05e958572c5a3b7e99a317c6546d7ef6358cb243a7
Opcode Fuzzy Hash: 2409c9cc2a58e72e462e3af1e3a8b9bcbd3293f96dea1b4f564600dc33109ec6
Instruction Fuzzy Hash: F2116D35A00649CFCF358E58CC857DD3BA1FF42300F6D4519DE8A6B292DB712980CB94

Non-executed Functions

Function 001A119F Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(C:\Users\user~1\AppData\Local\Temp\JdaybS.exe,?,?,?,?,?,?,001A13EF), ref: 001A11AB
OpenProcessToken.ADVAPI32(00000000,00000028,001A13EF,?,?,?,?,?,?,001A13EF), ref: 001A11BB
AdjustTokenPrivileges.ADVAPI32(001A13EF,00000000,?,00000010,00000000,00000000), ref: 001A11EB
CloseHandle.KERNEL32(001A13EF), ref: 001A11FA
CloseHandle.KERNEL32(?,?,?,?,?,?,?,001A13EF), ref: 001A1203

Strings

C:\Users\user~1\AppData\Local\Temp\JdaybS.exe, xrefs: 001A11A5

Memory Dump Source

Source File: 00000003.00000002.1536802905.00000000001A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000003.00000002.1536783269.00000000001A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.1536822008.00000000001A3000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.1536840558.00000000001A4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.1536859722.00000000001A6000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1a0000_JdaybS.jbxd

Similarity

API ID: CloseHandleProcessToken$AdjustCurrentOpenPrivileges
String ID: C:\Users\user~1\AppData\Local\Temp\JdaybS.exe
API String ID: 75692138-3675173926
Opcode ID: 91328cc210541eaa77805b91d56a9cac3ed47de58c8bf1e9c6e6a62c22ca432b
Instruction ID: 6f23e83fe334489946ea94b7c4d6cb39bd5958c9e74b72e856ded4f76f713de5
Opcode Fuzzy Hash: 91328cc210541eaa77805b91d56a9cac3ed47de58c8bf1e9c6e6a62c22ca432b
Instruction Fuzzy Hash: CA01E875900209FFDB00DFE4CE89AAEFBB9FB05305F104469F616A2190D7719F849B50

Function 001A239D Relevance: 56.2, APIs: 26, Strings: 6, Instructions: 239
sleepfilestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

strstr.MSVCRT ref: 001A23CC
CreateFileA.KERNEL32(?,C0000000,00000003,00000000,00000003,00000080,00000000), ref: 001A2464
GetFileSize.KERNEL32(00000000,00000000), ref: 001A2472
CloseHandle.KERNEL32(?,00000000,00000000), ref: 001A24A8
memset.MSVCRT ref: 001A24B9
strrchr.MSVCRT ref: 001A24C9
wsprintfA.USER32 ref: 001A24DE
strrchr.MSVCRT ref: 001A24ED
memset.MSVCRT ref: 001A24F2
memset.MSVCRT ref: 001A2505
wsprintfA.USER32 ref: 001A2524
Sleep.KERNEL32(000007D0), ref: 001A2535
Sleep.KERNEL32(000007D0), ref: 001A255D
memset.MSVCRT ref: 001A256E
wsprintfA.USER32 ref: 001A2585
memset.MSVCRT ref: 001A25A6
wsprintfA.USER32 ref: 001A25CA
Sleep.KERNEL32(000007D0), ref: 001A25D0
Sleep.KERNEL32(000007D0,?,?), ref: 001A25E5
CreateFileA.KERNEL32(?,C0000000,00000003,00000000,00000003,00000080,00000000), ref: 001A25FC
CloseHandle.KERNEL32(00000000,00000000,00000001), ref: 001A2611
SetFilePointer.KERNEL32(FFFFFFFF,?,00000000,00000000), ref: 001A2642
WriteFile.KERNEL32(?,00000006,?,00000000), ref: 001A265B
SetEndOfFile.KERNEL32 ref: 001A266D
CloseHandle.KERNEL32(00000000), ref: 001A2676
RemoveDirectoryA.KERNEL32(?), ref: 001A2681

Strings

C:\Users\user~1\AppData\Local\Temp\, xrefs: 001A23B1, 001A23B6, 001A24CD
%s\, xrefs: 001A257F
%s X -ibck "%s" "%s\", xrefs: 001A251E
%s%s, xrefs: 001A24D8
-ibck, xrefs: 001A25BA
%s M %s -r -o+ -ep1 "%s" "%s\*", xrefs: 001A25C4

Memory Dump Source

Source File: 00000003.00000002.1536802905.00000000001A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000003.00000002.1536783269.00000000001A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.1536822008.00000000001A3000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.1536840558.00000000001A4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.1536859722.00000000001A6000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1a0000_JdaybS.jbxd

Similarity

API ID: File$memset$Sleepwsprintf$CloseHandle$Createstrrchr$DirectoryPointerRemoveSizeWritestrstr
String ID: %s M %s -r -o+ -ep1 "%s" "%s\*"$%s X -ibck "%s" "%s\"$%s%s$%s\$-ibck$C:\Users\user~1\AppData\Local\Temp\
API String ID: 2203340711-1252250577
Opcode ID: 0fdbf17009802254189064fe5bd70d5dcbd0498b8355c93ff26dba80eed0e03b
Instruction ID: acecfb3a58a4ac5247d8c0d86f518ace5bc3d4856f459f054e8766413bde0a05
Opcode Fuzzy Hash: 0fdbf17009802254189064fe5bd70d5dcbd0498b8355c93ff26dba80eed0e03b
Instruction Fuzzy Hash: D081E0B5404304BBD710DF64DC49FABBBECFB8A714F00051AFA59D2190E774DA888B66

Function 001A274A Relevance: 28.1, APIs: 9, Strings: 7, Instructions: 83fileCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 001A2766
memset.MSVCRT ref: 001A2774
SHGetSpecialFolderPathA.SHELL32(00000000,?,00000026,00000000), ref: 001A2787
wsprintfA.USER32 ref: 001A27AB

Part of subcall function 001A185B: GetSystemTimeAsFileTime.KERNEL32(?,ddos.dnsnb8.net,75A38400,http://%s:%d/%s/%s,?,?,?,001A1118), ref: 001A1867
Part of subcall function 001A185B: srand.MSVCRT ref: 001A1878
Part of subcall function 001A185B: rand.MSVCRT ref: 001A1880
Part of subcall function 001A185B: srand.MSVCRT ref: 001A1890
Part of subcall function 001A185B: rand.MSVCRT ref: 001A1894

wsprintfA.USER32 ref: 001A27C6
CopyFileA.KERNEL32(?,001A4C80,00000000), ref: 001A27D4
wsprintfA.USER32 ref: 001A27F4

Part of subcall function 001A1973: PathFileExistsA.KERNELBASE(001A4E5C,00000000,C:\Users\user~1\AppData\Local\Temp\JdaybS.exe), ref: 001A1992
Part of subcall function 001A1973: CreateFileA.KERNELBASE(001A4E5C,80000000,00000001,00000000,00000003,00000000,00000000,00000000), ref: 001A19BA
Part of subcall function 001A1973: Sleep.KERNEL32(00000064), ref: 001A19C6
Part of subcall function 001A1973: wsprintfA.USER32 ref: 001A19EC
Part of subcall function 001A1973: CopyFileA.KERNEL32(001A4E5C,?,00000000), ref: 001A1A00
Part of subcall function 001A1973: CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 001A1A1E
Part of subcall function 001A1973: GetFileSize.KERNEL32(001A4E5C,00000000), ref: 001A1A2C
Part of subcall function 001A1973: VirtualAlloc.KERNELBASE(00000000,00000000,00003000,00000004), ref: 001A1A46
Part of subcall function 001A1973: ReadFile.KERNELBASE(001A4E5C,001A4E60,00000000,?,00000000), ref: 001A1A65

DeleteFileA.KERNEL32(?,?,001A4E54,001A4E58), ref: 001A281A
CreateFileA.KERNEL32(?,C0000000,00000000,00000000,00000004,00000000,00000000,?,001A4E54,001A4E58), ref: 001A2832

Strings

C:\Users\user~1\AppData\Local\Temp\, xrefs: 001A27B6
C:\Windows\system32, xrefs: 001A27E3
%s%.8x.exe, xrefs: 001A27BB
c_31892.nls, xrefs: 001A27DE
\WinRAR\Rar.exe, xrefs: 001A2793
%s\%s, xrefs: 001A27EE
%s%s, xrefs: 001A27A5

Memory Dump Source

Source File: 00000003.00000002.1536802905.00000000001A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000003.00000002.1536783269.00000000001A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.1536822008.00000000001A3000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.1536840558.00000000001A4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.1536859722.00000000001A6000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1a0000_JdaybS.jbxd

Similarity

API ID: File$wsprintf$Create$CopyPathTimememsetrandsrand$AllocDeleteExistsFolderReadSizeSleepSpecialSystemVirtual
String ID: %s%.8x.exe$%s%s$%s\%s$C:\Users\user~1\AppData\Local\Temp\$C:\Windows\system32$\WinRAR\Rar.exe$c_31892.nls
API String ID: 692489704-4282063453
Opcode ID: 0fe999d8a6516e2076dcf05881108c9142b2e83f58dd937307cf4f4400d38bb9
Instruction ID: 30fff89f5a9855ae693eee78a837fcdc4058aa8a798890d7c155ff3650d3253a
Opcode Fuzzy Hash: 0fe999d8a6516e2076dcf05881108c9142b2e83f58dd937307cf4f4400d38bb9
Instruction Fuzzy Hash: AD2199BAD4021C7BDB10E7A49D89FDB736CDB56754F0005A2B655E2041E7B4DF848AB0

Function 001A1581 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 67filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 001A185B: GetSystemTimeAsFileTime.KERNEL32(?,ddos.dnsnb8.net,75A38400,http://%s:%d/%s/%s,?,?,?,001A1118), ref: 001A1867
Part of subcall function 001A185B: srand.MSVCRT ref: 001A1878
Part of subcall function 001A185B: rand.MSVCRT ref: 001A1880
Part of subcall function 001A185B: srand.MSVCRT ref: 001A1890
Part of subcall function 001A185B: rand.MSVCRT ref: 001A1894

wsprintfA.USER32 ref: 001A15AA
wsprintfA.USER32 ref: 001A15C6
lstrlen.KERNEL32(?), ref: 001A15D2
CreateFileA.KERNEL32(?,C0000000,00000000,00000000,00000002,00000000,00000000), ref: 001A15EE
WriteFile.KERNEL32(00000000,?,00000000,00000001,00000000), ref: 001A1609
CloseHandle.KERNEL32(00000000), ref: 001A1612
ShellExecuteA.SHELL32(00000000,open,?,00000000,00000000,00000000), ref: 001A162D

Strings

C:\Users\user~1\AppData\Local\Temp\, xrefs: 001A1599
open, xrefs: 001A1627
C:\Users\user~1\AppData\Local\Temp\JdaybS.exe, xrefs: 001A158A, 001A15B3, 001A15B8, 001A15B9
:DELFILEdel "%s"if exist "%s" goto :DELFILEdel "%s", xrefs: 001A15C0
%s%.8x.bat, xrefs: 001A15A4

Memory Dump Source

Source File: 00000003.00000002.1536802905.00000000001A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000003.00000002.1536783269.00000000001A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.1536822008.00000000001A3000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.1536840558.00000000001A4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.1536859722.00000000001A6000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1a0000_JdaybS.jbxd

Similarity

API ID: File$Timerandsrandwsprintf$CloseCreateExecuteHandleShellSystemWritelstrlen
String ID: %s%.8x.bat$:DELFILEdel "%s"if exist "%s" goto :DELFILEdel "%s"$C:\Users\user~1\AppData\Local\Temp\$C:\Users\user~1\AppData\Local\Temp\JdaybS.exe$open
API String ID: 617340118-1048561510
Opcode ID: 1171402d7b57ea9c118a0611f7c43bf994d7138bec5637597d28223ea3eeb830
Instruction ID: 0c263363bd9e04205b77cd8f34bc6ffd2bc1d04ec8429c9d35c97b1ab0d85c92
Opcode Fuzzy Hash: 1171402d7b57ea9c118a0611f7c43bf994d7138bec5637597d28223ea3eeb830
Instruction Fuzzy Hash: E211737AA011287BD72097A49C89EEB7B6CDF5B760F000051F559E2040DB709BC4CBB0

Function 001A120E Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 93librarymemoryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(ntdll.dll,ZwQuerySystemInformation,00000104,?,?,?,?,001A1400), ref: 001A1226
GetProcAddress.KERNEL32(00000000), ref: 001A122D
GetCurrentProcessId.KERNEL32(?,?,?,?,001A1400), ref: 001A123F
OpenProcess.KERNEL32(00000400,00000000,00000000,?,?,?,?,001A1400), ref: 001A1250
VirtualFree.KERNEL32(00000000,00000000,00008000,?,C:\Users\user~1\AppData\Local\Temp\JdaybS.exe,?,?,?,?,001A1400), ref: 001A129E
VirtualAlloc.KERNEL32(00000000,00050000,00003000,00000004,00000001,?,C:\Users\user~1\AppData\Local\Temp\JdaybS.exe,?,?,?,?,001A1400), ref: 001A12B0
CloseHandle.KERNEL32(?,?,C:\Users\user~1\AppData\Local\Temp\JdaybS.exe,?,?,?,?,001A1400), ref: 001A12F5
VirtualFree.KERNEL32(00000000,00000000,00008000,?,?,?,001A1400), ref: 001A130A

Strings

ZwQuerySystemInformation, xrefs: 001A1212
ntdll.dll, xrefs: 001A1219
C:\Users\user~1\AppData\Local\Temp\JdaybS.exe, xrefs: 001A1262

Memory Dump Source

Source File: 00000003.00000002.1536802905.00000000001A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000003.00000002.1536783269.00000000001A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.1536822008.00000000001A3000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.1536840558.00000000001A4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.1536859722.00000000001A6000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1a0000_JdaybS.jbxd

Similarity

API ID: Virtual$FreeHandleProcess$AddressAllocCloseCurrentModuleOpenProc
String ID: C:\Users\user~1\AppData\Local\Temp\JdaybS.exe$ZwQuerySystemInformation$ntdll.dll
API String ID: 1500695312-2025625787
Opcode ID: 5398f1fde703ec40c670118ea42d757aa314589d232295721021fc1a40a7941e
Instruction ID: 151f6ccee9991b8b96e766929bc6b91601263b80b71b07b81b7042a1181c8e4f
Opcode Fuzzy Hash: 5398f1fde703ec40c670118ea42d757aa314589d232295721021fc1a40a7941e
Instruction Fuzzy Hash: D3212339605311BBD7209F64CC08B6BBAA8FF87B10F20092AF655E7280C770DA84C7A5

Function 001A1000 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 60fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000003,C0000000,00000003,00000000,00000003,00000080,00000000,?,http://%s:%d/%s/%s,001A10E8,?), ref: 001A1018
GetFileSize.KERNEL32(00000000,00000000,ddos.dnsnb8.net,75A38400,?,http://%s:%d/%s/%s,001A10E8,?), ref: 001A1029
CreateFileMappingA.KERNEL32(00000000,00000000,00000004,00000000,00000000,00000000), ref: 001A1038
MapViewOfFile.KERNEL32(00000000,000F001F,00000000,00000000,00000000,?,http://%s:%d/%s/%s,001A10E8,?), ref: 001A104B
UnmapViewOfFile.KERNEL32(00000000,?,http://%s:%d/%s/%s,001A10E8,?), ref: 001A1075
CloseHandle.KERNEL32(?,?,http://%s:%d/%s/%s,001A10E8,?), ref: 001A108B
CloseHandle.KERNEL32(00000000,?,http://%s:%d/%s/%s,001A10E8,?), ref: 001A108E

Strings

ddos.dnsnb8.net, xrefs: 001A1026
http://%s:%d/%s/%s, xrefs: 001A1000

Memory Dump Source

Source File: 00000003.00000002.1536802905.00000000001A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000003.00000002.1536783269.00000000001A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.1536822008.00000000001A3000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.1536840558.00000000001A4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.1536859722.00000000001A6000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1a0000_JdaybS.jbxd

Similarity

API ID: File$CloseCreateHandleView$MappingSizeUnmap
String ID: ddos.dnsnb8.net$http://%s:%d/%s/%s
API String ID: 1223616889-3273462101
Opcode ID: 1c71f0246e0291035f83e669e9f3ba262543cbae99a34711661c7f47ac35ec86
Instruction ID: da9a72c442051d4ca416035e5133b7552bde71dc29dc9a58aaf1fc8e1281e746
Opcode Fuzzy Hash: 1c71f0246e0291035f83e669e9f3ba262543cbae99a34711661c7f47ac35ec86
Instruction Fuzzy Hash: B80192B520035CBFE7306FB09E88F2BBBACEB457A9F004529F655A2490D7705E848B70

Function 001A185B Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 31timeCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(?,ddos.dnsnb8.net,75A38400,http://%s:%d/%s/%s,?,?,?,001A1118), ref: 001A1867
srand.MSVCRT ref: 001A1878
rand.MSVCRT ref: 001A1880
srand.MSVCRT ref: 001A1890
rand.MSVCRT ref: 001A1894

Strings

ddos.dnsnb8.net, xrefs: 001A1862
http://%s:%d/%s/%s, xrefs: 001A1860

Memory Dump Source

Source File: 00000003.00000002.1536802905.00000000001A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000003.00000002.1536783269.00000000001A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.1536822008.00000000001A3000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.1536840558.00000000001A4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.1536859722.00000000001A6000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1a0000_JdaybS.jbxd

Similarity

API ID: Timerandsrand$FileSystem
String ID: ddos.dnsnb8.net$http://%s:%d/%s/%s
API String ID: 4106363736-3273462101
Opcode ID: f1e3c799f4602d8ffe014d97f2d33bf0d9a9e7a1f43269d559df4deefa18cc7f
Instruction ID: 490675795ef9466cc953637201aa382923cfc5f1079fadcbd02a786c91e0e9bc
Opcode Fuzzy Hash: f1e3c799f4602d8ffe014d97f2d33bf0d9a9e7a1f43269d559df4deefa18cc7f
Instruction Fuzzy Hash: 86E0D877A00218BBD700A7F9EC4699EBBACDF85161B110527F610D3250E570FD848AB4

Function 001A2692 Relevance: 12.1, APIs: 8, Instructions: 64stringsynchronizationCOMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000000,00000001,00000000,771AE800,?,?,001A29DB,?,00000001), ref: 001A26A7
WaitForSingleObject.KERNEL32(00000000,000000FF,771AE800,?,?,001A29DB,?,00000001), ref: 001A26B5
lstrlen.KERNEL32(?), ref: 001A26C4
??2@YAPAXI@Z.MSVCRT ref: 001A26CE
lstrcpy.KERNEL32(00000004,?), ref: 001A26E3
lstrcpy.KERNEL32(?,00000004), ref: 001A271F
??3@YAXPAX@Z.MSVCRT ref: 001A272D
SetEvent.KERNEL32 ref: 001A273C

Memory Dump Source

Source File: 00000003.00000002.1536802905.00000000001A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000003.00000002.1536783269.00000000001A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.1536822008.00000000001A3000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.1536840558.00000000001A4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.1536859722.00000000001A6000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1a0000_JdaybS.jbxd

Similarity

API ID: Eventlstrcpy$??2@??3@CreateObjectSingleWaitlstrlen
String ID:
API String ID: 41106472-0
Opcode ID: f94cdd43b0111d7356868a113c1aad5ab14cc5fe5586a0f3c5534c14356e3b75
Instruction ID: d3c150245fe8371b00564c2cc355b5e8beea80fefb8fca311c118ae175ebcb83
Opcode Fuzzy Hash: f94cdd43b0111d7356868a113c1aad5ab14cc5fe5586a0f3c5534c14356e3b75
Instruction Fuzzy Hash: 5511BF7A500200EFCB219F98ED48D6A7BA9FBE7720B214025F86987920D7B58EC5CB50

Function 001A1B8A Relevance: 10.6, APIs: 5, Strings: 2, Instructions: 81stringCOMMON

Download Yara Rule

APIs

srand.MSVCRT ref: 001A1BCD
rand.MSVCRT ref: 001A1BD8
memset.MSVCRT ref: 001A1C43
memcpy.MSVCRT ref: 001A1C4F
lstrcat.KERNEL32(?,.exe), ref: 001A1C5D

Strings

cwVREvUemdJkBUBjxeaYpSVrMHBhrvWuAfOSNtxzmZluLnGiLKRbfQgiNAXncZaysXNKhYiqcEdjatTSDOvpeLTfMOCqlnMwHuqAklDykGrsQJooZzKdWFpoTIsbtVEGmQYFgUFxPRgIPXjyCIzWJwPHhCDb, xrefs: 001A1B8A, 001A1B9C, 001A1C15, 001A1C49
.exe, xrefs: 001A1C57

Memory Dump Source

Source File: 00000003.00000002.1536802905.00000000001A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000003.00000002.1536783269.00000000001A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.1536822008.00000000001A3000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.1536840558.00000000001A4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.1536859722.00000000001A6000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1a0000_JdaybS.jbxd

Similarity

API ID: lstrcatmemcpymemsetrandsrand
String ID: .exe$cwVREvUemdJkBUBjxeaYpSVrMHBhrvWuAfOSNtxzmZluLnGiLKRbfQgiNAXncZaysXNKhYiqcEdjatTSDOvpeLTfMOCqlnMwHuqAklDykGrsQJooZzKdWFpoTIsbtVEGmQYFgUFxPRgIPXjyCIzWJwPHhCDb
API String ID: 122620767-2013259745
Opcode ID: 5b846d8b550993555a981e87d535ffecba67875f6c1df8033c2b1da71e98fbb7
Instruction ID: 02f210e19d38e0296eb6962725ae4ec58ed3dc6019bd69ecb6b341202138c564
Opcode Fuzzy Hash: 5b846d8b550993555a981e87d535ffecba67875f6c1df8033c2b1da71e98fbb7
Instruction Fuzzy Hash: 5C218B2AE442A07FD32613396C40BBE3F549FF3721F1600A9F4952B992E3A809C58270

Function 001A189D Relevance: 9.1, APIs: 6, Instructions: 51processsynchronizationCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 001A18B1
CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000001,0C000000,00000000,00000000,?,?,000007D0,771B0F00,75A38400), ref: 001A18D3
CloseHandle.KERNEL32(001A2549), ref: 001A18E9
WaitForSingleObject.KERNEL32(?,000000FF), ref: 001A18F0
GetExitCodeProcess.KERNEL32(?,001A2549), ref: 001A1901
CloseHandle.KERNEL32(?), ref: 001A190A

Memory Dump Source

Source File: 00000003.00000002.1536802905.00000000001A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000003.00000002.1536783269.00000000001A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.1536822008.00000000001A3000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.1536840558.00000000001A4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.1536859722.00000000001A6000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1a0000_JdaybS.jbxd

Similarity

API ID: CloseHandleProcess$CodeCreateExitObjectSingleWaitmemset
String ID:
API String ID: 876959470-0
Opcode ID: 19ed72c01c053cfa815c98990984d8ef967fdf0d902f0ef5faa3993de0293dbe
Instruction ID: cff6609cc5d6ca7556a1791b21dfb0ca375e44ea1db8856471c5d2ae7ff97891
Opcode Fuzzy Hash: 19ed72c01c053cfa815c98990984d8ef967fdf0d902f0ef5faa3993de0293dbe
Instruction Fuzzy Hash: 31017C76901128BBCB21AF96DD48EDFBF3DEF86770F104021FA25A51A0D6314A58CAA0

Function 001A139F Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 109COMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(?,?,00000104,C:\Users\user~1\AppData\Local\Temp\JdaybS.exe), ref: 001A13BC
LookupPrivilegeValueA.ADVAPI32(00000000,SeDebugPrivilege,?), ref: 001A13DA
GetCurrentProcessId.KERNEL32(-00000094,0000000C,0000000C,00000001), ref: 001A1448

Part of subcall function 001A119F: GetCurrentProcess.KERNEL32(C:\Users\user~1\AppData\Local\Temp\JdaybS.exe,?,?,?,?,?,?,001A13EF), ref: 001A11AB
Part of subcall function 001A119F: OpenProcessToken.ADVAPI32(00000000,00000028,001A13EF,?,?,?,?,?,?,001A13EF), ref: 001A11BB
Part of subcall function 001A119F: AdjustTokenPrivileges.ADVAPI32(001A13EF,00000000,?,00000010,00000000,00000000), ref: 001A11EB
Part of subcall function 001A119F: CloseHandle.KERNEL32(001A13EF), ref: 001A11FA
Part of subcall function 001A119F: CloseHandle.KERNEL32(?,?,?,?,?,?,?,001A13EF), ref: 001A1203

Strings

SeDebugPrivilege, xrefs: 001A13D3
C:\Users\user~1\AppData\Local\Temp\JdaybS.exe, xrefs: 001A13A8

Memory Dump Source

Source File: 00000003.00000002.1536802905.00000000001A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000003.00000002.1536783269.00000000001A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.1536822008.00000000001A3000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.1536840558.00000000001A4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.1536859722.00000000001A6000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1a0000_JdaybS.jbxd

Similarity

API ID: Process$CloseCurrentHandleToken$AdjustLookupOpenPrivilegePrivilegesValueVersion
String ID: C:\Users\user~1\AppData\Local\Temp\JdaybS.exe$SeDebugPrivilege
API String ID: 4123949106-573180913
Opcode ID: ecc948e9bf1cecaa4d45c2087b463718d326536d6500b52dbcc982e09d47afd4
Instruction ID: b54f00badcdbfdb81fc8646aab81b89ceebb9fcf2b684b9a7c553eb01215fb3c
Opcode Fuzzy Hash: ecc948e9bf1cecaa4d45c2087b463718d326536d6500b52dbcc982e09d47afd4
Instruction Fuzzy Hash: 9A314D79D00209BAEF209FA98C45FEEBBB9FB4A714F60406AE505B2141D7309E49CB60

Function 001A1319 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 53libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(ntdll.dll,NtSystemDebugControl,-00000094,-00000094,0000000C,0000000C,00000001), ref: 001A1334
GetProcAddress.KERNEL32(00000000), ref: 001A133B
memset.MSVCRT ref: 001A1359

Strings

NtSystemDebugControl, xrefs: 001A132A
ntdll.dll, xrefs: 001A132F

Memory Dump Source

Source File: 00000003.00000002.1536802905.00000000001A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000003.00000002.1536783269.00000000001A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.1536822008.00000000001A3000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.1536840558.00000000001A4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.1536859722.00000000001A6000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1a0000_JdaybS.jbxd

Similarity

API ID: AddressHandleModuleProcmemset
String ID: NtSystemDebugControl$ntdll.dll
API String ID: 3137504439-2438149413
Opcode ID: 47584cfec704f3b9615c3e64b5be2a9f2a114d6e693574a8a8fa01f7fb1cc583
Instruction ID: 64a453b9f49b3cfaa2fbd372236f44176c8a4abf057f76a74bf860260e851ea1
Opcode Fuzzy Hash: 47584cfec704f3b9615c3e64b5be2a9f2a114d6e693574a8a8fa01f7fb1cc583
Instruction Fuzzy Hash: C6018079600309BFDF11DF98EC85A6FBBA8FF56324F00452AF951E2540E3B08655CB51

Function 001A1DF6 Relevance: 7.5, APIs: 5, Instructions: 45stringCOMMON

Download Yara Rule

APIs

strrchr.MSVCRT ref: 001A1E0B
lstrcpy.KERNEL32(?,00000001), ref: 001A1E1C
strrchr.MSVCRT ref: 001A1E2B
lstrcmpiA.KERNEL32(?,001A4488), ref: 001A1E48
lstrlen.KERNEL32(001A4488), ref: 001A1E53

Memory Dump Source

Source File: 00000003.00000002.1536802905.00000000001A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000003.00000002.1536783269.00000000001A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.1536822008.00000000001A3000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.1536840558.00000000001A4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.1536859722.00000000001A6000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1a0000_JdaybS.jbxd

Similarity

API ID: strrchr$lstrcmpilstrcpylstrlen
String ID:
API String ID: 3636361484-0
Opcode ID: c20477529c9094a51fed3f0480178bf8db15658230ea4f0a830bdc5989cbbdab
Instruction ID: 777740ae4c7a5d9efe6961fee8cdd4b48bef4ee6fb36fcd0ae844ef9397b861c
Opcode Fuzzy Hash: c20477529c9094a51fed3f0480178bf8db15658230ea4f0a830bdc5989cbbdab
Instruction Fuzzy Hash: 1301D6BA9042197FEB215760ED48BD777DCDB06350F040466FA55E2090EBB49EC48BA0

Function 001A6014 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll), ref: 001A603C
GetProcAddress.KERNEL32(00000000,001A6064), ref: 001A604F

Strings

kernel32.dll, xrefs: 001A603B

Memory Dump Source

Source File: 00000003.00000002.1536859722.00000000001A6000.00000040.00000001.01000000.00000004.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000003.00000002.1536783269.00000000001A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.1536802905.00000000001A1000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.1536822008.00000000001A3000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.1536840558.00000000001A4000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1a0000_JdaybS.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: kernel32.dll
API String ID: 1646373207-1793498882
Opcode ID: 48b849ca065d9396b9d2113a686530c5913db49e894d0fc34955d341c7b13c33
Instruction ID: ca1203a42806aa831a0983b6b3afaf3b39691aa7493c5d2b3d566b7bf00d3d1b
Opcode Fuzzy Hash: 48b849ca065d9396b9d2113a686530c5913db49e894d0fc34955d341c7b13c33
Instruction Fuzzy Hash: 0DF0F6F51442899FDF708E64CC44BDE3BE4EB06710F50442AE909CB281DB3886458B14

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may hook into Windows application programming interface (API) functions to collect user credentials. Malicious hooking mechanisms may capture API calls that include parameters that reveal user authentication credentials.Unlike Keylogging , this technique focuses specifically on API functions that include parameters that reveal user credentials. Hooking involves redirecting calls to these functions and can be implemented via:
Tactics:	Collection, Credential Access
Data Sources:	Process: OS API Execution, Process: Process Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit remote services to gain unauthorized access to internal systems once inside of a network. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. A common goal for post-compromise exploitation of remote services is for lateral movement to enable access to a remote system.
Tactics:	Lateral Movement
Data Sources:	Application Log: Application Log Content, Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may deliver payloads to remote systems by adding content to shared storage locations, such as network drives or internal code repositories. Content stored on network drives or in other shared locations may be tainted by adding malicious programs, scripts, or exploit code to otherwise valid files. Once a user opens the shared tainted content, the malicious portion can be executed to run the adversary's code on a remote system. Adversaries may use tainted shared content to move laterally.
Tactics:	Lateral Movement
Data Sources:	File: File Creation, File: File Modification, Network Share: Network Share Access, Process: Process Creation
Platforms:	Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 7Y18r(223).exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Snort Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Exploits

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files (x86)\AutoIt3\Examples\Helpfile\Extras\MyProg.exe

C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe

C:\Program Files\7-Zip\Uninstall.exe

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_JdaybS.exe_9e8ce935e9b7cca551c27c62a0c191c7d9681c5b_6dafb920_a99c52c2-4f7c-4dc1-8fe1-f6af9422e0a1\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WER80D6.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER8386.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER83B6.tmp.xml

C:\Users\user\AppData\Local\Temp\JdaybS.exe

C:\Windows\appcompat\Programs\Amcache.hve

Static File Info

General

Windows Analysis Report
7Y18r(223).exe

Function 00617A10 Relevance: 57.9, APIs: 31, Strings: 2, Instructions: 197
threadsynchronizationsleepCOMMON

Function 00462044 Relevance: 33.4, APIs: 4, Strings: 15, Instructions: 171
fileprocessCOMMON

Function 00612100 Relevance: 33.3, APIs: 16, Strings: 3, Instructions: 90
filesleepmemoryCOMMON

Function 00617FC0 Relevance: 24.5, APIs: 8, Strings: 6, Instructions: 46
libraryloaderCOMMON

Function 006179D0 Relevance: 45.7, APIs: 24, Strings: 2, Instructions: 177
threadmemorysynchronizationCOMMON

Function 00617B65 Relevance: 42.1, APIs: 22, Strings: 2, Instructions: 129
threadsynchronizationsleepCOMMON

Function 0061F6B0 Relevance: 38.7, APIs: 21, Strings: 1, Instructions: 187
networkCOMMON

Function 00616F40 Relevance: 35.5, APIs: 11, Strings: 9, Instructions: 484
stringCOMMON

Function 006135C8 Relevance: 34.7, APIs: 23, Instructions: 176
networkthreadCOMMON

Function 006165C0 Relevance: 33.5, APIs: 9, Strings: 10, Instructions: 247
stringCOMMON

Function 00616D90 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 133
networkCOMMON

Function 00615CC6 Relevance: 19.6, APIs: 6, Strings: 5, Instructions: 377
stringCOMMON

Function 006135D0 Relevance: 18.1, APIs: 12, Instructions: 102
networkthreadCOMMON

Function 0061F9D0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 120
memorystringCOMMON

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre